@@ -1149,6 +1149,88 @@ def handle_stream(self, stream, address):
11491149 yield handshake_future
11501150
11511151
1152+ class TestIOStreamCheckHostname (AsyncTestCase ):
1153+ # This test ensures that hostname checks are working correctly after
1154+ # #3337 revealed that we have no test coverage in this area, and we
1155+ # removed a manual hostname check that was needed only for very old
1156+ # versions of python.
1157+ def setUp (self ):
1158+ super ().setUp ()
1159+ self .listener , self .port = bind_unused_port ()
1160+
1161+ def accept_callback (connection , address ):
1162+ ssl_ctx = ssl .create_default_context (ssl .Purpose .CLIENT_AUTH )
1163+ ssl_ctx .load_cert_chain (
1164+ os .path .join (os .path .dirname (__file__ ), "test.crt" ),
1165+ os .path .join (os .path .dirname (__file__ ), "test.key" ),
1166+ )
1167+ connection = ssl_ctx .wrap_socket (
1168+ connection ,
1169+ server_side = True ,
1170+ do_handshake_on_connect = False ,
1171+ )
1172+ SSLIOStream (connection )
1173+
1174+ netutil .add_accept_handler (self .listener , accept_callback )
1175+
1176+ # Our self-signed cert is its own CA. We have to pass the CA check before
1177+ # the hostname check will be performed.
1178+ self .client_ssl_ctx = ssl .create_default_context (ssl .Purpose .SERVER_AUTH )
1179+ self .client_ssl_ctx .load_verify_locations (
1180+ os .path .join (os .path .dirname (__file__ ), "test.crt" )
1181+ )
1182+
1183+ def tearDown (self ):
1184+ self .io_loop .remove_handler (self .listener .fileno ())
1185+ self .listener .close ()
1186+ super ().tearDown ()
1187+
1188+ @gen_test
1189+ async def test_match (self ):
1190+ stream = SSLIOStream (socket .socket (), ssl_options = self .client_ssl_ctx )
1191+ await stream .connect (
1192+ ("127.0.0.1" , self .port ),
1193+ server_hostname = "foo.example.com" ,
1194+ )
1195+ stream .close ()
1196+
1197+ @gen_test
1198+ async def test_no_match (self ):
1199+ stream = SSLIOStream (socket .socket (), ssl_options = self .client_ssl_ctx )
1200+ with ExpectLog (
1201+ gen_log ,
1202+ ".*alert bad certificate" ,
1203+ level = logging .WARNING ,
1204+ required = platform .system () != "Windows" ,
1205+ ):
1206+ with self .assertRaises (ssl .SSLCertVerificationError ):
1207+ with ExpectLog (
1208+ gen_log ,
1209+ ".*(certificate verify failed: Hostname mismatch)" ,
1210+ level = logging .WARNING ,
1211+ ):
1212+ await stream .connect (
1213+ ("127.0.0.1" , self .port ),
1214+ server_hostname = "bar.example.com" ,
1215+ )
1216+ # The server logs a warning while cleaning up the failed connection.
1217+ # Unfortunately there's no good hook to wait for this logging.
1218+ # It doesn't seem to happen on windows; I'm not sure why.
1219+ if platform .system () != "Windows" :
1220+ await asyncio .sleep (0.1 )
1221+
1222+ @gen_test
1223+ async def test_check_disabled (self ):
1224+ # check_hostname can be set to false and the connection will succeed even though it doesn't
1225+ # have the right hostname.
1226+ self .client_ssl_ctx .check_hostname = False
1227+ stream = SSLIOStream (socket .socket (), ssl_options = self .client_ssl_ctx )
1228+ await stream .connect (
1229+ ("127.0.0.1" , self .port ),
1230+ server_hostname = "bar.example.com" ,
1231+ )
1232+
1233+
11521234@skipIfNonUnix
11531235class TestPipeIOStream (TestReadWriteMixin , AsyncTestCase ):
11541236 @gen .coroutine
0 commit comments