Mar 6, 2024 · Nov 25, 2023 · Nov 25, 2023 · Nov 25, 2023 · Nov 29, 2023 · Nov 29, 2023
diff --git a/Lib/test/certdata/leaf-missing-aki.ca.pem b/Lib/test/certdata/leaf-missing-aki.ca.pem
diff --git a/Lib/test/certdata/leaf-missing-aki.keycert.pem b/Lib/test/certdata/leaf-missing-aki.keycert.pem
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
 ssl = import_helper.import_module("ssl")
 import _ssl

 from ssl import TLSVersion, _TLSContentType, _TLSMessageType, _TLSAlertType
 from ssl importPurpose,TLSVersion, _TLSContentType, _TLSMessageType, _TLSAlertType

 Py_DEBUG_WIN32 = support.Py_DEBUG and sys.platform == 'win32'

 SIGNED_CERTFILE_ECC = data_file("keycertecc.pem")
 SIGNED_CERTFILE_ECC_HOSTNAME = 'localhost-ecc'

 # A custom testcase, extracted from `rfc5280::aki::leaf-missing-aki` in x509-limbo:
 # The leaf (server) certificate has no AKI, which is forbidden under RFC 5280.
 # See: https://x509-limbo.com/testcases/rfc5280/#rfc5280akileaf-missing-aki
 LEAF_MISSING_AKI_CERTFILE = data_file("leaf-missing-aki.keycert.pem")
 LEAF_MISSING_AKI_CERTFILE_HOSTNAME = "example.com"
 LEAF_MISSING_AKI_CA = data_file("leaf-missing-aki.ca.pem")

 # Same certificate as pycacert.pem, but without extra text in file
 SIGNING_CA = data_file("capath", "ceff1710.0")
 # cert with all kinds of subject alt names
                cipher = s.cipher()[0].split('-')
                self.assertTrue(cipher[:2], ('ECDHE', 'ECDSA'))

    def test_verify_strict(self):
        # verification fails by default, since the server cert is non-conforming
        client_context = ssl.create_default_context()
        client_context.load_verify_locations(LEAF_MISSING_AKI_CA)
        hostname = LEAF_MISSING_AKI_CERTFILE_HOSTNAME

        server_context = ssl.create_default_context(purpose=Purpose.CLIENT_AUTH)
        server_context.load_cert_chain(LEAF_MISSING_AKI_CERTFILE)
        server = ThreadedEchoServer(context=server_context, chatty=True)
        with server:
            with client_context.wrap_socket(socket.socket(),
                                            server_hostname=hostname) as s:
                with self.assertRaises(ssl.SSLCertVerificationError):
                    s.connect((HOST, server.port))

        # explicitly disabling VERIFY_X509_STRICT allows it to succeed
        client_context = ssl.create_default_context()
        client_context.load_verify_locations(LEAF_MISSING_AKI_CA)
        client_context.verify_flags &= ~ssl.VERIFY_X509_STRICT

        server_context = ssl.create_default_context(purpose=Purpose.CLIENT_AUTH)
        server_context.load_cert_chain(LEAF_MISSING_AKI_CERTFILE)
        server = ThreadedEchoServer(context=server_context, chatty=True)
        with server:
            with client_context.wrap_socket(socket.socket(),
                                            server_hostname=hostname) as s:
                s.connect((HOST, server.port))
                cert = s.getpeercert()
                self.assertTrue(cert, "Can't get peer certificate.")

    def test_dual_rsa_ecc(self):
        client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
        client_context.load_verify_locations(SIGNING_CA)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -38,7 +38,7 @@
		ssl = import_helper.import_module("ssl")
		import _ssl

		from ssl import TLSVersion, _TLSContentType, _TLSMessageType, _TLSAlertType
		from ssl importPurpose,TLSVersion, _TLSContentType, _TLSMessageType, _TLSAlertType

		Py_DEBUG_WIN32 = support.Py_DEBUG and sys.platform == 'win32'

Expand DownExpand Up		@@ -128,6 +128,13 @@ def data_file(*name):
		SIGNED_CERTFILE_ECC = data_file("keycertecc.pem")
		SIGNED_CERTFILE_ECC_HOSTNAME = 'localhost-ecc'

		# A custom testcase, extracted from `rfc5280::aki::leaf-missing-aki` in x509-limbo:
		# The leaf (server) certificate has no AKI, which is forbidden under RFC 5280.
		# See: https://x509-limbo.com/testcases/rfc5280/#rfc5280akileaf-missing-aki
		LEAF_MISSING_AKI_CERTFILE = data_file("leaf-missing-aki.keycert.pem")
		LEAF_MISSING_AKI_CERTFILE_HOSTNAME = "example.com"
		LEAF_MISSING_AKI_CA = data_file("leaf-missing-aki.ca.pem")

		# Same certificate as pycacert.pem, but without extra text in file
		SIGNING_CA = data_file("capath", "ceff1710.0")
		# cert with all kinds of subject alt names
Expand DownExpand Up		@@ -2949,6 +2956,36 @@ def test_ecc_cert(self):
		cipher = s.cipher()[0].split('-')
		self.assertTrue(cipher[:2], ('ECDHE', 'ECDSA'))

		def test_verify_strict(self):
Copy link ContributorAuthor woodruffwFeb 2, 2024 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. @sethmlarson This test provides a backstop check on`VERIFY_X509_STRICT`, PTAL! gpshead reacted with thumbs up emoji
		# verification fails by default, since the server cert is non-conforming
		client_context = ssl.create_default_context()
		client_context.load_verify_locations(LEAF_MISSING_AKI_CA)
		hostname = LEAF_MISSING_AKI_CERTFILE_HOSTNAME

		server_context = ssl.create_default_context(purpose=Purpose.CLIENT_AUTH)
		server_context.load_cert_chain(LEAF_MISSING_AKI_CERTFILE)
		server = ThreadedEchoServer(context=server_context, chatty=True)
		with server:
		with client_context.wrap_socket(socket.socket(),
		server_hostname=hostname) as s:
		with self.assertRaises(ssl.SSLCertVerificationError):
		s.connect((HOST, server.port))

		# explicitly disabling VERIFY_X509_STRICT allows it to succeed
		client_context = ssl.create_default_context()
		client_context.load_verify_locations(LEAF_MISSING_AKI_CA)
		client_context.verify_flags &= ~ssl.VERIFY_X509_STRICT

		server_context = ssl.create_default_context(purpose=Purpose.CLIENT_AUTH)
		server_context.load_cert_chain(LEAF_MISSING_AKI_CERTFILE)
		server = ThreadedEchoServer(context=server_context, chatty=True)
		with server:
		with client_context.wrap_socket(socket.socket(),
		server_hostname=hostname) as s:
		s.connect((HOST, server.port))
		cert = s.getpeercert()
		self.assertTrue(cert, "Can't get peer certificate.")

		def test_dual_rsa_ecc(self):
		client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
		client_context.load_verify_locations(SIGNING_CA)
Expand Down