import python-urllib3-1.24.2-4.el8
This commit is contained in:
CentOS Sources
parent
1182af9bec
commit
69917ef57d
|
|
@ -0,0 +1,56 @@
|
|||
From c9ed53c284a6747f17366eab71ba8922e33910e2 Mon Sep 17 00:00:00 2001
|
||||
From: Lumir Balhar <lbalhar@redhat.com>
|
||||
Date: Wed, 28 Aug 2019 14:55:26 +0200
|
||||
Subject: [PATCH] Backported patch from:
|
||||
https://github.com/urllib3/urllib3/commit/6a626be4ff623c25270e20db9002705bf4504e4e
|
||||
|
||||
Enable TLS 1.3 post-handshake authentication
|
||||
---
|
||||
src/urllib3/util/ssl_.py | 7 +++++++
|
||||
test/test_ssl.py | 15 +++++++++++++++
|
||||
2 files changed, 22 insertions(+)
|
||||
|
||||
diff --git a/src/urllib3/util/ssl_.py b/src/urllib3/util/ssl_.py
|
||||
index 5ae4358..7dc4a5a 100644
|
||||
--- a/src/urllib3/util/ssl_.py
|
||||
+++ b/src/urllib3/util/ssl_.py
|
||||
@@ -280,6 +280,13 @@ def create_urllib3_context(ssl_version=None, cert_reqs=None,
|
||||
|
||||
context.options |= options
|
||||
|
||||
+ # Enable post-handshake authentication for TLS 1.3, see GH #1634. PHA is
|
||||
+ # necessary for conditional client cert authentication with TLS 1.3.
|
||||
+ # The attribute is None for OpenSSL <= 1.1.0 or does not exist in older
|
||||
+ # versions of Python.
|
||||
+ if getattr(context, "post_handshake_auth", None) is not None:
|
||||
+ context.post_handshake_auth = True
|
||||
+
|
||||
context.verify_mode = cert_reqs
|
||||
if getattr(context, 'check_hostname', None) is not None: # Platform-specific: Python 3.2
|
||||
# We do our own verification, including fingerprints and alternative
|
||||
diff --git a/test/test_ssl.py b/test/test_ssl.py
|
||||
index 6a46b4f..3a99522 100644
|
||||
--- a/test/test_ssl.py
|
||||
+++ b/test/test_ssl.py
|
||||
@@ -125,3 +125,18 @@ def test_wrap_socket_default_loads_default_certs(monkeypatch):
|
||||
ssl_.ssl_wrap_socket(sock)
|
||||
|
||||
context.load_default_certs.assert_called_with()
|
||||
+
|
||||
+
|
||||
+@pytest.mark.parametrize(
|
||||
+ ["pha", "expected_pha"], [(None, None), (False, True), (True, True)]
|
||||
+)
|
||||
+def test_create_urllib3_context_pha(monkeypatch, pha, expected_pha):
|
||||
+ context = mock.create_autospec(ssl_.SSLContext)
|
||||
+ context.set_ciphers = mock.Mock()
|
||||
+ context.options = 0
|
||||
+ context.post_handshake_auth = pha
|
||||
+ monkeypatch.setattr(ssl_, "SSLContext", lambda *_, **__: context)
|
||||
+
|
||||
+ assert ssl_.create_urllib3_context() is context
|
||||
+
|
||||
+ assert context.post_handshake_auth == expected_pha
|
||||
--
|
||||
2.21.0
|
||||
|
||||
|
|
@ -2,7 +2,7 @@
|
|||
|
||||
Name: python-%{srcname}
|
||||
Version: 1.24.2
|
||||
Release: 2%{?dist}
|
||||
Release: 4%{?dist}
|
||||
Summary: Python HTTP library with thread-safe connection pooling and file post
|
||||
|
||||
License: MIT
|
||||
|
|
@ -21,7 +21,10 @@ BuildArch: noarch
|
|||
# - Superfluous commits were omitted (flake8 checks, travis settings, macos patch)
|
||||
# * https://github.com/urllib3/urllib3/pull/1593
|
||||
Patch1: CVE-2019-11236.patch
|
||||
|
||||
# Enable post-handshake authentication for TLS 1.3
|
||||
# - https://github.com/urllib3/urllib3/issues/1634
|
||||
# - https://bugzilla.redhat.com/show_bug.cgi?id=1726743
|
||||
Patch2: Enable_TLS_1.3_post-handshake_authentication.patch
|
||||
|
||||
%description
|
||||
Python HTTP module with connection pooling and file POST abilities.
|
||||
|
|
@ -50,6 +53,27 @@ Python3 HTTP module with connection pooling and file POST abilities.
|
|||
%setup -q -n %{srcname}-%{version}
|
||||
|
||||
%patch1 -p1
|
||||
%patch2 -p1
|
||||
|
||||
# Make sure that the RECENT_DATE value doesn't get too far behind what the current date is.
|
||||
# RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date
|
||||
# (from test/test_connection.py) would fail. However, it shouldn't be to close to the build time either,
|
||||
# since a user's system time could be set to a little in the past from what build time is (because of timezones,
|
||||
# corner cases, etc). As stated in the comment in src/urllib3/connection.py:
|
||||
# When updating RECENT_DATE, move it to within two years of the current date,
|
||||
# and not less than 6 months ago.
|
||||
# Example: if Today is 2018-01-01, then RECENT_DATE should be any date on or
|
||||
# after 2016-01-01 (today - 2 years) AND before 2017-07-01 (today - 6 months)
|
||||
# There is also a test_ssl_wrong_system_time test (from test/with_dummyserver/test_https.py) that tests if
|
||||
# user's system time isn't set as too far in the past, because it could lead to SSL verification errors.
|
||||
# That is why we need RECENT_DATE to be set at most 2 years ago (or else test_ssl_wrong_system_time would
|
||||
# result in false positive), but before at least 6 month ago (so this test could tolerate user's system time being
|
||||
# set to some time in the past, but not to far away from the present).
|
||||
# Next few lines update RECENT_DATE dynamically.
|
||||
|
||||
recent_date=$(date --date "7 month ago" +"%Y, %_m, %_d")
|
||||
sed -i "s/^RECENT_DATE = datetime.date(.*)/RECENT_DATE = datetime.date($recent_date)/" src/urllib3/connection.py
|
||||
|
||||
|
||||
# Drop the dummyserver tests in koji.
|
||||
# These require tornado, a Web framework otherwise unused in the distro.
|
||||
|
|
@ -105,6 +129,15 @@ popd
|
|||
|
||||
|
||||
%changelog
|
||||
* Wed Oct 30 2019 Anna Khaitovich <akhaitov@redhat.com> - 1.24.2-4
|
||||
- Update RECENT_DATE dynamically
|
||||
Resolves: rhbz#1761380
|
||||
|
||||
* Wed Aug 28 2019 Lumír Balhar <lbalhar@redhat.com> - 1.24.2-3
|
||||
- Enable TLS 1.3 post-handshake authentication
|
||||
- Adjust RECENT_DATE variable according to rules
|
||||
Resolves: rhbz#1726743
|
||||
|
||||
* Wed May 22 2019 Tomas Orsava <torsava@redhat.com> - 1.24.2-2
|
||||
- Rebuilding after gating was enabled
|
||||
- Resolves: rhbz#1703361 rhbz#1706026
|
||||
|
|
|
|||
Loading…
Reference in New Issue