8000 gh-94208: Add more TLS version/protocol checks for FreeBSD (GH-94347) · python/cpython@5e08eec · GitHub
[go: up one dir, main page]
Skip to content

Commit 5e08eec

Browse files
miss-islingtontiran
miss-islington
and
tiran
authored
gh-94208: Add more TLS version/protocol checks for FreeBSD (GH-94347)
Three test cases were failing on FreeBSD with latest OpenSSL. (cherry picked from commit 1bc86c2) Co-authored-by: Christian Heimes <christian@python.org>
1 parent 0ae7284 commit 5e08eec

File tree

2 files changed

+35
-27
lines changed

2 files changed

+35
-27
lines changed

‎Lib/test/test_ssl.py

Lines changed: 33 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -617,6 +617,8 @@ def test_openssl111_deprecations(self):
617617
)
618618

619619
for protocol in protocols:
620+
if not has_tls_protocol(protocol):
621+
continue
620622
with self.subTest(protocol=protocol):
621623
with self.assertWarns(DeprecationWarning) as cm:
622624
ssl.SSLContext(protocol)
@@ -626,6 +628,8 @@ def test_openssl111_deprecations(self):
626628
)
627629

628630
for version in versions:
631+
if not has_tls_version(version):
632+
continue
629633
with self.subTest(version=version):
630634
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
631< 10000 code>635
with self.assertWarns(DeprecationWarning) as cm:
@@ -1139,9 +1143,10 @@ class ContextTests(unittest.TestCase):
11391143

11401144
def test_constructor(self):
11411145
for protocol in PROTOCOLS:
1142-
with warnings_helper.check_warnings():
1143-
ctx = ssl.SSLContext(protocol)
1144-
self.assertEqual(ctx.protocol, protocol)
1146+
if has_tls_protocol(protocol):
1147+
with warnings_helper.check_warnings():
1148+
ctx = ssl.SSLContext(protocol)
1149+
self.assertEqual(ctx.protocol, protocol)
11451150
with warnings_helper.check_warnings():
11461151
ctx = ssl.SSLContext()
11471152
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS)
@@ -1286,7 +1291,7 @@ def test_min_max_version(self):
12861291
ctx.maximum_version = ssl.TLSVersion.MINIMUM_SUPPORTED
12871292
self.assertIn(
12881293
ctx.maximum_version,
1289-
{ssl.TLSVersion.TLSv1, ssl.TLSVersion.SSLv3}
1294+
{ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.SSLv3}
12901295
)
12911296

12921297
ctx.minimum_version = ssl.TLSVersion.MAXIMUM_SUPPORTED
@@ -1298,19 +1303,19 @@ def test_min_max_version(self):
12981303
with self.assertRaises(ValueError):
12991304
ctx.minimum_version = 42
13001305

1301-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1)
1302-
1303-
self.assertIn(
1304-
ctx.minimum_version, minimum_range
1305-
)
1306-
self.assertEqual(
1307-
ctx.maximum_version, ssl.TLSVersion.MAXIMUM_SUPPORTED
1308-
)
1309-
with self.assertRaises(ValueError):
1310-
ctx.minimum_version = ssl.TLSVersion.MINIMUM_SUPPORTED
1311-
with self.assertRaises(ValueError):
1312-
ctx.maximum_version = ssl.TLSVersion.TLSv1
1306+
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
1307+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1)
13131308

1309+
self.assertIn(
1310+
ctx.minimum_version, minimum_range
1311+
)
1312+
self.assertEqual(
1313+
ctx.maximum_version, ssl.TLSVersion.MAXIMUM_SUPPORTED
1314+
)
1315+
with self.assertRaises(ValueError):
1316+
ctx.minimum_version = ssl.TLSVersion.MINIMUM_SUPPORTED
1317+
with self.assertRaises(ValueError):
1318+
ctx.maximum_version = ssl.TLSVersion.TLSv1
13141319

13151320
@unittest.skipUnless(
13161321
hasattr(ssl.SSLContext, 'security_level'),
@@ -1706,20 +1711,19 @@ def test_create_default_context(self):
17061711
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
17071712
self._assert_context_options(ctx)
17081713

1709-
1710-
17111714
def test__create_stdlib_context(self):
17121715
ctx = ssl._create_stdlib_context()
17131716
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_CLIENT)
17141717
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
17151718
self.assertFalse(ctx.check_hostname)
17161719
self._assert_context_options(ctx)
17171720

1718-
with warnings_helper.check_warnings():
1719-
ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1)
1720-
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
1721-
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
1722-
self._assert_context_options(ctx)
1721+
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
1722+
with warnings_helper.check_warnings():
1723+
ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1)
1724+
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
1725+
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
1726+
self._assert_context_options(ctx)
17231727

17241728
with warnings_helper.check_warnings():
17251729
ctx = ssl._create_stdlib_context(
@@ -3464,10 +3468,12 @@ def test_protocol_tlsv1_2(self):
34643468
client_options=ssl.OP_NO_TLSv1_2)
34653469

34663470
try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2')
3467-
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False)
3468-
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False)
3469-
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
3470-
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False)
3471+
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
3472+
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False)
3473+
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False)
3474+
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
3475+
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
3476+
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False)
34713477

34723478
def test_starttls(self):
34733479
"""Switching from clear text to encrypted and back again."""

‎Misc/NEWS.d/next/Tests/2022-06-27-21-27-20.gh-issue-94208.VR6HX-.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
``test_ssl`` is now checking for supported TLS version and protocols in more
2+
tests.

0 commit comments

Comments
 (0)
0