Skip to content

Commit 82cd595

Browse files
youknowoneyouknowone
authored
ssl: unify handshake, transport and shutdown state (#8656)
* ssl: accept ClientHello before selecting the SNI context Replace the provisional server connection and replay flags with explicit handshake states. Retain fatal alerts across nonblocking retries and preserve fragmented input on timeout. Enable the three SNI alert regressions. Assisted-by: Codex:GPT-5 * ssl: share socket and MemoryBIO transport progress Queue drained TLS records before fallible output and use one handshake record loop for both transports. Assisted-by: Codex:GPT-5 * ssl: unify shutdown and fatal alert lifecycle Track close-notify progress in TlsState, preserve pending alerts across retries, and share record-boundary shutdown for sockets and MemoryBIO. Retain rustls errors until Python exception conversion. Assisted-by: Codex:GPT-5 * ssl: emit the full peer certificate dict Use the same certificate dict helper for getpeercert() and Certificate.get_info() so OCSP, caIssuers, and CRL URLs are present. Clear CHANNEL_BINDING_TYPES on the rustls backend, and add a MemoryBIO leftover-plaintext snippet. Assisted-by: Claude
1 parent 55cebcd commit 82cd595

8 files changed

Lines changed: 701 additions & 1463 deletions

File tree

‎Lib/ssl.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -268,6 +268,9 @@ class _TLSMessageType:
268268
socket_error = OSError # keep that public name in module namespace
269269

270270
CHANNEL_BINDING_TYPES = ['tls-unique']
271+
# TODO: RUSTPYTHON; rustls does not expose TLS Finished messages
272+
if "rustls" in OPENSSL_VERSION:
273+
CHANNEL_BINDING_TYPES = []
271274

272275
HAS_NEVER_CHECK_COMMON_NAME = hasattr(_ssl, 'HOSTFLAG_NEVER_CHECK_SUBJECT')
273276

‎Lib/test/test_asyncio/test_events.py‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1289,7 +1289,6 @@ def test_create_unix_server_ssl_verified(self):
12891289
server.close()
12901290
self.loop.run_until_complete(proto.done)
12911291

1292-
@unittest.expectedFailure # TODO: RUSTPYTHON; - SSL peer certificate format differs
12931292
@unittest.skipIf(ssl is None, 'No ssl module')
12941293
def test_create_server_ssl_verified(self):
12951294
proto = MyProto(loop=self.loop)

‎Lib/test/test_ssl.py‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4192,7 +4192,6 @@ def test_default_ecdh_curve(self):
41924192
s.connect((HOST, server.port))
41934193
self.assertIn("ECDH", s.cipher()[0])
41944194

4195-
@unittest.expectedFailure # TODO: RUSTPYTHON
41964195
@unittest.skipUnless("tls-unique" in ssl.CHANNEL_BINDING_TYPES,
41974196
"'tls-unique' channel binding not available")
41984197
def test_tls_unique_channel_binding(self):
@@ -4455,7 +4454,6 @@ def servername_cb(ssl_sock, server_name, initial_context):
44554454
self.check_common_name(stats, SIGNED_CERTFILE_HOSTNAME)
44564455
self.assertEqual(calls, [])
44574456

4458-
@unittest.expectedFailure # TODO: RUSTPYTHON; + TLSV1_ALERT_ACCESS_DENIED
44594457
def test_sni_callback_alert(self):
44604458
# Returning a TLS alert is reflected to the connecting client
44614459
server_context, other_context, client_context = self.sni_contexts()
@@ -4469,7 +4467,6 @@ def cb_returning_alert(ssl_sock, server_name, initial_context):
44694467
sni_name='supermessage')
44704468
self.assertEqual(cm.exception.reason, 'TLSV1_ALERT_ACCESS_DENIED')
44714469

4472-
@unittest.expectedFailure # TODO: RUSTPYTHON
44734470
def test_sni_callback_raising(self):
44744471
# Raising fails the connection with a TLS handshake failure alert.
44754472
server_context, other_context, client_context = self.sni_contexts()
@@ -4489,7 +4486,6 @@ def cb_raising(ssl_sock, server_name, initial_context):
44894486
self.assertRegex(cm.exception.reason, regex)
44904487
self.assertEqual(catch.unraisable.exc_type, ZeroDivisionError)
44914488

4492-
@unittest.expectedFailure # TODO: RUSTPYTHON; AttributeError: 'SSLEOFError' object has no attribute 'reason'
44934489
def test_sni_callback_wrong_return_type(self):
44944490
# Returning the wrong return type terminates the TLS connection
44954491
# with an internal error alert.

0 commit comments

Comments
 (0)