Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2463e5f

Browse files
pitroupitrou
committed
Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù.
1 parent f2c64ed commit 2463e5f

7 files changed

Lines changed: 194 additions & 81 deletions

File tree

‎Doc/library/ssl.rst‎

Lines changed: 45 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ probably additional platforms, as long as OpenSSL is installed on that platform.
2626

2727
Some behavior may be platform dependent, since calls are made to the
2828
operating system socket APIs. The installed version of OpenSSL may also
29-
cause variations in behavior.
29+
cause variations in behavior. For example, TLSv1.1 and TLSv1.2 come with
30+
openssl version 1.0.1.
3031

3132
This section documents the objects and functions in the ``ssl`` module; for more
3233
general information about TLS, SSL, and certificates, the reader is referred to
@@ -177,14 +178,16 @@ instead.
177178

178179
.. table::
179180

180-
======================== ========= ========= ========== =========
181-
*client* / **server** **SSLv2** **SSLv3** **SSLv23** **TLSv1**
182-
------------------------ --------- --------- ---------- ---------
183-
*SSLv2* yes no yes no
184-
*SSLv3* no yes yes no
185-
*SSLv23* yes no yes no
186-
*TLSv1* no no yes yes
187-
======================== ========= ========= ========== =========
181+
======================== ========= ========= ========== ========= =========== ===========
182+
*client* / **server** **SSLv2** **SSLv3** **SSLv23** **TLSv1** **TLSv1.1** **TLSv1.2**
183+
------------------------ --------- --------- ---------- --------- ----------- -----------
184+
*SSLv2* yes no yes no no no
185+
*SSLv3* no yes yes no no no
186+
*SSLv23* yes no yes no no no
187+
*TLSv1* no no yes yes no no
188+
*TLSv1.1* no no yes no yes no
189+
*TLSv1.2* no no yes no no yes
190+
======================== ========= ========= ========== ========= =========== ===========
188191

189192
.. note::
190193

@@ -401,9 +404,25 @@ Constants
401404

402405
.. data:: PROTOCOL_TLSv1
403406

404-
Selects TLS version 1 as the channel encryption protocol. This is the most
407+
Selects TLS version 1.0 as the channel encryption protocol.
408+
409+
.. data:: PROTOCOL_TLSv1_1
410+
411+
412+
Selects TLS version 1.1 as the channel encryption protocol.
413+
Available only with openssl version 1.0.1+.
414+
415+
.. versionadded:: 3.4
416+
417+
.. data:: PROTOCOL_TLSv1_2
418+
419+
420+
Selects TLS version 1.2 as the channel encryption protocol. This is the most
405421
modern version, and probably the best choice for maximum protection, if both
406422
sides can speak it.
423+
Available only with openssl version 1.0.1+.
424+
425+
.. versionadded:: 3.4
407426

408427
.. data:: OP_ALL
409428

@@ -437,6 +456,22 @@ Constants
437456

438457
.. versionadded:: 3.2
439458

459+
.. data:: OP_NO_TLSv1_1
460+
461+
Prevents a TLSv1.1 connection. This option is only applicable in conjunction
462+
with :const:`PROTOCOL_SSLv23`. It prevents the peers from choosing TLSv1.1 as
463+
the protocol version. Available only with openssl version 1.0.1+.
464+
465+
.. versionadded:: 3.4
466+
467+
.. data:: OP_NO_TLSv1_2
468+
469+
Prevents a TLSv1.2 connection. This option is only applicable in conjunction
470+
with :const:`PROTOCOL_SSLv23`. It prevents the peers from choosing TLSv1.2 as
471+
the protocol version. Available only with openssl version 1.0.1+.
472+
473+
.. versionadded:: 3.4
474+
440475
.. data:: OP_CIPHER_SERVER_PREFERENCE
441476

442477
Use the server's cipher ordering preference, rather than the client's.

‎Doc/whatsnew/3.4.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ Implementation improvements:
103103
Significantly Improved Library Modules:
104104

105105
* SHA-3 (Keccak) support for :mod:`hashlib`.
106+
* TLSv1.1 and TLSv1.2 support for :mod:`ssl`.
106107

107108
Security improvements:
108109

‎Lib/ssl.py‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,8 @@
5252
PROTOCOL_SSLv3
5353
PROTOCOL_SSLv23
5454
PROTOCOL_TLSv1
55+
PROTOCOL_TLSv1_1
56+
PROTOCOL_TLSv1_2
5557
5658
The following constants identify various SSL alert message descriptions as per
5759
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
@@ -110,8 +112,7 @@ def _import_symbols(prefix):
110112

111113
from _ssl import HAS_SNI, HAS_ECDH, HAS_NPN
112114

113-
from _ssl import (PROTOCOL_SSLv3, PROTOCOL_SSLv23,
114-
PROTOCOL_TLSv1)
115+
from _ssl import PROTOCOL_SSLv3, PROTOCOL_SSLv23, PROTOCOL_TLSv1
115116
from _ssl import _OPENSSL_API_VERSION
116117

117118

@@ -128,6 +129,14 @@ def _import_symbols(prefix):
128129
else:
129130
_PROTOCOL_NAMES[PROTOCOL_SSLv2] = "SSLv2"
130131

132+
try:
133+
from _ssl import PROTOCOL_TLSv1_1, PROTOCOL_TLSv1_2
134+
except ImportError:
135+
pass
136+
else:
137+
_PROTOCOL_NAMES[PROTOCOL_TLSv1_1] = "TLSv1.1"
138+
_PROTOCOL_NAMES[PROTOCOL_TLSv1_2] = "TLSv1.2"
139+
131140
from socket import getnameinfo as _getnameinfo
132141
from socket import socket, AF_INET, SOCK_STREAM, create_connection
133142
import base64 # for DER-to-PEM translation

‎Lib/test/test_ssl.py‎

Lines changed: 53 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -20,13 +20,7 @@
2020

2121
ssl = support.import_module("ssl")
2222

23-
PROTOCOLS = [
24-
ssl.PROTOCOL_SSLv3,
25-
ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1
26-
]
27-
if hasattr(ssl, 'PROTOCOL_SSLv2'):
28-
PROTOCOLS.append(ssl.PROTOCOL_SSLv2)
29-
23+
PROTOCOLS = sorted(ssl._PROTOCOL_NAMES)
3024
HOST = support.HOST
3125

3226
data_file = lambda name: os.path.join(os.path.dirname(__file__), name)
@@ -101,10 +95,6 @@ def f(*args, **kwargs):
10195
class BasicSocketTests(unittest.TestCase):
10296

10397
def test_constants(self):
104-
#ssl.PROTOCOL_SSLv2
105-
ssl.PROTOCOL_SSLv23
106-
ssl.PROTOCOL_SSLv3
107-
ssl.PROTOCOL_TLSv1
10898
ssl.CERT_NONE
10999
ssl.CERT_OPTIONAL
110100
ssl.CERT_REQUIRED
@@ -396,11 +386,8 @@ class ContextTests(unittest.TestCase):
396386

397387
@skip_if_broken_ubuntu_ssl
398388
def test_constructor(self):
399-
if hasattr(ssl, 'PROTOCOL_SSLv2'):
400-
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv2)
401-
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
402-
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv3)
403-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
389+
for protocol in PROTOCOLS:
390+
ssl.SSLContext(protocol)
404391
self.assertRaises(TypeError, ssl.SSLContext)
405392
self.assertRaises(ValueError, ssl.SSLContext, -1)
406393
self.assertRaises(ValueError, ssl.SSLContext, 42)
@@ -1360,12 +1347,15 @@ def try_protocol_combo(server_protocol, client_protocol, expect_success,
13601347
client_context.options = ssl.OP_ALL | client_options
13611348
server_context = ssl.SSLContext(server_protocol)
13621349
server_context.options = ssl.OP_ALL | server_options
1350+
1351+
# NOTE: we must enable "ALL" ciphers on the client, otherwise an
1352+
# SSLv23 client will send an SSLv3 hello (rather than SSLv2)
1353+
# starting from OpenSSL 1.0.0 (see issue #8322).
1354+
if client_context.protocol == ssl.PROTOCOL_SSLv23:
1355+
client_context.set_ciphers("ALL")
1356+
13631357
for ctx in (client_context, server_context):
13641358
ctx.verify_mode = certsreqs
1365-
# NOTE: we must enable "ALL" ciphers, otherwise an SSLv23 client
1366-
# will send an SSLv3 hello (rather than SSLv2) starting from
1367-
# OpenSSL 1.0.0 (see issue #8322).
1368-
ctx.set_ciphers("ALL")
13691359
ctx.load_cert_chain(CERTFILE)
13701360
ctx.load_verify_locations(CERTFILE)
13711361
try:
@@ -1581,6 +1571,49 @@ def test_protocol_tlsv1(self):
15811571
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv23, False,
15821572
client_options=ssl.OP_NO_TLSv1)
15831573

1574+
@skip_if_broken_ubuntu_ssl
1575+
@unittest.skipUnless(hasattr(ssl, "PROTOCOL_TLSv1_1"),
1576+
"TLS version 1.1 not supported.")
1577+
def test_protocol_tlsv1_1(self):
1578+
"""Connecting to a TLSv1.1 server with various client options.
1579+
Testing against older TLS versions."""
1580+
if support.verbose:
1581+
sys.stdout.write("\n")
1582+
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_1, True)
1583+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
1584+
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv2, False)
1585+
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv3, False)
1586+
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv23, False,
1587+
client_options=ssl.OP_NO_TLSv1_1)
1588+
1589+
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1_1, True)
1590+
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1, False)
1591+
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_1, False)
1592+
1593+
1594+
@skip_if_broken_ubuntu_ssl
1595+
@unittest.skipUnless(hasattr(ssl, "PROTOCOL_TLSv1_2"),
1596+
"TLS version 1.2 not supported.")
1597+
def test_protocol_tlsv1_2(self):
1598+
"""Connecting to a TLSv1.2 server with various client options.
1599+
Testing against older TLS versions."""
1600+
if support.verbose:
1601+
sys.stdout.write("\n")
1602+
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_2, True,
1603+
server_options=ssl.OP_NO_SSLv3|ssl.OP_NO_SSLv2,
1604+
client_options=ssl.OP_NO_SSLv3|ssl.OP_NO_SSLv2,)
1605+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
1606+
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv2, False)
1607+
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv3, False)
1608+
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv23, False,
1609+
client_options=ssl.OP_NO_TLSv1_2)
1610+
1611+
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1_2, True)
1612+
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False)
1613+
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False)
1614+
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
1615+
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False)
1616+
15841617
def test_starttls(self):
15851618
"""Switching from clear text to encrypted and back again."""
15861619
msgs = (b"msg 1", b"MSG 2", b"STARTTLS", b"MSG 3", b"msg 4", b"ENDTLS", b"msg 5", b"msg 6")

‎Misc/NEWS‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,6 +297,9 @@ Core and Builtins
297297
Library
298298
-------
299299

300+
- Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial
301+
patch by Michele Orrù.
302+
300303
- Issue #17025: multiprocessing: Reduce Queue and SimpleQueue contention.
301304

302305
- Issue #17536: Add to webbrowser's browser list: www-browser, x-www-browser,
@@ -1005,6 +1008,8 @@ _ Issue #17385: Fix quadratic behavior in threading.Condition. The FIFO
10051008
- ctypes.call_commethod was removed, since its only usage was in the defunct
10061009
samples directory.
10071010

1011+
- Issue #16692: Added TLSv1.1 and TLSv1.2 support for the ssl modules.
1012+
10081013
Extension Modules
10091014
-----------------
10101015

0 commit comments

Comments
 (0)