Skip to content

Commit 3d81d93

Browse files
committed
Issue python#25940: Use self-signed.pythontest.net in SSL tests
This is instead of svn.python.org, whose certificate recently expired, and whose new certificate uses a different root certificate. The certificate used at the pythontest server was modifed to set the "basic constraints" CA flag. This flag seems to be required for test_get_ca_certs_ capath() to work (in Python 3.4+). Added the new self-signed certificate to capath with the following commands: cp Lib/test/{selfsigned_pythontestdotnet.pem,capath/} c_rehash -v Lib/test/capath/ c_rehash -v -old Lib/test/capath/ # Note the generated file names cp Lib/test/capath/{selfsigned_pythontestdotnet.pem,0e4015b9.0} mv Lib/test/capath/{selfsigned_pythontestdotnet.pem,ce7b8643.0} The new server responds with "No route to host" when connecting to port 444.
1 parent 89644d0 commit 3d81d93

File tree

6 files changed

+97
-96
lines changed

6 files changed

+97
-96
lines changed

Lib/test/capath/0e4015b9.0

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIClTCCAf6gAwIBAgIJAKGU95wKR8pTMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV
3+
BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
4+
IFNvZnR3YXJlIEZvdW5kYXRpb24xIzAhBgNVBAMMGnNlbGYtc2lnbmVkLnB5dGhv
5+
bnRlc3QubmV0MB4XDTE0MTEwMjE4MDkyOVoXDTI0MTAzMDE4MDkyOVowcDELMAkG
6+
A1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRo
7+
b24gU29mdHdhcmUgRm91bmRhdGlvbjEjMCEGA1UEAwwac2VsZi1zaWduZWQucHl0
8+
aG9udGVzdC5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANDXQXW9tjyZ
9+
Xt0Iv2tLL1+jinr4wGg36ioLDLFkMf+2Y1GL0v0BnKYG4N1OKlAU15LXGeGer8vm
10+
Sv/yIvmdrELvhAbbo3w4a9TMYQA4XkIVLdvu3mvNOAet+8PMJxn26dbDhG809ALv
11+
EHY57lQsBS3G59RZyBPVqAqmImWNJnVzAgMBAAGjNzA1MCUGA1UdEQQeMByCGnNl
12+
bGYtc2lnbmVkLnB5dGhvbnRlc3QubmV0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN
13+
AQEFBQADgYEAIuzAhgMouJpNdf3URCHIineyoSt6WK/9+eyUcjlKOrDoXNZaD72h
14+
TXMeKYoWvJyVcSLKL8ckPtDobgP2OTt0UkyAaj0n+ZHaqq1lH2yVfGUA1ILJv515
15+
C8BqbvVZuqm3i7ygmw3bqE/lYMgOrYtXXnqOrz6nvsE6Yc9V9rFflOM=
16+
-----END CERTIFICATE-----

Lib/test/capath/ce7b8643.0

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIClTCCAf6gAwIBAgIJAKGU95wKR8pTMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV
3+
BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
4+
IFNvZnR3YXJlIEZvdW5kYXRpb24xIzAhBgNVBAMMGnNlbGYtc2lnbmVkLnB5dGhv
5+
bnRlc3QubmV0MB4XDTE0MTEwMjE4MDkyOVoXDTI0MTAzMDE4MDkyOVowcDELMAkG
6+
A1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRo
7+
b24gU29mdHdhcmUgRm91bmRhdGlvbjEjMCEGA1UEAwwac2VsZi1zaWduZWQucHl0
8+
aG9udGVzdC5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANDXQXW9tjyZ
9+
Xt0Iv2tLL1+jinr4wGg36ioLDLFkMf+2Y1GL0v0BnKYG4N1OKlAU15LXGeGer8vm
10+
Sv/yIvmdrELvhAbbo3w4a9TMYQA4XkIVLdvu3mvNOAet+8PMJxn26dbDhG809ALv
11+
EHY57lQsBS3G59RZyBPVqAqmImWNJnVzAgMBAAGjNzA1MCUGA1UdEQQeMByCGnNl
12+
bGYtc2lnbmVkLnB5dGhvbnRlc3QubmV0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN
13+
AQEFBQADgYEAIuzAhgMouJpNdf3URCHIineyoSt6WK/9+eyUcjlKOrDoXNZaD72h
14+
TXMeKYoWvJyVcSLKL8ckPtDobgP2OTt0UkyAaj0n+ZHaqq1lH2yVfGUA1ILJv515
15+
C8BqbvVZuqm3i7ygmw3bqE/lYMgOrYtXXnqOrz6nvsE6Yc9V9rFflOM=
16+
-----END CERTIFICATE-----

Lib/test/https_svn_python_org_root.pem

Lines changed: 0 additions & 41 deletions
This file was deleted.
Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIChzCCAfCgAwIBAgIJAKGU95wKR8pSMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV
2+
MIIClTCCAf6gAwIBAgIJAKGU95wKR8pTMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV
33
BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
44
IFNvZnR3YXJlIEZvdW5kYXRpb24xIzAhBgNVBAMMGnNlbGYtc2lnbmVkLnB5dGhv
55
bnRlc3QubmV0MB4XDTE0MTEwMjE4MDkyOVoXDTI0MTAzMDE4MDkyOVowcDELMAkG
@@ -8,9 +8,9 @@ b24gU29mdHdhcmUgRm91bmRhdGlvbjEjMCEGA1UEAwwac2VsZi1zaWduZWQucHl0
88
aG9udGVzdC5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANDXQXW9tjyZ
99
Xt0Iv2tLL1+jinr4wGg36ioLDLFkMf+2Y1GL0v0BnKYG4N1OKlAU15LXGeGer8vm
1010
Sv/yIvmdrELvhAbbo3w4a9TMYQA4XkIVLdvu3mvNOAet+8PMJxn26dbDhG809ALv
11-
EHY57lQsBS3G59RZyBPVqAqmImWNJnVzAgMBAAGjKTAnMCUGA1UdEQQeMByCGnNl
12-
bGYtc2lnbmVkLnB5dGhvbnRlc3QubmV0MA0GCSqGSIb3DQEBBQUAA4GBAIOXmdtM
13-
eG9qzP9TiXW/Gc/zI4cBfdCpC+Y4gOfC9bQUC7hefix4iO3+iZjgy3X/FaRxUUoV
14-
HKiXcXIaWqTSUWp45cSh0MbwZXudp6JIAptzdAhvvCrPKeC9i9GvxsPD4LtDAL97
15-
vSaxQBezA7hdxZd90/EeyMgVZgAnTCnvAWX9
11+
EHY57lQsBS3G59RZyBPVqAqmImWNJnVzAgMBAAGjNzA1MCUGA1UdEQQeMByCGnNl
12+
bGYtc2lnbmVkLnB5dGhvbnRlc3QubmV0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN
13+
AQEFBQADgYEAIuzAhgMouJpNdf3URCHIineyoSt6WK/9+eyUcjlKOrDoXNZaD72h
14+
TXMeKYoWvJyVcSLKL8ckPtDobgP2OTt0UkyAaj0n+ZHaqq1lH2yVfGUA1ILJv515
15+
C8BqbvVZuqm3i7ygmw3bqE/lYMgOrYtXXnqOrz6nvsE6Yc9V9rFflOM=
1616
-----END CERTIFICATE-----

Lib/test/test_ssl.py

Lines changed: 52 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,8 @@
2929

3030
HOST = support.HOST
3131

32-
data_file = lambda name: os.path.join(os.path.dirname(__file__), name)
32+
def data_file(*name):
33+
return os.path.join(os.path.dirname(__file__), *name)
3334

3435
# The custom key and certificate files used in test_ssl are generated
3536
# using Lib/test/make_ssl_certs.py.
@@ -44,8 +45,10 @@
4445
BYTES_ONLYKEY = os.fsencode(ONLYKEY)
4546
CAPATH = data_file("capath")
4647
BYTES_CAPATH = os.fsencode(CAPATH)
48+
CAFILE_CACERT = data_file("capath", "5ed36f99.0")
4749

48-
SVN_PYTHON_ORG_ROOT_CERT = data_file("https_svn_python_org_root.pem")
50+
REMOTE_HOST = "self-signed.pythontest.net"
51+
REMOTE_ROOT_CERT = data_file("selfsigned_pythontestdotnet.pem")
4952

5053
EMPTYCERT = data_file("nullcert.pem")
5154
BADCERT = data_file("badcert.pem")
@@ -163,7 +166,7 @@ def test_parse_cert_CVE_2013_4073(self):
163166
)
164167

165168
def test_DER_to_PEM(self):
166-
with open(SVN_PYTHON_ORG_ROOT_CERT, 'r') as f:
169+
with open(CAFILE_CACERT, 'r') as f:
167170
pem = f.read()
168171
d1 = ssl.PEM_cert_to_DER_cert(pem)
169172
p2 = ssl.DER_cert_to_PEM_cert(d1)
@@ -462,7 +465,7 @@ def test_load_cert_chain(self):
462465
# Mismatching key and cert
463466
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
464467
with self.assertRaisesRegex(ssl.SSLError, "key values mismatch"):
465-
ctx.load_cert_chain(SVN_PYTHON_ORG_ROOT_CERT, ONLYKEY)
468+
ctx.load_cert_chain(CAFILE_CACERT, ONLYKEY)
466469

467470
def test_load_verify_locations(self):
468471
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
@@ -511,11 +514,11 @@ def test_set_default_verify_paths(self):
511514
class NetworkedTests(unittest.TestCase):
512515

513516
def test_connect(self):
514-
with support.transient_internet("svn.python.org"):
517+
with support.transient_internet(REMOTE_HOST):
515518
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
516519
cert_reqs=ssl.CERT_NONE)
517520
try:
518-
s.connect(("svn.python.org", 443))
521+
s.connect((REMOTE_HOST, 443))
519522
self.assertEqual({}, s.getpeercert())
520523
finally:
521524
s.close()
@@ -524,42 +527,42 @@ def test_connect(self):
524527
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
525528
cert_reqs=ssl.CERT_REQUIRED)
526529
self.assertRaisesRegex(ssl.SSLError, "certificate verify failed",
527-
s.connect, ("svn.python.org", 443))
530+
s.connect, (REMOTE_HOST, 443))
528531
s.close()
529532

530533
# this should succeed because we specify the root cert
531534
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
532535
cert_reqs=ssl.CERT_REQUIRED,
533-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
536+
ca_certs=REMOTE_ROOT_CERT)
534537
try:
535-
s.connect(("svn.python.org", 443))
538+
s.connect((REMOTE_HOST, 443))
536539
self.assertTrue(s.getpeercert())
537540
finally:
538541
s.close()
539542

540543
def test_connect_ex(self):
541544
# Issue #11326: check connect_ex() implementation
542-
with support.transient_internet("svn.python.org"):
545+
with support.transient_internet(REMOTE_HOST):
543546
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
544547
cert_reqs=ssl.CERT_REQUIRED,
545-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
548+
ca_certs=REMOTE_ROOT_CERT)
546549
try:
547-
self.assertEqual(0, s.connect_ex(("svn.python.org", 443)))
550+
self.assertEqual(0, s.connect_ex((REMOTE_HOST, 443)))
548551
self.assertTrue(s.getpeercert())
549552
finally:
550553
s.close()
551554

552555
def test_non_blocking_connect_ex(self):
553556
# Issue #11326: non-blocking connect_ex() should allow handshake
554557
# to proceed after the socket gets ready.
555-
with support.transient_internet("svn.python.org"):
558+
with support.transient_internet(REMOTE_HOST):
556559
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
557560
cert_reqs=ssl.CERT_REQUIRED,
558-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT,
561+
ca_certs=REMOTE_ROOT_CERT,
559562
do_handshake_on_connect=False)
560563
try:
561564
s.setblocking(False)
562-
rc = s.connect_ex(('svn.python.org', 443))
565+
rc = s.connect_ex((REMOTE_HOST, 443))
563566
# EWOULDBLOCK under Windows, EINPROGRESS elsewhere
564567
self.assertIn(rc, (0, errno.EINPROGRESS, errno.EWOULDBLOCK))
565568
# Wait for connect to finish
@@ -584,59 +587,59 @@ def test_non_blocking_connect_ex(self):
584587
def test_timeout_connect_ex(self):
585588
# Issue #12065: on a timeout, connect_ex() should return the original
586589
# errno (mimicking the behaviour of non-SSL sockets).
587-
with support.transient_internet("svn.python.org"):
590+
with support.transient_internet(REMOTE_HOST):
588591
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
589592
cert_reqs=ssl.CERT_REQUIRED,
590-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT,
593+
ca_certs=REMOTE_ROOT_CERT,
591594
do_handshake_on_connect=False)
592595
try:
593596
s.settimeout(0.0000001)
594-
rc = s.connect_ex(('svn.python.org', 443))
597+
rc = s.connect_ex((REMOTE_HOST, 443))
595598
if rc == 0:
596-
self.skipTest("svn.python.org responded too quickly")
599+
self.skipTest("REMOTE_HOST responded too quickly")
597600
self.assertIn(rc, (errno.EAGAIN, errno.EWOULDBLOCK))
598601
finally:
599602
s.close()
600603

601604
def test_connect_ex_error(self):
602-
with support.transient_internet("svn.python.org"):
605+
with support.transient_internet(REMOTE_HOST):
603606
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
604607
cert_reqs=ssl.CERT_REQUIRED,
605-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
608+
ca_certs=REMOTE_ROOT_CERT)
606609
try:
607-
self.assertEqual(errno.ECONNREFUSED,
608-
s.connect_ex(("svn.python.org", 444)))
610+
rc = s.connect_ex((REMOTE_HOST, 444))
611+
self.assertIn(rc, (errno.ECONNREFUSED, errno.EHOSTUNREACH))
609612
finally:
610613
s.close()
611614

612615
def test_connect_with_context(self):
613-
with support.transient_internet("svn.python.org"):
616+
with support.transient_internet(REMOTE_HOST):
614617
# Same as test_connect, but with a separately created context
615618
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
616619
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
617-
s.connect(("svn.python.org", 443))
620+
s.connect((REMOTE_HOST, 443))
618621
try:
619622
self.assertEqual({}, s.getpeercert())
620623
finally:
621624
s.close()
622625
# Same with a server hostname
623626
s = ctx.wrap_socket(socket.socket(socket.AF_INET),
624-
server_hostname="svn.python.org")
627+
server_hostname=REMOTE_HOST)
625628
if ssl.HAS_SNI:
626-
s.connect(("svn.python.org", 443))
629+
s.connect((REMOTE_HOST, 443))
627630
s.close()
628631
else:
629-
self.assertRaises(ValueError, s.connect, ("svn.python.org", 443))
632+
self.assertRaises(ValueError, s.connect, (REMOTE_HOST, 443))
630633
# This should fail because we have no verification certs
631634
ctx.verify_mode = ssl.CERT_REQUIRED
632635
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
633636
self.assertRaisesRegex(ssl.SSLError, "certificate verify failed",
634-
s.connect, ("svn.python.org", 443))
637+
s.connect, (REMOTE_HOST, 443))
635638
s.close()
636639
# This should succeed because we specify the root cert
637-
ctx.load_verify_locations(SVN_PYTHON_ORG_ROOT_CERT)
640+
ctx.load_verify_locations(REMOTE_ROOT_CERT)
638641
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
639-
s.connect(("svn.python.org", 443))
642+
s.connect((REMOTE_HOST, 443))
640643
try:
641644
cert = s.getpeercert()
642645
self.assertTrue(cert)
@@ -649,12 +652,12 @@ def test_connect_capath(self):
649652
# OpenSSL 0.9.8n and 1.0.0, as a result the capath directory must
650653
# contain both versions of each certificate (same content, different
651654
# filename) for this test to be portable across OpenSSL releases.
652-
with support.transient_internet("svn.python.org"):
655+
with support.transient_internet(REMOTE_HOST):
653656
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
654657
ctx.verify_mode = ssl.CERT_REQUIRED
655658
ctx.load_verify_locations(capath=CAPATH)
656659
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
657-
s.connect(("svn.python.org", 443))
660+
s.connect((REMOTE_HOST, 443))
658661
try:
659662
cert = s.getpeercert()
660663
self.assertTrue(cert)
@@ -665,7 +668,7 @@ def test_connect_capath(self):
665668
ctx.verify_mode = ssl.CERT_REQUIRED
666669
ctx.load_verify_locations(capath=BYTES_CAPATH)
667670
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
668-
s.connect(("svn.python.org", 443))
671+
s.connect((REMOTE_HOST, 443))
669672
try:
670673
cert = s.getpeercert()
671674
self.assertTrue(cert)
@@ -677,9 +680,9 @@ def test_makefile_close(self):
677680
# Issue #5238: creating a file-like object with makefile() shouldn't
678681
# delay closing the underlying "real socket" (here tested with its
679682
# file descriptor, hence skipping the test under Windows).
680-
with support.transient_internet("svn.python.org"):
683+
with support.transient_internet(REMOTE_HOST):
681684
ss = ssl.wrap_socket(socket.socket(socket.AF_INET))
682-
ss.connect(("svn.python.org", 443))
685+
ss.connect((REMOTE_HOST, 443))
683686
fd = ss.fileno()
684687
f = ss.makefile()
685688
f.close()
@@ -693,9 +696,9 @@ def test_makefile_close(self):
693696
self.assertEqual(e.exception.errno, errno.EBADF)
694697

695698
def test_non_blocking_handshake(self):
696-
with support.transient_internet("svn.python.org"):
699+
with support.transient_internet(REMOTE_HOST):
697700
s = socket.socket(socket.AF_INET)
698-
s.connect(("svn.python.org", 443))
701+
s.connect((REMOTE_HOST, 443))
699702
s.setblocking(False)
700703
s = ssl.wrap_socket(s,
701704
cert_reqs=ssl.CERT_NONE,
@@ -718,33 +721,33 @@ def test_non_blocking_handshake(self):
718721
sys.stdout.write("\nNeeded %d calls to do_handshake() to establish session.\n" % count)
719722

720723
def test_get_server_certificate(self):
721-
with support.transient_internet("svn.python.org"):
722-
pem = ssl.get_server_certificate(("svn.python.org", 443),
724+
with support.transient_internet(REMOTE_HOST):
725+
pem = ssl.get_server_certificate((REMOTE_HOST, 443),
723726
ssl.PROTOCOL_SSLv23)
724727
if not pem:
725-
self.fail("No server certificate on svn.python.org:443!")
728+
self.fail("No server certificate on REMOTE_HOST:443!")
726729

727730
try:
728-
pem = ssl.get_server_certificate(("svn.python.org", 443),
731+
pem = ssl.get_server_certificate((REMOTE_HOST, 443),
729732
ssl.PROTOCOL_SSLv23,
730733
ca_certs=CERTFILE)
731734
except ssl.SSLError as x:
732735
#should fail
733736
if support.verbose:
734737
sys.stdout.write("%s\n" % x)
735738
else:
736-
self.fail("Got server certificate %s for svn.python.org!" % pem)
739+
self.fail("Got server certificate %s for REMOTE_HOST!" % pem)
737740

738-
pem = ssl.get_server_certificate(("svn.python.org", 443),
741+
pem = ssl.get_server_certificate((REMOTE_HOST, 443),
739742
ssl.PROTOCOL_SSLv23,
740-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
743+
ca_certs=REMOTE_ROOT_CERT)
741744
if not pem:
742-
self.fail("No server certificate on svn.python.org:443!")
745+
self.fail("No server certificate on REMOTE_HOST:443!")
743746
if support.verbose:
744-
sys.stdout.write("\nVerified certificate for svn.python.org:443 is\n%s\n" % pem)
747+
sys.stdout.write("\nVerified certificate for REMOTE_HOST:443 is\n%s\n" % pem)
745748

746749
def test_ciphers(self):
747-
remote = ("svn.python.org", 443)
750+
remote = (REMOTE_HOST, 443)
748751
with support.transient_internet(remote[0]):
749752
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
750753
cert_reqs=ssl.CERT_NONE, ciphers="ALL")
@@ -1745,7 +1748,7 @@ def test_main(verbose=False):
17451748
print(" HAS_SNI = %r" % ssl.HAS_SNI)
17461749

17471750
for filename in [
1748-
CERTFILE, SVN_PYTHON_ORG_ROOT_CERT, BYTES_CERTFILE,
1751+
CERTFILE, REMOTE_ROOT_CERT, BYTES_CERTFILE,
17491752
ONLYCERT, ONLYKEY, BYTES_ONLYCERT, BYTES_ONLYKEY,
17501753
BADCERT, BADKEY, EMPTYCERT]:
17511754
if not os.path.exists(filename):

Misc/NEWS

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,13 @@ Library
2121

2222
- Issue #22931: Allow '[' and ']' in cookie values.
2323

24+
Tests
25+
-----
26+
27+
- Issue #25940: Changed test_ssl and test_httplib to use
28+
self-signed.pythontest.net. This avoids relying on svn.python.org, which
29+
recently changed root certificate.
30+
2431

2532
What's New in Python 3.2.6?
2633
===========================

0 commit comments

Comments
 (0)