From 7ca1d814eeec13a965aa5169576feb14de524cb4 Mon Sep 17 00:00:00 2001
From: Mark Williams <mrw@enotuniq.org>
Date: Sun, 10 Feb 2019 16:44:06 -0800
Subject: [PATCH] Only check for ECDH on TLS 1.2

OpenSSL 1.1.1, via cryptography >= 2.5, will attempt to use TLS 1.3;
its implementation of TLS 1.3 always uses ECDH, though its cipher
suites don't reflect that (see comment in diff for more information.)

Force OpenSSLOptionsECDHIntegrationTests to use TLS 1.2 so that they
continue to assert ECDH is used when it might not be.
---
 src/twisted/test/test_sslverify.py | 27 ++++++++++++++++++++++-----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/src/twisted/test/test_sslverify.py b/src/twisted/test/test_sslverify.py
index d06ede76fa..28ac45f93d 100644
--- a/src/twisted/test/test_sslverify.py
+++ b/src/twisted/test/test_sslverify.py
@@ -1664,11 +1664,28 @@ def test_ellipticCurveDiffieHellman(self):
             raise unittest.SkipTest("OpenSSL does not support ECDH.")
 
         onData = defer.Deferred()
-        self.loopback(sslverify.OpenSSLCertificateOptions(privateKey=self.sKey,
-                            certificate=self.sCert, requireCertificate=False),
-                      sslverify.OpenSSLCertificateOptions(
-                          requireCertificate=False),
-                      onData=onData)
+        # TLS 1.3 cipher suites do not specify the key exchange
+        # mechanism:
+        # https://wiki.openssl.org/index.php/TLS1.3#Differences_with_TLS1.2_and_below
+        #
+        # and OpenSSL only supports ECHDE groups with TLS 1.3:
+        # https://wiki.openssl.org/index.php/TLS1.3#Groups
+        #
+        # so TLS 1.3 implies ECDHE.  Force this test to use TLS 1.2 to
+        # ensure ECDH is selected when it might not be.
+        self.loopback(
+            sslverify.OpenSSLCertificateOptions(
+                privateKey=self.sKey,
+                certificate=self.sCert,
+                requireCertificate=False,
+                lowerMaximumSecurityTo=sslverify.TLSVersion.TLSv1_2
+            ),
+            sslverify.OpenSSLCertificateOptions(
+                requireCertificate=False,
+                lowerMaximumSecurityTo=sslverify.TLSVersion.TLSv1_2,
+            ),
+            onData=onData,
+        )
 
         @onData.addCallback
         def assertECDH(_):