Python: fluent api tests

yoff · yoff · commit 87e1a062ea75 · 2021-03-03T17:50:46.000+01:00
diff --git a/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py b/python/ql/test/query-tests/Security/CWE-327/pyOpenSSL_fluent.py
@@ -0,0 +1,31 @@
+import socket
+from OpenSSL import SSL
+
+def test_fluent():
+    hostname = 'www.python.org'
+    context = SSL.Context(SSL.SSLv23_METHOD)
+
+    conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
+    r = conn.connect((hostname, 443))
+    print(conn.get_protocol_version_name())
+
+
+def test_fluent_no_TLSv1():
+    hostname = 'www.python.org'
+    context = SSL.Context(SSL.SSLv23_METHOD)
+    context.set_options(SSL.OP_NO_TLSv1)
+
+    conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
+    r = conn.connect((hostname, 443))
+    print(conn.get_protocol_version_name())
+
+
+def test_fluent_safe():
+    hostname = 'www.python.org'
+    context = SSL.Context(SSL.SSLv23_METHOD)
+    context.set_options(SSL.OP_NO_TLSv1)
+    context.set_options(SSL.OP_NO_TLSv1_1)
+
+    conn = SSL.Connection(context, socket.socket(socket.AF_INET, socket.SOCK_STREAM))
+    r = conn.connect((hostname, 443))
+    print(r, conn.get_protocol_version_name())
diff --git a/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py b/python/ql/test/query-tests/Security/CWE-327/ssl_fluent.py
@@ -0,0 +1,87 @@
+import socket
+import ssl
+
+def test_fluent_tls():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+
+def test_fluent_tls_no_TLSv1():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+    context.options |= ssl.OP_NO_TLSv1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_tls_safe():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+    context.options |= ssl.OP_NO_TLSv1
+    context.options |= ssl.OP_NO_TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+
+def test_fluent_ssl_no_TLSv1():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl_safe():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1
+    context.options |= ssl.OP_NO_TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl_safe_combined():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
+    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+# From Python 3.7
+# see https://docs.python.org/3/library/ssl.html#ssl.SSLContext.minimum_version
+def test_fluent_ssl_unsafe_version():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+    context.minimum_version = ssl.TLSVersion.TLSv1_1
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
+
+def test_fluent_ssl_safe_version():
+    hostname = 'www.python.org'
+    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
+    context.minimum_version = ssl.TLSVersion.TLSv1_3
+
+    with socket.create_connection((hostname, 443)) as sock:
+        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
+            print(ssock.version())
