Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1 | # Test the support for SSL and sockets |
| 2 | |
| 3 | import sys |
| 4 | import unittest |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 5 | from test import support |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 6 | import socket |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 7 | import select |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 8 | import time |
Antoine Pitrou | cfcd8ad | 2010-04-23 23:31:47 +0000 | [diff] [blame] | 9 | import gc |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 10 | import os |
Antoine Pitrou | cfcd8ad | 2010-04-23 23:31:47 +0000 | [diff] [blame] | 11 | import errno |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 12 | import pprint |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 13 | import tempfile |
Antoine Pitrou | 803e6d6 | 2010-10-13 10:36:15 +0000 | [diff] [blame] | 14 | import urllib.request |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 15 | import traceback |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 16 | import asyncore |
Antoine Pitrou | 9d54366 | 2010-04-23 23:10:32 +0000 | [diff] [blame] | 17 | import weakref |
Antoine Pitrou | 15cee62 | 2010-08-04 16:45:21 +0000 | [diff] [blame] | 18 | import platform |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 19 | import functools |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 20 | |
Antoine Pitrou | 05d936d | 2010-10-13 11:38:36 +0000 | [diff] [blame] | 21 | ssl = support.import_module("ssl") |
| 22 | |
| 23 | PROTOCOLS = [ |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 24 | ssl.PROTOCOL_SSLv3, |
Antoine Pitrou | 05d936d | 2010-10-13 11:38:36 +0000 | [diff] [blame] | 25 | ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1 |
| 26 | ] |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 27 | if hasattr(ssl, 'PROTOCOL_SSLv2'): |
| 28 | PROTOCOLS.append(ssl.PROTOCOL_SSLv2) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 29 | |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 30 | HOST = support.HOST |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 31 | |
| 32 | data_file = lambda name: os.path.join(os.path.dirname(__file__), name) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 33 | |
Antoine Pitrou | 8156409 | 2010-10-08 23:06:24 +0000 | [diff] [blame] | 34 | # The custom key and certificate files used in test_ssl are generated |
| 35 | # using Lib/test/make_ssl_certs.py. |
| 36 | # Other certificates are simply fetched from the Internet servers they |
| 37 | # are meant to authenticate. |
| 38 | |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 39 | CERTFILE = data_file("keycert.pem") |
Victor Stinner | 313a120 | 2010-06-11 23:56:51 +0000 | [diff] [blame] | 40 | BYTES_CERTFILE = os.fsencode(CERTFILE) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 41 | ONLYCERT = data_file("ssl_cert.pem") |
| 42 | ONLYKEY = data_file("ssl_key.pem") |
Victor Stinner | 313a120 | 2010-06-11 23:56:51 +0000 | [diff] [blame] | 43 | BYTES_ONLYCERT = os.fsencode(ONLYCERT) |
| 44 | BYTES_ONLYKEY = os.fsencode(ONLYKEY) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 45 | CAPATH = data_file("capath") |
Victor Stinner | 313a120 | 2010-06-11 23:56:51 +0000 | [diff] [blame] | 46 | BYTES_CAPATH = os.fsencode(CAPATH) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 47 | |
| 48 | SVN_PYTHON_ORG_ROOT_CERT = data_file("https_svn_python_org_root.pem") |
| 49 | |
| 50 | EMPTYCERT = data_file("nullcert.pem") |
| 51 | BADCERT = data_file("badcert.pem") |
| 52 | WRONGCERT = data_file("XXXnonexisting.pem") |
| 53 | BADKEY = data_file("badkey.pem") |
| 54 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 55 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 56 | def handle_error(prefix): |
| 57 | exc_format = ' '.join(traceback.format_exception(*sys.exc_info())) |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 58 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 59 | sys.stdout.write(prefix + exc_format) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 60 | |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 61 | def can_clear_options(): |
| 62 | # 0.9.8m or higher |
| 63 | return ssl.OPENSSL_VERSION_INFO >= (0, 9, 8, 13, 15) |
| 64 | |
| 65 | def no_sslv2_implies_sslv3_hello(): |
| 66 | # 0.9.7h or higher |
| 67 | return ssl.OPENSSL_VERSION_INFO >= (0, 9, 7, 8, 15) |
| 68 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 69 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 70 | # Issue #9415: Ubuntu hijacks their OpenSSL and forcefully disables SSLv2 |
| 71 | def skip_if_broken_ubuntu_ssl(func): |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 72 | if hasattr(ssl, 'PROTOCOL_SSLv2'): |
| 73 | @functools.wraps(func) |
| 74 | def f(*args, **kwargs): |
| 75 | try: |
| 76 | ssl.SSLContext(ssl.PROTOCOL_SSLv2) |
| 77 | except ssl.SSLError: |
| 78 | if (ssl.OPENSSL_VERSION_INFO == (0, 9, 8, 15, 15) and |
| 79 | platform.linux_distribution() == ('debian', 'squeeze/sid', '')): |
| 80 | raise unittest.SkipTest("Patched Ubuntu OpenSSL breaks behaviour") |
| 81 | return func(*args, **kwargs) |
| 82 | return f |
| 83 | else: |
| 84 | return func |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 85 | |
| 86 | |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 87 | class BasicSocketTests(unittest.TestCase): |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 88 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 89 | def test_constants(self): |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 90 | #ssl.PROTOCOL_SSLv2 |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 91 | ssl.PROTOCOL_SSLv23 |
| 92 | ssl.PROTOCOL_SSLv3 |
| 93 | ssl.PROTOCOL_TLSv1 |
| 94 | ssl.CERT_NONE |
| 95 | ssl.CERT_OPTIONAL |
| 96 | ssl.CERT_REQUIRED |
Antoine Pitrou | d532321 | 2010-10-22 18:19:07 +0000 | [diff] [blame] | 97 | self.assertIn(ssl.HAS_SNI, {True, False}) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 98 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 99 | def test_random(self): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 100 | v = ssl.RAND_status() |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 101 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 102 | sys.stdout.write("\n RAND_status is %d (%s)\n" |
| 103 | % (v, (v and "sufficient randomness") or |
| 104 | "insufficient randomness")) |
Victor Stinner | 99c8b16 | 2011-05-24 12:05:19 +0200 | [diff] [blame] | 105 | |
| 106 | data, is_cryptographic = ssl.RAND_pseudo_bytes(16) |
| 107 | self.assertEqual(len(data), 16) |
| 108 | self.assertEqual(is_cryptographic, v == 1) |
| 109 | if v: |
| 110 | data = ssl.RAND_bytes(16) |
| 111 | self.assertEqual(len(data), 16) |
Victor Stinner | 2e2baa9 | 2011-05-25 11:15:16 +0200 | [diff] [blame] | 112 | else: |
| 113 | self.assertRaises(ssl.SSLError, ssl.RAND_bytes, 16) |
Victor Stinner | 99c8b16 | 2011-05-24 12:05:19 +0200 | [diff] [blame] | 114 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 115 | try: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 116 | ssl.RAND_egd(1) |
| 117 | except TypeError: |
| 118 | pass |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 119 | else: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 120 | print("didn't raise TypeError") |
| 121 | ssl.RAND_add("this is a random string", 75.0) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 122 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 123 | def test_parse_cert(self): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 124 | # note that this uses an 'unofficial' function in _ssl.c, |
| 125 | # provided solely for this test, to exercise the certificate |
| 126 | # parsing code |
Antoine Pitrou | fb04691 | 2010-11-09 20:21:19 +0000 | [diff] [blame] | 127 | p = ssl._ssl._test_decode_cert(CERTFILE) |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 128 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 129 | sys.stdout.write("\n" + pprint.pformat(p) + "\n") |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 130 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 131 | def test_DER_to_PEM(self): |
| 132 | with open(SVN_PYTHON_ORG_ROOT_CERT, 'r') as f: |
| 133 | pem = f.read() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 134 | d1 = ssl.PEM_cert_to_DER_cert(pem) |
| 135 | p2 = ssl.DER_cert_to_PEM_cert(d1) |
| 136 | d2 = ssl.PEM_cert_to_DER_cert(p2) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 137 | self.assertEqual(d1, d2) |
Antoine Pitrou | 9bfbe61 | 2010-04-27 22:08:08 +0000 | [diff] [blame] | 138 | if not p2.startswith(ssl.PEM_HEADER + '\n'): |
| 139 | self.fail("DER-to-PEM didn't include correct header:\n%r\n" % p2) |
| 140 | if not p2.endswith('\n' + ssl.PEM_FOOTER + '\n'): |
| 141 | self.fail("DER-to-PEM didn't include correct footer:\n%r\n" % p2) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 142 | |
Antoine Pitrou | 04f6a32 | 2010-04-05 21:40:07 +0000 | [diff] [blame] | 143 | def test_openssl_version(self): |
| 144 | n = ssl.OPENSSL_VERSION_NUMBER |
| 145 | t = ssl.OPENSSL_VERSION_INFO |
| 146 | s = ssl.OPENSSL_VERSION |
| 147 | self.assertIsInstance(n, int) |
| 148 | self.assertIsInstance(t, tuple) |
| 149 | self.assertIsInstance(s, str) |
| 150 | # Some sanity checks follow |
| 151 | # >= 0.9 |
| 152 | self.assertGreaterEqual(n, 0x900000) |
| 153 | # < 2.0 |
| 154 | self.assertLess(n, 0x20000000) |
| 155 | major, minor, fix, patch, status = t |
| 156 | self.assertGreaterEqual(major, 0) |
| 157 | self.assertLess(major, 2) |
| 158 | self.assertGreaterEqual(minor, 0) |
| 159 | self.assertLess(minor, 256) |
| 160 | self.assertGreaterEqual(fix, 0) |
| 161 | self.assertLess(fix, 256) |
| 162 | self.assertGreaterEqual(patch, 0) |
| 163 | self.assertLessEqual(patch, 26) |
| 164 | self.assertGreaterEqual(status, 0) |
| 165 | self.assertLessEqual(status, 15) |
| 166 | # Version string as returned by OpenSSL, the format might change |
| 167 | self.assertTrue(s.startswith("OpenSSL {:d}.{:d}.{:d}".format(major, minor, fix)), |
| 168 | (s, t)) |
| 169 | |
Antoine Pitrou | 9d54366 | 2010-04-23 23:10:32 +0000 | [diff] [blame] | 170 | @support.cpython_only |
| 171 | def test_refcycle(self): |
| 172 | # Issue #7943: an SSL object doesn't create reference cycles with |
| 173 | # itself. |
| 174 | s = socket.socket(socket.AF_INET) |
| 175 | ss = ssl.wrap_socket(s) |
| 176 | wr = weakref.ref(ss) |
| 177 | del ss |
| 178 | self.assertEqual(wr(), None) |
| 179 | |
Antoine Pitrou | a468adc | 2010-09-14 14:43:44 +0000 | [diff] [blame] | 180 | def test_wrapped_unconnected(self): |
| 181 | # Methods on an unconnected SSLSocket propagate the original |
| 182 | # socket.error raise by the underlying socket object. |
| 183 | s = socket.socket(socket.AF_INET) |
| 184 | ss = ssl.wrap_socket(s) |
| 185 | self.assertRaises(socket.error, ss.recv, 1) |
| 186 | self.assertRaises(socket.error, ss.recv_into, bytearray(b'x')) |
| 187 | self.assertRaises(socket.error, ss.recvfrom, 1) |
| 188 | self.assertRaises(socket.error, ss.recvfrom_into, bytearray(b'x'), 1) |
| 189 | self.assertRaises(socket.error, ss.send, b'x') |
| 190 | self.assertRaises(socket.error, ss.sendto, b'x', ('0.0.0.0', 0)) |
| 191 | |
Antoine Pitrou | 40f0874 | 2010-04-24 22:04:40 +0000 | [diff] [blame] | 192 | def test_timeout(self): |
| 193 | # Issue #8524: when creating an SSL socket, the timeout of the |
| 194 | # original socket should be retained. |
| 195 | for timeout in (None, 0.0, 5.0): |
| 196 | s = socket.socket(socket.AF_INET) |
| 197 | s.settimeout(timeout) |
| 198 | ss = ssl.wrap_socket(s) |
| 199 | self.assertEqual(timeout, ss.gettimeout()) |
| 200 | |
Giampaolo Rodolà | 745ab38 | 2010-08-29 19:25:49 +0000 | [diff] [blame] | 201 | def test_errors(self): |
| 202 | sock = socket.socket() |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 203 | self.assertRaisesRegex(ValueError, |
Giampaolo Rodolà | 8b7da62 | 2010-08-30 18:28:05 +0000 | [diff] [blame] | 204 | "certfile must be specified", |
| 205 | ssl.wrap_socket, sock, keyfile=CERTFILE) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 206 | self.assertRaisesRegex(ValueError, |
Giampaolo Rodolà | 8b7da62 | 2010-08-30 18:28:05 +0000 | [diff] [blame] | 207 | "certfile must be specified for server-side operations", |
| 208 | ssl.wrap_socket, sock, server_side=True) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 209 | self.assertRaisesRegex(ValueError, |
Giampaolo Rodolà | 8b7da62 | 2010-08-30 18:28:05 +0000 | [diff] [blame] | 210 | "certfile must be specified for server-side operations", |
| 211 | ssl.wrap_socket, sock, server_side=True, certfile="") |
Giampaolo Rodolà | 745ab38 | 2010-08-29 19:25:49 +0000 | [diff] [blame] | 212 | s = ssl.wrap_socket(sock, server_side=True, certfile=CERTFILE) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 213 | self.assertRaisesRegex(ValueError, "can't connect in server-side mode", |
Giampaolo Rodolà | 745ab38 | 2010-08-29 19:25:49 +0000 | [diff] [blame] | 214 | s.connect, (HOST, 8080)) |
Giampaolo Rodolà | 4a656eb | 2010-08-29 22:50:39 +0000 | [diff] [blame] | 215 | with self.assertRaises(IOError) as cm: |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 216 | with socket.socket() as sock: |
| 217 | ssl.wrap_socket(sock, certfile=WRONGCERT) |
Giampaolo Rodolà | 4a656eb | 2010-08-29 22:50:39 +0000 | [diff] [blame] | 218 | self.assertEqual(cm.exception.errno, errno.ENOENT) |
Giampaolo Rodolà | 8b7da62 | 2010-08-30 18:28:05 +0000 | [diff] [blame] | 219 | with self.assertRaises(IOError) as cm: |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 220 | with socket.socket() as sock: |
| 221 | ssl.wrap_socket(sock, certfile=CERTFILE, keyfile=WRONGCERT) |
Giampaolo Rodolà | 8b7da62 | 2010-08-30 18:28:05 +0000 | [diff] [blame] | 222 | self.assertEqual(cm.exception.errno, errno.ENOENT) |
Giampaolo Rodolà | 4a656eb | 2010-08-29 22:50:39 +0000 | [diff] [blame] | 223 | with self.assertRaises(IOError) as cm: |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 224 | with socket.socket() as sock: |
| 225 | ssl.wrap_socket(sock, certfile=WRONGCERT, keyfile=WRONGCERT) |
Giampaolo Rodolà | 4a656eb | 2010-08-29 22:50:39 +0000 | [diff] [blame] | 226 | self.assertEqual(cm.exception.errno, errno.ENOENT) |
Giampaolo Rodolà | 745ab38 | 2010-08-29 19:25:49 +0000 | [diff] [blame] | 227 | |
Antoine Pitrou | 59fdd67 | 2010-10-08 10:37:08 +0000 | [diff] [blame] | 228 | def test_match_hostname(self): |
| 229 | def ok(cert, hostname): |
| 230 | ssl.match_hostname(cert, hostname) |
| 231 | def fail(cert, hostname): |
| 232 | self.assertRaises(ssl.CertificateError, |
| 233 | ssl.match_hostname, cert, hostname) |
| 234 | |
| 235 | cert = {'subject': ((('commonName', 'example.com'),),)} |
| 236 | ok(cert, 'example.com') |
| 237 | ok(cert, 'ExAmple.cOm') |
| 238 | fail(cert, 'www.example.com') |
| 239 | fail(cert, '.example.com') |
| 240 | fail(cert, 'example.org') |
| 241 | fail(cert, 'exampleXcom') |
| 242 | |
| 243 | cert = {'subject': ((('commonName', '*.a.com'),),)} |
| 244 | ok(cert, 'foo.a.com') |
| 245 | fail(cert, 'bar.foo.a.com') |
| 246 | fail(cert, 'a.com') |
| 247 | fail(cert, 'Xa.com') |
| 248 | fail(cert, '.a.com') |
| 249 | |
| 250 | cert = {'subject': ((('commonName', 'a.*.com'),),)} |
| 251 | ok(cert, 'a.foo.com') |
| 252 | fail(cert, 'a..com') |
| 253 | fail(cert, 'a.com') |
| 254 | |
| 255 | cert = {'subject': ((('commonName', 'f*.com'),),)} |
| 256 | ok(cert, 'foo.com') |
| 257 | ok(cert, 'f.com') |
| 258 | fail(cert, 'bar.com') |
| 259 | fail(cert, 'foo.a.com') |
| 260 | fail(cert, 'bar.foo.com') |
| 261 | |
| 262 | # Slightly fake real-world example |
| 263 | cert = {'notAfter': 'Jun 26 21:41:46 2011 GMT', |
| 264 | 'subject': ((('commonName', 'linuxfrz.org'),),), |
| 265 | 'subjectAltName': (('DNS', 'linuxfr.org'), |
| 266 | ('DNS', 'linuxfr.com'), |
| 267 | ('othername', '<unsupported>'))} |
| 268 | ok(cert, 'linuxfr.org') |
| 269 | ok(cert, 'linuxfr.com') |
| 270 | # Not a "DNS" entry |
| 271 | fail(cert, '<unsupported>') |
| 272 | # When there is a subjectAltName, commonName isn't used |
| 273 | fail(cert, 'linuxfrz.org') |
| 274 | |
| 275 | # A pristine real-world example |
| 276 | cert = {'notAfter': 'Dec 18 23:59:59 2011 GMT', |
| 277 | 'subject': ((('countryName', 'US'),), |
| 278 | (('stateOrProvinceName', 'California'),), |
| 279 | (('localityName', 'Mountain View'),), |
| 280 | (('organizationName', 'Google Inc'),), |
| 281 | (('commonName', 'mail.google.com'),))} |
| 282 | ok(cert, 'mail.google.com') |
| 283 | fail(cert, 'gmail.com') |
| 284 | # Only commonName is considered |
| 285 | fail(cert, 'California') |
| 286 | |
| 287 | # Neither commonName nor subjectAltName |
| 288 | cert = {'notAfter': 'Dec 18 23:59:59 2011 GMT', |
| 289 | 'subject': ((('countryName', 'US'),), |
| 290 | (('stateOrProvinceName', 'California'),), |
| 291 | (('localityName', 'Mountain View'),), |
| 292 | (('organizationName', 'Google Inc'),))} |
| 293 | fail(cert, 'mail.google.com') |
| 294 | |
Antoine Pitrou | 1c86b44 | 2011-05-06 15:19:49 +0200 | [diff] [blame] | 295 | # No DNS entry in subjectAltName but a commonName |
| 296 | cert = {'notAfter': 'Dec 18 23:59:59 2099 GMT', |
| 297 | 'subject': ((('countryName', 'US'),), |
| 298 | (('stateOrProvinceName', 'California'),), |
| 299 | (('localityName', 'Mountain View'),), |
| 300 | (('commonName', 'mail.google.com'),)), |
| 301 | 'subjectAltName': (('othername', 'blabla'), )} |
| 302 | ok(cert, 'mail.google.com') |
| 303 | |
| 304 | # No DNS entry subjectAltName and no commonName |
| 305 | cert = {'notAfter': 'Dec 18 23:59:59 2099 GMT', |
| 306 | 'subject': ((('countryName', 'US'),), |
| 307 | (('stateOrProvinceName', 'California'),), |
| 308 | (('localityName', 'Mountain View'),), |
| 309 | (('organizationName', 'Google Inc'),)), |
| 310 | 'subjectAltName': (('othername', 'blabla'),)} |
| 311 | fail(cert, 'google.com') |
| 312 | |
Antoine Pitrou | 59fdd67 | 2010-10-08 10:37:08 +0000 | [diff] [blame] | 313 | # Empty cert / no cert |
| 314 | self.assertRaises(ValueError, ssl.match_hostname, None, 'example.com') |
| 315 | self.assertRaises(ValueError, ssl.match_hostname, {}, 'example.com') |
| 316 | |
Antoine Pitrou | d532321 | 2010-10-22 18:19:07 +0000 | [diff] [blame] | 317 | def test_server_side(self): |
| 318 | # server_hostname doesn't work for server sockets |
| 319 | ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 320 | with socket.socket() as sock: |
| 321 | self.assertRaises(ValueError, ctx.wrap_socket, sock, True, |
| 322 | server_hostname="some.hostname") |
Antoine Pitrou | 04f6a32 | 2010-04-05 21:40:07 +0000 | [diff] [blame] | 323 | |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 324 | class ContextTests(unittest.TestCase): |
| 325 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 326 | @skip_if_broken_ubuntu_ssl |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 327 | def test_constructor(self): |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 328 | if hasattr(ssl, 'PROTOCOL_SSLv2'): |
| 329 | ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv2) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 330 | ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) |
| 331 | ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv3) |
| 332 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
| 333 | self.assertRaises(TypeError, ssl.SSLContext) |
| 334 | self.assertRaises(ValueError, ssl.SSLContext, -1) |
| 335 | self.assertRaises(ValueError, ssl.SSLContext, 42) |
| 336 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 337 | @skip_if_broken_ubuntu_ssl |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 338 | def test_protocol(self): |
| 339 | for proto in PROTOCOLS: |
| 340 | ctx = ssl.SSLContext(proto) |
| 341 | self.assertEqual(ctx.protocol, proto) |
| 342 | |
| 343 | def test_ciphers(self): |
| 344 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
| 345 | ctx.set_ciphers("ALL") |
| 346 | ctx.set_ciphers("DEFAULT") |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 347 | with self.assertRaisesRegex(ssl.SSLError, "No cipher can be selected"): |
Antoine Pitrou | 3047406 | 2010-05-16 23:46:26 +0000 | [diff] [blame] | 348 | ctx.set_ciphers("^$:,;?*'dorothyx") |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 349 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 350 | @skip_if_broken_ubuntu_ssl |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 351 | def test_options(self): |
| 352 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
| 353 | # OP_ALL is the default value |
| 354 | self.assertEqual(ssl.OP_ALL, ctx.options) |
| 355 | ctx.options |= ssl.OP_NO_SSLv2 |
| 356 | self.assertEqual(ssl.OP_ALL | ssl.OP_NO_SSLv2, |
| 357 | ctx.options) |
| 358 | ctx.options |= ssl.OP_NO_SSLv3 |
| 359 | self.assertEqual(ssl.OP_ALL | ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3, |
| 360 | ctx.options) |
| 361 | if can_clear_options(): |
| 362 | ctx.options = (ctx.options & ~ssl.OP_NO_SSLv2) | ssl.OP_NO_TLSv1 |
| 363 | self.assertEqual(ssl.OP_ALL | ssl.OP_NO_TLSv1 | ssl.OP_NO_SSLv3, |
| 364 | ctx.options) |
| 365 | ctx.options = 0 |
| 366 | self.assertEqual(0, ctx.options) |
| 367 | else: |
| 368 | with self.assertRaises(ValueError): |
| 369 | ctx.options = 0 |
| 370 | |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 371 | def test_verify(self): |
| 372 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
| 373 | # Default value |
| 374 | self.assertEqual(ctx.verify_mode, ssl.CERT_NONE) |
| 375 | ctx.verify_mode = ssl.CERT_OPTIONAL |
| 376 | self.assertEqual(ctx.verify_mode, ssl.CERT_OPTIONAL) |
| 377 | ctx.verify_mode = ssl.CERT_REQUIRED |
| 378 | self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED) |
| 379 | ctx.verify_mode = ssl.CERT_NONE |
| 380 | self.assertEqual(ctx.verify_mode, ssl.CERT_NONE) |
| 381 | with self.assertRaises(TypeError): |
| 382 | ctx.verify_mode = None |
| 383 | with self.assertRaises(ValueError): |
| 384 | ctx.verify_mode = 42 |
| 385 | |
| 386 | def test_load_cert_chain(self): |
| 387 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
| 388 | # Combined key and cert in a single file |
| 389 | ctx.load_cert_chain(CERTFILE) |
| 390 | ctx.load_cert_chain(CERTFILE, keyfile=CERTFILE) |
| 391 | self.assertRaises(TypeError, ctx.load_cert_chain, keyfile=CERTFILE) |
Giampaolo Rodolà | 4a656eb | 2010-08-29 22:50:39 +0000 | [diff] [blame] | 392 | with self.assertRaises(IOError) as cm: |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 393 | ctx.load_cert_chain(WRONGCERT) |
Giampaolo Rodolà | 4a656eb | 2010-08-29 22:50:39 +0000 | [diff] [blame] | 394 | self.assertEqual(cm.exception.errno, errno.ENOENT) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 395 | with self.assertRaisesRegex(ssl.SSLError, "PEM lib"): |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 396 | ctx.load_cert_chain(BADCERT) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 397 | with self.assertRaisesRegex(ssl.SSLError, "PEM lib"): |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 398 | ctx.load_cert_chain(EMPTYCERT) |
| 399 | # Separate key and cert |
Antoine Pitrou | d091950 | 2010-05-17 10:30:00 +0000 | [diff] [blame] | 400 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 401 | ctx.load_cert_chain(ONLYCERT, ONLYKEY) |
| 402 | ctx.load_cert_chain(certfile=ONLYCERT, keyfile=ONLYKEY) |
| 403 | ctx.load_cert_chain(certfile=BYTES_ONLYCERT, keyfile=BYTES_ONLYKEY) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 404 | with self.assertRaisesRegex(ssl.SSLError, "PEM lib"): |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 405 | ctx.load_cert_chain(ONLYCERT) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 406 | with self.assertRaisesRegex(ssl.SSLError, "PEM lib"): |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 407 | ctx.load_cert_chain(ONLYKEY) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 408 | with self.assertRaisesRegex(ssl.SSLError, "PEM lib"): |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 409 | ctx.load_cert_chain(certfile=ONLYKEY, keyfile=ONLYCERT) |
| 410 | # Mismatching key and cert |
Antoine Pitrou | d091950 | 2010-05-17 10:30:00 +0000 | [diff] [blame] | 411 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 412 | with self.assertRaisesRegex(ssl.SSLError, "key values mismatch"): |
Antoine Pitrou | 8156409 | 2010-10-08 23:06:24 +0000 | [diff] [blame] | 413 | ctx.load_cert_chain(SVN_PYTHON_ORG_ROOT_CERT, ONLYKEY) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 414 | |
| 415 | def test_load_verify_locations(self): |
| 416 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
| 417 | ctx.load_verify_locations(CERTFILE) |
| 418 | ctx.load_verify_locations(cafile=CERTFILE, capath=None) |
| 419 | ctx.load_verify_locations(BYTES_CERTFILE) |
| 420 | ctx.load_verify_locations(cafile=BYTES_CERTFILE, capath=None) |
| 421 | self.assertRaises(TypeError, ctx.load_verify_locations) |
| 422 | self.assertRaises(TypeError, ctx.load_verify_locations, None, None) |
Giampaolo Rodolà | 4a656eb | 2010-08-29 22:50:39 +0000 | [diff] [blame] | 423 | with self.assertRaises(IOError) as cm: |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 424 | ctx.load_verify_locations(WRONGCERT) |
Giampaolo Rodolà | 4a656eb | 2010-08-29 22:50:39 +0000 | [diff] [blame] | 425 | self.assertEqual(cm.exception.errno, errno.ENOENT) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 426 | with self.assertRaisesRegex(ssl.SSLError, "PEM lib"): |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 427 | ctx.load_verify_locations(BADCERT) |
| 428 | ctx.load_verify_locations(CERTFILE, CAPATH) |
| 429 | ctx.load_verify_locations(CERTFILE, capath=BYTES_CAPATH) |
| 430 | |
Victor Stinner | 80f75e6 | 2011-01-29 11:31:20 +0000 | [diff] [blame] | 431 | # Issue #10989: crash if the second argument type is invalid |
| 432 | self.assertRaises(TypeError, ctx.load_verify_locations, None, True) |
| 433 | |
Antoine Pitrou | eb585ad | 2010-10-22 18:24:20 +0000 | [diff] [blame] | 434 | @skip_if_broken_ubuntu_ssl |
Antoine Pitrou | b0182c8 | 2010-10-12 20:09:02 +0000 | [diff] [blame] | 435 | def test_session_stats(self): |
| 436 | for proto in PROTOCOLS: |
| 437 | ctx = ssl.SSLContext(proto) |
| 438 | self.assertEqual(ctx.session_stats(), { |
| 439 | 'number': 0, |
| 440 | 'connect': 0, |
| 441 | 'connect_good': 0, |
| 442 | 'connect_renegotiate': 0, |
| 443 | 'accept': 0, |
| 444 | 'accept_good': 0, |
| 445 | 'accept_renegotiate': 0, |
| 446 | 'hits': 0, |
| 447 | 'misses': 0, |
| 448 | 'timeouts': 0, |
| 449 | 'cache_full': 0, |
| 450 | }) |
| 451 | |
Antoine Pitrou | 664c2d1 | 2010-11-17 20:29:42 +0000 | [diff] [blame] | 452 | def test_set_default_verify_paths(self): |
| 453 | # There's not much we can do to test that it acts as expected, |
| 454 | # so just check it doesn't crash or raise an exception. |
| 455 | ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) |
| 456 | ctx.set_default_verify_paths() |
| 457 | |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 458 | |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 459 | class NetworkedTests(unittest.TestCase): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 460 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 461 | def test_connect(self): |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 462 | with support.transient_internet("svn.python.org"): |
| 463 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
| 464 | cert_reqs=ssl.CERT_NONE) |
| 465 | try: |
| 466 | s.connect(("svn.python.org", 443)) |
| 467 | self.assertEqual({}, s.getpeercert()) |
| 468 | finally: |
| 469 | s.close() |
| 470 | |
| 471 | # this should fail because we have no verification certs |
| 472 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
| 473 | cert_reqs=ssl.CERT_REQUIRED) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 474 | self.assertRaisesRegex(ssl.SSLError, "certificate verify failed", |
| 475 | s.connect, ("svn.python.org", 443)) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 476 | s.close() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 477 | |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 478 | # this should succeed because we specify the root cert |
| 479 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
| 480 | cert_reqs=ssl.CERT_REQUIRED, |
| 481 | ca_certs=SVN_PYTHON_ORG_ROOT_CERT) |
| 482 | try: |
| 483 | s.connect(("svn.python.org", 443)) |
| 484 | self.assertTrue(s.getpeercert()) |
| 485 | finally: |
| 486 | s.close() |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 487 | |
Antoine Pitrou | e93bf7a | 2011-02-26 23:24:06 +0000 | [diff] [blame] | 488 | def test_connect_ex(self): |
| 489 | # Issue #11326: check connect_ex() implementation |
| 490 | with support.transient_internet("svn.python.org"): |
| 491 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
| 492 | cert_reqs=ssl.CERT_REQUIRED, |
| 493 | ca_certs=SVN_PYTHON_ORG_ROOT_CERT) |
| 494 | try: |
| 495 | self.assertEqual(0, s.connect_ex(("svn.python.org", 443))) |
| 496 | self.assertTrue(s.getpeercert()) |
| 497 | finally: |
| 498 | s.close() |
| 499 | |
| 500 | def test_non_blocking_connect_ex(self): |
| 501 | # Issue #11326: non-blocking connect_ex() should allow handshake |
| 502 | # to proceed after the socket gets ready. |
| 503 | with support.transient_internet("svn.python.org"): |
| 504 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
| 505 | cert_reqs=ssl.CERT_REQUIRED, |
| 506 | ca_certs=SVN_PYTHON_ORG_ROOT_CERT, |
| 507 | do_handshake_on_connect=False) |
| 508 | try: |
| 509 | s.setblocking(False) |
| 510 | rc = s.connect_ex(('svn.python.org', 443)) |
Antoine Pitrou | 8a14a0c | 2011-02-27 15:44:12 +0000 | [diff] [blame] | 511 | # EWOULDBLOCK under Windows, EINPROGRESS elsewhere |
| 512 | self.assertIn(rc, (0, errno.EINPROGRESS, errno.EWOULDBLOCK)) |
Antoine Pitrou | e93bf7a | 2011-02-26 23:24:06 +0000 | [diff] [blame] | 513 | # Wait for connect to finish |
| 514 | select.select([], [s], [], 5.0) |
| 515 | # Non-blocking handshake |
| 516 | while True: |
| 517 | try: |
| 518 | s.do_handshake() |
| 519 | break |
| 520 | except ssl.SSLError as err: |
| 521 | if err.args[0] == ssl.SSL_ERROR_WANT_READ: |
| 522 | select.select([s], [], [], 5.0) |
| 523 | elif err.args[0] == ssl.SSL_ERROR_WANT_WRITE: |
| 524 | select.select([], [s], [], 5.0) |
| 525 | else: |
| 526 | raise |
| 527 | # SSL established |
| 528 | self.assertTrue(s.getpeercert()) |
| 529 | finally: |
| 530 | s.close() |
| 531 | |
Antoine Pitrou | b4410db | 2011-05-18 18:51:06 +0200 | [diff] [blame] | 532 | def test_timeout_connect_ex(self): |
| 533 | # Issue #12065: on a timeout, connect_ex() should return the original |
| 534 | # errno (mimicking the behaviour of non-SSL sockets). |
| 535 | with support.transient_internet("svn.python.org"): |
| 536 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
| 537 | cert_reqs=ssl.CERT_REQUIRED, |
| 538 | ca_certs=SVN_PYTHON_ORG_ROOT_CERT, |
| 539 | do_handshake_on_connect=False) |
| 540 | try: |
| 541 | s.settimeout(0.0000001) |
| 542 | rc = s.connect_ex(('svn.python.org', 443)) |
| 543 | if rc == 0: |
| 544 | self.skipTest("svn.python.org responded too quickly") |
| 545 | self.assertIn(rc, (errno.EAGAIN, errno.EWOULDBLOCK)) |
| 546 | finally: |
| 547 | s.close() |
| 548 | |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 549 | def test_connect_with_context(self): |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 550 | with support.transient_internet("svn.python.org"): |
| 551 | # Same as test_connect, but with a separately created context |
| 552 | ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) |
| 553 | s = ctx.wrap_socket(socket.socket(socket.AF_INET)) |
| 554 | s.connect(("svn.python.org", 443)) |
| 555 | try: |
| 556 | self.assertEqual({}, s.getpeercert()) |
| 557 | finally: |
| 558 | s.close() |
Antoine Pitrou | d532321 | 2010-10-22 18:19:07 +0000 | [diff] [blame] | 559 | # Same with a server hostname |
| 560 | s = ctx.wrap_socket(socket.socket(socket.AF_INET), |
| 561 | server_hostname="svn.python.org") |
| 562 | if ssl.HAS_SNI: |
| 563 | s.connect(("svn.python.org", 443)) |
| 564 | s.close() |
| 565 | else: |
| 566 | self.assertRaises(ValueError, s.connect, ("svn.python.org", 443)) |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 567 | # This should fail because we have no verification certs |
| 568 | ctx.verify_mode = ssl.CERT_REQUIRED |
| 569 | s = ctx.wrap_socket(socket.socket(socket.AF_INET)) |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 570 | self.assertRaisesRegex(ssl.SSLError, "certificate verify failed", |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 571 | s.connect, ("svn.python.org", 443)) |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 572 | s.close() |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 573 | # This should succeed because we specify the root cert |
| 574 | ctx.load_verify_locations(SVN_PYTHON_ORG_ROOT_CERT) |
| 575 | s = ctx.wrap_socket(socket.socket(socket.AF_INET)) |
| 576 | s.connect(("svn.python.org", 443)) |
| 577 | try: |
| 578 | cert = s.getpeercert() |
| 579 | self.assertTrue(cert) |
| 580 | finally: |
| 581 | s.close() |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 582 | |
| 583 | def test_connect_capath(self): |
| 584 | # Verify server certificates using the `capath` argument |
Antoine Pitrou | 467f28d | 2010-05-16 19:22:44 +0000 | [diff] [blame] | 585 | # NOTE: the subject hashing algorithm has been changed between |
| 586 | # OpenSSL 0.9.8n and 1.0.0, as a result the capath directory must |
| 587 | # contain both versions of each certificate (same content, different |
Antoine Pitrou | d7e4c1c | 2010-05-17 14:13:10 +0000 | [diff] [blame] | 588 | # filename) for this test to be portable across OpenSSL releases. |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 589 | with support.transient_internet("svn.python.org"): |
| 590 | ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) |
| 591 | ctx.verify_mode = ssl.CERT_REQUIRED |
| 592 | ctx.load_verify_locations(capath=CAPATH) |
| 593 | s = ctx.wrap_socket(socket.socket(socket.AF_INET)) |
| 594 | s.connect(("svn.python.org", 443)) |
| 595 | try: |
| 596 | cert = s.getpeercert() |
| 597 | self.assertTrue(cert) |
| 598 | finally: |
| 599 | s.close() |
| 600 | # Same with a bytes `capath` argument |
| 601 | ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) |
| 602 | ctx.verify_mode = ssl.CERT_REQUIRED |
| 603 | ctx.load_verify_locations(capath=BYTES_CAPATH) |
| 604 | s = ctx.wrap_socket(socket.socket(socket.AF_INET)) |
| 605 | s.connect(("svn.python.org", 443)) |
| 606 | try: |
| 607 | cert = s.getpeercert() |
| 608 | self.assertTrue(cert) |
| 609 | finally: |
| 610 | s.close() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 611 | |
Antoine Pitrou | e322024 | 2010-04-24 11:13:53 +0000 | [diff] [blame] | 612 | @unittest.skipIf(os.name == "nt", "Can't use a socket as a file under Windows") |
| 613 | def test_makefile_close(self): |
| 614 | # Issue #5238: creating a file-like object with makefile() shouldn't |
| 615 | # delay closing the underlying "real socket" (here tested with its |
| 616 | # file descriptor, hence skipping the test under Windows). |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 617 | with support.transient_internet("svn.python.org"): |
| 618 | ss = ssl.wrap_socket(socket.socket(socket.AF_INET)) |
| 619 | ss.connect(("svn.python.org", 443)) |
| 620 | fd = ss.fileno() |
| 621 | f = ss.makefile() |
| 622 | f.close() |
| 623 | # The fd is still open |
Antoine Pitrou | e322024 | 2010-04-24 11:13:53 +0000 | [diff] [blame] | 624 | os.read(fd, 0) |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 625 | # Closing the SSL socket should close the fd too |
| 626 | ss.close() |
| 627 | gc.collect() |
| 628 | with self.assertRaises(OSError) as e: |
| 629 | os.read(fd, 0) |
| 630 | self.assertEqual(e.exception.errno, errno.EBADF) |
Antoine Pitrou | e322024 | 2010-04-24 11:13:53 +0000 | [diff] [blame] | 631 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 632 | def test_non_blocking_handshake(self): |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 633 | with support.transient_internet("svn.python.org"): |
| 634 | s = socket.socket(socket.AF_INET) |
| 635 | s.connect(("svn.python.org", 443)) |
| 636 | s.setblocking(False) |
| 637 | s = ssl.wrap_socket(s, |
| 638 | cert_reqs=ssl.CERT_NONE, |
| 639 | do_handshake_on_connect=False) |
| 640 | count = 0 |
| 641 | while True: |
| 642 | try: |
| 643 | count += 1 |
| 644 | s.do_handshake() |
| 645 | break |
| 646 | except ssl.SSLError as err: |
| 647 | if err.args[0] == ssl.SSL_ERROR_WANT_READ: |
| 648 | select.select([s], [], []) |
| 649 | elif err.args[0] == ssl.SSL_ERROR_WANT_WRITE: |
| 650 | select.select([], [s], []) |
| 651 | else: |
| 652 | raise |
| 653 | s.close() |
| 654 | if support.verbose: |
| 655 | sys.stdout.write("\nNeeded %d calls to do_handshake() to establish session.\n" % count) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 656 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 657 | def test_get_server_certificate(self): |
Antoine Pitrou | 15399c3 | 2011-04-28 19:23:55 +0200 | [diff] [blame] | 658 | def _test_get_server_certificate(host, port, cert=None): |
| 659 | with support.transient_internet(host): |
| 660 | pem = ssl.get_server_certificate((host, port)) |
| 661 | if not pem: |
| 662 | self.fail("No server certificate on %s:%s!" % (host, port)) |
Antoine Pitrou | 5aefa66 | 2011-04-28 19:24:46 +0200 | [diff] [blame] | 663 | |
Antoine Pitrou | 15399c3 | 2011-04-28 19:23:55 +0200 | [diff] [blame] | 664 | try: |
| 665 | pem = ssl.get_server_certificate((host, port), ca_certs=CERTFILE) |
| 666 | except ssl.SSLError as x: |
| 667 | #should fail |
| 668 | if support.verbose: |
| 669 | sys.stdout.write("%s\n" % x) |
| 670 | else: |
Antoine Pitrou | 5aefa66 | 2011-04-28 19:24:46 +0200 | [diff] [blame] | 671 | self.fail("Got server certificate %s for %s:%s!" % (pem, host, port)) |
| 672 | |
Antoine Pitrou | 15399c3 | 2011-04-28 19:23:55 +0200 | [diff] [blame] | 673 | pem = ssl.get_server_certificate((host, port), ca_certs=cert) |
| 674 | if not pem: |
Antoine Pitrou | 5aefa66 | 2011-04-28 19:24:46 +0200 | [diff] [blame] | 675 | self.fail("No server certificate on %s:%s!" % (host, port)) |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 676 | if support.verbose: |
Antoine Pitrou | 5aefa66 | 2011-04-28 19:24:46 +0200 | [diff] [blame] | 677 | sys.stdout.write("\nVerified certificate for %s:%s is\n%s\n" % (host, port ,pem)) |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 678 | |
Antoine Pitrou | 15399c3 | 2011-04-28 19:23:55 +0200 | [diff] [blame] | 679 | _test_get_server_certificate('svn.python.org', 443, SVN_PYTHON_ORG_ROOT_CERT) |
| 680 | if support.IPV6_ENABLED: |
| 681 | _test_get_server_certificate('ipv6.google.com', 443) |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 682 | |
Antoine Pitrou | f4c7bad | 2010-08-15 23:02:22 +0000 | [diff] [blame] | 683 | def test_ciphers(self): |
| 684 | remote = ("svn.python.org", 443) |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 685 | with support.transient_internet(remote[0]): |
Antoine Pitrou | f4c7bad | 2010-08-15 23:02:22 +0000 | [diff] [blame] | 686 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 687 | cert_reqs=ssl.CERT_NONE, ciphers="ALL") |
Antoine Pitrou | f4c7bad | 2010-08-15 23:02:22 +0000 | [diff] [blame] | 688 | s.connect(remote) |
Antoine Pitrou | 350c722 | 2010-09-09 13:31:46 +0000 | [diff] [blame] | 689 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
| 690 | cert_reqs=ssl.CERT_NONE, ciphers="DEFAULT") |
| 691 | s.connect(remote) |
| 692 | # Error checking can happen at instantiation or when connecting |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 693 | with self.assertRaisesRegex(ssl.SSLError, "No cipher can be selected"): |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 694 | with socket.socket(socket.AF_INET) as sock: |
| 695 | s = ssl.wrap_socket(sock, |
| 696 | cert_reqs=ssl.CERT_NONE, ciphers="^$:,;?*'dorothyx") |
| 697 | s.connect(remote) |
Antoine Pitrou | f4c7bad | 2010-08-15 23:02:22 +0000 | [diff] [blame] | 698 | |
Antoine Pitrou | fec12ff | 2010-04-21 19:46:23 +0000 | [diff] [blame] | 699 | def test_algorithms(self): |
| 700 | # Issue #8484: all algorithms should be available when verifying a |
| 701 | # certificate. |
Antoine Pitrou | 29619b2 | 2010-04-22 18:43:31 +0000 | [diff] [blame] | 702 | # SHA256 was added in OpenSSL 0.9.8 |
| 703 | if ssl.OPENSSL_VERSION_INFO < (0, 9, 8, 0, 15): |
| 704 | self.skipTest("SHA256 not available on %r" % ssl.OPENSSL_VERSION) |
Victor Stinner | f332abb | 2011-01-08 03:16:05 +0000 | [diff] [blame] | 705 | # https://sha2.hboeck.de/ was used until 2011-01-08 (no route to host) |
| 706 | remote = ("sha256.tbs-internet.com", 443) |
Antoine Pitrou | fec12ff | 2010-04-21 19:46:23 +0000 | [diff] [blame] | 707 | sha256_cert = os.path.join(os.path.dirname(__file__), "sha256.pem") |
Antoine Pitrou | 160fd93 | 2011-01-08 10:23:29 +0000 | [diff] [blame] | 708 | with support.transient_internet("sha256.tbs-internet.com"): |
Antoine Pitrou | a88c83c | 2010-09-07 20:42:19 +0000 | [diff] [blame] | 709 | s = ssl.wrap_socket(socket.socket(socket.AF_INET), |
| 710 | cert_reqs=ssl.CERT_REQUIRED, |
| 711 | ca_certs=sha256_cert,) |
Antoine Pitrou | fec12ff | 2010-04-21 19:46:23 +0000 | [diff] [blame] | 712 | try: |
| 713 | s.connect(remote) |
| 714 | if support.verbose: |
| 715 | sys.stdout.write("\nCipher with %r is %r\n" % |
| 716 | (remote, s.cipher())) |
| 717 | sys.stdout.write("Certificate is:\n%s\n" % |
| 718 | pprint.pformat(s.getpeercert())) |
| 719 | finally: |
| 720 | s.close() |
| 721 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 722 | |
| 723 | try: |
| 724 | import threading |
| 725 | except ImportError: |
| 726 | _have_threads = False |
| 727 | else: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 728 | _have_threads = True |
| 729 | |
Antoine Pitrou | 803e6d6 | 2010-10-13 10:36:15 +0000 | [diff] [blame] | 730 | from test.ssl_servers import make_https_server |
| 731 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 732 | class ThreadedEchoServer(threading.Thread): |
| 733 | |
| 734 | class ConnectionHandler(threading.Thread): |
| 735 | |
| 736 | """A mildly complicated class, because we want it to work both |
| 737 | with and without the SSL wrapper around the socket connection, so |
| 738 | that we can test the STARTTLS functionality.""" |
| 739 | |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 740 | def __init__(self, server, connsock, addr): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 741 | self.server = server |
| 742 | self.running = False |
| 743 | self.sock = connsock |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 744 | self.addr = addr |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 745 | self.sock.setblocking(1) |
| 746 | self.sslconn = None |
| 747 | threading.Thread.__init__(self) |
Benjamin Peterson | 4171da5 | 2008-08-18 21:11:09 +0000 | [diff] [blame] | 748 | self.daemon = True |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 749 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 750 | def wrap_conn(self): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 751 | try: |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 752 | self.sslconn = self.server.context.wrap_socket( |
| 753 | self.sock, server_side=True) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 754 | except ssl.SSLError: |
| 755 | # XXX Various errors can have happened here, for example |
| 756 | # a mismatching protocol version, an invalid certificate, |
| 757 | # or a low-level bug. This should be made more discriminating. |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 758 | if self.server.chatty: |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 759 | handle_error("\n server: bad connection attempt from " + repr(self.addr) + ":\n") |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 760 | self.running = False |
| 761 | self.server.stop() |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 762 | self.close() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 763 | return False |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 764 | else: |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 765 | if self.server.context.verify_mode == ssl.CERT_REQUIRED: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 766 | cert = self.sslconn.getpeercert() |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 767 | if support.verbose and self.server.chatty: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 768 | sys.stdout.write(" client cert is " + pprint.pformat(cert) + "\n") |
| 769 | cert_binary = self.sslconn.getpeercert(True) |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 770 | if support.verbose and self.server.chatty: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 771 | sys.stdout.write(" cert binary is " + str(len(cert_binary)) + " bytes\n") |
| 772 | cipher = self.sslconn.cipher() |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 773 | if support.verbose and self.server.chatty: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 774 | sys.stdout.write(" server: connection cipher is now " + str(cipher) + "\n") |
| 775 | return True |
| 776 | |
| 777 | def read(self): |
| 778 | if self.sslconn: |
| 779 | return self.sslconn.read() |
| 780 | else: |
| 781 | return self.sock.recv(1024) |
| 782 | |
| 783 | def write(self, bytes): |
| 784 | if self.sslconn: |
| 785 | return self.sslconn.write(bytes) |
| 786 | else: |
| 787 | return self.sock.send(bytes) |
| 788 | |
| 789 | def close(self): |
| 790 | if self.sslconn: |
| 791 | self.sslconn.close() |
| 792 | else: |
| 793 | self.sock.close() |
| 794 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 795 | def run(self): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 796 | self.running = True |
| 797 | if not self.server.starttls_server: |
| 798 | if not self.wrap_conn(): |
| 799 | return |
| 800 | while self.running: |
| 801 | try: |
| 802 | msg = self.read() |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 803 | stripped = msg.strip() |
| 804 | if not stripped: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 805 | # eof, so quit this handler |
| 806 | self.running = False |
| 807 | self.close() |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 808 | elif stripped == b'over': |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 809 | if support.verbose and self.server.connectionchatty: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 810 | sys.stdout.write(" server: client closed connection\n") |
| 811 | self.close() |
| 812 | return |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 813 | elif (self.server.starttls_server and |
Antoine Pitrou | 764b878 | 2010-04-28 22:57:15 +0000 | [diff] [blame] | 814 | stripped == b'STARTTLS'): |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 815 | if support.verbose and self.server.connectionchatty: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 816 | sys.stdout.write(" server: read STARTTLS from client, sending OK...\n") |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 817 | self.write(b"OK\n") |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 818 | if not self.wrap_conn(): |
| 819 | return |
Bill Janssen | 40a0f66 | 2008-08-12 16:56:25 +0000 | [diff] [blame] | 820 | elif (self.server.starttls_server and self.sslconn |
Antoine Pitrou | 764b878 | 2010-04-28 22:57:15 +0000 | [diff] [blame] | 821 | and stripped == b'ENDTLS'): |
Bill Janssen | 40a0f66 | 2008-08-12 16:56:25 +0000 | [diff] [blame] | 822 | if support.verbose and self.server.connectionchatty: |
| 823 | sys.stdout.write(" server: read ENDTLS from client, sending OK...\n") |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 824 | self.write(b"OK\n") |
Bill Janssen | 40a0f66 | 2008-08-12 16:56:25 +0000 | [diff] [blame] | 825 | self.sock = self.sslconn.unwrap() |
| 826 | self.sslconn = None |
| 827 | if support.verbose and self.server.connectionchatty: |
| 828 | sys.stdout.write(" server: connection is now unencrypted...\n") |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 829 | else: |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 830 | if (support.verbose and |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 831 | self.server.connectionchatty): |
| 832 | ctype = (self.sslconn and "encrypted") or "unencrypted" |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 833 | sys.stdout.write(" server: read %r (%s), sending back %r (%s)...\n" |
| 834 | % (msg, ctype, msg.lower(), ctype)) |
| 835 | self.write(msg.lower()) |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 836 | except socket.error: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 837 | if self.server.chatty: |
| 838 | handle_error("Test server failure:\n") |
| 839 | self.close() |
| 840 | self.running = False |
| 841 | # normally, we'd just stop here, but for the test |
| 842 | # harness, we want to stop the server |
| 843 | self.server.stop() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 844 | |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 845 | def __init__(self, certificate=None, ssl_version=None, |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 846 | certreqs=None, cacerts=None, |
Antoine Pitrou | 2d9cb9c | 2010-04-17 17:40:45 +0000 | [diff] [blame] | 847 | chatty=True, connectionchatty=False, starttls_server=False, |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 848 | ciphers=None, context=None): |
| 849 | if context: |
| 850 | self.context = context |
| 851 | else: |
| 852 | self.context = ssl.SSLContext(ssl_version |
| 853 | if ssl_version is not None |
| 854 | else ssl.PROTOCOL_TLSv1) |
| 855 | self.context.verify_mode = (certreqs if certreqs is not None |
| 856 | else ssl.CERT_NONE) |
| 857 | if cacerts: |
| 858 | self.context.load_verify_locations(cacerts) |
| 859 | if certificate: |
| 860 | self.context.load_cert_chain(certificate) |
| 861 | if ciphers: |
| 862 | self.context.set_ciphers(ciphers) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 863 | self.chatty = chatty |
| 864 | self.connectionchatty = connectionchatty |
| 865 | self.starttls_server = starttls_server |
| 866 | self.sock = socket.socket() |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 867 | self.port = support.bind_port(self.sock) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 868 | self.flag = None |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 869 | self.active = False |
| 870 | threading.Thread.__init__(self) |
Benjamin Peterson | 4171da5 | 2008-08-18 21:11:09 +0000 | [diff] [blame] | 871 | self.daemon = True |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 872 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 873 | def start(self, flag=None): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 874 | self.flag = flag |
| 875 | threading.Thread.start(self) |
| 876 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 877 | def run(self): |
Antoine Pitrou | af7c602 | 2010-04-27 09:56:02 +0000 | [diff] [blame] | 878 | self.sock.settimeout(0.05) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 879 | self.sock.listen(5) |
| 880 | self.active = True |
| 881 | if self.flag: |
| 882 | # signal an event |
| 883 | self.flag.set() |
| 884 | while self.active: |
| 885 | try: |
| 886 | newconn, connaddr = self.sock.accept() |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 887 | if support.verbose and self.chatty: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 888 | sys.stdout.write(' server: new connection from ' |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 889 | + repr(connaddr) + '\n') |
| 890 | handler = self.ConnectionHandler(self, newconn, connaddr) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 891 | handler.start() |
| 892 | except socket.timeout: |
| 893 | pass |
| 894 | except KeyboardInterrupt: |
| 895 | self.stop() |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 896 | self.sock.close() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 897 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 898 | def stop(self): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 899 | self.active = False |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 900 | |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 901 | class AsyncoreEchoServer(threading.Thread): |
| 902 | |
| 903 | # this one's based on asyncore.dispatcher |
| 904 | |
| 905 | class EchoServer (asyncore.dispatcher): |
| 906 | |
| 907 | class ConnectionHandler (asyncore.dispatcher_with_send): |
| 908 | |
| 909 | def __init__(self, conn, certfile): |
| 910 | self.socket = ssl.wrap_socket(conn, server_side=True, |
| 911 | certfile=certfile, |
| 912 | do_handshake_on_connect=False) |
| 913 | asyncore.dispatcher_with_send.__init__(self, self.socket) |
Antoine Pitrou | d3f8ab8 | 2010-04-24 21:26:44 +0000 | [diff] [blame] | 914 | self._ssl_accepting = True |
| 915 | self._do_ssl_handshake() |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 916 | |
| 917 | def readable(self): |
| 918 | if isinstance(self.socket, ssl.SSLSocket): |
| 919 | while self.socket.pending() > 0: |
| 920 | self.handle_read_event() |
| 921 | return True |
| 922 | |
Antoine Pitrou | d3f8ab8 | 2010-04-24 21:26:44 +0000 | [diff] [blame] | 923 | def _do_ssl_handshake(self): |
| 924 | try: |
| 925 | self.socket.do_handshake() |
| 926 | except ssl.SSLError as err: |
| 927 | if err.args[0] in (ssl.SSL_ERROR_WANT_READ, |
| 928 | ssl.SSL_ERROR_WANT_WRITE): |
| 929 | return |
| 930 | elif err.args[0] == ssl.SSL_ERROR_EOF: |
| 931 | return self.handle_close() |
| 932 | raise |
| 933 | except socket.error as err: |
| 934 | if err.args[0] == errno.ECONNABORTED: |
| 935 | return self.handle_close() |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 936 | else: |
Antoine Pitrou | d3f8ab8 | 2010-04-24 21:26:44 +0000 | [diff] [blame] | 937 | self._ssl_accepting = False |
| 938 | |
| 939 | def handle_read(self): |
| 940 | if self._ssl_accepting: |
| 941 | self._do_ssl_handshake() |
| 942 | else: |
| 943 | data = self.recv(1024) |
| 944 | if support.verbose: |
| 945 | sys.stdout.write(" server: read %s from client\n" % repr(data)) |
| 946 | if not data: |
| 947 | self.close() |
| 948 | else: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 949 | self.send(data.lower()) |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 950 | |
| 951 | def handle_close(self): |
Bill Janssen | 2f5799b | 2008-06-29 00:08:12 +0000 | [diff] [blame] | 952 | self.close() |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 953 | if support.verbose: |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 954 | sys.stdout.write(" server: closed connection %s\n" % self.socket) |
| 955 | |
| 956 | def handle_error(self): |
| 957 | raise |
| 958 | |
Antoine Pitrou | 773b5db | 2010-04-27 08:53:36 +0000 | [diff] [blame] | 959 | def __init__(self, certfile): |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 960 | self.certfile = certfile |
Antoine Pitrou | 773b5db | 2010-04-27 08:53:36 +0000 | [diff] [blame] | 961 | sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) |
| 962 | self.port = support.bind_port(sock, '') |
| 963 | asyncore.dispatcher.__init__(self, sock) |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 964 | self.listen(5) |
| 965 | |
Giampaolo Rodolà | 977c707 | 2010-10-04 21:08:36 +0000 | [diff] [blame] | 966 | def handle_accepted(self, sock_obj, addr): |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 967 | if support.verbose: |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 968 | sys.stdout.write(" server: new connection from %s:%s\n" %addr) |
| 969 | self.ConnectionHandler(sock_obj, self.certfile) |
| 970 | |
| 971 | def handle_error(self): |
| 972 | raise |
| 973 | |
Trent Nelson | 7852000 | 2008-04-10 20:54:35 +0000 | [diff] [blame] | 974 | def __init__(self, certfile): |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 975 | self.flag = None |
| 976 | self.active = False |
Antoine Pitrou | 773b5db | 2010-04-27 08:53:36 +0000 | [diff] [blame] | 977 | self.server = self.EchoServer(certfile) |
| 978 | self.port = self.server.port |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 979 | threading.Thread.__init__(self) |
Benjamin Peterson | 4171da5 | 2008-08-18 21:11:09 +0000 | [diff] [blame] | 980 | self.daemon = True |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 981 | |
| 982 | def __str__(self): |
| 983 | return "<%s %s>" % (self.__class__.__name__, self.server) |
| 984 | |
| 985 | def start (self, flag=None): |
| 986 | self.flag = flag |
| 987 | threading.Thread.start(self) |
| 988 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 989 | def run(self): |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 990 | self.active = True |
| 991 | if self.flag: |
| 992 | self.flag.set() |
| 993 | while self.active: |
| 994 | try: |
| 995 | asyncore.loop(1) |
| 996 | except: |
| 997 | pass |
| 998 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 999 | def stop(self): |
Bill Janssen | 54cc54c | 2007-12-14 22:08:56 +0000 | [diff] [blame] | 1000 | self.active = False |
| 1001 | self.server.close() |
| 1002 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1003 | def bad_cert_test(certfile): |
| 1004 | """ |
| 1005 | Launch a server with CERT_REQUIRED, and check that trying to |
| 1006 | connect to it with the given client certificate fails. |
| 1007 | """ |
Trent Nelson | 7852000 | 2008-04-10 20:54:35 +0000 | [diff] [blame] | 1008 | server = ThreadedEchoServer(CERTFILE, |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1009 | certreqs=ssl.CERT_REQUIRED, |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1010 | cacerts=CERTFILE, chatty=False, |
| 1011 | connectionchatty=False) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1012 | flag = threading.Event() |
| 1013 | server.start(flag) |
| 1014 | # wait for it to start |
| 1015 | flag.wait() |
| 1016 | # try to connect |
| 1017 | try: |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1018 | try: |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 1019 | with socket.socket() as sock: |
| 1020 | s = ssl.wrap_socket(sock, |
| 1021 | certfile=certfile, |
| 1022 | ssl_version=ssl.PROTOCOL_TLSv1) |
| 1023 | s.connect((HOST, server.port)) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1024 | except ssl.SSLError as x: |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1025 | if support.verbose: |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1026 | sys.stdout.write("\nSSLError is %s\n" % x.args[1]) |
Antoine Pitrou | 05830aa | 2010-04-27 13:15:18 +0000 | [diff] [blame] | 1027 | except socket.error as x: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1028 | if support.verbose: |
Georg Brandl | b75b639 | 2010-10-24 14:20:22 +0000 | [diff] [blame] | 1029 | sys.stdout.write("\nsocket.error is %s\n" % x.args[1]) |
Giampaolo Rodolà | 745ab38 | 2010-08-29 19:25:49 +0000 | [diff] [blame] | 1030 | except IOError as x: |
Giampaolo Rodolà | cd9dfb9 | 2010-08-29 20:56:56 +0000 | [diff] [blame] | 1031 | if x.errno != errno.ENOENT: |
| 1032 | raise |
Giampaolo Rodolà | 745ab38 | 2010-08-29 19:25:49 +0000 | [diff] [blame] | 1033 | if support.verbose: |
Giampaolo Rodolà | cd9dfb9 | 2010-08-29 20:56:56 +0000 | [diff] [blame] | 1034 | sys.stdout.write("\IOError is %s\n" % str(x)) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1035 | else: |
Antoine Pitrou | d75b2a9 | 2010-05-06 14:15:10 +0000 | [diff] [blame] | 1036 | raise AssertionError("Use of invalid cert should have failed!") |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1037 | finally: |
| 1038 | server.stop() |
| 1039 | server.join() |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1040 | |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1041 | def server_params_test(client_context, server_context, indata=b"FOO\n", |
| 1042 | chatty=True, connectionchatty=False): |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1043 | """ |
| 1044 | Launch a server, connect a client to it and try various reads |
| 1045 | and writes. |
| 1046 | """ |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1047 | server = ThreadedEchoServer(context=server_context, |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1048 | chatty=chatty, |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1049 | connectionchatty=False) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1050 | flag = threading.Event() |
| 1051 | server.start(flag) |
| 1052 | # wait for it to start |
| 1053 | flag.wait() |
| 1054 | # try to connect |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1055 | try: |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1056 | s = client_context.wrap_socket(socket.socket()) |
Trent Nelson | 7852000 | 2008-04-10 20:54:35 +0000 | [diff] [blame] | 1057 | s.connect((HOST, server.port)) |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1058 | for arg in [indata, bytearray(indata), memoryview(indata)]: |
Antoine Pitrou | 7d7aede | 2009-11-25 18:55:32 +0000 | [diff] [blame] | 1059 | if connectionchatty: |
| 1060 | if support.verbose: |
| 1061 | sys.stdout.write( |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1062 | " client: sending %r...\n" % indata) |
Antoine Pitrou | 7d7aede | 2009-11-25 18:55:32 +0000 | [diff] [blame] | 1063 | s.write(arg) |
| 1064 | outdata = s.read() |
| 1065 | if connectionchatty: |
| 1066 | if support.verbose: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1067 | sys.stdout.write(" client: read %r\n" % outdata) |
Antoine Pitrou | 7d7aede | 2009-11-25 18:55:32 +0000 | [diff] [blame] | 1068 | if outdata != indata.lower(): |
Antoine Pitrou | d75b2a9 | 2010-05-06 14:15:10 +0000 | [diff] [blame] | 1069 | raise AssertionError( |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1070 | "bad data <<%r>> (%d) received; expected <<%r>> (%d)\n" |
| 1071 | % (outdata[:20], len(outdata), |
| 1072 | indata[:20].lower(), len(indata))) |
| 1073 | s.write(b"over\n") |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1074 | if connectionchatty: |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1075 | if support.verbose: |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1076 | sys.stdout.write(" client: closing connection.\n") |
| 1077 | s.close() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1078 | finally: |
| 1079 | server.stop() |
| 1080 | server.join() |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1081 | |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1082 | def try_protocol_combo(server_protocol, client_protocol, expect_success, |
| 1083 | certsreqs=None, server_options=0, client_options=0): |
Benjamin Peterson | 2a691a8 | 2008-03-31 01:51:45 +0000 | [diff] [blame] | 1084 | if certsreqs is None: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1085 | certsreqs = ssl.CERT_NONE |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1086 | certtype = { |
| 1087 | ssl.CERT_NONE: "CERT_NONE", |
| 1088 | ssl.CERT_OPTIONAL: "CERT_OPTIONAL", |
| 1089 | ssl.CERT_REQUIRED: "CERT_REQUIRED", |
| 1090 | }[certsreqs] |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1091 | if support.verbose: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1092 | formatstr = (expect_success and " %s->%s %s\n") or " {%s->%s} %s\n" |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1093 | sys.stdout.write(formatstr % |
| 1094 | (ssl.get_protocol_name(client_protocol), |
| 1095 | ssl.get_protocol_name(server_protocol), |
| 1096 | certtype)) |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1097 | client_context = ssl.SSLContext(client_protocol) |
| 1098 | client_context.options = ssl.OP_ALL | client_options |
| 1099 | server_context = ssl.SSLContext(server_protocol) |
| 1100 | server_context.options = ssl.OP_ALL | server_options |
| 1101 | for ctx in (client_context, server_context): |
| 1102 | ctx.verify_mode = certsreqs |
Antoine Pitrou | 2d9cb9c | 2010-04-17 17:40:45 +0000 | [diff] [blame] | 1103 | # NOTE: we must enable "ALL" ciphers, otherwise an SSLv23 client |
| 1104 | # will send an SSLv3 hello (rather than SSLv2) starting from |
| 1105 | # OpenSSL 1.0.0 (see issue #8322). |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1106 | ctx.set_ciphers("ALL") |
| 1107 | ctx.load_cert_chain(CERTFILE) |
| 1108 | ctx.load_verify_locations(CERTFILE) |
| 1109 | try: |
| 1110 | server_params_test(client_context, server_context, |
| 1111 | chatty=False, connectionchatty=False) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1112 | # Protocol mismatch can result in either an SSLError, or a |
| 1113 | # "Connection reset by peer" error. |
| 1114 | except ssl.SSLError: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1115 | if expect_success: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1116 | raise |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1117 | except socket.error as e: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1118 | if expect_success or e.errno != errno.ECONNRESET: |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1119 | raise |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1120 | else: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1121 | if not expect_success: |
Antoine Pitrou | d75b2a9 | 2010-05-06 14:15:10 +0000 | [diff] [blame] | 1122 | raise AssertionError( |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1123 | "Client protocol %s succeeded with server protocol %s!" |
| 1124 | % (ssl.get_protocol_name(client_protocol), |
| 1125 | ssl.get_protocol_name(server_protocol))) |
| 1126 | |
| 1127 | |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1128 | class ThreadedTests(unittest.TestCase): |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1129 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 1130 | @skip_if_broken_ubuntu_ssl |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1131 | def test_echo(self): |
| 1132 | """Basic test of an SSL client connecting to a server""" |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1133 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1134 | sys.stdout.write("\n") |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1135 | for protocol in PROTOCOLS: |
| 1136 | context = ssl.SSLContext(protocol) |
| 1137 | context.load_cert_chain(CERTFILE) |
| 1138 | server_params_test(context, context, |
| 1139 | chatty=True, connectionchatty=True) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1140 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1141 | def test_getpeercert(self): |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1142 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1143 | sys.stdout.write("\n") |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1144 | context = ssl.SSLContext(ssl.PROTOCOL_SSLv23) |
| 1145 | context.verify_mode = ssl.CERT_REQUIRED |
| 1146 | context.load_verify_locations(CERTFILE) |
| 1147 | context.load_cert_chain(CERTFILE) |
| 1148 | server = ThreadedEchoServer(context=context, chatty=False) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1149 | flag = threading.Event() |
| 1150 | server.start(flag) |
| 1151 | # wait for it to start |
| 1152 | flag.wait() |
| 1153 | # try to connect |
| 1154 | try: |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1155 | s = context.wrap_socket(socket.socket()) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1156 | s.connect((HOST, server.port)) |
| 1157 | cert = s.getpeercert() |
| 1158 | self.assertTrue(cert, "Can't get peer certificate.") |
| 1159 | cipher = s.cipher() |
| 1160 | if support.verbose: |
| 1161 | sys.stdout.write(pprint.pformat(cert) + '\n') |
| 1162 | sys.stdout.write("Connection cipher is " + str(cipher) + '.\n') |
| 1163 | if 'subject' not in cert: |
| 1164 | self.fail("No subject field in certificate: %s." % |
| 1165 | pprint.pformat(cert)) |
| 1166 | if ((('organizationName', 'Python Software Foundation'),) |
| 1167 | not in cert['subject']): |
| 1168 | self.fail( |
| 1169 | "Missing or invalid 'organizationName' field in certificate subject; " |
| 1170 | "should be 'Python Software Foundation'.") |
Antoine Pitrou | fb04691 | 2010-11-09 20:21:19 +0000 | [diff] [blame] | 1171 | self.assertIn('notBefore', cert) |
| 1172 | self.assertIn('notAfter', cert) |
| 1173 | before = ssl.cert_time_to_seconds(cert['notBefore']) |
| 1174 | after = ssl.cert_time_to_seconds(cert['notAfter']) |
| 1175 | self.assertLess(before, after) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1176 | s.close() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1177 | finally: |
| 1178 | server.stop() |
| 1179 | server.join() |
| 1180 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1181 | def test_empty_cert(self): |
| 1182 | """Connecting with an empty cert file""" |
| 1183 | bad_cert_test(os.path.join(os.path.dirname(__file__) or os.curdir, |
| 1184 | "nullcert.pem")) |
| 1185 | def test_malformed_cert(self): |
| 1186 | """Connecting with a badly formatted certificate (syntax error)""" |
| 1187 | bad_cert_test(os.path.join(os.path.dirname(__file__) or os.curdir, |
| 1188 | "badcert.pem")) |
| 1189 | def test_nonexisting_cert(self): |
| 1190 | """Connecting with a non-existing cert file""" |
| 1191 | bad_cert_test(os.path.join(os.path.dirname(__file__) or os.curdir, |
| 1192 | "wrongcert.pem")) |
| 1193 | def test_malformed_key(self): |
| 1194 | """Connecting with a badly formatted key (syntax error)""" |
| 1195 | bad_cert_test(os.path.join(os.path.dirname(__file__) or os.curdir, |
| 1196 | "badkey.pem")) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1197 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1198 | def test_rude_shutdown(self): |
| 1199 | """A brutal shutdown of an SSL server should raise an IOError |
| 1200 | in the client when attempting handshake. |
| 1201 | """ |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1202 | listener_ready = threading.Event() |
| 1203 | listener_gone = threading.Event() |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1204 | |
Antoine Pitrou | 773b5db | 2010-04-27 08:53:36 +0000 | [diff] [blame] | 1205 | s = socket.socket() |
| 1206 | port = support.bind_port(s, HOST) |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1207 | |
Antoine Pitrou | 773b5db | 2010-04-27 08:53:36 +0000 | [diff] [blame] | 1208 | # `listener` runs in a thread. It sits in an accept() until |
| 1209 | # the main thread connects. Then it rudely closes the socket, |
| 1210 | # and sets Event `listener_gone` to let the main thread know |
| 1211 | # the socket is gone. |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1212 | def listener(): |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1213 | s.listen(5) |
| 1214 | listener_ready.set() |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 1215 | newsock, addr = s.accept() |
| 1216 | newsock.close() |
Antoine Pitrou | 773b5db | 2010-04-27 08:53:36 +0000 | [diff] [blame] | 1217 | s.close() |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1218 | listener_gone.set() |
| 1219 | |
| 1220 | def connector(): |
| 1221 | listener_ready.wait() |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 1222 | with socket.socket() as c: |
| 1223 | c.connect((HOST, port)) |
| 1224 | listener_gone.wait() |
| 1225 | try: |
| 1226 | ssl_sock = ssl.wrap_socket(c) |
| 1227 | except IOError: |
| 1228 | pass |
| 1229 | else: |
| 1230 | self.fail('connecting to closed SSL socket should have failed') |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1231 | |
| 1232 | t = threading.Thread(target=listener) |
| 1233 | t.start() |
Antoine Pitrou | 773b5db | 2010-04-27 08:53:36 +0000 | [diff] [blame] | 1234 | try: |
| 1235 | connector() |
| 1236 | finally: |
| 1237 | t.join() |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1238 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 1239 | @skip_if_broken_ubuntu_ssl |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 1240 | @unittest.skipUnless(hasattr(ssl, 'PROTOCOL_SSLv2'), |
| 1241 | "OpenSSL is compiled without SSLv2 support") |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1242 | def test_protocol_sslv2(self): |
| 1243 | """Connecting to an SSLv2 server with various client options""" |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1244 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1245 | sys.stdout.write("\n") |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1246 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True) |
| 1247 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True, ssl.CERT_OPTIONAL) |
| 1248 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True, ssl.CERT_REQUIRED) |
| 1249 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv23, True) |
| 1250 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv3, False) |
| 1251 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLSv1, False) |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1252 | # SSLv23 client with specific SSL options |
| 1253 | if no_sslv2_implies_sslv3_hello(): |
| 1254 | # No SSLv2 => client will use an SSLv3 hello on recent OpenSSLs |
| 1255 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv23, False, |
| 1256 | client_options=ssl.OP_NO_SSLv2) |
| 1257 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv23, True, |
| 1258 | client_options=ssl.OP_NO_SSLv3) |
| 1259 | try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv23, True, |
| 1260 | client_options=ssl.OP_NO_TLSv1) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1261 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 1262 | @skip_if_broken_ubuntu_ssl |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1263 | def test_protocol_sslv23(self): |
| 1264 | """Connecting to an SSLv23 server with various client options""" |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1265 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1266 | sys.stdout.write("\n") |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 1267 | if hasattr(ssl, 'PROTOCOL_SSLv2'): |
| 1268 | try: |
| 1269 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv2, True) |
| 1270 | except (ssl.SSLError, socket.error) as x: |
| 1271 | # this fails on some older versions of OpenSSL (0.9.7l, for instance) |
| 1272 | if support.verbose: |
| 1273 | sys.stdout.write( |
| 1274 | " SSL2 client to SSL23 server test unexpectedly failed:\n %s\n" |
| 1275 | % str(x)) |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1276 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, True) |
| 1277 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True) |
| 1278 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, True) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1279 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1280 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, True, ssl.CERT_OPTIONAL) |
| 1281 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True, ssl.CERT_OPTIONAL) |
| 1282 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, True, ssl.CERT_OPTIONAL) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1283 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1284 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, True, ssl.CERT_REQUIRED) |
| 1285 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True, ssl.CERT_REQUIRED) |
| 1286 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, True, ssl.CERT_REQUIRED) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1287 | |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1288 | # Server with specific SSL options |
| 1289 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, False, |
| 1290 | server_options=ssl.OP_NO_SSLv3) |
| 1291 | # Will choose TLSv1 |
| 1292 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True, |
| 1293 | server_options=ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3) |
| 1294 | try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, False, |
| 1295 | server_options=ssl.OP_NO_TLSv1) |
| 1296 | |
| 1297 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 1298 | @skip_if_broken_ubuntu_ssl |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1299 | def test_protocol_sslv3(self): |
| 1300 | """Connecting to an SSLv3 server with various client options""" |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1301 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1302 | sys.stdout.write("\n") |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1303 | try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True) |
| 1304 | try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True, ssl.CERT_OPTIONAL) |
| 1305 | try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True, ssl.CERT_REQUIRED) |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 1306 | if hasattr(ssl, 'PROTOCOL_SSLv2'): |
| 1307 | try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv2, False) |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1308 | try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv23, False) |
| 1309 | try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_TLSv1, False) |
Antoine Pitrou | b521877 | 2010-05-21 09:56:06 +0000 | [diff] [blame] | 1310 | if no_sslv2_implies_sslv3_hello(): |
| 1311 | # No SSLv2 => client will use an SSLv3 hello on recent OpenSSLs |
| 1312 | try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv23, True, |
| 1313 | client_options=ssl.OP_NO_SSLv2) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1314 | |
Antoine Pitrou | 23df483 | 2010-08-04 17:14:06 +0000 | [diff] [blame] | 1315 | @skip_if_broken_ubuntu_ssl |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1316 | def test_protocol_tlsv1(self): |
| 1317 | """Connecting to a TLSv1 server with various client options""" |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1318 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1319 | sys.stdout.write("\n") |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1320 | try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True) |
| 1321 | try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True, ssl.CERT_OPTIONAL) |
| 1322 | try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True, ssl.CERT_REQUIRED) |
Victor Stinner | 3de4919 | 2011-05-09 00:42:58 +0200 | [diff] [blame] | 1323 | if hasattr(ssl, 'PROTOCOL_SSLv2'): |
| 1324 | try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv2, False) |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1325 | try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv3, False) |
| 1326 | try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv23, False) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1327 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1328 | def test_starttls(self): |
| 1329 | """Switching from clear text to encrypted and back again.""" |
| 1330 | msgs = (b"msg 1", b"MSG 2", b"STARTTLS", b"MSG 3", b"msg 4", b"ENDTLS", b"msg 5", b"msg 6") |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1331 | |
Trent Nelson | 7852000 | 2008-04-10 20:54:35 +0000 | [diff] [blame] | 1332 | server = ThreadedEchoServer(CERTFILE, |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1333 | ssl_version=ssl.PROTOCOL_TLSv1, |
| 1334 | starttls_server=True, |
| 1335 | chatty=True, |
| 1336 | connectionchatty=True) |
| 1337 | flag = threading.Event() |
| 1338 | server.start(flag) |
| 1339 | # wait for it to start |
| 1340 | flag.wait() |
| 1341 | # try to connect |
| 1342 | wrapped = False |
| 1343 | try: |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1344 | s = socket.socket() |
| 1345 | s.setblocking(1) |
| 1346 | s.connect((HOST, server.port)) |
| 1347 | if support.verbose: |
| 1348 | sys.stdout.write("\n") |
| 1349 | for indata in msgs: |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1350 | if support.verbose: |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1351 | sys.stdout.write( |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1352 | " client: sending %r...\n" % indata) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1353 | if wrapped: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1354 | conn.write(indata) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1355 | outdata = conn.read() |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1356 | else: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1357 | s.send(indata) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1358 | outdata = s.recv(1024) |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1359 | msg = outdata.strip().lower() |
| 1360 | if indata == b"STARTTLS" and msg.startswith(b"ok"): |
| 1361 | # STARTTLS ok, switch to secure mode |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1362 | if support.verbose: |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1363 | sys.stdout.write( |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1364 | " client: read %r from server, starting TLS...\n" |
| 1365 | % msg) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1366 | conn = ssl.wrap_socket(s, ssl_version=ssl.PROTOCOL_TLSv1) |
| 1367 | wrapped = True |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1368 | elif indata == b"ENDTLS" and msg.startswith(b"ok"): |
| 1369 | # ENDTLS ok, switch back to clear text |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1370 | if support.verbose: |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1371 | sys.stdout.write( |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1372 | " client: read %r from server, ending TLS...\n" |
| 1373 | % msg) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1374 | s = conn.unwrap() |
| 1375 | wrapped = False |
| 1376 | else: |
| 1377 | if support.verbose: |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1378 | sys.stdout.write( |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1379 | " client: read %r from server\n" % msg) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1380 | if support.verbose: |
| 1381 | sys.stdout.write(" client: closing connection.\n") |
| 1382 | if wrapped: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1383 | conn.write(b"over\n") |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1384 | else: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1385 | s.send(b"over\n") |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1386 | if wrapped: |
| 1387 | conn.close() |
| 1388 | else: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1389 | s.close() |
| 1390 | finally: |
| 1391 | server.stop() |
| 1392 | server.join() |
| 1393 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1394 | def test_socketserver(self): |
| 1395 | """Using a SocketServer to create and manage SSL connections.""" |
Antoine Pitrou | 803e6d6 | 2010-10-13 10:36:15 +0000 | [diff] [blame] | 1396 | server = make_https_server(self, CERTFILE) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1397 | # try to connect |
Antoine Pitrou | 803e6d6 | 2010-10-13 10:36:15 +0000 | [diff] [blame] | 1398 | if support.verbose: |
| 1399 | sys.stdout.write('\n') |
| 1400 | with open(CERTFILE, 'rb') as f: |
| 1401 | d1 = f.read() |
| 1402 | d2 = '' |
| 1403 | # now fetch the same data from the HTTPS server |
| 1404 | url = 'https://%s:%d/%s' % ( |
| 1405 | HOST, server.port, os.path.split(CERTFILE)[1]) |
| 1406 | f = urllib.request.urlopen(url) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1407 | try: |
Barry Warsaw | 820c120 | 2008-06-12 04:06:45 +0000 | [diff] [blame] | 1408 | dlen = f.info().get("content-length") |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1409 | if dlen and (int(dlen) > 0): |
| 1410 | d2 = f.read(int(dlen)) |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1411 | if support.verbose: |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1412 | sys.stdout.write( |
| 1413 | " client: read %d bytes from remote server '%s'\n" |
| 1414 | % (len(d2), server)) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1415 | finally: |
Antoine Pitrou | 803e6d6 | 2010-10-13 10:36:15 +0000 | [diff] [blame] | 1416 | f.close() |
| 1417 | self.assertEqual(d1, d2) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1418 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1419 | def test_asyncore_server(self): |
| 1420 | """Check the example asyncore integration.""" |
| 1421 | indata = "TEST MESSAGE of mixed case\n" |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1422 | |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1423 | if support.verbose: |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1424 | sys.stdout.write("\n") |
| 1425 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1426 | indata = b"FOO\n" |
Trent Nelson | 7852000 | 2008-04-10 20:54:35 +0000 | [diff] [blame] | 1427 | server = AsyncoreEchoServer(CERTFILE) |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1428 | flag = threading.Event() |
| 1429 | server.start(flag) |
| 1430 | # wait for it to start |
| 1431 | flag.wait() |
| 1432 | # try to connect |
| 1433 | try: |
| 1434 | s = ssl.wrap_socket(socket.socket()) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1435 | s.connect(('127.0.0.1', server.port)) |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1436 | if support.verbose: |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1437 | sys.stdout.write( |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1438 | " client: sending %r...\n" % indata) |
| 1439 | s.write(indata) |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1440 | outdata = s.read() |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1441 | if support.verbose: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1442 | sys.stdout.write(" client: read %r\n" % outdata) |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1443 | if outdata != indata.lower(): |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1444 | self.fail( |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1445 | "bad data <<%r>> (%d) received; expected <<%r>> (%d)\n" |
| 1446 | % (outdata[:20], len(outdata), |
| 1447 | indata[:20].lower(), len(indata))) |
| 1448 | s.write(b"over\n") |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1449 | if support.verbose: |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1450 | sys.stdout.write(" client: closing connection.\n") |
| 1451 | s.close() |
Antoine Pitrou | ed98636 | 2010-08-15 23:28:10 +0000 | [diff] [blame] | 1452 | if support.verbose: |
| 1453 | sys.stdout.write(" client: connection closed.\n") |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1454 | finally: |
Antoine Pitrou | ed98636 | 2010-08-15 23:28:10 +0000 | [diff] [blame] | 1455 | if support.verbose: |
| 1456 | sys.stdout.write(" cleanup: stopping server.\n") |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1457 | server.stop() |
Antoine Pitrou | ed98636 | 2010-08-15 23:28:10 +0000 | [diff] [blame] | 1458 | if support.verbose: |
| 1459 | sys.stdout.write(" cleanup: joining server thread.\n") |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1460 | server.join() |
Antoine Pitrou | ed98636 | 2010-08-15 23:28:10 +0000 | [diff] [blame] | 1461 | if support.verbose: |
| 1462 | sys.stdout.write(" cleanup: successfully joined.\n") |
Trent Nelson | 6b240cd | 2008-04-10 20:12:06 +0000 | [diff] [blame] | 1463 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1464 | def test_recv_send(self): |
| 1465 | """Test recv(), send() and friends.""" |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1466 | if support.verbose: |
| 1467 | sys.stdout.write("\n") |
| 1468 | |
| 1469 | server = ThreadedEchoServer(CERTFILE, |
| 1470 | certreqs=ssl.CERT_NONE, |
| 1471 | ssl_version=ssl.PROTOCOL_TLSv1, |
| 1472 | cacerts=CERTFILE, |
| 1473 | chatty=True, |
| 1474 | connectionchatty=False) |
| 1475 | flag = threading.Event() |
| 1476 | server.start(flag) |
| 1477 | # wait for it to start |
| 1478 | flag.wait() |
| 1479 | # try to connect |
Antoine Pitrou | 18c913e | 2010-04-27 10:59:39 +0000 | [diff] [blame] | 1480 | s = ssl.wrap_socket(socket.socket(), |
| 1481 | server_side=False, |
| 1482 | certfile=CERTFILE, |
| 1483 | ca_certs=CERTFILE, |
| 1484 | cert_reqs=ssl.CERT_NONE, |
| 1485 | ssl_version=ssl.PROTOCOL_TLSv1) |
| 1486 | s.connect((HOST, server.port)) |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1487 | try: |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1488 | # helper methods for standardising recv* method signatures |
| 1489 | def _recv_into(): |
| 1490 | b = bytearray(b"\0"*100) |
| 1491 | count = s.recv_into(b) |
| 1492 | return b[:count] |
| 1493 | |
| 1494 | def _recvfrom_into(): |
| 1495 | b = bytearray(b"\0"*100) |
| 1496 | count, addr = s.recvfrom_into(b) |
| 1497 | return b[:count] |
| 1498 | |
| 1499 | # (name, method, whether to expect success, *args) |
| 1500 | send_methods = [ |
| 1501 | ('send', s.send, True, []), |
| 1502 | ('sendto', s.sendto, False, ["some.address"]), |
| 1503 | ('sendall', s.sendall, True, []), |
| 1504 | ] |
| 1505 | recv_methods = [ |
| 1506 | ('recv', s.recv, True, []), |
| 1507 | ('recvfrom', s.recvfrom, False, ["some.address"]), |
| 1508 | ('recv_into', _recv_into, True, []), |
| 1509 | ('recvfrom_into', _recvfrom_into, False, []), |
| 1510 | ] |
| 1511 | data_prefix = "PREFIX_" |
| 1512 | |
| 1513 | for meth_name, send_meth, expect_success, args in send_methods: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1514 | indata = (data_prefix + meth_name).encode('ascii') |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1515 | try: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1516 | send_meth(indata, *args) |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1517 | outdata = s.read() |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1518 | if outdata != indata.lower(): |
Georg Brandl | 89fad14 | 2010-03-14 10:23:39 +0000 | [diff] [blame] | 1519 | self.fail( |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1520 | "While sending with <<{name:s}>> bad data " |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1521 | "<<{outdata:r}>> ({nout:d}) received; " |
| 1522 | "expected <<{indata:r}>> ({nin:d})\n".format( |
| 1523 | name=meth_name, outdata=outdata[:20], |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1524 | nout=len(outdata), |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1525 | indata=indata[:20], nin=len(indata) |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1526 | ) |
| 1527 | ) |
| 1528 | except ValueError as e: |
| 1529 | if expect_success: |
Georg Brandl | 89fad14 | 2010-03-14 10:23:39 +0000 | [diff] [blame] | 1530 | self.fail( |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1531 | "Failed to send with method <<{name:s}>>; " |
| 1532 | "expected to succeed.\n".format(name=meth_name) |
| 1533 | ) |
| 1534 | if not str(e).startswith(meth_name): |
Georg Brandl | 89fad14 | 2010-03-14 10:23:39 +0000 | [diff] [blame] | 1535 | self.fail( |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1536 | "Method <<{name:s}>> failed with unexpected " |
| 1537 | "exception message: {exp:s}\n".format( |
| 1538 | name=meth_name, exp=e |
| 1539 | ) |
| 1540 | ) |
| 1541 | |
| 1542 | for meth_name, recv_meth, expect_success, args in recv_methods: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1543 | indata = (data_prefix + meth_name).encode('ascii') |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1544 | try: |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1545 | s.send(indata) |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1546 | outdata = recv_meth(*args) |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1547 | if outdata != indata.lower(): |
Georg Brandl | 89fad14 | 2010-03-14 10:23:39 +0000 | [diff] [blame] | 1548 | self.fail( |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1549 | "While receiving with <<{name:s}>> bad data " |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1550 | "<<{outdata:r}>> ({nout:d}) received; " |
| 1551 | "expected <<{indata:r}>> ({nin:d})\n".format( |
| 1552 | name=meth_name, outdata=outdata[:20], |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1553 | nout=len(outdata), |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1554 | indata=indata[:20], nin=len(indata) |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1555 | ) |
| 1556 | ) |
| 1557 | except ValueError as e: |
| 1558 | if expect_success: |
Georg Brandl | 89fad14 | 2010-03-14 10:23:39 +0000 | [diff] [blame] | 1559 | self.fail( |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1560 | "Failed to receive with method <<{name:s}>>; " |
| 1561 | "expected to succeed.\n".format(name=meth_name) |
| 1562 | ) |
| 1563 | if not str(e).startswith(meth_name): |
Georg Brandl | 89fad14 | 2010-03-14 10:23:39 +0000 | [diff] [blame] | 1564 | self.fail( |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1565 | "Method <<{name:s}>> failed with unexpected " |
| 1566 | "exception message: {exp:s}\n".format( |
| 1567 | name=meth_name, exp=e |
| 1568 | ) |
| 1569 | ) |
| 1570 | # consume data |
| 1571 | s.read() |
| 1572 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1573 | s.write(b"over\n") |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1574 | s.close() |
| 1575 | finally: |
| 1576 | server.stop() |
| 1577 | server.join() |
| 1578 | |
Antoine Pitrou | d3f8ab8 | 2010-04-24 21:26:44 +0000 | [diff] [blame] | 1579 | def test_handshake_timeout(self): |
| 1580 | # Issue #5103: SSL handshake must respect the socket timeout |
| 1581 | server = socket.socket(socket.AF_INET) |
| 1582 | host = "127.0.0.1" |
| 1583 | port = support.bind_port(server) |
| 1584 | started = threading.Event() |
| 1585 | finish = False |
| 1586 | |
| 1587 | def serve(): |
| 1588 | server.listen(5) |
| 1589 | started.set() |
| 1590 | conns = [] |
| 1591 | while not finish: |
| 1592 | r, w, e = select.select([server], [], [], 0.1) |
| 1593 | if server in r: |
| 1594 | # Let the socket hang around rather than having |
| 1595 | # it closed by garbage collection. |
| 1596 | conns.append(server.accept()[0]) |
Antoine Pitrou | d2eca37 | 2010-10-29 23:41:37 +0000 | [diff] [blame] | 1597 | for sock in conns: |
| 1598 | sock.close() |
Antoine Pitrou | d3f8ab8 | 2010-04-24 21:26:44 +0000 | [diff] [blame] | 1599 | |
| 1600 | t = threading.Thread(target=serve) |
| 1601 | t.start() |
| 1602 | started.wait() |
| 1603 | |
| 1604 | try: |
Antoine Pitrou | 40f0874 | 2010-04-24 22:04:40 +0000 | [diff] [blame] | 1605 | try: |
| 1606 | c = socket.socket(socket.AF_INET) |
| 1607 | c.settimeout(0.2) |
| 1608 | c.connect((host, port)) |
| 1609 | # Will attempt handshake and time out |
Antoine Pitrou | c4df784 | 2010-12-03 19:59:41 +0000 | [diff] [blame] | 1610 | self.assertRaisesRegex(socket.timeout, "timed out", |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 1611 | ssl.wrap_socket, c) |
Antoine Pitrou | 40f0874 | 2010-04-24 22:04:40 +0000 | [diff] [blame] | 1612 | finally: |
| 1613 | c.close() |
Antoine Pitrou | d3f8ab8 | 2010-04-24 21:26:44 +0000 | [diff] [blame] | 1614 | try: |
| 1615 | c = socket.socket(socket.AF_INET) |
| 1616 | c = ssl.wrap_socket(c) |
| 1617 | c.settimeout(0.2) |
| 1618 | # Will attempt handshake and time out |
Antoine Pitrou | c4df784 | 2010-12-03 19:59:41 +0000 | [diff] [blame] | 1619 | self.assertRaisesRegex(socket.timeout, "timed out", |
Ezio Melotti | ed3a7d2 | 2010-12-01 02:32:32 +0000 | [diff] [blame] | 1620 | c.connect, (host, port)) |
Antoine Pitrou | d3f8ab8 | 2010-04-24 21:26:44 +0000 | [diff] [blame] | 1621 | finally: |
| 1622 | c.close() |
| 1623 | finally: |
| 1624 | finish = True |
| 1625 | t.join() |
| 1626 | server.close() |
| 1627 | |
Bill Janssen | 58afe4c | 2008-09-08 16:45:19 +0000 | [diff] [blame] | 1628 | |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1629 | def test_main(verbose=False): |
Antoine Pitrou | 15cee62 | 2010-08-04 16:45:21 +0000 | [diff] [blame] | 1630 | if support.verbose: |
| 1631 | plats = { |
| 1632 | 'Linux': platform.linux_distribution, |
| 1633 | 'Mac': platform.mac_ver, |
| 1634 | 'Windows': platform.win32_ver, |
| 1635 | } |
| 1636 | for name, func in plats.items(): |
| 1637 | plat = func() |
| 1638 | if plat and plat[0]: |
| 1639 | plat = '%s %r' % (name, plat) |
| 1640 | break |
| 1641 | else: |
| 1642 | plat = repr(platform.platform()) |
| 1643 | print("test_ssl: testing with %r %r" % |
| 1644 | (ssl.OPENSSL_VERSION, ssl.OPENSSL_VERSION_INFO)) |
| 1645 | print(" under %s" % plat) |
Antoine Pitrou | d532321 | 2010-10-22 18:19:07 +0000 | [diff] [blame] | 1646 | print(" HAS_SNI = %r" % ssl.HAS_SNI) |
Antoine Pitrou | 15cee62 | 2010-08-04 16:45:21 +0000 | [diff] [blame] | 1647 | |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 1648 | for filename in [ |
| 1649 | CERTFILE, SVN_PYTHON_ORG_ROOT_CERT, BYTES_CERTFILE, |
| 1650 | ONLYCERT, ONLYKEY, BYTES_ONLYCERT, BYTES_ONLYKEY, |
| 1651 | BADCERT, BADKEY, EMPTYCERT]: |
| 1652 | if not os.path.exists(filename): |
| 1653 | raise support.TestFailed("Can't read certificate file %r" % filename) |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1654 | |
Antoine Pitrou | 152efa2 | 2010-05-16 18:19:27 +0000 | [diff] [blame] | 1655 | tests = [ContextTests, BasicSocketTests] |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1656 | |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1657 | if support.is_resource_enabled('network'): |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1658 | tests.append(NetworkedTests) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1659 | |
Thomas Wouters | 1b7f891 | 2007-09-19 03:06:30 +0000 | [diff] [blame] | 1660 | if _have_threads: |
Benjamin Peterson | ee8712c | 2008-05-20 21:35:26 +0000 | [diff] [blame] | 1661 | thread_info = support.threading_setup() |
| 1662 | if thread_info and support.is_resource_enabled('network'): |
Bill Janssen | 6e027db | 2007-11-15 22:23:56 +0000 | [diff] [blame] | 1663 | tests.append(ThreadedTests) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1664 | |
Antoine Pitrou | 480a124 | 2010-04-28 21:37:09 +0000 | [diff] [blame] | 1665 | try: |
| 1666 | support.run_unittest(*tests) |
| 1667 | finally: |
| 1668 | if _have_threads: |
| 1669 | support.threading_cleanup(*thread_info) |
Thomas Wouters | ed03b41 | 2007-08-28 21:37:11 +0000 | [diff] [blame] | 1670 | |
| 1671 | if __name__ == "__main__": |
| 1672 | test_main() |