Skip to content

tests: get SSL tests working on unix and bare-metal #13181

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 2 commits into from
Dec 12, 2023
Merged

tests: get SSL tests working on unix and bare-metal #13181

merged 2 commits into from
Dec 12, 2023

Conversation

dpgeorge
Copy link
Member

Two changes in this PR:

  • Make SSL getpeercert() optional, and only enable this method when the relevant feature is available in mbedtls.
  • Update tests to use SSLContext, and work on CPython.

@dpgeorge dpgeorge added the tests Relates to tests/ directory in source label Dec 12, 2023
@github-actions GitHub Actions
Copy link

Code size report:

   bare-arm:    +0 +0.000% 
minimal x86:    +0 +0.000% 
   unix x64:  -312 -0.039% standard[incl -32(data)]
      stm32:    +0 +0.000% PYBV10
     mimxrt:    +0 +0.000% TEENSY40
        rp2:    +0 +0.000% RPI_PICO
       samd:    +0 +0.000% ADAFRUIT_ITSYBITSY_M4_EXPRESS

@dpgeorge
extmod/modssl_mbedtls: Make SSLSocket.getpeercert() optional.
ef996d1 
And only enable this method when the relevant feature is available in
mbedtls.  Otherwise, if mbedtls doesn't support getting the peer
certificate, this method always returns None and it's confusing why it does
that.  It's better to remove the method altogether, so the error trying to
use it is more obvious.

Signed-off-by: Damien George <damien@micropython.org>
@dpgeorge
tests: Update SSL network tests to use SSLContext, and work on CPython.
bba8a67 
Changes are:
- use ssl.SSLContext.wrap_socket instead of ssl.wrap_socket
- disable check_hostname and call load_default_certs() where appropriate,
  to get CPython to run the tests correctly
- pass socket.AF_INET to getaddrinfo and socket.socket(), to force IPv4
- change tests to use github.com instead of google.com, because certificate
  validation was failing with google.com

Signed-off-by: Damien George <damien@micropython.org>
@dpgeorge dpgeorge force-pushed the extmod-mbedtls-optional-getpeercert branch from 8d11a80 to bba8a67 Compare December 12, 2023 10:23
@codecov Codecov
Copy link

codecov bot commented Dec 12, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (c9eb6bc) 98.39% compared to head (bba8a67) 98.39%.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master   #13181   +/-   ##
=======================================
  Coverage   98.39%   98.39%           
=======================================
  Files         159      159           
  Lines       21063    21056    -7     
=======================================
- Hits        20724    20719    -5     
+ Misses        339      337    -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@dpgeorge dpgeorge merged commit bba8a67 into micropython:master Dec 12, 2023
@dpgeorge dpgeorge deleted the extmod-mbedtls-optional-getpeercert branch December 12, 2023 12:57
@felixdoerre felixdoerre mentioned this pull request Dec 18, 2023
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
tests Relates to tests/ directory in source
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@dpgeorge