| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
| |
(#109682)
* gh-108303: Move all certificates to `Lib/test/certdata/` (GH-109489)
(cherry picked from commit e57ecf6bbc59f999d27b125ea51b042c24a07bd9)
Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Python 3.12 backport: update also `test_nntplib`.
Co-authored-by: Nikita Sobolev <mail@sobolevn.me>
Co-authored-by: T. Wouters <thomas@python.org>
|
|
|
|
|
|
| |
Add methods enterContext() and enterClassContext() in TestCase.
Add method enterAsyncContext() in IsolatedAsyncioTestCase.
Add function enterModuleContext().
|
| |
|
|
|
| |
Signed-off-by: Christian Heimes <christian@python.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The ssl module now has more secure default settings. Ciphers without forward
secrecy or SHA-1 MAC are disabled by default. Security level 2 prohibits
weak RSA, DH, and ECC keys with less than 112 bits of security.
:class:`~ssl.SSLContext` defaults to minimum protocol version TLS 1.2.
Settings are based on Hynek Schlawack's research.
```
$ openssl version
OpenSSL 1.1.1k FIPS 25 Mar 2021
$ openssl ciphers -v '@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM'
TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD
TLS_CHACHA20_POLY1305_SHA256 TLSv1.3 Kx=any Au=any Enc=CHACHA20/POLY1305(256) Mac=AEAD
TLS_AES_128_GCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESGCM(128) Mac=AEAD
TLS_AES_128_CCM_SHA256 TLSv1.3 Kx=any Au=any Enc=AESCCM(128) Mac=AEAD
ECDHE-ECDSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(256) Mac=AEAD
ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(256) Mac=AEAD
ECDHE-ECDSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AESGCM(128) Mac=AEAD
ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(128) Mac=AEAD
ECDHE-ECDSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=ECDSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-RSA-CHACHA20-POLY1305 TLSv1.2 Kx=ECDH Au=RSA Enc=CHACHA20/POLY1305(256) Mac=AEAD
ECDHE-ECDSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(256) Mac=SHA384
ECDHE-RSA-AES256-SHA384 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(256) Mac=SHA384
ECDHE-ECDSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=ECDSA Enc=AES(128) Mac=SHA256
ECDHE-RSA-AES128-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AES(128) Mac=SHA256
DHE-RSA-AES256-GCM-SHA384 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(256) Mac=AEAD
DHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AESGCM(128) Mac=AEAD
DHE-RSA-AES256-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(256) Mac=SHA256
DHE-RSA-AES128-SHA256 TLSv1.2 Kx=DH Au=RSA Enc=AES(128) Mac=SHA256
```
Signed-off-by: Christian Heimes <christian@python.org>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
(GH-25455)
* ssl.OP_NO_SSLv2
* ssl.OP_NO_SSLv3
* ssl.OP_NO_TLSv1
* ssl.OP_NO_TLSv1_1
* ssl.OP_NO_TLSv1_2
* ssl.OP_NO_TLSv1_3
* ssl.PROTOCOL_SSLv2
* ssl.PROTOCOL_SSLv3
* ssl.PROTOCOL_SSLv23 (alias for PROTOCOL_TLS)
* ssl.PROTOCOL_TLS
* ssl.PROTOCOL_TLSv1
* ssl.PROTOCOL_TLSv1_1
* ssl.PROTOCOL_TLSv1_2
* ssl.TLSVersion.SSLv3
* ssl.TLSVersion.TLSv1
* ssl.TLSVersion.TLSv1_1
* ssl.wrap_socket()
* ssl.RAND_pseudo_bytes()
* ssl.RAND_egd() (already removed since it's not supported by OpenSSL 1.1.1)
* ssl.SSLContext() without a protocol argument
* ssl.match_hostname()
* hashlib.pbkdf2_hmac() (pure Python implementation, fast OpenSSL
function will stay)
Signed-off-by: Christian Heimes <christian@python.org>
|
| |
|
|
|
| |
Automerge-Triggered-By: @tiran
|
| |
|
| |
|
|
|
|
|
|
| |
* Move socket related functions from test.support to socket_helper.
* Import socket, nntplib and urllib.error lazily in transient_internet().
* Remove importing multiprocess.
|
|
|
|
|
| |
nntplib.NNTP and nntplib.NNTP_SSL now raise a ValueError
if the given timeout for their constructor is zero to
prevent the creation of a non-blocking socket.
|
| |
|
|
|
|
|
| |
Replace hardcoded timeout constants in tests with INTERNET_TIMEOUT of
test.support, so it's easier to ajdust this timeout for all tests at
once.
|
|
|
|
|
|
|
|
| |
Modern Linux distros such as Debian Buster have default OpenSSL system
configurations that reject connections to servers with weak certificates
by default. This causes our test suite run with external networking
resources enabled to skip these tests when they encounter such a failure.
Fixing the network servers is a separate issue.
|
|
|
|
|
| |
The NNTP server currently has troubles with SSL, whereas we don't
have the control on this server. This test blocks all CIs, so disable
it until a fix can be found.
|
|
|
|
|
|
| |
* Remove Setup.config
* Always define WITH_THREAD for compatibility.
|
|
|
| |
fixes regression of 5b4feb7
|
|
|
|
| |
Catch also ssl.SSLEOFError in NetworkedNNTPTests setUpClass().
EOFError was already catched.
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* bpo-30175: Skip client cert tests of test_imaplib
The IMAP server cyrus.andrew.cmu.edu doesn't accept our randomly
generated client x509 certificate anymore.
* bpo-30188: Catch EOFError in NetworkedNNTPTests
test_nntplib fails randomly with EOFError in
NetworkedNNTPTests.setUpClass(). Catch EOFError to skip tests in that
case.
|
|\ |
|
| |
| |
| |
| | |
for issue #28971.
|
|/
|
|
|
|
|
| |
The deprecation include manual creation of SSLSocket and certfile/keyfile
(or similar) in ftplib, httplib, imaplib, smtplib, poplib and urllib.
ssl.wrap_socket() is not marked as deprecated yet.
|
|
|
|
| |
Based on patch by Ville Skyttä.
|
|
|
|
| |
This affects documentation, code comments, and a debugging messages.
|
|
|
|
|
|
|
| |
The previous test relied on a remote server, which currently seems to be
shutting the connection down once TLS has been set up, causing an EOFError.
Now the test is implemented using a minimal NNTP server running in a
background thread.
|
| |
|
|
|
|
|
| |
@unittest.skipUnless(ssl, '...') doesn't work because the class body uses the
nntplib.NNTP_SSL attribute which doesn't exist.
|
|
|
|
|
| |
and socket open until the garbage collector cleans them up. Patch by
Martin Panter.
|
| |
|
| |
|
|\ |
|
| |
| |
| |
| |
| | |
prevent readline() calls from consuming too much memory. Patch by Jyrki
Pulliainen.
|
|/ |
|
| |
|
|\ |
|
| | |
|
|\ \
| |/
| |
| | |
Patch by Hynek Schlawack.
|
| |
| |
| |
| | |
Patch by Hynek Schlawack.
|
|\ \
| |/
| |
| |
| |
| | |
sending MODE READER, and only sends it if not already in READER mode.
Patch by Hynek Schlawack.
|
| |
| |
| |
| |
| |
| | |
sending MODE READER, and only sends it if not already in READER mode.
Patch by Hynek Schlawack.
|
|\ \
| |/
| |
| |
| |
| | |
authenticating (since the result may change, according to RFC 4643).
Patch by Hynek Schlawack.
|
| |
| |
| |
| |
| |
| | |
authenticating (since the result may change, according to RFC 4643).
Patch by Hynek Schlawack.
|
|\ \
| |/ |
|
| | |
|
| | |
|
| |
| |
| |
| | |
can used with the 'with' statement.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
'latin-1' and 'utf-8'.
These are optimized in the Python Unicode implementation
to result in more direct processing, bypassing the codec
registry.
Also see issue11303.
|
|/ |
|
| |
|