churchyard / rpms / python3

Forked from rpms/python3 4 years ago
Clone

Blame 00298-do-not-send-IP-in-SNI-TLS-extension.patch

c9bb114
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
c9bb114
index df8c6a7d96d8..e8cffef14de0 100644
c9bb114
--- a/Modules/_ssl.c
c9bb114
+++ b/Modules/_ssl.c
c9bb114
@@ -55,6 +55,11 @@ static PySocketModule_APIObject PySocketModule;
c9bb114
 #include <sys/poll.h>
c9bb114
 #endif
c9bb114
 
c9bb114
+#ifndef MS_WINDOWS
c9bb114
+/* inet_pton */
c9bb114
+#include <arpa/inet.h>
c9bb114
+#endif
c9bb114
+
c9bb114
 /* Don't warn about deprecated functions */
c9bb114
 #ifdef __GNUC__
c9bb114
 #pragma GCC diagnostic ignored "-Wdeprecated-declarations"
c9bb114
@@ -667,8 +672,41 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
c9bb114
     SSL_set_mode(self->ssl, mode);
c9bb114
 
c9bb114
 #if HAVE_SNI
c9bb114
-    if (server_hostname != NULL)
c9bb114
-        SSL_set_tlsext_host_name(self->ssl, server_hostname);
c9bb114
+    if (server_hostname != NULL) {
c9bb114
+/* Don't send SNI for IP addresses. We cannot simply use inet_aton() and
c9bb114
+ * inet_pton() here. inet_aton() may be linked weakly and inet_pton() isn't
c9bb114
+ * available on all platforms. Use OpenSSL's IP address parser. It's
c9bb114
+ * available since 1.0.2 and LibreSSL since at least 2.3.0. */
c9bb114
+        int send_sni = 1;
c9bb114
+#if OPENSSL_VERSION_NUMBER >= 0x10200000L
c9bb114
+        ASN1_OCTET_STRING *ip = a2i_IPADDRESS(server_hostname);
c9bb114
+        if (ip == NULL) {
c9bb114
+            send_sni = 1;
c9bb114
+            ERR_clear_error();
c9bb114
+        } else {
c9bb114
+            send_sni = 0;
c9bb114
+            ASN1_OCTET_STRING_free(ip);
c9bb114
+        }
c9bb114
+#elif defined(HAVE_INET_PTON)
c9bb114
+#ifdef ENABLE_IPV6
c9bb114
+        char packed[Py_MAX(sizeof(struct in_addr), sizeof(struct in6_addr))];
c9bb114
+#else
c9bb114
+        char packed[sizeof(struct in_addr)];
c9bb114
+#endif /* ENABLE_IPV6 */
c9bb114
+        if (inet_pton(AF_INET, server_hostname, packed)) {
c9bb114
+            send_sni = 0;
c9bb114
+#ifdef ENABLE_IPV6
c9bb114
+        } else if(inet_pton(AF_INET6, server_hostname, packed)) {
c9bb114
+            send_sni = 0;
c9bb114
+#endif /* ENABLE_IPV6 */
c9bb114
+        } else {
c9bb114
+            send_sni = 1;
c9bb114
+        }
c9bb114
+#endif /* HAVE_INET_PTON */
c9bb114
+        if (send_sni) {
c9bb114
+            SSL_set_tlsext_host_name(self->ssl, server_hostname);
c9bb114
+        }
c9bb114
+    }
c9bb114
 #endif
c9bb114
 
c9bb114
     /* If the socket is in non-blocking mode or timeout mode, set the BIO