2929
3030HOST = support .HOST
3131
32- data_file = lambda name : os .path .join (os .path .dirname (__file__ ), name )
32+ def data_file (* name ):
33+ return os .path .join (os .path .dirname (__file__ ), * name )
3334
3435# The custom key and certificate files used in test_ssl are generated
3536# using Lib/test/make_ssl_certs.py.
4445BYTES_ONLYKEY = os .fsencode (ONLYKEY )
4546CAPATH = data_file ("capath" )
4647BYTES_CAPATH = os .fsencode (CAPATH )
48+ CAFILE_CACERT = data_file ("capath" , "5ed36f99.0" )
4749
48- SVN_PYTHON_ORG_ROOT_CERT = data_file ("https_svn_python_org_root.pem" )
50+ REMOTE_HOST = "self-signed.pythontest.net"
51+ REMOTE_ROOT_CERT = data_file ("selfsigned_pythontestdotnet.pem" )
4952
5053EMPTYCERT = data_file ("nullcert.pem" )
5154BADCERT = data_file ("badcert.pem" )
@@ -163,7 +166,7 @@ def test_parse_cert_CVE_2013_4073(self):
163166 )
164167
165168 def test_DER_to_PEM (self ):
166- with open (SVN_PYTHON_ORG_ROOT_CERT , 'r' ) as f :
169+ with open (CAFILE_CACERT , 'r' ) as f :
167170 pem = f .read ()
168171 d1 = ssl .PEM_cert_to_DER_cert (pem )
169172 p2 = ssl .DER_cert_to_PEM_cert (d1 )
@@ -462,7 +465,7 @@ def test_load_cert_chain(self):
462465 # Mismatching key and cert
463466 ctx = ssl .SSLContext (ssl .PROTOCOL_TLSv1 )
464467 with self .assertRaisesRegex (ssl .SSLError , "key values mismatch" ):
465- ctx .load_cert_chain (SVN_PYTHON_ORG_ROOT_CERT , ONLYKEY )
468+ ctx .load_cert_chain (CAFILE_CACERT , ONLYKEY )
466469
467470 def test_load_verify_locations (self ):
468471 ctx = ssl .SSLContext (ssl .PROTOCOL_TLSv1 )
@@ -511,11 +514,11 @@ def test_set_default_verify_paths(self):
511514class NetworkedTests (unittest .TestCase ):
512515
513516 def test_connect (self ):
514- with support .transient_internet ("svn.python.org" ):
517+ with support .transient_internet (REMOTE_HOST ):
515518 s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
516519 cert_reqs = ssl .CERT_NONE )
517520 try :
518- s .connect (("svn.python.org" , 443 ))
521+ s .connect ((REMOTE_HOST , 443 ))
519522 self .assertEqual ({}, s .getpeercert ())
520523 finally :
521524 s .close ()
@@ -524,42 +527,42 @@ def test_connect(self):
524527 s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
525528 cert_reqs = ssl .CERT_REQUIRED )
526529 self .assertRaisesRegex (ssl .SSLError , "certificate verify failed" ,
527- s .connect , ("svn.python.org" , 443 ))
530+ s .connect , (REMOTE_HOST , 443 ))
528531 s .close ()
529532
530533 # this should succeed because we specify the root cert
531534 s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
532535 cert_reqs = ssl .CERT_REQUIRED ,
533- ca_certs = SVN_PYTHON_ORG_ROOT_CERT )
536+ ca_certs = REMOTE_ROOT_CERT )
534537 try :
535- s .connect (("svn.python.org" , 443 ))
538+ s .connect ((REMOTE_HOST , 443 ))
536539 self .assertTrue (s .getpeercert ())
537540 finally :
538541 s .close ()
539542
540543 def test_connect_ex (self ):
541544 # Issue #11326: check connect_ex() implementation
542- with support .transient_internet ("svn.python.org" ):
545+ with support .transient_internet (REMOTE_HOST ):
543546 s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
544547 cert_reqs = ssl .CERT_REQUIRED ,
545- ca_certs = SVN_PYTHON_ORG_ROOT_CERT )
548+ ca_certs = REMOTE_ROOT_CERT )
546549 try :
547- self .assertEqual (0 , s .connect_ex (("svn.python.org" , 443 )))
550+ self .assertEqual (0 , s .connect_ex ((REMOTE_HOST , 443 )))
548551 self .assertTrue (s .getpeercert ())
549552 finally :
550553 s .close ()
551554
552555 def test_non_blocking_connect_ex (self ):
553556 # Issue #11326: non-blocking connect_ex() should allow handshake
554557 # to proceed after the socket gets ready.
555- with support .transient_internet ("svn.python.org" ):
558+ with support .transient_internet (REMOTE_HOST ):
556559 s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
557560 cert_reqs = ssl .CERT_REQUIRED ,
558- ca_certs = SVN_PYTHON_ORG_ROOT_CERT ,
561+ ca_certs = REMOTE_ROOT_CERT ,
559562 do_handshake_on_connect = False )
560563 try :
561564 s .setblocking (False )
562- rc = s .connect_ex (('svn.python.org' , 443 ))
565+ rc = s .connect_ex ((REMOTE_HOST , 443 ))
563566 # EWOULDBLOCK under Windows, EINPROGRESS elsewhere
564567 self .assertIn (rc , (0 , errno .EINPROGRESS , errno .EWOULDBLOCK ))
565568 # Wait for connect to finish
@@ -584,59 +587,59 @@ def test_non_blocking_connect_ex(self):
584587 def test_timeout_connect_ex (self ):
585588 # Issue #12065: on a timeout, connect_ex() should return the original
586589 # errno (mimicking the behaviour of non-SSL sockets).
587- with support .transient_internet ("svn.python.org" ):
590+ with support .transient_internet (REMOTE_HOST ):
588591 s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
589592 cert_reqs = ssl .CERT_REQUIRED ,
590- ca_certs = SVN_PYTHON_ORG_ROOT_CERT ,
593+ ca_certs = REMOTE_ROOT_CERT ,
591594 do_handshake_on_connect = False )
592595 try :
593596 s .settimeout (0.0000001 )
594- rc = s .connect_ex (('svn.python.org' , 443 ))
597+ rc = s .connect_ex ((REMOTE_HOST , 443 ))
595598 if rc == 0 :
596- self .skipTest ("svn.python.org responded too quickly" )
599+ self .skipTest ("REMOTE_HOST responded too quickly" )
597600 self .assertIn (rc , (errno .EAGAIN , errno .EWOULDBLOCK ))
598601 finally :
599602 s .close ()
600603
601604 def test_connect_ex_error (self ):
602- with support .transient_internet ("svn.python.org" ):
605+ with support .transient_internet (REMOTE_HOST ):
603606 s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
604607 cert_reqs = ssl .CERT_REQUIRED ,
605- ca_certs = SVN_PYTHON_ORG_ROOT_CERT )
608+ ca_certs = REMOTE_ROOT_CERT )
606609 try :
607- self . assertEqual ( errno . ECONNREFUSED ,
608- s . connect_ex (( "svn.python.org" , 444 ) ))
610+ rc = s . connect_ex (( REMOTE_HOST , 444 ))
611+ self . assertIn ( rc , ( errno . ECONNREFUSED , errno . EHOSTUNREACH ))
609612 finally :
610613 s .close ()
611614
612615 def test_connect_with_context (self ):
613- with support .transient_internet ("svn.python.org" ):
616+ with support .transient_internet (REMOTE_HOST ):
614617 # Same as test_connect, but with a separately created context
615618 ctx = ssl .SSLContext (ssl .PROTOCOL_SSLv23 )
616619 s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
617- s .connect (("svn.python.org" , 443 ))
620+ s .connect ((REMOTE_HOST , 443 ))
618621 try :
619622 self .assertEqual ({}, s .getpeercert ())
620623 finally :
621624 s .close ()
622625 # Same with a server hostname
623626 s = ctx .wrap_socket (socket .socket (socket .AF_INET ),
624- server_hostname = "svn.python.org" )
627+ server_hostname = REMOTE_HOST )
625628 if ssl .HAS_SNI :
626- s .connect (("svn.python.org" , 443 ))
629+ s .connect ((REMOTE_HOST , 443 ))
627630 s .close ()
628631 else :
629- self .assertRaises (ValueError , s .connect , ("svn.python.org" , 443 ))
632+ self .assertRaises (ValueError , s .connect , (REMOTE_HOST , 443 ))
630633 # This should fail because we have no verification certs
631634 ctx .verify_mode = ssl .CERT_REQUIRED
632635 s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
633636 self .assertRaisesRegex (ssl .SSLError , "certificate verify failed" ,
634- s .connect , ("svn.python.org" , 443 ))
637+ s .connect , (REMOTE_HOST , 443 ))
635638 s .close ()
636639 # This should succeed because we specify the root cert
637- ctx .load_verify_locations (SVN_PYTHON_ORG_ROOT_CERT )
640+ ctx .load_verify_locations (REMOTE_ROOT_CERT )
638641 s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
639- s .connect (("svn.python.org" , 443 ))
642+ s .connect ((REMOTE_HOST , 443 ))
640643 try :
641644 cert = s .getpeercert ()
642645 self .assertTrue (cert )
@@ -649,12 +652,12 @@ def test_connect_capath(self):
649652 # OpenSSL 0.9.8n and 1.0.0, as a result the capath directory must
650653 # contain both versions of each certificate (same content, different
651654 # filename) for this test to be portable across OpenSSL releases.
652- with support .transient_internet ("svn.python.org" ):
655+ with support .transient_internet (REMOTE_HOST ):
653656 ctx = ssl .SSLContext (ssl .PROTOCOL_SSLv23 )
654657 ctx .verify_mode = ssl .CERT_REQUIRED
655658 ctx .load_verify_locations (capath = CAPATH )
656659 s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
657- s .connect (("svn.python.org" , 443 ))
660+ s .connect ((REMOTE_HOST , 443 ))
658661 try :
659662 cert = s .getpeercert ()
660663 self .assertTrue (cert )
@@ -665,7 +668,7 @@ def test_connect_capath(self):
665668 ctx .verify_mode = ssl .CERT_REQUIRED
666669 ctx .load_verify_locations (capath = BYTES_CAPATH )
667670 s = ctx .wrap_socket (socket .socket (socket .AF_INET ))
668- s .connect (("svn.python.org" , 443 ))
671+ s .connect ((REMOTE_HOST , 443 ))
669672 try :
670673 cert = s .getpeercert ()
671674 self .assertTrue (cert )
@@ -677,9 +680,9 @@ def test_makefile_close(self):
677680 # Issue #5238: creating a file-like object with makefile() shouldn't
678681 # delay closing the underlying "real socket" (here tested with its
679682 # file descriptor, hence skipping the test under Windows).
680- with support .transient_internet ("svn.python.org" ):
683+ with support .transient_internet (REMOTE_HOST ):
681684 ss = ssl .wrap_socket (socket .socket (socket .AF_INET ))
682- ss .connect (("svn.python.org" , 443 ))
685+ ss .connect ((REMOTE_HOST , 443 ))
683686 fd = ss .fileno ()
684687 f = ss .makefile ()
685688 f .close ()
@@ -693,9 +696,9 @@ def test_makefile_close(self):
693696 self .assertEqual (e .exception .errno , errno .EBADF )
694697
695698 def test_non_blocking_handshake (self ):
696- with support .transient_internet ("svn.python.org" ):
699+ with support .transient_internet (REMOTE_HOST ):
697700 s = socket .socket (socket .AF_INET )
698- s .connect (("svn.python.org" , 443 ))
701+ s .connect ((REMOTE_HOST , 443 ))
699702 s .setblocking (False )
700703 s = ssl .wrap_socket (s ,
701704 cert_reqs = ssl .CERT_NONE ,
@@ -718,33 +721,33 @@ def test_non_blocking_handshake(self):
718721 sys .stdout .write ("\n Needed %d calls to do_handshake() to establish session.\n " % count )
719722
720723 def test_get_server_certificate (self ):
721- with support .transient_internet ("svn.python.org" ):
722- pem = ssl .get_server_certificate (("svn.python.org" , 443 ),
724+ with support .transient_internet (REMOTE_HOST ):
725+ pem = ssl .get_server_certificate ((REMOTE_HOST , 443 ),
723726 ssl .PROTOCOL_SSLv23 )
724727 if not pem :
725- self .fail ("No server certificate on svn.python.org :443!" )
728+ self .fail ("No server certificate on REMOTE_HOST :443!" )
726729
727730 try :
728- pem = ssl .get_server_certificate (("svn.python.org" , 443 ),
731+ pem = ssl .get_server_certificate ((REMOTE_HOST , 443 ),
729732 ssl .PROTOCOL_SSLv23 ,
730733 ca_certs = CERTFILE )
731734 except ssl .SSLError as x :
732735 #should fail
733736 if support .verbose :
734737 sys .stdout .write ("%s\n " % x )
735738 else :
736- self .fail ("Got server certificate %s for svn.python.org !" % pem )
739+ self .fail ("Got server certificate %s for REMOTE_HOST !" % pem )
737740
738- pem = ssl .get_server_certificate (("svn.python.org" , 443 ),
741+ pem = ssl .get_server_certificate ((REMOTE_HOST , 443 ),
739742 ssl .PROTOCOL_SSLv23 ,
740- ca_certs = SVN_PYTHON_ORG_ROOT_CERT )
743+ ca_certs = REMOTE_ROOT_CERT )
741744 if not pem :
742- self .fail ("No server certificate on svn.python.org :443!" )
745+ self .fail ("No server certificate on REMOTE_HOST :443!" )
743746 if support .verbose :
744- sys .stdout .write ("\n Verified certificate for svn.python.org :443 is\n %s\n " % pem )
747+ sys .stdout .write ("\n Verified certificate for REMOTE_HOST :443 is\n %s\n " % pem )
745748
746749 def test_ciphers (self ):
747- remote = ("svn.python.org" , 443 )
750+ remote = (REMOTE_HOST , 443 )
748751 with support .transient_internet (remote [0 ]):
749752 s = ssl .wrap_socket (socket .socket (socket .AF_INET ),
750753 cert_reqs = ssl .CERT_NONE , ciphers = "ALL" )
@@ -1745,7 +1748,7 @@ def test_main(verbose=False):
17451748 print (" HAS_SNI = %r" % ssl .HAS_SNI )
17461749
17471750 for filename in [
1748- CERTFILE , SVN_PYTHON_ORG_ROOT_CERT , BYTES_CERTFILE ,
1751+ CERTFILE , REMOTE_ROOT_CERT , BYTES_CERTFILE ,
17491752 ONLYCERT , ONLYKEY , BYTES_ONLYCERT , BYTES_ONLYKEY ,
17501753 BADCERT , BADKEY , EMPTYCERT ]:
17511754 if not os .path .exists (filename ):
0 commit comments