Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Disable the use of session tickets on TLSv1.2 by default #1970

Merged
merged 3 commits into from Sep 25, 2020
Merged

Disable the use of session tickets on TLSv1.2 by default #1970

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
38c2679
disable the use of session tickets on TLSv1.2 by default
PleasantMachine9 Sep 18, 2020
69e82e3
Update ssl_.py
sethmlarson Sep 25, 2020
1bda47f
Update ssl_.py
sethmlarson Sep 25, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
13 changes: 12 additions & 1 deletion src/urllib3/util/ssl_.py
View file
Open in desktop
Expand Up @@ -64,6 +64,12 @@ def _const_compare_digest_backport(a, b):
OP_NO_COMPRESSION = 0x20000


try: # OP_NO_TICKET was added in Python 3.6
from ssl import OP_NO_TICKET
except ImportError:
OP_NO_TICKET = 0x4000


# A secure default.
# Sources for more information on TLS ciphers:
#
Expand Down Expand Up @@ -250,7 +256,7 @@ def create_urllib3_context(
``ssl.CERT_REQUIRED``.
:param options:
Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2``,
``ssl.OP_NO_SSLv3``, ``ssl.OP_NO_COMPRESSION``.
``ssl.OP_NO_SSLv3``, ``ssl.OP_NO_COMPRESSION``, and ``ssl.OP_NO_TICKET``.
:param ciphers:
Which cipher suites to allow the server to select.
:returns:
Expand All @@ -273,6 +279,11 @@ def create_urllib3_context(
# Disable compression to prevent CRIME attacks for OpenSSL 1.0+
# (issue #309)
options |= OP_NO_COMPRESSION
# TLSv1.2 only. Unless set explicitly, do not request tickets.
# This may save some bandwidth on wire, and although the ticket is encrypted,
# there is a risk associated with it being on wire,
# if the server is not rotating its ticketing keys properly.
options |= OP_NO_TICKET

context.options |= options

Expand Down