diff --git a/SOURCES/Enable_TLS_1.3_post-handshake_authentication.patch b/SOURCES/Enable_TLS_1.3_post-handshake_authentication.patch new file mode 100644 index 0000000..ac903bb --- /dev/null +++ b/SOURCES/Enable_TLS_1.3_post-handshake_authentication.patch @@ -0,0 +1,56 @@ +From c9ed53c284a6747f17366eab71ba8922e33910e2 Mon Sep 17 00:00:00 2001 +From: Lumir Balhar +Date: Wed, 28 Aug 2019 14:55:26 +0200 +Subject: [PATCH] Backported patch from: + https://github.com/urllib3/urllib3/commit/6a626be4ff623c25270e20db9002705bf4504e4e + +Enable TLS 1.3 post-handshake authentication +--- + src/urllib3/util/ssl_.py | 7 +++++++ + test/test_ssl.py | 15 +++++++++++++++ + 2 files changed, 22 insertions(+) + +diff --git a/src/urllib3/util/ssl_.py b/src/urllib3/util/ssl_.py +index 5ae4358..7dc4a5a 100644 +--- a/src/urllib3/util/ssl_.py ++++ b/src/urllib3/util/ssl_.py +@@ -280,6 +280,13 @@ def create_urllib3_context(ssl_version=None, cert_reqs=None, + + context.options |= options + ++ # Enable post-handshake authentication for TLS 1.3, see GH #1634. PHA is ++ # necessary for conditional client cert authentication with TLS 1.3. ++ # The attribute is None for OpenSSL <= 1.1.0 or does not exist in older ++ # versions of Python. ++ if getattr(context, "post_handshake_auth", None) is not None: ++ context.post_handshake_auth = True ++ + context.verify_mode = cert_reqs + if getattr(context, 'check_hostname', None) is not None: # Platform-specific: Python 3.2 + # We do our own verification, including fingerprints and alternative +diff --git a/test/test_ssl.py b/test/test_ssl.py +index 6a46b4f..3a99522 100644 +--- a/test/test_ssl.py ++++ b/test/test_ssl.py +@@ -125,3 +125,18 @@ def test_wrap_socket_default_loads_default_certs(monkeypatch): + ssl_.ssl_wrap_socket(sock) + + context.load_default_certs.assert_called_with() ++ ++ ++@pytest.mark.parametrize( ++ ["pha", "expected_pha"], [(None, None), (False, True), (True, True)] ++) ++def test_create_urllib3_context_pha(monkeypatch, pha, expected_pha): ++ context = mock.create_autospec(ssl_.SSLContext) ++ context.set_ciphers = mock.Mock() ++ context.options = 0 ++ context.post_handshake_auth = pha ++ monkeypatch.setattr(ssl_, "SSLContext", lambda *_, **__: context) ++ ++ assert ssl_.create_urllib3_context() is context ++ ++ assert context.post_handshake_auth == expected_pha +-- +2.21.0 + diff --git a/SPECS/python-urllib3.spec b/SPECS/python-urllib3.spec index e684a2b..6cd889b 100644 --- a/SPECS/python-urllib3.spec +++ b/SPECS/python-urllib3.spec @@ -2,7 +2,7 @@ Name: python-%{srcname} Version: 1.24.2 -Release: 2%{?dist} +Release: 4%{?dist} Summary: Python HTTP library with thread-safe connection pooling and file post License: MIT @@ -21,7 +21,10 @@ BuildArch: noarch # - Superfluous commits were omitted (flake8 checks, travis settings, macos patch) # * https://github.com/urllib3/urllib3/pull/1593 Patch1: CVE-2019-11236.patch - +# Enable post-handshake authentication for TLS 1.3 +# - https://github.com/urllib3/urllib3/issues/1634 +# - https://bugzilla.redhat.com/show_bug.cgi?id=1726743 +Patch2: Enable_TLS_1.3_post-handshake_authentication.patch %description Python HTTP module with connection pooling and file POST abilities. @@ -50,6 +53,27 @@ Python3 HTTP module with connection pooling and file POST abilities. %setup -q -n %{srcname}-%{version} %patch1 -p1 +%patch2 -p1 + +# Make sure that the RECENT_DATE value doesn't get too far behind what the current date is. +# RECENT_DATE must not be older that 2 years from the build time, or else test_recent_date +# (from test/test_connection.py) would fail. However, it shouldn't be to close to the build time either, +# since a user's system time could be set to a little in the past from what build time is (because of timezones, +# corner cases, etc). As stated in the comment in src/urllib3/connection.py: +# When updating RECENT_DATE, move it to within two years of the current date, +# and not less than 6 months ago. +# Example: if Today is 2018-01-01, then RECENT_DATE should be any date on or +# after 2016-01-01 (today - 2 years) AND before 2017-07-01 (today - 6 months) +# There is also a test_ssl_wrong_system_time test (from test/with_dummyserver/test_https.py) that tests if +# user's system time isn't set as too far in the past, because it could lead to SSL verification errors. +# That is why we need RECENT_DATE to be set at most 2 years ago (or else test_ssl_wrong_system_time would +# result in false positive), but before at least 6 month ago (so this test could tolerate user's system time being +# set to some time in the past, but not to far away from the present). +# Next few lines update RECENT_DATE dynamically. + +recent_date=$(date --date "7 month ago" +"%Y, %_m, %_d") +sed -i "s/^RECENT_DATE = datetime.date(.*)/RECENT_DATE = datetime.date($recent_date)/" src/urllib3/connection.py + # Drop the dummyserver tests in koji. # These require tornado, a Web framework otherwise unused in the distro. @@ -105,6 +129,15 @@ popd %changelog +* Wed Oct 30 2019 Anna Khaitovich - 1.24.2-4 +- Update RECENT_DATE dynamically +Resolves: rhbz#1761380 + +* Wed Aug 28 2019 Lumír Balhar - 1.24.2-3 +- Enable TLS 1.3 post-handshake authentication +- Adjust RECENT_DATE variable according to rules +Resolves: rhbz#1726743 + * Wed May 22 2019 Tomas Orsava - 1.24.2-2 - Rebuilding after gating was enabled - Resolves: rhbz#1703361 rhbz#1706026