[Python-checkins] cpython (3.3): Issue #19508: direct the user to read the security considerations for the ssl

[antoine.pitrou]

http://hg.python.org/cpython/rev/f86fdaf529ea
changeset:   87202:f86fdaf529ea
branch:      3.3
parent:      87198:9444ee6864b3
user:        Antoine Pitrou <solipsis at pitrou.net>
date:        Sun Nov 17 15:35:33 2013 +0100
summary:
  Issue #19508: direct the user to read the security considerations for the ssl module

files:
  Doc/library/ssl.rst |  19 ++++++++++++++-----
  1 files changed, 14 insertions(+), 5 deletions(-)


diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -29,12 +29,10 @@
    cause variations in behavior.
 
 .. warning::
+   Don't use this module without reading the :ref:`ssl-security`.  Doing so
+   may lead to a false sense of security, as the default settings of the
+   ssl module are not necessarily appropriate for your application.
 
-   OpenSSL's internal random number generator does not properly handle fork.
-   Applications must change the PRNG state of the parent process if they use
-   any SSL feature with :func:`os.fork`. Any successful call of
-   :func:`~ssl.RAND_add`, :func:`~ssl.RAND_bytes` or
-   :func:`~ssl.RAND_pseudo_bytes` is sufficient.
 
 This section documents the objects and functions in the ``ssl`` module; for more
 general information about TLS, SSL, and certificates, the reader is referred to
@@ -1314,6 +1312,17 @@
 If you want to check which ciphers are enabled by a given cipher list,
 use the ``openssl ciphers`` command on your system.
 
+Multi-processing
+^^^^^^^^^^^^^^^^
+
+If using this module as part of a multi-processed application (using,
+for example the :mod:`multiprocessing` or :mod:`concurrent.futures` modules),
+be aware that OpenSSL's internal random number generator does not properly
+handle forked processes.  Applications must change the PRNG state of the
+parent process if they use any SSL feature with :func:`os.fork`.  Any
+successful call of :func:`~ssl.RAND_add`, :func:`~ssl.RAND_bytes` or
+:func:`~ssl.RAND_pseudo_bytes` is sufficient.
+
 
 .. seealso::
 

-- 
Repository URL: http://hg.python.org/cpython