f6b1d66a3c
Issue #23804 : Fix SSL recv/read(0) to not return 1024 bytes
2016-03-28 00:22:09 +00:00
afd465d497
Issue #26644 : Merge SSL negative read fix from 3.5
2016-03-27 10:40:22 +00:00
5503d4731e
Issue #26644 : Raise ValueError for negative SSLSocket.recv() and read()
2016-03-27 05:35:19 +00:00
3840b2ac67
Issue #25940 : Use internal local server more in test_ssl
...
Move many tests from NetworkedTests and NetworkedBIOTests to a new Simple-
BackgroundTests class, using the existing ThreadedEchoServer and SIGNED_
CERTFILE infrastructure.
For tests that cause the server to crash by rejecting its certificate,
separate them into independent test methods.
Added custom root certificate to capath with the following commands:
cp Lib/test/{pycacert.pem,capath/}
# Edit copy to remove part before certificate
c_rehash -v Lib/test/capath/
c_rehash -v -old Lib/test/capath/
# Note the generated file names
cp Lib/test/capath/{pycacert.pem,b1930218.0}
mv Lib/test/capath/{pycacert.pem,ceff1710.0}
Change to pure PEM version of SIGNING_CA because PEM_cert_to_DER_cert() does
not like the extra text at the start.
Moved test_connect_ex_error() into BasicSocketTests and rewrote it to connect
to a reserved localhost port.
NetworkedTests.test_get_server_certificate_ipv6() split out because it needs
to connect to an IPv6 DNS address.
The only reference left to self-signed.pythontest.net is test_timeout_
connect_ex(), which needs a remote server to reliably time out the
connection, but does not rely on the server running SSL.
Made ThreadedEchoServer call unwrap() by default when it sees the client has
shut the connection down, so that the client can cleanly call unwrap().
2016-03-27 01:53:46 +00:00
e0b75b7e87
Fix test_ssl.test_refcycle()
...
Issue #26590 : support.check_warnings() stores warnins, but ResourceWarning now
comes with a reference to the socket object which indirectly keeps the socket
alive.
2016-03-21 17:26:04 +01:00
3464ea2807
Issue #26173 : Separate bad cert file tests and client rejection test
...
Test test_wrong_cert() runs a server that rejects the client's certificate,
so ECONNRESET is reasonable in addition to SSLError. On the other hand, the
other three tests don't even need to run a server because they are just
testing the parsing of invalid certificate files.
Also fix a ResourceWarning by closing the wrapped socket.
2016-02-01 21:58:11 +00:00
407b62f3e5
Issue #26173 : Fix test_ssl confusion with non-existing cert and wrongcert.pem
...
Testing for a non-existing certificate file is already done in test_errors().
Copy wrongcert.pem from Python 2 and use it to test the behaviour with a
mismatched certificate.
2016-01-30 03:41:43 +00:00
a8b43b5fc3
Issue #25940 : Merge ETIMEDOUT fix from 3.4 into 3.5
2016-01-15 02:28:59 +00:00
3f2240ccb6
Issue #25940 : Merge ETIMEDOUT fix from 3.3 into 3.4
2016-01-15 02:18:31 +00:00
fab75d9bb9
Issue #25940 : Merge ETIMEDOUT fix from 3.2 into 3.3
2016-01-15 02:08:13 +00:00
035583b389
Issue #25940 : On Windows, connecting to port 444 returns ETIMEDOUT
2016-01-15 01:16:41 +00:00
40b97ec57a
Issue #25940 : Update new SSL tests for self-signed.pythontest.net
...
Removed SSL_ERROR_SYSCALL checking from ssl_io_loop() so that the loop can
terminate when unwrap() raises that error.
2016-01-14 13:05:46 +00:00
17cbee49d6
Issue #25940 : Merge self-signed.pythontest.net testing from 3.4 into 3.5
2016-01-14 13:22:29 +00:00
b55f8b79af
Issue #25940 : Update new SSL tests for self-signed.pythontest.net
2016-01-14 12:53:56 +00:00
514bb0711f
Issue #25940 : Merge self-signed.pythontest.net testing from 3.3 into 3.4
2016-01-14 12:46:49 +00:00
73f55076f6
Issue #25940 : Merge self-signed.pythontest.net testing from 3.2 into 3.3
2016-01-14 12:21:02 +00:00
3d81d93f34
Issue #25940 : Use self-signed.pythontest.net in SSL tests
...
This is instead of svn.python.org, whose certificate recently expired, and
whose new certificate uses a different root certificate.
The certificate used at the pythontest server was modifed to set the "basic
constraints" CA flag. This flag seems to be required for test_get_ca_certs_
capath() to work (in Python 3.4+).
Added the new self-signed certificate to capath with the following commands:
cp Lib/test/{selfsigned_pythontestdotnet.pem,capath/}
c_rehash -v Lib/test/capath/
c_rehash -v -old Lib/test/capath/
# Note the generated file names
cp Lib/test/capath/{selfsigned_pythontestdotnet.pem,0e4015b9.0}
mv Lib/test/capath/{selfsigned_pythontestdotnet.pem,ce7b8643.0}
The new server responds with "No route to host" when connecting to port 444.
2016-01-14 09:36:00 +00:00
45bde5d2ee
merge 3.4 ( #25530 )
2015-11-11 22:45:22 -08:00
a9dcdabccb
always set OP_NO_SSLv3 by default ( closes #25530 )
2015-11-11 22:38:41 -08:00
9e7990ae21
Issue #24210 : Silence more PendingDeprecationWarning warnings in tests.
2015-05-16 23:21:26 +03:00
4b9df0d33b
merge 3.4 ( #23844 )
2015-04-02 00:08:10 -04:00
a7eaf56a6d
replace 512 bit dh key with a 2014 bit one ( closes #23844 )
...
Patch by Cédric Krier.
2015-04-02 00:04:06 -04:00
8490f5acfe
Issue #23001 : Few functions in modules mmap, ossaudiodev, socket, ssl, and
...
codecs, that accepted only read-only bytes-like object now accept writable
bytes-like object too.
2015-03-20 09:00:36 +02:00
18987a11ce
Issue #20617 : Remove unused import in test_ssl.
...
Patch by Mark Lawrence.
2015-03-12 18:50:49 +02:00
4a0e14730b
Issue #20617 : Remove unused import in test_ssl.
...
Patch by Mark Lawrence.
2015-03-12 18:51:16 +02:00
3e2500d6db
merge 3.4
2015-03-04 23:20:23 -05:00
c3d9c5ca0a
adjust test_crl_check for trusted first being default
2015-03-04 23:18:48 -05:00
de8eca4638
merge 3.4
2015-03-04 22:50:25 -05:00
990fcaac3c
expose X509_V_FLAG_TRUSTED_FIRST
2015-03-04 22:49:41 -05:00
c481bfb3f6
Issue #23239 : ssl.match_hostname() now supports matching of IP addresses.
2015-02-15 18:12:20 +01:00
7aa4428835
Issue #23345 : merge from 3.4
2015-02-05 17:24:00 +11:00
05784a706e
Issue #23345 : Prevent test_ssl failures with large OpenSSL patch level
...
values (like 0.9.8zc).
2015-02-05 17:20:13 +11:00
8861502e07
prefer server alpn ordering over the client's
2015-01-23 17:30:26 -05:00
cca2732a82
add support for ALPN ( closes #20188 )
2015-01-23 16:35:37 -05:00
15042921ad
enable cert validation in test
2015-01-07 22:12:43 -06:00
23ef9fac16
trying again
2015-01-07 21:21:34 -06:00
e6838e08ef
reorder cipher prefs
2015-01-07 20:52:40 -06:00
44c77791ab
drop 256
2015-01-07 20:30:59 -06:00
359f2982f4
try using AES256
2015-01-07 20:03:27 -06:00
8791d697e0
fix assertions after ciphers were changed
2015-01-07 14:29:45 -06:00
f78b78aed4
rc4 is a long time favorite
2015-01-07 14:21:22 -06:00
438a8db763
everyone should support AES ciphers
2015-01-07 13:28:40 -06:00
9f6eceab46
include some more ciphers
2015-01-07 12:59:20 -06:00
aacd524118
force test server to speak tlsv1
2015-01-07 11:42:38 -06:00
e27a421354
remove apparently wrong assertion about des bit size
2015-01-07 11:33:51 -06:00
4cb17812d9
expose the client's cipher suites from the handshake ( closes #23186 )
2015-01-07 11:14:26 -06:00
fcfed19913
Issue #21356 : Make ssl.RAND_egd() optional to support LibreSSL. The
...
availability of the function is checked during the compilation. Patch written
by Bernard Spil.
2015-01-06 13:54:58 +01:00
789b805700
test_ssl: add more debug to investigate test_openssl_version() failure on
...
OpenBSD with LibreSSL.
2015-01-06 11:51:06 +01:00
3f7e064b2b
Issue #22935 : Fix test_ssl when the SSLv3 protocol is not supported
2014-12-12 12:27:08 +01:00
e32467cf6a
allow ssl module to compile if openssl doesn't support SSL 3 ( closes #22935 )
...
Patch by Kurt Roeckx.
2014-12-05 21:59:35 -05:00
7243b574e5
don't require OpenSSL SNI to pass hostname to ssl functions ( #22921 )
...
Patch by Donald Stufft.
2014-11-23 17:04:34 -06:00
648b862017
Issue #22935 : Fix test_ssl when the SSLv3 protocol is not supported
2014-12-12 12:23:59 +01:00
22293df016
merge 3.4 ( #22935 )
2014-12-05 22:11:33 -05:00
beeb512fe1
Issue #21356 : Make ssl.RAND_egd() optional to support LibreSSL. The
...
availability of the function is checked during the compilation.
Patch written by Bernard Spil.
2014-11-28 13:28:25 +01:00
f9284ae8ed
merge 3.4 ( #22921 )
2014-11-23 17:06:39 -06:00
98e1b9158c
merge 3.4
2014-11-03 21:06:07 -05:00
1ea070e561
test that keyfile can be None
2014-11-03 21:05:01 -05:00
1cca273669
merge 3.4 ( #22417 )
2014-11-03 14:36:48 -05:00
4ffb075271
PEP 476: enable HTTPS certificate verification by default ( #22417 )
...
Patch by Alex Gaynor with some modifications by me.
2014-11-03 14:29:33 -05:00
b1fdf47ff5
Issue #21965 : Add support for in-memory SSL to the ssl module.
...
Patch by Geert Jansen.
2014-10-05 20:41:53 +02:00
91b62c4a8a
merge 3.4
2014-10-03 18:17:30 -04:00
91244e01bb
separate cert loading tests into Windows and non-Windows cases
2014-10-03 18:17:15 -04:00
8b9cfa1066
merge 3.4 ( #22449 )
2014-10-03 17:33:45 -04:00
5915b0f924
also use openssl envvars to find certs on windows ( closes #22449 )
...
Patch by Christian Heimes and Alex Gaynor.
2014-10-03 17:27:05 -04:00
47e40429fb
Issue #20421 : Add a .version() method to SSL sockets exposing the actual protocol version in use.
2014-09-04 21:00:10 +02:00
6e20460dc6
Issue #21566 : Make use of socket.listen() default backlog.
2014-07-23 19:28:13 +01:00
26408df88f
Issue #21976 : Fix test_ssl to accept LibreSSL version strings.
...
Thanks to William Orr.
2014-07-21 18:37:36 -04:00
dfab935c74
Issue #21976 : Fix test_ssl to accept LibreSSL version strings.
...
Thanks to William Orr.
2014-07-21 18:35:01 -04:00
915d14190e
fix issue #17552 : add socket.sendfile() method allowing to send a file over a socket by using high-performance os.sendfile() on UNIX. Patch by Giampaolo Rodola'·
2014-06-11 03:54:30 +02:00
b4bebdafe3
Issue #20951 : SSLSocket.send() now raises either SSLWantReadError or SSLWantWriteError on a non-blocking socket if the operation would block. Previously, it would return 0.
...
Patch by Nikolaus Rath.
2014-04-29 10:03:28 +02:00
c695c95626
Issue #19940 : ssl.cert_time_to_seconds() now interprets the given time string in the UTC timezone (as specified in RFC 5280), not the local timezone.
...
Patch by Akira.
2014-04-28 20:57:36 +02:00
172f025bed
Issue #21068 : The ssl.PROTOCOL* constants are now enum members.
2014-04-18 20:33:08 +02:00
c043061667
Try to fix buildbot failures on old OpenSSLs (< 1.0.0) - followup to issue #21015
2014-04-16 18:33:39 +02:00
94a5b663bf
Issue #20896 : ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not PROTOCOL_SSLv3, for maximum compatibility.
2014-04-16 18:56:28 +02:00
6a2ba94908
Issue #21013 : Enhance ssl.create_default_context() for server side contexts
...
Closes #21013 by modfying ssl.create_default_context() to:
* Move the restricted ciphers to only apply when using
ssl.Purpose.CLIENT_AUTH. The major difference between restricted and not
is the lack of RC4 in the restricted. However there are servers that exist
that only expose RC4 still.
* Switches the default protocol to ssl.PROTOCOL_SSLv23 so that the context
will select TLS1.1 or TLS1.2 if it is available.
* Add ssl.OP_NO_SSLv3 by default to continue to block SSL3.0 sockets
* Add ssl.OP_SINGLE_DH_USE and ssl.OP_SINGLE_ECDG_USE to improve the security
of the perfect forward secrecy
* Add ssl.OP_CIPHER_SERVER_PREFERENCE so that when used for a server side
socket the context will prioritize our ciphers which have been carefully
selected to maximize security and performance.
* Documents the failure conditions when a SSL3.0 connection is required so
that end users can more easily determine if they need to unset
ssl.OP_NO_SSLv3.
2014-03-23 19:05:28 -04:00
0bebbc33fa
Issue #21015 : SSL contexts will now automatically select an elliptic curve for ECDH key exchange on OpenSSL 1.0.2 and later, and otherwise default to "prime256v1".
...
(should also fix a buildbot failure introduced by #20995 )
2014-03-22 18:13:50 +01:00
10b93cc29c
merge 3.3 ( #20896 )
2014-03-12 18:10:57 -05:00
d0fc83d5eb
merge 3.2 ( #20896 )
2014-03-12 18:10:47 -05:00
cf25c5caae
use ssl.PROTOCOL_SSLv23 for maximum compatibility ( closes #20896 )
2014-03-12 18:05:53 -05:00
ba44860c11
Try to fix test_ssl failures on some buildbots
2014-01-09 21:30:17 +01:00
32c4915b23
Try to fix test_ssl failures on some buildbots
2014-01-09 21:28:48 +01:00
78ace81c93
Issue #20207 : Always disable SSLv2 except when PROTOCOL_SSLv2 is explicitly asked for.
2014-01-09 20:09:03 +01:00
cd3d7cabef
Issue #20207 : Always disable SSLv2 except when PROTOCOL_SSLv2 is explicitly asked for.
2014-01-09 20:02:20 +01:00
3e86ba4e32
Issue #19422 : Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
2013-12-28 17:26:33 +01:00
e6d2f159fc
Issue #19422 : Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
2013-12-28 17:30:51 +01:00
36e96b8716
(Merge 3.3) Issue #20025 : ssl.RAND_bytes() and ssl.RAND_pseudo_bytes() now
...
raise a ValueError if num is negative (instead of raising a SystemError).
2013-12-19 16:47:25 +01:00
1e81a399a2
Issue #20025 : ssl.RAND_bytes() and ssl.RAND_pseudo_bytes() now raise a
...
ValueError if num is negative (instead of raising a SystemError).
2013-12-19 16:47:04 +01:00
bd9cbb0691
Issue #19919 : Fix flacky SSL test. connect_ex() sometimes returns
...
EWOULDBLOCK on Windows or VMs hosted on Windows.
2013-12-16 21:16:45 +01:00
de57074874
Issue #19919 : Fix flacky SSL test. connect_ex() sometimes returns
...
EWOULDBLOCK on Windows or VMs hosted on Windows.
2013-12-16 21:15:44 +01:00
575596e19a
test_ssl: skip tests when SNI is not available
2013-12-15 21:49:17 +01:00
8e7f394282
Test SSLSock's context getter and setter
2013-12-05 07:41:08 +01:00
a02c69a73b
add check_hostname arg to ssl._create_stdlib_context()
2013-12-02 20:59:28 +01:00
1aa9a75fbf
Issue #19509 : Add SSLContext.check_hostname to match the peer's certificate
...
with server_hostname on handshake.
2013-12-02 02:41:19 +01:00
67986f9431
Issue #19735 : Implement private function ssl._create_stdlib_context() to
...
create SSLContext objects in Python's stdlib module. It provides a single
configuration point and makes use of SSLContext.load_default_certs().
2013-11-23 22:43:47 +01:00
4c05b472dd
Issue #19689 : Add ssl.create_default_context() factory function. It creates
...
a new SSLContext object with secure default settings.
2013-11-23 15:58:30 +01:00
72d28500b3
Issue #19292 : Add SSLContext.load_default_certs() to load default root CA
...
certificates from default stores or system stores. By default the method
loads CA certs for authentication of server certs.
2013-11-23 13:56:58 +01:00
2427b50fdd
Issue #8813 : X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+
...
The patch removes the verify_flags feature on Mac OS X 10.4 with OpenSSL 0.9.7l 28 Sep 2006.
2013-11-23 11:24:32 +01:00
5398e1a56e
Issue #19448 : report name / NID in exception message of ASN1Object
2013-11-22 16:20:53 +01:00
c2d65e1e93
Issue #17134 : check certs of CA and ROOT system store
2013-11-22 16:13:55 +01:00
32f0c7a67b
or VERIFY_CRL_CHECK_LEAF to verify_flags
2013-11-22 03:43:48 +01:00
Martin Panter
Victor Stinner
Martin Panter
Benjamin Peterson
Berker Peksag
Serhiy Storchaka
Antoine Pitrou
Ned Deily
Charles-François Natali
Giampaolo Rodola'
Donald Stufft
Christian Heimes