Repository navigation
[3.6] bpo-41183: Skip ssl tests for disabled versions (GH-16427) - #21882
hroncok wants to merge 1 commit into
Conversation
Sorry, something went wrong.
test_ssl now handles disabled TLS/SSL versions better. OpenSSL's crypto policy and run-time settings are recognized and tests for disabled versions are skipped. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38275 (cherry picked from commit df6ac7e)
| return False | ||
|
|
||
| if isinstance(version, str): | ||
| version = ssl.TLSVersion.__members__[version] |
There was a problem hiding this comment.
So this entire thing does not exist on 3.6 yet.
Sorry, something went wrong.
| version = ssl.TLSVersion.__members__[version] | ||
|
|
||
| # check compile time flags like ssl.HAS_TLSv1_2 | ||
| if not getattr(ssl, f'HAS_{version.name}'): |
There was a problem hiding this comment.
Neither does this.
Sorry, something went wrong.
| ctx = ssl.SSLContext() | ||
| if ( | ||
| hasattr(ctx, 'minimum_version') and | ||
| ctx.minimum_version != ssl.TLSVersion.MINIMUM_SUPPORTED and |
There was a problem hiding this comment.
Yet the most importantly, and that I believe is what is problematic on newer systems is that this (and MAXIMUM_SUPPORTED) is also not here yet.
Sorry, something went wrong.
There was a problem hiding this comment.
This change requires #5259 to be backported. However even if we backport that, it relies on some features from #5128 . So in general I don't think it's possible to pull this off with this approach. And it's easy to figure out the baked/compiled in versions of supported protocols in openssl but no easy way, without those features, to determine the runtime config.
Sorry, something went wrong.
test_ssl now handles disabled TLS/SSL versions better. OpenSSL's crypto
policy and run-time settings are recognized and tests for disabled versions
are skipped.
Signed-off-by: Christian Heimes christian@python.org
https://bugs.python.org/issue38275
(cherry picked from commit df6ac7e)
cc @larryhastings @tiran
https://bugs.python.org/issue41183