Fixed logging messages for transport security options (#2310)

paramiko/transport.py

@@ -3050,7 +3050,12 @@ def _set(self, name, orig, x):
         possible = list(getattr(self._transport, orig).keys())
         forbidden = [n for n in x if n not in possible]
         if len(forbidden) > 0:
-            raise ValueError("unknown cipher")
+            name_parsed = name.replace("_preferred_", "")
+            raise ValueError(
+                "unknown {} name: {}, possible options: {}".format(
+                    name_parsed, forbidden, possible
+                )
+            )
         setattr(self._transport, name, x)
 
     @property

sites/www/changelog.rst

@@ -2,6 +2,10 @@
 Changelog
 =========
 
+- :support:`2313` (solves part of :issue:`2310`) Fix debug logging messages
+  for transport security options in case of mismatch/no support,
+  e.g. `SecurityOptions.digests`, `SecurityOptions.ciphers`.
+
 - :release:`3.3.1 <2023-07-28>`
 - :bug:`-` Cleaned up some very old root level files, mostly just to exercise
   some of our doc build and release machinery. This changelog entry

tests/test_transport.py

@@ -155,6 +155,32 @@ def testb_security_options_reset(self):
         o.kex = o.kex
         o.compression = o.compression
 
+    def test_security_options_log_message(self):
+        """
+        Test proper logging user experience for security options
+        """
+        opts = self.tc.get_security_options()
+        # we use mapping to work with legacy attribute names
+        mapping = {
+            "ciphers": "ciphers",
+            "digests": "macs",
+            "key_types": "keys",
+            "kex": "kex",
+        }
+        for prop in mapping.keys():
+            with self.assertRaises(ValueError) as exc:
+                setattr(opts, prop, ["unknown"])
+            assert str(exc.exception).startswith(
+                "unknown {} name: ['unknown'],".format(mapping[prop])
+            )
+        # test the mix of valid and invalid options
+        valid = opts.ciphers[0]
+        with self.assertRaises(ValueError) as exc:
+            setattr(opts, "ciphers", ["unknown", valid])
+        assert str(exc.exception).startswith(
+            "unknown ciphers name: ['unknown'],"
+        )
+
     def test_compute_key(self):
         self.tc.K = 123281095979686581523377256114209720774539068973101330872763622971399429481072519713536292772709507296759612401802191955568143056534122385270077606457721553469730659233569339356140085284052436697480759510519672848743794433460113118986816826624865291116513647975790797391795651716378444844877749505443714557929  # noqa
         self.tc.H = b"\x0C\x83\x07\xCD\xE6\x85\x6F\xF3\x0B\xA9\x36\x84\xEB\x0F\x04\xC2\x52\x0E\x9E\xD3"  # noqa