[Python-checkins] cpython: Fix a crash when setting a servername callback on a SSL server socket and the
antoine.pitrou
python-checkins at python.org
Thu Apr 11 20:49:21 CEST 2013
http://hg.python.org/cpython/rev/4ae6095b4638
changeset: 83251:4ae6095b4638
user: Antoine Pitrou <solipsis at pitrou.net>
date: Thu Apr 11 20:48:42 2013 +0200
summary:
Fix a crash when setting a servername callback on a SSL server socket and the client doesn't send a server name.
Patch by Kazuhiro Yoshida.
(originally issue #8109)
files:
Doc/library/ssl.rst | 1 +
Lib/test/test_ssl.py | 11 ++++++++++-
Misc/ACKS | 1 +
Modules/_ssl.c | 30 ++++++++++++++++++------------
4 files changed, 30 insertions(+), 13 deletions(-)
diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -842,6 +842,7 @@
The callback function, *server_name_callback*, will be called with three
arguments; the first being the :class:`ssl.SSLSocket`, the second is a string
that represents the server name that the client is intending to communicate
+ (or :const:`None` if the TLS Client Hello does not contain a server name)
and the third argument is the original :class:`SSLContext`. The server name
argument is the IDNA decoded server name.
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -2096,7 +2096,8 @@
def servername_cb(ssl_sock, server_name, initial_context):
calls.append((server_name, initial_context))
- ssl_sock.context = other_context
+ if server_name is not None:
+ ssl_sock.context = other_context
server_context.set_servername_callback(servername_cb)
stats = server_params_test(client_context, server_context,
@@ -2108,6 +2109,14 @@
# CERTFILE4 was selected
self.check_common_name(stats, 'fakehostname')
+ calls = []
+ # The callback is called with server_name=None
+ stats = server_params_test(client_context, server_context,
+ chatty=True,
+ sni_name=None)
+ self.assertEqual(calls, [(None, server_context)])
+ self.check_common_name(stats, 'localhost')
+
# Check disabling the callback
calls = []
server_context.set_servername_callback(None)
diff --git a/Misc/ACKS b/Misc/ACKS
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -1361,6 +1361,7 @@
Danny Yoo
Rory Yorke
George Yoshida
+Kazuhiro Yoshida
Masazumi Yoshikawa
Arnaud Ysmal
Bernard Yue
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -2448,22 +2448,28 @@
goto error;
}
- servername_o = PyBytes_FromString(servername);
- if (servername_o == NULL) {
- PyErr_WriteUnraisable((PyObject *) ssl_ctx);
- goto error;
+ if (servername == NULL) {
+ result = PyObject_CallFunctionObjArgs(ssl_ctx->set_hostname, ssl_socket,
+ Py_None, ssl_ctx, NULL);
}
- servername_idna = PyUnicode_FromEncodedObject(servername_o, "idna", NULL);
- if (servername_idna == NULL) {
- PyErr_WriteUnraisable(servername_o);
+ else {
+ servername_o = PyBytes_FromString(servername);
+ if (servername_o == NULL) {
+ PyErr_WriteUnraisable((PyObject *) ssl_ctx);
+ goto error;
+ }
+ servername_idna = PyUnicode_FromEncodedObject(servername_o, "idna", NULL);
+ if (servername_idna == NULL) {
+ PyErr_WriteUnraisable(servername_o);
+ Py_DECREF(servername_o);
+ goto error;
+ }
Py_DECREF(servername_o);
- goto error;
+ result = PyObject_CallFunctionObjArgs(ssl_ctx->set_hostname, ssl_socket,
+ servername_idna, ssl_ctx, NULL);
+ Py_DECREF(servername_idna);
}
- Py_DECREF(servername_o);
- result = PyObject_CallFunctionObjArgs(ssl_ctx->set_hostname, ssl_socket,
- servername_idna, ssl_ctx, NULL);
Py_DECREF(ssl_socket);
- Py_DECREF(servername_idna);
if (result == NULL) {
PyErr_WriteUnraisable(ssl_ctx->set_hostname);
--
Repository URL: http://hg.python.org/cpython
More information about the Python-checkins
mailing list