Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dnsdist: Fix regression tests with Python 3.13 #15003

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

rgacogne
Copy link
Member

Short description

The CA certificates that we are generating as par of our regression tests were lacking the X.509 Key Usage extension, causing TLS validation with Python 3.13 to fail with:

certificate verify failed: CA cert does not include key usage extension

It appears that Python 3.13 enables VERIFY_X509_STRICT by default, which makes OpenSSL stricter, and thus it chokes on our invalid CA.

Checklist

I have:

  • read the CONTRIBUTING.md document
  • compiled this code
  • tested this code
  • included documentation (including possible behaviour changes)
  • documented the code
  • added or modified regression test(s)
  • added or modified unit test(s)

The CA certificates that we are generating as par of our regression tests
were lacking the X.509 `Key Usage` extension, causing TLS validation with
Python 3.13 to fail with:

> certificate verify failed: CA cert does not include key usage extension

It appears that Python 3.13 enables `VERIFY_X509_STRICT` by default, which makes OpenSSL stricter, and thus it chokes on our invalid CA.
@coveralls
Copy link

coveralls commented Dec 30, 2024

Pull Request Test Coverage Report for Build 12548222735

Details

  • 0 of 0 changed or added relevant lines in 0 files are covered.
  • 7956 unchanged lines in 153 files lost coverage.
  • Overall coverage increased (+2.2%) to 64.809%

Files with Coverage Reduction New Missed Lines %
pdns/dnsdistdist/dnsdist-session-cache.cc 1 62.86%
pdns/auth-catalogzone.hh 1 66.67%
modules/gpgsqlbackend/gpgsqlbackend.cc 1 88.62%
pdns/dnsdistdist/test-dnsdistrules_cc.cc 1 95.15%
pdns/recursordist/nod.hh 1 92.59%
pdns/test-dnsrecords_cc.cc 2 95.97%
pdns/dnsdistdist/test-dnsdist-lua-ffi.cc 2 99.59%
pdns/epollmplexer.cc 2 85.0%
pdns/json.cc 2 83.33%
pdns/recursordist/test-negcache_cc.cc 2 98.52%
Totals Coverage Status
Change from base Build 12508806594: 2.2%
Covered Lines: 126093
Relevant Lines: 163763

💛 - Coveralls

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants