Mirrors
/
synapse
mirror of https://github.com/element-hq/synapse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Use TLSv1.2 for fake servers in tests (#8208) 

Some Linux distros have begun disabling TLSv1.0 and TLSv1.1 by default
for security reasons, for example in Fedora 33 onwards:

https://fedoraproject.org/wiki/Changes/StrongCryptoSettings2

Use TLSv1.2 for the fake TLS servers created in the test suite, to avoid
failures due to OpenSSL disallowing TLSv1.0:

    <twisted.python.failure.Failure OpenSSL.SSL.Error: [('SSL routines',
    'ssl_choose_client_version', 'unsupported protocol')]>

Signed-off-by: Dan Callaghan <djc@djc.id.au>
This commit is contained in:
Dan Callaghan 2020-09-11 04:49:08 +10:00 committed by GitHub
parent 95d869c357
commit c312ee3cde
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
changelog.d/8208.misc Normal file
View File

@ -0,0 +1 @@
Fix tests on distros which disable TLSv1.0. Contributed by @danc86.

2
tests/http/__init__.py
View File

@ -145,7 +145,7 @@ class TestServerTLSConnectionFactory:
self._cert_file = create_test_cert_file(sanlist) self._cert_file = create_test_cert_file(sanlist)
def serverConnectionForTLS(self, tlsProtocol): def serverConnectionForTLS(self, tlsProtocol):
ctx = SSL.Context(SSL.TLSv1_METHOD) ctx = SSL.Context(SSL.SSLv23_METHOD)
ctx.use_certificate_file(self._cert_file) ctx.use_certificate_file(self._cert_file)
ctx.use_privatekey_file(get_test_key_file()) ctx.use_privatekey_file(get_test_key_file())
return Connection(ctx, None) return Connection(ctx, None)