8000 gh-131050: Allow CPython test to handle TLS libraries lacking FFDHE ciphersuites by WillChilds-Klein · Pull Request #131051 · python/cpython · GitHub
[go: up one dir, main page]

Skip to content

gh-131050: Allow CPython test to handle TLS libraries lacking FFDHE ciphersuites #131051

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 11 commits into from
Mar 29, 2025
Merged
Prev Previous commit
Next Next commit
Extract supports_kx_aliases test util
  • Loading branch information
WillChilds-Klein committed Mar 28, 2025
commit 7a8375ad4a9deeeb6a1529af97e4210e8cd39f33
21 changes: 12 additions & 9 deletions Lib/test/test_ssl.py
Original file line number Diff line number Diff line change
Expand Up @@ -2782,6 +2782,14 @@ def try_protocol_combo(server_protocol, client_protocol, expect_success,
% (expect_success, stats['version']))


def supports_kx_alias(ctx, aliases):
for cipher in ctx.get_ciphers():
for alias in aliases:
if f"Kx={alias}" in cipher['description']:
return True
return False


class ThreadedTests(unittest.TestCase):

@support.requires_resource('walltime')
Expand Down Expand Up @@ -4042,17 +4050,12 @@ def test_no_legacy_server_connect(self):
sni_name=hostname)

def test_dh_params(self):
# Check we can get a connection with ephemeral finite-field Diffie-
# Hellman (if supported).
# Check we can get a connection with ephemeral finite-field
# Diffie-Hellman (if supported).
client_context, server_context, hostname = testing_context()
dhe_aliases = {"ADH", "EDH", "DHE"}
def supports_dhe(ctx) -> bool:
for cipher in ctx.get_ciphers():
for alias in dhe_aliases:
if f"Kx={alias}" in cipher['description']:
return True
return False
if not (supports_dhe(client_context) and supports_dhe(server_context)):
if not (supports_kx_alias(client_context, dhe_aliases) and
supports_kx_alias(server_context, dhe_aliases)):
self.skipTest("libssl doesn't support ephemeral DH")
# test scenario needs TLS <= 1.2
client_context.maximum_version = ssl.TLSVersion.TLSv1_2
Expand Down
Loading
0