mirror of
https://github.com/github/codeql.git
synced 2026-05-05 13:45:19 +02:00
Merge branch 'main' into port-weak-crypto-algorithm
This commit is contained in:
Rasmus Wriedt Larsen
@@ -1,14 +1,39 @@
|
||||
| InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to deprecated method ssl.wrap_socket. |
|
||||
| InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_SSLv3 specified in call to deprecated method ssl.wrap_socket. |
|
||||
| InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_TLSv1 specified in call to deprecated method ssl.wrap_socket. |
|
||||
| InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to ssl.SSLContext. |
|
||||
| InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_SSLv3 specified in call to ssl.SSLContext. |
|
||||
| InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_TLSv1 specified in call to ssl.SSLContext. |
|
||||
| InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2_METHOD specified in call to pyOpenSSL.SSL.Context. |
|
||||
| InsecureProtocol.py:15:1:15:30 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv23_METHOD specified in call to pyOpenSSL.SSL.Context. |
|
||||
| InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3_METHOD specified in call to pyOpenSSL.SSL.Context. |
|
||||
| InsecureProtocol.py:17:1:17:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1_METHOD specified in call to pyOpenSSL.SSL.Context. |
|
||||
| InsecureProtocol.py:32:1:32:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2_METHOD specified in call to pyOpenSSL.SSL.Context. |
|
||||
| InsecureProtocol.py:48:1:48:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to deprecated method ssl.wrap_socket. |
|
||||
| InsecureProtocol.py:49:1:49:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version PROTOCOL_SSLv2 specified in call to ssl.SSLContext. |
|
||||
| InsecureProtocol.py:52:1:52:33 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv23_METHOD specified in call to ssl.SSLContext. |
|
||||
| InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@ | InsecureProtocol.py:6:1:6:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
|
||||
| InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified by $@ | InsecureProtocol.py:7:1:7:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
|
||||
| InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified by $@ | InsecureProtocol.py:8:1:8:47 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
|
||||
| InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified by $@ | InsecureProtocol.py:10:1:10:39 | ControlFlowNode for SSLContext() | call to SSLContext |
|
||||
| InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv3 specified by $@ | InsecureProtocol.py:11:1:11:39 | ControlFlowNode for SSLContext() | call to SSLContext |
|
||||
| InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version TLSv1 specified by $@ | InsecureProtocol.py:12:1:12:39 | ControlFlowNode for SSLContext() | call to SSLContext |
|
||||
| InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@ | InsecureProtocol.py:14:1:14:29 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| InsecureProtocol.py:15:1:15:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv3 specified by $@ | InsecureProtocol.py:15:1:15:29 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version TLSv1 specified by $@ | InsecureProtocol.py:16:1:16:29 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| InsecureProtocol.py:19:1:19:19 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@ | InsecureProtocol.py:19:1:19:19 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| InsecureProtocol.py:23:1:23:43 | ControlFlowNode for Attribute() | Insecure SSL/TLS protocol version SSLv2 specified by $@ | InsecureProtocol.py:23:1:23:43 | ControlFlowNode for Attribute() | call to ssl.wrap_socket |
|
||||
| InsecureProtocol.py:24:1:24:35 | ControlFlowNode for SSLContext() | Insecure SSL/TLS protocol version SSLv2 specified by $@ | InsecureProtocol.py:24:1:24:35 | ControlFlowNode for SSLContext() | call to SSLContext |
|
||||
| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv2 allowed by $@ | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@ | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@ | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| pyOpenSSL_fluent.py:8:27:8:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | pyOpenSSL_fluent.py:6:15:6:44 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv2 allowed by $@ | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@ | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| pyOpenSSL_fluent.py:18:27:18:33 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | pyOpenSSL_fluent.py:15:15:15:44 | ControlFlowNode for Attribute() | call to SSL.Context |
|
||||
| ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@ | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:9:14:9:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:6:15:6:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:19:14:19:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:15:15:15:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:28:14:28:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:24:15:24:53 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:37:14:37:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:33:15:33:53 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:57:14:57:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@ | ssl_fluent.py:54:15:54:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:57:14:57:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:54:15:54:49 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@ | ssl_fluent.py:62:12:62:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@ | ssl_fluent.py:101:15:101:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:62:12:62:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:101:15:101:46 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:117:5:117:11 | ControlFlowNode for context | context modification |
|
||||
| ssl_fluent.py:71:14:71:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:135:5:135:11 | ControlFlowNode for context | context modification |
|
||||
| ssl_fluent.py:77:14:77:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@ | ssl_fluent.py:62:12:62:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:77:14:77:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:62:12:62:43 | ControlFlowNode for Attribute() | call to ssl.SSLContext |
|
||||
| ssl_fluent.py:97:14:97:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:95:5:95:11 | ControlFlowNode for context | context modification |
|
||||
| ssl_fluent.py:146:14:146:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:143:5:143:11 | ControlFlowNode for context | context modification |
|
||||
| ssl_fluent.py:165:14:165:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version SSLv3 allowed by $@ | ssl_fluent.py:162:5:162:11 | ControlFlowNode for context | context modification |
|
||||
| ssl_fluent.py:165:14:165:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1 allowed by $@ | ssl_fluent.py:161:15:161:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
|
||||
| ssl_fluent.py:165:14:165:20 | ControlFlowNode for context | Insecure SSL/TLS protocol version TLSv1_1 allowed by $@ | ssl_fluent.py:161:15:161:65 | ControlFlowNode for Attribute() | call to ssl.create_default_context |
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
import ssl
|
||||
from pyOpenSSL import SSL
|
||||
from OpenSSL import SSL
|
||||
from ssl import SSLContext
|
||||
|
||||
# true positives
|
||||
# insecure versions specified
|
||||
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2)
|
||||
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3)
|
||||
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1)
|
||||
@@ -12,41 +12,26 @@ SSLContext(protocol=ssl.PROTOCOL_SSLv3)
|
||||
SSLContext(protocol=ssl.PROTOCOL_TLSv1)
|
||||
|
||||
SSL.Context(SSL.SSLv2_METHOD)
|
||||
SSL.Context(SSL.SSLv23_METHOD)
|
||||
SSL.Context(SSL.SSLv3_METHOD)
|
||||
SSL.Context(SSL.TLSv1_METHOD)
|
||||
|
||||
# not relevant
|
||||
wrap_socket(ssl_version=ssl.PROTOCOL_SSLv3)
|
||||
wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1)
|
||||
wrap_socket(ssl_version=ssl.PROTOCOL_SSLv2)
|
||||
|
||||
Context(SSL.SSLv3_METHOD)
|
||||
Context(SSL.TLSv1_METHOD)
|
||||
Context(SSL.SSLv2_METHOD)
|
||||
Context(SSL.SSLv23_METHOD)
|
||||
|
||||
# true positive using flow
|
||||
|
||||
METHOD = SSL.SSLv2_METHOD
|
||||
SSL.Context(METHOD)
|
||||
|
||||
# secure versions
|
||||
|
||||
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_1)
|
||||
SSLContext(protocol=ssl.PROTOCOL_TLSv1_1)
|
||||
SSL.Context(SSL.TLSv1_1_METHOD)
|
||||
|
||||
# possibly insecure default
|
||||
ssl.wrap_socket()
|
||||
context = SSLContext()
|
||||
|
||||
# importing the protocol constant directly
|
||||
|
||||
from ssl import PROTOCOL_SSLv2
|
||||
|
||||
ssl.wrap_socket(ssl_version=PROTOCOL_SSLv2)
|
||||
SSLContext(protocol=PROTOCOL_SSLv2)
|
||||
|
||||
# FP for insecure default
|
||||
ssl.SSLContext(ssl.SSLv23_METHOD)
|
||||
# secure versions specified
|
||||
ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_2)
|
||||
SSLContext(protocol=ssl.PROTOCOL_TLSv1_2)
|
||||
SSL.Context(SSL.TLSv1_2_METHOD)
|
||||
|
||||
# insecure versions allowed by specified range
|
||||
SSLContext(protocol=ssl.PROTOCOL_SSLv23)
|
||||
SSLContext(protocol=ssl.PROTOCOL_TLS)
|
||||
SSLContext(protocol=ssl.PROTOCOL_TLS_CLIENT)
|
||||
SSLContext(protocol=ssl.PROTOCOL_TLS_SERVER)
|
||||
|
||||
SSL.Context(SSL.SSLv23_METHOD)
|
||||
|
||||
@@ -0,0 +1,41 @@
|
||||
import socket
|
||||
from OpenSSL import SSL
|
||||
|
||||
def test_fluent():
|
||||
hostname = 'www.python.org'
|
||||
context = SSL.Context(SSL.SSLv23_METHOD)
|
||||
|
||||
conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
|
||||
r = conn.connect((hostname, 443))
|
||||
print(conn.get_protocol_version_name())
|
||||
|
||||
|
||||
def test_fluent_no_TLSv1():
|
||||
hostname = 'www.python.org'
|
||||
context = SSL.Context(SSL.SSLv23_METHOD)
|
||||
context.set_options(SSL.OP_NO_TLSv1)
|
||||
|
||||
conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
|
||||
r = conn.connect((hostname, 443))
|
||||
print(conn.get_protocol_version_name())
|
||||
|
||||
|
||||
def test_fluent_safe():
|
||||
hostname = 'www.python.org'
|
||||
context = SSL.Context(SSL.SSLv23_METHOD)
|
||||
context.set_options(SSL.OP_NO_SSLv2)
|
||||
context.set_options(SSL.OP_NO_SSLv3)
|
||||
context.set_options(SSL.OP_NO_TLSv1)
|
||||
context.set_options(SSL.OP_NO_TLSv1_1)
|
||||
|
||||
conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
|
||||
r = conn.connect((hostname, 443))
|
||||
print(r, conn.get_protocol_version_name())
|
||||
|
||||
def test_safe_by_construction():
|
||||
hostname = 'www.python.org'
|
||||
context = SSL.Context(SSL.TLSv1_2_METHOD)
|
||||
|
||||
conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
|
||||
r = conn.connect((hostname, 443))
|
||||
print(conn.get_protocol_version_name())
|
||||
166
python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
Normal file
166
python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
Normal file
@@ -0,0 +1,166 @@
|
||||
import socket
|
||||
import ssl
|
||||
|
||||
def test_fluent_tls():
|
||||
hostname = 'www.python.org'
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
|
||||
with socket.create_connection((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
|
||||
def test_fluent_tls_no_TLSv1():
|
||||
hostname = 'www.python.org'
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
context.options |= ssl.OP_NO_TLSv1
|
||||
|
||||
with socket.create_connection((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_fluent_tls_client_no_TLSv1():
|
||||
hostname = 'www.python.org'
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
||||
context.options |= ssl.OP_NO_TLSv1
|
||||
|
||||
with socket.create_connection((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_fluent_tls_server_no_TLSv1():
|
||||
hostname = 'www.python.org'
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
|
||||
context.options |= ssl.OP_NO_TLSv1
|
||||
|
||||
with socket.create_server((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_fluent_tls_safe():
|
||||
hostname = 'www.python.org'
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
context.options |= ssl.OP_NO_TLSv1
|
||||
context.options |= ssl.OP_NO_TLSv1_1
|
||||
|
||||
with socket.create_connection((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_fluent_ssl():
|
||||
hostname = 'www.python.org'
|
||||
# notice that `ssl.PROTOCOL_SSLv23` is just a deprecated alias for `ssl.PROTOCOL_TLS`.
|
||||
# Therefore, we only have this one test using PROTOCOL_SSLv23, to show that we handle this alias correctly.
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
|
||||
|
||||
with socket.create_connection((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
|
||||
def create_relaxed_context():
|
||||
return ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
|
||||
def create_secure_context():
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
|
||||
return context
|
||||
|
||||
def create_connection(context):
|
||||
with socket.create_connection(('www.python.org', 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_delegated_context_unsafe():
|
||||
context = create_relaxed_context()
|
||||
with socket.create_connection(('www.python.org', 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_delegated_context_safe():
|
||||
context = create_secure_context()
|
||||
with socket.create_connection(('www.python.org', 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_delegated_context_made_safe():
|
||||
context = create_relaxed_context()
|
||||
context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
|
||||
with socket.create_connection(('www.python.org', 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_delegated_context_made_unsafe():
|
||||
context = create_secure_context()
|
||||
context.options &= ~ssl.OP_NO_TLSv1_1
|
||||
with socket.create_connection(('www.python.org', 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_delegated_connection_unsafe():
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
create_connection(context)
|
||||
|
||||
def test_delegated_connection_safe():
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
|
||||
create_connection(context)
|
||||
|
||||
def test_delegated_connection_made_safe():
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
|
||||
create_connection(context)
|
||||
|
||||
def test_delegated_connection_made_unsafe():
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
|
||||
context.options &= ~ssl.OP_NO_TLSv1_1
|
||||
create_connection(context)
|
||||
|
||||
def test_delegated_unsafe():
|
||||
context = create_relaxed_context()
|
||||
create_connection(context)
|
||||
|
||||
def test_delegated_safe():
|
||||
context = create_secure_context()
|
||||
create_connection(context)
|
||||
|
||||
def test_delegated_made_safe():
|
||||
context = create_relaxed_context()
|
||||
context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
|
||||
create_connection(context)
|
||||
|
||||
def test_delegated_made_unsafe():
|
||||
context = create_secure_context()
|
||||
context.options &= ~ssl.OP_NO_TLSv1_1
|
||||
create_connection(context)
|
||||
|
||||
# From Python 3.7
|
||||
# see https://docs.python.org/3/library/ssl.html#ssl.SSLContext.minimum_version
|
||||
def test_fluent_ssl_unsafe_version():
|
||||
hostname = 'www.python.org'
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
context.minimum_version = ssl.TLSVersion.TLSv1_1
|
||||
|
||||
with socket.create_connection((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
def test_fluent_ssl_safe_version():
|
||||
hostname = 'www.python.org'
|
||||
context = ssl.SSLContext(ssl.PROTOCOL_TLS)
|
||||
context.minimum_version = ssl.TLSVersion.TLSv1_3
|
||||
|
||||
with socket.create_connection((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
|
||||
# Taken from https://docs.python.org/3/library/ssl.html#context-creation
|
||||
def test_fluent_explicitly_unsafe():
|
||||
hostname = 'www.python.org'
|
||||
context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
|
||||
context.options &= ~ssl.OP_NO_SSLv3
|
||||
|
||||
with socket.create_connection((hostname, 443)) as sock:
|
||||
with context.wrap_socket(sock, server_hostname=hostname) as ssock:
|
||||
print(ssock.version())
|
||||
Reference in New Issue
Block a user