Skip to content

Commit

Permalink
pythongh-89051: Add ssl.OP_LEGACY_SERVER_CONNECT (python#93927)
Browse files Browse the repository at this point in the history
Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com>
Co-authored-by: Christian Heimes <christian@python.org>
Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com>
Fixes python#89051

(cherry picked from commit 79ccc03)
  • Loading branch information
graingert authored and hugovk committed Dec 20, 2022
1 parent cfa78ec commit dd21351
Show file tree
Hide file tree
Showing 4 changed files with 26 additions and 0 deletions.
7 changes: 7 additions & 0 deletions Doc/library/ssl.rst
Original file line number Diff line number Diff line change
Expand Up @@ -918,6 +918,13 @@ Constants

.. versionadded:: 3.10

.. data:: OP_LEGACY_SERVER_CONNECT

Allow legacy insecure renegotiation between OpenSSL and unpatched servers
only.

.. versionadded:: 3.11.2

.. data:: HAS_ALPN

Whether the OpenSSL library has built-in support for the *Application-Layer
Expand Down
16 changes: 16 additions & 0 deletions Lib/test/test_ssl.py
Original file line number Diff line number Diff line change
Expand Up @@ -1702,6 +1702,8 @@ def _assert_context_options(self, ctx):
if OP_CIPHER_SERVER_PREFERENCE != 0:
self.assertEqual(ctx.options & OP_CIPHER_SERVER_PREFERENCE,
OP_CIPHER_SERVER_PREFERENCE)
self.assertEqual(ctx.options & ssl.OP_LEGACY_SERVER_CONNECT,
0 if IS_OPENSSL_3_0_0 else ssl.OP_LEGACY_SERVER_CONNECT)

def test_create_default_context(self):
ctx = ssl.create_default_context()
Expand Down Expand Up @@ -4094,6 +4096,20 @@ def test_compression_disabled(self):
sni_name=hostname)
self.assertIs(stats['compression'], None)

def test_legacy_server_connect(self):
client_context, server_context, hostname = testing_context()
client_context.options |= ssl.OP_LEGACY_SERVER_CONNECT
server_params_test(client_context, server_context,
chatty=True, connectionchatty=True,
sni_name=hostname)

def test_no_legacy_server_connect(self):
client_context, server_context, hostname = testing_context()
client_context.options &= ~ssl.OP_LEGACY_SERVER_CONNECT
server_params_test(client_context, server_context,
chatty=True, connectionchatty=True,
sni_name=hostname)

@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_dh_params(self):
# Check we can get a connection with ephemeral Diffie-Hellman
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Add :data:`ssl.OP_LEGACY_SERVER_CONNECT`
2 changes: 2 additions & 0 deletions Modules/_ssl.c
Original file line number Diff line number Diff line change
Expand Up @@ -5888,6 +5888,8 @@ sslmodule_init_constants(PyObject *m)
SSL_OP_CIPHER_SERVER_PREFERENCE);
PyModule_AddIntConstant(m, "OP_SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE);
PyModule_AddIntConstant(m, "OP_NO_TICKET", SSL_OP_NO_TICKET);
PyModule_AddIntConstant(m, "OP_LEGACY_SERVER_CONNECT",
SSL_OP_LEGACY_SERVER_CONNECT);
#ifdef SSL_OP_SINGLE_ECDH_USE
PyModule_AddIntConstant(m, "OP_SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE);
#endif
Expand Down

0 comments on commit dd21351

Please sign in to comment.