Author: tomaz Date: Thu Aug 2 00:40:56 2012 New Revision: 1368325 URL: http://svn.apache.org/viewvc?rev=1368325&view=rev Log: Merge changes from 0.11.x branch:
Fix hostname validation in the SSL verification code (CVE-2012-3446). Reported by researchers from the University of Texas at Austin (Martin Georgiev, Suman Jana and Vitaly Shmatikov). For more info, see http://libcloud.apache.org/security.html. Modified: libcloud/trunk/ (props changed) libcloud/trunk/CHANGES libcloud/trunk/libcloud/__init__.py libcloud/trunk/libcloud/httplib_ssl.py libcloud/trunk/libcloud/test/test_httplib_ssl.py Propchange: libcloud/trunk/ ------------------------------------------------------------------------------ Merged /libcloud/branches/0.11.x:r1368315-1368323 Merged /libcloud/tags/0.11.0:r1364889-1368314 Modified: libcloud/trunk/CHANGES URL: http://svn.apache.org/viewvc/libcloud/trunk/CHANGES?rev=1368325&r1=1368324&r2=1368325&view=diff ============================================================================== --- libcloud/trunk/CHANGES (original) +++ libcloud/trunk/CHANGES Thu Aug 2 00:40:56 2012 @@ -7,6 +7,15 @@ Changes with Apache Libcloud in developm - Add new Rackspace Nova driver for Chicago (ORD) location ; LIBCLOUD-234 [Brian McDaniel] +Changes with Apache Libcloud 0.11.1: + + *) General + + - Fix hostname validation in the SSL verification code (CVE-2012-3446). + + Reported by researchers from the University of Texas at Austin (Martin + Georgiev, Suman Jana and Vitaly Shmatikov). + Changes with Apache Libcloud 0.11.0: *) Compute @@ -146,7 +155,7 @@ Changes with Apache Libcloud 0.11.0: CloudFiles driver. [Tomaz Muraus] - - Fix a bug with content_type and and encoding of object and path names in + - Fix a bug with content_type and and encoding of object and path names in the Atmos driver. [Russell Keith-Magee] @@ -241,7 +250,7 @@ Changes with Apache Libcloud 0.10.1: - Add ex_rescue and ex_unrescue method to OpenStack 1.1 driver. ; LIBCLOUD-193 - [Shawn Smith] + [Shawn Smith] - Include 'password' in the node extra dictionary when calling deploy_node if the password auth is used. @@ -426,7 +435,7 @@ Changes with Apache Libcloud 0.8.0: - Enable ex_delete_image method in the OpenStack 1.1 driver. [Shawn Smith] - - Return NodeImage instance in OpenStack 1.1 driver ex_save_image method + - Return NodeImage instance in OpenStack 1.1 driver ex_save_image method ; LIBCLOUD-138 [Shawn Smith] Modified: libcloud/trunk/libcloud/__init__.py URL: http://svn.apache.org/viewvc/libcloud/trunk/libcloud/__init__.py?rev=1368325&r1=1368324&r2=1368325&view=diff ============================================================================== --- libcloud/trunk/libcloud/__init__.py (original) +++ libcloud/trunk/libcloud/__init__.py Thu Aug 2 00:40:56 2012 @@ -20,7 +20,7 @@ libcloud provides a unified interface to """ __all__ = ['__version__', 'enable_debug'] -__version__ = '0.11.0' +__version__ = '0.11.1' try: import paramiko Modified: libcloud/trunk/libcloud/httplib_ssl.py URL: http://svn.apache.org/viewvc/libcloud/trunk/libcloud/httplib_ssl.py?rev=1368325&r1=1368324&r2=1368325&view=diff ============================================================================== --- libcloud/trunk/libcloud/httplib_ssl.py (original) +++ libcloud/trunk/libcloud/httplib_ssl.py Thu Aug 2 00:40:56 2012 @@ -122,13 +122,8 @@ class LibcloudHTTPSConnection(httplib.HT # replace * with alphanumeric and dash # replace . with literal . valid_patterns = [ - re.compile( - pattern.replace( - r".", r"\." - ).replace( - r"*", r"[0-9A-Za-z]+" - ) - ) + re.compile('^' + pattern.replace(r".", r"\.") \ + .replace(r"*", r"[0-9A-Za-z]+") + '$') for pattern in (set(common_name) | set(alt_names))] return any( Modified: libcloud/trunk/libcloud/test/test_httplib_ssl.py URL: http://svn.apache.org/viewvc/libcloud/trunk/libcloud/test/test_httplib_ssl.py?rev=1368325&r1=1368324&r2=1368325&view=diff ============================================================================== --- libcloud/trunk/libcloud/test/test_httplib_ssl.py (original) +++ libcloud/trunk/libcloud/test/test_httplib_ssl.py Thu Aug 2 00:40:56 2012 @@ -45,16 +45,49 @@ class TestHttpLibSSLTests(unittest.TestC 'subjectAltName': ((('DNS', 'foo.alt.name')), (('DNS', 'foo.alt.name.1')))} + cert3 = {'notAfter': 'Feb 16 16:54:50 2013 GMT', + 'subject': ((('countryName', 'US'),), + (('stateOrProvinceName', 'Delaware'),), + (('localityName', 'Wilmington'),), + (('organizationName', 'Python Software Foundation'),), + (('organizationalUnitName', 'SSL'),), + (('commonName', 'python.org'),))} + self.assertFalse(self.httplib_object._verify_hostname( hostname='invalid', cert=cert1)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='machine.python.org', cert=cert1)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='foomachine.python.org', cert=cert1)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='somesomemachine.python.org', cert=cert1)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='somemachine.python.orga', cert=cert1)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='somemachine.python.org.org', cert=cert1)) self.assertTrue(self.httplib_object._verify_hostname( hostname='somemachine.python.org', cert=cert1)) self.assertFalse(self.httplib_object._verify_hostname( hostname='invalid', cert=cert2)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='afoo.alt.name.1', cert=cert2)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='a.foo.alt.name.1', cert=cert2)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='foo.alt.name.1.2', cert=cert2)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='afoo.alt.name.1.2', cert=cert2)) self.assertTrue(self.httplib_object._verify_hostname( hostname='foo.alt.name.1', cert=cert2)) + self.assertTrue(self.httplib_object._verify_hostname( + hostname='python.org', cert=cert3)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='opython.org', cert=cert3)) + self.assertFalse(self.httplib_object._verify_hostname( + hostname='ython.org', cert=cert3)) + def test_get_subject_alt_names(self): cert1 = {'notAfter': 'Feb 16 16:54:50 2013 GMT', 'subject': ((('countryName', 'US'),),
