crabapples
/
websockify
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Disable SSL3 in Python wrap_socket 

Against POODLE security vulnerability.

Note: breaks Python2 support.
This commit is contained in:
Wiebe Cazemier 2017-01-16 09:59:52 +01:00
parent cb1508fa49
commit cdd08e90b7
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
websockify/websocket.py
View File

@ -833,11 +833,12 @@ class WebSocketServer(object):
% self.cert) % self.cert)
retsock = None retsock = None
try: try:
retsock = ssl.wrap_socket( # This stuff only works in Python3. In the Python 2.7.4 in Ubuntu it's mighty hard to disable SSLv3, because of the lack of SSLContext
sock, sslcontext = ssl.SSLContext(protocol=ssl.PROTOCOL_SSLv23) # SSLv23 is the deprecrated, python 3.4 compatible way of saying 'everything, also TLS'
server_side=True, sslcontext.load_cert_chain(certfile=self.cert, keyfile=self.key);
certfile=self.cert, sslcontext.options |= ssl.OP_NO_SSLv3
keyfile=self.key)
retsock = sslcontext.wrap_socket(sock, server_side=True);
except ssl.SSLError: except ssl.SSLError:
_, x, _ = sys.exc_info() _, x, _ = sys.exc_info()
if x.args[0] == ssl.SSL_ERROR_EOF: if x.args[0] == ssl.SSL_ERROR_EOF: