Merge lp:~jderose/degu/py3.10 into lp:degu

[Jason Gerard DeRose]

Support Python 3.10

[Jeremy Soller (jackpot51)]

Changes all look good to me

review: Approve

=== modified file 'debian/control'
--- debian/control	2021-01-13 13:00:43 +0000
+++ debian/control	2022-06-16 23:17:03 +0000
@@ -6,6 +6,7 @@
     dh-python,
     python3-all-dev (>= 3.8),
     python3-all-dbg (>= 3.8),
+    python3-setuptools,
     python3-sphinx,
     pyflakes3,
     clang-tools,
 
=== modified file 'degu/client.py'
--- degu/client.py	2016-05-18 04:00:39 +0000
+++ degu/client.py	2022-06-16 23:17:03 +0000
@@ -82,7 +82,7 @@
                     )
                 )
 
-    sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
+    sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     sslctx.verify_mode = ssl.CERT_REQUIRED
     sslctx.set_ciphers(
         'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384'
@@ -116,8 +116,8 @@
 
     if not isinstance(sslctx, ssl.SSLContext):
         raise TypeError('sslctx must be an ssl.SSLContext')
-    if sslctx.protocol != ssl.PROTOCOL_TLSv1_2:
-        raise ValueError('sslctx.protocol must be ssl.PROTOCOL_TLSv1_2')
+    if sslctx.protocol != ssl.PROTOCOL_TLS_CLIENT:
+        raise ValueError('sslctx.protocol must be ssl.PROTOCOL_TLS_CLIENT')
     if not (sslctx.options & ssl.OP_NO_COMPRESSION):
         raise ValueError('sslctx.options must include ssl.OP_NO_COMPRESSION')
     if sslctx.verify_mode != ssl.CERT_REQUIRED:
 
=== modified file 'degu/server.py'
--- degu/server.py	2019-11-26 01:04:54 +0000
+++ degu/server.py	2022-06-16 23:17:03 +0000
@@ -69,7 +69,7 @@
                     )
                 )
 
-    sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
+    sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
     sslctx.set_ciphers(
         'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384'
     )
@@ -109,8 +109,8 @@
 
     if not isinstance(sslctx, ssl.SSLContext):
         raise TypeError('sslctx must be an ssl.SSLContext')
-    if sslctx.protocol != ssl.PROTOCOL_TLSv1_2:
-        raise ValueError('sslctx.protocol must be ssl.PROTOCOL_TLSv1_2')
+    if sslctx.protocol != ssl.PROTOCOL_TLS_SERVER:
+        raise ValueError('sslctx.protocol must be ssl.PROTOCOL_TLS_SERVER')
 
     # We consider ssl.CERT_OPTIONAL to be a bad grey area:
     if sslctx.verify_mode == ssl.CERT_OPTIONAL:
 
=== modified file 'degu/tests/test_base.py'
--- degu/tests/test_base.py	2021-01-11 18:50:42 +0000
+++ degu/tests/test_base.py	2022-06-16 23:17:03 +0000
@@ -425,9 +425,9 @@
             if self.backend is _base:
                 msg = ARG_MSG_C.format(fullname, number, len(args))
             elif len(args) < number:
-                msg = ARG_MSG_Py_1.format(name, missing)
+                msg = ARG_MSG_Py_1.format(fullname, missing)
             else:
-                msg = ARG_MSG_Py_2.format(name, number + 1, number + 2)
+                msg = ARG_MSG_Py_2.format(fullname, number + 1, number + 2)
             self.assertEqual(str(cm.exception), msg)
 
     def check_method_args(self, inst, name, number, missing):
@@ -803,10 +803,6 @@
         self.assertEqual(str(r),  'bytes=0-9999999999999998')
 
         # Check reference counting:
-        if self.backend is _base:
-            delmsg = 'readonly attribute'
-        else:
-            delmsg = "can't delete attribute"
         for i in range(1000):
             stop = random.randrange(1, MAX_LENGTH + 1)
             start = random.randrange(0, stop)
@@ -827,6 +823,10 @@
             # start, stop should be read-only:
             r = self.Range(start, stop)
             for name in ('start', 'stop'):
+                if self.backend is _base:
+                    delmsg = 'readonly attribute'
+                else:
+                    delmsg = "can't delete attribute '" + name + "'"
                 with self.assertRaises(AttributeError) as cm:
                     delattr(r, name)
                 self.assertEqual(str(cm.exception), delmsg)
@@ -1139,10 +1139,6 @@
         )
 
         # Check reference counting:
-        if self.backend is _base:
-            delmsg = 'readonly attribute'
-        else:
-            delmsg = "can't delete attribute"
         for i in range(1000):
             stop = random.randrange(1, MAX_LENGTH + 1)
             start = random.randrange(0, stop)
@@ -1172,6 +1168,10 @@
             # start, stop, total should be read-only:
             r = self.ContentRange(start, stop, total)
             for name in ('start', 'stop', 'total'):
+                if self.backend is _base:
+                    delmsg = 'readonly attribute'
+                else:
+                    delmsg = "can't delete attribute '" + name + "'"
                 with self.assertRaises(AttributeError) as cm:
                     delattr(r, name)
                 self.assertEqual(str(cm.exception), delmsg)
@@ -2170,6 +2170,7 @@
         self.assertEqual(str(cm.exception),
             "'MissingReadline' object has no attribute 'readline'"
         )
+        del cm  # Must del context manager before testing refcount (py 3.10+):
         self.assertEqual(sys.getrefcount(rfile), 2)
 
         # rfile.readline() not callable:
@@ -2195,6 +2196,7 @@
         self.assertEqual(str(cm.exception),
             "'MissingRead' object has no attribute 'readinto'"
         )
+        del cm  # Must del context manager before testing refcount (py 3.10+):
         self.assertEqual(sys.getrefcount(rfile), 2)
 
         # rfile.readinto() not callable:
@@ -3505,13 +3507,13 @@
         Check body instance attributes that should be read-only.
         """
         assert len(members) >= 2
-        if self.backend is _basepy:
-            setmsg = "can't set attribute"
-            delmsg = "can't delete attribute"
-        else:
-            setmsg = 'readonly attribute'
-            delmsg = 'readonly attribute'
         for name in members:
+            if self.backend is _basepy:
+                setmsg = "can't set attribute '" + name + "'"
+                delmsg = "can't delete attribute '" + name + "'"
+            else:
+                setmsg = 'readonly attribute'
+                delmsg = 'readonly attribute'
             value = getattr(body, name)
             with self.assertRaises(AttributeError) as cm:
                 setattr(body, name, value)
@@ -3993,6 +3995,7 @@
         self.assertEqual(str(cm.exception),
             "'MissingReadline' object has no attribute 'readline'"
         )
+        del cm  # Must del context manager before testing refcount (py 3.10+):
         self.assertEqual(sys.getrefcount(rfile), 2)
 
         # Not a backend.SocketWrapper, rfile.readline() not callable:
@@ -4018,6 +4021,7 @@
         self.assertEqual(str(cm.exception),
             "'MissingRead' object has no attribute 'readinto'"
         )
+        del cm  # Must del context manager before testing refcount (py 3.10+):
         self.assertEqual(sys.getrefcount(rfile), 2)
 
         # Not a backend.SocketWrapper, rfile.readinto() not callable:
@@ -6245,6 +6249,7 @@
         self.assertEqual(str(cm.exception),
             "'BadSocket1' object has no attribute 'recv_into'"
         )
+        del cm  # Must del context manager before testing refcount (py 3.10+):
         self.assertEqual(sys.getrefcount(sock), 2)
         self.assertEqual(sock._calls, ['close'])
 
@@ -6259,6 +6264,7 @@
         self.assertEqual(str(cm.exception),
             "'BadSocket2' object has no attribute 'send'"
         )
+        del cm  # Must del context manager before testing refcount (py 3.10+):
         self.assertEqual(sys.getrefcount(sock), 2)
         self.assertEqual(sock._calls, ['close'])
 
 
=== modified file 'degu/tests/test_client.py'
--- degu/tests/test_client.py	2017-09-04 23:38:30 +0000
+++ degu/tests/test_client.py	2022-06-16 23:17:03 +0000
@@ -142,7 +142,7 @@
         for func in client_sslctx_funcs:
             sslctx = func({})
             self.assertIsInstance(sslctx, ssl.SSLContext)
-            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLSv1_2)
+            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLS_CLIENT)
             self.assertEqual(sslctx.verify_mode, ssl.CERT_REQUIRED)
             self.assertIs(sslctx.check_hostname, True)
 
@@ -159,7 +159,7 @@
         for func in client_sslctx_funcs:
             sslctx = func({'check_hostname': True})
             self.assertIsInstance(sslctx, ssl.SSLContext)
-            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLSv1_2)
+            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLS_CLIENT)
             self.assertEqual(sslctx.verify_mode, ssl.CERT_REQUIRED)
             self.assertIs(sslctx.check_hostname, True)
 
@@ -173,7 +173,7 @@
         for func in client_sslctx_funcs:
             sslctx = func(sslconfig)
             self.assertIsInstance(sslctx, ssl.SSLContext)
-            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLSv1_2)
+            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLS_CLIENT)
             self.assertEqual(sslctx.verify_mode, ssl.CERT_REQUIRED)
             self.assertIs(sslctx.check_hostname, False)
 
@@ -182,7 +182,7 @@
         for func in client_sslctx_funcs:
             sslctx = func(sslconfig)
             self.assertIsInstance(sslctx, ssl.SSLContext)
-            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLSv1_2)
+            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLS_CLIENT)
             self.assertEqual(sslctx.verify_mode, ssl.CERT_REQUIRED)
             self.assertIs(sslctx.check_hostname, True)
 
@@ -193,7 +193,7 @@
         for func in client_sslctx_funcs:
             sslctx = func(sslconfig)
             self.assertIsInstance(sslctx, ssl.SSLContext)
-            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLSv1_2)
+            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLS_CLIENT)
             self.assertEqual(sslctx.verify_mode, ssl.CERT_REQUIRED)
             self.assertIs(sslctx.check_hostname, False)
 
@@ -202,7 +202,7 @@
         for func in client_sslctx_funcs:
             sslctx = func(sslconfig)
             self.assertIsInstance(sslctx, ssl.SSLContext)
-            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLSv1_2)
+            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLS_CLIENT)
             self.assertEqual(sslctx.verify_mode, ssl.CERT_REQUIRED)
             self.assertIs(sslctx.check_hostname, True)
 
@@ -470,11 +470,11 @@
         self.assertEqual(str(cm.exception), 'sslctx must be an ssl.SSLContext')
 
         # Bad SSL protocol version:
-        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
+        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
         with self.assertRaises(ValueError) as cm:
             client.SSLClient(sslctx, None)
         self.assertEqual(str(cm.exception),
-            'sslctx.protocol must be ssl.PROTOCOL_TLSv1_2'
+            'sslctx.protocol must be ssl.PROTOCOL_TLS_CLIENT'
         )
 
         # Note: Python 3.3.4 (and presumably 3.4.0) now disables SSLv2 by
@@ -482,7 +482,7 @@
         # we cannot unset the ssl.OP_NO_SSLv2 bit, we can't unit test to check
         # that Degu enforces this, so for now, we set the bit here so it works
         # with Python 3.3.3 still; see: http://bugs.python.org/issue20207
-        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
+        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         sslctx.options |= ssl.OP_NO_SSLv2
 
         # not (options & ssl.OP_NO_COMPRESSION)
@@ -494,7 +494,7 @@
             )
 
         # verify_mode is not ssl.CERT_REQUIRED:
-        sslctx.options |= ssl.OP_NO_COMPRESSION
+        sslctx.verify_mode = ssl.CERT_OPTIONAL
         with self.assertRaises(ValueError) as cm:
             client.SSLClient(sslctx, None)
         self.assertEqual(str(cm.exception),
 
=== modified file 'degu/tests/test_server.py'
--- degu/tests/test_server.py	2019-11-26 01:04:54 +0000
+++ degu/tests/test_server.py	2022-06-16 23:17:03 +0000
@@ -120,7 +120,7 @@
         )
         for func in server_sslctx_funcs:
             sslctx = func(pki.server_sslconfig)
-            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLSv1_2)
+            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLS_SERVER)
             self.assertEqual(sslctx.verify_mode, ssl.CERT_REQUIRED)
 
         # New in Degu 0.3: should not be able to accept connections from
@@ -138,7 +138,7 @@
         sslconfig['allow_unauthenticated_clients'] = True
         for func in server_sslctx_funcs:
             sslctx = func(sslconfig)
-            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLSv1_2)
+            self.assertEqual(sslctx.protocol, ssl.PROTOCOL_TLS_SERVER)
             self.assertEqual(sslctx.verify_mode, ssl.CERT_NONE)
 
         # Cannot mix ca_file/ca_path with allow_unauthenticated_clients:
@@ -176,13 +176,13 @@
 
         # Wrong protocol:
         with self.assertRaises(ValueError) as cm:
-            server._validate_server_sslctx(ssl.SSLContext(ssl.PROTOCOL_TLSv1))
+            server._validate_server_sslctx(ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT))
         self.assertEqual(str(cm.exception),
-            'sslctx.protocol must be ssl.PROTOCOL_TLSv1_2'
+            'sslctx.protocol must be ssl.PROTOCOL_TLS_SERVER'
         )
 
         # Don't allow ssl.CERT_OPTIONAL:
-        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
+        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
         sslctx.verify_mode = ssl.CERT_OPTIONAL
         with self.assertRaises(ValueError) as cm:
             server._validate_server_sslctx(sslctx)
@@ -191,13 +191,13 @@
         )
 
         # All good:
-        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
+        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
         self.assertIs(sslctx.verify_mode, ssl.CERT_NONE)
         self.assertIs(server._validate_server_sslctx(sslctx), sslctx)
 
         # Now again, this time with CERT_REQUIRED:
         # options missing OP_NO_COMPRESSION:
-        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
+        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
         sslctx.verify_mode = ssl.CERT_REQUIRED
         self.assertIs(sslctx.verify_mode, ssl.CERT_REQUIRED)
         self.assertIs(server._validate_server_sslctx(sslctx), sslctx)
@@ -426,15 +426,15 @@
         self.assertEqual(str(cm.exception), 'sslctx must be an ssl.SSLContext')
 
         # Bad SSL protocol version:
-        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
+        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
         with self.assertRaises(ValueError) as cm:
             server.SSLServer(sslctx, degu.IPv6_LOOPBACK, good_app)
         self.assertEqual(str(cm.exception),
-            'sslctx.protocol must be ssl.PROTOCOL_TLSv1_2'
+            'sslctx.protocol must be ssl.PROTOCOL_TLS_SERVER'
         )
 
         # Good sslctx from here on:
-        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
+        sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
 
         # Bad address type:
         with self.assertRaises(TypeError) as cm:
@@ -1003,7 +1003,7 @@
         with self.assertRaises(ssl.SSLError) as cm:
             client.connect()
         self.assertTrue(
-            str(cm.exception).startswith('[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE]')
+            str(cm.exception).startswith('[SSL: CERTIFICATE_VERIFY_FAILED]')
         )
         self.assertIs(conn.closed, True)
 
@@ -1017,7 +1017,7 @@
         with self.assertRaises(ssl.SSLError) as cm:
             client.connect()
         self.assertTrue(
-            str(cm.exception).startswith('[SSL: TLSV1_ALERT_UNKNOWN_CA]')
+            str(cm.exception).startswith('[SSL: CERTIFICATE_VERIFY_FAILED]')
         )
         self.assertIs(conn.closed, True)
 
 
=== modified file 'degu/tests/test_sslhelpers.py'
--- degu/tests/test_sslhelpers.py	2016-03-13 18:28:18 +0000
+++ degu/tests/test_sslhelpers.py	2022-06-16 23:17:03 +0000
@@ -36,22 +36,26 @@
     def test_create_key(self):
         # 1024 bit:
         key_data = sslhelpers.create_key(1024)
-        self.assertIn(len(key_data), [883, 887, 891])
+        self.assertGreater(len(key_data), 512)
+        self.assertLess(len(key_data), 1024)
         sslhelpers.get_pubkey(key_data)
 
         # 2048 bit:
         key_data = sslhelpers.create_key(2048)
-        self.assertIn(len(key_data), [1671, 1675, 1679])
+        self.assertGreater(len(key_data), 1024)
+        self.assertLess(len(key_data), 2048)
         sslhelpers.get_pubkey(key_data)
 
         # 3072 bit:
         key_data = sslhelpers.create_key(3072)
-        self.assertIn(len(key_data), [2455, 2459])
+        self.assertGreater(len(key_data), 2048)
+        self.assertLess(len(key_data), 3072)
         sslhelpers.get_pubkey(key_data)
 
         # 4096 bit:
         key_data = sslhelpers.create_key(4096)
-        self.assertIn(len(key_data), [3239, 3243, 3247])
+        self.assertGreater(len(key_data), 3072)
+        self.assertLess(len(key_data), 4096)
         sslhelpers.get_pubkey(key_data)
 
     def test_create_ca(self):
@@ -179,7 +183,6 @@
             set([
                 ca_id + '.key',
                 ca_id + '.ca',
-                ca_id + '.srl',
                 cert_id + '.csr',
                 cert_id + '.cert',
             ])
 
=== modified file 'doc/degu.client.rst'
--- doc/degu.client.rst	2017-07-18 18:07:33 +0000
+++ doc/degu.client.rst	2022-06-16 23:17:03 +0000
@@ -42,7 +42,7 @@
 server certificate (more or less how a browser would configure SSL):
 
 >>> import ssl
->>> sslclient.sslctx.protocol == ssl.PROTOCOL_TLSv1_2
+>>> sslclient.sslctx.protocol == ssl.PROTOCOL_TLS_CLIENT
 True
 >>> sslclient.sslctx.verify_mode == ssl.CERT_REQUIRED
 True
 
=== modified file 'setup.py'
--- setup.py	2021-01-13 13:00:43 +0000
+++ setup.py	2022-06-16 23:17:03 +0000
@@ -33,8 +33,7 @@
 import os
 from os import path
 import subprocess
-from distutils.core import setup, Extension
-from distutils.cmd import Command
+from setuptools import setup, Command, Extension
 
 import degu
 from degu.tests.run import run_tests