rpms/pywbem
7
0
Fork 0
Code Issues Pull Requests Releases Activity

skip hostname check when no verification is desired

Browse Source 
If the peer certificate's verification is disabled with no_verification
option, hostname check needs to be skipped as well.

Related: rhbz#1026891
This commit is contained in:
Michal Minar 2014-01-03 07:54:15 +01:00
parent 5675d620ef
commit 39bb7a21e2
2 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
pywbem-20131121-ssl_verify_host.patch
View File

@ -38,7 +38,7 @@ Index: pywbem-20131121/cim_http.py
"""Send XML data over HTTP to the specified url. Return the
response in XML. Uses Python's build-in httplib. x509 may be a
dictionary containing the location of the SSL certificate and key
@@ -105,10 +124,47 @@ def wbem_request(url, data, creds, heade
@@ -105,10 +124,49 @@ def wbem_request(url, data, creds, heade
class HTTPSConnection(HTTPBaseConnection, httplib.HTTPSConnection):
def __init__(self, host, port=None, key_file=None, cert_file=None,
@ -76,19 +76,21 @@ Index: pywbem-20131121/cim_http.py
+ self.sock.setup_ssl()
+ self.sock.set_connect_state()
+ ret = self.sock.connect_ssl()
+ check = getattr(self.sock, 'postConnectionCheck',
+ self.sock.clientPostConnectionCheck)
+ if check is not None:
+ if not check(self.sock.get_peer_cert(), self.host):
+ raise Error('SSL error: post connection check failed')
+ if self.ca_certs:
+ check = getattr(self.sock, 'postConnectionCheck',
+ self.sock.clientPostConnectionCheck)
+ if check is not None:
+ if not check(self.sock.get_peer_cert(), self.host):
+ raise Error('SSL error: post connection check failed')
+ return ret
+ except (Err.SSLError, SSL.SSLError, SSL.SSLTimeoutError), arg:
+ except ( Err.SSLError, SSL.SSLError, SSL.SSLTimeoutError
+ , SSL.Checker.WrongHost), arg:
+ raise Error("SSL error: %s" % arg)
+
class FileHTTPConnection(HTTPBaseConnection, httplib.HTTPConnection):
def __init__(self, uds_path):
httplib.HTTPConnection.__init__(self, 'localhost')
@@ -117,64 +173,36 @@ def wbem_request(url, data, creds, heade
@@ -117,64 +175,36 @@ def wbem_request(url, data, creds, heade
self.sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
self.sock.connect(self.uds_path)
@ -171,7 +173,7 @@ Index: pywbem-20131121/cim_http.py
else:
if url.startswith('http'):
h = HTTPConnection(host, port = port)
@@ -216,6 +244,8 @@ def wbem_request(url, data, creds, heade
@@ -216,6 +246,8 @@ def wbem_request(url, data, creds, heade
h.putheader('PegasusAuthorization', 'Local "%s"' % locallogin)
for hdr in headers:

5
pywbem.spec
View File

@ -4,7 +4,7 @@
Name: pywbem
Version: 0.7.0
Release: 22.%{revdate}svn%{svnrev}%{?dist}
Release: 23.%{revdate}svn%{svnrev}%{?dist}
Summary: Python WBEM Client and Provider Interface
Group: Development/Libraries
License: LGPLv2
@ -84,6 +84,9 @@ rm -rf %{buildroot}
%{python_sitelib}/pywbem/twisted_client.py*
%changelog
* Fri Jan 03 2014 Michal Minar <miminar@redhat.com> 0.7.0-23.20131121svn656
- Skip hostname check when no verification is desired.
* Fri Dec 27 2013 Michal Minar <miminar@redhat.com> 0.7.0-22.20131121svn656
- Work around M2Crypto's inability to handle unicode strings.