Skip to content

Cover the password prompt case for SSLContext.load_cert_chain with a test #132102

Closed as not planned
Closed as not planned
Cover the password prompt case for SSLContext.load_cert_chain with a test#132102
Labels
pendingThe issue will be closed if no feedback is providedtestsTests in the Lib/test dirtopic-SSL

Description

@donbarbos
donbarbos
opened on Apr 4, 2025

@picnixz found a case that is not covered by the tests: when we specify a cert and a password-protected file, but no password. This behavior can be reproduced in the following way (password is somepass):

>>> import ssl
>>> context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
>>> context.load_cert_chain(certfile="./Lib/test/certdata/keycert.passwd.pem")
Enter PEM pass phrase:

Documentation says that in this case the password should be requested interactively

If the password argument is not specified and a password is required, OpenSSL’s built-in password prompting mechanism will be used to interactively prompt the user for a password.

We have great tests (./Lib/test/test_ssl) for the ssl module but unfortunately this case has no tests, so I suggest to add it

Activity

  1. picnixz
    added
    testsTests in the Lib/test dir
    topic-SSL
    on Apr 4, 2025

  2. picnixz commented on Apr 5, 2025

    @picnixz
    picnixz
    on Apr 5, 2025
    Member

    Considering #129607 (comment), I'll forward my reply (#129607 (comment)):

    [...] if you think it's fine not to cover this, I'm also fine (we test everything but the interactive prompt; but I guess that the interactive prompt is actually populating the context so we don't need to do anything on our side).

    So maybe this is not needed. Sorry for making you create this issue.

  3. picnixz
    added
    pendingThe issue will be closed if no feedback is provided
    on Apr 5, 2025

  4. picnixz commented on Jun 7, 2025

    @picnixz
    picnixz
    on Jun 7, 2025
    Member

    Considering the discussion I linked above, we can do the following:

    • either we check that the interaction is correct (namely that we don't hang and correctly handle the output)
    • or we don't test it. If you don't have time for that, we can ignore the test (if someone complains about it, then we'll fix it as well).

  5. donbarbos commented on Jun 29, 2025

    @donbarbos
    donbarbos
    on Jun 29, 2025
    ContributorAuthor

    I tried writing tests, but honestly I don't know how to catch this output (something like with contextlib.redirect_std* doesn't help), since it is done using OpenSSL's default password callback SSL_CTX_set_default_passwd_cb

    I don't mind if you decide to close the issue but maybe someone knows how to catch in such cases

  6. picnixz commented on Jun 29, 2025

    @picnixz
    picnixz
    on Jun 29, 2025
    Member

    Ah I see. Ok, let's forget it.

  7. picnixz
    closed this as not plannedon Jun 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    pendingThe issue will be closed if no feedback is providedtestsTests in the Lib/test dirtopic-SSL

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions