SERVICE_IDENTITY(1)

NAME
service_identity - service_identity Documentation

Release v18.1.0 (What's new?).

Use this package if:

•   you use pyOpenSSL and don’t want to be MITMed or

•   if you want to verify that a PyCA cryptography certificate is valid for a certain hostname or IP address.

    service_identity aspires to give you all the tools you need for verifying whether a certificate is valid for the intended purposes.

    In the simplest case, this means host name verification. However, service_identity implements RFC 6125 fully and plans to add other relevant RFCs too.

    service_identity’s documentation lives at Read the Docs, the code on GitHub.

USER'S GUIDE

  Installation and Requirements

  Installation

$ pip install service_identity

  Requirements

Python 2.7, 3.4 and later, as well as PyPy are supported.

Additionally, the following PyPI packages are required:

•   attrs

•   pyOpenSSL >= 0.14 (0.12 and 0.13 may work but are not part of CI anymore)

•   pyasn1

•   pyasn1-modules

•   ipaddress on Python 2.7

    Optionally, idna >= 0.6 can be used for internationalized domain names (IDN), i.e. non-ASCII domains. Unfortunately it’s required because Python’s IDN support in the standard library is outdated even in the latest releases.

    If you need Python 3.2 support, you will have to use the latest 0.2.x release. If you need Python 2.6 or 3.3 support, you will have to use the latest 14.0.x release. They will receive bug fix releases if necessary but other than that no further development is planned.

  Implemented Standards

  Present

•   dNSName with fallback to CN (DNS-ID, aka host names, RFC 6125).

•   iPAddress (RFC 2818).

•   uniformResourceIdentifier (URI-ID, RFC 6125).

•   SRV-ID (RFC 6125)

  Future

•   xmppAddr (RFC 3920).

•   nameConstraints extensions (RFC 3280).

  API

NOTE: So far, public APIs are only available for hostnames (RFC 6125) and IP addresses (RFC 2818). All IDs specified by RFC 6125 are already implemented though. If you'd like to play with them and provide feedback have a look at the verify_service_identity function in the _common module.

  pyOpenSSL

  PyCA cryptography

  Universal Errors and Warnings

  Project Information

  Backward Compatibility

service_identity has a very strong backward compatibility policy. Generally speaking, you shouldn't ever be afraid of updating.

If breaking changes are needed do be done, they are:

1.  …announced in the changelog.

2.  …the old behavior raises a DeprecationWarning for a year.

3.  …are done with another announcement in the changelog.

  License

service_identity is licensed under the MIT license. The full license text can be also found in the source code repository.

  Authors

service_identity is written and maintained by Hynek Schlawack.

The development is kindly supported by Variomedia AG.

Other contributors can be found in GitHub's overview.

  How To Contribute

First off, thank you for considering contributing to service_identity! It's people like you who make it such a great tool for everyone.

This document intends to make contribution more accessible by codifying tribal knowledge and expectations. Don't be afraid to open half-finished PRs, and ask questions if something is unclear!

  Workflow

•   No contribution is too small! Please submit as many fixes for typos and grammar bloopers as you can!

•   Try to limit each pull request to one change only.

•   Since we squash on merge, it's up to you how you handle updates to the master branch. Whether you prefer to rebase on master or merge master into your branch, do whatever is more comfortable for you.

•   Always add tests and docs for your code. This is a hard rule; patches with missing tests or documentation can't be merged.

•   Make sure your changes pass our CI. You won't get any feedback until it's green unless you ask for it.

•   Once you've addressed review feedback, make sure to bump the pull request with a short note, so we know you're done.

•   Don’t break backward compatibility.

  Code

•   Obey PEP 8 and PEP 257. We use the """-on-separate-lines style for docstrings:

    def func(x):
        """
        Do something.
        :param str x: A very important parameter.
        :rtype: str
        """

•   If you add or change public APIs, tag the docstring using .. versionadded:: 16.0.0 WHAT or .. versionchanged:: 16.2.0 WHAT.

•   We use isort to sort our imports, and we follow the Black code style with a line length of 79 characters. As long as you run our full tox suite before committing, or install our pre-commit hooks (ideally you'll do both -- see below "Local Development Environment"), you won't have to spend any time on formatting your code at all. If you don't, CI will catch it for you -- but that seems like a waste of your time!

  Tests

•   Write your asserts as expected == actual to line them up nicely:

    x = f()
    assert 42 == x.some_attribute
    assert "foo" == x._a_private_attribute

•   To run the test suite, all you need is a recent tox. It will ensure the test suite runs with all dependencies against all Python versions just as it will on Travis CI. If you lack some Python versions, you can can make it a non-failure using tox --skip-missing-interpreters (in that case you may want to look into pyenv that makes it very easy to install many different Python versions in parallel).

•   Write good test docstrings.

  Documentation

•   Use semantic newlines in reStructuredText files (files ending in .rst):

    This is a sentence.
    This is another sentence.

•   If you start a new section, add two blank lines before and one blank line after the header except if two headers follow immediately after each other:

    Last line of previous section.
    Header of New Top Section
    -------------------------
    Header of New Section
    ^^^^^^^^^^^^^^^^^^^^^
    First line of new section.

•   If your change is noteworthy, add an entry to the changelog. Use semantic newlines, and add a link to your pull request:

    - Added ``service_identity.func()`` that does foo.
      It's pretty cool.
      [`#1 <https://github.com/pyca/service_identity/pull/1>`_]
    - ``service_identity.func()`` now doesn't crash the Large Hadron Collider anymore.
      That was a nasty bug!
      [`#2 <https://github.com/pyca/service_identity/pull/2>`_]

  Local Development Environment

You can (and should) run our test suite using tox. However you’ll probably want a more traditional environment too. We highly recommend to develop using the latest Python 3 release.

First create a virtual environment. It’s out of scope for this document to list all the ways to manage virtual environments in Python but if you don’t have already a pet way, take some time to look at tools like pew, virtualfish, and virtualenvwrapper.

Next, get an up to date checkout of the service_identity repository:

$ git checkout git@github.com:pyca/service_identity.git

Change into the newly created directory and after activating your virtual environment install an editable version of service_identity along with its tests and docs requirements:

$ cd service_identity
$ pip install -e .[dev]

At this point

$ python -m pytest

should work and pass, as should:

$ cd docs
$ make html

The built documentation can then be found in docs/_build/html/.

To avoid committing code that violates our style guide, we strongly advise you to install pre-commit [1] hooks:

$ pre-commit install

You can also run them anytime (as our tox does) using:

$ pre-commit run --all-files

[1] pre-commit should have been installed into your virtualenv automatically when you ran pip install -e '.[dev]' above. If pre-commit is missing, it may be that you need to re-run pip install -e '.[dev]'.

    ----

    Please note that this project is released with a Contributor Code of Conduct. By participating in this project you agree to abide by its terms. Please report any harm to Hynek Schlawack in any way you find appropriate. We can usually be found in the #cryptography-dev channel on freenode.

    Thank you for considering to contribute to service_identity!

  Contributor Covenant Code of Conduct

  Our Pledge

In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to make participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, gender identity and expression, level of experience, nationality, personal appearance, race, religion, or sexual identity and orientation.

  Our Standards

Examples of behavior that contributes to creating a positive environment include:

•   Using welcoming and inclusive language

•   Being respectful of differing viewpoints and experiences

•   Gracefully accepting constructive criticism

•   Focusing on what is best for the community

•   Showing empathy towards other community members

    Examples of unacceptable behavior by participants include:

•   The use of sexualized language or imagery and unwelcome sexual attention or advances

•   Trolling, insulting/derogatory comments, and personal or political attacks

•   Public or private harassment

•   Publishing others' private information, such as a physical or electronic address, without explicit permission

•   Other conduct which could reasonably be considered inappropriate in a professional setting

  Our Responsibilities

Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.

Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.

  Scope

This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community include using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.

  Enforcement

Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at hs@ox.cx. All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.

Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.

  Attribution

This Code of Conduct is adapted from the Contributor Covenant, version 1.4, available at <https://www.contributor-covenant.org/version/1/4/code-of-conduct.html>.

  Changelog

Versions follow CalVer with a strict backwards compatibility policy. The third digit is only for regressions.

  18.1.0 (2018-12-05)

  Changes:

•   pyOpenSSL is optional now if you use service_identity.cryptography.* only.

•   Added support for iPAddress subjectAltNames. You can now verify whether a connection or a certificate is valid for an IP address using service_identity.pyopenssl.verify_ip_address() and service_identity.cryptography.verify_certificate_ip_address(). #12

    ----

  17.0.0 (2017-05-23)

  Deprecations:

•   Since Chrome 58 and Firefox 48 both don't accept certificates that contain only a Common Name, its usage is hereby deprecated in service_identity too. We have been raising a warning since 16.0.0 and the support will be removed in mid-2018 for good.

  Changes:

•   When service_identity.SubjectAltNameWarning is raised, the Common Name of the certificate is now included in the warning message. #17

•   Added cryptography.x509 backend for verifying certificates. #18

•   Wildcards (*) are now only allowed if they are the leftmost label in a certificate. This is common practice by all major browsers. #19

    ----

  16.0.0 (2016-02-18)

  Backward-incompatible changes:

•   Python 3.3 and 2.6 aren't supported anymore. They may work by chance but any effort to keep them working has ceased.

    The last Python 2.6 release was on October 29, 2013 and isn't supported by the CPython core team anymore. Major Python packages like Django and Twisted dropped Python 2.6 a while ago already.

    Python 3.3 never had a significant user base and wasn't part of any distribution's LTS release.

•   pyOpenSSL versions older than 0.14 are not tested anymore. They don't even build on recent OpenSSL versions. Please note that its support may break without further notice.

  Changes:

•   Officially support Python 3.5.

•   service_identity.SubjectAltNameWarning is now raised if the server certicate lacks a proper SubjectAltName. #9

•   Add a __str__ method to VerificationError.

•   Port from characteristic to its spiritual successor attrs.

    ----

  14.0.0 (2014-08-22)

  Changes:

•   Switch to year-based version numbers.

•   Port to characteristic 14.0 (get rid of deprecation warnings).

•   Package docs with sdist.

    ----

  1.0.0 (2014-06-15)

  Backward-incompatible changes:

•   Drop support for Python 3.2. There is no justification to add complexity and unnecessary function calls for a Python version that nobody uses.

  Changes:

•   Move into the Python Cryptography Authority’s GitHub account.

•   Move exceptions into service_identity.exceptions so tracebacks don’t contain private module names.

•   Promoting to stable since Twisted 14.0 is optionally depending on service_identity now.

•   Use characteristic instead of a home-grown solution.

•   idna 0.6 did some backward-incompatible fixes that broke Python 3 support. This has been fixed now therefore service_identity only works with idna 0.6 and later. Unfortunately since idna doesn’t offer version introspection, service_identity can’t warn about it.

    ----

  0.2.0 (2014-04-06)

  Backward-incompatible changes:

•   Refactor into a multi-module package. Most notably, verify_hostname and extract_ids live in the service_identity.pyopenssl module now.

•   verify_hostname now takes an OpenSSL.SSL.Connection for the first argument.

  Changes:

•   Less false positives in IP address detection.

•   Officially support Python 3.4 too.

•   More strict checks for URI_IDs.

    ----

  0.1.0 (2014-03-03)

Initial release.

INDICES AND TABLES

•   genindex

•   search

AUTHOR
Hynek Schlawack

COPYRIGHT
2019, Hynek Schlawack