summaryrefslogtreecommitdiff
path: root/tests/test_ssl.py
Commit message (Collapse)AuthorAgeFilesLines
* Fix tests on Windows, add Windows CI (#1186)Maximilian Hils2023-02-131-28/+39
| | | | | * fix tests on Windows, add Windows CI * remove test safeguards from coverage
* Add support for DTLS timeouts (#1180)Jeremy Lainé2023-02-131-4/+42
| | | | | | | | | | | | Add support for DTLS timeouts When performing a DTLS handshake, the DTLS state machine may need to be updated based on the passage of time, for instance in response to packet loss. OpenSSL supports this by means of the `DTLSv1_get_timeout` and `DTLSv1_handle_timeout` methods, both of which are included in cryptography's bindings. This change adds Python wrappers for these methods in the `Connection` class.
* Fix CI (#1185)Maximilian Hils2023-02-131-2/+1
| | | | | * Reformat code using black 23.x * fix compat with tox 4
* Make some handshakes in tests less flaky. (#1163)Theodore Ni2022-12-021-12/+13
|
* disallow latest sphinx release because it doesn't work with sphinx_rtd_theme ↵Alex Gaynor2022-09-251-0/+2
| | | | | | | | | (#1147) * disallow latest sphinx release because it doesn't work with sphinx_rtd_theme * Update test_ssl.py * black
* add `Connection.use_(certificate|privatekey)` (#1121)Maximilian Hils2022-09-161-42/+71
| | | | | | | | | | | * add `Connection.use_(certificate|privatekey)` * bump minimum cryptography version * deduplicate tests * black! * max line length
* add `Connection.set_verify`, fix #255 (#1073)Maximilian Hils2022-05-131-0/+46
| | | | | | | | | | | * add `Connection.set_verify`, fix #255 * show that it works with cryptography main * Revert "show that it works with cryptography main" This reverts commit fb0136a8e5aa5d2c6e0c16f8f4ecee2f3c72a16b. * make it black
* repair CI (#1116)Paul Kehrer2022-05-111-12/+24
| | | | | | | | | | | | | | | | | | | | | * repair CI * more fixes * pypy39 requires latest cryptography * Apply suggestions from code review Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com> * use constant * bump minimum version * remove unneeded try * fix Co-authored-by: Alex Gaynor <alex.gaynor@gmail.com>
* Implement Context constructor in terms of new OpenSSL APIs (#1109)Alex Gaynor2022-03-141-3/+1
|
* flake8-import-order (#1099)whiteowl32022-03-021-85/+81
| | | | | | | | | | | * flake8-import-order * make sure bad import orders fail * flake8-import-order * add application name to flake8 section * correct import order for openssl as application
* Stop passing backend to cryptography (#1094)Alex Gaynor2022-02-131-7/+2
|
* Don’t inherit from object (#1084)lovetox2022-01-301-19/+19
| | | In python3 all classes inherit by default from object
* latest black (#1082)Paul Kehrer2022-01-291-4/+4
|
* Update variable name, there are now many linuxes (#1070)Alex Gaynor2021-12-241-4/+4
|
* Remove some more py27-isms (#1062)Alex Gaynor2021-11-241-7/+7
|
* Expose some DTLS-related features (#1026)Nathaniel J. Smith2021-11-021-2/+195
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Expose DTLS_METHOD and friends * Expose OP_NO_RENEGOTIATION * Expose DTLS MTU-related functions * Expose DTLSv1_listen and associated callbacks * Add a basic DTLS test * Cope with old versions of openssl/libressl * blacken * Soothe flake8 * Add temporary hack to skip DTLS test on old cryptography versions * Update for cryptography v35 release * Add changelog entry * Fix versionadded:: * get_cleartext_mtu doesn't exist on decrepit old openssl * Rewrite DTLS test to work around stupid OpenSSL misbehavior * flake8 go away * minor tidying
* Check for invalid ALPN lists before calling OpenSSL, for consistency (#1056)Nathaniel J. Smith2021-10-271-1/+1
| | | | | | | * Check for invalid ALPN lists before calling OpenSSL, for consistency Fixes gh-1043 * Soothe flake8
* py27 going, going, gone (#1047)Paul Kehrer2021-10-041-40/+10
| | | | | | | | | | | * py27 going, going, gone * black * more black * ok then * forgot to remove pypy2
* Attempt to test with system OpenSSL on recent Ubuntu (#1003)Alex Gaynor2021-03-191-2/+15
| | | | | * Attempt to test with system OpenSSL on recent Ubuntu * attempted fix for this test
* Add SSL_CTX_set_min_proto_version/SSL_CTX_set_max_proto_version bindings (#985)Maximilian Hils2021-03-101-1/+27
| | | | | | | | | | | | | | | | | | | * add Context.set_*_proto_version, fix #860 * docs: add new openssl tls methods * accept the fact that nothing can be taken for granted * bump minimum required cryptography version to 3.3 * drop support for Python 3.5 * use binary wheels for cryptography * Revert "use binary wheels for cryptography" This reverts commit 91a04c612ed1d0dd9fd541dfefe21cac7c25b1c1. * docker ci: compile cryptography with rust
* Check return code of SSL_[CTX_]set_alpn_protos (#993)Maximilian Hils2021-02-171-0/+9
| | | | | | | * check return code of SSL_CTX_set_alpn_protos, fix #992 * paint it black! * fix line lengths as well :upside_down_face:
* Keep reference to SSL verify_call in Connection object (#956)Arne Schwabe2020-11-271-0/+46
| | | | | | | | | | | | | | * Keep reference to SSL verify_call in Connection object If a set_verify is used on a context before and after a Connection the reference in the SSL* object still points to the old _verify_helper object. Since this object has no longer any references to it, the callback can result in a segfault. This commit fixes the issues by ensuring that as long as the Connection object/SSL* object lives a reference to the callback function is held. * Add Unit test for set_verify_callback deference
* Drop CI for OpenSSL 1.0.2 (#953)Alex Gaynor2020-10-261-11/+2
| | | | | | | * Drop CI for OpenSSL 1.0.2 * Delete code for coverage reasons * Bump minimum cryptography version
* I'm back in black (#941)Alex Gaynor2020-08-261-5/+16
|
* Context.set_verify: allow omission of callback (#933)Maximilian Hils2020-08-071-5/+26
| | | | | | | * Context.set_verify: allow omission of callback * squeeze to 80 chars * make it clear that default callback is used
* Allow accessing a connection's verfied certificate chain (#894)Shane Harvey2020-08-051-0/+57
| | | | | | | | | | | | | | | | | | | | | | | | | * Allow accessing a connection's verfied certificate chain Add X509StoreContext.get_verified_chain using X509_STORE_CTX_get1_chain. Add Connection.get_verified_chain using SSL_get0_verified_chain if available (ie OpenSSL 1.1+) and X509StoreContext.get_verified_chain otherwise. Fixes #740. * TLSv1_METHOD -> SSLv23_METHOD * Use X509_up_ref instead of X509_dup * Add _openssl_assert where appropriate * SSL_get_peer_cert_chain should not be null * Reformat with black * Fix <OpenSSL.crypto.X509 object at 0x7fdbb59e8050> != <OpenSSL.crypto.X509 object at 0x7fdbb59daad0> * Add Changelog entry * Remove _add_chain
* focal time (#929)Paul Kehrer2020-08-051-6/+7
| | | | | | | | | * focal time * larger dh params, assert on something * urllib3 fix * actually check an error
* remove npn support entirely. you should be using alpn (#932)Paul Kehrer2020-08-031-184/+0
| | | | | * remove npn support entirely. you should be using alpn * flake8
* use SSLv23_METHOD so we get "best TLS" in most tests. (#931)Paul Kehrer2020-08-031-135/+135
|
* use modern message digests (#930)Paul Kehrer2020-08-031-3/+3
|
* update cert fixtures and simplify tests (#927)Paul Kehrer2020-08-031-24/+17
| | | | | | | | | * simplify * generate new certs and keys with 3072-bit RSA * black * add a test to avoid losing coverage
* make our CI less frustrating (#926)Paul Kehrer2020-08-031-5/+5
| | | | | | | * make our CI less frustrating * sigh, even less sensitive * can we stop doing this on macos now?
* use larger keys in ssl tests (#922)Alex Gaynor2020-08-031-3/+3
|
* Add SSL.Context.set_keylog_callback (#910)Maximilian Hils2020-07-281-0/+31
| | | | | | | | | * add SSL.Context.set_keylog_callback * don't fail on missing attribute * lint! * make it black
* Paint it Black by the Rolling Stones (#920)Alex Gaynor2020-07-231-290/+445
|
* Fix generated test X.509 certificates. (#917)David Benjamin2020-06-241-0/+3
| | | | | | | | | | | From RFC 5280, section 4.1.2.9: [Extensions] MUST only appear if the version is 3 (Section 4.1.2.1). If present, this field is a SEQUENCE of one or more certificate extensions. The format and content of certificate extensions in the Internet PKI are defined in Section 4.2. X509 objects default to v1, so the test certs need a set_version(2) call. (Note v3 is encoded as 2.)
* Drop OpenSSL 1.0.1 (#908)Alex Gaynor2020-04-071-208/+187
|
* Make tests pass in the future (now the present) (#888)Alex Gaynor2020-01-121-3/+5
|
* ALPN: complete handshake without accepting a client's protocols. (#876)Mark Williams2019-11-181-1/+78
| | | | | | | | | | | | | | | | | | | | | | | | | * ALPN: complete handshake without accepting a client's protocols. The callback passed to `SSL_CTX_set_alpn_select_cb` can return `SSL_TLSEXT_ERR_NOACK` to allow the handshake to continue without accepting any of the client's offered protocols. This commit introduces `NO_OVERLAPPING_PROTOCOLS`, which the Python callback passed to `Context.set_alpn_select_callback` can return to achieve the same thing. It does not change the previous meaning of an empty string, which still terminates the handshake. * Update src/OpenSSL/SSL.py Co-Authored-By: Alex Gaynor <alex.gaynor@gmail.com> * Address @alex's review. * Use recorded value in test, fix lint error. * Cover TypeError branch in _ALPNHelper.callback
* use _ffi.from_buffer() to support bytearray (#852)Daniel Holth2019-11-181-2/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * use _ffi.from_buffer(buf) in send, to support bytearray * add bytearray test * update CHANGELOG.rst * move from_buffer before 'buffer too long' check * context-managed from_buffer + black * don't shadow buf in send() * test return count for sendall * test sending an array * fix test * also use from_buffer in bio_write * de-format _util.py * formatting * add simple bio_write tests * wrap line
* Fix for Python 4 (#862)Hugo van Kemenade2019-08-291-3/+3
| | | | | | * Fix for Python 4 * Fix for Python 4
* Mark this test as flaky (#850)Alex Gaynor2019-07-061-0/+3
|
* Remove tests of long functionality (#832)Alex Gaynor2019-05-191-117/+0
| | | These don't actually cover any code.
* Make test_ssl pass in an IPv6-only environment (#827)David Benjamin2019-04-151-20/+38
| | | | | | | | | | | | * Make test_ssl pass in an IPv6-only environment * Review comments * Update tests/test_ssl.py Co-Authored-By: davidben <davidben@davidben.net> * Wrap long line with parens.
* skip NPN tests if NPN is not available (#822)Paul Kehrer2019-02-261-0/+3
| | | | | | * skip NPN tests if NPN is not available * use the right name
* Raise an Error with "no cipher match" even with TLS 1.3 (#818)Mark Williams2019-02-141-9/+22
| | | | | | | | | | | * Raise an Error with "no cipher match" even with TLS 1.3 This makes Twisted's OpenSSLAcceptableCiphers.fromOpenSSLCipherString and seamlessly work with TLS 1.3: https://github.com/twisted/twisted/pull/1100/files/a5df2fb373ac67b0e3032acc9291ae88dfd0b3b1#diff-df501bac724aab523150498f84749b88R1767 * Split TestContext.test_set_cipher_list_wrong_args into two tests.
* Removed deprecated Type aliases (#814)Alex Gaynor2019-02-071-7/+3
| | | | | | | | | | | | * Removed deprecated Type aliases * typo * typo * missed this somehow * Line wrap
* Hypothetically fixes pyOpenSSL tests (#805)Paul Kehrer2019-01-211-8/+11
| | | | | | | | | | | | | | | * fix openssl CLI testing for 1.1.1 * various 1.1.1 related fixes some of which are just admitting TLS 1.3 is fundamentally different and pinning the tests to TLS 1.2 * flake8 fixes * allow travis_infra env var through * fix twisted
* fix wantWriteError to error even with big socket buffers (#782)catern2018-08-091-1/+1
| | | | | | | My system apparently has larger socket buffers than this test assumes, so it fails. (Debian 9, Linux 4.16, Python 3.7) So let's increase the size of the buffers such that it works for me. This was the smallest power of 2 that worked.
* Add Connection.get_certificate method (#733)Jeremy Lainé2018-05-161-0/+25
| | | | | | | | This makes it possible to retrieve the local certificate (if any) for a Connection. An example where this is useful is when negotiating a DTLS-SRTP connection, the fingerprint of the local certificate needs to be communicated to the remote party out-of-band via SDP.
View Lorry Controller Status