From af0d43fa4c3c0c00eddfbbd1fcf9724a65ddbc90 Mon Sep 17 00:00:00 2001 From: Carlos Killpack Date: Mon, 24 Nov 2014 17:13:47 -0700 Subject: [PATCH 1/2] Fix #173 Sets `SSLContext.verify_mode` to `ssl.CERT_OPTIONAL` if `disable_ssl_certificate_validation` is `True` otherwise it is set to `ssl.CERT_REQUIRED`. --- python3/httplib2/__init__.py | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/python3/httplib2/__init__.py b/python3/httplib2/__init__.py index 43f7419..56add70 100644 --- a/python3/httplib2/__init__.py +++ b/python3/httplib2/__init__.py @@ -827,18 +827,19 @@ def __init__(self, host, port=None, key_file=None, cert_file=None, timeout=None, proxy_info=None, ca_certs=None, disable_ssl_certificate_validation=False): self.proxy_info = proxy_info - context = None if ca_certs is None: ca_certs = CA_CERTS - if (cert_file or ca_certs) and not disable_ssl_certificate_validation: - if not hasattr(ssl, 'SSLContext'): - raise CertificateValidationUnsupportedInPython31() - context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + if not hasattr(ssl, 'SSLContext'): + raise CertificateValidationUnsupportedInPython31() + context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + if disable_ssl_certificate_validation: + context.verify_mode = ssl.CERT_OPTIONAL + else: context.verify_mode = ssl.CERT_REQUIRED - if cert_file: - context.load_cert_chain(cert_file, key_file) - if ca_certs: - context.load_verify_locations(ca_certs) + if cert_file: + context.load_cert_chain(cert_file, key_file) + if ca_certs: + context.load_verify_locations(ca_certs) http.client.HTTPSConnection.__init__( self, host, port=port, key_file=key_file, cert_file=cert_file, timeout=timeout, context=context, From 015b332e9f6d79ba48a826f55349f79033537445 Mon Sep 17 00:00:00 2001 From: Carlos Killpack Date: Tue, 25 Nov 2014 10:26:26 -0700 Subject: [PATCH 2/2] Changes based on comments on pull #173 * `ssl.SSLContext` is new in Python 3.2 and all of the features used here are available from then on. * The when using an `SSLContext` the `check_hostname` kwarg *requires* that `context.verify_mode` be set to **either** `ssl.CERT_REQUIRED` **or** `ssl.CERT_OPTIONAL`. `ssl.CERT_NONE` raises an exception. --- python3/httplib2/__init__.py | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/python3/httplib2/__init__.py b/python3/httplib2/__init__.py index 56add70..856e2b6 100644 --- a/python3/httplib2/__init__.py +++ b/python3/httplib2/__init__.py @@ -829,17 +829,24 @@ def __init__(self, host, port=None, key_file=None, cert_file=None, self.proxy_info = proxy_info if ca_certs is None: ca_certs = CA_CERTS - if not hasattr(ssl, 'SSLContext'): - raise CertificateValidationUnsupportedInPython31() - context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) if disable_ssl_certificate_validation: - context.verify_mode = ssl.CERT_OPTIONAL + if hasattr(ssl, 'SSLContext'): + context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + context.verify_mode = ssl.CERT_OPTIONAL + context.load_default_certs() + else: + context = None else: - context.verify_mode = ssl.CERT_REQUIRED - if cert_file: - context.load_cert_chain(cert_file, key_file) - if ca_certs: - context.load_verify_locations(ca_certs) + if hasattr(ssl, 'SSLContext'): + context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + context.verify_mode = ssl.CERT_REQUIRED + context.load_default_certs() + if cert_file: + context.load_cert_chain(cert_file, key_file) + if ca_certs: + context.load_verify_locations(ca_certs) + else: + raise CertificateValidationUnsupportedInPython31() http.client.HTTPSConnection.__init__( self, host, port=port, key_file=key_file, cert_file=cert_file, timeout=timeout, context=context,