twisted.test.test_sslverify.ServiceIdentityTests

class documentation

class ServiceIdentityTests(SynchronousTestCase):

Constructor: ServiceIdentityTests(methodName)

View In Hierarchy

Tests for the verification of the peer's service's identity via the hostname argument to sslverify.OpenSSLCertificateOptions.

Method serviceIdentitySetup Connect a server and a client.
Method test_butIfTheyDidItWouldWork ssl.optionsForClientTLS should be using ssl.platformTrust by default, so if we fake that out then it should trust ourselves again.
Method test_clientPresentsBadCertificate When the server verifies and the client presents an invalid certificate for that verification by passing it to sslverify.optionsForClientTLS, the connection cannot be established with an SSL error.
Method test_clientPresentsCertificate When the server verifies and the client presents a valid certificate for that verification by passing it to sslverify.optionsForClientTLS, communication proceeds.
Method test_fallback sslverify.simpleVerifyHostname checks string equality on the commonName of a connection's certificate's subject, doing nothing if it matches and raising VerificationError if it doesn't.
Method test_hostnameEncoding Hostnames are encoded as IDNA.
Method test_hostnameIsIndicated Specifying the hostname argument to CertificateOptions also sets the Server Name Extension TLS indication field to the correct value.
Method test_invalidHostname When a certificate containing an invalid hostname is received from the server, the connection is immediately dropped.
Method test_realCAsBetterNotSignOurBogusTestCerts If we use the default trust from the platform, our dinky certificate should really fail.
Method test_surpriseFromInfoCallback pyOpenSSL isn't always so great about reporting errors. If one occurs in the verification info callback, it should be logged and the connection should be shut down (if possible, anyway; the app_data could be clobbered but there's no point testing for that).
Method test_validHostname Whenever a valid certificate containing a valid hostname is received, connection proceeds normally.
Method test_validHostnameInvalidCertificate When an invalid certificate containing a perfectly valid hostname is received, the connection is aborted with an OpenSSL error.
Instance Variable clientOpts Undocumented
Instance Variable serverOpts Undocumented

Inherited from SynchronousTestCase:

Method __eq__ Override the comparison defined by the base TestCase which considers instances of the same class with the same _testMethodName to be equal. Since trial puts TestCase instances into a set, that definition of comparison makes it impossible to run the same test method twice...
Method __hash__ Undocumented
Method __init__ Undocumented
Method addCleanup Add the given function to a list of functions to be called after the test has run, but before tearDown.
Method callDeprecated Call a function that should have been deprecated at a specific version and in favor of a specific alternative, and assert that it was thusly deprecated.
Method flushLoggedErrors Remove stored errors received from the log.
Method flushWarnings Remove stored warnings from the list of captured warnings and return them.
Method getDeprecatedModuleAttribute Retrieve a module attribute which should have been deprecated, and assert that we saw the appropriate deprecation warning.
Method getSkip Return the skip reason set on this test, if any is set. Checks on the instance first, then the class, then the module, then packages. As soon as it finds something with a skip attribute, returns that in a tuple (...
Method getTodo Return a Todo object if the test is marked todo. Checks on the instance first, then the class, then the module, then packages. As soon as it finds something with a todo attribute, returns that. Returns ...
Method mktemp Create a new path name which can be used for a new file or directory.
Method patch Monkey patch an object for the duration of the test.
Method run Run the test case, storing the results in result.
Method runTest If no methodName argument is passed to the constructor, run will treat this method as the thing with the actual test inside.
Method shortDescription Undocumented
Instance Variable failureException An exception class, defaulting to FailTest. If the test method raises this exception, it will be reported as a failure, rather than an exception. All of the assertion methods raise this if the assertion fails.
Instance Variable skip None or a string explaining why this test is to be skipped. If defined, the test will not be run. Instead, it will be reported to the result object as 'skipped' (if the TestResult supports skipping).
Instance Variable suppress None or a list of tuples of (args, kwargs) to be passed to warnings.filterwarnings. Use these to suppress warnings raised in a test. Useful for testing deprecated code. See also util.suppress.
Instance Variable todo None, a string or a tuple of (errors, reason) where errors is either an exception class or an iterable of exception classes, and reason is a string. See Todo or makeTodo for more information.
Method _getSkipReason Return the reason to use for skipping a test method.
Method _getSuppress Returns any warning suppressions set for this test. Checks on the instance first, then the class, then the module, then packages. As soon as it finds something with a suppress attribute, returns that. ...
Method _installObserver Undocumented
Method _removeObserver Undocumented
Method _run Run a single method, either a test method or fixture.
Method _runCleanups Synchronously run any cleanups which have been added.
Method _runFixturesAndTest Run setUp, a test method, test cleanups, and tearDown.
Instance Variable _cleanups Undocumented
Instance Variable _observer Undocumented
Instance Variable _parents Undocumented
Instance Variable _passed Undocumented
Instance Variable _testMethodName Undocumented
Instance Variable _warnings Undocumented

Inherited from _Assertions (via SynchronousTestCase):

Method assertAlmostEqual Fail if the two objects are unequal as determined by their difference rounded to the given number of decimal places (default 7) and comparing to zero.
Method assertApproximates Fail if first - second > tolerance
Method assertEqual Fail the test if first and second are not equal.
Method assertFalse Fail the test if condition evaluates to True.
Method assertIn Fail the test if containee is not found in container.
Method assertIs Fail the test if first is not second. This is an obect-identity-equality test, not an object equality (i.e. __eq__) test.
Method assertIsInstance Fail if instance is not an instance of the given class or of one of the given classes.
Method assertIsNot Fail the test if first is second. This is an obect-identity-equality test, not an object equality (i.e. __eq__) test.
Method assertNoResult Assert that deferred does not have a result at this point.
Method assertNotAlmostEqual Fail if the two objects are equal as determined by their difference rounded to the given number of decimal places (default 7) and comparing to zero.
Method assertNotEqual Fail the test if first == second.
Method assertNotIn Fail the test if containee is found in container.
Method assertNotIsInstance Fail if instance is an instance of the given class or of one of the given classes.
Method assertNotSubstring Fail if astring contains substring.
Method assertRaises Fail the test unless calling the function f with the given args and kwargs raises exception. The failure will report the traceback and call stack of the unexpected exception.
Method assertSubstring Fail if substring does not exist within astring.
Method assertTrue Fail the test if condition evaluates to False.
Method assertWarns Fail if the given function doesn't generate the specified warning when called. It calls the function, checks the warning, and forwards the result of the function if everything is fine.
Method fail Absolutely fail the test. Do not pass go, do not collect $200.
Method failureResultOf Return the current failure result of deferred or raise self.failureException.
Method successResultOf Return the current success result of deferred or raise self.failureException.
def serviceIdentitySetup(self, clientHostname, serverHostname, serverContextSetup=lambda ctx: None, validCertificate=True, clientPresentsCertificate=False, validClientCertificate=True, serverVerifies=False, buggyInfoCallback=False, fakePlatformTrust=False, useDefaultTrust=False):

Connect a server and a client.

Parameters
clientHostname:unicodeThe client's idea of the server's hostname; passed as the hostname to the sslverify.OpenSSLCertificateOptions instance.
serverHostname:unicodeThe server's own idea of the server's hostname; present in the certificate presented by the server.
serverContextSetup:callable taking OpenSSL.SSL.Context returning None.a 1-argument callable invoked with the OpenSSL.SSL.Context after it's produced.
validCertificate:boolIs the server's certificate valid? True if so, False otherwise.
clientPresentsCertificate:boolShould the client present a certificate to the server? Defaults to 'no'.
validClientCertificate:boolIf the client presents a certificate, should it actually be a valid one, i.e. signed by the same CA that the server is checking? Defaults to 'yes'.
serverVerifies:boolShould the server verify the client's certificate? Defaults to 'no'.
buggyInfoCallback:boolShould we patch the implementation so that the info_callback passed to OpenSSL to have a bug and raise an exception (ZeroDivisionError)? Defaults to 'no'.
fakePlatformTrust:boolShould we fake the platformTrust to be the same as our fake server certificate authority, so that we can test it's being used? Defaults to 'no' and we just pass platform trust.
useDefaultTrust:boolShould we avoid passing the trustRoot to ssl.optionsForClientTLS? Defaults to 'no'.
Returns
5-tuple of 4 IProtocols and IOPumpthe client TLS protocol, the client wrapped protocol, the server TLS protocol, the server wrapped protocol and an IOPump which, when its pump and flush methods are called, will move data between the created client and server protocol instances
def test_butIfTheyDidItWouldWork(self):

ssl.optionsForClientTLS should be using ssl.platformTrust by default, so if we fake that out then it should trust ourselves again.

def test_clientPresentsBadCertificate(self):

When the server verifies and the client presents an invalid certificate for that verification by passing it to sslverify.optionsForClientTLS, the connection cannot be established with an SSL error.

def test_clientPresentsCertificate(self):

When the server verifies and the client presents a valid certificate for that verification by passing it to sslverify.optionsForClientTLS, communication proceeds.

def test_fallback(self):

sslverify.simpleVerifyHostname checks string equality on the commonName of a connection's certificate's subject, doing nothing if it matches and raising VerificationError if it doesn't.

@skipIf(skipSNI, skipSNI)
def test_hostnameEncoding(self):

Hostnames are encoded as IDNA.

@skipIf(skipSNI, skipSNI)
def test_hostnameIsIndicated(self):

Specifying the hostname argument to CertificateOptions also sets the Server Name Extension TLS indication field to the correct value.

def test_invalidHostname(self):

When a certificate containing an invalid hostname is received from the server, the connection is immediately dropped.

def test_realCAsBetterNotSignOurBogusTestCerts(self):

If we use the default trust from the platform, our dinky certificate should really fail.

def test_surpriseFromInfoCallback(self):

pyOpenSSL isn't always so great about reporting errors. If one occurs in the verification info callback, it should be logged and the connection should be shut down (if possible, anyway; the app_data could be clobbered but there's no point testing for that).

def test_validHostname(self):

Whenever a valid certificate containing a valid hostname is received, connection proceeds normally.

def test_validHostnameInvalidCertificate(self):

When an invalid certificate containing a perfectly valid hostname is received, the connection is aborted with an OpenSSL error.

clientOpts =

Undocumented

serverOpts =

Undocumented