mirror of
https://git.anonymousland.org/anonymousland/synapse.git
synced 2025-06-12 09:22:47 -04:00
Add missing type hints to tests.config. (#14681)
This commit is contained in:
parent
864c3f85b0
commit
3aeca2588b
18 changed files with 108 additions and 103 deletions
|
@ -13,13 +13,20 @@
|
|||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
from typing import cast
|
||||
|
||||
import idna
|
||||
|
||||
from OpenSSL import SSL
|
||||
|
||||
from synapse.config._base import Config, RootConfig
|
||||
from synapse.config.homeserver import HomeServerConfig
|
||||
from synapse.config.tls import ConfigError, TlsConfig
|
||||
from synapse.crypto.context_factory import FederationPolicyForHTTPS
|
||||
from synapse.crypto.context_factory import (
|
||||
FederationPolicyForHTTPS,
|
||||
SSLClientConnectionCreator,
|
||||
)
|
||||
from synapse.types import JsonDict
|
||||
|
||||
from tests.unittest import TestCase
|
||||
|
||||
|
@ -27,7 +34,7 @@ from tests.unittest import TestCase
|
|||
class FakeServer(Config):
|
||||
section = "server"
|
||||
|
||||
def has_tls_listener(self):
|
||||
def has_tls_listener(self) -> bool:
|
||||
return False
|
||||
|
||||
|
||||
|
@ -36,21 +43,21 @@ class TestConfig(RootConfig):
|
|||
|
||||
|
||||
class TLSConfigTests(TestCase):
|
||||
def test_tls_client_minimum_default(self):
|
||||
def test_tls_client_minimum_default(self) -> None:
|
||||
"""
|
||||
The default client TLS version is 1.0.
|
||||
"""
|
||||
config = {}
|
||||
config: JsonDict = {}
|
||||
t = TestConfig()
|
||||
t.tls.read_config(config, config_dir_path="", data_dir_path="")
|
||||
|
||||
self.assertEqual(t.tls.federation_client_minimum_tls_version, "1")
|
||||
|
||||
def test_tls_client_minimum_set(self):
|
||||
def test_tls_client_minimum_set(self) -> None:
|
||||
"""
|
||||
The default client TLS version can be set to 1.0, 1.1, and 1.2.
|
||||
"""
|
||||
config = {"federation_client_minimum_tls_version": 1}
|
||||
config: JsonDict = {"federation_client_minimum_tls_version": 1}
|
||||
t = TestConfig()
|
||||
t.tls.read_config(config, config_dir_path="", data_dir_path="")
|
||||
self.assertEqual(t.tls.federation_client_minimum_tls_version, "1")
|
||||
|
@ -76,7 +83,7 @@ class TLSConfigTests(TestCase):
|
|||
t.tls.read_config(config, config_dir_path="", data_dir_path="")
|
||||
self.assertEqual(t.tls.federation_client_minimum_tls_version, "1.2")
|
||||
|
||||
def test_tls_client_minimum_1_point_3_missing(self):
|
||||
def test_tls_client_minimum_1_point_3_missing(self) -> None:
|
||||
"""
|
||||
If TLS 1.3 support is missing and it's configured, it will raise a
|
||||
ConfigError.
|
||||
|
@ -88,7 +95,7 @@ class TLSConfigTests(TestCase):
|
|||
self.addCleanup(setattr, SSL, "SSL.OP_NO_TLSv1_3", OP_NO_TLSv1_3)
|
||||
assert not hasattr(SSL, "OP_NO_TLSv1_3")
|
||||
|
||||
config = {"federation_client_minimum_tls_version": 1.3}
|
||||
config: JsonDict = {"federation_client_minimum_tls_version": 1.3}
|
||||
t = TestConfig()
|
||||
with self.assertRaises(ConfigError) as e:
|
||||
t.tls.read_config(config, config_dir_path="", data_dir_path="")
|
||||
|
@ -100,7 +107,7 @@ class TLSConfigTests(TestCase):
|
|||
),
|
||||
)
|
||||
|
||||
def test_tls_client_minimum_1_point_3_exists(self):
|
||||
def test_tls_client_minimum_1_point_3_exists(self) -> None:
|
||||
"""
|
||||
If TLS 1.3 support exists and it's configured, it will be settable.
|
||||
"""
|
||||
|
@ -110,20 +117,20 @@ class TLSConfigTests(TestCase):
|
|||
self.addCleanup(lambda: delattr(SSL, "OP_NO_TLSv1_3"))
|
||||
assert hasattr(SSL, "OP_NO_TLSv1_3")
|
||||
|
||||
config = {"federation_client_minimum_tls_version": 1.3}
|
||||
config: JsonDict = {"federation_client_minimum_tls_version": 1.3}
|
||||
t = TestConfig()
|
||||
t.tls.read_config(config, config_dir_path="", data_dir_path="")
|
||||
self.assertEqual(t.tls.federation_client_minimum_tls_version, "1.3")
|
||||
|
||||
def test_tls_client_minimum_set_passed_through_1_2(self):
|
||||
def test_tls_client_minimum_set_passed_through_1_2(self) -> None:
|
||||
"""
|
||||
The configured TLS version is correctly configured by the ContextFactory.
|
||||
"""
|
||||
config = {"federation_client_minimum_tls_version": 1.2}
|
||||
config: JsonDict = {"federation_client_minimum_tls_version": 1.2}
|
||||
t = TestConfig()
|
||||
t.tls.read_config(config, config_dir_path="", data_dir_path="")
|
||||
|
||||
cf = FederationPolicyForHTTPS(t)
|
||||
cf = FederationPolicyForHTTPS(cast(HomeServerConfig, t))
|
||||
options = _get_ssl_context_options(cf._verify_ssl_context)
|
||||
|
||||
# The context has had NO_TLSv1_1 and NO_TLSv1_0 set, but not NO_TLSv1_2
|
||||
|
@ -131,15 +138,15 @@ class TLSConfigTests(TestCase):
|
|||
self.assertNotEqual(options & SSL.OP_NO_TLSv1_1, 0)
|
||||
self.assertEqual(options & SSL.OP_NO_TLSv1_2, 0)
|
||||
|
||||
def test_tls_client_minimum_set_passed_through_1_0(self):
|
||||
def test_tls_client_minimum_set_passed_through_1_0(self) -> None:
|
||||
"""
|
||||
The configured TLS version is correctly configured by the ContextFactory.
|
||||
"""
|
||||
config = {"federation_client_minimum_tls_version": 1}
|
||||
config: JsonDict = {"federation_client_minimum_tls_version": 1}
|
||||
t = TestConfig()
|
||||
t.tls.read_config(config, config_dir_path="", data_dir_path="")
|
||||
|
||||
cf = FederationPolicyForHTTPS(t)
|
||||
cf = FederationPolicyForHTTPS(cast(HomeServerConfig, t))
|
||||
options = _get_ssl_context_options(cf._verify_ssl_context)
|
||||
|
||||
# The context has not had any of the NO_TLS set.
|
||||
|
@ -147,11 +154,11 @@ class TLSConfigTests(TestCase):
|
|||
self.assertEqual(options & SSL.OP_NO_TLSv1_1, 0)
|
||||
self.assertEqual(options & SSL.OP_NO_TLSv1_2, 0)
|
||||
|
||||
def test_whitelist_idna_failure(self):
|
||||
def test_whitelist_idna_failure(self) -> None:
|
||||
"""
|
||||
The federation certificate whitelist will not allow IDNA domain names.
|
||||
"""
|
||||
config = {
|
||||
config: JsonDict = {
|
||||
"federation_certificate_verification_whitelist": [
|
||||
"example.com",
|
||||
"*.ドメイン.テスト",
|
||||
|
@ -163,11 +170,11 @@ class TLSConfigTests(TestCase):
|
|||
)
|
||||
self.assertIn("IDNA domain names", str(e))
|
||||
|
||||
def test_whitelist_idna_result(self):
|
||||
def test_whitelist_idna_result(self) -> None:
|
||||
"""
|
||||
The federation certificate whitelist will match on IDNA encoded names.
|
||||
"""
|
||||
config = {
|
||||
config: JsonDict = {
|
||||
"federation_certificate_verification_whitelist": [
|
||||
"example.com",
|
||||
"*.xn--eckwd4c7c.xn--zckzah",
|
||||
|
@ -176,14 +183,16 @@ class TLSConfigTests(TestCase):
|
|||
t = TestConfig()
|
||||
t.tls.read_config(config, config_dir_path="", data_dir_path="")
|
||||
|
||||
cf = FederationPolicyForHTTPS(t)
|
||||
cf = FederationPolicyForHTTPS(cast(HomeServerConfig, t))
|
||||
|
||||
# Not in the whitelist
|
||||
opts = cf.get_options(b"notexample.com")
|
||||
assert isinstance(opts, SSLClientConnectionCreator)
|
||||
self.assertTrue(opts._verifier._verify_certs)
|
||||
|
||||
# Caught by the wildcard
|
||||
opts = cf.get_options(idna.encode("テスト.ドメイン.テスト"))
|
||||
assert isinstance(opts, SSLClientConnectionCreator)
|
||||
self.assertFalse(opts._verifier._verify_certs)
|
||||
|
||||
|
||||
|
@ -191,4 +200,4 @@ def _get_ssl_context_options(ssl_context: SSL.Context) -> int:
|
|||
"""get the options bits from an openssl context object"""
|
||||
# the OpenSSL.SSL.Context wrapper doesn't expose get_options, so we have to
|
||||
# use the low-level interface
|
||||
return SSL._lib.SSL_CTX_get_options(ssl_context._context)
|
||||
return SSL._lib.SSL_CTX_get_options(ssl_context._context) # type: ignore[attr-defined]
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue