Skip to content

gh-131423: Update to OpenSSL 3.0.16. #131839

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Mar 28, 2025
Merged

gh-131423: Update to OpenSSL 3.0.16. #131839

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
2a3da59
gh-131423: Update to OpenSSL 3.0.16.
zooba Mar 28, 2025
37c1d10
Remove unused code from ssl.c
zooba Mar 28, 2025
aa14760
Add NEWS
zooba Mar 28, 2025
dac6cfb
Fix directory and SBOM
zooba Mar 28, 2025
9296a9c
Better grammar and fix for other test using test_dh_params
zooba Mar 28, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
52 changes: 39 additions & 13 deletions Lib/test/test_ssl.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1321,10 +1321,14 @@ def test_load_verify_cadata(self):
with self.assertRaises(ssl.SSLError):
ctx.load_verify_locations(cadata=cacert_der + b"A")

@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_load_dh_params(self):
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
ctx.load_dh_params(DHFILE)
try:
ctx.load_dh_params(DHFILE)
except RuntimeError:
if Py_DEBUG_WIN32:
self.skipTest("not supported on Win32 debug build")
raise
ctx.load_dh_params(BYTES_DHFILE)
self.assertRaises(TypeError, ctx.load_dh_params)
self.assertRaises(TypeError, ctx.load_dh_params, None)
Expand Down Expand Up @@ -1648,12 +1652,17 @@ def test_str(self):
self.assertEqual(str(e), "foo")
self.assertEqual(e.errno, 1)

@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_lib_reason(self):
# Test the library and reason attributes
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
with self.assertRaises(ssl.SSLError) as cm:
ctx.load_dh_params(CERTFILE)
try:
with self.assertRaises(ssl.SSLError) as cm:
ctx.load_dh_params(CERTFILE)
except RuntimeError:
if Py_DEBUG_WIN32:
self.skipTest("not supported on Win32 debug build")
raise

self.assertEqual(cm.exception.library, 'PEM')
regex = "(NO_START_LINE|UNSUPPORTED_PUBLIC_KEY_TYPE)"
self.assertRegex(cm.exception.reason, regex)
Expand Down Expand Up @@ -4032,13 +4041,17 @@ def test_no_legacy_server_connect(self):
chatty=True, connectionchatty=True,
sni_name=hostname)

@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_dh_params(self):
# Check we can get a connection with ephemeral Diffie-Hellman
client_context, server_context, hostname = testing_context()
# test scenario needs TLS <= 1.2
client_context.maximum_version = ssl.TLSVersion.TLSv1_2
server_context.load_dh_params(DHFILE)
try:
server_context.load_dh_params(DHFILE)
except RuntimeError:
if Py_DEBUG_WIN32:
self.skipTest("not supported on Win32 debug build")
raise
server_context.set_ciphers("kEDH")
server_context.maximum_version = ssl.TLSVersion.TLSv1_2
stats = server_params_test(client_context, server_context,
Expand Down Expand Up @@ -4819,14 +4832,18 @@ def keylog_lines(self, fname=os_helper.TESTFN):
return len(list(f))

@requires_keylog
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_keylog_defaults(self):
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
self.assertEqual(ctx.keylog_filename, None)

self.assertFalse(os.path.isfile(os_helper.TESTFN))
ctx.keylog_filename = os_helper.TESTFN
try:
ctx.keylog_filename = os_helper.TESTFN
except RuntimeError:
if Py_DEBUG_WIN32:
self.skipTest("not supported on Win32 debug build")
raise
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
self.assertTrue(os.path.isfile(os_helper.TESTFN))
self.assertEqual(self.keylog_lines(), 1)
Expand All @@ -4843,12 +4860,17 @@ def test_keylog_defaults(self):
ctx.keylog_filename = 1

@requires_keylog
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_keylog_filename(self):
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
client_context, server_context, hostname = testing_context()

client_context.keylog_filename = os_helper.TESTFN
try:
client_context.keylog_filename = os_helper.TESTFN
except RuntimeError:
if Py_DEBUG_WIN32:
self.skipTest("not supported on Win32 debug build")
raise

server = ThreadedEchoServer(context=server_context, chatty=False)
with server:
with client_context.wrap_socket(socket.socket(),
Expand Down Expand Up @@ -4881,7 +4903,6 @@ def test_keylog_filename(self):
@requires_keylog
@unittest.skipIf(sys.flags.ignore_environment,
"test is not compatible with ignore_environment")
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
def test_keylog_env(self):
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
with unittest.mock.patch.dict(os.environ):
Expand All @@ -4891,7 +4912,12 @@ def test_keylog_env(self):
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
self.assertEqual(ctx.keylog_filename, None)

ctx = ssl.create_default_context()
try:
ctx = ssl.create_default_context()
except RuntimeError:
if Py_DEBUG_WIN32:
self.skipTest("not supported on Win32 debug build")
raise
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)

ctx = ssl._create_stdlib_context()
Expand Down
3 changes: 3 additions & 0 deletions Misc/NEWS.d/next/Windows/2025-03-28-13-22-55.gh-issue-131423.vI-LqV.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
Update bundled version of OpenSSL to 3.0.16. The new build also disables
uplink support, which may be relevant to embedders but has no impact on
normal use.
8 changes: 4 additions & 4 deletions Misc/externals.spdx.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,21 +70,21 @@
"checksums": [
{
"algorithm": "SHA256",
"checksumValue": "1550c87996a0858474a9dd179deab2c55eb73726b9a140b32865b02fd3d8a86b"
"checksumValue": "6bb739ecddbd2cfb6d255eb5898437a9b5739277dee931338d3275bac5d96ba2"
}
],
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.15.tar.gz",
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.16.tar.gz",
"externalRefs": [
{
"referenceCategory": "SECURITY",
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.15:*:*:*:*:*:*:*",
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.16:*:*:*:*:*:*:*",
"referenceType": "cpe23Type"
}
],
"licenseConcluded": "NOASSERTION",
"name": "openssl",
"primaryPackagePurpose": "SOURCE",
"versionInfo": "3.0.15"
"versionInfo": "3.0.16"
},
{
"SPDXID": "SPDXRef-PACKAGE-sqlite",
Expand Down
6 changes: 6 additions & 0 deletions Modules/_ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4427,6 +4427,12 @@ _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath)
FILE *f;
DH *dh;

#if defined(MS_WINDOWS) && defined(_DEBUG)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is _DEBUG the canonical "NDEBUG" for Windows builds? (just asking)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They're opposite. _DEBUG basically means linking to the debug CRT (and asserts are enabled), while NDEBUG means linking to the non-debug CRT (and asserts are disabled).

Copy link
Member

@picnixz picnixz Mar 28, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah yes, what I meant is "is it common to use the _DEBUG macro instead of the !defined(NDEBUG) one" (I think I've only seen Py_DEBUG and NDEBUG usage but not _DEBUG)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess it's personal preference? _DEBUG is defined by the compiler based on the runtime library which is what I wanted, while NDEBUG controls the behaviour of assert.

So it's technically possible to define them both at once, but generally you don't, and I wouldn't suggest it in a codebase like ours because it's almost certainly assuming they are mutually exclusive.

PyErr_SetString(PyExc_RuntimeError,
"unable to load_dh_params on Windows debug build");
return NULL;
#endif

f = Py_fopen(filepath, "rb");
if (f == NULL)
return NULL;
Expand Down
7 changes: 7 additions & 0 deletions Modules/_ssl/debughelpers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,13 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
{
PySSLContext *self = PySSLContext_CAST(op);
FILE *fp;

#if defined(MS_WINDOWS) && defined(_DEBUG)
PyErr_SetString(PyExc_RuntimeError,
"unable to set_keylog_filename on Windows debug build");
return -1;
#endif

/* Reset variables and callback first */
SSL_CTX_set_keylog_callback(self->ctx, NULL);
Py_CLEAR(self->keylog_filename);
Expand Down
3 changes: 0 additions & 3 deletions PCbuild/_ssl.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,9 +99,6 @@
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="..\Modules\_ssl.c" />
<ClCompile Include="$(opensslIncludeDir)\applink.c">
<PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;$(PreprocessorDefinitions)</PreprocessorDefinitions>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="..\PC\python_nt.rc" />
Expand Down
3 changes: 0 additions & 3 deletions PCbuild/_ssl.vcxproj.filters
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,6 @@
<ClCompile Include="..\Modules\_ssl.c">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="$(opensslIncludeDir)\applink.c">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="..\PC\python_nt.rc">
Expand Down
4 changes: 2 additions & 2 deletions PCbuild/get_externals.bat
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ echo.Fetching external libraries...
set libraries=
set libraries=%libraries% bzip2-1.0.8
if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.4.4
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.15
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.16
set libraries=%libraries% mpdecimal-4.0.0
set libraries=%libraries% sqlite-3.45.3.0
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.15.0
Expand All @@ -77,7 +77,7 @@ echo.Fetching external binaries...

set binaries=
if NOT "%IncludeLibffi%"=="false" set binaries=%binaries% libffi-3.4.4
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.15
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.16.1
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.15.0
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06

Expand Down
26 changes: 1 addition & 25 deletions PCbuild/openssl.vcxproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,47 +67,23 @@
set VCINSTALLDIR=$(VCInstallDir)
if not exist "$(IntDir.TrimEnd('\'))" mkdir "$(IntDir.TrimEnd('\'))"
cd /D "$(IntDir.TrimEnd('\'))"
$(Perl) "$(opensslDir)\configure" $(OpenSSLPlatform) no-asm
$(Perl) "$(opensslDir)\configure" $(OpenSSLPlatform) no-asm no-uplink
nmake
</NMakeBuildCommandLine>
</PropertyGroup>

<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

<Target Name="_PatchUplink" BeforeTargets="Build">
<PropertyGroup>
<Uplink>$(opensslDir)\ms\uplink.c</Uplink>
<BeforePatch>((h = GetModuleHandle(NULL)) == NULL)</BeforePatch>
<AfterPatch>((h = GetModuleHandleA("_ssl.pyd")) == NULL) if ((h = GetModuleHandleA("_ssl_d.pyd")) == NULL) if ((h = GetModuleHandle(NULL)) == NULL /*patched*/)</AfterPatch>
</PropertyGroup>
<Error Text="Cannot find $(Uplink)" Condition="!Exists($(Uplink))" />
<PropertyGroup>
<_Original>$([System.IO.File]::ReadAllText($(Uplink)))</_Original>
<_Patched>$(_Original.Replace($(BeforePatch), $(AfterPatch)))</_Patched>
<IsPatched>false</IsPatched>
<IsPatched Condition="$(_Patched) == $(_Original)">true</IsPatched>
</PropertyGroup>
<Message Text="$(Uplink) is already patched" Importance="normal" Condition="$(IsPatched)" />
<Message Text="Patching $(Uplink)" Importance="high" Condition="!$(IsPatched)" />
<WriteLinesToFile File="$(Uplink)"
Lines="$(_Patched)"
Overwrite="true"
Encoding="ASCII"
Condition="!$(IsPatched)" />
</Target>

<Target Name="_CopyToOutput" AfterTargets="Build">
<ItemGroup>
<_Built Include="$(opensslDir)\LICENSE" />
<_Built Include="$(IntDir)\libcrypto.lib;$(IntDir)\libcrypto-*.dll;$(IntDir)\libcrypto-*.pdb" />
<_Built Include="$(IntDir)\libssl.lib;$(IntDir)\libssl-*.dll;$(IntDir)\libssl-*.pdb" />
<_AppLink Include="$(opensslDir)\ms\applink.c" />
<_Include Include="$(opensslDir)\Include\openssl\*.h" />
<_Include Include="$(IntDir)\include\openssl\*.h" />
</ItemGroup>
<MakeDir Directories="$(opensslOutDir)\include\openssl" />
<Copy SourceFiles="@(_Built)" DestinationFolder="$(opensslOutDir)" />
<Copy SourceFiles="@(_AppLink)" DestinationFolder="$(opensslOutDir)\include" />
<Copy SourceFiles="@(_Include)" DestinationFolder="$(opensslOutDir)\include\openssl" />
</Target>

Expand Down
4 changes: 2 additions & 2 deletions PCbuild/python.props
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,8 @@
<libffiOutDir Condition="$(libffiOutDir) == ''">$(libffiDir)$(ArchName)\</libffiOutDir>
<libffiIncludeDir Condition="$(libffiIncludeDir) == ''">$(libffiOutDir)include</libffiIncludeDir>
<mpdecimalDir Condition="$(mpdecimalDir) == ''">$(ExternalsDir)\mpdecimal-4.0.0\</mpdecimalDir>
<opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-3.0.15\</opensslDir>
<opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-3.0.15\$(ArchName)\</opensslOutDir>
<opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-3.0.16\</opensslDir>
<opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-3.0.16.1\$(ArchName)\</opensslOutDir>
<opensslIncludeDir Condition="$(opensslIncludeDir) == ''">$(opensslOutDir)include</opensslIncludeDir>
<nasmDir Condition="$(nasmDir) == ''">$(ExternalsDir)\nasm-2.11.06\</nasmDir>
<zlibDir Condition="$(zlibDir) == ''">$(ExternalsDir)\zlib-1.3.1\</zlibDir>
Expand Down
Loading