Interface: Require minimum TLS version 1.2 #2665
Draft
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
`pytest-docker` switched from `docker-compose` to `docker compose` in version 2.0.0: https://github.com/avast/pytest-docker/releases/tag/v2.0.0 The new docker compose v2 works slightly different in some cases. In this case the path for our bind mount must be relative to the `docker-compose.yml` file. If the build fails make sure you can run `docker compose`, if not your docker installation is too old.
Fixes Electron-Cash#2661 The imp module was removed in Python 3.12 so the old code does not work anymore. Since we only support Python >= 3.6 we don't need to deal with compatibility with older versions.
Exclude Python 3.12.0-beta.4 on Windows because it crashes on startup.
this caused electrum to fail to start potentially only older python 3.6.x are affected fixes spesmilo#5421
assertEqual is equivalent to assertEquals, which was removed in Python 3.12.
Since Python 3.7 the hostname verification is done in `SSLSocket.do_handshake` if `SSLContext.check_hostname` is set, so we don't need our own code to verify the certificate. There is no compatibility code for Python < 3.7 so the minimum version was increased. This also removes the unused `_match_hostname` function and its tests.
Python already refuses connecting to TLS 1.1 servers, which is a good thing. `SSLContext.minimum_version` should be used instead of setting the options, this requires Python 3.7.
|
Seems that the tests for this are a bit flaky: The certificate checks seem to be much more reliable |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Python already refuses connecting to TLS 1.1 servers, which is a good thing.
SSLContext.minimum_versionshould be used instead of setting the options, this requires Python 3.7.