summaryrefslogtreecommitdiffstats
path: root/Lib/test/test_ssl.py
Commit message (Collapse)AuthorAgeFilesLines
* bpo-44740: Lowercase "internet" and "web" where appropriate. (GH-27378) ↵Miss Islington (bot)2021-07-261-1/+1
| | | | | | | | (GH-27380) Co-authored-by: Łukasz Langa <lukasz@langa.pl> (cherry picked from commit 11749e2dc20ad6a76e9a39e948853e89b2b4bbed) Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
* [3.10] bpo-44559: [Enum] revert enum module to 3.9 (GH-27010)Ethan Furman2021-07-041-153/+3
| | | * [Enum] revert enum module to 3.9
* bpo-44498: suppress DeprecationWarnings for asynchat, asyncore and smtpd in ↵Miss Islington (bot)2021-06-241-1/+5
| | | | | | | | tests (GH-26905) (GH-26907) (cherry picked from commit 22e7effad571f8e524d2f71ff55bbf2a25306753) Co-authored-by: Irit Katriel <1055913+iritkatriel@users.noreply.github.com>
* bpo-44229: Ignore spurious EPROTOTYPE on macOS in test_ssl (GH-26893)Miss Islington (bot)2021-06-241-3/+8
| | | | | (cherry picked from commit b5a52eef67997246b4235b5407e52a01e822ce56) Co-authored-by: Erlend Egeberg Aasland <erlend.aasland@innova.no>
* [3.10] bpo-43988: Add test.support.check_disallow_instantiation() (GH-25757) ↵Erlend Egeberg Aasland2021-06-231-5/+1
| | | | | | | | | (GH-26885) (cherry picked from commit 4f725261c6cf23d259e8fdc205e12b76ef4d2d31, fbff5387c3e1f3904420fa5a27738c6c5881305b, and 8cec740820fc875117bfa7b6bdb10202ebeb8fd5) Co-authored-by: Erlend Egeberg Aasland <erlend.aasland@innova.no> Automerge-Triggered-By: GH:vstinner
* bpo-44389: Fix typo in ssl deprecation warning message (GH-26754)Miss Islington (bot)2021-06-171-1/+1
| | | | | | `ssl.SSL_NO_TLS` should be `ssl.OP_NO_TLS`. (cherry picked from commit c544393b89f9b3e2b1a22588fc9ae58019314879) Co-authored-by: Joe <nigelchiang@outlook.com>
* [3.10] bpo-44389: Fix deprecation of OP_NO_TLSv1_3 (GH-26700) (GH-26705)Miss Islington (bot)2021-06-131-8/+56
| | | | | | | | | Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit bf527277d4e4907e32d76ca7ba667ab3149fe258) Co-authored-by: Christian Heimes <christian@python.org> Automerge-Triggered-By: GH:tiran
* bpo-44362: ssl: improve deprecation warnings and docs (GH-26646)Miss Islington (bot)2021-06-111-7/+12
| | | | | | Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit e26014f1c47d26d6097ff7a0f25384bfbde714a9) Co-authored-by: Christian Heimes <christian@python.org>
* bpo-43921: Fix test_ssl.test_wrong_cert_tls13() on Windows (GH-26502) (GH-26518)Miss Islington (bot)2021-06-031-14/+6
| | | | | | | Fix test_ssl.test_wrong_cert_tls13(): use suppress_ragged_eofs=False, since read() can raise ssl.SSLEOFError on Windows. (cherry picked from commit ea0210fa8ccca769896847f25fc6fadfe9a717bc) Co-authored-by: Victor Stinner <vstinner@python.org>
* bpo-43921: Fix test_ssl.test_pha_required_nocert() (GH-26489)Miss Islington (bot)2021-06-021-2/+9
| | | | | | | Fix test_pha_required_nocert() of test_ssl: catch two more EOF cases (when the recv() method returns an empty string). (cherry picked from commit 320eaa7f42b413cd5e5436ec92d4dc5ba150395f) Co-authored-by: Victor Stinner <vstinner@python.org>
* bpo-43943: ssl tests: Increase server socket timeout, backlog, debugging ↵Christian Heimes2021-05-031-5/+11
| | | | | (GH-25850) Signed-off-by: Christian Heimes <christian@python.org>
* bpo-43908: Mark ssl, hash, and hmac types as immutable (GH-25792)Christian Heimes2021-05-021-0/+19
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-18233: Add internal methods to access peer chain (GH-25467)Christian Heimes2021-04-261-2/+67
| | | | | | | | | | | | The internal `_ssl._SSLSocket` object now provides methods to retrieve the peer cert chain and verified cert chain as a list of Certificate objects. Certificate objects have methods to convert the cert to a dict, PEM, or DER (ASN.1). These are private APIs for now. There is a slim chance to stabilize the approach and provide a public API for 3.10. Otherwise I'll provide a stable API in 3.11. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-43921: also accept EOF in post-handshake auth test (GH-25574)Christian Heimes2021-04-241-1/+3
|
* bpo-37322: Fix ResourceWarning and exception handling in test (GH-25553)Christian Heimes2021-04-241-38/+38
| | | | | | | | | Revert 73ea546, increase logging, and improve stability of test. Handle all OSErrors in a single block. OSError also takes care of SSLError and socket's connection errors. Partly reverts commit fb7e750. The threaded connection handler must not raise an unhandled exception.
* bpo-31870: Fix test_get_server_certificate_timeout on Windows (GH-25570)Christian Heimes2021-04-241-1/+5
| | | | Some OS do not support millisecond granularity in select(). Use 100ms timeout and a server callback with sleep to emulate a slow server.
* bpo-31870: Add a timeout parameter to ssl.get_server_certificate() (GH-22270)Zackery Spytz2021-04-241-0/+5
|
* bpo-43921: ignore failing test_wrong_cert_tls13 on Windows (GH-25561)Christian Heimes2021-04-231-2/+10
| | | | | | | test_wrong_cert_tls13 sometimes fails on some Windows buildbots. Turn failing test case into skipped test case until we have more time to investigate. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-43920: Make load_verify_locations(cadata) error message consistent ↵Christian Heimes2021-04-231-3/+8
| | | | | (GH-25554) Signed-off-by: Christian Heimes <christian@python.org>
* bpo-38659: [Enum] add _simple_enum decorator (GH-25497)Ethan Furman2021-04-211-1/+152
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add: * `_simple_enum` decorator to transform a normal class into an enum * `_test_simple_enum` function to compare * `_old_convert_` to enable checking `_convert_` generated enums `_simple_enum` takes a normal class and converts it into an enum: @simple_enum(Enum) class Color: RED = 1 GREEN = 2 BLUE = 3 `_old_convert_` works much like` _convert_` does, using the original logic: # in a test file import socket, enum CheckedAddressFamily = enum._old_convert_( enum.IntEnum, 'AddressFamily', 'socket', lambda C: C.isupper() and C.startswith('AF_'), source=_socket, ) `_test_simple_enum` takes a traditional enum and a simple enum and compares the two: # in the REPL or the same module as Color class CheckedColor(Enum): RED = 1 GREEN = 2 BLUE = 3 _test_simple_enum(CheckedColor, Color) _test_simple_enum(CheckedAddressFamily, socket.AddressFamily) Any important differences will raise a TypeError
* bpo-43799: Also define SSLv3_method() (GH-25481)Christian Heimes2021-04-201-8/+0
| | | Signed-off-by: Christian Heimes <christian@python.org>
* Revert "bpo-38659: [Enum] add _simple_enum decorator (GH-25285)" (GH-25476)Ethan Furman2021-04-201-152/+1
| | | This reverts commit dbac8f40e81eb0a29dc833e6409a1abf47467da6.
* bpo-38659: [Enum] add _simple_enum decorator (GH-25285)Ethan Furman2021-04-201-1/+152
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | add: _simple_enum decorator to transform a normal class into an enum _test_simple_enum function to compare _old_convert_ to enable checking _convert_ generated enums _simple_enum takes a normal class and converts it into an enum: @simple_enum(Enum) class Color: RED = 1 GREEN = 2 BLUE = 3 _old_convert_ works much like _convert_ does, using the original logic: # in a test file import socket, enum CheckedAddressFamily = enum._old_convert_( enum.IntEnum, 'AddressFamily', 'socket', lambda C: C.isupper() and C.startswith('AF_'), source=_socket, ) test_simple_enum takes a traditional enum and a simple enum and compares the two: # in the REPL or the same module as Color class CheckedColor(Enum): RED = 1 GREEN = 2 BLUE = 3 _test_simple_enum(CheckedColor, Color) _test_simple_enum(CheckedAddressFamily, socket.AddressFamily) Any important differences will raise a TypeError
* bpo-43669: More test_ssl cleanups (GH-25470)Christian Heimes2021-04-191-78/+21
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-43880: Show DeprecationWarnings for deprecated ssl module features ↵Christian Heimes2021-04-191-153/+120
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | (GH-25455) * ssl.OP_NO_SSLv2 * ssl.OP_NO_SSLv3 * ssl.OP_NO_TLSv1 * ssl.OP_NO_TLSv1_1 * ssl.OP_NO_TLSv1_2 * ssl.OP_NO_TLSv1_3 * ssl.PROTOCOL_SSLv2 * ssl.PROTOCOL_SSLv3 * ssl.PROTOCOL_SSLv23 (alias for PROTOCOL_TLS) * ssl.PROTOCOL_TLS * ssl.PROTOCOL_TLSv1 * ssl.PROTOCOL_TLSv1_1 * ssl.PROTOCOL_TLSv1_2 * ssl.TLSVersion.SSLv3 * ssl.TLSVersion.TLSv1 * ssl.TLSVersion.TLSv1_1 * ssl.wrap_socket() * ssl.RAND_pseudo_bytes() * ssl.RAND_egd() (already removed since it's not supported by OpenSSL 1.1.1) * ssl.SSLContext() without a protocol argument * ssl.match_hostname() * hashlib.pbkdf2_hmac() (pure Python implementation, fast OpenSSL function will stay) Signed-off-by: Christian Heimes <christian@python.org>
* bpo-42854: Use SSL_read/write_ex() (GH-25468)Christian Heimes2021-04-191-0/+11
| | | | | | | | The ssl module now uses ``SSL_read_ex`` and ``SSL_write_ex`` internally. The functions support reading and writing of data larger than 2 GB. Writing zero-length data no longer fails with a protocol violation error. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-36076: Add SNI support to ssl.get_server_certificate. (GH-16820)juhovh2021-04-181-1/+25
| | | | | | | | | | | | | | Many servers in the cloud environment require SNI to be used during the SSL/TLS handshake, therefore it is not possible to fetch their certificates using the ssl.get_server_certificate interface. This change adds an additional optional hostname argument that can be used to set the SNI. Note that it is intentionally a separate argument instead of using the host part of the addr tuple, because one might want to explicitly fetch the default certificate or fetch a certificate from a specific IP address with the specified SNI hostname. A separate argument also works better for backwards compatibility. Automerge-Triggered-By: GH:tiran
* bpo-43669: PEP 644: Require OpenSSL 1.1.1 or newer (GH-23014)Christian Heimes2021-04-171-93/+26
| | | | | | | | | | | | | | | | | | | | | | | | - Remove HAVE_X509_VERIFY_PARAM_SET1_HOST check - Update hashopenssl to require OpenSSL 1.1.1 - multissltests only OpenSSL > 1.1.0 - ALPN is always supported - SNI is always supported - Remove deprecated NPN code. Python wrappers are no-op. - ECDH is always supported - Remove OPENSSL_VERSION_1_1 macro - Remove locking callbacks - Drop PY_OPENSSL_1_1_API macro - Drop HAVE_SSL_CTX_CLEAR_OPTIONS macro - SSL_CTRL_GET_MAX_PROTO_VERSION is always defined now - security level is always available now - get_num_tickets is available with TLS 1.3 - X509_V_ERR MISMATCH is always available now - Always set SSL_MODE_RELEASE_BUFFERS - X509_V_FLAG_TRUSTED_FIRST is always available - get_ciphers is always supported - SSL_CTX_set_keylog_callback is always available - Update Modules/Setup with static link example - Mention PEP in whatsnew - Drop 1.0.2 and 1.1.0 from GHA tests
* bpo-43522: Fix SSLContext.hostname_checks_common_name (GH-24899)Christian Heimes2021-04-171-1/+29
| | | | | | Fix problem with ssl.SSLContext.hostname_checks_common_name. OpenSSL does not copy hostflags from *struct SSL_CTX* to *struct SSL*. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355)Christian Heimes2021-04-121-1/+4
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-43794: OpenSSL 3.0.0: set OP_IGNORE_UNEXPECTED_EOF by default (GH-25309)Christian Heimes2021-04-091-1/+3
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-4379: Skip TLS 1.0/1.1 tests under OpenSSL 3.0.0 (GH-25304)Christian Heimes2021-04-091-0/+5
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-40066: Enum: modify `repr()` and `str()` (GH-22392)Ethan Furman2021-03-311-1/+1
| | | | | | | | | * Enum: streamline repr() and str(); improve docs - repr() is now ``enum_class.member_name`` - stdlib global enums are ``module_name.member_name`` - str() is now ``member_name`` - add HOW-TO section for ``Enum`` - change main documentation to be an API reference
* bpo-43562: fix test_ssl to skip on unreachable network (GH-24937)Carl Meyer2021-03-271-0/+2
| | | This test checks result code of the connection directly, so it never raises an exception that can be suppressed by `support.transient_internet`. Directly support skipping the test in case of unreachable network.
* bpo-43577: Fix deadlock with SSLContext._msg_callback and sni_callback ↵Christian Heimes2021-03-211-0/+22
| | | | | | | | | | | | (GH-24957) OpenSSL copies the internal message callback from SSL_CTX->msg_callback to SSL->msg_callback. SSL_set_SSL_CTX() does not update SSL->msg_callback to use the callback value of the new context. PySSL_set_context() now resets the callback and _PySSL_msg_callback() resets thread state in error path. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)Christian Heimes2021-03-181-0/+29
| | | | | | | | | | Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level 2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow TLS 1.0 and 1.1 on security level 2. See: See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 Signed-off-by: Christian Heimes <christian@python.org>
* bpo-39342: Expose X509_V_FLAG_ALLOW_PROXY_CERTS in ssl module (GH-18011)Chris Burr2021-03-181-0/+2
| | | Exposes the `X509_V_FLAG_ALLOW_PROXY_CERTS` constant as `ssl.VERIFY_ALLOW_PROXY_CERTS` to allow for proxy certificate validation as described in: https://www.openssl.org/docs/man1.1.1/man7/proxy-certificates.html
* bpo-41439: Skip test_ssl and test_uuid tests if fork() is not supported ↵pxinwr2020-12-081-1/+1
| | | | (GH-21684)
* bpo-42413: socket.timeout is now an alias of TimeoutError (GH-23413)Christian Heimes2020-11-201-3/+3
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-41561: skip test_min_max_version_mismatch (GH-22308)Christian Heimes2020-11-181-0/+1
| | | | | skip test_min_max_version_mismatch when TLS 1.0 is not available Signed-off-by: Christian Heimes <christian@python.org>
* bpo-40275: Use new test.support helper submodules in tests (GH-21449)Hai Shi2020-08-031-25/+28
|
* bpo-41195: Add getter for Openssl security level (GH-21282)matthewhughes9342020-07-171-0/+19
| | | | | | | | | | | Add an accessor under SSLContext.security_level as a wrapper around SSL_CTX_get_security_level, see: https://www.openssl.org/docs/manmaster/man3/SSL_CTX_get_security_level.html ------ This is my first time contributing, so please pull me up on all the things I missed or did incorrectly. Automerge-Triggered-By: @tiran
* bpo-40275: Adding threading_helper submodule in test.support (GH-20263)Hai Shi2020-05-271-3/+4
|
* bpo-40275: Move transient_internet from test.support to socket_helper (GH-19711)Serhiy Storchaka2020-04-291-2/+2
|
* bpo-40275: Avoid importing socket in test.support (GH-19603)Serhiy Storchaka2020-04-251-10/+11
| | | | | | * Move socket related functions from test.support to socket_helper. * Import socket, nntplib and urllib.error lazily in transient_internet(). * Remove importing multiprocess.
* bpo-40094: Add test.support.wait_process() (GH-19254)Victor Stinner2020-03-311-2/+1
| | | | | | | | | Moreover, the following tests now check the child process exit code: * test_os.PtyTests * test_mailbox.test_lock_conflict() * test_tempfile.test_process_awareness() * test_uuid.testIssue8621() * multiprocessing resource tracker tests
* bpo-38614: Use test.support.SHORT_TIMEOUT constant (GH-17566)Victor Stinner2019-12-111-1/+1
| | | | | | | | | | | | | | | Replace hardcoded timeout constants in tests with SHORT_TIMEOUT of test.support, so it's easier to ajdust this timeout for all tests at once. SHORT_TIMEOUT is 30 seconds by default, but it can be longer depending on --timeout command line option. The change makes almost all timeouts longer, except test_reap_children() of test_support which is made 2x shorter: SHORT_TIMEOUT should be enough. If this test starts to fail, LONG_TIMEOUT should be used instead. Uniformize also "from test import support" import in some test files.
* bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190)Christian Heimes2019-12-071-6/+6
| | | | | | | | | | test_openssl_version now accepts version 3.0.0. getpeercert() no longer returns IPv6 addresses with a trailing new line. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38820
* bpo-38815: Accept TLSv3 default in min max test (GH-NNNN) (GH-17437)torsava2019-12-021-2/+8
| | | | | | | Make ssl tests less strict and also accept TLSv3 as the default maximum version. This change unbreaks test_min_max_version on Fedora 32. https://bugs.python.org/issue38815
* bpo-38275: Fix test_ssl issue caused by GH-16386 (#16428)Christian Heimes2019-09-261-0/+2
| | | | | | Check presence of SSLContext.minimum_version to make tests pass with old versions of OpenSSL. Signed-off-by: Christian Heimes <christian@python.org>
generated by cgit v0.12 at 2025-03-23 21:31:25 (GMT)