diff options
| author | Christian Heimes <christian@python.org> | 2019-07-02 18:39:42 (GMT) |
|---|---|---|
| committer | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2019-07-02 18:39:42 (GMT) |
| commit | 477b1b25768945621d466a8b3f0739297a842439 (patch) | |
| tree | b6e320b2a8bfad573e567855ba107fb172d4627a /Lib/test/test_ssl.py | |
| parent | 7cb9204ee1cf204f6f507d99a60f7c5bb359eebb (diff) | |
| download | cpython-477b1b25768945621d466a8b3f0739297a842439.zip cpython-477b1b25768945621d466a8b3f0739297a842439.tar.gz cpython-477b1b25768945621d466a8b3f0739297a842439.tar.bz2 | |
bpo-37463: match_hostname requires quad-dotted IPv4 (GH-14499)
ssl.match_hostname() no longer accepts IPv4 addresses with additional text
after the address and only quad-dotted notation without trailing
whitespaces. Some inet_aton() implementations ignore whitespace and all data
after whitespace, e.g. '127.0.0.1 whatever'.
Short notations like '127.1' for '127.0.0.1' were already filtered out.
The bug was initially found by Dominik Czarnota and reported by Paul Kehrer.
Signed-off-by: Christian Heimes <christian@python.org>
https://bugs.python.org/issue37463
Diffstat (limited to 'Lib/test/test_ssl.py')
| -rw-r--r-- | Lib/test/test_ssl.py | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index ef17239..d2b9e20 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -669,9 +669,14 @@ class BasicSocketTests(unittest.TestCase): cert = {'subject': ((('commonName', 'example.com'),),), 'subjectAltName': (('DNS', 'example.com'), ('IP Address', '10.11.12.13'), - ('IP Address', '14.15.16.17'))} + ('IP Address', '14.15.16.17'), + ('IP Address', '127.0.0.1'))} ok(cert, '10.11.12.13') ok(cert, '14.15.16.17') + # socket.inet_ntoa(socket.inet_aton('127.1')) == '127.0.0.1' + fail(cert, '127.1') + fail(cert, '14.15.16.17 ') + fail(cert, '14.15.16.17 extra data') fail(cert, '14.15.16.18') fail(cert, 'example.net') @@ -684,6 +689,8 @@ class BasicSocketTests(unittest.TestCase): ('IP Address', '2003:0:0:0:0:0:0:BABA\n'))} ok(cert, '2001::cafe') ok(cert, '2003::baba') + fail(cert, '2003::baba ') + fail(cert, '2003::baba extra data') fail(cert, '2003::bebe') fail(cert, 'example.net') |