changeset:   93775:ee095a2e2b35
parent:      93770:7f3695701724
parent:      93771:a409a7cd908d
user:        Benjamin Peterson <benjamin@python.org>
date:        Sun Dec 07 13:47:34 2014 -0500
files:       Lib/http/client.py Lib/test/test_httplib.py Misc/NEWS
description:
merge 3.4 (#22959)


diff -r 7f3695701724 -r ee095a2e2b35 Doc/library/http.client.rst
--- a/Doc/library/http.client.rst	Sun Dec 07 01:28:27 2014 +0100
+++ b/Doc/library/http.client.rst	Sun Dec 07 13:47:34 2014 -0500
@@ -69,17 +69,12 @@
    *key_file* and *cert_file* are deprecated, please use
    :meth:`ssl.SSLContext.load_cert_chain` instead, or let
    :func:`ssl.create_default_context` select the system's trusted CA
-   certificates for you.
+   certificates for you.  The *check_hostname* parameter is also deprecated; the
+   :attr:`SSLContext.check_hostname` attribute of *context* should be used
+   instead.
 
    Please read :ref:`ssl-security` for more information on best practices.
 
-   .. note::
-      If *context* is specified and has a :attr:`~ssl.SSLContext.verify_mode`
-      of either :data:`~ssl.CERT_OPTIONAL` or :data:`~ssl.CERT_REQUIRED`, then
-      by default *host* is matched against the host name(s) allowed by the
-      server's certificate.  If you want to change that behaviour, you can
-      explicitly set *check_hostname* to False.
-
    .. versionchanged:: 3.2
       *source_address*, *context* and *check_hostname* were added.
 
diff -r 7f3695701724 -r ee095a2e2b35 Lib/http/client.py
--- a/Lib/http/client.py	Sun Dec 07 01:28:27 2014 +0100
+++ b/Lib/http/client.py	Sun Dec 07 13:47:34 2014 -0500
@@ -1274,8 +1274,8 @@
                 context = ssl._create_default_https_context()
             will_verify = context.verify_mode != ssl.CERT_NONE
             if check_hostname is None:
-                check_hostname = will_verify
-            elif check_hostname and not will_verify:
+                check_hostname = context.check_hostname
+            if check_hostname and not will_verify:
                 raise ValueError("check_hostname needs a SSL context with "
                                  "either CERT_OPTIONAL or CERT_REQUIRED")
             if key_file or cert_file:
diff -r 7f3695701724 -r ee095a2e2b35 Lib/test/test_httplib.py
--- a/Lib/test/test_httplib.py	Sun Dec 07 01:28:27 2014 +0100
+++ b/Lib/test/test_httplib.py	Sun Dec 07 13:47:34 2014 -0500
@@ -1113,6 +1113,7 @@
         server = self.make_server(CERT_fakehostname)
         context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
         context.verify_mode = ssl.CERT_REQUIRED
+        context.check_hostname = True
         context.load_verify_locations(CERT_fakehostname)
         h = client.HTTPSConnection('localhost', server.port, context=context)
         with self.assertRaises(ssl.CertificateError):
@@ -1123,11 +1124,24 @@
         with self.assertRaises(ssl.CertificateError):
             h.request('GET', '/')
         # With check_hostname=False, the mismatching is ignored
+        context.check_hostname = False
         h = client.HTTPSConnection('localhost', server.port, context=context,
                                    check_hostname=False)
         h.request('GET', '/nonexistent')
         resp = h.getresponse()
         self.assertEqual(resp.status, 404)
+        # The context's check_hostname setting is used if one isn't passed to
+        # HTTPSConnection.
+        context.check_hostname = False
+        h = client.HTTPSConnection('localhost', server.port, context=context)
+        h.request('GET', '/nonexistent')
+        self.assertEqual(h.getresponse().status, 404)
+        # Passing check_hostname to HTTPSConnection should override the
+        # context's setting.
+        h = client.HTTPSConnection('localhost', server.port, context=context,
+                                   check_hostname=True)
+        with self.assertRaises(ssl.CertificateError):
+            h.request('GET', '/')
 
     @unittest.skipIf(not hasattr(client, 'HTTPSConnection'),
                      'http.client.HTTPSConnection not available')
diff -r 7f3695701724 -r ee095a2e2b35 Misc/NEWS
--- a/Misc/NEWS	Sun Dec 07 01:28:27 2014 +0100
+++ b/Misc/NEWS	Sun Dec 07 13:47:34 2014 -0500
@@ -194,6 +194,9 @@
 Library
 -------
 
+- Issue #22959: In the constructor of http.client.HTTPSConnection, prefer the
+  context's check_hostname attribute over the *check_hostname* parameter.
+
 - Issue #22696: Add function :func:`sys.is_finalizing` to know about
   interpreter shutdown.