GeezerVison

Original file line number	Diff line number	Diff line change
Expand Up		@@ -823,6 +823,13 @@ Constants

		.. versionadded:: 3.12

		.. data:: OP_LEGACY_SERVER_CONNECT

		Allow legacy insecure renegotiation between OpenSSL and unpatched servers
		only.

		.. versionadded:: 3.12

		.. data:: HAS_ALPN

		Whether the OpenSSL library has built-in support for the *Application-Layer
Expand Down

16 changes: 16 additions & 0 deletions 16 Lib/test/test_ssl.py

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -1461,6 +1461,8 @@ def _assert_context_options(self, ctx):
		if OP_CIPHER_SERVER_PREFERENCE != 0:
		self.assertEqual(ctx.options & OP_CIPHER_SERVER_PREFERENCE,
		OP_CIPHER_SERVER_PREFERENCE)
		self.assertEqual(ctx.options & ssl.OP_LEGACY_SERVER_CONNECT,
		0 if IS_OPENSSL_3_0_0 else ssl.OP_LEGACY_SERVER_CONNECT)

		def test_create_default_context(self):
		ctx = ssl.create_default_context()
Expand Down Expand Up		@@ -3815,6 +3817,20 @@ def test_compression_disabled(self):
		sni_name=hostname)
		self.assertIs(stats['compression'], None)

		def test_legacy_server_connect(self):
		client_context, server_context, hostname = testing_context()
		client_context.options \|= ssl.OP_LEGACY_SERVER_CONNECT
		server_params_test(client_context, server_context,
Comment thread graingert Jun 17, 2022 Copy link Copy Markdown Contributor Author There was a problem hiding this comment. Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Is there a mechanism for creating a bad TLS server that doesn't support secure renegotiation indication? Sorry, something went wrong. Uh oh! There was an error while loading. Please reload this page. All reactions
		chatty=True, connectionchatty=True,
		sni_name=hostname)

		def test_no_legacy_server_connect(self):
		client_context, server_context, hostname = testing_context()
		client_context.options &= ~ssl.OP_LEGACY_SERVER_CONNECT
		server_params_test(client_context, server_context,
		chatty=True, connectionchatty=True,
		sni_name=hostname)

		@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
		def test_dh_params(self):
		# Check we can get a connection with ephemeral Diffie-Hellman
Expand Down

1 change: 1 addition & 0 deletions 1 Misc/NEWS.d/next/Core and Builtins/2022-06-17-08-00-34.gh-issue-89051.yP4Na0.rst

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Add :data:`ssl.OP_LEGACY_SERVER_CONNECT`

2 changes: 2 additions & 0 deletions 2 Modules/_ssl.c

Show comments

View file

Open in desktop

Original file line number	Diff line number	Diff line change
Expand Up		@@ -5845,6 +5845,8 @@ sslmodule_init_constants(PyObject *m)
		SSL_OP_CIPHER_SERVER_PREFERENCE);
		PyModule_AddIntConstant(m, "OP_SINGLE_DH_USE", SSL_OP_SINGLE_DH_USE);
		PyModule_AddIntConstant(m, "OP_NO_TICKET", SSL_OP_NO_TICKET);
		PyModule_AddIntConstant(m, "OP_LEGACY_SERVER_CONNECT",
		SSL_OP_LEGACY_SERVER_CONNECT);
		#ifdef SSL_OP_SINGLE_ECDH_USE
		PyModule_AddIntConstant(m, "OP_SINGLE_ECDH_USE", SSL_OP_SINGLE_ECDH_USE);
		#endif
Expand Down

Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.

You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

gh-89051: Add ssl.OP_LEGACY_SERVER_CONNECT #93927

Uh oh!

gh-89051: Add ssl.OP_LEGACY_SERVER_CONNECT #93927

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

graingert Jun 17, 2022

Choose a reason for hiding this comment

Uh oh!