Skip to content

Commit aab2258

Browse files
tirantiran
authored
bpo-31518: Change TLS protocol for Debian (#3660)
Debian Unstable has disabled TLS 1.0 and 1.1 for SSLv23_METHOD(). Change TLS/SSL protocol of some tests to PROTOCOL_TLS or PROTOCOL_TLSv1_2 to make them pass on Debian. Signed-off-by: Christian Heimes <christian@python.org>
1 parent 980790e commit aab2258

6 files changed

Lines changed: 15 additions & 12 deletions

File tree

‎Lib/test/test_ftplib.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -908,11 +908,11 @@ def test_auth_ssl(self):
908908
self.client.auth()
909909
self.assertRaises(ValueError, self.client.auth)
910910
finally:
911-
self.client.ssl_version = ssl.PROTOCOL_TLSv1
911+
self.client.ssl_version = ssl.PROTOCOL_TLS
912912

913913
def test_context(self):
914914
self.client.quit()
915-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
915+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
916916
self.assertRaises(ValueError, ftplib.FTP_TLS, keyfile=CERTFILE,
917917
context=ctx)
918918
self.assertRaises(ValueError, ftplib.FTP_TLS, certfile=CERTFILE,
@@ -941,7 +941,7 @@ def test_ccc(self):
941941

942942
def test_check_hostname(self):
943943
self.client.quit()
944-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
944+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
945945
ctx.verify_mode = ssl.CERT_REQUIRED
946946
ctx.check_hostname = True
947947
ctx.load_verify_locations(CAFILE)

‎Lib/test/test_httplib.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1583,7 +1583,7 @@ def test_networked_good_cert(self):
15831583
import ssl
15841584
support.requires('network')
15851585
with support.transient_internet('self-signed.pythontest.net'):
1586-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1586+
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
15871587
context.verify_mode = ssl.CERT_REQUIRED
15881588
context.load_verify_locations(CERT_selfsigned_pythontestdotnet)
15891589
h = client.HTTPSConnection('self-signed.pythontest.net', 443, context=context)
@@ -1599,7 +1599,7 @@ def test_networked_bad_cert(self):
15991599
import ssl
16001600
support.requires('network')
16011601
with support.transient_internet('self-signed.pythontest.net'):
1602-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1602+
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
16031603
context.verify_mode = ssl.CERT_REQUIRED
16041604
context.load_verify_locations(CERT_localhost)
16051605
h = client.HTTPSConnection('self-signed.pythontest.net', 443, context=context)
@@ -1620,7 +1620,7 @@ def test_local_good_hostname(self):
16201620
# The (valid) cert validates the HTTP hostname
16211621
import ssl
16221622
server = self.make_server(CERT_localhost)
1623-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1623+
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
16241624
context.verify_mode = ssl.CERT_REQUIRED
16251625
context.load_verify_locations(CERT_localhost)
16261626
h = client.HTTPSConnection('localhost', server.port, context=context)
@@ -1634,7 +1634,7 @@ def test_local_bad_hostname(self):
16341634
# The (valid) cert doesn't validate the HTTP hostname
16351635
import ssl
16361636
server = self.make_server(CERT_fakehostname)
1637-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1637+
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
16381638
context.verify_mode = ssl.CERT_REQUIRED
16391639
context.check_hostname = True
16401640
context.load_verify_locations(CERT_fakehostname)

‎Lib/test/test_poplib.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -352,7 +352,7 @@ def test_stls(self):
352352
@requires_ssl
353353
def test_stls_context(self):
354354
expected = b'+OK Begin TLS negotiation'
355-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
355+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
356356
ctx.load_verify_locations(CAFILE)
357357
ctx.verify_mode = ssl.CERT_REQUIRED
358358
ctx.check_hostname = True
@@ -392,7 +392,7 @@ def test__all__(self):
392392
self.assertIn('POP3_SSL', poplib.__all__)
393393

394394
def test_context(self):
395-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
395+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS)
396396
self.assertRaises(ValueError, poplib.POP3_SSL, self.server.host,
397397
self.server.port, keyfile=CERTFILE, context=ctx)
398398
self.assertRaises(ValueError, poplib.POP3_SSL, self.server.host,

‎Lib/test/test_ssl.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1689,7 +1689,7 @@ def test_get_ca_certs_capath(self):
16891689
@needs_sni
16901690
def test_context_setget(self):
16911691
# Check that the context of a connected socket can be replaced.
1692-
ctx1 = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1692+
ctx1 = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
16931693
ctx2 = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
16941694
s = socket.socket(socket.AF_INET)
16951695
with ctx1.wrap_socket(s) as ss:
@@ -1986,7 +1986,7 @@ def __init__(self, certificate=None, ssl_version=None,
19861986
else:
19871987
self.context = ssl.SSLContext(ssl_version
19881988
if ssl_version is not None
1989-
else ssl.PROTOCOL_TLSv1)
1989+
else ssl.PROTOCOL_TLS)
19901990
self.context.verify_mode = (certreqs if certreqs is not None
19911991
else ssl.CERT_NONE)
19921992
if cacerts:

‎Lib/test/test_urllib2_localnet.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -598,7 +598,7 @@ def test_https_sni(self):
598598
def cb_sni(ssl_sock, server_name, initial_context):
599599
nonlocal sni_name
600600
sni_name = server_name
601-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
601+
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
602602
context.set_servername_callback(cb_sni)
603603
handler = self.start_https_server(context=context, certfile=CERT_localhost)
604604
context = ssl.create_default_context(cafile=CERT_localhost)

‎Misc/NEWS.d/next/Tests/2017-09-19-20-48-50.bpo-31518.KwTMMz.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Debian Unstable has disabled TLS 1.0 and 1.1 for SSLv23_METHOD(). Change
2+
TLS/SSL protocol of some tests to PROTOCOL_TLS or PROTOCOL_TLSv1_2 to make
3+
them pass on Debian.

0 commit comments

Comments
 (0)