Your IP : 216.73.216.213
�
f fP � @ sH d d l Z d d l Z d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z d d l Z d d l Z d d l Z d d l Z d d l Z e j d � Z e e j � Z e j Z e j j d � Z e o1e j d d d f k Z d d � Z e d � Z e j! e � Z" e d � Z# e d
� Z$ e j! e# � Z% e j! e$ � Z& e d � Z' e d � Z( d
Z) e d � Z* e j! e* � Z+ e d d � Z, e d d � Z- e d � Z. e d � Z/ e d � Z0 e d � Z1 d Z2 e d � Z3 e d � Z4 e d � Z5 e d � Z6 e d � Z7 e d � Z8 e d � Z9 e d � Z: e d � Z; e j! e; � Z< d d � Z= d! d" � Z> d# d$ � Z? d% d& � Z@ d' d( � ZA d) d* � ZB e jC e jD d+ � ZE Gd, d- � d- e jF � ZG Gd. d/ � d/ e jF � ZH Gd0 d1 � d1 e jF � ZI Gd2 d3 � d3 e jF � ZJ y d d lK ZK Wn eL k
r�d4 ZM Yn� Xd5 ZM d d6 lN mO ZO Gd7 d8 � d8 eK jP � ZQ Gd9 d: � d: eK jP � ZR d; d< � ZS d= d5 d4 d d> d? � ZT d d d d@ dA � ZU GdB dC � dC e jF � ZV d4 dD dE � ZW eX dF k rDeW � n d S)G� N)�support�sslZLibreSSL� c G s t j j t j j t � | � S)N)�os�path�join�dirname�__file__)�name� r �2/opt/alt/python34/lib64/python3.4/test/test_ssl.py� data_file s r
z keycert.pemz ssl_cert.pemz ssl_key.pemzkeycert.passwd.pemzssl_key.passwd.pemZsomepass�capathz
4e1295a3.0z
5ed36f99.0zrevocation.crlz keycert3.pemz keycert4.pemz pycacert.pemzself-signed.pythontest.netz selfsigned_pythontestdotnet.pemz nullcert.pemz badcert.pemzXXXnonexisting.pemz
badkey.pemz nokia.pemznullbytecert.pemztalos-2019-0758.pemz
dh1024.pemc C sB d j t j t j � � � } t j r> t j j | | � n d S)N� ) r � traceback�format_exception�sys�exc_infor �verbose�stdout�write)�prefixZ
exc_formatr r r � handle_errorL s r c C s
t j d k S)Nr � � �
� )r r r r r )r �_OPENSSL_API_VERSIONr r r r �can_clear_optionsQ s r c C s
t j d k S)Nr r � r r )r r r r r )r �OPENSSL_VERSION_INFOr r r r � no_sslv2_implies_sslv3_helloU s r! c C s
t j d k S)Nr r r r )r r r r r )r r r r r r �have_verify_flagsY s r" c C s� t j d k r� d } t j j | | � } | j d d � } | j | � } | d d k r� | d d � d | d
d � } q� n | S) Nr r r r z%b %d %H:%M:%S %Y GMT�second� �0r � )r r r r r )r r �datetimeZstrptime�replaceZstrftime)Z cert_timeZfmtZdtr r r �asn1time] s (r) c s< t t d � r4 t j � � � f d d � � } | S� Sd S)N�PROTOCOL_SSLv2c sl y t j t j � WnH t j k
r^ t j d k rZ t j � d
k rZ t j d � � n Yn X� | | � S) Nr r r r �debian� squeeze/sid� z'Patched Ubuntu OpenSSL breaks behaviour)r r r r r )r+ r, r- ) r �
SSLContextr* �SSLErrorr �platform�linux_distribution�unittestZSkipTest)�args�kwargs)�funcr r �fn s z$skip_if_broken_ubuntu_ssl.<locals>.f)�hasattrr � functools�wraps)r5 r6 r )r5 r �skip_if_broken_ubuntu_ssll s ! r: z SNI support needed for this testc @ s� e Z d Z d d � Z d d � Z e j e j d k d � d d � � Z d d
� Z
d d � Z d
d � Z d d � Z
d d � Z e j d d � � Z d d � Z d d � Z d d � Z d d � Z d d � Z d d � Z e j d! e j k d" � d# d$ � � Z d% d& � Z d' d( � Z e j e j d) k d* � d+ d, � � Z e j e j d) k d* � d- d. � � Z d/ d0 � Z! d1 d2 � Z" d3 d4 � Z# d5 S)6�BasicSocketTestsc C s� t j t j t j t j t j t j r6 t j n t j d k rO t j n | j
t j d d h � | j
t j d d h � d S)Nr r TF)r r ) r � CERT_NONE�
CERT_OPTIONAL�
CERT_REQUIREDZOP_CIPHER_SERVER_PREFERENCE�OP_SINGLE_DH_USE�HAS_ECDH�OP_SINGLE_ECDH_USEr �OP_NO_COMPRESSION�assertIn�HAS_SNI)�selfr r r �test_constants� s
z BasicSocketTests.test_constantsc C sG t j � } t j r> t j j d | | r0 d p3 d f � n t j d � \ } } | j t | � d � | j | | d k � | r� t j
d � } | j t | � d � n | j t j t j
d � | j t
t j
d � | j t
t j d � t t d � r3| j t t j d � | j t t j d d � n t j d d
� d S)
Nz
RAND_status is %d (%s)
zsufficient randomnesszinsufficient randomness� r r& �RAND_egd�foozthis is a random stringg �R@���rJ )r � RAND_statusr r r r r �RAND_pseudo_bytes� assertEqual�lenZ
RAND_bytes� assertRaisesr/ �
ValueErrorr7 � TypeErrorrH ZRAND_add)rE �v�dataZis_cryptographicr r r � test_random� s$ z BasicSocketTests.test_random�posixzrequires posixc C s� t j � } | s" | j d � n t j � \ } } t j � } | d k r� yW t j | � t j d � d } | j t | � d � t j
| | � t j | � Wn t k
r� t j d � Yq~Xt j d � n� t j | � | j
t j | � t j | d � \ } } | j | d � t j | d � } | j t | � d � t j d � d } | j t | � d � | j | | � d S)Nz*OpenSSL's PRNG has insufficient randomnessr rG r )r rK �failr �pipe�fork�closerL rM rN r �
BaseException�_exit�
addCleanup�waitpid�read�assertNotEqual)rE �statusZrfdZwfd�pidZ child_random�_Z
parent_randomr r r �test_random_fork� s0
z!BasicSocketTests.test_random_forkc C sV t j j t � } t j r? t j j d t j
| � d � n | j | d d$ � | j | d t d � � | j | d
t d � � | j | d d � | j | d d- � | j | d d/ � t j j t
� } t j rt j j d t j
| � d � n | j | d d2 � | j | d d3 � | j | d d4 � | j | d d5 � d S)6N�
�issuer� countryName�XY� localityName�Castle Anthrax�organizationName�Python Software Foundation�
commonName� localhost�notAfterzOct 5 23:01:56 2020 GMT� notBeforezOct 8 23:01:56 2010 GMT� serialNumberZD7C7381919AFC24E�subject�subjectAltName�DNS� projects.developer.nokia.com�projects.forum.nokia.comZOCSP�http://ocsp.verisign.comZ caIssuers�0http://SVRIntl-G3-aia.verisign.com/SVRIntlG3.cer�crlDistributionPoints�0http://SVRIntl-G3-crl.verisign.com/SVRIntlG3.crl�rf rg �rz �rh ri �r| �rj rk �r~ �rl rm �r� )r{ r} r r� �rf rg �r� �rh ri �r� �rj rk �r� �rl rm �r� )r� r� r� r� �rs rm )r� �rs rt �rs ru )r� r� )rv )rw )ry )r �_ssl�_test_decode_cert�CERTFILEr r r r r �pprint�pformatrM r) � NOKIACERT)rE �pr r r �test_parse_cert� s8 $
$
z BasicSocketTests.test_parse_certc C s� t j j t � } t j r? t j j d t j
| � d � n | j | i d d 6d d 6d d
6d d 6d d 6d d 6d d 6� d S) Nrd rf �UKrl �cody-care zJun 14 18:00:58 2028 GMTrn zJun 18 18:00:58 2018 GMTro Z02rp �#codenomicon-vm-2.test.lal.cisco.comrq rs rr � �version�� countryNamer� �r� ��
commonNamer� �r� )r� r� �r� r� �r� �r� r� �r� )r� r� �zDNSr� )r� ) r r� r� �TALOS_INVALID_CRLDPr r r r r r� r� rM )rE r� r r r � test_parse_cert_CVE_2019_5010� s $ z.BasicSocketTests.test_parse_cert_CVE_2019_5010c C s� t j j t � } t j r? t j j d t j
| � d � n d. } | j | d | � | j | d | � t j d/ k r� d5 } n d; } | j | d | � d S)<Nrd rf �US�stateOrProvinceName�Oregonrh � Beavertonrj �Python Software Foundation�organizationalUnitName�Python Core Developmentrl �null.python.org example.org� emailAddress�python-dev@python.orgrq re r r r rs � altnull.python.org example.com�email� null@python.org user@example.org�URI�)http://null.python.org http://example.org�
IP Address� 192.0.2.1�2001:DB8:0:0:0:0:0:1
� <invalid>rr �z countryNamer� �r� �r� r� �r� �z localityNamer� �r� �zorganizationNamer� �r� �r� r� �r� �z
commonNamer� �r� �r� r� �r� )r� r� r� r� r� r� r� )r r r ��DNSr� �r� r� �r� r� �r� r� �r� r� )r� r� r� r� r� �r� r� �r� r� �r� r� �r� r� �r� r� )r� r� r� r� r� )
r r� r� � NULLBYTECERTr r r r r r� r� rM r )rE r� rq Zsanr r r � test_parse_cert_CVE_2013_4238 s0 $ z.BasicSocketTests.test_parse_cert_CVE_2013_4238c C s� t t d � � } | j � } Wd QXt j | � } t j | � } t j | � } | j | | � | j t j d � s� | j d | � n | j
d t j d � s� | j d | � n d S)N�rrd z-DER-to-PEM didn't include correct header:
%r
z-DER-to-PEM didn't include correct footer:
%r
) �open�
CAFILE_CACERTr^ r �PEM_cert_to_DER_certZDER_cert_to_PEM_certrM �
startswithZ
PEM_HEADERrV �endswithZ
PEM_FOOTER)rE r6 �pem�d1Zp2�d2r r r �test_DER_to_PEM s z BasicSocketTests.test_DER_to_PEMc C s� t j } t j } t j } | j | t � | j | t � | j | t � | j | d � | j | d � | \ } } } } } | j | d � | j | d � | j | d � | j | d � | j | d � | j | d � | j | d � | j
| d � | j | d � | j
| d � t | k rW| j | j
d j | � � | | f � n. | j | j
d j | | | � � | | f � d S)
Ni � i 0r r� � �? r z
LibreSSL {:d}zOpenSSL {:d}.{:d}.{:d})r ZOPENSSL_VERSION_NUMBERr �OPENSSL_VERSION�assertIsInstance�int�tuple�strZassertGreaterEqual�
assertLessZassertLessEqual� IS_LIBRESSL�
assertTruer� �format) rE �n�t�s�major�minorZfixZpatchr` r r r �test_openssl_version, s0 !z%BasicSocketTests.test_openssl_versionc
C sf t j t j � } t j | � } t j | � } t j d t f � � ~ | j | � d � Wd QXd S)Nr- )
�socket�AF_INETr � wrap_socket�weakref�refr Zcheck_warnings�ResourceWarningrM )rE r� �ss�wrr r r �
test_refcycleK s z BasicSocketTests.test_refcyclec
C s� t j t j � } t j | � �� } | j t | j d � | j t | j t d � � | j t | j d � | j t | j
t d � d � | j t | j d � | j t | j d d � Wd QXd S)Nr � x�0.0.0.0r )r� r )
r� r� r r� rO �OSError�recv� recv_into� bytearray�recvfrom�
recvfrom_into�send�sendto)rE r� r� r r r �test_wrapped_unconnectedV s z)BasicSocketTests.test_wrapped_unconnectedc C sb x[ d D]S } t j t j � } | j | � t j | � � } | j | | j � � Wd QXq Wd S)N� � @)Nr r )r� r� �
settimeoutr r� rM Z
gettimeout)rE �timeoutr� r� r r r � test_timeoutb s
z BasicSocketTests.test_timeoutc 2 C s� t j � } | j t d t j | d t �| j t d t j | d d �| j t d t j | d d d d �t j | d d d t ��& } | j t d | j t d f � Wd QX| j t � �/ } t j � � } t j | d t
�Wd QXWd QX| j | j j
t
j � | j t � �5 } t j � � } t j | d t d t
�Wd QXWd QX| j | j j
t
j � | j t � �5 } t j � � } t j | d t
d t
�Wd QXWd QX| j | j j
t
j � d S)
Nzcertfile must be specified�keyfilez5certfile must be specified for server-side operations� server_sideT�certfiler- z!can't connect in server-side modei� )r� �assertRaisesRegexrP r r� r� �connect�HOSTrO r� � WRONGCERTrM � exception�errno�ENOENT)rE �sockr� �cmr r r � test_errorsk s2 %%z BasicSocketTests.test_errorsc
s� d d � } � f d d � } i dG d 6} | | d � | | d � | | d � | | d
� | | d � | | d � i dJ d 6} | | d � | | d � | | d � | | d � | | d � i dM d 6} | | d � | | d � | | d � | | d � | | d � i dP d 6} | | d � | | d � | | d � i dS d 6} | | d � | | d � | | d � | | d � i dV d 6} | | d � | | d � | | d � d j d � j d � } i d | f f f d 6} | | | � i dY d 6} | | | � i d\ d 6} | | | � d# j d � j d � } i d | f f f d 6} | | d$ j d � j d � � | | d% j d � j d � � | | d& j d � j d � � | | d' j d � j d � � i d( d) 6d_ d 6dc d0 6} | | d, � | | d- � | | d/ � | | d* � i d1 d) 6dn d 6} | | d: � | | d; � | | d5 � i d1 d) 6dw d 6} | | d: � i d< d) 6d� d 6d� d0 6} | | d: � i d< d) 6d� d 6d� d0 6} | | d> � � j t t j d d � � j t t j i d � i d� d 6} | | d@ � i d� d 6} | | d@ � i d� d 6} � j t j � � } t j | dC � Wd QX� j dD t | j � � d S)�Nc S s t j | | � d S)N)r �match_hostname)�cert�hostnamer r r �ok� s z0BasicSocketTests.test_match_hostname.<locals>.okc s � j t j t j | | � d S)N)rO r �CertificateErrorr )r r )rE r r rV � s z2BasicSocketTests.test_match_hostname.<locals>.failrl � example.comrq z ExAmple.cOmzwww.example.comz .example.comz example.orgZ exampleXcom�*.a.comz foo.a.comz
bar.foo.a.comza.comzXa.comz.a.com�f*.comzfoo.comzf.comzbar.comz bar.foo.com�null.python.org example.orgznull.python.org� *.*.a.com�a.*.comz a.foo.comza..comu püthon.python.org�idna�ascii�
x*.python.org�xn--p*.python.orgu www*.pythön.orgu www.pythön.orgu www1.pythön.orgu ftp.pythön.orgu pythön.orgzJun 26 21:41:46 2011 GMTrn � linuxfrz.orgrs � linuxfr.org� linuxfr.com� othername�
<unsupported>rr zDec 18 23:59:59 2011 GMTrf r� r� �
Californiarh �
Mountain Viewrj �
Google Inc�mail.google.comz gmail.comzDec 18 23:59:59 2099 GMT�blablaz
google.com�a*b.comzaxxb.com�a*b.co*�a*b*.comz axxbxxc.comztoo many wildcards��
commonNamer �r2 )r4 �r3 r �r5 )r6 �r3 r �r7 )r8 �r3 r �r9 )r: �r3 r �r; )r< �r3 r �r= )r> �r3 r# �r? )r@ �r3 r$ �rA )rB �r3 r% �rC )rD ��DNSr& �rF r' �r( r) )rE rG rH �� countryName�US�rI ��stateOrProvinceNamer* �rM �� localityNamer+ �rP ��organizationNamer, �rS �r3 r- �rV )rL rO rR rU rW �rJ rK �rX �rN r* �rZ �rQ r+ �r\ �rT r, �r^ )rY r[ r] r_ �rJ rK �r` �rN r* �rb �rQ r+ �rd �r3 r- �rf )ra rc re rg �r( r. )rh �rJ rK �ri �rN r* �rk �rQ r+ �rm �rT r, �ro )rj rl rn rp �r( r. )rq �r3 r/ �rr )rs �r3 r0 �rt )ru �r3 r1 �rv )rw )
�encode�decoderO rP r r r rC r� r )rE r rV r r! r r )rE r �test_match_hostname� s�
z$BasicSocketTests.test_match_hostnamec C sJ t j t j � } t j � �& } | j t | j | d d d �Wd QXd S)NT�server_hostnamez
some.hostname)r r. �PROTOCOL_SSLv23r� rO rP r� )rE �ctxr r r r �test_server_side s z!BasicSocketTests.test_server_sidec C sQ t j t j � } t j | � �* } | j t � � | j d � Wd QXWd QXd S)Nz unknown-type)r� r� r r� rO rP �get_channel_binding)rE r� r� r r r � test_unknown_channel_binding s z-BasicSocketTests.test_unknown_channel_bindingz
tls-uniquez*'tls-unique' channel binding not availablec C s� t j t j � } t j | � � } | j | j d � � Wd QXt j t j � } t j | d d d t �� } | j | j d � � Wd QXd S)Nz
tls-uniquer
Tr )r� r� r r� Z assertIsNoner r� )rE r� r� r r r � test_tls_unique_channel_binding s z0BasicSocketTests.test_tls_unique_channel_bindingc C ss t j t j t j � � } t | � } | j t � � } d } t j � Wd QX| j | t
| j j d � � d S)Nr )
r r� r� r� �reprZ assertWarnsr� r Z
gc_collectrC r� Zwarningr3 )rE r� r� r r r r �test_dealloc_warn% s z"BasicSocketTests.test_dealloc_warnc
C s� t j � } | j t | � d � | j | t j � t j � �M } t | d <t | d <t j � } | j | j
t � | j | j t � Wd QXd S)N� � SSL_CERT_DIR�
SSL_CERT_FILE) r Zget_default_verify_pathsrM rN r� ZDefaultVerifyPathsr �EnvironmentVarGuard�CAPATHr� �cafiler )rE �paths�envr r r � test_get_default_verify_paths- s
z.BasicSocketTests.test_get_default_verify_paths�win32zWindows specificc C sI | j t j d � � | j t j d � � | j t t j � | j t t j d � t � } x� d D]� } t j | � } | j | t � x� | D]� } | j | t � | j
t | � d � | \ } } } | j | t � | j
| d d h � | j | t t f � t | t � r� | j | � q� q� Wqe Wd } | j
| | � d S) N�CA�ROOTr- r� �x509_asn�
pkcs_7_asnz1.3.6.1.5.5.7.3.1)r� r� )r� r Zenum_certificatesrO rQ � WindowsError�setr� �listr� rM rN �bytesrC �bool�
isinstance�update) rE Z
trust_oidsZ storenameZstore�elementr �encZtrust�
serverAuthr r r �test_enum_certificates9 s&
z'BasicSocketTests.test_enum_certificatesc C s� | j t j d � � | j t t j � | j t t j d � t j d � } | j | t � xb | D]Z } | j | t � | j t
| � d � | j | d t � | j | d d d h � qe Wd S)Nr� r- � r r r� r� )
r� r Z enum_crlsrO rQ r� r� r� r� rM rN r� rC )rE Zcrlsr� r r r �test_enum_crlsR s
z BasicSocketTests.test_enum_crlsc C sE d } t j d � } | j | | � | j | j d � | j | j d � | j | j d � | j | j d � | j | t j � | j t t j d � t j j
d � } | j | | � | j | t j � | j t t j j
d � | j t d � � t j j
d � Wd QXx� t d � D]� } y t j j
| � } Wn t k
rNYq X| j | j t
� | j | j t � | j | j t � | j | j t t d � f � q Wt j j d � } | j | | � | j | t j � | j t j j d � | � | j t j j d � | � | j t d � � t j j d
� Wd QXd S)
N� r� � TLS Web Server Authentication�1.3.6.1.5.5.7.3.1r zunknown NID 100000i�� i� zunknown object 'serverauth'Z
serverauth)r� z
serverAuthr� r� ���)r � _ASN1ObjectrM �nid� shortnameZlongname�oidr� rO rP Zfromnidr �ranger� r� �typeZfromname)rE �expected�val�i�objr r r �test_asn1objecta sB
# z BasicSocketTests.test_asn1objectc C s t j d � } | j t j j t j � | j t j j | � | j t j j j d � | j t j j j d � | j t j j j d � t j d � } | j t j j t j � | j t j j | � | j t j j j d � | j t j j j d � | j t j j j d � d S)Nz1.3.6.1.5.5.7.3.1r� r� z1.3.6.1.5.5.7.3.2� Z
clientAuth)
r r� r� �Purpose� SERVER_AUTHrM r� r� r� � CLIENT_AUTH)rE r� r r r �test_purpose_enum� s z"BasicSocketTests.test_purpose_enumc C s� t j t j t j � } | j | j � | j t � � } t j | d t j �Wd QX| j
t | j � d � t j
t j � } | j t � � } | j | � Wd QX| j
t | j � d � d S)N� cert_reqsz!only stream sockets are supported)r� r� Z
SOCK_DGRAMr\ rY rO �NotImplementedErrorr r� r< rM r� r r. r| )rE r� Zcxr} r r r �test_unsupported_dtls� s z&BasicSocketTests.test_unsupported_dtlsN)$�__name__�
__module__� __qualname__rF rT r2 �
skipUnlessr r
rc r� r� r� r� r� r Z cpython_onlyr� r r r rz r~ r� r �CHANNEL_BINDING_TYPESr� r� r� r r0 r� r� r� r� r� r r r r r; ~ s0
' ( � '' ' r; c @ s� e Z d Z e d d � � Z e d d � � Z d d � Z e d d � � Z d d
� Z e j
e � d � d d
� � Z d d � Z
d d � Z d d � Z d d � Z e d d � � Z d d � Z e j
e j d � d d � � Z e d d � � Z e d d � � Z d! d" � Z d# d$ � Z d% d& � Z e j e j d' k d( � e j e d) � d* d+ � � � Z e j
e j d' k d, � d- d. � � Z! d/ d0 � Z" d1 d2 � Z# d3 d4 � Z$ d5 S)6� ContextTestsc C sp x t D] } t j | � q Wt j � } | j | j t j � | j t t j d � | j t t j d � d S)Nr �* r� )� PROTOCOLSr r. rM �protocolZ PROTOCOL_TLSrO rP )rE r� r} r r r �test_constructor� s
z ContextTests.test_constructorc C s7 x0 t D]( } t j | � } | j | j | � q Wd S)N)r� r r. rM r� )rE �protor} r r r �
test_protocol� s
zContextTests.test_protocolc C sY t j t j � } | j d � | j d � | j t j d � � | j d � Wd QXd S)N�ALL�DEFAULTzNo cipher can be selectedz^$:,;?*'dorothyx)r r. �PROTOCOL_TLSv1� set_ciphersr r/ )rE r} r r r � test_ciphers� s
zContextTests.test_ciphersc C s t j t j � } t j t j Bt j B} t rO t j d k rO | t j O} n | j | | j
� | j
t j O_
| j | t j B| j
� t � r� | j
t j @| _
| j | | j
� d | _
| j d | j
t j @� n | j
t � � d | _
Wd QXd S)Nr r )r r r )r r. r� �OP_ALL� OP_NO_SSLv2� OP_NO_SSLv3r� r rB rM �options� OP_NO_TLSv1r rO rP )rE r} �defaultr r r � test_options� s zContextTests.test_optionsc C s� t j t j � } | j | j t j � t j | _ | j | j t j � t j | _ | j | j t j � t j | _ | j | j t j � | j t � � d | _ Wd QX| j t
� � d | _ Wd QXd S)Nr� ) r r. r� rM � verify_moder< r= r> rO rQ rP )rE r} r r r �test_verify_mode� s z ContextTests.test_verify_modez!verify_flags need OpenSSL > 0.9.8c C s� t j t j � } t t d d � } | j | j t j | B� t j | _ | j | j t j � t j | _ | j | j t j � t j | _ | j | j t j � t j t j B| _ | j | j t j t j B� | j
t � � d | _ Wd QXd S)N�VERIFY_X509_TRUSTED_FIRSTr ) r r. r� �getattrrM � verify_flags�VERIFY_DEFAULT�VERIFY_CRL_CHECK_LEAFZVERIFY_CRL_CHECK_CHAINZVERIFY_X509_STRICTrO rQ )rE r} �tfr r r �test_verify_flags� s z ContextTests.test_verify_flagsc Y C s� t j t j � } | j t d d �| j t d t �| j t | j d t �| j t � � } | j t � Wd QX| j | j
j t j � | j
t j d � � | j t � Wd QX| j
t j d � � | j t � Wd QXt j t j � } | j t t � | j d t d t � | j d t d t � | j
t j d � � | j t � Wd QX| j
t j d � � | j t � Wd QX| j
t j d � � | j d t d t � Wd QXt j t j � } | j
t j d � � | j t t � Wd QX| j t d t �| j t d t j � �| j t d t t j � � �| j t t t � | j t t t j � � | j t t t t j � � � | j
t d � � | j t d d �Wd QX| j t j � � | j t d d �Wd QX| j
t d � � | j t d d
d �Wd QXd d
� } d d � } d d � } d d � } d d � } d d � } d d � } Gd d � d � }
| j t d | �| j t d | �| j t d | �| j t d |
� �| j t d |
� j �| j t j � � | j t d | �Wd QX| j
t d � � | j t d | �Wd QX| j
t d � � | j t d | �Wd QX| j
t d � � | j t d | �Wd QX| j t d | �d S) Nr zPEM libr zkey values mismatchZpasswordzshould be a stringT�badpasszcannot be longer� ai � c S s t S)N)� KEY_PASSWORDr r r r �getpass_unicode# s z:ContextTests.test_load_cert_chain.<locals>.getpass_unicodec S s
t j � S)N)r� rx r r r r �
getpass_bytes% s z8ContextTests.test_load_cert_chain.<locals>.getpass_bytesc S s t t j � � S)N)r� r� rx r r r r �getpass_bytearray' s z<ContextTests.test_load_cert_chain.<locals>.getpass_bytearrayc S s d S)Nr� r r r r r �getpass_badpass) s z:ContextTests.test_load_cert_chain.<locals>.getpass_badpassc S s d d S)Nr� i i r r r r r � getpass_huge+ s z7ContextTests.test_load_cert_chain.<locals>.getpass_hugec S s d S)Nr r r r r r �getpass_bad_type- s z;ContextTests.test_load_cert_chain.<locals>.getpass_bad_typec S s t d � � d S)Nz
getpass error)� Exceptionr r r r �getpass_exception/ s z<ContextTests.test_load_cert_chain.<locals>.getpass_exceptionc @ s( e Z d Z d d � Z d d � Z d S)z:ContextTests.test_load_cert_chain.<locals>.GetPassCallablec S s t S)N)r� )rE r r r �__call__2 s zCContextTests.test_load_cert_chain.<locals>.GetPassCallable.__call__c S s t S)N)r� )rE r r r �getpass4 s zBContextTests.test_load_cert_chain.<locals>.GetPassCallable.getpassN)r� r� r� r� r� r r r r �GetPassCallable1 s r� zmust return a stringz
getpass error) r r. r� �load_cert_chainr� rO rQ r� r rM r r r r r/ �BADCERT� EMPTYCERT�ONLYCERT�ONLYKEY�BYTES_ONLYCERT�
BYTES_ONLYKEYr� �CERTFILE_PROTECTEDr� rx r� �ONLYKEY_PROTECTEDrP r� r� ) rE r} r r� r� r� r� r� r� r� r� r r r �test_load_cert_chain� sz
z!ContextTests.test_load_cert_chainc C s. t j t j � } | j t � | j d t d d � | j t � | j d t d d � | j t | j � | j t | j d d d � | j t � � } | j t � Wd QX| j
| j j t j
� | j t j d � � | j t � Wd QX| j t t � | j t d t �| j t | j d d � d S)Nr� r zPEM libT)r r. r� �load_verify_locationsr� �BYTES_CERTFILErO rQ r� r rM r r r r r/ r� r� � BYTES_CAPATH)rE r} r r r r �test_load_verify_locationsG s
z'ContextTests.test_load_verify_locationsc C s t t � � } | j � } Wd QXt j | � } t t � � } | j � } Wd QXt j | � } t j t j � } | j | j � d d � | j
d | � | j | j � d d � | j
d | � | j | j � d d � | j
d | � | j | j � d d � t j t j � } d j | | f � } | j
d | � | j | j � d d � t j t j � } d | d | d | d
g } | j
d d j | � � | j | j � d d � t j t j � } | j
d | � | j
d | � | j | j � d d � | j
d | � | j | j � d d � t j t j � } d j | | f � } | j
d | � | j | j � d d � t j t j � } | j t
| j
d t �| j t j d � � | j
d d
� Wd QX| j t j d � � | j
d d � Wd QXd S)N�x509_car �cadatar r� rd �head�otherZagain�tail� z
no start lineZbrokenznot enough datas broken)r� r� r^ r r� �CAFILE_NEURONIOr. r� rM �cert_store_statsr� r rO rQ �objectr r/ )rE r6 Z
cacert_pemZ
cacert_derZ neuronio_pemZ neuronio_derr} Zcombinedr r r �test_load_verify_cadataZ sN z$ContextTests.test_load_verify_cadatac C s� t j t j � } | j t � t j d k r> | j t � n | j t | j � | j t | j d � | j t
� � } | j t � Wd QX| j | j
j t j � | j t j � � } | j t � Wd QXd S)N�nt)r r. r� �load_dh_params�DHFILEr r
� BYTES_DHFILErO rQ �FileNotFoundErrorr rM r r r r/ r� )rE r} r r r r �test_load_dh_params� s
z ContextTests.test_load_dh_paramsc C s� x� t D]x } t j | � } | j | j � i d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d 6d d
6d d 6d d 6� q Wd S)
Nr Znumberr
Z connect_goodZconnect_renegotiate�acceptZ accept_goodZaccept_renegotiate�hits�missesZtimeoutsZ
cache_full)r� r r. rM Z
session_stats)rE r� r} r r r �test_session_stats� s
z ContextTests.test_session_statsc C s t j t j � } | j � d S)N)r r. r� Zset_default_verify_paths)rE r} r r r � test_set_default_verify_paths� s z*ContextTests.test_set_default_verify_pathsz#ECDH disabled on this OpenSSL buildc C s� t j t j � } | j d � | j d � | j t | j � | j t | j d � | j t | j d � | j t | j d � d S)NZ
prime256v1s
prime256v1rI s foo)r r. r� Zset_ecdh_curverO rQ rP )rE r} r r r �test_set_ecdh_curve� s
z ContextTests.test_set_ecdh_curvec C s� t j t j � } | j t | j � | j t | j d � | j t | j d � | j t | j | � d d � } | j d � | j | � d S)Nr$ r- c S s d S)Nr )r �
servernamer} r r r �
dummycallback� s z5ContextTests.test_sni_callback.<locals>.dummycallback)r r. r� rO rQ �set_servername_callback)rE r} r
r r r �test_sni_callback� s
z ContextTests.test_sni_callbackc C sd t j t j � } | d d � } | j | � t j | � } ~ ~ t j � | j | � d � d S)Nc S s d S)Nr )r r r} �cycler r r r
� s z>ContextTests.test_sni_callback_refcycle.<locals>.dummycallback) r r. r� r r� r� �gc�collect�assertIs)rE r} r
r� r r r �test_sni_callback_refcycle� s
z'ContextTests.test_sni_callback_refcyclec C s� t j t j � } | j | j � i d d 6d d 6d d 6� | j t � | j | j � i d d 6d d 6d d 6� | j t � | j | j � i d d 6d d 6d d 6� | j t � | j | j � i d d 6d d 6d d 6� d S)Nr r� �crl�x509r r� ) r r. r� rM r� r� r� r� r� )rE r} r r r �test_cert_store_stats� s
z"ContextTests.test_cert_store_statsc C s� t j t j � } | j | j � g � | j t � | j | j � g � | j t � | j | j � i d d 6t d
� d 6t d � d
6d d 6d d 6d( d 6d d 6g � t t � � } | j
� } Wd QXt j | � } | j | j d � | g � d S))Nrj �Root CAr� �http://www.cacert.orgrl �CA Cert Signing Authorityr� �support@cacert.orgre zMar 29 12:29:49 2033 GMTrn zMar 30 12:29:49 2003 GMTro Z00rp �!https://www.cacert.org/revoke.crlrx rq r� r� T��organizationNamer �r ��organizationalUnitNamer �r ��
commonNamer �r �� emailAddressr �r# )r r r" r% )r �r r �r& �r r �r( �r! r �r* �r$ r �r, )r' r) r+ r- ) r r. r� rM � get_ca_certsr� r� r� r) r� r^ r� )rE r} r6 r� �derr r r �test_get_ca_certs� s.
z ContextTests.test_get_ca_certsc C s� t j t j � } | j � t j t j � } | j t j j � | j � t j t j � } | j t j j � t j t j � } | j t | j d � | j t | j d � d S)Nr� ) r r. r� �load_default_certsr� r� r� rO rQ )rE r} r r r �test_load_default_certs s
z$ContextTests.test_load_default_certsr� znot-Windows specificz!LibreSSL doesn't support env varsc C st t j t j � } t j � �P } t | d <t | d <| j � | j | j � i d d 6d d 6d d 6� Wd QXd S)Nr� r� r r r r r� )
r r. r� r r� r� r� r1 rM r� )rE r} r� r r r �test_load_default_certs_env s
z(ContextTests.test_load_default_certs_envzWindows specificc C s� t j t j � } | j � | j � } t j t j � } t j � �I } t | d <t | d <| j � | d d 7<| j | j � | � Wd QXd S)Nr� r� r r )
r r. r� r1 r� r r� r� r� rM )rE r} �statsr� r r r �#test_load_default_certs_env_windows" s
z0ContextTests.test_load_default_certs_env_windowsc
C s: t j � } | j | j t j � | j | j t j � | j | j � | j | j t j
@t j
� | j | j t t d d � @t t d d � � t t
� � } | j � } Wd QXt j d t
d t d | � } | j | j t j � | j | j t j � | j | j t j
@t j
� | j | j t t d d � @t t d d � � t j t j j � } | j | j t j � | j | j t j � | j | j t j
@t j
� | j | j t t d d � @t t d d � � | j | j t t d d � @t t d d � � | j | j t t d d � @t t d d � � d S)NrB r r� r r� r? rA )r �create_default_contextrM r� r| r� r> r� �check_hostnamer� r� r� r� �
SIGNING_CAr^ r� r� r� r< )rE r} r6 r� r r r �test_create_default_context0 s> z(ContextTests.test_create_default_contextc C s� t j � } | j | j t j � | j | j t j � | j | j � | j | j t j
@t j
� t j t j � } | j | j t j � | j | j t j � | j | j t j
@t j
� t j t j d t j d d �} | j | j t j � | j | j t j � | j
| j � | j | j t j
@t j
� t j d t j j � } | j | j t j � | j | j t j � | j | j t j
@t j
� d S)Nr� r7 TZpurpose)r Z_create_stdlib_contextrM r� r| r� r< � assertFalser7 r� r� r� r> r� r� r� )rE r} r r r �test__create_stdlib_contextX s( z(ContextTests.test__create_stdlib_contextc C s� t j t j � } | j | j � | j t � � d | _ Wd QXt j | _ | j | j � d | _ | j | j � t j
| _ d | _ | j | j � | j t � � t j | _ Wd QXd | _ | j | j � d S)NTF) r r. r� r: r7 rO rP r> r� r� r= r< )rE r} r r r �test_check_hostnameq s z ContextTests.test_check_hostnameN)%r� r� r� r: r� r� r� r� r� r2 r� r" r� r� r� r� r r r r r@ r � needs_snir r r r0 r2 �skipIfr r0 r� r3 r5 r9 r; r< r r r r r� � s2 S :
!
! ' ( r� c @ s4 e Z d Z d d � Z d d � Z d d � Z d S)�
SSLErrorTestsc C sz t j d d � } | j t | � d � | j | j d � t j d d � } | j t | � d � | j | j d � d S)Nr rI )r r/ rM r� r ZSSLZeroReturnError)rE �er r r �test_str� s zSSLErrorTests.test_strc C s� t j t j � } | j t j � � } | j t � Wd QX| j | j j d � | j | j j
d � t | j � } | j | j
d � | � d S)NZPEMZ
NO_START_LINEz"[PEM: NO_START_LINE] no start line)r r. r� rO r/ r� r� rM r Zlibrary�reasonr� r� r� )rE r} r r� r r r �test_lib_reason� s z SSLErrorTests.test_lib_reasonc C s� t j t j � } t j � �� } | j d � | j d � t j � } | j | j � � | j d � | j | d d d ��m } | j
t j � � } | j � Wd QXt
| j � } | j | j d � | � | j | j j t j � Wd QXWd QXd S)N� 127.0.0.1r r& F�do_handshake_on_connectz%The operation did not complete (read))rD r )r r. r� r� Zbind�listenr
� getsockname� setblockingr� rO �SSLWantReadError� do_handshaker� r r� r� rM r ZSSL_ERROR_WANT_READ)rE r} r� �cr r r r �
test_subclass� s
zSSLErrorTests.test_subclassN)r� r� r� rA rC rL r r r r r? � s
r? c @ s� e Z d Z d d � Z d d � Z d d � Z d d � Z d d
� Z d d � Z d
d � Z d d � Z
e j e
j d k d � d d � � Z d d � Z d d � Z d d � Z d d � Z d d � Z e d d � � Z d! S)"�NetworkedTestsc C s+ t j t � �t j t j t j � d t j �} z- | j t d f � | j i | j
� � Wd | j � Xt j t j t j � d t j �} | j
t j d | j t d f � | j � t j t j t j � d t j d t �} z* | j t d f � | j | j
� � Wd | j � XWd QXd S)Nr� i� zcertificate verify failed�ca_certs)r �transient_internet� REMOTE_HOSTr r� r� r� r< r
rM � getpeercertrY r> r r/ �REMOTE_ROOT_CERTr� )rE r� r r r � test_connect� s&
zNetworkedTests.test_connectc C s� t j t � �s t j t j t j � d t j d t �} z6 | j d | j
t d f � � | j | j � � Wd | j
� XWd QXd S)Nr� rN r i� )r rO rP r r� r� r� r> rR rM �
connect_exr� rQ rY )rE r� r r r �test_connect_ex� s z NetworkedTests.test_connect_exc C s= t j t � �(t j t j t j � d t j d t d d �} z� | j d � | j
t d f � } | j | d t j
t j f � t j g | g g d � xq y | j � PWq� t j k
r� t j | g g g d � Yq� t j k
r t j g | g g d � Yq� Xq� W| j | j � � Wd | j � XWd QXd S)Nr� rN rE Fi� r g @)r rO rP r r� r� r� r> rR rH rT rC r Z EINPROGRESS� EWOULDBLOCK�selectrJ rI �SSLWantWriteErrorr� rQ rY )rE r� �rcr r r � test_non_blocking_connect_ex� s(
"z+NetworkedTests.test_non_blocking_connect_exc C s� t j t � �� t j t j t j � d t j d t d d �} z^ | j d � | j
t d f � } | d k r� | j d � n | j | t
j t
j f � Wd | j � XWd QXd S) Nr� rN rE FgH�����z>i� r z!REMOTE_HOST responded too quickly)r rO rP r r� r� r� r> rR r rT �skipTestrC r ZEAGAINrV rY )rE r� rY r r r �test_timeout_connect_ex� s
z&NetworkedTests.test_timeout_connect_exc C s� t j t � �� t j t j t j � d t j d t �} zG | j t d f � } t
j t
j t
j
t
j f } | j | | � Wd | j � XWd QXd S)Nr� rN i� )r rO rP r r� r� r� r> rR rT r Z ECONNREFUSEDZ EHOSTUNREACHZ ETIMEDOUTrV rC rY )rE r� rY �errorsr r r �test_connect_ex_error s z$NetworkedTests.test_connect_ex_errorc C sy t j t � �dt j t j � } | j t j t j � � } | j t d f � z | j
i | j � � Wd | j � X| j t j t j � d t �} | j t d f � | j � t j
| _ | j t j t j � � } | j t j d | j t d f � | j � | j t � | j t j t j � � } | j t d f � z | j � } | j | � Wd | j � XWd QXd S)Ni� r{ zcertificate verify failed)r rO rP r r. r| r� r� r� r
rM rQ rY r> r� r r/ r� rR r� )rE r} r� r r r r �test_connect_with_context s.
z(NetworkedTests.test_connect_with_contextc C s( t j t � �t j t j � } t j | _ | j d t � | j
t j t j � � } | j
t d f � z | j � } | j | � Wd | j � Xt j t j � } t j | _ | j d t � | j
t j t j � � } | j
t d f � z | j � } | j | � Wd | j � XWd QXd S)Nr i� )r rO rP r r. r| r> r� r� r� r� r� r� r
rQ r� rY r� )rE r} r� r r r r �test_connect_capath8 s& z"NetworkedTests.test_connect_capathc C sF t t � � } | j � } Wd QXt j | � } t j t � �t j t j � } t j
| _ | j d | � | j
t j t j � � �3 } | j t d f � | j � } | j | � Wd QXt j t j � } t j
| _ | j d | � | j
t j t j � � �3 } | j t d f � | j � } | j | � Wd QXWd QXd S)Nr� i� )r� rR r^ r r� r rO rP r. r| r> r� r� r� r� r� r
rQ r� )rE r6 r� r/ r} r� r r r r �test_connect_cadataU s$ z"NetworkedTests.test_connect_cadatar� z*Can't use a socket as a file under Windowsc C s� t j t � �� t j t j t j � � } | j t d f � | j � } | j � } | j
� t j | d � | j
� t
j � | j t � � } t j | d � Wd QX| j | j j t j � Wd QXd S)Ni� r )r rO rP r r� r� r� r
�fileno�makefilerY r r^ r r rO r� rM r r ZEBADF)rE r� �fdr6 r@ r r r �test_makefile_closek s
z"NetworkedTests.test_makefile_closec C s t j t � �� t j t j � } | j t d f � | j d � t j | d t j d d �} d } xu y | d 7} | j
� PWqi t j k
r� t j | g g g � Yqi t j
k
r� t j g | g g � Yqi Xqi W| j � t j rt j j d | � n Wd QXd S)Ni� Fr� rE r r z9
Needed %d calls to do_handshake() to establish session.
)r rO rP r� r� r
rH r r� r< rJ rI rW rX rY r r r r )rE r� �countr r r �test_non_blocking_handshake s(
z*NetworkedTests.test_non_blocking_handshakec sB d � f d d � } | t d t � t j r> | d d � n d S)Nc sI t j | � �4t j | | f t j � } | sK � j d | | f � n y% t j | | f t j d t �} WnH t j k
r� } z% t j r� t j
j d | � n WYd d } ~ Xn X� j d | | | f � t j | | f t j d | �} | s� j d | | f � n t j r?t j
j d | | | f � n Wd QXd S)Nz No server certificate on %s:%s!rN z%s
z$Got server certificate %s for %s:%s!z&
Verified certificate for %s:%s is
%s
) r rO r Zget_server_certificater| rV r� r/ r r r r )�host�portr r� �x)rE r r � _test_get_server_certificate� s(
* zPNetworkedTests.test_get_server_certificate.<locals>._test_get_server_certificatei� zipv6.google.com)rP rR r Z IPV6_ENABLED)rE rk r )rE r �test_get_server_certificate� s z*NetworkedTests.test_get_server_certificatec ' C s t d f } t j | d � �� t j t j t j � d t j d d �� } | j | � Wd QXt j t j t j � d t j d d �� } | j | � Wd QX| j t j
d � �K t j t j � �2 } t j | d t j d d �} | j | � Wd QXWd QXWd QXd S) Ni� r r� �ciphersr� r� zNo cipher can be selectedz^$:,;?*'dorothyx) rP r rO r r� r� r� r< r
r r/ )rE �remoter� r r r r r� � s zNetworkedTests.test_ciphersc C s: t j d
k r& | j d t j � n t j s? | j d � n d } t j j t j j t � d � } t
j d � �� t j t j
� } t j | _ | j | � | j t j t j � d
d �} z` | j | � t
j r!t j j d | | j � f � t j j d t j | j � � � n Wd | j � XWd QXd S)Nr r r r zSHA256 not available on %rzSNI needed for this test�sha256.tbs-internet.com� z
sha256.pemr{ z
Cipher with %r is %r
zCertificate is:
%s
)r r r r r )ro rp ) r r r[ r� rD r r r r r r rO r. r� r> r� r� r� r� r� r
r r r r �cipherr� r� rQ rY )rE rn Z sha256_certr} r� r r r �test_algorithms� s( !
z NetworkedTests.test_algorithmsc C s� t j t � �� t j t j � } t j | _ | j d t � | j
| j � g � | j t
j
t
j � � } | j t d f � z | j � } | j | � Wd | j � X| j
t | j � � d � Wd QXd S)Nr i� r )r rO rP r r. r| r> r� r� r� rM r. r� r� r� r
rQ r� rY rN )rE r} r� r r r r �test_get_ca_certs_capath� s z'NetworkedTests.test_get_ca_certs_capathc C s� t j t � �� t j t j � } t j t j � } t j t j � } | j | � �u } | j
t d f � | j | j | � | j | j
j | � | | _ | j | j | � | j | j
j | � Wd QXWd QXd S)Ni� )r rO rP r r. r� r| r� r� r� r
r �contextZ_sslobj)rE Zctx1Zctx2r� r� r r r �test_context_setget� s z"NetworkedTests.test_context_setgetN)r� r� r� rS rU rZ r\ r^ r_ r` ra r2 r> r r
re rg rl r� rr rs r= ru r r r r rM � s ' rM FT)�make_https_serverc @ s� e Z d Z Gd d � d e j � Z d d d d d d d d d d d d �
Z d d � Z d
d � Z d d d
� Z d d � Z
d d � Z d S)�ThreadedEchoServerc @ s^ e Z d Z d Z d d � Z d d � Z d d � Z d d � Z d
d � Z d d
� Z d S)z$ThreadedEchoServer.ConnectionHandlerz�A mildly complicated class, because we want it to work both
with and without the SSL wrapper around the socket connection, so
that we can test the STARTTLS functionality.c C sZ | | _ d | _ | | _ | | _ | j j d � d | _ t j j | � d | _ d S)NFr T)
�server�runningr �addrrH �sslconn� threading�Thread�__init__�daemon)rE rx Zconnsockrz r r r r~ s z-ThreadedEchoServer.ConnectionHandler.__init__c C s� yA | j j j | j d d �| _ | j j j | j j � � Wn� t j t
f k
r� } zf | j j j | � | j j r� t
d t | j � d � n d | _ | j j � | j � d SWYd d } ~ Xn"X| j j j t j k r�| j j � } t j r3| j j r3t j j d t j | � d � n | j j d � } t j r�| j j r�t j j d t t | � � d � q�n | j j � } t j r�| j j r�t j j d
t | � d � t j j d t | j j � � d � n d Sd S) Nr
Tz'
server: bad connection attempt from z:
Fz client cert is rd z cert binary is z bytes
z" server: connection cipher is now z" server: selected protocol is now ) rx rt r� r r{ �selected_protocols�append�selected_npn_protocolr r/ �ConnectionResetError� conn_errors�chattyr r� rz ry �stoprY r� r> rQ r r r r r r� r� r� rN rq )rE r@ r Z cert_binaryrq r r r � wrap_conn s2
$* !z.ThreadedEchoServer.ConnectionHandler.wrap_connc C s* | j r | j j � S| j j d � Sd S)Ni )r{ r^ r r� )rE r r r r^ = s
z)ThreadedEchoServer.ConnectionHandler.readc C s- | j r | j j | � S| j j | � Sd S)N)r{ r r r )rE r� r r r r C s z*ThreadedEchoServer.ConnectionHandler.writec C s* | j r | j j � n
| j j � d S)N)r{ rY r )rE r r r rY I s z*ThreadedEchoServer.ConnectionHandler.closec C s� d | _ | j j s( | j � s( d Sn x�| j r�yE| j � } | j � } | sk d | _ | j � n
| d k r� t j r� | j j r� t
j j d � n | j � d S| j j r
| d k r
t j r� | j j r� t
j j d � n | j d � | j � sxd Snk| j j r�| j
r�| d k r�t j rV| j j rVt
j j d � n | j d � | j
j � | _ d | _
t j rx| j j rxt
j j d
� qxn� | d k rt j r�| j j r�t
j j d � n | j
j d
� } | j t | � j d � d � nf t j re| j j re| j
r6d p9d } t
j j d | | | j � | f � n | j | j � � Wq+ t k
r�| j j r�t d � n | j � d | _ | j j � Yq+ Xq+ Wd S)NTFs overz" server: client closed connection
s STARTTLSz2 server: read STARTTLS from client, sending OK...
s OK
s ENDTLSz0 server: read ENDTLS from client, sending OK...
z* server: connection is now unencrypted...
s
CB tls-uniquez@ server: read CB tls-unique from client, sending our CB data...
z
tls-uniquezus-asciis
Z encryptedZ unencryptedz/ server: read %r (%s), sending back %r (%s)...
zTest server failure:
)ry rx �starttls_serverr� r^ �striprY r r �connectionchattyr r r r{ �unwrapr r r� rx �lowerr� r� r r� )rE �msgZstrippedrS Zctyper r r �runO sb
#
z(ThreadedEchoServer.ConnectionHandler.runN)
r� r� r� �__doc__r~ r� r^ r rY r� r r r r �ConnectionHandler
s
# r� NTFc C s> |
r |
| _ n� t j | d k r* | n t j � | _ | d k rK | n t j | j _ | rs | j j | � n | r� | j j | � n | r� | j j | � n | r� | j j | � n | | _
| | _ | | _ t
j
� | _ t j | j � | _ d | _ d | _ g | _ g | _ t j j | � d | _ d S)NFT)rt r r. r� r< r� r� r� �set_npn_protocolsr� r� r� r� r� r r � bind_portri �flag�activer� r� r| r} r~ r ) rE Z certificate� ssl_version�certreqs�cacertsr� r� r� Z
npn_protocolsrm rt r r r r~ � s4 zThreadedEchoServer.__init__c C s$ | j t j � � | j j � | S)N)�startr| �Eventr� �wait)rE r r r � __enter__� s
z ThreadedEchoServer.__enter__c G s | j � | j � d S)N)r� r )rE r3 r r r �__exit__� s
zThreadedEchoServer.__exit__c C s | | _ t j j | � d S)N)r� r| r} r� )rE r� r r r r� � s zThreadedEchoServer.startc C s | j j d � | j j d � d | _ | j rB | j j � n x� | j r� yu | j j � \ } } t j r� | j r� t
j j d t
| � d � n | j | | | � } | j � | j � WqE t j k
r� YqE t k
r� | j � YqE XqE W| j j � d S)Ng�������?r& Tz server: new connection from rd )r r rF r� r� r� r r r r� r r r r� r� r� r r� r �KeyboardInterruptr� rY )rE ZnewconnZconnaddrZhandlerr r r r� � s&
zThreadedEchoServer.runc C s
d | _ d S)NF)r� )rE r r r r� � s zThreadedEchoServer.stop) r� r� r� r| r} r� r~ r� r� r� r� r� r r r r rw s | rw c @ s� e Z d Z Gd d � d e j � Z d d � Z d d � Z d d � Z d d
� Z d d d
� Z
d d � Z d d � Z d S)�AsyncoreEchoServerc @ sM e Z d Z Gd d � d e j � Z d d � Z d d � Z d d � Z d S)
z AsyncoreEchoServer.EchoServerc @ sX e Z d Z d d � Z d d � Z d d � Z d d � Z d d
� Z d d � Z d
S)z/AsyncoreEchoServer.EchoServer.ConnectionHandlerc C sQ t j | d d d | d d �| _ t j j | | j � d | _ | j � d S)Nr
Tr rE F)r r� r� �asyncore�dispatcher_with_sendr~ �_ssl_accepting�_do_ssl_handshake)rE �connr r r r r~ � s z8AsyncoreEchoServer.EchoServer.ConnectionHandler.__init__c C sB t | j t j � r> x& | j j � d k r: | j � q Wn d S)Nr T)r� r� r � SSLSocket�pendingZhandle_read_event)rE r r r �readable� s z8AsyncoreEchoServer.EchoServer.ConnectionHandler.readablec C s� y | j j � Wn� t j t j f k
r5 d SYn� t j k
rS | j � SYne t j k
rj � YnN t k
r� } z% | j d t
j k r� | j � SWYd d } ~ Xn
Xd | _ d S)Nr F)
r� rJ r rI rX Z SSLEOFError� handle_closer/ r� r3 r Z ECONNABORTEDr� )rE �errr r r r� � s zAAsyncoreEchoServer.EchoServer.ConnectionHandler._do_ssl_handshakec C su | j r | j � n[ | j d � } t j rK t j j d t | � � n | s^ | j � n | j
| j � � d S)Ni z server: read %s from client
) r� r� r� r r r r r r� rY r r� )rE rS r r r � handle_read� s
z;AsyncoreEchoServer.EchoServer.ConnectionHandler.handle_readc C s1 | j � t j r- t j j d | j � n d S)Nz server: closed connection %s
)rY r r r r r r� )rE r r r r� � s
z<AsyncoreEchoServer.EchoServer.ConnectionHandler.handle_closec C s � d S)Nr )rE r r r r s z<AsyncoreEchoServer.EchoServer.ConnectionHandler.handle_errorN) r� r� r� r~ r� r� r� r� r r r r r r� � s r� c C sZ | | _ t j t j t j � } t j | d � | _ t j j | | � | j
d � d S)Nr- r& ) r r� r� Z SOCK_STREAMr r� ri r� �
dispatcherr~ rF )rE r r r r r r~ s
z&AsyncoreEchoServer.EchoServer.__init__c C s7 t j r t j j d | � n | j | | j � d S)Nz$ server: new connection from %s:%s
)r r r r r r� r )rE Zsock_objrz r r r �handle_accepted s z-AsyncoreEchoServer.EchoServer.handle_acceptedc C s � d S)Nr )rE r r r r s z*AsyncoreEchoServer.EchoServer.handle_errorN) r� r� r� r� r� r� r~ r� r r r r r �
EchoServer� s 3 r� c C sP d | _ d | _ | j | � | _ | j j | _ t j j | � d | _ d S)NFT) r� r� r� rx ri r| r} r~ r )rE r r r r r~ s zAsyncoreEchoServer.__init__c C s d | j j | j f S)Nz<%s %s>)� __class__r� rx )rE r r r �__str__ s zAsyncoreEchoServer.__str__c C s$ | j t j � � | j j � | S)N)r� r| r� r� r� )rE r r r r� s
z AsyncoreEchoServer.__enter__c G sl t j r t j j d � n | j � t j rB t j j d � n | j � t j rh t j j d � n d S)Nz cleanup: stopping server.
z! cleanup: joining server thread.
z cleanup: successfully joined.
)r r r r r r� r )rE r3 r r r r� $ s
zAsyncoreEchoServer.__exit__Nc C s | | _ t j j | � d S)N)r� r| r} r� )rE r� r r r r� . s zAsyncoreEchoServer.startc C sR d | _ | j r" | j j � n x) | j rM y t j d � Wq% Yq% Xq% Wd S)NTr )r� r� r� r� Zloop)rE r r r r� 2 s zAsyncoreEchoServer.runc C s d | _ | j j � d S)NF)r� rx rY )rE r r r r� < s zAsyncoreEchoServer.stop)
r� r� r� r� r� r� r~ r� r� r� r� r� r� r r r r r� � s D
r� c C s� t t d t j d t d d d d �} | �]yM t j � �; } t j | d | d t j �} | j t | j f � Wd QXWn� t j
k
r� } z, t j r� t
j j d | j d
� n WYd d } ~ Xn� t k
r} z, t j rt
j j d | j d
� n WYd d } ~ Xno t k
ry} zC | j t j k rA� n t j rgt
j j d t | � � n WYd d } ~ Xn
Xt d
� � Wd QXd S)z�
Launch a server with CERT_REQUIRED, and check that trying to
connect to it with the given client certificate fails.
r� r� r� Fr� r r� Nz
SSLError is %s
r z
OSError is %s
z\OSError is %s
z'Use of invalid cert should have failed!)rw r� r r> r� r� r� r
r ri r/ r r r r r r3 r� r r r� �AssertionError)r rx r r� rj r r r �
bad_cert_test@ s. 0 0 0r� s FOO
c C s� i } t d | d | d d � } | ��| j t j � d | ���} | j t | j f � x� | t | � t | � g D]� } | r� t j r� t
j j d | � q� n | j | � | j
� }
| r� t j r� t
j j d |
� q� n |
| j � k rx t d |
d d
� t |
� | d d
� j � t | � f � � qx qx W| j d � | rvt j rvt
j j d � qvn | j i | j � d
6| j � d 6| j � d 6| j � d 6� | j � Wd QX| j | d <Wd QX| S)zc
Launch a server, connect a client to it and try various reads
and writes.
rt r� r� Fr{ z client: sending %r...
z client: read %r
z4bad data <<%r>> (%d) received; expected <<%r>> (%d)
N� s over
z client: closing connection.
� compressionrq �peercert�client_npn_protocolZserver_npn_protocols)rw r� r� r
r ri r� �
memoryviewr r r r r r^ r� r� rN r� r� rq rQ r� rY r� ) �client_context�server_context�indatar� r� �sni_namer4 rx r� �arg�outdatar r r �server_params_test^ sF "
-
r� c C s� | d k r t j } n i d t j 6d t j 6d t j 6| } t j r� | rU d pX d } t j j | t j | � t j | � | f � n t j
| � } | j | O_ t j
| � } | j | O_ | j t j
k r� | j d � n x7 | | f D]) }
| |
_ |
j t � |
j t � q� Wy t | | d d d d �Wnc t j k
re| ra� n Ynt t k
r�} z# | s�| j t j k r�� n WYd d } ~ Xn2 X| s�t d
t j | � t j | � f � � n d S) Nr< r= r> z %s->%s %s
z
{%s->%s} %s
r� r� Fr� z5Client protocol %s succeeded with server protocol %s!)r r< r= r> r r r r r Zget_protocol_namer. r� r� r| r� r� r� r� r� r� r/ r� r Z
ECONNRESETr� ) Zserver_protocolZclient_protocol�expect_successZ certsreqs�server_options�client_optionsZcerttypeZ formatstrr� r� r} r@ r r r �try_protocol_combo� sJ
r� c @ s� e Z d Z e d d � � Z d d � Z e j e � d � d d � � Z d d � Z
d
d � Z d d
� Z d d � Z
d d � Z d d � Z e e j e e d � d � d d � � � Z e d d � � Z e e j e e d � d � d d � � � Z e d d � � Z e e j e e d � d! � d" d# � � � Z e e j e e d$ � d% � d& d' � � � Z d( d) � Z d* d+ � Z d, d- � Z d. d/ � Z d0 d1 � Z d2 d3 � Z d4 d5 � Z d6 d7 � Z d8 d9 � Z e j e j! d: � d; d< � � Z" e j d= e j# k d> � d? d@ � � Z$ dA dB � Z% e j e e dC � dD � dE dF � � Z& dG dH � Z' dI dJ � Z( e j e j) dK � dL dM � � Z* dN dO � Z+ dP dQ � Z, e- dR dS � � Z. e- dT dU � � Z/ e- dV dW � � Z0 e- dX dY � � Z1 dZ d[ � Z2 d\ S)]�
ThreadedTestsc C s� t j r t j j d � n xc t D][ } | j d t j | � �: t j | � } | j
t � t | | d d d d �Wd QXq# Wd S)z2Basic test of an SSL client connecting to a serverrd r� r� Tr� N)
r r r r r r� ZsubTestr �_PROTOCOL_NAMESr. r� r� r� )rE r� rt r r r � test_echo� s
zThreadedTests.test_echoc C s� t j r t j j d � n t j t j � } t j | _ | j
t � | j t � t
d | d d � } | �x| j t j � d d �} | j t | j f � | j t � � | j � Wd QX| j � | j � } | j | d � | j � } t j r:t j j t j | � d � t j j d t | � d � n d | k rc| j d
t j | � � n d | d k r�| j d
� n | j d | � | j d | � t j | d � } t j | d � } | j | | � | j � Wd QXd S)Nrd rt r� FrE zCan't get peer certificate.zConnection cipher is z.
rq z$No subject field in certificate: %s.rj �Python Software FoundationzkMissing or invalid 'organizationName' field in certificate subject; should be 'Python Software Foundation'.ro rn �zorganizationNamer� )r� )!r r r r r r r. r| r> r� r� r� r� rw r� r� r
r ri rO rP rQ rJ r� rq r� r� r� rV rC Zcert_time_to_secondsr� rY )rE rt rx r� r rq Zbefore�afterr r r �test_getpeercert� sB
!
z ThreadedTests.test_getpeercertz!verify_flags need OpenSSL > 0.9.8c / C s t j r t j j d � n t j t j � } | j t � t j t j � } t j
| _ | j t
� t t d d � } | j | j t j | B� t d | d d � } | �U | j t j � � �9 } | j t | j f � | j � } | j | d � Wd QXWd QX| j t j O_ t d | d d � } | �U | j t j � � �9 } | j t j d � � | j t | j f � Wd QXWd QXWd QX| j t � t d | d d � } | �U | j t j � � �9 } | j t | j f � | j � } | j | d � Wd QXWd QXd S) Nrd r� r rt r� TzCan't get peer certificate.zcertificate verify failed) r r r r r r r. r� r� �SIGNED_CERTFILEr> r� r� r8 r� rM r� r� rw r� r� r
r ri rQ r� r� r r/ �CRLFILE)rE r� rt r� rx r� r r r r �test_crl_check� s:
(
z ThreadedTests.test_crl_checkc 5 C s� t j r t j j d � n t j t j � } | j t � t j t j � } t j
| _ d | _ | j
t � t d | d d � } | �[ | j t j � d d ��9 } | j t | j f � | j � } | j | d � Wd QXWd QXt d | d d � } | �[ | j t j � d d ��9 } | j t j d � � | j t | j f � Wd QXWd QXWd QXt d | d d � } | �@ t j � �- } | j t d
� � | j | � Wd QXWd QXWd QXd S) Nrd Trt r� r{ rm zCan't get peer certificate.Zinvalidz,hostname 'invalid' doesn't match 'localhost'z'check_hostname requires server_hostname)r r r r r r r. r� r� r� r> r� r7 r� r8 rw r� r� r
r ri rQ r� r r rP )rE r� rt rx r� r r r r r< s8
(
z!ThreadedTests.test_check_hostnamec C s2 t t j j t j j t � p$ t j d � � d S)z"Connecting with an empty cert filez nullcert.pemN)r� r r r r r �curdir)rE r r r �test_empty_cert? s $z ThreadedTests.test_empty_certc C s2 t t j j t j j t � p$ t j d � � d S)z<Connecting with a badly formatted certificate (syntax error)z badcert.pemN)r� r r r r r r� )rE r r r �test_malformed_certC s $z!ThreadedTests.test_malformed_certc C s2 t t j j t j j t � p$ t j d � � d S)z(Connecting with a non-existing cert filez
wrongcert.pemN)r� r r r r r r� )rE r r r �test_nonexisting_certG s $z#ThreadedTests.test_nonexisting_certc C s2 t t j j t j j t � p$ t j d � � d S)z4Connecting with a badly formatted key (syntax error)z
badkey.pemN)r� r r r r r r� )rE r r r �test_malformed_keyK s $z ThreadedTests.test_malformed_keyc
s� t j � � t j � � t j � � t j � t � � � � � f d d � } � � � � f d d � } t j d | � } | j � z | � Wd | j � Xd S)z|A brutal shutdown of an SSL server should raise an OSError
in the client when attempting handshake.
c sK � j d � � j � � j � \ } } | j � � j � � j � d S)Nr& )rF r� r rY )Znewsockrz )�
listener_gone�listener_readyr� r r �listener^ s
z2ThreadedTests.test_rude_shutdown.<locals>.listenerc su � j � t j � �Y } | j t � f � � j � y t j | � } Wn t k
r] Yn X� j d � Wd QXd S)Nz2connecting to closed SSL socket should have failed)r� r� r
r r r� r� rV )rK �ssl_sock)r� r� ri rE r r � connectorf s
z3ThreadedTests.test_rude_shutdown.<locals>.connector�targetN) r| r� r� r r� r r} r� r )rE r� r� r� r )r� r� ri r� rE r �test_rude_shutdownP s
z ThreadedTests.test_rude_shutdownr* z)OpenSSL is compiled without SSLv2 supportc C s+ t j r t j j d � n t t j t j d � t t j t j d t j � t t j t j d t j � t t j t j
d � t t d � r� t t j t j d � n t t j t j
d � t � r� t t j t j
d d t j �n t t j t j
d d t j �t t j t j
d d t j �d S)z9Connecting to an SSLv2 server with various client optionsrd TF�PROTOCOL_SSLv3r� N)r r r r r r� r r* r= r> r| r7 r� r� r! r� r� r� )rE r r r �test_protocol_sslv2y s
z!ThreadedTests.test_protocol_sslv2c C s0 t j r t j j d � n t t d � r� y t t j t j d � Wq� t
k
r� } z+ t j r� t j j d t | � � n WYd d } ~ Xq� Xn t t d � r� t t j t j d � n t t j t j d � t t j t j
d � t t d � rt t j t j d t j � n t t j t j d t j � t t j t j
d t j � t t d � r~t t j t j d t j � n t t j t j d t j � t t j t j
d t j � t t d � r�t t j t j d d t j �n t t j t j d d t j t j B�t t j t j
d d t j �d S) z:Connecting to an SSLv23 server with various client optionsrd r* Tz; SSL2 client to SSL23 server test unexpectedly failed:
%s
Nr� Fr� )r r r r r r7 r r� r| r* r� r� r� r� r= r> r� r� r� )rE rj r r r �test_protocol_sslv23� s: '
z"ThreadedTests.test_protocol_sslv23r� z)OpenSSL is compiled without SSLv3 supportc C s� t j r t j j d � n t t j t j d � t t j t j d t j � t t j t j d t j � t
t d � r� t t j t j d � n t t j t j d d t j
�t t j t j d � t � r� t t j t j d d t j �n d S)z9Connecting to an SSLv3 server with various client optionsrd Tr* Fr� N)r r r r r r� r r� r= r> r7 r* r| r� r� r! r� )rE r r r �test_protocol_sslv3� s
z!ThreadedTests.test_protocol_sslv3c C s� t j r t j j d � n t t j t j d � t t j t j d t j � t t j t j d t j � t
t d � r� t t j t j d � n t
t d � r� t t j t j d � n t t j t j
d d t j �d S)z8Connecting to a TLSv1 server with various client optionsrd Tr* Fr� r� N)r r r r r r� r r� r= r> r7 r* r� r| r� )rE r r r �test_protocol_tlsv1� s z!ThreadedTests.test_protocol_tlsv1�PROTOCOL_TLSv1_1z TLS version 1.1 not supported.c C s� t j r t j j d � n t t j t j d � t t d � rZ t t j t j d � n t t d � r� t t j t j
d � n t t j t j d d t j �t t j t j d � t t j t j
d � t t j
t j d � d S)znConnecting to a TLSv1.1 server with various client options.
Testing against older TLS versions.rd Tr* Fr� r� N)r r r r r r� r r� r7 r* r� r| �
OP_NO_TLSv1_1r� )rE r r r �test_protocol_tlsv1_1� s
z#ThreadedTests.test_protocol_tlsv1_1�PROTOCOL_TLSv1_2z TLS version 1.2 not supported.c C s3 t j r t j j d � n t t j t j d d t j t j Bd t j t j B�t
t d � rz t t j t j d � n t
t d � r� t t j t j d � n t t j t j
d d t j �t t j
t j d � t t j t j d � t t j t j d � t t j t j d � t t j t j d � d S) znConnecting to a TLSv1.2 server with various client options.
Testing against older TLS versions.rd Tr� r� r* Fr� N)r r r r r r� r r� r� r� r7 r* r� r| Z
OP_NO_TLSv1_2r� r� )rE r r r �test_protocol_tlsv1_2� s
z#ThreadedTests.test_protocol_tlsv1_2c C s8 d } t t d t j d
d d d d
d �} d } | ��t j � } | j d � | j t | j f � t j
r� t j j
d � n xJ| D]B} t j
r� t j j
d | � n | r� | j
| � | j � } n | j | � | j d � } | j � j � } | d k r^| j d � r^t j
r=t j j
d | � n t j | d t j �} d } q� | d k r�| j d � r�t j
r�t j j
d | � n | j � } d } q� t j
r� t j j
d | � q� q� Wt j
r�t j j
d � n | r| j
d � n
| j d � | r$| j � n
| j � Wd QXd S)z6Switching from clear text to encrypted and back again.� msg 1� MSG 2� STARTTLS� MSG 3� msg 4� ENDTLS� msg 5� msg 6r� r� Tr� r� Fr rd z client: sending %r...
i s okz/ client: read %r from server, starting TLS...
z- client: read %r from server, ending TLS...
z client: read %r from server
z client: closing connection.
s over
N)r� r� r� r� r� r� r� r� )rw r� r r� r� rH r
r ri r r r r r r^ r r� r� r� r� r� r� rY ) rE Zmsgsrx �wrappedr� r� r� r� r� r r r �
test_starttls s`
zThreadedTests.test_starttlsc C s< t | d t �} t j r. t j j d � n t t d � � } | j � } Wd QXd } d | j t
j j t � d f } t
j d t � } t j j | d | �} zu | j � j d
� } | rt | � d k r| j t | � � } t j rt j j d t | � | f � qn Wd | j � X| j | | � d S)
z:Using a SocketServer to create and manage SSL connections.r rd �rbNr- zhttps://localhost:%d/%sr r� rt zcontent-lengthr z/ client: read %d bytes from remote server '%s'
)rv r� r r r r r r� r^ ri r r �splitr r6 �urllibZrequestZurlopen�info�getr� rN rY rM )rE rx r6 r� r� Zurlrt Zdlenr r r �test_socketserverC s( z ThreadedTests.test_socketserverc C sp d } t j r" t j j d � n d } t t � } | �0t j t j � � } | j
d | j f � t j r� t j j d | � n | j | � | j � } t j r� t j j d | � n | | j
� k r| j d | d d � t | � | d d � j
� t | � f � n | j d
� t j r@t j j d � n | j � t j rft j j d � n Wd QXd S)
z'Check the example asyncore integration.zTEST MESSAGE of mixed case
rd s FOO
z 127.0.0.1z client: sending %r...
z client: read %r
z4bad data <<%r>> (%d) received; expected <<%r>> (%d)
Nr� s over
z client: closing connection.
z client: connection closed.
)r r r r r r� r� r r� r� r
ri r^ r� rV rN rY )rE r� rx r� r� r r r �test_asyncore_server] s4
'
z"ThreadedTests.test_asyncore_serverc s4 t j r t j j d � n t t d t j d t j d t d d d d �} | ��t j
t j � d d d
t d t d t j d t j �� � j t
| j f � � f d
d � } � f d d � } d � j d g f d � j d d g f d � j d g f g } d � j d g f d � j d d g f d | d g f d | d g f g } d } x1| D])\ } } } }
| | j d � } y� | | |
� � j � } | | j � k r| j d j d | d | d d � d t | � d! | d d � d" t | � � � n Wq]t k
r�}
z^ | r<| j d# j d | � � n t |
� j | � ss| j d$ j d | d% |
� � n WYd d }
~
Xq]Xq]Wx;| D]3\ } } } }
| | j d � } y� � j | � | |
� } | | j � k r8| j d& j d | d | d d � d t | � d! | d d � d" t | � � � n Wq�t k
r�}
zh | rp| j d' j d | � � n t |
� j | � s�| j d$ j d | d% |
� � n � j � WYd d }
~
Xq�Xq�W| j t � j d( g � | j t � j d) � | j t � j! t" d) � � � j d* � � j# � Wd QXd S)+z Test recv(), send() and friends.rd r� r� r� r� Tr� Fr
r rN r� c s- t d d � } � j | � } | d | � S)Ns �d )r� r� )�brf )r� r r �
_recv_into� s z0ThreadedTests.test_recv_send.<locals>._recv_intoc s3 t d d � } � j | � \ } } | d | � S)Ns r� )r� r )r� rf rz )r� r r �_recvfrom_into� s z4ThreadedTests.test_recv_send.<locals>._recvfrom_intor r z some.address�sendallr� r� r� r ZPREFIX_r" zpWhile sending with <<{name:s}>> bad data <<{outdata:r}>> ({nout:d}) received; expected <<{indata:r}>> ({nin:d})
r
r� Nr� Znoutr� Zninz>Failed to send with method <<{name:s}>>; expected to succeed.
zFMethod <<{name:s}>> failed with unexpected exception message: {exp:s}
ZexpzrWhile receiving with <<{name:s}>> bad data <<{outdata:r}>> ({nout:d}) received; expected <<{indata:r}>> ({nin:d})
zAFailed to receive with method <<{name:s}>>; expected to succeed.
s datar� s over
)$r r r r r rw r� r r< r� r� r� r
r ri r r r� r� r� rx r^ r� rV r� rN rP r� r� rO r� ZsendmsgZrecvmsgZ recvmsg_intor� rY )rE rx r� r� Z send_methodsZ recv_methodsZ data_prefixZ meth_nameZ send_methr� r3 r� r� r@ Z recv_methr )r� r �test_recv_send| s�
'
*
'
!
z ThreadedTests.test_recv_sendc s_ t j t j � � d } t j � � } t j � � d � � � � f d d � } t j d | � } | j � � j � z� zR t j t j � } | j d � | j
| | f � | j t j d t
j | � Wd | j � XzT t j t j � } t
j | � } | j d � | j t j d | j
| | f � Wd | j � XWd d � | j � � j � Xd S) Nz 127.0.0.1Fc s� � j d � � j � g } xT � ss t j � g g g d � \ } } } � | k r | j � j � d � q q Wx | D] } | j � q{ Wd S)Nr& g�������?r )rF r� rW r� r rY )Zconnsr� �wr@ r )�finishrx �startedr r �serve� s
$
z3ThreadedTests.test_handshake_timeout.<locals>.server� g�������?z timed outT)r� r� r r� r| r� r} r� r� r r
r r r r� rY r )rE rh ri r� r� rK r )r� rx r� r �test_handshake_timeout� s6
z$ThreadedTests.test_handshake_timeoutc sP t j t j � } t j | _ | j t � | j t � t j t j � � d } t
j � � } | j � d d �� t
j � � d � d � � � � � f d d � } t
j d | � } | j � � j � | j t j � � } | j | | f � | j � } | j � | j � � j � � j � | j � t j � | j � | � d S)Nz 127.0.0.1r
Tc s: � j d � � j � � j � \ � � � j d � d S)Nr& r )rF r� r r� r )�evt�peerrn rx r r r� /
s
z/ThreadedTests.test_server_accept.<locals>.server� )r r. r| r> r� r� r� r� r� r� r r� r� r| r� r} r� r� r
rG rY r r� r� rM )rE rt rh ri r� r� �clientZ client_addrr )r� r� rn rx r �test_server_accept
s0
z ThreadedTests.test_server_acceptc C so t j t j � } | j t j � � �B } | j t � � } | j � Wd QX| j | j j
t
j � Wd QXd S)N) r r. r| r� r� rO r� rQ rM r r �ENOTCONN)rE rt r r r r r �test_getpeercert_enotconnF
s
z'ThreadedTests.test_getpeercert_enotconnc C so t j t j � } | j t j � � �B } | j t � � } | j � Wd QX| j | j j
t
j � Wd QXd S)N) r r. r| r� r� rO r� rJ rM r r r )rE rt r r r r r �test_do_handshake_enotconnM
s
z(ThreadedTests.test_do_handshake_enotconnc C s� t j t j � } y | j d � Wn" t j k
rG | j d � Yn Xt t d t j d d ��Q } | j t j � � �3 } | j
t � � | j t
| j f � Wd QXWd QXWd QX| j d t | j d � � d S)NZDESzno DES cipher availabler� r� Fzno shared cipherr )r r. r| r� r/ r[ rw r� r� r� rO r� r
r ri rC r� r� )rE rt rx r� r r r �test_default_ciphersT
s (z"ThreadedTests.test_default_ciphersz"test requires ECDH-enabled OpenSSLc C s� t j t j � } | j t � t j d k r> | j d � n t d | � �U } | j t j � � �7 } | j
t | j f � | j
d | j � d � Wd QXWd QXd S)Nr r z
ECCdraft:ECDHrt ZECDH)r r r )r r. r| r� r� r r� rw r� r� r
r ri rC rq )rE rt rx r� r r r �test_default_ecdh_curvec
s
z%ThreadedTests.test_default_ecdh_curvez
tls-uniquez*'tls-unique' channel binding not availablec C sI t j r t j j d � n t t d t j d t j d t d d d d �} | ��t j
t j � d d d
t d t d t j d t j �} | j t
| j f � | j d
� } t j r� t j j d j | � � n | j | � | j t | � d � | j d � | j � j � } | j | t | � j d � � | j � t j
t j � d d d
t d t d t j d t j �} | j t
| j f � | j d
� } t j r�t j j d j | � � n | j | | � | j | � | j t | � d � | j d � | j � j � } | j | t | � j d � � | j � Wd QXd S)z Test tls-unique channel binding.rd r� r� r� r� Tr� Fr
r rN r� z
tls-uniquez! got channel binding data: {0!r}
� s CB tls-unique
zus-asciiz) got another channel binding data: {0!r}
N)r r r r r rw r� r r< r� r� r� r
r ri r r� ZassertIsNotNonerM rN r^ r� r� rx rY r_ )rE rx r� Zcb_dataZpeer_data_reprZ new_cb_datar r r r� t
s\
z-ThreadedTests.test_tls_unique_channel_bindingc C s� t j t j � } | j t � t | | d d d d �} t j rc t j j
d j | d � � n | j | d d d d h � d S)Nr� Tr� z got compression: {!r}
r� ZZLIBZRLE)
r r. r� r� r� r� r r r r r r� rC )rE rt r4 r r r �test_compression�
s
z ThreadedTests.test_compressionrB z*ssl.OP_NO_COMPRESSION needed for this testc C sd t j t j � } | j t � | j t j O_ t | | d d d d �} | j | d d � d S)Nr� Tr� r� ) r r. r� r� r� r� rB r� r )rE rt r4 r r r �test_compression_disabled�
s
z'ThreadedTests.test_compression_disabledc C s� t j t j � } | j t � | j t � | j d � t | | d d d d �} | d d } | j d � } d | k r� d | k r� d
| k r� | j
d | d � n d S) NZkEDHr� Tr� rq r �-ZADHZEDHZDHEzNon-DH cipher: ) r r. r� r� r� r� r� r� r� r� rV )rE rt r4 rq �partsr r r �test_dh_params�
s
$z ThreadedTests.test_dh_paramsc C sR t j t j � } | j t � t | | d d d d �} | j | d d � d S)Nr� Tr� r� )r r. r� r� r� r� r )rE rt r4 r r r �test_selected_npn_protocol�
s
z(ThreadedTests.test_selected_npn_protocolz NPN support needed for this testc C s� d d g } d d g d f d d g d f d d g d f d d g d f g } xq| D]i\ } } t j t j � } | j t � | j | � t j t j � } | j t � | j | � y t | | d d d d �} Wn. t j k
r} z | } WYd d } ~ Xn X| d k r1t r1| j | t j � qU d t
| � t
| � t
| � f } | d
}
| j |
| | |
d f � t | d � r�| d d n d } | j | | | | d f � qU Wd S)Nzhttp/1.1zspdy/2�test�abc�defr� Tr� zKfailed trying %s (s) and %s (c).
was expecting %s, but got %%s from the %%sZclient_alpn_protocolr� Zserver_alpn_protocolsr Znothingrx r� )
r r. r� r� r� r� r� r/ �IS_OPENSSL_1_1r� r� rM rN ) rE Zserver_protocolsZprotocol_testsZclient_protocolsr� r� r� r4 r@ r� Z
client_resultZ
server_resultr r r �test_npn_protocols�
s<
$ z ThreadedTests.test_npn_protocolsc C sv t j t j � } | j t � t j t j � } | j t � t j t j � } t j | _ | j t � | | | f S)N)
r r. r� r� r� �SIGNED_CERTFILE2r> r� r� r8 )rE r� �
other_contextr� r r r � sni_contexts s
zThreadedTests.sni_contextsc C s+ | d } | j d | f f | d � d S)Nr� rl rq )rC )rE r4 r
r r r r �check_common_name s
z ThreadedTests.check_common_namec s g � | j � \ } � } � � f d d � } | j | � t | | d d d d �} | j � d | f g � | j | d � g � t | | d d d d �} | j � d | f g � | j | d � g � | j d � t | | d d d d �} | j | d � | j � g � d S)
Nc s/ � j | | f � | d k r+ � | _ n d S)N)r� rt )r� � server_name�initial_context)�callsr r r �
servername_cb s z6ThreadedTests.test_sni_callback.<locals>.servername_cbr� Tr� � supermessageZ fakehostnamerm Znotfunny)r r r� rM r )rE r� r� r r4 r )r r r r s,
z ThreadedTests.test_sni_callbackc C s~ | j � \ } } } d d � } | j | � | j t j � �" } t | | d d d d �} Wd QX| j | j j d � d S)Nc S s t j S)N)r Z ALERT_DESCRIPTION_ACCESS_DENIED)r� r r r r r �cb_returning_alert; s zAThreadedTests.test_sni_callback_alert.<locals>.cb_returning_alertr� Fr� r ZTLSV1_ALERT_ACCESS_DENIED) r r rO r r/ r� rM r rB )rE r� r r� r r r4 r r r �test_sni_callback_alert6 s
z%ThreadedTests.test_sni_callback_alertc C s� | j � \ } } } d d � } | j | � | j t j � �7 } t j � �" } t | | d d d d �} Wd QXWd QX| j | j j
d � | j d | j � � d S) Nc S s d d d S)Nr r r )r� r r r r r �
cb_raisingJ s z;ThreadedTests.test_sni_callback_raising.<locals>.cb_raisingr� Fr� r Z SSLV3_ALERT_HANDSHAKE_FAILURE�ZeroDivisionError)
r r rO r r/ r �captured_stderrr� rM r rB rC �getvalue)rE r� r r� r r �stderrr4 r r r �test_sni_callback_raisingE s
z'ThreadedTests.test_sni_callback_raisingc C s� | j � \ } } } d d � } | j | � | j t j � �7 } t j � �" } t | | d d d d �} Wd QXWd QX| j | j j
d � | j d | j � � d S) Nc S s d S)NrI r )r� r r r r r �cb_wrong_return_type\ s zOThreadedTests.test_sni_callback_wrong_return_type.<locals>.cb_wrong_return_typer� Fr� r ZTLSV1_ALERT_INTERNAL_ERRORrQ )
r r rO r r/ r r r� rM r rB rC r )rE r� r r� r# r r! r4 r r r �#test_sni_callback_wrong_return_typeV s
z1ThreadedTests.test_sni_callback_wrong_return_typec C s� t j t j � } t j | _ | j t � | j t � t d | d d � } | �f | j t
j
� � } | j t | j
f � | j � | j t | j d � | j t | j d � Wd QXd S)Nrt r� Fi s hello)r r. r| r> r� r� r� r� rw r� r� r
r ri rY rO rP r^ r )rE rt rx r� r r r �,test_read_write_after_close_raises_valuerrorh s
z:ThreadedTests.test_read_write_after_close_raises_valuerrorN)3r� r� r� r: r� r� r2 r� r" r� r< r� r� r� r� r� r7 r r� r� r� r� r� r� r� r� r� r� r� r r r r r@ r r� r� r r r r ZHAS_NPNr r r r= r r r" r$ r% r r r r r� � sb & * & )( : s 1 & !;
!)
'r� c C s� t j r i t j d 6t j d 6t j d 6} xY | j � D]9 \ } } | � } | r: | d r: d | | f } Pq: q: Wt t j � � } t d t j
t j f � t d | � t d t j � t d t j
� y t d
t j � Wq t k
r� Yq Xn x] t t t t t t t t t t t t t g
D]. } t j j | � s.t j d | � � q.q.Wt! t" t# g } t j$ d � r�| j% t& � n t' r�t j( � } | r�| j% t) � q�n z t j* | � Wd t' r�t j+ | � n Xd S)
NZLinuxZMacZWindowsr z%s %rz test_ssl: testing with %r %rz under %sz HAS_SNI = %rz OP_ALL = 0x%8xz OP_NO_TLSv1_1 = 0x%8xz Can't read certificate file %rZnetwork),r r r0 r1 Zmac_verZ win32_ver�itemsr� �printr r� r rD r� r� �AttributeErrorr� rR r� r� r� r� r� r� r r8 r� �BADKEYr� r r �existsZ
TestFailedr� r; r? Zis_resource_enabledr� rM �
_have_threadsZthreading_setupr� Z run_unittestZthreading_cleanup)r Zplatsr
r5 Zplat�filenameZtests� thread_infor r r � test_mainx sL
r. �__main__)Yr r2 r
r r� rW Ztimer' r r r r� ZtempfileZurllib.requestr� r r� r� r0 r8 �
import_moduler �sortedr� r� r r� r� r� r r r
r� �fsencoder� r� r� r� r� r� r� r� r� r� r� r� r� r� r r8 rP rR r� r� r r) r� r� r� r� r r r r! r" r) r: r� rD r= ZTestCaser; r� r? rM r| � ImportErrorr+ Ztest.ssl_serversrv r} rw r� r� r� r� r� r. r� r r r r �<module> s� � � )� �)� O
�t +0� � � �0