Blame SOURCES/00223-pep476-verify-certs-by-default.patch

057d67
057d67
# HG changeset patch
057d67
# User Benjamin Peterson <benjamin@python.org>
057d67
# Date 1416798122 21600
057d67
# Node ID fb83916c3ea12899569e88a7505469a90ab1f674
057d67
# Parent  c84f36a5f556867c2ec50453dc879a500032d377
057d67
pep 476: verify certificates by default (#22417)
057d67
057d67
diff --git a/Doc/library/httplib.rst b/Doc/library/httplib.rst
057d67
--- a/Doc/library/httplib.rst
057d67
+++ b/Doc/library/httplib.rst
057d67
@@ -90,9 +90,6 @@ The module provides the following classe
057d67
       server's certificate.  If you want to change that behaviour, you can
057d67
       explicitly set *check_hostname* to False.
057d67
 
057d67
-   .. warning::
057d67
-      This does not do any verification of the server's certificate.
057d67
-
057d67
    .. versionadded:: 2.0
057d67
 
057d67
    .. versionchanged:: 2.6
057d67
@@ -104,6 +101,11 @@ The module provides the following classe
057d67
    .. versionchanged:: 2.7.9
057d67
       *context* and *check_hostname* was added.
057d67
 
057d67
+      This class now performs all the necessary certificate and hostname checks
057d67
+      by default. To revert to the previous, unverified, behavior
057d67
+      :func:`ssl._create_unverified_context` can be passed to the *context*
057d67
+      parameter.
057d67
+
057d67
 
057d67
 .. class:: HTTPResponse(sock, debuglevel=0, strict=0)
057d67
 
057d67
diff --git a/Lib/httplib.py b/Lib/httplib.py
057d67
--- a/Lib/httplib.py
057d67
+++ b/Lib/httplib.py
057d67
@@ -1193,7 +1193,7 @@ else:
057d67
             self.key_file = key_file
057d67
             self.cert_file = cert_file
057d67
             if context is None:
057d67
-                context = ssl.create_default_context()
057d67
+                context = ssl._create_default_https_context()
057d67
             will_verify = context.verify_mode != ssl.CERT_NONE
057d67
             if check_hostname is None:
057d67
                 check_hostname = will_verify
057d67
diff --git a/Lib/ssl.py b/Lib/ssl.py
057d67
--- a/Lib/ssl.py
057d67
+++ b/Lib/ssl.py
057d67
@@ -427,8 +427,7 @@ def create_default_context(purpose=Purpo
057d67
         context.load_default_certs(purpose)
057d67
     return context
057d67
 
057d67
-
057d67
-def _create_stdlib_context(protocol=PROTOCOL_SSLv23, cert_reqs=None,
057d67
+def _create_unverified_context(protocol=PROTOCOL_SSLv23, cert_reqs=None,
057d67
                            check_hostname=False, purpose=Purpose.SERVER_AUTH,
057d67
                            certfile=None, keyfile=None,
057d67
                            cafile=None, capath=None, cadata=None):
057d67
@@ -469,6 +468,14 @@ def _create_stdlib_context(protocol=PROT
057d67
 
057d67
     return context
057d67
 
057d67
+# Used by http.client if no context is explicitly passed.
057d67
+_create_default_https_context = create_default_context
057d67
+
057d67
+
057d67
+# Backwards compatibility alias, even though it's not a public name.
057d67
+_create_stdlib_context = _create_unverified_context
057d67
+
057d67
+
057d67
 class SSLSocket(socket):
057d67
     """This class implements a subtype of socket.socket that wraps
057d67
     the underlying OS socket in an SSL context when necessary, and
057d67
diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
057d67
--- a/Lib/test/test_httplib.py
057d67
+++ b/Lib/test/test_httplib.py
057d67
@@ -1,10 +1,9 @@
057d67
 import httplib
057d67
 import array
057d67
-import httplib
057d67
-import os
057d67
 import StringIO
057d67
 import socket
057d67
 import errno
057d67
+import os
057d67
 
057d67
 import unittest
057d67
 TestCase = unittest.TestCase
057d67
diff --git a/Lib/test/test_urllib2_localnet.py b/Lib/test/test_urllib2_localnet.py
057d67
--- a/Lib/test/test_urllib2_localnet.py
057d67
+++ b/Lib/test/test_urllib2_localnet.py
057d67
@@ -5,6 +5,7 @@ import urllib2
057d67
 import BaseHTTPServer
057d67
 import unittest
057d67
 import hashlib
057d67
+import ssl
057d67
 
057d67
 from test import test_support
057d67
 
057d67
@@ -562,15 +563,37 @@ class TestUrlopen(BaseTestCase):
057d67
                             cafile=CERT_localhost)
057d67
         self.assertEqual(data, b"we care a bit")
057d67
         # Bad cert
057d67
-        with self.assertRaises(urllib2.URLError) as cm:
057d67
+        with self.assertRaises(urllib2.URLError):
057d67
             self.urlopen("https://localhost:%s/bizarre" % handler.port,
057d67
                          cafile=CERT_fakehostname)
057d67
         # Good cert, but mismatching hostname
057d67
         handler = self.start_https_server(certfile=CERT_fakehostname)
057d67
-        with self.assertRaises(ssl.CertificateError) as cm:
057d67
+        with self.assertRaises(ssl.CertificateError):
057d67
             self.urlopen("https://localhost:%s/bizarre" % handler.port,
057d67
                          cafile=CERT_fakehostname)
057d67
 
057d67
+    def test_https_with_cadefault(self):
057d67
+        handler = self.start_https_server(certfile=CERT_localhost)
057d67
+        # Self-signed cert should fail verification with system certificate store
057d67
+        with self.assertRaises(urllib2.URLError):
057d67
+            self.urlopen("https://localhost:%s/bizarre" % handler.port,
057d67
+                         cadefault=True)
057d67
+
057d67
+    def test_https_sni(self):
057d67
+        if ssl is None:
057d67
+            self.skipTest("ssl module required")
057d67
+        if not ssl.HAS_SNI:
057d67
+            self.skipTest("SNI support required in OpenSSL")
057d67
+        sni_name = [None]
057d67
+        def cb_sni(ssl_sock, server_name, initial_context):
057d67
+            sni_name[0] = server_name
057d67
+        context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
057d67
+        context.set_servername_callback(cb_sni)
057d67
+        handler = self.start_https_server(context=context, certfile=CERT_localhost)
057d67
+        context = ssl.create_default_context(cafile=CERT_localhost)
057d67
+        self.urlopen("https://localhost:%s" % handler.port, context=context)
057d67
+        self.assertEqual(sni_name[0], "localhost")
057d67
+
057d67
     def test_sending_headers(self):
057d67
         handler = self.start_server([(200, [], "we don't care")])
057d67
 
057d67
diff -up Python-2.7.5/Doc/library/xmlrpclib.rst.ver Python-2.7.5/Doc/library/xmlrpclib.rst
057d67
--- Python-2.7.5/Doc/library/xmlrpclib.rst.ver	2015-03-30 13:59:29.243493601 +0200
057d67
+++ Python-2.7.5/Doc/library/xmlrpclib.rst	2015-03-30 14:03:40.509532180 +0200
057d67
@@ -34,6 +34,10 @@ between conformable Python objects and X
057d67
    constructed data.  If you need to parse untrusted or unauthenticated data see
057d67
    :ref:`xml-vulnerabilities`.
057d67
 
057d67
+.. versionchanged:: 2.7.9
057d67
+
057d67
+   For https URIs, :mod:`xmlrpclib` now performs all the necessary certificate
057d67
+   and hostname checks by default
057d67
 
057d67
 .. class:: ServerProxy(uri[, transport[, encoding[, verbose[,  allow_none[, use_datetime]]]]])
057d67