summaryrefslogtreecommitdiffstats
path: root/Lib/test/test_ssl.py
Commit message (Collapse)AuthorAgeFilesLines
* [3.9] gh-108342: Make ssl TestPreHandshakeClose more reliable (GH-108370) ↵Łukasz Langa2023-08-241-31/+71
| | | | | | | | | | | | | | | | | | | | | | (#108407) * In preauth tests of test_ssl, explicitly break reference cycles invoving SingleConnectionTestServerThread to make sure that the thread is deleted. Otherwise, the test marks the environment as altered because the threading module sees a "dangling thread" (SingleConnectionTestServerThread). This test leak was introduced by the test added for the fix of issue gh-108310. * Use support.SHORT_TIMEOUT instead of hardcoded 1.0 or 2.0 seconds timeout. * SingleConnectionTestServerThread.run() catchs TimeoutError * Fix a race condition (missing synchronization) in test_preauth_data_to_tls_client(): the server now waits until the client connect() completed in call_after_accept(). * test_https_client_non_tls_response_ignored() calls server.join() explicitly. * Replace "localhost" with server.listener.getsockname()[0]. (cherry picked from commit 592bacb6fc0833336c0453e818e9b95016e9fd47) Co-authored-by: Victor Stinner <vstinner@python.org>
* [3.9] gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close ↵Łukasz Langa2023-08-221-0/+215
| | | | | | | | | | | | | | | | | | flaw (#108320) gh-108310: Fix CVE-2023-40217: Check for & avoid the ssl pre-close flaw Instances of `ssl.SSLSocket` were vulnerable to a bypass of the TLS handshake and included protections (like certificate verification) and treating sent unencrypted data as if it were post-handshake TLS encrypted data. The vulnerability is caused when a socket is connected, data is sent by the malicious peer and stored in a buffer, and then the malicious peer closes the socket within a small timing window before the other peers’ TLS handshake can begin. After this sequence of events the closed socket will not immediately attempt a TLS handshake due to not being connected but will also allow the buffered data to be read as if a successful TLS handshake had occurred. Co-authored-by: Gregory P. Smith [Google LLC] <greg@krypto.org>
* [3.9] gh-94208: Add even more TLS version/protocol checks for FreeBSD (#98037)Łukasz Langa2022-10-071-10/+16
| | | Otherwise, buildbot builds would fail since there's no TLS 1.0/1.1 support.
* gh-95280: Fix test_get_ciphers on systems without RSA key exchange ↵Miss Islington (bot)2022-07-291-2/+14
| | | | | | | (GH-95282) (GH-95323) (cherry picked from commit 565403038b75eb64ea483b2757ba30769246d853) Co-authored-by: Christian Heimes <christian@python.org>
* [3.9] gh-94208: Add more TLS version/protocol checks for FreeBSD (GH-94347) ↵Łukasz Langa2022-07-271-24/+32
| | | | | | | | (GH-95312) Three test cases were failing on FreeBSD with latest OpenSSL. (cherry picked from commit 1bc86c26253befa006c0f52eebb6ed633c7d1e5c) Co-authored-by: Christian Heimes <christian@python.org>
* [3.9] bpo-46114: Fix OpenSSL version check for 3.0.1 (GH-30170) (GH-30173)Christian Heimes2021-12-171-6/+9
| | | Co-authored-by: Christian Heimes <christian@python.org>
* [3.9] bpo-45229: Remove test_main in many tests (GH-28405) (GH-28456)Serhiy Storchaka2021-09-201-15/+5
| | | | | | | | | | | Instead of explicitly enumerate test classes for run_unittest() use the unittest ability to discover tests. This also makes these tests discoverable and runnable with unittest. load_tests() can be used for dynamic generating tests and adding doctests. setUpModule(), tearDownModule() and addModuleCleanup() can be used for running code before and after all module tests.. (cherry picked from commit 40348acc180580371d25f75f46b27048e35f2435)
* bpo-44229: Ignore spurious EPROTOTYPE on macOS in test_ssl (GH-26893)Miss Islington (bot)2021-06-241-3/+8
| | | | | (cherry picked from commit b5a52eef67997246b4235b5407e52a01e822ce56) Co-authored-by: Erlend Egeberg Aasland <erlend.aasland@innova.no>
* [3.9] bpo-43920: Make load_verify_locations(cadata) error message consistent ↵Christian Heimes2021-04-231-3/+8
| | | | | | | | (GH-25554) (GH-25555) Signed-off-by: Christian Heimes <christian@python.org>. (cherry picked from commit b9ad88be0304136c3fe5959c65a5d2c75490cd80) Co-authored-by: Christian Heimes <christian@python.org>
* [3.9] bpo-43522: Fix SSLContext.hostname_checks_common_name (GH-24899) ↵Christian Heimes2021-04-171-1/+29
| | | | | | | | | | | (GH-25451) Fix problem with ssl.SSLContext.hostname_checks_common_name. OpenSSL does not copy hostflags from *struct SSL_CTX* to *struct SSL*. Signed-off-by: Christian Heimes <christian@python.org>. (cherry picked from commit b467d9a24011992242c95d9157d3455f8a84466b) Co-authored-by: Christian Heimes <christian@python.org>
* bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355)Miss Islington (bot)2021-04-121-1/+4
| | | | | | Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 3447750073aff229b049e4ccd6217db2811dcfd1) Co-authored-by: Christian Heimes <christian@python.org>
* bpo-43794: OpenSSL 3.0.0: set OP_IGNORE_UNEXPECTED_EOF by default (GH-25309)Miss Islington (bot)2021-04-091-1/+3
| | | | | | Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 6f37ebc61e9e0d13bcb1a2ddb7fc9723c04b6372) Co-authored-by: Christian Heimes <christian@python.org>
* bpo-4379: Skip TLS 1.0/1.1 tests under OpenSSL 3.0.0 (GH-25304)Miss Islington (bot)2021-04-091-0/+5
| | | | | | Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 5151d642004c59cce58d669be85d9a5e987f51d3) Co-authored-by: Christian Heimes <christian@python.org>
* bpo-43562: fix test_ssl to skip on unreachable network (GH-24937) (GH-25046)Miss Islington (bot)2021-03-291-0/+2
| | | | | | | | This test checks result code of the connection directly, so it never raises an exception that can be suppressed by `support.transient_internet`. Directly support skipping the test in case of unreachable network. (cherry picked from commit 29c451c6989c3c94fa0a9facf187c24f3cbf2420) Co-authored-by: Carl Meyer <carl@oddbird.net> Co-authored-by: Carl Meyer <carl@oddbird.net>
* bpo-43577: Fix deadlock with SSLContext._msg_callback and sni_callback ↵Miss Islington (bot)2021-03-211-0/+22
| | | | | | | | | | | | | | | (GH-24957) OpenSSL copies the internal message callback from SSL_CTX->msg_callback to SSL->msg_callback. SSL_set_SSL_CTX() does not update SSL->msg_callback to use the callback value of the new context. PySSL_set_context() now resets the callback and _PySSL_msg_callback() resets thread state in error path. Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 77cde5042a2f1eae489c11a67540afaf43cd5cdf) Co-authored-by: Christian Heimes <christian@python.org>
* bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)Miss Islington (bot)2021-03-181-0/+29
| | | | | | | | | | | | | Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level 2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow TLS 1.0 and 1.1 on security level 2. See: See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit f6c6b5821bff815bdc810de53992fd1fbdb2edd4) Co-authored-by: Christian Heimes <christian@python.org>
* [3.9] bpo-41561: skip test_min_max_version_mismatch (GH-22308) (GH-23363)Miss Islington (bot)2020-11-181-0/+1
| | | | | | | | | | | skip test_min_max_version_mismatch when TLS 1.0 is not available Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit ce04e7105bc396c32667a22b928a712ba0778a3f) Co-authored-by: Christian Heimes <christian@python.org> Automerge-Triggered-By: GH:tiran
* bpo-40275: Move transient_internet from test.support to socket_helper (GH-19711)Serhiy Storchaka2020-04-291-2/+2
|
* bpo-40275: Avoid importing socket in test.support (GH-19603)Serhiy Storchaka2020-04-251-10/+11
| | | | | | * Move socket related functions from test.support to socket_helper. * Import socket, nntplib and urllib.error lazily in transient_internet(). * Remove importing multiprocess.
* bpo-40094: Add test.support.wait_process() (GH-19254)Victor Stinner2020-03-311-2/+1
| | | | | | | | | Moreover, the following tests now check the child process exit code: * test_os.PtyTests * test_mailbox.test_lock_conflict() * test_tempfile.test_process_awareness() * test_uuid.testIssue8621() * multiprocessing resource tracker tests
* bpo-38614: Use test.support.SHORT_TIMEOUT constant (GH-17566)Victor Stinner2019-12-111-1/+1
| | | | | | | | | | | | | | | Replace hardcoded timeout constants in tests with SHORT_TIMEOUT of test.support, so it's easier to ajdust this timeout for all tests at once. SHORT_TIMEOUT is 30 seconds by default, but it can be longer depending on --timeout command line option. The change makes almost all timeouts longer, except test_reap_children() of test_support which is made 2x shorter: SHORT_TIMEOUT should be enough. If this test starts to fail, LONG_TIMEOUT should be used instead. Uniformize also "from test import support" import in some test files.
* bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190)Christian Heimes2019-12-071-6/+6
| | | | | | | | | | test_openssl_version now accepts version 3.0.0. getpeercert() no longer returns IPv6 addresses with a trailing new line. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38820
* bpo-38815: Accept TLSv3 default in min max test (GH-NNNN) (GH-17437)torsava2019-12-021-2/+8
| | | | | | | Make ssl tests less strict and also accept TLSv3 as the default maximum version. This change unbreaks test_min_max_version on Fedora 32. https://bugs.python.org/issue38815
* bpo-38275: Fix test_ssl issue caused by GH-16386 (#16428)Christian Heimes2019-09-261-0/+2
| | | | | | Check presence of SSLContext.minimum_version to make tests pass with old versions of OpenSSL. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-38275: Skip ssl tests for disabled versions (GH-16386)Christian Heimes2019-09-261-51/+143
| | | | | | | | | | | test_ssl now handles disabled TLS/SSL versions better. OpenSSL's crypto policy and run-time settings are recognized and tests for disabled versions are skipped. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38275
* Correct typo in min version test (GH-16000)Christian Heimes2019-09-111-1/+1
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-34001: Fix test_ssl with LibreSSL (GH-13783)Christian Heimes2019-09-111-1/+2
|
* bpo-35941: Fix performance regression in new code (GH-12610)Christian Heimes2019-09-091-2/+2
| | | | | | | | Accumulate certificates in a set instead of doing a costly list contain operation. A Windows cert store can easily contain over hundred certificates. The old code would result in way over 5,000 comparison operations Signed-off-by: Christian Heimes <christian@python.org>
* bpo-15999: Always pass bool instead of int to socket.setblocking(). (GH-15621)Serhiy Storchaka2019-09-011-2/+2
|
* bpo-37322: ssl test_pha_required_nocert() ignores expected SSLError (GH-14670)Victor Stinner2019-07-091-15/+18
| | | | | | test_ssl.test_pha_required_nocert() now uses support.catch_threading_exception() to ignore the expected SSLError in ConnectionHandler of ThreadedEchoServer (it is only raised sometimes on Windows).
* Revert "bpo-37322: Fix test_ssl.test_pha_required_nocert() ResourceWarning ↵Victor Stinner2019-07-091-1/+0
| | | | | (GH-14662)" (GH-14669) This reverts commit cf9c41c422de3774862db964fe3153086bad3f61.
* bpo-37322: Fix test_ssl.test_pha_required_nocert() ResourceWarning (GH-14662)Victor Stinner2019-07-091-0/+1
| | | | Close the TLS connection in test_pha_required_nocert() of test_ssl to fix a ResourceWarning.
* bpo-37463: match_hostname requires quad-dotted IPv4 (GH-14499)Christian Heimes2019-07-021-1/+8
| | | | | | | | | | | | | | | | ssl.match_hostname() no longer accepts IPv4 addresses with additional text after the address and only quad-dotted notation without trailing whitespaces. Some inet_aton() implementations ignore whitespace and all data after whitespace, e.g. '127.0.0.1 whatever'. Short notations like '127.1' for '127.0.0.1' were already filtered out. The bug was initially found by Dominik Czarnota and reported by Paul Kehrer. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue37463
* Remove unused imports in tests (GH-14518)Victor Stinner2019-07-011-2/+1
|
* bpo-37428: Don't set PHA verify flag on client side (GH-14421)Christian Heimes2019-07-011-0/+31
| | | | | | | | | | | | SSLContext.post_handshake_auth = True no longer sets SSL_VERIFY_POST_HANDSHAKE verify flag for client connections. Although the option is documented as ignored for clients, OpenSSL implicitly enables cert chain validation when the flag is set. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue37428
* bpo-37199: Fix test failures when IPv6 is unavailable or disabled (#14480)Zackery Spytz2019-06-301-2/+2
|
* bpo-36511: Add buildbot scripts and fix tests for Windows ARM32 buildbot ↵Paul Monson2019-06-191-0/+9
| | | | (GH-13454)
* bpo-37120: Add SSLContext.num_tickets (GH-13719)Christian Heimes2019-06-031-0/+18
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-34271: Fix compatibility with 1.0.2 (GH-13728)Christian Heimes2019-06-031-41/+7
| | | | | | Fix various compatibility issues with LibreSSL and OpenSSL 1.0.2 introduced by bpo-34271. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-37069: tests use catch_unraisable_exception() (GH-13762)Victor Stinner2019-06-031-14/+18
| | | | | | | | | | | | | Modify test_coroutines, test_cprofile, test_generators, test_raise, test_ssl and test_yield_from to use support.catch_unraisable_exception() rather than support.captured_stderr(). test_thread: remove test_save_exception_state_on_error() which is now updated. test_unraisable_exception() checks that sys.unraisablehook() is called to handle _thread.start_new_thread() exception. test_cprofile now rely on unittest for test discovery: replace support.run_unittest() with unittest.main().
* bpo-34271: Add ssl debugging helpers (GH-10031)Christian Heimes2019-05-311-1/+167
| | | | | | | | | | | The ssl module now can dump key material to a keylog file and trace TLS protocol messages with a tracing callback. The default and stdlib contexts also support SSLKEYLOGFILE env var. The msg_callback and related enums are private members. The feature is designed for internal debugging and not for end users. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-35926: Add support for OpenSSL 1.1.1b on Windows (GH-11779)Paul Monson2019-05-151-2/+17
|
* bpo-36766: Typos in docs and code comments (GH-13116)penguindustin2019-05-061-1/+1
|
* bpo-35934: Add socket.create_server() utility function (GH-11784)Giampaolo Rodola2019-04-081-8/+3
|
* bpo-36037: Fix test_ssl for strict OpenSSL policy (GH-11940)Victor Stinner2019-02-191-1/+29
| | | | | Fix test_ssl for strict OpenSSL configuration like RHEL8 strict crypto policy. Use older TLS version for minimum TLS version of the server SSL context if needed, to test TLS version older than default minimum TLS version.
* bpo-35045: Accept TLSv1 default in min max test (GH-11510)Christian Heimes2019-01-181-2/+5
| | | | | | Make ssl tests less strict and also accept TLSv1 as system default. The changes unbreaks test_min_max_version on Fedora 29. Signed-off-by: Christian Heimes <christian@python.org>
* bpo-35746: Fix segfault in ssl's cert parser (GH-11569)Christian Heimes2019-01-151-0/+22
| | | | | | | | | | | Fix a NULL pointer deref in ssl module. The cert parser did not handle CRL distribution points with empty DP or URI correctly. A malicious or buggy certificate can result into segfault. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue35746
* bpo-33023: Fix NotImplemented to NotImplementedError. (GH-10934)Serhiy Storchaka2018-12-061-1/+6
|
* bpo-35202: Remove unused imports in tests. (GH-10561)Srinivas Thatiparthy (శ్రీనివాస్ తాటిపర్తి)2018-11-161-1/+0
|
* bpo-34670: Add TLS 1.3 post handshake auth (GH-9460)Christian Heimes2018-09-231-1/+192
| | | | | | | | | | Add SSLContext.post_handshake_auth and SSLSocket.verify_client_post_handshake for TLS 1.3 post-handshake authentication. Signed-off-by: Christian Heimes <christian@python.org>q https://bugs.python.org/issue34670
generated by cgit v0.12 at 2025-09-15 12:33:03 (GMT)