Merge lp:~jderose/microfiber/crime into lp:microfiber

[Jason Gerard DeRose]

* Adds Python3.2 monkey patch for ssl.OP_NO_COMPRESSION constant

* build_ssl_context() now sets the options like this:

    ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
    ctx.verify_mode = ssl.CERT_REQUIRED
    ctx.options |= ssl.OP_NO_COMPRESSION

* Updates build_ssl_context() tests to check ctx.options

[Jason Gerard DeRose (jderose)]

Oh, one more thing: I've done some out-of-band tests with Apache and mod_wsgi to confirm that setting ssl.OP_NO_COMPRESSION on the client-side indeed results in compression being disabled, even when it's not disabled on the server.

[David Jordan (dmj726)]

Thanks! This'll be good to ensure security, though I suspect there wasn't much of a vulnerability here.

review: Approve

=== modified file 'microfiber.py'
--- microfiber.py	2012-09-26 09:01:57 +0000
+++ microfiber.py	2012-09-30 09:27:21 +0000
@@ -59,6 +59,10 @@
 import math
 import platform
 
+# Monkey patch python3.2 to add ssl.OP_NO_COMPRESSION available in python3.3:
+if not hasattr(ssl, 'OP_NO_COMPRESSION'):
+    ssl.OP_NO_COMPRESSION = 131072  
+
 
 __all__ = (
     'random_id',
@@ -519,6 +523,7 @@
 def build_ssl_context(config):
     ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
     ctx.verify_mode = ssl.CERT_REQUIRED
+    ctx.options |= ssl.OP_NO_COMPRESSION  # Protect against CRIME-like attacks
 
     # Configure certificate authorities used to verify server certs
     if 'ca_file' in config or 'ca_path' in config:
 
=== modified file 'test_microfiber.py'
--- test_microfiber.py	2012-09-25 07:29:00 +0000
+++ test_microfiber.py	2012-09-30 09:27:21 +0000
@@ -372,6 +372,7 @@
         self.assertIsInstance(ctx, ssl.SSLContext)
         self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
         self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
+        self.assertEqual(ctx.options, ssl.OP_ALL | ssl.OP_NO_COMPRESSION)
 
         # Provide ca_file
         config = {
@@ -381,6 +382,7 @@
         self.assertIsInstance(ctx, ssl.SSLContext)
         self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
         self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
+        self.assertEqual(ctx.options, ssl.OP_ALL | ssl.OP_NO_COMPRESSION)
 
         # Provide cert_file and key_file (uses openssl default ca_path)
         config = {
@@ -391,6 +393,7 @@
         self.assertIsInstance(ctx, ssl.SSLContext)
         self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
         self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
+        self.assertEqual(ctx.options, ssl.OP_ALL | ssl.OP_NO_COMPRESSION)
 
         # Provide all three
         config = {
@@ -402,6 +405,7 @@
         self.assertIsInstance(ctx, ssl.SSLContext)
         self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
         self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
+        self.assertEqual(ctx.options, ssl.OP_ALL | ssl.OP_NO_COMPRESSION)
 
         # Provide junk ca_file, make sure ca_file is actually being used
         config = {