mirror of
https://github.com/python/cpython.git
synced 2025-08-22 09:45:06 +00:00
gh-106687: _ssl: use uint64_t for SSL options (#106700)
SSL_CTX_get_options() uses uint64_t for options: https://www.openssl.org/docs/man3.1/man3/SSL_CTX_get_options.html Fix this compiler warning on Windows with MSC: conversion from 'uint64_t' to 'long', possible loss of data
This commit is contained in:
parent
036bb73656
commit
ad95c7253a
2 changed files with 78 additions and 26 deletions
|
@ -339,6 +339,15 @@ class BasicSocketTests(unittest.TestCase):
|
|||
ssl.OP_NO_TLSv1_2
|
||||
self.assertEqual(ssl.PROTOCOL_TLS, ssl.PROTOCOL_SSLv23)
|
||||
|
||||
def test_options(self):
|
||||
# gh-106687: SSL options values are unsigned integer (uint64_t)
|
||||
for name in dir(ssl):
|
||||
if not name.startswith('OP_'):
|
||||
continue
|
||||
with self.subTest(option=name):
|
||||
value = getattr(ssl, name)
|
||||
self.assertGreaterEqual(value, 0, f"ssl.{name}")
|
||||
|
||||
def test_ssl_types(self):
|
||||
ssl_types = [
|
||||
_ssl._SSLContext,
|
||||
|
@ -951,6 +960,7 @@ class ContextTests(unittest.TestCase):
|
|||
)
|
||||
|
||||
def test_options(self):
|
||||
# Test default SSLContext options
|
||||
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
||||
# OP_ALL | OP_NO_SSLv2 | OP_NO_SSLv3 is the default value
|
||||
default = (ssl.OP_ALL | ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3)
|
||||
|
@ -959,16 +969,30 @@ class ContextTests(unittest.TestCase):
|
|||
OP_SINGLE_DH_USE | OP_SINGLE_ECDH_USE |
|
||||
OP_ENABLE_MIDDLEBOX_COMPAT)
|
||||
self.assertEqual(default, ctx.options)
|
||||
|
||||
# disallow TLSv1
|
||||
with warnings_helper.check_warnings():
|
||||
ctx.options |= ssl.OP_NO_TLSv1
|
||||
self.assertEqual(default | ssl.OP_NO_TLSv1, ctx.options)
|
||||
|
||||
# allow TLSv1
|
||||
with warnings_helper.check_warnings():
|
||||
ctx.options = (ctx.options & ~ssl.OP_NO_TLSv1)
|
||||
self.assertEqual(default, ctx.options)
|
||||
|
||||
# clear all options
|
||||
ctx.options = 0
|
||||
# Ubuntu has OP_NO_SSLv3 forced on by default
|
||||
self.assertEqual(0, ctx.options & ~ssl.OP_NO_SSLv3)
|
||||
|
||||
# invalid options
|
||||
with self.assertRaises(OverflowError):
|
||||
ctx.options = -1
|
||||
with self.assertRaises(OverflowError):
|
||||
ctx.options = 2 ** 100
|
||||
with self.assertRaises(TypeError):
|
||||
ctx.options = "abc"
|
||||
|
||||
def test_verify_mode_protocol(self):
|
||||
with warnings_helper.check_warnings():
|
||||
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue