Blame SOURCES/00224-pep476-add-toggle-for-cert-verify.patch

f63228
diff -up Python-2.7.5/Lib/ssl.py.cert Python-2.7.5/Lib/ssl.py
f63228
--- Python-2.7.5/Lib/ssl.py.cert	2015-03-30 14:52:12.172241615 +0200
f63228
+++ Python-2.7.5/Lib/ssl.py	2015-03-30 15:16:49.168185354 +0200
f63228
@@ -466,8 +466,27 @@ def _create_unverified_context(protocol=
f63228
 
f63228
     return context
f63228
 
f63228
+_cert_verification_config = '/etc/python/cert-verification.cfg'
f63228
+
f63228
+def _get_verify_status(protocol):
f63228
+   context_factory = {
f63228
+       'platform_default': _create_unverified_context,
f63228
+       'enable': create_default_context,
f63228
+       'disable': _create_unverified_context
f63228
+   }
f63228
+   import ConfigParser
f63228
+   try:
f63228
+       config = ConfigParser.RawConfigParser()
f63228
+       config.read(_cert_verification_config)
f63228
+       status = config.get(protocol, 'verify')
f63228
+   except (ConfigParser.NoSectionError, ConfigParser.NoOptionError):
f63228
+       status = 'platform_default'
f63228
+   default = context_factory.get('platform_default')
f63228
+   return context_factory.get(status, default)
f63228
+
f63228
+
f63228
 # Used by http.client if no context is explicitly passed.
f63228
-_create_default_https_context = create_default_context
f63228
+_create_default_https_context = _get_verify_status('https')
f63228
 
f63228
 
f63228
 # Backwards compatibility alias, even though it's not a public name.
f63228
diff -up Python-2.7.5/Lib/test/test_httplib.py.cert Python-2.7.5/Lib/test/test_httplib.py
f63228
--- Python-2.7.5/Lib/test/test_httplib.py.cert	2015-03-30 16:45:30.738794461 +0200
f63228
+++ Python-2.7.5/Lib/test/test_httplib.py	2015-03-30 16:54:48.065062351 +0200
f63228
@@ -516,12 +516,24 @@ class HTTPSTest(TestCase):
f63228
         h = httplib.HTTPSConnection(HOST, TimeoutTest.PORT, timeout=30)
f63228
         self.assertEqual(h.timeout, 30)
f63228
 
f63228
+    def test_networked_default(self):
f63228
+        # specific to RHEL
f63228
+        # Default settings: doesnt requires a valid cert from a trusted CA
f63228
+        test_support.requires('network')
f63228
+        with test_support.transient_internet('self-signed.pythontest.net'):
f63228
+            h = httplib.HTTPSConnection('self-signed.pythontest.net', 443)
f63228
+            h.request('GET', '/')
f63228
+            resp = h.getresponse()
f63228
+            self.assertIn('nginx', resp.getheader('server'))
f63228
+
f63228
+    # We have to pass safe context to test cert verification
f63228
+    # RHEL by default disable cert verification
f63228
     def test_networked(self):
f63228
-        # Default settings: requires a valid cert from a trusted CA
f63228
         import ssl
f63228
         test_support.requires('network')
f63228
         with test_support.transient_internet('self-signed.pythontest.net'):
f63228
-            h = httplib.HTTPSConnection('self-signed.pythontest.net', 443)
f63228
+            context = ssl.create_default_context()
f63228
+            h = httplib.HTTPSConnection('self-signed.pythontest.net', 443, context=context)
f63228
             with self.assertRaises(ssl.SSLError) as exc_info:
f63228
                 h.request('GET', '/')
f63228
             self.assertEqual(exc_info.exception.reason, 'CERTIFICATE_VERIFY_FAILED')
f63228
@@ -542,8 +554,10 @@ class HTTPSTest(TestCase):
f63228
     def test_networked_trusted_by_default_cert(self):
f63228
         # Default settings: requires a valid cert from a trusted CA
f63228
         test_support.requires('network')
f63228
+        import ssl
f63228
         with test_support.transient_internet('www.python.org'):
f63228
-            h = httplib.HTTPSConnection('www.python.org', 443)
f63228
+            context = ssl.create_default_context()
f63228
+            h = httplib.HTTPSConnection('www.python.org', 443, context=context)
f63228
             h.request('GET', '/')
f63228
             resp = h.getresponse()
f63228
             content_type = resp.getheader('content-type')
f63228
@@ -579,7 +592,8 @@ class HTTPSTest(TestCase):
f63228
         # The custom cert isn't known to the default trust bundle
f63228
         import ssl
f63228
         server = self.make_server(CERT_localhost)
f63228
-        h = httplib.HTTPSConnection('localhost', server.port)
f63228
+        context = ssl.create_default_context()
f63228
+        h = httplib.HTTPSConnection('localhost', server.port, context=context)
f63228
         with self.assertRaises(ssl.SSLError) as exc_info:
f63228
             h.request('GET', '/')
f63228
         self.assertEqual(exc_info.exception.reason, 'CERTIFICATE_VERIFY_FAILED')
f63228
@@ -624,6 +638,9 @@ class HTTPSTest(TestCase):
f63228
         for hp in ("www.python.org:abc", "user:password@www.python.org"):
f63228
             self.assertRaises(httplib.InvalidURL, httplib.HTTPSConnection, hp)
f63228
 
f63228
+        import ssl
f63228
+        context = ssl.create_default_context()
f63228
+
f63228
         for hp, h, p in (("[fe80::207:e9ff:fe9b]:8000",
f63228
                           "fe80::207:e9ff:fe9b", 8000),
f63228
                          ("www.python.org:443", "www.python.org", 443),
f63228
@@ -632,7 +648,7 @@ class HTTPSTest(TestCase):
f63228
                          ("[fe80::207:e9ff:fe9b]", "fe80::207:e9ff:fe9b", 443),
f63228
                          ("[fe80::207:e9ff:fe9b]:", "fe80::207:e9ff:fe9b",
f63228
                              443)):
f63228
-            c = httplib.HTTPSConnection(hp)
f63228
+            c = httplib.HTTPSConnection(hp, context=context)
f63228
             self.assertEqual(h, c.host)
f63228
             self.assertEqual(p, c.port)
f63228