Issue #12000: When a SSL certificate has a subjectAltName without any

dNSName entry, ssl.match_hostname() should use the subject's commonName.
Patch by Nicolas Bareil.
This commit is contained in:
Antoine Pitrou 2011-05-06 15:20:55 +02:00
commit ff9bfca482
4 changed files with 26 additions and 2 deletions

View File

@ -122,8 +122,9 @@ def match_hostname(cert, hostname):
if _dnsname_to_pat(value).match(hostname):
return
dnsnames.append(value)
if not san:
# The subject is only checked when subjectAltName is empty
if not dnsnames:
# The subject is only checked when there is no dNSName entry
# in subjectAltName
for sub in cert.get('subject', ()):
for key, value in sub:
# XXX according to RFC 2818, the most specific Common Name

View File

@ -277,6 +277,24 @@ class BasicSocketTests(unittest.TestCase):
(('organizationName', 'Google Inc'),))}
fail(cert, 'mail.google.com')
# No DNS entry in subjectAltName but a commonName
cert = {'notAfter': 'Dec 18 23:59:59 2099 GMT',
'subject': ((('countryName', 'US'),),
(('stateOrProvinceName', 'California'),),
(('localityName', 'Mountain View'),),
(('commonName', 'mail.google.com'),)),
'subjectAltName': (('othername', 'blabla'), )}
ok(cert, 'mail.google.com')
# No DNS entry subjectAltName and no commonName
cert = {'notAfter': 'Dec 18 23:59:59 2099 GMT',
'subject': ((('countryName', 'US'),),
(('stateOrProvinceName', 'California'),),
(('localityName', 'Mountain View'),),
(('organizationName', 'Google Inc'),)),
'subjectAltName': (('othername', 'blabla'),)}
fail(cert, 'google.com')
# Empty cert / no cert
self.assertRaises(ValueError, ssl.match_hostname, None, 'example.com')
self.assertRaises(ValueError, ssl.match_hostname, {}, 'example.com')

View File

@ -50,6 +50,7 @@ Luigi Ballabio
Jeff Balogh
Matt Bandy
Michael J. Barber
Nicolas Bareil
Chris Barker
Nick Barnes
Quentin Barnes

View File

@ -140,6 +140,10 @@ Core and Builtins
Library
-------
- Issue #12000: When a SSL certificate has a subjectAltName without any
dNSName entry, ssl.match_hostname() should use the subject's commonName.
Patch by Nicolas Bareil.
- Issue #10775: assertRaises, assertRaisesRegex, assertWarns, and
assertWarnsRegex now accept a keyword argument 'msg' when used as context
managers. Initial patch by Winston Ewert.