mirror of
https://github.com/python/cpython.git
synced 2025-11-25 04:34:37 +00:00
Issue #25940: Use self-signed.pythontest.net in SSL tests
This is instead of svn.python.org, whose certificate recently expired, and
whose new certificate uses a different root certificate.
The certificate used at the pythontest server was modifed to set the "basic
constraints" CA flag. This flag seems to be required for test_get_ca_certs_
capath() to work (in Python 3.4+).
Added the new self-signed certificate to capath with the following commands:
cp Lib/test/{selfsigned_pythontestdotnet.pem,capath/}
c_rehash -v Lib/test/capath/
c_rehash -v -old Lib/test/capath/
# Note the generated file names
cp Lib/test/capath/{selfsigned_pythontestdotnet.pem,0e4015b9.0}
mv Lib/test/capath/{selfsigned_pythontestdotnet.pem,ce7b8643.0}
The new server responds with "No route to host" when connecting to port 444.
This commit is contained in:
Martin Panter
parent
89644d080b
commit
3d81d93f34
6 changed files with 97 additions and 96 deletions
|
|
@ -29,7 +29,8 @@ if hasattr(ssl, 'PROTOCOL_SSLv2'):
|
|||
|
||||
HOST = support.HOST
|
||||
|
||||
data_file = lambda name: os.path.join(os.path.dirname(__file__), name)
|
||||
def data_file(*name):
|
||||
return os.path.join(os.path.dirname(__file__), *name)
|
||||
|
||||
# The custom key and certificate files used in test_ssl are generated
|
||||
# using Lib/test/make_ssl_certs.py.
|
||||
|
|
@ -44,8 +45,10 @@ BYTES_ONLYCERT = os.fsencode(ONLYCERT)
|
|||
BYTES_ONLYKEY = os.fsencode(ONLYKEY)
|
||||
CAPATH = data_file("capath")
|
||||
BYTES_CAPATH = os.fsencode(CAPATH)
|
||||
CAFILE_CACERT = data_file("capath", "5ed36f99.0")
|
||||
|
||||
SVN_PYTHON_ORG_ROOT_CERT = data_file("https_svn_python_org_root.pem")
|
||||
REMOTE_HOST = "self-signed.pythontest.net"
|
||||
REMOTE_ROOT_CERT = data_file("selfsigned_pythontestdotnet.pem")
|
||||
|
||||
EMPTYCERT = data_file("nullcert.pem")
|
||||
BADCERT = data_file("badcert.pem")
|
||||
|
|
@ -163,7 +166,7 @@ class BasicSocketTests(unittest.TestCase):
|
|||
)
|
||||
|
||||
def test_DER_to_PEM(self):
|
||||
with open(SVN_PYTHON_ORG_ROOT_CERT, 'r') as f:
|
||||
with open(CAFILE_CACERT, 'r') as f:
|
||||
pem = f.read()
|
||||
d1 = ssl.PEM_cert_to_DER_cert(pem)
|
||||
p2 = ssl.DER_cert_to_PEM_cert(d1)
|
||||
|
|
@ -462,7 +465,7 @@ class ContextTests(unittest.TestCase):
|
|||
# Mismatching key and cert
|
||||
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
|
||||
with self.assertRaisesRegex(ssl.SSLError, "key values mismatch"):
|
||||
ctx.load_cert_chain(SVN_PYTHON_ORG_ROOT_CERT, ONLYKEY)
|
||||
ctx.load_cert_chain(CAFILE_CACERT, ONLYKEY)
|
||||
|
||||
def test_load_verify_locations(self):
|
||||
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
|
||||
|
|
@ -511,11 +514,11 @@ class ContextTests(unittest.TestCase):
|
|||
class NetworkedTests(unittest.TestCase):
|
||||
|
||||
def test_connect(self):
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
|
||||
cert_reqs=ssl.CERT_NONE)
|
||||
try:
|
||||
s.connect(("svn.python.org", 443))
|
||||
s.connect((REMOTE_HOST, 443))
|
||||
self.assertEqual({}, s.getpeercert())
|
||||
finally:
|
||||
s.close()
|
||||
|
|
@ -524,27 +527,27 @@ class NetworkedTests(unittest.TestCase):
|
|||
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
|
||||
cert_reqs=ssl.CERT_REQUIRED)
|
||||
self.assertRaisesRegex(ssl.SSLError, "certificate verify failed",
|
||||
s.connect, ("svn.python.org", 443))
|
||||
s.connect, (REMOTE_HOST, 443))
|
||||
s.close()
|
||||
|
||||
# this should succeed because we specify the root cert
|
||||
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
|
||||
cert_reqs=ssl.CERT_REQUIRED,
|
||||
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
|
||||
ca_certs=REMOTE_ROOT_CERT)
|
||||
try:
|
||||
s.connect(("svn.python.org", 443))
|
||||
s.connect((REMOTE_HOST, 443))
|
||||
self.assertTrue(s.getpeercert())
|
||||
finally:
|
||||
s.close()
|
||||
|
||||
def test_connect_ex(self):
|
||||
# Issue #11326: check connect_ex() implementation
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
|
||||
cert_reqs=ssl.CERT_REQUIRED,
|
||||
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
|
||||
ca_certs=REMOTE_ROOT_CERT)
|
||||
try:
|
||||
self.assertEqual(0, s.connect_ex(("svn.python.org", 443)))
|
||||
self.assertEqual(0, s.connect_ex((REMOTE_HOST, 443)))
|
||||
self.assertTrue(s.getpeercert())
|
||||
finally:
|
||||
s.close()
|
||||
|
|
@ -552,14 +555,14 @@ class NetworkedTests(unittest.TestCase):
|
|||
def test_non_blocking_connect_ex(self):
|
||||
# Issue #11326: non-blocking connect_ex() should allow handshake
|
||||
# to proceed after the socket gets ready.
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
|
||||
cert_reqs=ssl.CERT_REQUIRED,
|
||||
ca_certs=SVN_PYTHON_ORG_ROOT_CERT,
|
||||
ca_certs=REMOTE_ROOT_CERT,
|
||||
do_handshake_on_connect=False)
|
||||
try:
|
||||
s.setblocking(False)
|
||||
rc = s.connect_ex(('svn.python.org', 443))
|
||||
rc = s.connect_ex((REMOTE_HOST, 443))
|
||||
# EWOULDBLOCK under Windows, EINPROGRESS elsewhere
|
||||
self.assertIn(rc, (0, errno.EINPROGRESS, errno.EWOULDBLOCK))
|
||||
# Wait for connect to finish
|
||||
|
|
@ -584,59 +587,59 @@ class NetworkedTests(unittest.TestCase):
|
|||
def test_timeout_connect_ex(self):
|
||||
# Issue #12065: on a timeout, connect_ex() should return the original
|
||||
# errno (mimicking the behaviour of non-SSL sockets).
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
|
||||
cert_reqs=ssl.CERT_REQUIRED,
|
||||
ca_certs=SVN_PYTHON_ORG_ROOT_CERT,
|
||||
ca_certs=REMOTE_ROOT_CERT,
|
||||
do_handshake_on_connect=False)
|
||||
try:
|
||||
s.settimeout(0.0000001)
|
||||
rc = s.connect_ex(('svn.python.org', 443))
|
||||
rc = s.connect_ex((REMOTE_HOST, 443))
|
||||
if rc == 0:
|
||||
self.skipTest("svn.python.org responded too quickly")
|
||||
self.skipTest("REMOTE_HOST responded too quickly")
|
||||
self.assertIn(rc, (errno.EAGAIN, errno.EWOULDBLOCK))
|
||||
finally:
|
||||
s.close()
|
||||
|
||||
def test_connect_ex_error(self):
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
|
||||
cert_reqs=ssl.CERT_REQUIRED,
|
||||
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
|
||||
ca_certs=REMOTE_ROOT_CERT)
|
||||
try:
|
||||
self.assertEqual(errno.ECONNREFUSED,
|
||||
s.connect_ex(("svn.python.org", 444)))
|
||||
rc = s.connect_ex((REMOTE_HOST, 444))
|
||||
self.assertIn(rc, (errno.ECONNREFUSED, errno.EHOSTUNREACH))
|
||||
finally:
|
||||
s.close()
|
||||
|
||||
def test_connect_with_context(self):
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
# Same as test_connect, but with a separately created context
|
||||
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
|
||||
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
|
||||
s.connect(("svn.python.org", 443))
|
||||
s.connect((REMOTE_HOST, 443))
|
||||
try:
|
||||
self.assertEqual({}, s.getpeercert())
|
||||
finally:
|
||||
s.close()
|
||||
# Same with a server hostname
|
||||
s = ctx.wrap_socket(socket.socket(socket.AF_INET),
|
||||
server_hostname="svn.python.org")
|
||||
server_hostname=REMOTE_HOST)
|
||||
if ssl.HAS_SNI:
|
||||
s.connect(("svn.python.org", 443))
|
||||
s.connect((REMOTE_HOST, 443))
|
||||
s.close()
|
||||
else:
|
||||
self.assertRaises(ValueError, s.connect, ("svn.python.org", 443))
|
||||
self.assertRaises(ValueError, s.connect, (REMOTE_HOST, 443))
|
||||
# This should fail because we have no verification certs
|
||||
ctx.verify_mode = ssl.CERT_REQUIRED
|
||||
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
|
||||
self.assertRaisesRegex(ssl.SSLError, "certificate verify failed",
|
||||
s.connect, ("svn.python.org", 443))
|
||||
s.connect, (REMOTE_HOST, 443))
|
||||
s.close()
|
||||
# This should succeed because we specify the root cert
|
||||
ctx.load_verify_locations(SVN_PYTHON_ORG_ROOT_CERT)
|
||||
ctx.load_verify_locations(REMOTE_ROOT_CERT)
|
||||
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
|
||||
s.connect(("svn.python.org", 443))
|
||||
s.connect((REMOTE_HOST, 443))
|
||||
try:
|
||||
cert = s.getpeercert()
|
||||
self.assertTrue(cert)
|
||||
|
|
@ -649,12 +652,12 @@ class NetworkedTests(unittest.TestCase):
|
|||
# OpenSSL 0.9.8n and 1.0.0, as a result the capath directory must
|
||||
# contain both versions of each certificate (same content, different
|
||||
# filename) for this test to be portable across OpenSSL releases.
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
|
||||
ctx.verify_mode = ssl.CERT_REQUIRED
|
||||
ctx.load_verify_locations(capath=CAPATH)
|
||||
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
|
||||
s.connect(("svn.python.org", 443))
|
||||
s.connect((REMOTE_HOST, 443))
|
||||
try:
|
||||
cert = s.getpeercert()
|
||||
self.assertTrue(cert)
|
||||
|
|
@ -665,7 +668,7 @@ class NetworkedTests(unittest.TestCase):
|
|||
ctx.verify_mode = ssl.CERT_REQUIRED
|
||||
ctx.load_verify_locations(capath=BYTES_CAPATH)
|
||||
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
|
||||
s.connect(("svn.python.org", 443))
|
||||
s.connect((REMOTE_HOST, 443))
|
||||
try:
|
||||
cert = s.getpeercert()
|
||||
self.assertTrue(cert)
|
||||
|
|
@ -677,9 +680,9 @@ class NetworkedTests(unittest.TestCase):
|
|||
# Issue #5238: creating a file-like object with makefile() shouldn't
|
||||
# delay closing the underlying "real socket" (here tested with its
|
||||
# file descriptor, hence skipping the test under Windows).
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
ss = ssl.wrap_socket(socket.socket(socket.AF_INET))
|
||||
ss.connect(("svn.python.org", 443))
|
||||
ss.connect((REMOTE_HOST, 443))
|
||||
fd = ss.fileno()
|
||||
f = ss.makefile()
|
||||
f.close()
|
||||
|
|
@ -693,9 +696,9 @@ class NetworkedTests(unittest.TestCase):
|
|||
self.assertEqual(e.exception.errno, errno.EBADF)
|
||||
|
||||
def test_non_blocking_handshake(self):
|
||||
with support.transient_internet("svn.python.org"):
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
s = socket.socket(socket.AF_INET)
|
||||
s.connect(("svn.python.org", 443))
|
||||
s.connect((REMOTE_HOST, 443))
|
||||
s.setblocking(False)
|
||||
s = ssl.wrap_socket(s,
|
||||
cert_reqs=ssl.CERT_NONE,
|
||||
|
|
@ -718,14 +721,14 @@ class NetworkedTests(unittest.TestCase):
|
|||
sys.stdout.write("\nNeeded %d calls to do_handshake() to establish session.\n" % count)
|
||||
|
||||
def test_get_server_certificate(self):
|
||||
with support.transient_internet("svn.python.org"):
|
||||
pem = ssl.get_server_certificate(("svn.python.org", 443),
|
||||
with support.transient_internet(REMOTE_HOST):
|
||||
pem = ssl.get_server_certificate((REMOTE_HOST, 443),
|
||||
ssl.PROTOCOL_SSLv23)
|
||||
if not pem:
|
||||
self.fail("No server certificate on svn.python.org:443!")
|
||||
self.fail("No server certificate on REMOTE_HOST:443!")
|
||||
|
||||
try:
|
||||
pem = ssl.get_server_certificate(("svn.python.org", 443),
|
||||
pem = ssl.get_server_certificate((REMOTE_HOST, 443),
|
||||
ssl.PROTOCOL_SSLv23,
|
||||
ca_certs=CERTFILE)
|
||||
except ssl.SSLError as x:
|
||||
|
|
@ -733,18 +736,18 @@ class NetworkedTests(unittest.TestCase):
|
|||
if support.verbose:
|
||||
sys.stdout.write("%s\n" % x)
|
||||
else:
|
||||
self.fail("Got server certificate %s for svn.python.org!" % pem)
|
||||
self.fail("Got server certificate %s for REMOTE_HOST!" % pem)
|
||||
|
||||
pem = ssl.get_server_certificate(("svn.python.org", 443),
|
||||
pem = ssl.get_server_certificate((REMOTE_HOST, 443),
|
||||
ssl.PROTOCOL_SSLv23,
|
||||
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
|
||||
ca_certs=REMOTE_ROOT_CERT)
|
||||
if not pem:
|
||||
self.fail("No server certificate on svn.python.org:443!")
|
||||
self.fail("No server certificate on REMOTE_HOST:443!")
|
||||
if support.verbose:
|
||||
sys.stdout.write("\nVerified certificate for svn.python.org:443 is\n%s\n" % pem)
|
||||
sys.stdout.write("\nVerified certificate for REMOTE_HOST:443 is\n%s\n" % pem)
|
||||
|
||||
def test_ciphers(self):
|
||||
remote = ("svn.python.org", 443)
|
||||
remote = (REMOTE_HOST, 443)
|
||||
with support.transient_internet(remote[0]):
|
||||
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
|
||||
cert_reqs=ssl.CERT_NONE, ciphers="ALL")
|
||||
|
|
@ -1745,7 +1748,7 @@ def test_main(verbose=False):
|
|||
print(" HAS_SNI = %r" % ssl.HAS_SNI)
|
||||
|
||||
for filename in [
|
||||
CERTFILE, SVN_PYTHON_ORG_ROOT_CERT, BYTES_CERTFILE,
|
||||
CERTFILE, REMOTE_ROOT_CERT, BYTES_CERTFILE,
|
||||
ONLYCERT, ONLYKEY, BYTES_ONLYCERT, BYTES_ONLYKEY,
|
||||
BADCERT, BADKEY, EMPTYCERT]:
|
||||
if not os.path.exists(filename):
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue