From 516cda6fd4308f8075aae311ff3ef34c463ef385 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Mon, 27 Jun 2022 21:26:42 +0200 Subject: [PATCH 1/3] gh-94208: Add more TLS version/protocol checks for FreeBSD Three test cases were failing on FreeBSD with latest OpenSSL. --- Lib/test/test_ssl.py | 24 +++++++++++-------- ...2-06-27-21-27-20.gh-issue-94208.VR6HX-.rst | 2 ++ 2 files changed, 16 insertions(+), 10 deletions(-) create mode 100644 Misc/NEWS.d/next/Tests/2022-06-27-21-27-20.gh-issue-94208.VR6HX-.rst diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index b41ce98a6d9940..a97dcc6a71b36b 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -610,6 +610,8 @@ def test_openssl111_deprecations(self): ) for protocol in protocols: + if not has_tls_protocol(protocol): + continue with self.subTest(protocol=protocol): with self.assertWarns(DeprecationWarning) as cm: ssl.SSLContext(protocol) @@ -619,6 +621,8 @@ def test_openssl111_deprecations(self): ) for version in versions: + if not has_tls_version(version): + continue with self.subTest(version=version): ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) with self.assertWarns(DeprecationWarning) as cm: @@ -934,9 +938,10 @@ class ContextTests(unittest.TestCase): def test_constructor(self): for protocol in PROTOCOLS: - with warnings_helper.check_warnings(): - ctx = ssl.SSLContext(protocol) - self.assertEqual(ctx.protocol, protocol) + if has_tls_protocol(protocol): + with warnings_helper.check_warnings(): + ctx = ssl.SSLContext(protocol) + self.assertEqual(ctx.protocol, protocol) with warnings_helper.check_warnings(): ctx = ssl.SSLContext() self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS) @@ -1502,8 +1507,6 @@ def test_create_default_context(self): self.assertEqual(ctx.verify_mode, ssl.CERT_NONE) self._assert_context_options(ctx) - - def test__create_stdlib_context(self): ctx = ssl._create_stdlib_context() self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_CLIENT) @@ -1511,11 +1514,12 @@ def test__create_stdlib_context(self): self.assertFalse(ctx.check_hostname) self._assert_context_options(ctx) - with warnings_helper.check_warnings(): - ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1) - self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1) - self.assertEqual(ctx.verify_mode, ssl.CERT_NONE) - self._assert_context_options(ctx) + if has_tls_protocol(ssl.PROTOCOL_TLSv1): + with warnings_helper.check_warnings(): + ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1) + self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1) + self.assertEqual(ctx.verify_mode, ssl.CERT_NONE) + self._assert_context_options(ctx) with warnings_helper.check_warnings(): ctx = ssl._create_stdlib_context( diff --git a/Misc/NEWS.d/next/Tests/2022-06-27-21-27-20.gh-issue-94208.VR6HX-.rst b/Misc/NEWS.d/next/Tests/2022-06-27-21-27-20.gh-issue-94208.VR6HX-.rst new file mode 100644 index 00000000000000..d0f970ad286b1d --- /dev/null +++ b/Misc/NEWS.d/next/Tests/2022-06-27-21-27-20.gh-issue-94208.VR6HX-.rst @@ -0,0 +1,2 @@ +``test_ssl`` is now checking for supported TLS version and protocols in more +tests. From b11a393f67638168b719d8e37ad5138f1f4f13bf Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Mon, 27 Jun 2022 22:42:49 +0200 Subject: [PATCH 2/3] More version checks --- Lib/test/test_ssl.py | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index a97dcc6a71b36b..92f8e01ace7609 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -1086,7 +1086,7 @@ def test_min_max_version(self): ctx.maximum_version = ssl.TLSVersion.MINIMUM_SUPPORTED self.assertIn( ctx.maximum_version, - {ssl.TLSVersion.TLSv1, ssl.TLSVersion.SSLv3} + {ssl.TLSVersion.TLSv1, ssl.TLSVersion.TLSv1_1, ssl.TLSVersion.SSLv3} ) ctx.minimum_version = ssl.TLSVersion.MAXIMUM_SUPPORTED @@ -1098,19 +1098,19 @@ def test_min_max_version(self): with self.assertRaises(ValueError): ctx.minimum_version = 42 - ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1) - - self.assertIn( - ctx.minimum_version, minimum_range - ) - self.assertEqual( - ctx.maximum_version, ssl.TLSVersion.MAXIMUM_SUPPORTED - ) - with self.assertRaises(ValueError): - ctx.minimum_version = ssl.TLSVersion.MINIMUM_SUPPORTED - with self.assertRaises(ValueError): - ctx.maximum_version = ssl.TLSVersion.TLSv1 + if has_tls_version(ssl.PROTOCOL_TLSv1_1): + ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1) + self.assertIn( + ctx.minimum_version, minimum_range + ) + self.assertEqual( + ctx.maximum_version, ssl.TLSVersion.MAXIMUM_SUPPORTED + ) + with self.assertRaises(ValueError): + ctx.minimum_version = ssl.TLSVersion.MINIMUM_SUPPORTED + with self.assertRaises(ValueError): + ctx.maximum_version = ssl.TLSVersion.TLSv1 @unittest.skipUnless( hasattr(ssl.SSLContext, 'security_level'), @@ -3253,10 +3253,12 @@ def test_protocol_tlsv1_2(self): client_options=ssl.OP_NO_TLSv1_2) try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2') - try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False) - try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False) - try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False) - try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False) + if has_tls_protocol(ssl.PROTOCOL_TLSv1): + try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False) + try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False) + if has_tls_protocol(ssl.PROTOCOL_TLSv1_1): + try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False) + try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False) def test_starttls(self): """Switching from clear text to encrypted and back again.""" From a326d766d395410290a5203ece86fe63b3d3f6c6 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Tue, 28 Jun 2022 08:40:00 +0200 Subject: [PATCH 3/3] Typo --- Lib/test/test_ssl.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 92f8e01ace7609..559eea9fbabf6b 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -1098,7 +1098,7 @@ def test_min_max_version(self): with self.assertRaises(ValueError): ctx.minimum_version = 42 - if has_tls_version(ssl.PROTOCOL_TLSv1_1): + if has_tls_protocol(ssl.PROTOCOL_TLSv1_1): ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1) self.assertIn(