Ensure eventlet SSL HTTPs contexts allow HTTP verify disabled #485
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Python SSL supports a couple of different ways to disable HTTPS verification, either via an environment variable or via methods defined in PEP 493. To ensure these work we must call the original _create_default_https_context function to ensure we are calling the right default https context (verified or unverified) function according set by the https context factory. Fixes eventlet#484
Codecov Report
@@ Coverage Diff @@
## master #485 +/- ##
======================================
+ Coverage 45% 45% +<1%
======================================
Files 82 82
Lines 8024 8029 +5
Branches 1372 1372
======================================
+ Hits 3622 3626 +4
- Misses 4159 4160 +1
Partials 243 243
Continue to review full report at Codecov.
|
|
I verified it with a small python script, here are my results: $ cat test.py
import ssl
import eventlet
import urllib2
from eventlet.green import ssl as greenssl
eventlet.monkey_patch(os=False)
print(ssl._create_default_https_context)
print(urllib2.urlopen("https://expired.badssl.com/"))
$ export PYTHONHTTPSVERIFY=1
$ python test.py
<function green_create_default_https_context at 0x7feefd1da230>
Traceback (most recent call last):
File "test.py", line 10, in <module>
print(urllib2.urlopen("https://expired.badssl.com/"))
File "/usr/lib/python2.7/urllib2.py", line 154, in urlopen
return opener.open(url, data, timeout)
File "/usr/lib/python2.7/urllib2.py", line 429, in open
response = self._open(req, data)
File "/usr/lib/python2.7/urllib2.py", line 447, in _open
'_open', req)
File "/usr/lib/python2.7/urllib2.py", line 407, in _call_chain
result = func(*args)
File "/usr/lib/python2.7/urllib2.py", line 1241, in https_open
context=self._context)
File "/usr/lib/python2.7/urllib2.py", line 1198, in do_open
raise URLError(err)
urllib2.URLError: <urlopen error [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:661)>
$ export PYTHONHTTPSVERIFY=0
$ python test.py
<function green_create_default_https_context at 0x7efd0fd16230>
<addinfourl at 139625356258336 whose fp = <socket._fileobject object at 0x7efd11791250>> |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Monkey patched SSL context does not observe environment PYTHONHTTPSVERIFY=0 or PEP 493 settings
Eventlet monkey patches the default SSL context and as a result circumvents the logic added to python's ssl.py to change the default SSL verification behaviour here https://github.com/python/cpython/blob/2.7/Lib/ssl.py#L508-L518
Python SSL supports a couple of different ways to disable HTTPS
verification, either via an environment variable or via methods defined
in PEP 493. To ensure these work we must call the original
_create_default_https_context function to ensure we are calling the
right default https context (verified or unverified) function according
set by the https context factory.
Fixes #484