Apply changes from 1.24.2 release to master
MODIFY
.travis.yml
.travis.yml
@@ -31,13 +31,13 @@ env:
- PYPI_USERNAME=urllib3
# PYPI_PASSWORD is set in Travis control panel.
- matrix:
- - TOXENV=flake8-py3
- - TOXENV=gae
- - TOXENV=docs
-
matrix:
include:
+ - python: 3.6
+ env: TOXENV=flake8-py3
+ - python: 3.6
+ env: TOXENV=docs
+
- python: 2.7
env: TOXENV=py27
- python: 2.7
@@ -63,6 +63,10 @@ matrix:
- python: pypy-5.4
env: TOXENV=pypy
+
+ - python: 2.7
+ env: TOXENV=gae
+
- language: generic
os: osx
env: TOXENV=py27

MODIFY
CHANGES.rst
CHANGES.rst
@@ -8,8 +8,6 @@ dev (master)
* Upgraded ``urllib3.utils.parse_url()`` to be RFC 3986 compliant. (Pull #1487)
-* Remove Authorization header regardless of case when redirecting to cross-site. (Issue #1510)
-
* Added support for ``key_password`` for ``HTTPSConnectionPool`` to use
encrypted ``key_file`` without creating your own ``SSLContext`` object. (Pull #1489)
@@ -28,13 +26,22 @@ dev (master)
* Drop ciphers using DSS key exchange from default TLS cipher suites.
Improve default ciphers when using SecureTransport. (Pull #1496)
-* Add support for IPv6 addresses in subjectAltName section of certificates. (Issue #1269)
-
* Switched the default multipart header encoder from RFC 2231 to HTML 5 working draft. (Issue #303, PR #1492)
* ... [Short description of non-trivial change.] (Issue #)
+1.24.2 (2019-04-17)
+-------------------
+
+* Don't load system certificates by default when any other ``ca_certs``, ``ca_certs_dir`` or
+ ``ssl_context`` parameters are specified.
+
+* Remove Authorization header regardless of case when redirecting to cross-site. (Issue #1510)
+
+* Add support for IPv6 addresses in subjectAltName section of certificates. (Issue #1269)
+
+
1.24.1 (2018-11-02)
-------------------

MODIFY
docs/requirements.txt
docs/requirements.txt
-r ../dev-requirements.txt
-ndg-httpsclient
sphinx
alabaster
requests>=2,<2.16

MODIFY
src/urllib3/util/ssl_.py
src/urllib3/util/ssl_.py
@@ -329,7 +329,8 @@ def ssl_wrap_socket(sock, keyfile=None, certfile=None, cert_reqs=None,
if e.errno == errno.ENOENT:
raise SSLError(e)
raise
- elif getattr(context, 'load_default_certs', None) is not None:
+
+ elif ssl_context is None and hasattr(context, 'load_default_certs'):
# try to load OS default certs; works well on Windows (require Python3.4+)
context.load_default_certs()

MODIFY
test/test_ssl.py
test/test_ssl.py
@@ -88,3 +88,40 @@ def test_create_urllib3_context_set_ciphers(monkeypatch, ciphers, expected_ciphe
assert context.set_ciphers.call_count == 1
assert context.set_ciphers.call_args == mock.call(expected_ciphers)
+
+
+def test_wrap_socket_given_context_no_load_default_certs():
+ context = mock.create_autospec(ssl_.SSLContext)
+ context.load_default_certs = mock.Mock()
+
+ sock = mock.Mock()
+ ssl_.ssl_wrap_socket(sock, ssl_context=context)
+
+ context.load_default_certs.assert_not_called()
+
+
+def test_wrap_socket_given_ca_certs_no_load_default_certs(monkeypatch):
+ context = mock.create_autospec(ssl_.SSLContext)
+ context.load_default_certs = mock.Mock()
+ context.options = 0
+
+ monkeypatch.setattr(ssl_, "SSLContext", lambda *_, **__: context)
+
+ sock = mock.Mock()
+ ssl_.ssl_wrap_socket(sock, ca_certs="/tmp/fake-file")
+
+ context.load_default_certs.assert_not_called()
+ context.load_verify_locations.assert_called_with("/tmp/fake-file", None)
+
+
+def test_wrap_socket_default_loads_default_certs(monkeypatch):
+ context = mock.create_autospec(ssl_.SSLContext)
+ context.load_default_certs = mock.Mock()
+ context.options = 0
+
+ monkeypatch.setattr(ssl_, "SSLContext", lambda *_, **__: context)
+
+ sock = mock.Mock()
+ ssl_.ssl_wrap_socket(sock)
+
+ context.load_default_certs.assert_called_with()

Apply changes from 1.24.2 release to master (#1566)