mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-10-10 00:43:41 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 18

Issue #13636: Weak ciphers are now disabled by default in the ssl module

Browse source 
(except when SSLv2 is explicitly asked for).
This commit is contained in:
Antoine Pitrou 2012-01-03 22:46:48 +01:00
parent ea320abcae
commit 8f85f907e3
3 changed files with 34 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

12
Lib/ssl.py
View file

@ -86,8 +86,9 @@ _PROTOCOL_NAMES = {
}
try:
from _ssl import PROTOCOL_SSLv2
_SSLv2_IF_EXISTS = PROTOCOL_SSLv2
except ImportError:
pass
_SSLv2_IF_EXISTS = None
else:
_PROTOCOL_NAMES[PROTOCOL_SSLv2] = "SSLv2"
@ -98,6 +99,10 @@ import base64 # for DER-to-PEM translation
import traceback
import errno
# Disable weak or insecure ciphers by default
# (OpenSSL's default setting is 'DEFAULT:!aNULL:!eNULL')
_DEFAULT_CIPHERS = 'DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2'
class CertificateError(ValueError):
pass
@ -165,7 +170,10 @@ class SSLContext(_SSLContext):
__slots__ = ('protocol',)
def __new__(cls, protocol, *args, **kwargs):
return _SSLContext.__new__(cls, protocol)
self = _SSLContext.__new__(cls, protocol)
if protocol != _SSLv2_IF_EXISTS:
self.set_ciphers(_DEFAULT_CIPHERS)
return self
def __init__(self, protocol):
self.protocol = protocol