Skip to content

Commit 328ca61

Browse files
oscpacheoscpache
committed
Update SSL/TLS cipher-related tests
Change-Id: I06c3041fa7c0fc37c2141a096e920c9a15e483a2
1 parent 98637f3 commit 328ca61

File tree

2 files changed

+73
-27
lines changed

2 files changed

+73
-27
lines changed

‎mysql-connector-python/tests/qa/test_qa_ciphers.py

Lines changed: 37 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -126,32 +126,40 @@ class CipherTests(tests.MySQLConnectorTests):
126126
),
127127
"2": (
128128
DeprecationWarning,
129-
DEPRECATED_TLS_CIPHERSUITES["TLSv1.2"][
130-
"TLS_RSA_WITH_AES_128_GCM_SHA256"
129+
[
130+
DEPRECATED_TLS_CIPHERSUITES["TLSv1.2"][
131+
"TLS_RSA_WITH_AES_128_GCM_SHA256"
132+
]
131133
],
132134
["TLSv1.2"],
133135
["TLS_RSA_WITH_AES_128_GCM_SHA256"], # deprecated
134136
),
135137
"3": (
136138
None,
137-
APPROVED_TLS_CIPHERSUITES["TLSv1.2"][
138-
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
139+
[
140+
APPROVED_TLS_CIPHERSUITES["TLSv1.2"][
141+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
142+
]
139143
],
140144
["TLSv1.2"],
141145
["ECDHE-RSA-AES256-GCM-SHA384"], # approved
142146
),
143147
"4": (
144148
None,
145-
MANDATORY_TLS_CIPHERSUITES["TLSv1.2"][
146-
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
149+
[
150+
MANDATORY_TLS_CIPHERSUITES["TLSv1.2"][
151+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
152+
]
147153
],
148154
["TLSv1.2"],
149155
["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"], # mandatory
150156
),
151157
"5": (
152158
None,
153-
MANDATORY_TLS_CIPHERSUITES["TLSv1.2"][
154-
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
159+
[
160+
MANDATORY_TLS_CIPHERSUITES["TLSv1.2"][
161+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
162+
]
155163
],
156164
["TLSv1.2"],
157165
[
@@ -170,14 +178,29 @@ class CipherTests(tests.MySQLConnectorTests):
170178
),
171179
"7": (
172180
None,
173-
"TLS_AES_256_GCM_SHA384",
181+
# the pure-python implementation does not support cipher selection for
182+
# TLSv1.3. The ultimate cipher to be used will be determined by the
183+
# MySQL Server during TLS negotiation. As of MySQL Server 9.2.0,
184+
# `TLS_AES_128_GCM_SHA256` is used over `TLS_AES_256_GCM_SHA384` as
185+
# default since it is more efficient.
186+
# While AES-256 offers a higher theoretical security level due to its
187+
# larger key size, for most practical applications, AES-128 is
188+
# considered sufficiently secure and provides a good balance between
189+
# security and performance. Hence, both are acceptable expected cipher
190+
# OpenSSL name values.
191+
[
192+
"TLS_AES_128_GCM_SHA256",
193+
"TLS_AES_256_GCM_SHA384",
194+
], # expected cipher OpenSSL name
174195
["TLSv1.3"],
175196
["TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"], # acceptable
176197
),
177198
"8": (
178199
DeprecationWarning,
179-
DEPRECATED_TLS_CIPHERSUITES["TLSv1.2"][
180-
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
200+
[
201+
DEPRECATED_TLS_CIPHERSUITES["TLSv1.2"][
202+
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
203+
]
181204
],
182205
["TLSv1.2"],
183206
["TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"], # deprecated
@@ -268,7 +291,7 @@ async def _check_async_tls_ciphersuites(
268291
return ssl_version, ssl_cipher
269292

270293
def _test_tls_ciphersuites(self, test_case_id: str):
271-
exp_event, exp_ssl_cipher, tls_versions, tls_ciphersuites = (
294+
exp_event, exp_ssl_ciphers, tls_versions, tls_ciphersuites = (
272295
self.test_case_values["tls_ciphersuites"][test_case_id]
273296
)
274297

@@ -290,7 +313,7 @@ def _test_tls_ciphersuites(self, test_case_id: str):
290313
conf, exp_ssl_version
291314
)
292315
self.assertEqual(ssl_version, exp_ssl_version)
293-
self.assertEqual(ssl_cipher, exp_ssl_cipher)
316+
self.assertIn(ssl_cipher, exp_ssl_ciphers)
294317

295318
# C-ext implementation isn't supported yet for aio.
296319
if (CEXT_SUPPORT_FOR_AIO and not conf["use_pure"]) or conf["use_pure"]:
@@ -299,7 +322,7 @@ def _test_tls_ciphersuites(self, test_case_id: str):
299322
self._check_async_tls_ciphersuites(conf, exp_ssl_version)
300323
)
301324
self.assertEqual(ssl_version, exp_ssl_version)
302-
self.assertEqual(ssl_cipher, exp_ssl_cipher)
325+
self.assertIn(ssl_cipher, exp_ssl_ciphers)
303326

304327
@tests.foreach_cnx()
305328
def test_tls_versions_1(self):

‎mysqlx-connector-python/tests/qa/test_qa_ciphers.py

Lines changed: 36 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -101,32 +101,40 @@ class CipherTests(tests.MySQLxTests):
101101
),
102102
"2": (
103103
DeprecationWarning,
104-
DEPRECATED_TLS_CIPHERSUITES["TLSv1.2"][
105-
"TLS_RSA_WITH_AES_128_GCM_SHA256"
104+
[
105+
DEPRECATED_TLS_CIPHERSUITES["TLSv1.2"][
106+
"TLS_RSA_WITH_AES_128_GCM_SHA256"
107+
]
106108
],
107109
["TLSv1.2"],
108110
["TLS_RSA_WITH_AES_128_GCM_SHA256"], # deprecated
109111
),
110112
"3": (
111113
None,
112-
APPROVED_TLS_CIPHERSUITES["TLSv1.2"][
113-
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
114+
[
115+
APPROVED_TLS_CIPHERSUITES["TLSv1.2"][
116+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
117+
]
114118
],
115119
["TLSv1.2"],
116120
["ECDHE-RSA-AES256-GCM-SHA384"], # approved
117121
),
118122
"4": (
119123
None,
120-
MANDATORY_TLS_CIPHERSUITES["TLSv1.2"][
121-
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
124+
[
125+
MANDATORY_TLS_CIPHERSUITES["TLSv1.2"][
126+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
127+
]
122128
],
123129
["TLSv1.2"],
124130
["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"], # mandatory
125131
),
126132
"5": (
127133
None,
128-
MANDATORY_TLS_CIPHERSUITES["TLSv1.2"][
129-
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
134+
[
135+
MANDATORY_TLS_CIPHERSUITES["TLSv1.2"][
136+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
137+
]
130138
],
131139
["TLSv1.2"],
132140
[
@@ -145,14 +153,29 @@ class CipherTests(tests.MySQLxTests):
145153
),
146154
"7": (
147155
None,
148-
"TLS_AES_256_GCM_SHA384",
156+
# the pure-python implementation does not support cipher selection for
157+
# TLSv1.3. The ultimate cipher to be used will be determined by the
158+
# MySQL Server during TLS negotiation. As of MySQL Server 9.2.0,
159+
# `TLS_AES_128_GCM_SHA256` is used over `TLS_AES_256_GCM_SHA384` as
160+
# default since it is more efficient.
161+
# While AES-256 offers a higher theoretical security level due to its
162+
# larger key size, for most practical applications, AES-128 is
163+
# considered sufficiently secure and provides a good balance between
164+
# security and performance. Hence, both are acceptable expected cipher
165+
# OpenSSL name values.
166+
[
167+
"TLS_AES_128_GCM_SHA256",
168+
"TLS_AES_256_GCM_SHA384",
169+
], # expected cipher OpenSSL name
149170
["TLSv1.3"],
150171
["TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"], # acceptable
151172
),
152173
"8": (
153174
DeprecationWarning,
154-
DEPRECATED_TLS_CIPHERSUITES["TLSv1.2"][
155-
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
175+
[
176+
DEPRECATED_TLS_CIPHERSUITES["TLSv1.2"][
177+
"TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
178+
]
156179
],
157180
["TLSv1.2"],
158181
["TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"], # deprecated
@@ -183,7 +206,7 @@ def _test_tls_versions(self, test_case_id: str):
183206
self.assertEqual(res[-1], expected_res)
184207

185208
def _test_tls_ciphersuites(self, test_case_id: str):
186-
exp_event, exp_cipher, tls_versions, tls_ciphersuites = self.test_case_values[
209+
exp_event, exp_ciphers, tls_versions, tls_ciphersuites = self.test_case_values[
187210
"tls_ciphersuites"
188211
][test_case_id]
189212

@@ -216,7 +239,7 @@ def _test_tls_ciphersuites(self, test_case_id: str):
216239
.fetch_all()[0]
217240
)
218241
res = ast.literal_eval(repr(res)) # res[0] is mysqlx.result.Row
219-
self.assertEqual(res[-1], exp_cipher)
242+
self.assertIn(res[-1], exp_ciphers)
220243

221244
@tests.foreach_session()
222245
def test_tls_versions_1(self):

0 commit comments

Comments
 (0)