Author: Alex Gaynor <[email protected]>
Branch:
Changeset: r68591:1bf39957a7e8
Date: 2014-01-09 10:53 -0800
http://bitbucket.org/pypy/pypy/changeset/1bf39957a7e8/
Log: Disable SSLv2 except when a user explicity requests it
diff --git a/lib-python/2.7/test/test_ssl.py b/lib-python/2.7/test/test_ssl.py
--- a/lib-python/2.7/test/test_ssl.py
+++ b/lib-python/2.7/test/test_ssl.py
@@ -993,7 +993,7 @@
try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True)
try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True,
ssl.CERT_OPTIONAL)
try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True,
ssl.CERT_REQUIRED)
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv23, True)
+ try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv23, False)
try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv3, False)
try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLSv1, False)
diff --git a/pypy/module/_ssl/interp_ssl.py b/pypy/module/_ssl/interp_ssl.py
--- a/pypy/module/_ssl/interp_ssl.py
+++ b/pypy/module/_ssl/interp_ssl.py
@@ -711,8 +711,12 @@
raise ssl_error(space, "SSL_CTX_use_certificate_chain_file error")
# ssl compatibility
- libssl_SSL_CTX_set_options(ss.ctx,
- SSL_OP_ALL &
~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS)
+ options = SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
+ if protocol != PY_SSL_VERSION_SSL2:
+ # SSLv2 is extremely broken, don't use it unless a user specifically
+ # requests it
+ options |= SSL_OP_NO_SSLv2
+ libssl_SSL_CTX_set_options(ss.ctx, options)
verification_mode = SSL_VERIFY_NONE
if cert_mode == PY_SSL_CERT_OPTIONAL:
@@ -724,7 +728,7 @@
libssl_SSL_set_fd(ss.ssl, sock_fd) # set the socket for SSL
# The ACCEPT_MOVING_WRITE_BUFFER flag is necessary because the address
# of a str object may be changed by the garbage collector.
- libssl_SSL_set_mode(ss.ssl,
+ libssl_SSL_set_mode(ss.ssl,
SSL_MODE_AUTO_RETRY |
SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER)
# If the socket is in non-blocking mode or timeout mode, set the BIO
_______________________________________________
pypy-commit mailing list
[email protected]
https://mail.python.org/mailman/listinfo/pypy-commit
