[patch] required tls-patch

imapclient-1.1.0-tls.patch (text/plain), 1.91 KB, created by Helmut Jarausch on 2017-12-07 16:05:38 UTC

--- imapclient/tls.py.ORIG	2017-11-23 12:00:49.000000000 +0100
+++ imapclient/tls.py	2017-12-07 15:21:10.157402884 +0100
@@ -35,12 +35,7 @@
 if os.environ.get("READTHEDOCS") != "True":
     check_pyopenssl_version()
 
-try:
-    from backports import ssl
-except ImportError:
-    raise ImportError("backports.ssl is not installed")
-
-_ossl = ssl.ossl
+import ssl
 
 if sys.platform == "win32":
     try:
@@ -86,27 +81,6 @@
     context.verify_mode = ssl.CERT_REQUIRED
     context.check_hostname = True
 
-    # SSLv2 considered harmful.
-    context.options |= _ossl.OP_NO_SSLv2
-
-    # SSLv3 has problematic security and is only required for really old
-    # clients such as IE6 on Windows XP
-    context.options |= _ossl.OP_NO_SSLv3
-
-    # disable compression to prevent CRIME attacks (OpenSSL 1.0+)
-    context.options |= getattr(_ossl, "OP_NO_COMPRESSION", 0)
-
-    # Prefer the server's ciphers by default so that we get stronger
-    # encryption
-    context.options |= getattr(_ossl, "OP_CIPHER_SERVER_PREFERENCE", 0)
-
-    # Use single use keys in order to improve forward secrecy
-    context.options |= getattr(_ossl, "OP_SINGLE_DH_USE", 0)
-    context.options |= getattr(_ossl, "OP_SINGLE_ECDH_USE", 0)
-
-    # disallow ciphers with known vulnerabilities
-    # TODO: backports.ssl.SSLContext is missing set_ciphers
-    context._ctx.set_cipher_list(_RESTRICTED_SERVER_CIPHERS)
 
     if cafile or capath or cadata:
         context.load_verify_locations(cafile, capath, cadata)
@@ -194,7 +168,7 @@
 
     def shutdown(self):
         self.file.close()
-        self.sock._conn.shutdown()
+        self.sock.shutdown(socket.SHUT_RDWR)
         self.sock.close()
 
 
@@ -205,7 +179,6 @@
         self.sslsock = sslsock
 
     def shutdown(self, how):
-        return self.sslsock._conn.sock_shutdown(how)
-
+        return self.sslsock.shutdown(how)
     def __getattr__(self, name):
         return getattr(self.sslsock, name)