From bf0cecd76dd0501cbb98c77583c11a622dcfe73f Mon Sep 17 00:00:00 2001 From: Raphael Kubo da Costa Date: Thu, 3 Jul 2014 17:03:39 +0300 Subject: ssl_support: Adjust to tunneling changes in Python 2.7.7 and 3.4.1. The fix for https://bugs.python.org/issue7776 changed httplib.HTTPConnection's handling of tunneling: `host' now points to the proxy host, so we have to adjust the code to perform the certificate validation on `_tunnel_host' instead when it is available. --- setuptools/ssl_support.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/setuptools/ssl_support.py b/setuptools/ssl_support.py index 7b5f429f..cc7db067 100644 --- a/setuptools/ssl_support.py +++ b/setuptools/ssl_support.py @@ -178,12 +178,19 @@ class VerifyingHTTPSConn(HTTPSConnection): if hasattr(self, '_tunnel') and getattr(self, '_tunnel_host', None): self.sock = sock self._tunnel() + # http://bugs.python.org/issue7776: Python>=3.4.1 and >=2.7.7 + # change self.host to mean the proxy server host when tunneling is + # being used. Adapt, since we are interested in the destination + # host for the match_hostname() comparison. + actual_host = self._tunnel_host + else: + actual_host = self.host self.sock = ssl.wrap_socket( sock, cert_reqs=ssl.CERT_REQUIRED, ca_certs=self.ca_bundle ) try: - match_hostname(self.sock.getpeercert(), self.host) + match_hostname(self.sock.getpeercert(), actual_host) except CertificateError: self.sock.shutdown(socket.SHUT_RDWR) self.sock.close() -- cgit v1.2.3