|
 |
930f77 |
diff --git a/setuptools/ssl_support.py b/setuptools/ssl_support.py
|
|
|
930f77 |
--- a/setuptools/ssl_support.py
|
|
|
930f77 |
+++ b/setuptools/ssl_support.py
|
|
|
930f77 |
@@ -194,6 +194,12 @@
|
|
|
930f77 |
sock = create_connection(
|
|
|
930f77 |
(self.host, self.port), getattr(self,'source_address',None)
|
|
|
930f77 |
)
|
|
|
930f77 |
+
|
|
|
930f77 |
+ # Handle the socket if a (proxy) tunnel is present
|
|
|
930f77 |
+ if hasattr(self, '_tunnel') and getattr(self, '_tunnel_host', None):
|
|
|
930f77 |
+ self.sock = sock
|
|
|
930f77 |
+ self._tunnel()
|
|
|
930f77 |
+
|
|
|
930f77 |
self.sock = ssl.wrap_socket(
|
|
|
930f77 |
sock, cert_reqs=ssl.CERT_REQUIRED, ca_certs=self.ca_bundle
|
|
|
930f77 |
)
|
|
|
930f77 |
# HG changeset patch
|
|
|
930f77 |
# User Raphael Kubo da Costa <raphael.kubo.da.costa@intel.com>
|
|
|
930f77 |
# Date 1404396219 -10800
|
|
|
930f77 |
# Node ID ca4b86f318ecf4cb46462e65a86fc814295124e8
|
|
|
930f77 |
# Parent 2381b11608897723145601dac345b9a4c981f3cb
|
|
|
930f77 |
ssl_support: Adjust to tunneling changes in Python 2.7.7 and 3.4.1.
|
|
|
930f77 |
|
|
|
930f77 |
The fix for https://bugs.python.org/issue7776 changed httplib.HTTPConnection's
|
|
|
930f77 |
handling of tunneling: `host' now points to the proxy host, so we have to
|
|
|
930f77 |
adjust the code to perform the certificate validation on `_tunnel_host' instead
|
|
|
930f77 |
when it is available.
|
|
|
930f77 |
|
|
|
930f77 |
diff --git a/setuptools/ssl_support.py b/setuptools/ssl_support.py
|
|
|
930f77 |
--- a/setuptools/ssl_support.py
|
|
|
930f77 |
+++ b/setuptools/ssl_support.py
|
|
|
930f77 |
@@ -178,12 +178,19 @@
|
|
|
930f77 |
if hasattr(self, '_tunnel') and getattr(self, '_tunnel_host', None):
|
|
|
930f77 |
self.sock = sock
|
|
|
930f77 |
self._tunnel()
|
|
|
930f77 |
+ # http://bugs.python.org/issue7776: Python>=3.4.1 and >=2.7.7
|
|
|
930f77 |
+ # change self.host to mean the proxy server host when tunneling is
|
|
|
930f77 |
+ # being used. Adapt, since we are interested in the destination
|
|
|
930f77 |
+ # host for the match_hostname() comparison.
|
|
|
930f77 |
+ actual_host = self._tunnel_host
|
|
|
930f77 |
+ else:
|
|
|
930f77 |
+ actual_host = self.host
|
|
|
930f77 |
|
|
|
930f77 |
self.sock = ssl.wrap_socket(
|
|
|
930f77 |
sock, cert_reqs=ssl.CERT_REQUIRED, ca_certs=self.ca_bundle
|
|
|
930f77 |
)
|
|
|
930f77 |
try:
|
|
|
930f77 |
- match_hostname(self.sock.getpeercert(), self.host)
|
|
|
930f77 |
+ match_hostname(self.sock.getpeercert(), actual_host)
|
|
|
930f77 |
except CertificateError:
|
|
|
930f77 |
self.sock.shutdown(socket.SHUT_RDWR)
|
|
|
930f77 |
self.sock.close()
|