From 1c86b4450689cc9ecef6c99ad8e55bae67931e59 Mon Sep 17 00:00:00 2001
From: Antoine Pitrou <solipsis@pitrou.net>
Date: Fri, 6 May 2011 15:19:49 +0200
Subject: [PATCH] Issue #12000: When a SSL certificate has a subjectAltName
 without any dNSName entry, ssl.match_hostname() should use the subject's
 commonName. Patch by Nicolas Bareil.

---
 Lib/ssl.py           |  5 +++--
 Lib/test/test_ssl.py | 18 ++++++++++++++++++
 Misc/ACKS            |  1 +
 Misc/NEWS            |  4 ++++
 4 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/Lib/ssl.py b/Lib/ssl.py
index 84aa6dc3bf7..e7c175f063a 100644
--- a/Lib/ssl.py
+++ b/Lib/ssl.py
@@ -122,8 +122,9 @@ def match_hostname(cert, hostname):
             if _dnsname_to_pat(value).match(hostname):
                 return
             dnsnames.append(value)
-    if not san:
-        # The subject is only checked when subjectAltName is empty
+    if not dnsnames:
+        # The subject is only checked when there is no dNSName entry
+        # in subjectAltName
         for sub in cert.get('subject', ()):
             for key, value in sub:
                 # XXX according to RFC 2818, the most specific Common Name
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 164b6c262a5..ba788e4c844 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -277,6 +277,24 @@ class BasicSocketTests(unittest.TestCase):
                             (('organizationName', 'Google Inc'),))}
         fail(cert, 'mail.google.com')
 
+        # No DNS entry in subjectAltName but a commonName
+        cert = {'notAfter': 'Dec 18 23:59:59 2099 GMT',
+                'subject': ((('countryName', 'US'),),
+                            (('stateOrProvinceName', 'California'),),
+                            (('localityName', 'Mountain View'),),
+                            (('commonName', 'mail.google.com'),)),
+                'subjectAltName': (('othername', 'blabla'), )}
+        ok(cert, 'mail.google.com')
+
+        # No DNS entry subjectAltName and no commonName
+        cert = {'notAfter': 'Dec 18 23:59:59 2099 GMT',
+                'subject': ((('countryName', 'US'),),
+                            (('stateOrProvinceName', 'California'),),
+                            (('localityName', 'Mountain View'),),
+                            (('organizationName', 'Google Inc'),)),
+                'subjectAltName': (('othername', 'blabla'),)}
+        fail(cert, 'google.com')
+
         # Empty cert / no cert
         self.assertRaises(ValueError, ssl.match_hostname, None, 'example.com')
         self.assertRaises(ValueError, ssl.match_hostname, {}, 'example.com')
diff --git a/Misc/ACKS b/Misc/ACKS
index 0443e9374c4..efbd30bae9b 100644
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -49,6 +49,7 @@ Luigi Ballabio
 Jeff Balogh
 Matt Bandy
 Michael J. Barber
+Nicolas Bareil
 Chris Barker
 Nick Barnes
 Quentin Barnes
diff --git a/Misc/NEWS b/Misc/NEWS
index 01274a11f85..827e8373cba 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -83,6 +83,10 @@ Core and Builtins
 Library
 -------
 
+- Issue #12000: When a SSL certificate has a subjectAltName without any
+  dNSName entry, ssl.match_hostname() should use the subject's commonName.
+  Patch by Nicolas Bareil.
+
 - Issue #11647: objects created using contextlib.contextmanager now support
   more than one call to the function when used as a decorator. Initial patch
   by Ysj Ray.