From 3ed27a7fcd1b5ff35a8b7dc46abd44df06c22003 Mon Sep 17 00:00:00 2001 From: Christian Heimes Date: Tue, 19 Sep 2017 20:48:59 +0200 Subject: [PATCH] bpo-31518: Change TLS protocol for Debian Debian Unstable has disabled TLS 1.0 and 1.1 for SSLv23_METHOD(). Change TLS/SSL protocol of some tests to PROTOCOL_TLS or PROTOCOL_TLSv1_2 to make them pass on Debian. Signed-off-by: Christian Heimes --- Lib/test/test_ftplib.py | 6 +++--- Lib/test/test_httplib.py | 8 ++++---- Lib/test/test_ssl.py | 2 +- Lib/test/test_urllib2_localnet.py | 2 +- .../next/Tests/2017-09-19-20-48-50.bpo-31518.KwTMMz.rst | 3 +++ 5 files changed, 12 insertions(+), 9 deletions(-) create mode 100644 Misc/NEWS.d/next/Tests/2017-09-19-20-48-50.bpo-31518.KwTMMz.rst diff --git a/Lib/test/test_ftplib.py b/Lib/test/test_ftplib.py index fdfa31387cb4b9..e728aa70f9ea50 100644 --- a/Lib/test/test_ftplib.py +++ b/Lib/test/test_ftplib.py @@ -710,11 +710,11 @@ def test_auth_ssl(self): self.client.auth() self.assertRaises(ValueError, self.client.auth) finally: - self.client.ssl_version = ssl.PROTOCOL_TLSv1 + self.client.ssl_version = ssl.PROTOCOL_TLS def test_context(self): self.client.quit() - ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS) self.assertRaises(ValueError, ftplib.FTP_TLS, keyfile=CERTFILE, context=ctx) self.assertRaises(ValueError, ftplib.FTP_TLS, certfile=CERTFILE, @@ -739,7 +739,7 @@ def test_context(self): def test_check_hostname(self): self.client.quit() - ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS) ctx.verify_mode = ssl.CERT_REQUIRED ctx.check_hostname = True ctx.load_verify_locations(CAFILE) diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py index 7e8b058e8b0f6e..44ffac7036886e 100644 --- a/Lib/test/test_httplib.py +++ b/Lib/test/test_httplib.py @@ -860,7 +860,7 @@ def test_networked_good_cert(self): import ssl test_support.requires('network') with test_support.transient_internet('self-signed.pythontest.net'): - context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + context = ssl.SSLContext(ssl.PROTOCOL_TLS) context.verify_mode = ssl.CERT_REQUIRED context.load_verify_locations(CERT_selfsigned_pythontestdotnet) h = httplib.HTTPSConnection('self-signed.pythontest.net', 443, context=context) @@ -874,7 +874,7 @@ def test_networked_bad_cert(self): import ssl test_support.requires('network') with test_support.transient_internet('self-signed.pythontest.net'): - context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + context = ssl.SSLContext(ssl.PROTOCOL_TLS) context.verify_mode = ssl.CERT_REQUIRED context.load_verify_locations(CERT_localhost) h = httplib.HTTPSConnection('self-signed.pythontest.net', 443, context=context) @@ -895,7 +895,7 @@ def test_local_good_hostname(self): # The (valid) cert validates the HTTP hostname import ssl server = self.make_server(CERT_localhost) - context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + context = ssl.SSLContext(ssl.PROTOCOL_TLS) context.verify_mode = ssl.CERT_REQUIRED context.load_verify_locations(CERT_localhost) h = httplib.HTTPSConnection('localhost', server.port, context=context) @@ -907,7 +907,7 @@ def test_local_bad_hostname(self): # The (valid) cert doesn't validate the HTTP hostname import ssl server = self.make_server(CERT_fakehostname) - context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + context = ssl.SSLContext(ssl.PROTOCOL_TLS) context.verify_mode = ssl.CERT_REQUIRED context.check_hostname = True context.load_verify_locations(CERT_fakehostname) diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index cfc03e343c7d6b..f172520011f467 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -1774,7 +1774,7 @@ def __init__(self, certificate=None, ssl_version=None, else: self.context = ssl.SSLContext(ssl_version if ssl_version is not None - else ssl.PROTOCOL_TLSv1) + else ssl.PROTOCOL_TLS) self.context.verify_mode = (certreqs if certreqs is not None else ssl.CERT_NONE) if cacerts: diff --git a/Lib/test/test_urllib2_localnet.py b/Lib/test/test_urllib2_localnet.py index 061233f9f2f254..932b57223a5652 100644 --- a/Lib/test/test_urllib2_localnet.py +++ b/Lib/test/test_urllib2_localnet.py @@ -577,7 +577,7 @@ def test_https_sni(self): sni_name = [None] def cb_sni(ssl_sock, server_name, initial_context): sni_name[0] = server_name - context = ssl.SSLContext(ssl.PROTOCOL_TLSv1) + context = ssl.SSLContext(ssl.PROTOCOL_TLS) context.set_servername_callback(cb_sni) handler = self.start_https_server(context=context, certfile=CERT_localhost) context = ssl.create_default_context(cafile=CERT_localhost) diff --git a/Misc/NEWS.d/next/Tests/2017-09-19-20-48-50.bpo-31518.KwTMMz.rst b/Misc/NEWS.d/next/Tests/2017-09-19-20-48-50.bpo-31518.KwTMMz.rst new file mode 100644 index 00000000000000..7378df0747333d --- /dev/null +++ b/Misc/NEWS.d/next/Tests/2017-09-19-20-48-50.bpo-31518.KwTMMz.rst @@ -0,0 +1,3 @@ +Debian Unstable has disabled TLS 1.0 and 1.1 for SSLv23_METHOD(). Change +TLS/SSL protocol of some tests to PROTOCOL_TLS or PROTOCOL_TLSv1_2 to make +them pass on Debian.