Donald Stufft [Sun, 23 Mar 2014 23:05:28 +0000 (19:05 -0400)]
Issue #21013: Enhance ssl.create_default_context() for server side contexts
Closes #21013 by modfying ssl.create_default_context() to:
* Move the restricted ciphers to only apply when using
ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
is the lack of RC4 in the restricted. However there are servers that exist
that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
socket the context will prioritize our ciphers which have been carefully
selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
that end users can more easily determine if they need to unset
ssl.OP_NO_SSLv3.
Antoine Pitrou [Sat, 22 Mar 2014 17:14:57 +0000 (18:14 +0100)]
Issue #21015: SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1".
(should also fix a buildbot failure introduced by #20995)
Antoine Pitrou [Sat, 22 Mar 2014 17:13:50 +0000 (18:13 +0100)]
Issue #21015: SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1".
(should also fix a buildbot failure introduced by #20995)
Zachary Ware [Sat, 22 Mar 2014 05:36:25 +0000 (00:36 -0500)]
Issue #15968: Temporarily revert change to PCbuild/rt.bat
to prevent buildbot failures on test_idle. This change
should go back in once #20035 is fixed.
Zachary Ware [Sat, 22 Mar 2014 03:58:19 +0000 (22:58 -0500)]
Issue #15968: Incorporated Tcl, Tk, and Tix builds into the Windows build
solution.
Currently, Tix is not built in Debug configuration.
This change also:
- simplifies some Tcl/Tk-related msbuild properties for _tkinter
- copies the Tcl and Tk DLLs into the build output directory, meaning
they will always be available after a build without having to copy
them manually or change PATH
- removes PCbuild/build_tkinter.py: the solution does the build without
needing to invoke Python (so Tcl/Tk/Tix can be built in parallel with
the rest of the build using the `/m` msbuild command line switch)
- removes an outdated README concerning building Tcl/Tk on AMD64
Donald Stufft [Sat, 22 Mar 2014 01:33:34 +0000 (21:33 -0400)]
Issue #20995: Enhance default ciphers used by the ssl module
Closes #20995 by Enabling better security by prioritizing ciphers
such that:
* Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
* Prefer ECDHE over DHE for better performance
* Prefer any AES-GCM over any AES-CBC for better performance and security
* Then Use HIGH cipher suites as a fallback
* Then Use 3DES as fallback which is secure but slow
* Finally use RC4 as a fallback which is problematic but needed for
compatibility some times.
* Disable NULL authentication, NULL encryption, and MD5 MACs for security
reasons
Victor Stinner [Fri, 21 Mar 2014 09:00:52 +0000 (10:00 +0100)]
asyncio: Ensure call_soon(), call_later() and call_at() are invoked on current
loop in debug mode. Raise a RuntimeError if the event loop of the current
thread is different. The check should help to debug thread-safetly issue.
Patch written by David Foster.
Zachary Ware [Wed, 19 Mar 2014 03:34:52 +0000 (22:34 -0500)]
Clean up PCbuild/pcbuild.sln a bit:
- Remove configuration settings from removed _sha3.vcxproj
- Don't try to build configurations of _testembed that don't exist
(namely, PGInstrument and PGUpdate)
projects / python / log