diff options
| -rw-r--r-- | Lib/ssl.py | 5 | ||||
| -rw-r--r-- | Lib/test/test_ssl.py | 18 | ||||
| -rw-r--r-- | Misc/ACKS | 1 | ||||
| -rw-r--r-- | Misc/NEWS | 4 |
4 files changed, 26 insertions, 2 deletions
diff --git a/Lib/ssl.py b/Lib/ssl.py index 84aa6dc3bf..e7c175f063 100644 --- a/Lib/ssl.py +++ b/Lib/ssl.py @@ -122,8 +122,9 @@ def match_hostname(cert, hostname): if _dnsname_to_pat(value).match(hostname): return dnsnames.append(value) - if not san: - # The subject is only checked when subjectAltName is empty + if not dnsnames: + # The subject is only checked when there is no dNSName entry + # in subjectAltName for sub in cert.get('subject', ()): for key, value in sub: # XXX according to RFC 2818, the most specific Common Name diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 164b6c262a..ba788e4c84 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -277,6 +277,24 @@ class BasicSocketTests(unittest.TestCase): (('organizationName', 'Google Inc'),))} fail(cert, 'mail.google.com') + # No DNS entry in subjectAltName but a commonName + cert = {'notAfter': 'Dec 18 23:59:59 2099 GMT', + 'subject': ((('countryName', 'US'),), + (('stateOrProvinceName', 'California'),), + (('localityName', 'Mountain View'),), + (('commonName', 'mail.google.com'),)), + 'subjectAltName': (('othername', 'blabla'), )} + ok(cert, 'mail.google.com') + + # No DNS entry subjectAltName and no commonName + cert = {'notAfter': 'Dec 18 23:59:59 2099 GMT', + 'subject': ((('countryName', 'US'),), + (('stateOrProvinceName', 'California'),), + (('localityName', 'Mountain View'),), + (('organizationName', 'Google Inc'),)), + 'subjectAltName': (('othername', 'blabla'),)} + fail(cert, 'google.com') + # Empty cert / no cert self.assertRaises(ValueError, ssl.match_hostname, None, 'example.com') self.assertRaises(ValueError, ssl.match_hostname, {}, 'example.com') @@ -49,6 +49,7 @@ Luigi Ballabio Jeff Balogh Matt Bandy Michael J. Barber +Nicolas Bareil Chris Barker Nick Barnes Quentin Barnes @@ -83,6 +83,10 @@ Core and Builtins Library ------- +- Issue #12000: When a SSL certificate has a subjectAltName without any + dNSName entry, ssl.match_hostname() should use the subject's commonName. + Patch by Nicolas Bareil. + - Issue #11647: objects created using contextlib.contextmanager now support more than one call to the function when used as a decorator. Initial patch by Ysj Ray. |