From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Sat, 29 Mar 2025 10:51:11 +0000 (+0100)
Subject: [3.12] gh-131050: skip `test_dh_params` when TLS library lacks FFDHE ciphersuites... 
X-Git-Tag: v3.12.10~48
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=85b6b0e2d2fffbc8a5a84661e3dfee3deb7ab011;p=thirdparty%2FPython%2Fcpython.git

[3.12] gh-131050: skip `test_dh_params` when TLS library lacks FFDHE ciphersuites (GH-131051) (#131875)

gh-131050: skip `test_dh_params` when TLS library lacks FFDHE ciphersuites (GH-131051)
(cherry picked from commit be2d2181e62cd138b0cdf80ebc0dd4058187c52a)

Co-authored-by: Will Childs-Klein <willck93@gmail.com>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
---

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 581a1760204e..75b7e5ca506a 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -2782,6 +2782,14 @@ def try_protocol_combo(server_protocol, client_protocol, expect_success,
                                  % (expect_success, stats['version']))
 
 
+def supports_kx_alias(ctx, aliases):
+    for cipher in ctx.get_ciphers():
+        for alias in aliases:
+            if f"Kx={alias}" in cipher['description']:
+                return True
+    return False
+
+
 class ThreadedTests(unittest.TestCase):
 
     @support.requires_resource('walltime')
@@ -3970,8 +3978,13 @@ class ThreadedTests(unittest.TestCase):
                                    sni_name=hostname)
 
     def test_dh_params(self):
-        # Check we can get a connection with ephemeral Diffie-Hellman
+        # Check we can get a connection with ephemeral finite-field
+        # Diffie-Hellman (if supported).
         client_context, server_context, hostname = testing_context()
+        dhe_aliases = {"ADH", "EDH", "DHE"}
+        if not (supports_kx_alias(client_context, dhe_aliases)
+                and supports_kx_alias(server_context, dhe_aliases)):
+            self.skipTest("libssl doesn't support ephemeral DH")
         # test scenario needs TLS <= 1.2
         client_context.maximum_version = ssl.TLSVersion.TLSv1_2
         try:
@@ -3987,7 +4000,7 @@ class ThreadedTests(unittest.TestCase):
                                    sni_name=hostname)
         cipher = stats["cipher"][0]
         parts = cipher.split("-")
-        if "ADH" not in parts and "EDH" not in parts and "DHE" not in parts:
+        if not dhe_aliases.intersection(parts):
             self.fail("Non-DH key exchange: " + cipher[0])
 
     def test_ecdh_curve(self):
diff --git a/Misc/NEWS.d/next/Tests/2025-03-10-18-58-03.gh-issue-131050.FMBAPN.rst b/Misc/NEWS.d/next/Tests/2025-03-10-18-58-03.gh-issue-131050.FMBAPN.rst
new file mode 100644
index 000000000000..53096738619c
--- /dev/null
+++ b/Misc/NEWS.d/next/Tests/2025-03-10-18-58-03.gh-issue-131050.FMBAPN.rst
@@ -0,0 +1 @@
+``test_ssl.test_dh_params`` is skipped if the underlying TLS library does not support finite-field ephemeral Diffie-Hellman.