diff options
author | Antoine Pitrou <solipsis@pitrou.net> | 2013-12-28 16:30:51 (GMT) |
---|---|---|
committer | Antoine Pitrou <solipsis@pitrou.net> | 2013-12-28 16:30:51 (GMT) |
commit | e6d2f159fcadd5fc336970110c49bba706b9787e (patch) | |
tree | b7776304fedf69f6073b393b822dcd3519f2d859 /Lib | |
parent | c1764dd3506e70d19d1bdda171b7812d416ad92f (diff) | |
parent | 3e86ba4e321d20931648d110e1be12643cb8ff04 (diff) | |
download | cpython-e6d2f159fcadd5fc336970110c49bba706b9787e.zip cpython-e6d2f159fcadd5fc336970110c49bba706b9787e.tar.gz cpython-e6d2f159fcadd5fc336970110c49bba706b9787e.tar.bz2 |
Issue #19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
Diffstat (limited to 'Lib')
-rw-r--r-- | Lib/ssl.py | 5 | ||||
-rw-r--r-- | Lib/test/test_ssl.py | 11 |
2 files changed, 16 insertions, 0 deletions
@@ -150,6 +150,7 @@ if sys.platform == "win32": from socket import getnameinfo as _getnameinfo from socket import SHUT_RDWR as _SHUT_RDWR from socket import socket, AF_INET, SOCK_STREAM, create_connection +from socket import SOL_SOCKET, SO_TYPE import base64 # for DER-to-PEM translation import traceback import errno @@ -482,6 +483,10 @@ class SSLSocket(socket): self.ssl_version = ssl_version self.ca_certs = ca_certs self.ciphers = ciphers + # Can't use sock.type as other flags (such as SOCK_NONBLOCK) get + # mixed in. + if sock.getsockopt(SOL_SOCKET, SO_TYPE) != SOCK_STREAM: + raise NotImplementedError("only stream sockets are supported") if server_side and server_hostname: raise ValueError("server_hostname can only be specified " "in client mode") diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 6eb88d7..14d3cc1 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -632,6 +632,17 @@ class BasicSocketTests(unittest.TestCase): self.assertEqual(ssl.Purpose.CLIENT_AUTH.oid, '1.3.6.1.5.5.7.3.2') + def test_unsupported_dtls(self): + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + self.addCleanup(s.close) + with self.assertRaises(NotImplementedError) as cx: + ssl.wrap_socket(s, cert_reqs=ssl.CERT_NONE) + self.assertEqual(str(cx.exception), "only stream sockets are supported") + ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) + with self.assertRaises(NotImplementedError) as cx: + ctx.wrap_socket(s) + self.assertEqual(str(cx.exception), "only stream sockets are supported") + class ContextTests(unittest.TestCase): |