[Python-checkins] r80317 - in python/branches/py3k: Lib/test/sha256.pem Lib/test/support.py Lib/test/test_ssl.py Misc/NEWS Modules/_ssl.c

antoine.pitrou python-checkins at python.org
Wed Apr 21 21:46:23 CEST 2010


Author: antoine.pitrou
Date: Wed Apr 21 21:46:23 2010
New Revision: 80317

Log:
Merged revisions 80314-80315 via svnmerge from 
svn+ssh://pythondev@svn.python.org/python/trunk

........
  r80314 | antoine.pitrou | 2010-04-21 21:28:03 +0200 (mer., 21 avril 2010) | 5 lines
  
  Issue #8484: Load all ciphers and digest algorithms when initializing
  the _ssl extension, such that verification of some SSL certificates
  doesn't fail because of an "unknown algorithm".
........
  r80315 | antoine.pitrou | 2010-04-21 21:36:23 +0200 (mer., 21 avril 2010) | 3 lines
  
  Forgot to add the sample certificate (followup to r80314)
........


Added:
   python/branches/py3k/Lib/test/sha256.pem
      - copied unchanged from r80315, /python/trunk/Lib/test/sha256.pem
Modified:
   python/branches/py3k/   (props changed)
   python/branches/py3k/Lib/test/support.py
   python/branches/py3k/Lib/test/test_ssl.py
   python/branches/py3k/Misc/NEWS
   python/branches/py3k/Modules/_ssl.c

Modified: python/branches/py3k/Lib/test/support.py
==============================================================================
--- python/branches/py3k/Lib/test/support.py	(original)
+++ python/branches/py3k/Lib/test/support.py	Wed Apr 21 21:46:23 2010
@@ -755,6 +755,17 @@
 
 
 @contextlib.contextmanager
+def transient_internet():
+    """Return a context manager that raises ResourceDenied when various issues
+    with the Internet connection manifest themselves as exceptions."""
+    time_out = TransientResource(IOError, errno=errno.ETIMEDOUT)
+    socket_peer_reset = TransientResource(socket.error, errno=errno.ECONNRESET)
+    ioerror_peer_reset = TransientResource(IOError, errno=errno.ECONNRESET)
+    with time_out, socket_peer_reset, ioerror_peer_reset:
+        yield
+
+
+ at contextlib.contextmanager
 def captured_output(stream_name):
     """Run the 'with' statement body using a StringIO object in place of a
     specific attribute on the sys module.

Modified: python/branches/py3k/Lib/test/test_ssl.py
==============================================================================
--- python/branches/py3k/Lib/test/test_ssl.py	(original)
+++ python/branches/py3k/Lib/test/test_ssl.py	Wed Apr 21 21:46:23 2010
@@ -218,6 +218,26 @@
         if support.verbose:
             sys.stdout.write("\nVerified certificate for svn.python.org:443 is\n%s\n" % pem)
 
+    def test_algorithms(self):
+        # Issue #8484: all algorithms should be available when verifying a
+        # certificate.
+        # NOTE: https://sha256.tbs-internet.com is another possible test host
+        remote = ("sha2.hboeck.de", 443)
+        sha256_cert = os.path.join(os.path.dirname(__file__), "sha256.pem")
+        s = ssl.wrap_socket(socket.socket(socket.AF_INET),
+                            cert_reqs=ssl.CERT_REQUIRED,
+                            ca_certs=sha256_cert,)
+        with support.transient_internet():
+            try:
+                s.connect(remote)
+                if support.verbose:
+                    sys.stdout.write("\nCipher with %r is %r\n" %
+                                     (remote, s.cipher()))
+                    sys.stdout.write("Certificate is:\n%s\n" %
+                                     pprint.pformat(s.getpeercert()))
+            finally:
+                s.close()
+
 
 try:
     import threading

Modified: python/branches/py3k/Misc/NEWS
==============================================================================
--- python/branches/py3k/Misc/NEWS	(original)
+++ python/branches/py3k/Misc/NEWS	Wed Apr 21 21:46:23 2010
@@ -318,6 +318,10 @@
 Library
 -------
 
+- Issue #8484: Load all ciphers and digest algorithms when initializing
+  the _ssl extension, such that verification of some SSL certificates
+  doesn't fail because of an "unknown algorithm".
+
 - Issue #6547: Added the ignore_dangling_symlinks option to shutil.copytree.
 
 - Issue #1540112: Now allowing the choice of a copy function in 

Modified: python/branches/py3k/Modules/_ssl.c
==============================================================================
--- python/branches/py3k/Modules/_ssl.c	(original)
+++ python/branches/py3k/Modules/_ssl.c	Wed Apr 21 21:46:23 2010
@@ -1669,13 +1669,14 @@
 
 	/* Init OpenSSL */
 	SSL_load_error_strings();
+	SSL_library_init();
 #ifdef WITH_THREAD
 	/* note that this will start threading if not already started */
 	if (!_setup_ssl_threads()) {
 		return NULL;
 	}
 #endif
-	SSLeay_add_ssl_algorithms();
+	OpenSSL_add_all_algorithms();
 
 	/* Add symbols to module dict */
 	PySSLErrorObject = PyErr_NewException("ssl.SSLError",


More information about the Python-checkins mailing list