An interpreted, interactive, object-oriented programming language
CentOS Sources
2017-08-01 71084d584ff953f5463757ec6536406320560b4d
commit | author | age
f63228 1
CS 2 # HG changeset patch
3 # User Benjamin Peterson <benjamin@python.org>
4 # Date 1416798122 21600
5 # Node ID fb83916c3ea12899569e88a7505469a90ab1f674
6 # Parent  c84f36a5f556867c2ec50453dc879a500032d377
7 pep 476: verify certificates by default (#22417)
8
9 diff --git a/Doc/library/httplib.rst b/Doc/library/httplib.rst
10 --- a/Doc/library/httplib.rst
11 +++ b/Doc/library/httplib.rst
12 @@ -90,9 +90,6 @@ The module provides the following classe
13        server's certificate.  If you want to change that behaviour, you can
14        explicitly set *check_hostname* to False.
15  
16 -   .. warning::
17 -      This does not do any verification of the server's certificate.
18 -
19     .. versionadded:: 2.0
20  
21     .. versionchanged:: 2.6
22 @@ -104,6 +101,11 @@ The module provides the following classe
23     .. versionchanged:: 2.7.9
24        *context* and *check_hostname* was added.
25  
26 +      This class now performs all the necessary certificate and hostname checks
27 +      by default. To revert to the previous, unverified, behavior
28 +      :func:`ssl._create_unverified_context` can be passed to the *context*
29 +      parameter.
30 +
31  
32  .. class:: HTTPResponse(sock, debuglevel=0, strict=0)
33  
34 diff --git a/Lib/httplib.py b/Lib/httplib.py
35 --- a/Lib/httplib.py
36 +++ b/Lib/httplib.py
37 @@ -1193,7 +1193,7 @@ else:
38              self.key_file = key_file
39              self.cert_file = cert_file
40              if context is None:
41 -                context = ssl.create_default_context()
42 +                context = ssl._create_default_https_context()
43              will_verify = context.verify_mode != ssl.CERT_NONE
44              if check_hostname is None:
45                  check_hostname = will_verify
46 diff --git a/Lib/ssl.py b/Lib/ssl.py
47 --- a/Lib/ssl.py
48 +++ b/Lib/ssl.py
49 @@ -427,8 +427,7 @@ def create_default_context(purpose=Purpo
50          context.load_default_certs(purpose)
51      return context
52  
53 -
54 -def _create_stdlib_context(protocol=PROTOCOL_SSLv23, cert_reqs=None,
55 +def _create_unverified_context(protocol=PROTOCOL_SSLv23, cert_reqs=None,
56                             check_hostname=False, purpose=Purpose.SERVER_AUTH,
57                             certfile=None, keyfile=None,
58                             cafile=None, capath=None, cadata=None):
59 @@ -469,6 +468,14 @@ def _create_stdlib_context(protocol=PROT
60  
61      return context
62  
63 +# Used by http.client if no context is explicitly passed.
64 +_create_default_https_context = create_default_context
65 +
66 +
67 +# Backwards compatibility alias, even though it's not a public name.
68 +_create_stdlib_context = _create_unverified_context
69 +
70 +
71  class SSLSocket(socket):
72      """This class implements a subtype of socket.socket that wraps
73      the underlying OS socket in an SSL context when necessary, and
74 diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
75 --- a/Lib/test/test_httplib.py
76 +++ b/Lib/test/test_httplib.py
77 @@ -1,10 +1,9 @@
78  import httplib
79  import array
80 -import httplib
81 -import os
82  import StringIO
83  import socket
84  import errno
85 +import os
86  
87  import unittest
88  TestCase = unittest.TestCase
89 diff --git a/Lib/test/test_urllib2_localnet.py b/Lib/test/test_urllib2_localnet.py
90 --- a/Lib/test/test_urllib2_localnet.py
91 +++ b/Lib/test/test_urllib2_localnet.py
92 @@ -5,6 +5,7 @@ import urllib2
93  import BaseHTTPServer
94  import unittest
95  import hashlib
96 +import ssl
97  
98  from test import test_support
99  
100 @@ -562,15 +563,37 @@ class TestUrlopen(BaseTestCase):
101                              cafile=CERT_localhost)
102          self.assertEqual(data, b"we care a bit")
103          # Bad cert
104 -        with self.assertRaises(urllib2.URLError) as cm:
105 +        with self.assertRaises(urllib2.URLError):
106              self.urlopen("https://localhost:%s/bizarre" % handler.port,
107                           cafile=CERT_fakehostname)
108          # Good cert, but mismatching hostname
109          handler = self.start_https_server(certfile=CERT_fakehostname)
110 -        with self.assertRaises(ssl.CertificateError) as cm:
111 +        with self.assertRaises(ssl.CertificateError):
112              self.urlopen("https://localhost:%s/bizarre" % handler.port,
113                           cafile=CERT_fakehostname)
114  
115 +    def test_https_with_cadefault(self):
116 +        handler = self.start_https_server(certfile=CERT_localhost)
117 +        # Self-signed cert should fail verification with system certificate store
118 +        with self.assertRaises(urllib2.URLError):
119 +            self.urlopen("https://localhost:%s/bizarre" % handler.port,
120 +                         cadefault=True)
121 +
122 +    def test_https_sni(self):
123 +        if ssl is None:
124 +            self.skipTest("ssl module required")
125 +        if not ssl.HAS_SNI:
126 +            self.skipTest("SNI support required in OpenSSL")
127 +        sni_name = [None]
128 +        def cb_sni(ssl_sock, server_name, initial_context):
129 +            sni_name[0] = server_name
130 +        context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
131 +        context.set_servername_callback(cb_sni)
132 +        handler = self.start_https_server(context=context, certfile=CERT_localhost)
133 +        context = ssl.create_default_context(cafile=CERT_localhost)
134 +        self.urlopen("https://localhost:%s" % handler.port, context=context)
135 +        self.assertEqual(sni_name[0], "localhost")
136 +
137      def test_sending_headers(self):
138          handler = self.start_server([(200, [], "we don't care")])
139  
140 diff -up Python-2.7.5/Doc/library/xmlrpclib.rst.ver Python-2.7.5/Doc/library/xmlrpclib.rst
141 --- Python-2.7.5/Doc/library/xmlrpclib.rst.ver    2015-03-30 13:59:29.243493601 +0200
142 +++ Python-2.7.5/Doc/library/xmlrpclib.rst    2015-03-30 14:03:40.509532180 +0200
143 @@ -34,6 +34,10 @@ between conformable Python objects and X
144     constructed data.  If you need to parse untrusted or unauthenticated data see
145     :ref:`xml-vulnerabilities`.
146  
147 +.. versionchanged:: 2.7.9
148 +
149 +   For https URIs, :mod:`xmlrpclib` now performs all the necessary certificate
150 +   and hostname checks by default
151  
152  .. class:: ServerProxy(uri[, transport[, encoding[, verbose[,  allow_none[, use_datetime]]]]])
153