fail safe if ssl.create_default_context doesn't exist

fall back to the default SSL handler when create_default_context
doesn't exist as on Python versions prior to 2.7.9 where it hasn't
been backported (Ubuntu Trusty).

The downside is no certificate verification is done.

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3a95974408e705bd056c60dc22e8009d6260e265..ab50434e089ec7db74d749fd489cc104f001ef7d 100644 (file)
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,8 @@
 - Bundle a copy of the index which can be used if download source for
   the index is not available, and no index was previously
   downloaded. Warnings will be issued.
+- Fix for Python versions prior to 2.7.9 that don't have
+  ssl.create_default_context. For example, Ubuntu Trusty.
 
 ## 1.0.0b1 - 2018-01-19
 - Various fixes for Python 3.

diff --git a/suricata/update/net.py b/suricata/update/net.py
index 33679de50cf9801ea1987e0c3fbdc0afd7ab4444..074520aa05bcb6457509fcb19930805f6dea8b7e 100644 (file)
--- a/suricata/update/net.py
+++ b/suricata/update/net.py
@@ -91,14 +91,17 @@ def get(url, fileobj, progress_hook=None):
     user_agent = build_user_agent()
     logger.debug("Setting HTTP user-agent to %s", user_agent)
 
-    ssl_context = ssl.create_default_context()
-
-    if config.get("no-check-certificate"):
-        logger.debug("Disabling SSL/TLS certificate verification.")
-        ssl_context.check_hostname = False
-        ssl_context.verify_mode = ssl.CERT_NONE
-
-    opener = build_opener(HTTPSHandler(context=ssl_context))
+    try:
+        # Wrap in a try as Python versions prior to 2.7.9 don't have
+        # create_default_context, but some distros have backported it.
+        ssl_context = ssl.create_default_context()
+        if config.get("no-check-certificate"):
+            logger.debug("Disabling SSL/TLS certificate verification.")
+            ssl_context.check_hostname = False
+            ssl_context.verify_mode = ssl.CERT_NONE
+        opener = build_opener(HTTPSHandler(context=ssl_context))
+    except:
+        opener = build_opener()
 
     opener.addheaders = [
         ("User-Agent", build_user_agent()),