From 85b6b0e2d2fffbc8a5a84661e3dfee3deb7ab011 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Sat, 29 Mar 2025 11:51:11 +0100 Subject: [PATCH] [3.12] gh-131050: skip `test_dh_params` when TLS library lacks FFDHE ciphersuites (GH-131051) (#131875) MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit gh-131050: skip `test_dh_params` when TLS library lacks FFDHE ciphersuites (GH-131051) (cherry picked from commit be2d2181e62cd138b0cdf80ebc0dd4058187c52a) Co-authored-by: Will Childs-Klein Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com> --- Lib/test/test_ssl.py | 17 +++++++++++++++-- ...25-03-10-18-58-03.gh-issue-131050.FMBAPN.rst | 1 + 2 files changed, 16 insertions(+), 2 deletions(-) create mode 100644 Misc/NEWS.d/next/Tests/2025-03-10-18-58-03.gh-issue-131050.FMBAPN.rst diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 581a1760204e..75b7e5ca506a 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -2782,6 +2782,14 @@ def try_protocol_combo(server_protocol, client_protocol, expect_success, % (expect_success, stats['version'])) +def supports_kx_alias(ctx, aliases): + for cipher in ctx.get_ciphers(): + for alias in aliases: + if f"Kx={alias}" in cipher['description']: + return True + return False + + class ThreadedTests(unittest.TestCase): @support.requires_resource('walltime') @@ -3970,8 +3978,13 @@ class ThreadedTests(unittest.TestCase): sni_name=hostname) def test_dh_params(self): - # Check we can get a connection with ephemeral Diffie-Hellman + # Check we can get a connection with ephemeral finite-field + # Diffie-Hellman (if supported). client_context, server_context, hostname = testing_context() + dhe_aliases = {"ADH", "EDH", "DHE"} + if not (supports_kx_alias(client_context, dhe_aliases) + and supports_kx_alias(server_context, dhe_aliases)): + self.skipTest("libssl doesn't support ephemeral DH") # test scenario needs TLS <= 1.2 client_context.maximum_version = ssl.TLSVersion.TLSv1_2 try: @@ -3987,7 +4000,7 @@ class ThreadedTests(unittest.TestCase): sni_name=hostname) cipher = stats["cipher"][0] parts = cipher.split("-") - if "ADH" not in parts and "EDH" not in parts and "DHE" not in parts: + if not dhe_aliases.intersection(parts): self.fail("Non-DH key exchange: " + cipher[0]) def test_ecdh_curve(self): diff --git a/Misc/NEWS.d/next/Tests/2025-03-10-18-58-03.gh-issue-131050.FMBAPN.rst b/Misc/NEWS.d/next/Tests/2025-03-10-18-58-03.gh-issue-131050.FMBAPN.rst new file mode 100644 index 000000000000..53096738619c --- /dev/null +++ b/Misc/NEWS.d/next/Tests/2025-03-10-18-58-03.gh-issue-131050.FMBAPN.rst @@ -0,0 +1 @@ +``test_ssl.test_dh_params`` is skipped if the underlying TLS library does not support finite-field ephemeral Diffie-Hellman. -- 2.47.3