This repository has been archived by the owner on Apr 14, 2022. It is now read-only.
Merge from master (February 28th, 2019) #107
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Add tests for specific TLS/SSL versions * Add change and update bindings * SSLSocket.version() not available sometimes * Add support for kTLSProtocolMaxSupported * Try setProtocolVersionMax again if error * Get ctypes.c_uint.value for SSLSocket.version() * Opt-in TLS 1.3 on macOS 10.13 * Update tornado to 5.1.1 * Add documentation updates for TLSv1.3 * Add wbond/oscrypto license to contrib/securetransport * Remove all TLS 1.3 ciphersuites from DEFAULT_CIPHERS * Experiment showing cipher list per protocol * Update test_https.py * Update test_https.py * Update test_https.py * Update changelog wording to exclude pyOpenSSL * minor rewording * Add support for IPv6 in subjectAltName * Don't use OP_ALL * Update CHANGES.rst * No PROTOCOL_TLSv1_3 * Remove DSS, rearrange SecureTransport ciphers * Use ECDSA before RSA with ECDHE * ReviReorder ciphers * ECDHE * Update test_https.py * Turns out we don't need version detection * Reorder per Hyneks post and favor ephemeral * Refactor HTTPS unit tests * Fix up tests * Test locking pytest-httpbin * Update requests.sh * remove whitespace
…om-master-2019-02-28
|
Travis had three failures, and they all involve timeouts, so I suspect they're flaky tests: One on pypy3.6-7.1.1: And two on the macOS 3.7 build: I'll click the restart button and see if it fixes anything. |
Codecov Report
@@ Coverage Diff @@
## bleach-spike #107 +/- ##
================================================
+ Coverage 99.46% 99.46% +<.01%
================================================
Files 29 29
Lines 1852 1854 +2
================================================
+ Hits 1842 1844 +2
Misses 10 10
|
|
Ta-da, now the CI is green. Well, at least that gets us through this PR. Well done figuring out that obscure bug! |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request is mostly about TLS 1.3 support.
TLS 1.3 works without this PR, but this changes tests and adds support in two SSL backends: pyOpenSSL and SecureTransport. We don't support them yet, and did not modify them much, so the merges were mostly automatic.
I also bumped the macOS Python releases we use so that Python 3.7 is tested with OpenSSL 1.1.1 (and TLS 1.3) support.
I don't understand the post-handshake authentication (PHA) comment in the pyOpenSSL backend, but I imagine it was added because of psf/requests#4961 (comment). In any case, I'm not sure why the comment mentions PHA: at the time of the commit, PHA was not enabled in urllib3, and not yet supported by pyOpenSSL anyway: pyca/pyopenssl#793.
I fixed a bug that's also in the urllib3 master branch (see urllib3/urllib3#1664). It was hard to notice because OpenSSL 1.1.1 / TLS 1.3 using Python's ssl module was not tested in CI until now. It took me a long time to fix for two reasons: 1/ I did not have OpenSSL 1.1.1 support in my Python build, so I was testing on CI, which takes a long time (I ended up compiling Python from source) 2/ the fixed test was using an unexpected certificate which led me to think that the bug was #106