Donald Stufft [Mon, 24 Mar 2014 23:26:03 +0000 (19:26 -0400)]
Issue #21043: Remove the recommendation for specific CA organizations
Closes #21043 by updating the documentation to remove specific CA
organizations and update the text to no longer need to tell you to
download root certificates, but instead use the OS certificates
avaialble through SSLContext.load_default_certs.
Donald Stufft [Sun, 23 Mar 2014 23:05:28 +0000 (19:05 -0400)]
Issue #21013: Enhance ssl.create_default_context() for server side contexts
Closes #21013 by modfying ssl.create_default_context() to:
* Move the restricted ciphers to only apply when using
ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
is the lack of RC4 in the restricted. However there are servers that exist
that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
socket the context will prioritize our ciphers which have been carefully
selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
that end users can more easily determine if they need to unset
ssl.OP_NO_SSLv3.
Antoine Pitrou [Sat, 22 Mar 2014 17:14:57 +0000 (18:14 +0100)]
Issue #21015: SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1".
(should also fix a buildbot failure introduced by #20995)
Antoine Pitrou [Sat, 22 Mar 2014 17:13:50 +0000 (18:13 +0100)]
Issue #21015: SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1".
(should also fix a buildbot failure introduced by #20995)
Zachary Ware [Sat, 22 Mar 2014 05:36:25 +0000 (00:36 -0500)]
Issue #15968: Temporarily revert change to PCbuild/rt.bat
to prevent buildbot failures on test_idle. This change
should go back in once #20035 is fixed.
Zachary Ware [Sat, 22 Mar 2014 03:58:19 +0000 (22:58 -0500)]
Issue #15968: Incorporated Tcl, Tk, and Tix builds into the Windows build
solution.
Currently, Tix is not built in Debug configuration.
This change also:
- simplifies some Tcl/Tk-related msbuild properties for _tkinter
- copies the Tcl and Tk DLLs into the build output directory, meaning
they will always be available after a build without having to copy
them manually or change PATH
- removes PCbuild/build_tkinter.py: the solution does the build without
needing to invoke Python (so Tcl/Tk/Tix can be built in parallel with
the rest of the build using the `/m` msbuild command line switch)
- removes an outdated README concerning building Tcl/Tk on AMD64
Donald Stufft [Sat, 22 Mar 2014 01:33:34 +0000 (21:33 -0400)]
Issue #20995: Enhance default ciphers used by the ssl module
Closes #20995 by Enabling better security by prioritizing ciphers
such that:
* Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
* Prefer ECDHE over DHE for better performance
* Prefer any AES-GCM over any AES-CBC for better performance and security
* Then Use HIGH cipher suites as a fallback
* Then Use 3DES as fallback which is secure but slow
* Finally use RC4 as a fallback which is problematic but needed for
compatibility some times.
* Disable NULL authentication, NULL encryption, and MD5 MACs for security
reasons
Victor Stinner [Fri, 21 Mar 2014 09:00:52 +0000 (10:00 +0100)]
asyncio: Ensure call_soon(), call_later() and call_at() are invoked on current
loop in debug mode. Raise a RuntimeError if the event loop of the current
thread is different. The check should help to debug thread-safetly issue.
Patch written by David Foster.
Victor Stinner [Fri, 21 Mar 2014 09:00:52 +0000 (10:00 +0100)]
asyncio: Ensure call_soon(), call_later() and call_at() are invoked on current
loop in debug mode. Raise a RuntimeError if the event loop of the current
thread is different. The check should help to debug thread-safetly issue.
Patch written by David Foster.
projects / python / log