Skip to content

Commit 73f5507

Browse files
author
Martin Panter
committed
Issue python#25940: Merge self-signed.pythontest.net testing from 3.2 into 3.3
2 parents 0e617e2 + 3d81d93 commit 73f5507

File tree

7 files changed

+111
-89
lines changed

7 files changed

+111
-89
lines changed

‎Lib/test/capath/0e4015b9.0

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIClTCCAf6gAwIBAgIJAKGU95wKR8pTMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV
3+
BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
4+
IFNvZnR3YXJlIEZvdW5kYXRpb24xIzAhBgNVBAMMGnNlbGYtc2lnbmVkLnB5dGhv
5+
bnRlc3QubmV0MB4XDTE0MTEwMjE4MDkyOVoXDTI0MTAzMDE4MDkyOVowcDELMAkG
6+
A1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRo
7+
b24gU29mdHdhcmUgRm91bmRhdGlvbjEjMCEGA1UEAwwac2VsZi1zaWduZWQucHl0
8+
aG9udGVzdC5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANDXQXW9tjyZ
9+
Xt0Iv2tLL1+jinr4wGg36ioLDLFkMf+2Y1GL0v0BnKYG4N1OKlAU15LXGeGer8vm
10+
Sv/yIvmdrELvhAbbo3w4a9TMYQA4XkIVLdvu3mvNOAet+8PMJxn26dbDhG809ALv
11+
EHY57lQsBS3G59RZyBPVqAqmImWNJnVzAgMBAAGjNzA1MCUGA1UdEQQeMByCGnNl
12+
bGYtc2lnbmVkLnB5dGhvbnRlc3QubmV0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN
13+
AQEFBQADgYEAIuzAhgMouJpNdf3URCHIineyoSt6WK/9+eyUcjlKOrDoXNZaD72h
14+
TXMeKYoWvJyVcSLKL8ckPtDobgP2OTt0UkyAaj0n+ZHaqq1lH2yVfGUA1ILJv515
15+
C8BqbvVZuqm3i7ygmw3bqE/lYMgOrYtXXnqOrz6nvsE6Yc9V9rFflOM=
16+
-----END CERTIFICATE-----

‎Lib/test/capath/ce7b8643.0

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIClTCCAf6gAwIBAgIJAKGU95wKR8pTMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV
3+
BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
4+
IFNvZnR3YXJlIEZvdW5kYXRpb24xIzAhBgNVBAMMGnNlbGYtc2lnbmVkLnB5dGhv
5+
bnRlc3QubmV0MB4XDTE0MTEwMjE4MDkyOVoXDTI0MTAzMDE4MDkyOVowcDELMAkG
6+
A1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRo
7+
b24gU29mdHdhcmUgRm91bmRhdGlvbjEjMCEGA1UEAwwac2VsZi1zaWduZWQucHl0
8+
aG9udGVzdC5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANDXQXW9tjyZ
9+
Xt0Iv2tLL1+jinr4wGg36ioLDLFkMf+2Y1GL0v0BnKYG4N1OKlAU15LXGeGer8vm
10+
Sv/yIvmdrELvhAbbo3w4a9TMYQA4XkIVLdvu3mvNOAet+8PMJxn26dbDhG809ALv
11+
EHY57lQsBS3G59RZyBPVqAqmImWNJnVzAgMBAAGjNzA1MCUGA1UdEQQeMByCGnNl
12+
bGYtc2lnbmVkLnB5dGhvbnRlc3QubmV0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN
13+
AQEFBQADgYEAIuzAhgMouJpNdf3URCHIineyoSt6WK/9+eyUcjlKOrDoXNZaD72h
14+
TXMeKYoWvJyVcSLKL8ckPtDobgP2OTt0UkyAaj0n+ZHaqq1lH2yVfGUA1ILJv515
15+
C8BqbvVZuqm3i7ygmw3bqE/lYMgOrYtXXnqOrz6nvsE6Yc9V9rFflOM=
16+
-----END CERTIFICATE-----

‎Lib/test/https_svn_python_org_root.pem

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎Lib/test/selfsigned_pythontestdotnet.pem

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIClTCCAf6gAwIBAgIJAKGU95wKR8pTMA0GCSqGSIb3DQEBBQUAMHAxCzAJBgNV
3+
BAYTAlhZMRcwFQYDVQQHDA5DYXN0bGUgQW50aHJheDEjMCEGA1UECgwaUHl0aG9u
4+
IFNvZnR3YXJlIEZvdW5kYXRpb24xIzAhBgNVBAMMGnNlbGYtc2lnbmVkLnB5dGhv
5+
bnRlc3QubmV0MB4XDTE0MTEwMjE4MDkyOVoXDTI0MTAzMDE4MDkyOVowcDELMAkG
6+
A1UEBhMCWFkxFzAVBgNVBAcMDkNhc3RsZSBBbnRocmF4MSMwIQYDVQQKDBpQeXRo
7+
b24gU29mdHdhcmUgRm91bmRhdGlvbjEjMCEGA1UEAwwac2VsZi1zaWduZWQucHl0
8+
aG9udGVzdC5uZXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBANDXQXW9tjyZ
9+
Xt0Iv2tLL1+jinr4wGg36ioLDLFkMf+2Y1GL0v0BnKYG4N1OKlAU15LXGeGer8vm
10+
Sv/yIvmdrELvhAbbo3w4a9TMYQA4XkIVLdvu3mvNOAet+8PMJxn26dbDhG809ALv
11+
EHY57lQsBS3G59RZyBPVqAqmImWNJnVzAgMBAAGjNzA1MCUGA1UdEQQeMByCGnNl
12+
bGYtc2lnbmVkLnB5dGhvbnRlc3QubmV0MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN
13+
AQEFBQADgYEAIuzAhgMouJpNdf3URCHIineyoSt6WK/9+eyUcjlKOrDoXNZaD72h
14+
TXMeKYoWvJyVcSLKL8ckPtDobgP2OTt0UkyAaj0n+ZHaqq1lH2yVfGUA1ILJv515
15+
C8BqbvVZuqm3i7ygmw3bqE/lYMgOrYtXXnqOrz6nvsE6Yc9V9rFflOM=
16+
-----END CERTIFICATE-----

‎Lib/test/test_httplib.py

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@
1515
CERT_localhost = os.path.join(here, 'keycert.pem')
1616
# Self-signed cert file for 'fakehostname'
1717
CERT_fakehostname = os.path.join(here, 'keycert2.pem')
18-
# Root cert file (CA) for svn.python.org's cert
19-
CACERT_svn_python_org = os.path.join(here, 'https_svn_python_org_root.pem')
18+
# Self-signed cert file for self-signed.pythontest.net
19+
CERT_selfsigned_pythontestdotnet = os.path.join(here, 'selfsigned_pythontestdotnet.pem')
2020

2121
HOST = support.HOST
2222

@@ -758,17 +758,18 @@ def test_networked(self):
758758
self._check_svn_python_org(resp)
759759

760760
def test_networked_good_cert(self):
761-
# We feed a CA cert that validates the server's cert
761+
# We feed the server's cert as a validating cert
762762
import ssl
763763
support.requires('network')
764-
with support.transient_internet('svn.python.org'):
764+
with support.transient_internet('self-signed.pythontest.net'):
765765
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
766766
context.verify_mode = ssl.CERT_REQUIRED
767-
context.load_verify_locations(CACERT_svn_python_org)
768-
h = client.HTTPSConnection('svn.python.org', 443, context=context)
767+
context.load_verify_locations(CERT_selfsigned_pythontestdotnet)
768+
h = client.HTTPSConnection('self-signed.pythontest.net', 443, context=context)
769769
h.request('GET', '/')
770770
resp = h.getresponse()
771-
self._check_svn_python_org(resp)
771+
server_string = resp.getheader('server')
772+
self.assertIn('nginx', server_string)
772773

773774
def test_networked_bad_cert(self):
774775
# We feed a "CA" cert that is unrelated to the server's cert

‎Lib/test/test_ssl.py

Lines changed: 48 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,8 @@
2929

3030
HOST = support.HOST
3131

32-
data_file = lambda name: os.path.join(os.path.dirname(__file__), name)
32+
def data_file(*name):
33+
return os.path.join(os.path.dirname(__file__), *name)
3334

3435
# The custom key and certificate files used in test_ssl are generated
3536
# using Lib/test/make_ssl_certs.py.
@@ -47,8 +48,10 @@
4748
KEY_PASSWORD = "somepass"
4849
CAPATH = data_file("capath")
4950
BYTES_CAPATH = os.fsencode(CAPATH)
51+
CAFILE_CACERT = data_file("capath", "5ed36f99.0")
5052

51-
SVN_PYTHON_ORG_ROOT_CERT = data_file("https_svn_python_org_root.pem")
53+
REMOTE_HOST = "self-signed.pythontest.net"
54+
REMOTE_ROOT_CERT = data_file("selfsigned_pythontestdotnet.pem")
5255

5356
EMPTYCERT = data_file("nullcert.pem")
5457
BADCERT = data_file("badcert.pem")
@@ -229,7 +232,7 @@ def test_parse_cert_CVE_2013_4238(self):
229232
self.assertEqual(p['subjectAltName'], san)
230233

231234
def test_DER_to_PEM(self):
232-
with open(SVN_PYTHON_ORG_ROOT_CERT, 'r') as f:
235+
with open(CAFILE_CACERT, 'r') as f:
233236
pem = f.read()
234237
d1 = ssl.PEM_cert_to_DER_cert(pem)
235238
p2 = ssl.DER_cert_to_PEM_cert(d1)
@@ -592,7 +595,7 @@ def test_load_cert_chain(self):
592595
# Mismatching key and cert
593596
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
594597
with self.assertRaisesRegex(ssl.SSLError, "key values mismatch"):
595-
ctx.load_cert_chain(SVN_PYTHON_ORG_ROOT_CERT, ONLYKEY)
598+
ctx.load_cert_chain(CAFILE_CACERT, ONLYKEY)
596599
# Password protected key and cert
597600
ctx.load_cert_chain(CERTFILE_PROTECTED, password=KEY_PASSWORD)
598601
ctx.load_cert_chain(CERTFILE_PROTECTED, password=KEY_PASSWORD.encode())
@@ -759,11 +762,11 @@ def test_subclass(self):
759762
class NetworkedTests(unittest.TestCase):
760763

761764
def test_connect(self):
762-
with support.transient_internet("svn.python.org"):
765+
with support.transient_internet(REMOTE_HOST):
763766
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
764767
cert_reqs=ssl.CERT_NONE)
765768
try:
766-
s.connect(("svn.python.org", 443))
769+
s.connect((REMOTE_HOST, 443))
767770
self.assertEqual({}, s.getpeercert())
768771
finally:
769772
s.close()
@@ -772,42 +775,42 @@ def test_connect(self):
772775
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
773776
cert_reqs=ssl.CERT_REQUIRED)
774777
self.assertRaisesRegex(ssl.SSLError, "certificate verify failed",
775-
s.connect, ("svn.python.org", 443))
778+
s.connect, (REMOTE_HOST, 443))
776779
s.close()
777780

778781
# this should succeed because we specify the root cert
779782
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
780783
cert_reqs=ssl.CERT_REQUIRED,
781-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
784+
ca_certs=REMOTE_ROOT_CERT)
782785
try:
783-
s.connect(("svn.python.org", 443))
786+
s.connect((REMOTE_HOST, 443))
784787
self.assertTrue(s.getpeercert())
785788
finally:
786789
s.close()
787790

788791
def test_connect_ex(self):
789792
# Issue #11326: check connect_ex() implementation
790-
with support.transient_internet("svn.python.org"):
793+
with support.transient_internet(REMOTE_HOST):
791794
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
792795
cert_reqs=ssl.CERT_REQUIRED,
793-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
796+
ca_certs=REMOTE_ROOT_CERT)
794797
try:
795-
self.assertEqual(0, s.connect_ex(("svn.python.org", 443)))
798+
self.assertEqual(0, s.connect_ex((REMOTE_HOST, 443)))
796799
self.assertTrue(s.getpeercert())
797800
finally:
798801
s.close()
799802

800803
def test_non_blocking_connect_ex(self):
801804
# Issue #11326: non-blocking connect_ex() should allow handshake
802805
# to proceed after the socket gets ready.
803-
with support.transient_internet("svn.python.org"):
806+
with support.transient_internet(REMOTE_HOST):
804807
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
805808
cert_reqs=ssl.CERT_REQUIRED,
806-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT,
809+
ca_certs=REMOTE_ROOT_CERT,
807810
do_handshake_on_connect=False)
808811
try:
809812
s.setblocking(False)
810-
rc = s.connect_ex(('svn.python.org', 443))
813+
rc = s.connect_ex((REMOTE_HOST, 443))
811814
# EWOULDBLOCK under Windows, EINPROGRESS elsewhere
812815
self.assertIn(rc, (0, errno.EINPROGRESS, errno.EWOULDBLOCK))
813816
# Wait for connect to finish
@@ -829,61 +832,65 @@ def test_non_blocking_connect_ex(self):
829832
def test_timeout_connect_ex(self):
830833
# Issue #12065: on a timeout, connect_ex() should return the original
831834
# errno (mimicking the behaviour of non-SSL sockets).
832-
with support.transient_internet("svn.python.org"):
835+
with support.transient_internet(REMOTE_HOST):
833836
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
834837
cert_reqs=ssl.CERT_REQUIRED,
835-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT,
838+
ca_certs=REMOTE_ROOT_CERT,
836839
do_handshake_on_connect=False)
837840
try:
838841
s.settimeout(0.0000001)
839-
rc = s.connect_ex(('svn.python.org', 443))
842+
rc = s.connect_ex((REMOTE_HOST, 443))
840843
if rc == 0:
841-
self.skipTest("svn.python.org responded too quickly")
844+
self.skipTest("REMOTE_HOST responded too quickly")
842845
self.assertIn(rc, (errno.EAGAIN, errno.EWOULDBLOCK))
843846
finally:
844847
s.close()
845848

846849
def test_connect_ex_error(self):
847-
with support.transient_internet("svn.python.org"):
850+
with support.transient_internet(REMOTE_HOST):
848851
s = ssl.wrap_socket(socket.socket(socket.AF_INET),
849852
cert_reqs=ssl.CERT_REQUIRED,
850-
ca_certs=SVN_PYTHON_ORG_ROOT_CERT)
853+
ca_certs=REMOTE_ROOT_CERT)
851854
try:
852-
rc = s.connect_ex(("svn.python.org", 444))
855+
rc = s.connect_ex((REMOTE_HOST, 444))
853856
# Issue #19919: Windows machines or VMs hosted on Windows
854857
# machines sometimes return EWOULDBLOCK.
855-
self.assertIn(rc, (errno.ECONNREFUSED, errno.EWOULDBLOCK))
858+
errors = (
859+
errno.ECONNREFUSED, errno.EHOSTUNREACH,
860+
errno.EWOULDBLOCK,
861+
)
862+
self.assertIn(rc, errors)
856863
finally:
857864
s.close()
858865

859866
def test_connect_with_context(self):
860-
with support.transient_internet("svn.python.org"):
867+
with support.transient_internet(REMOTE_HOST):
861868
# Same as test_connect, but with a separately created context
862869
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
863870
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
864-
s.connect(("svn.python.org", 443))
871+
s.connect((REMOTE_HOST, 443))
865872
try:
866873
self.assertEqual({}, s.getpeercert())
867874
finally:
868875
s.close()
869876
# Same with a server hostname
870877
s = ctx.wrap_socket(socket.socket(socket.AF_INET),
871-
server_hostname="svn.python.org")
878+
server_hostname=REMOTE_HOST)
872879
if ssl.HAS_SNI:
873-
s.connect(("svn.python.org", 443))
880+
s.connect((REMOTE_HOST, 443))
874881
s.close()
875882
else:
876-
self.assertRaises(ValueError, s.connect, ("svn.python.org", 443))
883+
self.assertRaises(ValueError, s.connect, (REMOTE_HOST, 443))
877884
# This should fail because we have no verification certs
878885
ctx.verify_mode = ssl.CERT_REQUIRED
879886
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
880887
self.assertRaisesRegex(ssl.SSLError, "certificate verify failed",
881-
s.connect, ("svn.python.org", 443))
888+
s.connect, (REMOTE_HOST, 443))
882889
s.close()
883890
# This should succeed because we specify the root cert
884-
ctx.load_verify_locations(SVN_PYTHON_ORG_ROOT_CERT)
891+
ctx.load_verify_locations(REMOTE_ROOT_CERT)
885892
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
886-
s.connect(("svn.python.org", 443))
893+
s.connect((REMOTE_HOST, 443))
887894
try:
888895
cert = s.getpeercert()
889896
self.assertTrue(cert)
@@ -896,12 +903,12 @@ def test_connect_capath(self):
896903
# OpenSSL 0.9.8n and 1.0.0, as a result the capath directory must
897904
# contain both versions of each certificate (same content, different
898905
# filename) for this test to be portable across OpenSSL releases.
899-
with support.transient_internet("svn.python.org"):
906+
with support.transient_internet(REMOTE_HOST):
900907
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
901908
ctx.verify_mode = ssl.CERT_REQUIRED
902909
ctx.load_verify_locations(capath=CAPATH)
903910
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
904-
s.connect(("svn.python.org", 443))
911+
s.connect((REMOTE_HOST, 443))
905912
try:
906913
cert = s.getpeercert()
907914
self.assertTrue(cert)
@@ -912,7 +919,7 @@ def test_connect_capath(self):
912919
ctx.verify_mode = ssl.CERT_REQUIRED
913920
ctx.load_verify_locations(capath=BYTES_CAPATH)
914921
s = ctx.wrap_socket(socket.socket(socket.AF_INET))
915-
s.connect(("svn.python.org", 443))
922+
s.connect((REMOTE_HOST, 443))
916923
try:
917924
cert = s.getpeercert()
918925
self.assertTrue(cert)
@@ -924,9 +931,9 @@ def test_makefile_close(self):
924931
# Issue #5238: creating a file-like object with makefile() shouldn't
925932
# delay closing the underlying "real socket" (here tested with its
926933
# file descriptor, hence skipping the test under Windows).
927-
with support.transient_internet("svn.python.org"):
934+
with support.transient_internet(REMOTE_HOST):
928935
ss = ssl.wrap_socket(socket.socket(socket.AF_INET))
929-
ss.connect(("svn.python.org", 443))
936+
ss.connect((REMOTE_HOST, 443))
930937
fd = ss.fileno()
931938
f = ss.makefile()
932939
f.close()
@@ -940,9 +947,9 @@ def test_makefile_close(self):
940947
self.assertEqual(e.exception.errno, errno.EBADF)
941948

942949
def test_non_blocking_handshake(self):
943-
with support.transient_internet("svn.python.org"):
950+
with support.transient_internet(REMOTE_HOST):
944951
s = socket.socket(socket.AF_INET)
945-
s.connect(("svn.python.org", 443))
952+
s.connect((REMOTE_HOST, 443))
946953
s.setblocking(False)
947954
s = ssl.wrap_socket(s,
948955
cert_reqs=ssl.CERT_NONE,
@@ -988,12 +995,12 @@ def _test_get_server_certificate(host, port, cert=None):
988995
if support.verbose:
989996
sys.stdout.write("\nVerified certificate for %s:%s is\n%s\n" % (host, port ,pem))
990997

991-
_test_get_server_certificate('svn.python.org', 443, SVN_PYTHON_ORG_ROOT_CERT)
998+
_test_get_server_certificate(REMOTE_HOST, 443, REMOTE_ROOT_CERT)
992999
if support.IPV6_ENABLED:
9931000
_test_get_server_certificate('ipv6.google.com', 443)
9941001

9951002
def test_ciphers(self):
996-
remote = ("svn.python.org", 443)
1003+
remote = (REMOTE_HOST, 443)
9971004
with support.transient_internet(remote[0]):
9981005
with ssl.wrap_socket(socket.socket(socket.AF_INET),
9991006
cert_reqs=ssl.CERT_NONE, ciphers="ALL") as s:
@@ -2150,7 +2157,7 @@ def test_main(verbose=False):
21502157
print(" HAS_SNI = %r" % ssl.HAS_SNI)
21512158

21522159
for filename in [
2153-
CERTFILE, SVN_PYTHON_ORG_ROOT_CERT, BYTES_CERTFILE,
2160+
CERTFILE, REMOTE_ROOT_CERT, BYTES_CERTFILE,
21542161
ONLYCERT, ONLYKEY, BYTES_ONLYCERT, BYTES_ONLYKEY,
21552162
BADCERT, BADKEY, EMPTYCERT]:
21562163
if not os.path.exists(filename):

0 commit comments

Comments
 (0)