https://github.com/python/cpython/commit/0af7556b94eac47041957f36e98e230650b56bbf
commit: 0af7556b94eac47041957f36e98e230650b56bbf
branch: main
author: Bénédikt Tran <[email protected]>
committer: picnixz <[email protected]>
date: 2025-08-05T07:50:34Z
summary:
gh-136306: fix `test_ssl.ContextTests.test_set_groups` on FIPS builds (#137405)
X25519 is not a valid curve if OpenSSL is built with FIPS mode,
and ignoring unknown groups in `SSL_CTX_set1_groups_list()`
is only supported since OpenSSL 3.3, so we use two curves that
are known to be FIPS-compliant, namely P-256 and P-384.
files:
M Lib/test/test_ssl.py
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index c8939383c75d6d..b5263129baed3f 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -49,6 +49,7 @@
HOST = socket_helper.HOST
IS_OPENSSL_3_0_0 = ssl.OPENSSL_VERSION_INFO >= (3, 0, 0)
CAN_GET_SELECTED_OPENSSL_GROUP = ssl.OPENSSL_VERSION_INFO >= (3, 2)
+CAN_IGNORE_UNKNOWN_OPENSSL_GROUPS = ssl.OPENSSL_VERSION_INFO >= (3, 3)
CAN_GET_AVAILABLE_OPENSSL_GROUPS = ssl.OPENSSL_VERSION_INFO >= (3, 5)
PY_SSL_DEFAULT_CIPHERS = sysconfig.get_config_var('PY_SSL_DEFAULT_CIPHERS')
@@ -964,8 +965,14 @@ def test_get_ciphers(self):
def test_set_groups(self):
ctx = ssl.create_default_context()
- self.assertIsNone(ctx.set_groups('P-256:X25519'))
- self.assertRaises(ssl.SSLError, ctx.set_groups, 'P-256:xxx')
+ # We use P-256 and P-384 (FIPS 186-4) that are alloed by OpenSSL
+ # even if FIPS module is enabled. Ignoring unknown groups is only
+ # supported since OpenSSL 3.3.
+ self.assertIsNone(ctx.set_groups('P-256:P-384'))
+
+ self.assertRaises(ssl.SSLError, ctx.set_groups, 'P-256:foo')
+ if CAN_IGNORE_UNKNOWN_OPENSSL_GROUPS:
+ self.assertIsNone(ctx.set_groups('P-256:?foo'))
@unittest.skipUnless(CAN_GET_AVAILABLE_OPENSSL_GROUPS,
"OpenSSL version doesn't support getting groups")
_______________________________________________
Python-checkins mailing list -- [email protected]
To unsubscribe send an email to [email protected]
https://mail.python.org/mailman3//lists/python-checkins.python.org
Member address: [email protected]
