29
29
30
30
HOST = support .HOST
31
31
32
- data_file = lambda name : os .path .join (os .path .dirname (__file__ ), name )
32
+ def data_file (* name ):
33
+ return os .path .join (os .path .dirname (__file__ ), * name )
33
34
34
35
# The custom key and certificate files used in test_ssl are generated
35
36
# using Lib/test/make_ssl_certs.py.
44
45
BYTES_ONLYKEY = os .fsencode (ONLYKEY )
45
46
CAPATH = data_file ("capath" )
46
47
BYTES_CAPATH = os .fsencode (CAPATH )
48
+ CAFILE_CACERT = data_file ("capath" , "5ed36f99.0" )
47
49
48
- SVN_PYTHON_ORG_ROOT_CERT = data_file ("https_svn_python_org_root.pem" )
50
+ REMOTE_HOST = "self-signed.pythontest.net"
51
+ REMOTE_ROOT_CERT = data_file ("selfsigned_pythontestdotnet.pem" )
49
52
50
53
EMPTYCERT = data_file ("nullcert.pem" )
51
54
BADCERT = data_file ("badcert.pem" )
@@ -163,7 +166,7 @@ def test_parse_cert_CVE_2013_4073(self):
163
166
)
164
167
165
168
def test_DER_to_PEM (self ):
166
- with open (SVN_PYTHON_ORG_ROOT_CERT , 'r' ) as f :
169
+ with open (CAFILE_CACERT , 'r' ) as f :
167
170
pem = f .read ()
168
171
d1 = ssl .PEM_cert_to_DER_cert (pem )
169
172
p2 = ssl .DER_cert_to_PEM_cert (d1 )
@@ -462,7 +465,7 @@ def test_load_cert_chain(self):
462
465
# Mismatching key and cert
463
466
ctx = ssl .SSLContext (ssl .PROTOCOL_TLSv1 )
464
467
with self .assertRaisesRegex (ssl .SSLError , "key values mismatch" ):
465
- ctx .load_cert_chain (SVN_PYTHON_ORG_ROOT_CERT , ONLYKEY )
468
+ ctx .load_cert_chain (CAFILE_CACERT , ONLYKEY )
466
469
467
470
def test_load_verify_locations (self ):
468
471
ctx = ssl .SSLContext (ssl .PROTOCOL_TLSv1 )
@@ -511,11 +514,11 @@ def test_set_default_verify_paths(self):
511
514
class NetworkedTests (unittest .TestCase ):
512
515
513
516
def test_connect (self ):
514
- with support .transient_internet ("svn.python.org" ):
517
+ with support .transient_internet (REMOTE_HOST ):
515
518
s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
516
519
cert_reqs = ssl .CERT_NONE )
517
520
try :
518
- s .connect (("svn.python.org" , 443 ))
521
+ s .connect ((REMOTE_HOST , 443 ))
519
522
self .assertEqual ({}, s .getpeercert ())
520
523
finally :
521
524
s .close ()
@@ -524,42 +527,42 @@ def test_connect(self):
524
527
s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
525
528
cert_reqs = ssl .CERT_REQUIRED )
526
529
self .assertRaisesRegex (ssl .SSLError , "certificate verify failed" ,
527
- s .connect , ("svn.python.org" , 443 ))
530
+ s .connect , (REMOTE_HOST , 443 ))
528
531
s .close ()
529
532
530
533
# this should succeed because we specify the root cert
531
534
s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
532
535
cert_reqs = ssl .CERT_REQUIRED ,
533
- ca_certs = SVN_PYTHON_ORG_ROOT_CERT )
536
+ ca_certs = REMOTE_ROOT_CERT )
534
537
try :
535
- s .connect (("svn.python.org" , 443 ))
538
+ s .connect ((REMOTE_HOST , 443 ))
536
539
self .assertTrue (s .getpeercert ())
537
540
finally :
538
541
s .close ()
539
542
540
543
def test_connect_ex (self ):
541
544
# Issue #11326: check connect_ex() implementation
542
- with support .transient_internet ("svn.python.org" ):
545
+ with support .transient_internet (REMOTE_HOST ):
543
546
s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
544
547
cert_reqs = ssl .CERT_REQUIRED ,
545
- ca_certs = SVN_PYTHON_ORG_ROOT_CERT )
548
+ ca_certs = REMOTE_ROOT_CERT )
546
549
try :
547
- self .assertEqual (0 , s .connect_ex (("svn.python.org" , 443 )))
550
+ self .assertEqual (0 , s .connect_ex ((REMOTE_HOST , 443 )))
548
551
self .assertTrue (s .getpeercert ())
549
552
finally :
550
553
s .close ()
551
554
552
555
def test_non_blocking_connect_ex (self ):
553
556
# Issue #11326: non-blocking connect_ex() should allow handshake
554
557
# to proceed after the socket gets ready.
555
- with support .transient_internet ("svn.python.org" ):
558
+ with support .transient_internet (REMOTE_HOST ):
556
559
s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
557
560
cert_reqs = ssl .CERT_REQUIRED ,
558
- ca_certs = SVN_PYTHON_ORG_ROOT_CERT ,
561
+ ca_certs = REMOTE_ROOT_CERT ,
559
562
do_handshake_on_connect = False )
560
563
try :
561
564
s .setblocking (False )
562
- rc = s .connect_ex (('svn.python.org' , 443 ))
565
+ rc = s .connect_ex ((REMOTE_HOST , 443 ))
563
566
# EWOULDBLOCK under Windows, EINPROGRESS elsewhere
564
567
self .assertIn (rc , (0 , errno .EINPROGRESS , errno .EWOULDBLOCK ))
565
568
# Wait for connect to finish
@@ -584,59 +587,59 @@ def test_non_blocking_connect_ex(self):
584
587
def test_timeout_connect_ex (self ):
585
588
# Issue #12065: on a timeout, connect_ex() should return the original
586
589
# errno (mimicking the behaviour of non-SSL sockets).
587
- with support .transient_internet ("svn.python.org" ):
590
+ with support .transient_internet (REMOTE_HOST ):
588
591
s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
589
592
cert_reqs = ssl .CERT_REQUIRED ,
590
- ca_certs = SVN_PYTHON_ORG_ROOT_CERT ,
593
+ ca_certs = REMOTE_ROOT_CERT ,
591
594
do_handshake_on_connect = False )
592
595
try :
593
596
s .settimeout (0.0000001 )
594
- rc = s .connect_ex (('svn.python.org' , 443 ))
597
+ rc = s .connect_ex ((REMOTE_HOST , 443 ))
595
598
if rc == 0 :
596
- self .skipTest ("svn.python.org responded too quickly" )
599
+ self .skipTest ("REMOTE_HOST responded too quickly" )
597
600
self .assertIn (rc , (errno .EAGAIN , errno .EWOULDBLOCK ))
598
601
finally :
599
602
s .close ()
600
603
601
604
def test_connect_ex_error (self ):
602
- with support .transient_internet ("svn.python.org" ):
605
+ with support .transient_internet (REMOTE_HOST ):
603
606
s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
604
607
cert_reqs = ssl .CERT_REQUIRED ,
605
- ca_certs = SVN_PYTHON_ORG_ROOT_CERT )
608
+ ca_certs = REMOTE_ROOT_CERT )
606
609
try :
607
- self . assertEqual ( errno . ECONNREFUSED ,
608
- s . connect_ex (( "svn.python.org" , 444 ) ))
610
+ rc = s . connect_ex (( REMOTE_HOST , 444 ))
611
+ self . assertIn ( rc , ( errno . ECONNREFUSED , errno . EHOSTUNREACH ))
609
612
finally :
610
613
s .close ()
611
614
612
615
def test_connect_with_context (self ):
613
- with support .transient_internet ("svn.python.org" ):
616
+ with support .transient_internet (REMOTE_HOST ):
614
617
# Same as test_connect, but with a separately created context
615
618
ctx = ssl .SSLContext (ssl .PROTOCOL_SSLv23 )
616
619
s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
617
- s .connect (("svn.python.org" , 443 ))
620
+ s .connect ((REMOTE_HOST , 443 ))
618
621
try :
619
622
self .assertEqual ({}, s .getpeercert ())
620
623
finally :
621
624
s .close ()
622
625
# Same with a server hostname
623
626
s = ctx .wrap_socket (socket .socket (socket .AF_INET ),
624
- server_hostname = "svn.python.org" )
627
+ server_hostname = REMOTE_HOST )
625
628
if ssl .HAS_SNI :
626
- s .connect (("svn.python.org" , 443 ))
629
+ s .connect ((REMOTE_HOST , 443 ))
627
630
s .close ()
628
631
else :
629
- self .assertRaises (ValueError , s .connect , ("svn.python.org" , 443 ))
632
+ self .assertRaises (ValueError , s .connect , (REMOTE_HOST , 443 ))
630
633
# This should fail because we have no verification certs
631
634
ctx .verify_mode = ssl .CERT_REQUIRED
632
635
s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
633
636
self .assertRaisesRegex (ssl .SSLError , "certificate verify failed" ,
634
- s .connect , ("svn.python.org" , 443 ))
637
+ s .connect , (REMOTE_HOST , 443 ))
635
638
s .close ()
636
639
# This should succeed because we specify the root cert
637
- ctx .load_verify_locations (SVN_PYTHON_ORG_ROOT_CERT )
640
+ ctx .load_verify_locations (REMOTE_ROOT_CERT )
638
641
s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
639
- s .connect (("svn.python.org" , 443 ))
642
+ s .connect ((REMOTE_HOST , 443 ))
640
643
try :
641
644
cert = s .getpeercert ()
642
645
self .assertTrue (cert )
@@ -649,12 +652,12 @@ def test_connect_capath(self):
649
652
# OpenSSL 0.9.8n and 1.0.0, as a result the capath directory must
650
653
# contain both versions of each certificate (same content, different
651
654
# filename) for this test to be portable across OpenSSL releases.
652
- with support .transient_internet ("svn.python.org" ):
655
+ with support .transient_internet (REMOTE_HOST ):
653
656
ctx = ssl .SSLContext (ssl .PROTOCOL_SSLv23 )
654
657
ctx .verify_mode = ssl .CERT_REQUIRED
655
658
ctx .load_verify_locations (capath = CAPATH )
656
659
s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
657
- s .connect (("svn.python.org" , 443 ))
660
+ s .connect ((REMOTE_HOST , 443 ))
658
661
try :
659
662
cert = s .getpeercert ()
660
663
self .assertTrue (cert )
@@ -665,7 +668,7 @@ def test_connect_capath(self):
665
668
ctx .verify_mode = ssl .CERT_REQUIRED
666
669
ctx .load_verify_locations (capath = BYTES_CAPATH )
667
670
s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
668
- s .connect (("svn.python.org" , 443 ))
671
+ s .connect ((REMOTE_HOST , 443 ))
669
672
try :
670
673
cert = s .getpeercert ()
671
674
self .assertTrue (cert )
@@ -677,9 +680,9 @@ def test_makefile_close(self):
677
680
# Issue #5238: creating a file-like object with makefile() shouldn't
678
681
# delay closing the underlying "real socket" (here tested with its
679
682
# file descriptor, hence skipping the test under Windows).
680
- with support .transient_internet ("svn.python.org" ):
683
+ with support .transient_internet (REMOTE_HOST ):
681
684
ss = ssl .wrap_socket (socket .socket (socket .AF_INET ))
682
- ss .connect (("svn.python.org" , 443 ))
685
+ ss .connect ((REMOTE_HOST , 443 ))
683
686
fd = ss .fileno ()
684
687
f = ss .makefile ()
685
688
f .close ()
@@ -693,9 +696,9 @@ def test_makefile_close(self):
693
696
self .assertEqual (e .exception .errno , errno .EBADF )
694
697
695
698
def test_non_blocking_handshake (self ):
696
- with support .transient_internet ("svn.python.org" ):
699
+ with support .transient_internet (REMOTE_HOST ):
697
700
s = socket .socket (socket .AF_INET )
698
- s .connect (("svn.python.org" , 443 ))
701
+ s .connect ((REMOTE_HOST , 443 ))
699
702
s .setblocking (False )
700
703
s = ssl .wrap_socket (s ,
701
704
cert_reqs = ssl .CERT_NONE ,
@@ -718,33 +721,33 @@ def test_non_blocking_handshake(self):
718
721
sys .stdout .write ("\n Needed %d calls to do_handshake() to establish session.\n " % count )
719
722
720
723
def test_get_server_certificate (self ):
721
- with support .transient_internet ("svn.python.org" ):
722
- pem = ssl .get_server_certificate (("svn.python.org" , 443 ),
724
+ with support .transient_internet (REMOTE_HOST ):
725
+ pem = ssl .get_server_certificate ((REMOTE_HOST , 443 ),
723
726
ssl .PROTOCOL_SSLv23 )
724
727
if not pem :
725
- self .fail ("No server certificate on svn.python.org :443!" )
728
+ self .fail ("No server certificate on REMOTE_HOST :443!" )
726
729
727
730
try :
728
- pem = ssl .get_server_certificate (("svn.python.org" , 443 ),
731
+ pem = ssl .get_server_certificate ((REMOTE_HOST , 443 ),
729
732
ssl .PROTOCOL_SSLv23 ,
730
733
ca_certs = CERTFILE )
731
734
except ssl .SSLError as x :
732
735
#should fail
733
736
if support .verbose :
734
737
sys .stdout .write ("%s\n " % x )
735
738
else :
736
- self .fail ("Got server certificate %s for svn.python.org !" % pem )
739
+ self .fail ("Got server certificate %s for REMOTE_HOST !" % pem )
737
740
738
- pem = ssl .get_server_certificate (("svn.python.org" , 443 ),
741
+ pem = ssl .get_server_certificate ((REMOTE_HOST , 443 ),
739
742
ssl .PROTOCOL_SSLv23 ,
740
- ca_certs = SVN_PYTHON_ORG_ROOT_CERT )
743
+ ca_certs = REMOTE_ROOT_CERT )
741
744
if not pem :
742
- self .fail ("No server certificate on svn.python.org :443!" )
745
+ self .fail ("No server certificate on REMOTE_HOST :443!" )
743
746
if support .verbose :
744
- sys .stdout .write ("\n Verified certificate for svn.python.org :443 is\n %s\n " % pem )
747
+ sys .stdout .write ("\n Verified certificate for REMOTE_HOST :443 is\n %s\n " % pem )
745
748
746
749
def test_ciphers (self ):
747
- remote = ("svn.python.org" , 443 )
750
+ remote = (REMOTE_HOST , 443 )
748
751
with support .transient_internet (remote [0 ]):
749
752
s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
750
753
cert_reqs = ssl .CERT_NONE , ciphers = "ALL" )
@@ -1745,7 +1748,7 @@ def test_main(verbose=False):
1745
1748
print (" HAS_SNI = %r" % ssl .HAS_SNI )
1746
1749
1747
1750
for filename in [
1748
- CERTFILE , SVN_PYTHON_ORG_ROOT_CERT , BYTES_CERTFILE ,
1751
+ CERTFILE , REMOTE_ROOT_CERT , BYTES_CERTFILE ,
1749
1752
ONLYCERT , ONLYKEY , BYTES_ONLYCERT , BYTES_ONLYKEY ,
1750
1753
BADCERT , BADKEY , EMPTYCERT ]:
1751
1754
if not os .path .exists (filename ):
0 commit comments