71 lines
2.9 KiB
Diff
71 lines
2.9 KiB
Diff
diff --git a/Doc/library/http.client.rst b/Doc/library/http.client.rst
|
|
index 2f59ece..d756916 100644
|
|
--- a/Doc/library/http.client.rst
|
|
+++ b/Doc/library/http.client.rst
|
|
@@ -88,6 +88,11 @@ The module provides the following classes:
|
|
:func:`ssl._create_unverified_context` can be passed to the *context*
|
|
parameter.
|
|
|
|
+ .. versionchanged:: 3.7.4
|
|
+ This class now enables TLS 1.3
|
|
+ :attr:`ssl.SSLContext.post_handshake_auth` for the default *context* or
|
|
+ when *cert_file* is passed with a custom *context*.
|
|
+
|
|
.. deprecated:: 3.6
|
|
|
|
*key_file* and *cert_file* are deprecated in favor of *context*.
|
|
diff --git a/Lib/http/client.py b/Lib/http/client.py
|
|
index 1a6bd8a..f0d2642 100644
|
|
--- a/Lib/http/client.py
|
|
+++ b/Lib/http/client.py
|
|
@@ -1390,6 +1390,9 @@ else:
|
|
self.cert_file = cert_file
|
|
if context is None:
|
|
context = ssl._create_default_https_context()
|
|
+ # enable PHA for TLS 1.3 connections if available
|
|
+ if context.post_handshake_auth is not None:
|
|
+ context.post_handshake_auth = True
|
|
will_verify = context.verify_mode != ssl.CERT_NONE
|
|
if check_hostname is None:
|
|
check_hostname = context.check_hostname
|
|
@@ -1398,6 +1401,10 @@ else:
|
|
"either CERT_OPTIONAL or CERT_REQUIRED")
|
|
if key_file or cert_file:
|
|
context.load_cert_chain(cert_file, key_file)
|
|
+ # cert and key file means the user wants to authenticate.
|
|
+ # enable TLS 1.3 PHA implicitly even for custom contexts.
|
|
+ if context.post_handshake_auth is not None:
|
|
+ context.post_handshake_auth = True
|
|
self._context = context
|
|
self._check_hostname = check_hostname
|
|
|
|
diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
|
|
index 714d521..5795b7a 100644
|
|
--- a/Lib/test/test_httplib.py
|
|
+++ b/Lib/test/test_httplib.py
|
|
@@ -1709,6 +1709,24 @@ class HTTPSTest(TestCase):
|
|
self.assertEqual(h, c.host)
|
|
self.assertEqual(p, c.port)
|
|
|
|
+ def test_tls13_pha(self):
|
|
+ import ssl
|
|
+ if not ssl.HAS_TLSv1_3:
|
|
+ self.skipTest('TLS 1.3 support required')
|
|
+ # just check status of PHA flag
|
|
+ h = client.HTTPSConnection('localhost', 443)
|
|
+ self.assertTrue(h._context.post_handshake_auth)
|
|
+
|
|
+ context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
|
+ self.assertFalse(context.post_handshake_auth)
|
|
+ h = client.HTTPSConnection('localhost', 443, context=context)
|
|
+ self.assertIs(h._context, context)
|
|
+ self.assertFalse(h._context.post_handshake_auth)
|
|
+
|
|
+ h = client.HTTPSConnection('localhost', 443, context=context,
|
|
+ cert_file=CERT_localhost)
|
|
+ self.assertTrue(h._context.post_handshake_auth)
|
|
+
|
|
|
|
class RequestBodyTest(TestCase):
|
|
"""Test cases where a request includes a message body."""
|