Description: Support TLS SNI extension in ssl module Author: markk Bug-Python: http://bugs.python.org/issue5639 --- a/Lib/ssl.py +++ b/Lib/ssl.py @@ -202,6 +202,7 @@ def __init__(self, sock, keyfile=None, certfile=None, server_side=False, cert_reqs=CERT_NONE, ssl_version=PROTOCOL_SSLv23, ca_certs=None, + server_hostname=None, do_handshake_on_connect=True, suppress_ragged_eofs=True, ciphers=None): # Can't use sock.type as other flags (such as SOCK_NONBLOCK) get @@ -238,6 +239,7 @@ self._sslobj = _ssl.sslwrap(self._sock, server_side, keyfile, certfile, cert_reqs, ssl_version, ca_certs, + server_hostname, ciphers) if do_handshake_on_connect: self.do_handshake() @@ -246,6 +248,7 @@ self.cert_reqs = cert_reqs self.ssl_version = ssl_version self.ca_certs = ca_certs + self.server_hostname = server_hostname self.ciphers = ciphers self.do_handshake_on_connect = do_handshake_on_connect self.suppress_ragged_eofs = suppress_ragged_eofs @@ -411,7 +414,7 @@ raise ValueError("attempt to connect already-connected SSLSocket!") self._sslobj = _ssl.sslwrap(self._sock, False, self.keyfile, self.certfile, self.cert_reqs, self.ssl_version, - self.ca_certs, self.ciphers) + self.ca_certs, self.server_hostname, self.ciphers) try: if return_errno: rc = socket.connect_ex(self, addr) @@ -452,6 +455,7 @@ cert_reqs=self.cert_reqs, ssl_version=self.ssl_version, ca_certs=self.ca_certs, + server_hostname=None, ciphers=self.ciphers, do_handshake_on_connect=self.do_handshake_on_connect, suppress_ragged_eofs=self.suppress_ragged_eofs), @@ -566,7 +570,7 @@ sock = sock._sock ssl_sock = _ssl.sslwrap(sock, 0, keyfile, certfile, CERT_NONE, - PROTOCOL_SSLv23, None) + PROTOCOL_SSLv23, None, None, None) try: sock.getpeername() except socket_error: --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -267,7 +267,7 @@ enum py_ssl_server_or_client socket_type, enum py_ssl_cert_requirements certreq, enum py_ssl_version proto_version, - char *cacerts_file, char *ciphers) + char *cacerts_file, char *server_hostname, char *ciphers) { PySSLObject *self; char *errstr = NULL; @@ -389,6 +389,14 @@ PySSL_BEGIN_ALLOW_THREADS self->ssl = SSL_new(self->ctx); /* New ssl struct */ +#if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT) + /* If SNI isn't supported, we just don't call it and fail silently, + * as there's not much else we can do. + */ + if ((socket_type == PY_SSL_CLIENT) && + (proto_version != PY_SSL_VERSION_SSL2) && server_hostname) + SSL_set_tlsext_host_name(self->ssl, server_hostname); +#endif PySSL_END_ALLOW_THREADS SSL_set_fd(self->ssl, Sock->sock_fd); /* Set the socket for SSL */ #ifdef SSL_MODE_AUTO_RETRY @@ -431,15 +439,16 @@ char *key_file = NULL; char *cert_file = NULL; char *cacerts_file = NULL; + char *server_hostname = NULL; char *ciphers = NULL; - if (!PyArg_ParseTuple(args, "O!i|zziizz:sslwrap", + if (!PyArg_ParseTuple(args, "O!i|zziizzz:sslwrap", PySocketModule.Sock_Type, &Sock, &server_side, &key_file, &cert_file, &verification_mode, &protocol, - &cacerts_file, &ciphers)) + &cacerts_file, &server_hostname, &ciphers)) return NULL; /* @@ -452,13 +461,13 @@ return (PyObject *) newPySSLObject(Sock, key_file, cert_file, server_side, verification_mode, - protocol, cacerts_file, + protocol, cacerts_file, server_hostname, ciphers); } PyDoc_STRVAR(ssl_doc, "sslwrap(socket, server_side, [keyfile, certfile, certs_mode, protocol,\n" -" cacertsfile, ciphers]) -> sslobject"); +" cacertsfile, ciphers, server_hostname]) -> sslobject"); /* SSL object methods */