wrap wolfSSL_check_domain_name, add SSLContext.check_hostname

Author: cconlon

src/wolfssl/__init__.py

@@ -150,6 +150,7 @@ def __init__(self, protocol, server_side=None):
         self.protocol = protocol
         self._server_side = server_side
         self._verify_mode = None
+        self._check_hostname = False
         self.native_object = _lib.wolfSSL_CTX_new(method.native_object)
 
         # wolfSSL_CTX_new() takes ownership of the method.
@@ -188,6 +189,23 @@ def verify_mode(self, value):
                                         self._verify_mode,
                                         _ffi.NULL)
 
+    @property
+    def check_hostname(self):
+        """
+        Whether to match the peer certificate's hostname with match_hostname()
+        in SSLSocket.do_handshake(). Context's verify mode must be set to
+        CERT_REQUIRED, and the server hostname must be passed to wrap_socket()
+        in order to match the hostname.
+        """
+        return self._check_hostname
+
+    @check_hostname.setter
+    def check_hostname(self, value):
+        if value is not True and value is not False:
+            raise ValueError("check_hostname must be either True or False")
+
+        self._check_hostname = value
+
     def get_options(self):
         """
         Wrap native wolfSSL_CTX_get_options() function.
@@ -431,6 +449,12 @@ def __init__(self, sock=None, keyfile=None, certfile=None,
             self._release_native_object()
             raise ValueError("Unnable to set fd to ssl object")
 
+        # match domain name / host name if set in context
+        if server_hostname is not None:
+            if self._context.check_hostname:
+                _lib.wolfSSL_check_domain_name(self.native_object,
+                                               server_hostname)
+
         if connected:
             try:
                 if do_handshake_on_connect:

src/wolfssl/_build_ffi.py

@@ -103,6 +103,7 @@
     int wolfSSL_shutdown(void*);
     void* wolfSSL_get_peer_certificate(void*);
     int wolfSSL_UseSNI(void*, unsigned char, const void*, unsigned short);
+    int wolfSSL_check_domain_name(void*, const char*);
 
     /**
      * WOLFSSL_X509 functions