diff options
| -rw-r--r-- | paramiko/client.py | 8 | ||||
| -rw-r--r-- | paramiko/transport.py | 18 | ||||
| -rw-r--r-- | sites/www/changelog.rst | 2 | ||||
| -rw-r--r-- | tests/test_client.py | 10 | ||||
| -rw-r--r-- | tests/test_transport.py | 2 |
5 files changed, 20 insertions, 20 deletions
diff --git a/paramiko/client.py b/paramiko/client.py index b8e043a3..3d8f2dd4 100644 --- a/paramiko/client.py +++ b/paramiko/client.py @@ -236,7 +236,7 @@ class SSHClient(ClosingContextManager): auth_timeout=None, gss_trust_dns=True, passphrase=None, - disable_algorithms=None, + disabled_algorithms=None, ): """ Connect to an SSH server and authenticate to it. The server's host key @@ -311,7 +311,7 @@ class SSHClient(ClosingContextManager): for the SSH banner to be presented. :param float auth_timeout: an optional timeout (in seconds) to wait for an authentication response. - :param dict disable_algorithms: + :param dict disabled_algorithms: an optional dict passed directly to `.Transport` and its keyword argument of the same name. @@ -332,7 +332,7 @@ class SSHClient(ClosingContextManager): .. versionchanged:: 2.4 Added the ``passphrase`` argument. .. versionchanged:: 2.6 - Added the ``disable_algorithms`` argument. + Added the ``disabled_algorithms`` argument. """ if not sock: errors = {} @@ -371,7 +371,7 @@ class SSHClient(ClosingContextManager): sock, gss_kex=gss_kex, gss_deleg_creds=gss_deleg_creds, - disable_algorithms=disable_algorithms, + disabled_algorithms=disabled_algorithms, ) t.use_compression(compress=compress) t.set_gss_host( diff --git a/paramiko/transport.py b/paramiko/transport.py index ba9308a1..fa3cb661 100644 --- a/paramiko/transport.py +++ b/paramiko/transport.py @@ -146,7 +146,7 @@ class Transport(threading.Thread, ClosingContextManager): # These tuples of algorithm identifiers are in preference order; do not # reorder without reason! # NOTE: if you need to modify these, we suggest leveraging the - # `disable_algorithms` constructor argument (also available in SSHClient) + # `disabled_algorithms` constructor argument (also available in SSHClient) # instead of monkeypatching or subclassing. _preferred_ciphers = ( "aes128-ctr", @@ -309,7 +309,7 @@ class Transport(threading.Thread, ClosingContextManager): default_max_packet_size=DEFAULT_MAX_PACKET_SIZE, gss_kex=False, gss_deleg_creds=True, - disable_algorithms=None, + disabled_algorithms=None, ): """ Create a new SSH session over an existing socket, or socket-like @@ -356,7 +356,7 @@ class Transport(threading.Thread, ClosingContextManager): :param bool gss_deleg_creds: Whether to enable GSSAPI credential delegation when GSSAPI is in play. Default: ``True``. - :param dict disable_algorithms: + :param dict disabled_algorithms: If given, must be a dictionary mapping algorithm type to an iterable of algorithm identifiers, which will be disabled for the lifetime of the transport. @@ -370,7 +370,7 @@ class Transport(threading.Thread, ClosingContextManager): For example, if you need to disable ``diffie-hellman-group16-sha512`` key exchange (perhaps because your code talks to a server which implements it differently from - Paramiko), specify ``disable_algorithms={"kex": + Paramiko), specify ``disabled_algorithms={"kex": ["diffie-hellman-group16-sha512"]}``. .. versionchanged:: 1.15 @@ -379,7 +379,7 @@ class Transport(threading.Thread, ClosingContextManager): .. versionchanged:: 1.15 Added the ``gss_kex`` and ``gss_deleg_creds`` kwargs. .. versionchanged:: 2.6 - Added the ``disable_algorithms`` kwarg. + Added the ``disabled_algorithms`` kwarg. """ self.active = False self.hostname = None @@ -487,9 +487,7 @@ class Transport(threading.Thread, ClosingContextManager): self.handshake_timeout = 15 # how long (seconds) to wait for the auth response. self.auth_timeout = 30 - - # Note change from verb to plural noun. - self.disabled_algorithms = disable_algorithms or {} + self.disabled_algorithms = disabled_algorithms or {} # server mode: self.server_mode = False @@ -502,7 +500,9 @@ class Transport(threading.Thread, ClosingContextManager): def _filter_algorithm(self, type_): default = getattr(self, "_preferred_{}".format(type_)) return tuple( - x for x in default if x not in self.disabled_algorithms.get(type_, []) + x + for x in default + if x not in self.disabled_algorithms.get(type_, []) ) @property diff --git a/sites/www/changelog.rst b/sites/www/changelog.rst index 23ae18ad..9e9275f6 100644 --- a/sites/www/changelog.rst +++ b/sites/www/changelog.rst @@ -4,7 +4,7 @@ Changelog - :feature:`1463` Add a new keyword argument to `SSHClient.connect <paramiko.client.SSHClient.connect>` and `~paramiko.transport.Transport`, - ``disable_algorithms``, which allows selectively disabling one or more + ``disabled_algorithms``, which allows selectively disabling one or more kex/key/cipher/etc algorithms. This can be useful when disabling algorithms your target server (or client) does not support cleanly, or to work around unpatched bugs in Paramiko's own implementation thereof. diff --git a/tests/test_client.py b/tests/test_client.py index f40c38c1..ad5c36ad 100644 --- a/tests/test_client.py +++ b/tests/test_client.py @@ -656,19 +656,19 @@ class SSHClientTest(ClientTest): assert isinstance(client._policy, paramiko.AutoAddPolicy) @patch("paramiko.client.Transport") - def test_disable_algorithms_defaults_to_None(self, Transport): + def test_disabled_algorithms_defaults_to_None(self, Transport): SSHClient().connect("host", sock=Mock(), password="no") - assert Transport.call_args[1]["disable_algorithms"] is None + assert Transport.call_args[1]["disabled_algorithms"] is None @patch("paramiko.client.Transport") - def test_disable_algorithms_passed_directly_if_given(self, Transport): + def test_disabled_algorithms_passed_directly_if_given(self, Transport): SSHClient().connect( "host", sock=Mock(), password="no", - disable_algorithms={"keys": ["ssh-dss"]}, + disabled_algorithms={"keys": ["ssh-dss"]}, ) - call_arg = Transport.call_args[1]["disable_algorithms"] + call_arg = Transport.call_args[1]["disabled_algorithms"] assert call_arg == {"keys": ["ssh-dss"]} diff --git a/tests/test_transport.py b/tests/test_transport.py index f4e824d0..9612ada7 100644 --- a/tests/test_transport.py +++ b/tests/test_transport.py @@ -1115,7 +1115,7 @@ class AlgorithmDisablingTests(unittest.TestCase): def test_preferred_lists_filter_disabled_algorithms(self): t = Transport( sock=Mock(), - disable_algorithms={ + disabled_algorithms={ "ciphers": ["aes128-cbc"], "macs": ["hmac-md5"], "keys": ["ssh-dss"], |