Skip to content

Commit

Permalink
bpo-4379: Skip TLS 1.0/1.1 tests under OpenSSL 3.0.0 (pythonGH-25304)
Browse files Browse the repository at this point in the history
Signed-off-by: Christian Heimes <[email protected]>
  • Loading branch information
tiran authored Apr 9, 2021
1 parent d3b73f3 commit 5151d64
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 0 deletions.
5 changes: 5 additions & 0 deletions Lib/test/test_ssl.py
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,7 @@
IS_LIBRESSL = ssl.OPENSSL_VERSION.startswith('LibreSSL')
IS_OPENSSL_1_1_0 = not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (1, 1, 0)
IS_OPENSSL_1_1_1 = not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (1, 1, 1)
IS_OPENSSL_3_0_0 = not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (3, 0, 0)
PY_SSL_DEFAULT_CIPHERS = sysconfig.get_config_var('PY_SSL_DEFAULT_CIPHERS')

PROTOCOL_TO_TLS_VERSION = {}
Expand Down Expand Up @@ -212,6 +213,10 @@ def has_tls_version(version):
if not getattr(ssl, f'HAS_{version.name}'):
return False

if IS_OPENSSL_3_0_0 and version < ssl.TLSVersion.TLSv1_2:
# bpo43791: 3.0.0-alpha14 fails with TLSV1_ALERT_INTERNAL_ERROR
return False

# check runtime and dynamic crypto policy settings. A TLS version may
# be compiled in but disabled by a policy or config option.
ctx = ssl.SSLContext()
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
OpenSSL 3.0.0: Disable testing of legacy protocols TLS 1.0 and 1.1. Tests
are failing with TLSV1_ALERT_INTERNAL_ERROR.

0 comments on commit 5151d64

Please sign in to comment.