Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity
100,691 Commits 6 Branches 592 Tags 2.8 GiB
Commit Graph

428 Commits

Author SHA1 Message Date
Martin Panter 407b62f3e5 Issue #26173: Fix test_ssl confusion with non-existing cert and wrongcert.pem 
Testing for a non-existing certificate file is already done in test_errors().
Copy wrongcert.pem from Python 2 and use it to test the behaviour with a
mismatched certificate.
 2016-01-30 03:41:43 +00:00
Martin Panter a8b43b5fc3 Issue #25940: Merge ETIMEDOUT fix from 3.4 into 3.5 2016-01-15 02:28:59 +00:00
Martin Panter 3f2240ccb6 Issue #25940: Merge ETIMEDOUT fix from 3.3 into 3.4 2016-01-15 02:18:31 +00:00
Martin Panter fab75d9bb9 Issue #25940: Merge ETIMEDOUT fix from 3.2 into 3.3 2016-01-15 02:08:13 +00:00
Martin Panter 035583b389 Issue #25940: On Windows, connecting to port 444 returns ETIMEDOUT 2016-01-15 01:16:41 +00:00
Martin Panter 40b97ec57a Issue #25940: Update new SSL tests for self-signed.pythontest.net 
Removed SSL_ERROR_SYSCALL checking from ssl_io_loop() so that the loop can
terminate when unwrap() raises that error.
 2016-01-14 13:05:46 +00:00
Martin Panter 17cbee49d6 Issue #25940: Merge self-signed.pythontest.net testing from 3.4 into 3.5 2016-01-14 13:22:29 +00:00
Martin Panter b55f8b79af Issue #25940: Update new SSL tests for self-signed.pythontest.net 2016-01-14 12:53:56 +00:00
Martin Panter 514bb0711f Issue #25940: Merge self-signed.pythontest.net testing from 3.3 into 3.4 2016-01-14 12:46:49 +00:00
Martin Panter 73f55076f6 Issue #25940: Merge self-signed.pythontest.net testing from 3.2 into 3.3 2016-01-14 12:21:02 +00:00
Martin Panter 3d81d93f34 Issue #25940: Use self-signed.pythontest.net in SSL tests 
This is instead of svn.python.org, whose certificate recently expired, and
whose new certificate uses a different root certificate.

The certificate used at the pythontest server was modifed to set the "basic
constraints" CA flag. This flag seems to be required for test_get_ca_certs_
capath() to work (in Python 3.4+).

Added the new self-signed certificate to capath with the following commands:

cp Lib/test/{selfsigned_pythontestdotnet.pem,capath/}
c_rehash -v Lib/test/capath/
c_rehash -v -old Lib/test/capath/
# Note the generated file names
cp Lib/test/capath/{selfsigned_pythontestdotnet.pem,0e4015b9.0}
mv Lib/test/capath/{selfsigned_pythontestdotnet.pem,ce7b8643.0}

The new server responds with "No route to host" when connecting to port 444.
 2016-01-14 09:36:00 +00:00
Benjamin Peterson 45bde5d2ee merge 3.4 (#25530) 2015-11-11 22:45:22 -08:00
Benjamin Peterson a9dcdabccb always set OP_NO_SSLv3 by default (closes #25530) 2015-11-11 22:38:41 -08:00
Berker Peksag 9e7990ae21 Issue #24210: Silence more PendingDeprecationWarning warnings in tests. 2015-05-16 23:21:26 +03:00
Benjamin Peterson 4b9df0d33b merge 3.4 (#23844) 2015-04-02 00:08:10 -04:00
Benjamin Peterson a7eaf56a6d replace 512 bit dh key with a 2014 bit one (closes #23844) 
Patch by Cédric Krier.
 2015-04-02 00:04:06 -04:00
Serhiy Storchaka 8490f5acfe Issue #23001: Few functions in modules mmap, ossaudiodev, socket, ssl, and 
codecs, that accepted only read-only bytes-like object now accept writable
bytes-like object too.
 2015-03-20 09:00:36 +02:00
Berker Peksag 18987a11ce Issue #20617: Remove unused import in test_ssl. 
Patch by Mark Lawrence.
 2015-03-12 18:50:49 +02:00
Berker Peksag 4a0e14730b Issue #20617: Remove unused import in test_ssl. 
Patch by Mark Lawrence.
 2015-03-12 18:51:16 +02:00
Benjamin Peterson 3e2500d6db merge 3.4 2015-03-04 23:20:23 -05:00
Benjamin Peterson c3d9c5ca0a adjust test_crl_check for trusted first being default 2015-03-04 23:18:48 -05:00
Benjamin Peterson de8eca4638 merge 3.4 2015-03-04 22:50:25 -05:00
Benjamin Peterson 990fcaac3c expose X509_V_FLAG_TRUSTED_FIRST 2015-03-04 22:49:41 -05:00
Antoine Pitrou c481bfb3f6 Issue #23239: ssl.match_hostname() now supports matching of IP addresses. 2015-02-15 18:12:20 +01:00
Ned Deily 7aa4428835 Issue #23345: merge from 3.4 2015-02-05 17:24:00 +11:00
Ned Deily 05784a706e Issue #23345: Prevent test_ssl failures with large OpenSSL patch level 
values (like 0.9.8zc).
 2015-02-05 17:20:13 +11:00
Benjamin Peterson 8861502e07 prefer server alpn ordering over the client's 2015-01-23 17:30:26 -05:00
Benjamin Peterson cca2732a82 add support for ALPN (closes #20188) 2015-01-23 16:35:37 -05:00
Benjamin Peterson 15042921ad enable cert validation in test 2015-01-07 22:12:43 -06:00
Benjamin Peterson 23ef9fac16 trying again 2015-01-07 21:21:34 -06:00
Benjamin Peterson e6838e08ef reorder cipher prefs 2015-01-07 20:52:40 -06:00
Benjamin Peterson 44c77791ab drop 256 2015-01-07 20:30:59 -06:00
Benjamin Peterson 359f2982f4 try using AES256 2015-01-07 20:03:27 -06:00
Benjamin Peterson 8791d697e0 fix assertions after ciphers were changed 2015-01-07 14:29:45 -06:00
Benjamin Peterson f78b78aed4 rc4 is a long time favorite 2015-01-07 14:21:22 -06:00
Benjamin Peterson 438a8db763 everyone should support AES ciphers 2015-01-07 13:28:40 -06:00
Benjamin Peterson 9f6eceab46 include some more ciphers 2015-01-07 12:59:20 -06:00
Benjamin Peterson aacd524118 force test server to speak tlsv1 2015-01-07 11:42:38 -06:00
Benjamin Peterson e27a421354 remove apparently wrong assertion about des bit size 2015-01-07 11:33:51 -06:00
Benjamin Peterson 4cb17812d9 expose the client's cipher suites from the handshake (closes #23186) 2015-01-07 11:14:26 -06:00
Victor Stinner fcfed19913 Issue #21356: Make ssl.RAND_egd() optional to support LibreSSL. The 
availability of the function is checked during the compilation. Patch written
by Bernard Spil.
 2015-01-06 13:54:58 +01:00
Victor Stinner 789b805700 test_ssl: add more debug to investigate test_openssl_version() failure on 
OpenBSD with LibreSSL.
 2015-01-06 11:51:06 +01:00
Victor Stinner 3f7e064b2b Issue #22935: Fix test_ssl when the SSLv3 protocol is not supported 2014-12-12 12:27:08 +01:00
Benjamin Peterson e32467cf6a allow ssl module to compile if openssl doesn't support SSL 3 (closes #22935) 
Patch by Kurt Roeckx.
 2014-12-05 21:59:35 -05:00
Benjamin Peterson 7243b574e5 don't require OpenSSL SNI to pass hostname to ssl functions (#22921) 
Patch by Donald Stufft.
 2014-11-23 17:04:34 -06:00
Victor Stinner 648b862017 Issue #22935: Fix test_ssl when the SSLv3 protocol is not supported 2014-12-12 12:23:59 +01:00
Benjamin Peterson 22293df016 merge 3.4 (#22935) 2014-12-05 22:11:33 -05:00
Victor Stinner beeb512fe1 Issue #21356: Make ssl.RAND_egd() optional to support LibreSSL. The 
availability of the function is checked during the compilation.

Patch written by Bernard Spil.
 2014-11-28 13:28:25 +01:00
Benjamin Peterson f9284ae8ed merge 3.4 (#22921) 2014-11-23 17:06:39 -06:00
Benjamin Peterson 98e1b9158c merge 3.4 2014-11-03 21:06:07 -05:00
Benjamin Peterson 1ea070e561 test that keyfile can be None 2014-11-03 21:05:01 -05:00
Benjamin Peterson 1cca273669 merge 3.4 (#22417) 2014-11-03 14:36:48 -05:00
Benjamin Peterson 4ffb075271 PEP 476: enable HTTPS certificate verification by default (#22417) 
Patch by Alex Gaynor with some modifications by me.
 2014-11-03 14:29:33 -05:00
Antoine Pitrou b1fdf47ff5 Issue #21965: Add support for in-memory SSL to the ssl module. 
Patch by Geert Jansen.
 2014-10-05 20:41:53 +02:00
Benjamin Peterson 91b62c4a8a merge 3.4 2014-10-03 18:17:30 -04:00
Benjamin Peterson 91244e01bb separate cert loading tests into Windows and non-Windows cases 2014-10-03 18:17:15 -04:00
Benjamin Peterson 8b9cfa1066 merge 3.4 (#22449) 2014-10-03 17:33:45 -04:00
Benjamin Peterson 5915b0f924 also use openssl envvars to find certs on windows (closes #22449) 
Patch by Christian Heimes and Alex Gaynor.
 2014-10-03 17:27:05 -04:00
Antoine Pitrou 47e40429fb Issue #20421: Add a .version() method to SSL sockets exposing the actual protocol version in use. 2014-09-04 21:00:10 +02:00
Charles-François Natali 6e20460dc6 Issue #21566: Make use of socket.listen() default backlog. 2014-07-23 19:28:13 +01:00
Antoine Pitrou 26408df88f Issue #21976: Fix test_ssl to accept LibreSSL version strings. 
Thanks to William Orr.
 2014-07-21 18:37:36 -04:00
Antoine Pitrou dfab935c74 Issue #21976: Fix test_ssl to accept LibreSSL version strings. 
Thanks to William Orr.
 2014-07-21 18:35:01 -04:00
Giampaolo Rodola' 915d14190e fix issue #17552: add socket.sendfile() method allowing to send a file over a socket by using high-performance os.sendfile() on UNIX. Patch by Giampaolo Rodola'· 2014-06-11 03:54:30 +02:00
Antoine Pitrou b4bebdafe3 Issue #20951: SSLSocket.send() now raises either SSLWantReadError or SSLWantWriteError on a non-blocking socket if the operation would block. Previously, it would return 0. 
Patch by Nikolaus Rath.
 2014-04-29 10:03:28 +02:00
Antoine Pitrou c695c95626 Issue #19940: ssl.cert_time_to_seconds() now interprets the given time string in the UTC timezone (as specified in RFC 5280), not the local timezone. 
Patch by Akira.
 2014-04-28 20:57:36 +02:00
Antoine Pitrou 172f025bed Issue #21068: The ssl.PROTOCOL* constants are now enum members. 2014-04-18 20:33:08 +02:00
Antoine Pitrou c043061667 Try to fix buildbot failures on old OpenSSLs (< 1.0.0) - followup to issue #21015 2014-04-16 18:33:39 +02:00
Antoine Pitrou 94a5b663bf Issue #20896: ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not PROTOCOL_SSLv3, for maximum compatibility. 2014-04-16 18:56:28 +02:00
Donald Stufft 6a2ba94908 Issue #21013: Enhance ssl.create_default_context() for server side contexts 
Closes #21013 by modfying ssl.create_default_context() to:

* Move the restricted ciphers to only apply when using
  ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
  is the lack of RC4 in the restricted. However there are servers that exist
  that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
  will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
  of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
  socket the context will prioritize our ciphers which have been carefully
  selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
  that end users can more easily determine if they need to unset
  ssl.OP_NO_SSLv3.
 2014-03-23 19:05:28 -04:00
Antoine Pitrou 0bebbc33fa Issue #21015: SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1". 
(should also fix a buildbot failure introduced by #20995)
 2014-03-22 18:13:50 +01:00
Benjamin Peterson 10b93cc29c merge 3.3 (#20896) 2014-03-12 18:10:57 -05:00
Benjamin Peterson d0fc83d5eb merge 3.2 (#20896) 2014-03-12 18:10:47 -05:00
Benjamin Peterson cf25c5caae use ssl.PROTOCOL_SSLv23 for maximum compatibility (closes #20896) 2014-03-12 18:05:53 -05:00
Antoine Pitrou ba44860c11 Try to fix test_ssl failures on some buildbots 2014-01-09 21:30:17 +01:00
Antoine Pitrou 32c4915b23 Try to fix test_ssl failures on some buildbots 2014-01-09 21:28:48 +01:00
Antoine Pitrou 78ace81c93 Issue #20207: Always disable SSLv2 except when PROTOCOL_SSLv2 is explicitly asked for. 2014-01-09 20:09:03 +01:00
Antoine Pitrou cd3d7cabef Issue #20207: Always disable SSLv2 except when PROTOCOL_SSLv2 is explicitly asked for. 2014-01-09 20:02:20 +01:00
Antoine Pitrou 3e86ba4e32 Issue #19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data. 2013-12-28 17:26:33 +01:00
Antoine Pitrou e6d2f159fc Issue #19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data. 2013-12-28 17:30:51 +01:00
Victor Stinner 36e96b8716 (Merge 3.3) Issue #20025: ssl.RAND_bytes() and ssl.RAND_pseudo_bytes() now 
raise a ValueError if num is negative (instead of raising a SystemError).
 2013-12-19 16:47:25 +01:00
Victor Stinner 1e81a399a2 Issue #20025: ssl.RAND_bytes() and ssl.RAND_pseudo_bytes() now raise a 
ValueError if num is negative (instead of raising a SystemError).
 2013-12-19 16:47:04 +01:00
Christian Heimes bd9cbb0691 Issue #19919: Fix flacky SSL test. connect_ex() sometimes returns 
EWOULDBLOCK on Windows or VMs hosted on Windows.
 2013-12-16 21:16:45 +01:00
Christian Heimes de57074874 Issue #19919: Fix flacky SSL test. connect_ex() sometimes returns 
EWOULDBLOCK on Windows or VMs hosted on Windows.
 2013-12-16 21:15:44 +01:00
Christian Heimes 575596e19a test_ssl: skip tests when SNI is not available 2013-12-15 21:49:17 +01:00
Christian Heimes 8e7f394282 Test SSLSock's context getter and setter 2013-12-05 07:41:08 +01:00
Christian Heimes a02c69a73b add check_hostname arg to ssl._create_stdlib_context() 2013-12-02 20:59:28 +01:00
Christian Heimes 1aa9a75fbf Issue #19509: Add SSLContext.check_hostname to match the peer's certificate 
with server_hostname on handshake.
 2013-12-02 02:41:19 +01:00
Christian Heimes 67986f9431 Issue #19735: Implement private function ssl._create_stdlib_context() to 
create SSLContext objects in Python's stdlib module. It provides a single
configuration point and makes use of SSLContext.load_default_certs().
 2013-11-23 22:43:47 +01:00
Christian Heimes 4c05b472dd Issue #19689: Add ssl.create_default_context() factory function. It creates 
a new SSLContext object with secure default settings.
 2013-11-23 15:58:30 +01:00
Christian Heimes 72d28500b3 Issue #19292: Add SSLContext.load_default_certs() to load default root CA 
certificates from default stores or system stores. By default the method
loads CA certs for authentication of server certs.
 2013-11-23 13:56:58 +01:00
Christian Heimes 2427b50fdd Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ 
The patch removes the verify_flags feature on Mac OS X 10.4 with OpenSSL 0.9.7l 28 Sep 2006.
 2013-11-23 11:24:32 +01:00
Christian Heimes 5398e1a56e Issue #19448: report name / NID in exception message of ASN1Object 2013-11-22 16:20:53 +01:00
Christian Heimes c2d65e1e93 Issue #17134: check certs of CA and ROOT system store 2013-11-22 16:13:55 +01:00
Christian Heimes 32f0c7a67b or VERIFY_CRL_CHECK_LEAF to verify_flags 2013-11-22 03:43:48 +01:00
Christian Heimes 44109d7de7 Issue #17134: Finalize interface to Windows' certificate store. Cert and 
CRL enumeration are now two functions. enum_certificates() also returns
purpose flags as set of OIDs.
 2013-11-22 01:51:30 +01:00
Christian Heimes d6dc952e17 one CERT_REQUIRED is enough 2013-11-22 00:39:38 +01:00
Christian Heimes 225877917e Issue #8813: Add SSLContext.verify_flags to change the verification flags 
of the context in order to enable certification revocation list (CRL)
checks or strict X509 rules.
 2013-11-21 23:56:13 +01:00
Christian Heimes bd3a7f90b5 Issue #18379: SSLSocket.getpeercert() returns CA issuer AIA fields, OCSP 
and CRL distribution points.
 2013-11-21 03:40:15 +01:00
Christian Heimes efff7060f8 Issue #18138: Implement cadata argument of SSLContext.load_verify_location() 
to load CA certificates and CRL from memory. It supports PEM and DER
encoded strings.
 2013-11-21 03:35:02 +01:00
Christian Heimes a6bc95aa02 Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. 2013-11-17 19:59:14 +01:00