Backport fixes from 94ccda0

Co-authored-by: Thomas Grainger <tagrain@gmail.com>
urllib3 · sethmlarson · Aug 2, 2024 · Aug 2, 2024 · Aug 2, 2024 · Aug 2, 2024
commit 8e0581920d3bf6e5bb022523d5a3fc026f96fde8
diff --git a/test/test_no_ssl.py b/test/test_no_ssl.py
@@ -5,6 +5,7 @@
 * HTTPS requests must fail with an error that points at the ssl module
 """
 
+import importlib
 import sys
 
 import pytest
@@ -29,6 +30,12 @@ def find_module(self, fullname, path=None):
     def load_module(self, fullname):
         raise ImportError("import of {0} is blocked".format(fullname))
 
+    def find_spec(self, fullname, path, target):
+        loader = self.find_module(fullname, path)
+        if loader is None:
+            return None
+        return importlib.util.spec_from_loader(fullname, loader)
+
 
 class ModuleStash(object):
     """

diff --git a/test/with_dummyserver/test_socketlevel.py b/test/with_dummyserver/test_socketlevel.py
@@ -142,6 +142,38 @@ def socket_handler(listener):
                 ), "missing ALPN protocol in SSL handshake"
 
 
+def original_ssl_wrap_socket(
+    sock,
+    keyfile=None,
+    certfile=None,
+    server_side=False,
+    cert_reqs=ssl.CERT_NONE,
+    ssl_version=ssl.PROTOCOL_TLS,
+    ca_certs=None,
+    do_handshake_on_connect=True,
+    suppress_ragged_eofs=True,
+    ciphers=None,
+):
+    if server_side and not certfile:
+        raise ValueError("certfile must be specified for server-side operations")
+    if keyfile and not certfile:
+        raise ValueError("certfile must be specified")
+    context = ssl.SSLContext(ssl_version)
+    context.verify_mode = cert_reqs
+    if ca_certs:
+        context.load_verify_locations(ca_certs)
+    if certfile:
+        context.load_cert_chain(certfile, keyfile)
+    if ciphers:
+        context.set_ciphers(ciphers)
+    return context.wrap_socket(
+        sock=sock,
+        server_side=server_side,
+        do_handshake_on_connect=do_handshake_on_connect,
+        suppress_ragged_eofs=suppress_ragged_eofs,
+    )
+
+
 class TestClientCerts(SocketDummyServerTestCase):
     """
     Tests for client certificate support.
@@ -173,7 +205,7 @@ def _wrap_in_ssl(self, sock):
         """
         Given a single socket, wraps it in TLS.
         """
-        return ssl.wrap_socket(
+        return original_ssl_wrap_socket(
             sock,
             ssl_version=ssl.PROTOCOL_SSLv23,
             cert_reqs=ssl.CERT_REQUIRED,
@@ -1076,7 +1108,7 @@ def proxy_ssl_one(listener):
                 return
 
             sock.send(("HTTP/1.1 200 Connection Established\r\n\r\n").encode("utf-8"))
-            ssl_sock = ssl.wrap_socket(
+            ssl_sock = original_ssl_wrap_socket(
                 sock,
                 server_side=True,
                 keyfile=DEFAULT_CERTS["keyfile"],
@@ -1128,7 +1160,7 @@ def echo_socket_handler(listener):
 
             if s.startswith("CONNECT [%s]:443" % (ipv6_addr,)):
                 sock.send(b"HTTP/1.1 200 Connection Established\r\n\r\n")
-                ssl_sock = ssl.wrap_socket(
+                ssl_sock = original_ssl_wrap_socket(
                     sock,
                     server_side=True,
                     keyfile=DEFAULT_CERTS["keyfile"],
@@ -1195,7 +1227,7 @@ def test_ssl_failure_midway_through_conn(self):
         def socket_handler(listener):
             sock = listener.accept()[0]
             sock2 = sock.dup()
-            ssl_sock = ssl.wrap_socket(
+            ssl_sock = original_ssl_wrap_socket(
                 sock,
                 server_side=True,
                 keyfile=DEFAULT_CERTS["keyfile"],
@@ -1234,7 +1266,7 @@ def test_ssl_read_timeout(self):
 
         def socket_handler(listener):
             sock = listener.accept()[0]
-            ssl_sock = ssl.wrap_socket(
+            ssl_sock = original_ssl_wrap_socket(
                 sock,
                 server_side=True,
                 keyfile=DEFAULT_CERTS["keyfile"],
@@ -1275,7 +1307,7 @@ def test_ssl_failed_fingerprint_verification(self):
         def socket_handler(listener):
             for i in range(2):
                 sock = listener.accept()[0]
-                ssl_sock = ssl.wrap_socket(
+                ssl_sock = original_ssl_wrap_socket(
                     sock,
                     server_side=True,
                     keyfile=DEFAULT_CERTS["keyfile"],
@@ -1322,7 +1354,7 @@ def socket_handler(listener):
             # first request, trigger an SSLError
             sock = listener.accept()[0]
             sock2 = sock.dup()
-            ssl_sock = ssl.wrap_socket(
+            ssl_sock = original_ssl_wrap_socket(
                 sock,
                 server_side=True,
                 keyfile=DEFAULT_CERTS["keyfile"],
@@ -1347,7 +1379,7 @@ def socket_handler(listener):
 
             # retried request
             sock = listener.accept()[0]
-            ssl_sock = ssl.wrap_socket(
+            ssl_sock = original_ssl_wrap_socket(
                 sock,
                 server_side=True,
                 keyfile=DEFAULT_CERTS["keyfile"],
@@ -1373,7 +1405,7 @@ def socket_handler(listener):
     def test_ssl_load_default_certs_when_empty(self):
         def socket_handler(listener):
             sock = listener.accept()[0]
-            ssl_sock = ssl.wrap_socket(
+            ssl_sock = original_ssl_wrap_socket(
                 sock,
                 server_side=True,
                 keyfile=DEFAULT_CERTS["keyfile"],
@@ -1410,7 +1442,7 @@ def socket_handler(listener):
     def test_ssl_dont_load_default_certs_when_given(self):
         def socket_handler(listener):
             sock = listener.accept()[0]
-            ssl_sock = ssl.wrap_socket(
+            ssl_sock = original_ssl_wrap_socket(
                 sock,
                 server_side=True,
                 keyfile=DEFAULT_CERTS["keyfile"],
@@ -1475,7 +1507,7 @@ def is_closed_socket(sock):
         def socket_handler(listener):
             sock = listener.accept()[0]
             try:
-                _ = ssl.wrap_socket(
+                _ = original_ssl_wrap_socket(
                     sock,
                     server_side=True,
                     keyfile=DEFAULT_CERTS["keyfile"],
@@ -1522,7 +1554,7 @@ def test_requesting_large_resources_via_ssl(self, preload_content, read_amt):
 
         def socket_handler(listener):
             sock = listener.accept()[0]
-            ssl_sock = ssl.wrap_socket(
+            ssl_sock = original_ssl_wrap_socket(
                 sock,
                 server_side=True,
                 keyfile=DEFAULT_CERTS["keyfile"],