mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-12-09 02:35:14 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 10

gh-89051: Add ssl.OP_LEGACY_SERVER_CONNECT (#93927)

Browse source 
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Christian Heimes <christian@python.org>
Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>
Fixes https://github.com/python/cpython/issues/89051
This commit is contained in:
Thomas Grainger 2022-12-20 07:10:30 +00:00 • committed by GitHub
parent 36a0b1d0dd
commit 79ccc03b62
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 26 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
Doc/library/ssl.rst
View file

@ -823,6 +823,13 @@ Constants
.. versionadded:: 3.12 .. versionadded:: 3.12
.. data:: OP_LEGACY_SERVER_CONNECT
Allow legacy insecure renegotiation between OpenSSL and unpatched servers
only.
.. versionadded:: 3.12
.. data:: HAS_ALPN .. data:: HAS_ALPN
Whether the OpenSSL library has built-in support for the *Application-Layer Whether the OpenSSL library has built-in support for the *Application-Layer

16
Lib/test/test_ssl.py
View file

@ -1461,6 +1461,8 @@ class ContextTests(unittest.TestCase):
if OP_CIPHER_SERVER_PREFERENCE != 0: if OP_CIPHER_SERVER_PREFERENCE != 0:
self.assertEqual(ctx.options & OP_CIPHER_SERVER_PREFERENCE, self.assertEqual(ctx.options & OP_CIPHER_SERVER_PREFERENCE,
OP_CIPHER_SERVER_PREFERENCE) OP_CIPHER_SERVER_PREFERENCE)
self.assertEqual(ctx.options & ssl.OP_LEGACY_SERVER_CONNECT,
0 if IS_OPENSSL_3_0_0 else ssl.OP_LEGACY_SERVER_CONNECT)
def test_create_default_context(self): def test_create_default_context(self):
ctx = ssl.create_default_context() ctx = ssl.create_default_context()
@ -3815,6 +3817,20 @@ class ThreadedTests(unittest.TestCase):
sni_name=hostname) sni_name=hostname)
self.assertIs(stats['compression'], None) self.assertIs(stats['compression'], None)
def test_legacy_server_connect(self):
client_context, server_context, hostname = testing_context()
client_context.options |= ssl.OP_LEGACY_SERVER_CONNECT
server_params_test(client_context, server_context,
chatty=True, connectionchatty=True,
sni_name=hostname)
def test_no_legacy_server_connect(self):
client_context, server_context, hostname = testing_context()
client_context.options &= ~ssl.OP_LEGACY_SERVER_CONNECT
server_params_test(client_context, server_context,
chatty=True, connectionchatty=True,
sni_name=hostname)
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows") @unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_dh_params(self): def test_dh_params(self):
# Check we can get a connection with ephemeral Diffie-Hellman # Check we can get a connection with ephemeral Diffie-Hellman

1
Misc/NEWS.d/next/Core and Builtins/2022-06-17-08-00-34.gh-issue-89051.yP4Na0.rst Normal file
View file

@ -0,0 +1 @@
Add :data:`ssl.OP_LEGACY_SERVER_CONNECT`

2
Modules/_ssl.c
View file

@ -5845,6 +5845,8 @@ sslmodule_init_constants(PyObject *m)
SSL_OP_CIPHER_SERVER_PREFERENCE); SSL_OP_CIPHER_SERVER_PREFERENCE);
PyModule_AddIntConstant(m, "OP_SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE); PyModule_AddIntConstant(m, "OP_SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE);
PyModule_AddIntConstant(m, "OP_NO_TICKET", SSL_OP_NO_TICKET); PyModule_AddIntConstant(m, "OP_NO_TICKET", SSL_OP_NO_TICKET);
PyModule_AddIntConstant(m, "OP_LEGACY_SERVER_CONNECT",
SSL_OP_LEGACY_SERVER_CONNECT);
#ifdef SSL_OP_SINGLE_ECDH_USE #ifdef SSL_OP_SINGLE_ECDH_USE
PyModule_AddIntConstant(m, "OP_SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE); PyModule_AddIntConstant(m, "OP_SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE);
#endif #endif