Skip to content

Commit 2a3da59

Browse files
zoobazooba
committed
pythongh-131423: Update to OpenSSL 3.0.16.
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix pythongh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
1 parent 2c8f329 commit 2a3da59

File tree

7 files changed

+62
-46
lines changed

7 files changed

+62
-46
lines changed

‎Lib/test/test_ssl.py

+39-13
Original file line numberDiff line numberDiff line change
@@ -1321,10 +1321,14 @@ def test_load_verify_cadata(self):
13211321
with self.assertRaises(ssl.SSLError):
13221322
ctx.load_verify_locations(cadata=cacert_der + b"A")
13231323

1324-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
13251324
def test_load_dh_params(self):
13261325
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
1327-
ctx.load_dh_params(DHFILE)
1326+
try:
1327+
ctx.load_dh_params(DHFILE)
1328+
except RuntimeError:
1329+
if Py_DEBUG_WIN32:
1330+
self.skipTest("not supported on Win32 debug build")
1331+
raise
13281332
ctx.load_dh_params(BYTES_DHFILE)
13291333
self.assertRaises(TypeError, ctx.load_dh_params)
13301334
self.assertRaises(TypeError, ctx.load_dh_params, None)
@@ -1648,12 +1652,17 @@ def test_str(self):
16481652
self.assertEqual(str(e), "foo")
16491653
self.assertEqual(e.errno, 1)
16501654

1651-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
16521655
def test_lib_reason(self):
16531656
# Test the library and reason attributes
16541657
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
1655-
with self.assertRaises(ssl.SSLError) as cm:
1656-
ctx.load_dh_params(CERTFILE)
1658+
try:
1659+
with self.assertRaises(ssl.SSLError) as cm:
1660+
ctx.load_dh_params(CERTFILE)
1661+
except RuntimeError:
1662+
if Py_DEBUG_WIN32:
1663+
self.skipTest("not supported on Win32 debug build")
1664+
raise
1665+
16571666
self.assertEqual(cm.exception.library, 'PEM')
16581667
regex = "(NO_START_LINE|UNSUPPORTED_PUBLIC_KEY_TYPE)"
16591668
self.assertRegex(cm.exception.reason, regex)
@@ -4032,13 +4041,17 @@ def test_no_legacy_server_connect(self):
40324041
chatty=True, connectionchatty=True,
40334042
sni_name=hostname)
40344043

4035-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
40364044
def test_dh_params(self):
40374045
# Check we can get a connection with ephemeral Diffie-Hellman
40384046
client_context, server_context, hostname = testing_context()
40394047
# test scenario needs TLS <= 1.2
40404048
client_context.maximum_version = ssl.TLSVersion.TLSv1_2
4041-
server_context.load_dh_params(DHFILE)
4049+
try:
4050+
server_context.load_dh_params(DHFILE)
4051+
except RuntimeError:
4052+
if Py_DEBUG_WIN32:
4053+
self.skipTest("not supported on Win32 debug build")
4054+
raise
40424055
server_context.set_ciphers("kEDH")
40434056
server_context.maximum_version = ssl.TLSVersion.TLSv1_2
40444057
stats = server_params_test(client_context, server_context,
@@ -4819,14 +4832,18 @@ def keylog_lines(self, fname=os_helper.TESTFN):
48194832
return len(list(f))
48204833

48214834
@requires_keylog
4822-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48234835
def test_keylog_defaults(self):
48244836
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48254837
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
48264838
self.assertEqual(ctx.keylog_filename, None)
48274839

48284840
self.assertFalse(os.path.isfile(os_helper.TESTFN))
4829-
ctx.keylog_filename = os_helper.TESTFN
4841+
try:
4842+
ctx.keylog_filename = os_helper.TESTFN
4843+
except RuntimeError:
4844+
if Py_DEBUG_WIN32:
4845+
self.skipTest("not supported on Win32 debug build")
4846+
raise
48304847
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
48314848
self.assertTrue(os.path.isfile(os_helper.TESTFN))
48324849
self.assertEqual(self.keylog_lines(), 1)
@@ -4843,12 +4860,17 @@ def test_keylog_defaults(self):
48434860
ctx.keylog_filename = 1
48444861

48454862
@requires_keylog
4846-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48474863
def test_keylog_filename(self):
48484864
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48494865
client_context, server_context, hostname = testing_context()
48504866

4851-
client_context.keylog_filename = os_helper.TESTFN
4867+
try:
4868+
client_context.keylog_filename = os_helper.TESTFN
4869+
except RuntimeError:
4870+
if Py_DEBUG_WIN32:
4871+
self.skipTest("not supported on Win32 debug build")
4872+
raise
4873+
48524874
server = ThreadedEchoServer(context=server_context, chatty=False)
48534875
with server:
48544876
with client_context.wrap_socket(socket.socket(),
@@ -4881,7 +4903,6 @@ def test_keylog_filename(self):
48814903
@requires_keylog
48824904
@unittest.skipIf(sys.flags.ignore_environment,
48834905
"test is not compatible with ignore_environment")
4884-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48854906
def test_keylog_env(self):
48864907
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48874908
with unittest.mock.patch.dict(os.environ):
@@ -4891,7 +4912,12 @@ def test_keylog_env(self):
48914912
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
48924913
self.assertEqual(ctx.keylog_filename, None)
48934914

4894-
ctx = ssl.create_default_context()
4915+
try:
4916+
ctx = ssl.create_default_context()
4917+
except RuntimeError:
4918+
if Py_DEBUG_WIN32:
4919+
self.skipTest("not supported on Win32 debug build")
4920+
raise
48954921
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
48964922

48974923
ctx = ssl._create_stdlib_context()

‎Modules/_ssl.c

+13
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,13 @@
7373
# error "OPENSSL_THREADS is not defined, Python requires thread-safe OpenSSL"
7474
#endif
7575

76+
#ifdef FORCE_ASSERTS
77+
#ifdef NDEBUG
78+
#undef NDEBUG
79+
#define _DEBUG
80+
#endif
81+
#include <assert.h>
82+
#endif /* FORCE_ASSERTS */
7683

7784

7885
struct py_ssl_error_code {
@@ -4427,6 +4434,12 @@ _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath)
44274434
FILE *f;
44284435
DH *dh;
44294436

4437+
#if defined(MS_WINDOWS) && defined(_DEBUG)
4438+
PyErr_SetString(PyExc_RuntimeError,
4439+
"unable to load_dh_params on Windows debug build");
4440+
return NULL;
4441+
#endif
4442+
44304443
f = Py_fopen(filepath, "rb");
44314444
if (f == NULL)
44324445
return NULL;

‎Modules/_ssl/debughelpers.c

+7
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,13 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
174174
{
175175
PySSLContext *self = PySSLContext_CAST(op);
176176
FILE *fp;
177+
178+
#if defined(MS_WINDOWS) && defined(_DEBUG)
179+
PyErr_SetString(PyExc_RuntimeError,
180+
"unable to set_keylog_filename on Windows debug build");
181+
return -1;
182+
#endif
183+
177184
/* Reset variables and callback first */
178185
SSL_CTX_set_keylog_callback(self->ctx, NULL);
179186
Py_CLEAR(self->keylog_filename);

‎PCbuild/_ssl.vcxproj

-3
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,6 @@
9999
</ItemDefinitionGroup>
100100
<ItemGroup>
101101
<ClCompile Include="..\Modules\_ssl.c" />
102-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
103-
<PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;$(PreprocessorDefinitions)</PreprocessorDefinitions>
104-
</ClCompile>
105102
</ItemGroup>
106103
<ItemGroup>
107104
<ResourceCompile Include="..\PC\python_nt.rc" />

‎PCbuild/_ssl.vcxproj.filters

-3
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@
1212
<ClCompile Include="..\Modules\_ssl.c">
1313
<Filter>Source Files</Filter>
1414
</ClCompile>
15-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
16-
<Filter>Source Files</Filter>
17-
</ClCompile>
1815
</ItemGroup>
1916
<ItemGroup>
2017
<ResourceCompile Include="..\PC\python_nt.rc">

‎PCbuild/get_externals.bat

+2-2
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ echo.Fetching external libraries...
5353
set libraries=
5454
set libraries=%libraries% bzip2-1.0.8
5555
if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.4.4
56-
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.15
56+
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.16
5757
set libraries=%libraries% mpdecimal-4.0.0
5858
set libraries=%libraries% sqlite-3.45.3.0
5959
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.15.0
@@ -77,7 +77,7 @@ echo.Fetching external binaries...
7777

7878
set binaries=
7979
if NOT "%IncludeLibffi%"=="false" set binaries=%binaries% libffi-3.4.4
80-
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.15
80+
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.16.1
8181
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.15.0
8282
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06
8383

‎PCbuild/openssl.vcxproj

+1-25
Original file line numberDiff line numberDiff line change
@@ -67,47 +67,23 @@
6767
set VCINSTALLDIR=$(VCInstallDir)
6868
if not exist "$(IntDir.TrimEnd('\'))" mkdir "$(IntDir.TrimEnd('\'))"
6969
cd /D "$(IntDir.TrimEnd('\'))"
70-
$(Perl) "$(opensslDir)\configure" $(OpenSSLPlatform) no-asm
70+
$(Perl) "$(opensslDir)\configure" $(OpenSSLPlatform) no-asm no-uplink
7171
nmake
7272
</NMakeBuildCommandLine>
7373
</PropertyGroup>
7474

7575
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
7676

77-
<Target Name="_PatchUplink" BeforeTargets="Build">
78-
<PropertyGroup>
79-
<Uplink>$(opensslDir)\ms\uplink.c</Uplink>
80-
<BeforePatch>((h = GetModuleHandle(NULL)) == NULL)</BeforePatch>
81-
<AfterPatch>((h = GetModuleHandleA("_ssl.pyd")) == NULL) if ((h = GetModuleHandleA("_ssl_d.pyd")) == NULL) if ((h = GetModuleHandle(NULL)) == NULL /*patched*/)</AfterPatch>
82-
</PropertyGroup>
83-
<Error Text="Cannot find $(Uplink)" Condition="!Exists($(Uplink))" />
84-
<PropertyGroup>
85-
<_Original>$([System.IO.File]::ReadAllText($(Uplink)))</_Original>
86-
<_Patched>$(_Original.Replace($(BeforePatch), $(AfterPatch)))</_Patched>
87-
<IsPatched>false</IsPatched>
88-
<IsPatched Condition="$(_Patched) == $(_Original)">true</IsPatched>
89-
</PropertyGroup>
90-
<Message Text="$(Uplink) is already patched" Importance="normal" Condition="$(IsPatched)" />
91-
<Message Text="Patching $(Uplink)" Importance="high" Condition="!$(IsPatched)" />
92-
<WriteLinesToFile File="$(Uplink)"
93-
Lines="$(_Patched)"
94-
Overwrite="true"
95-
Encoding="ASCII"
96-
Condition="!$(IsPatched)" />
97-
</Target>
98-
9977
<Target Name="_CopyToOutput" AfterTargets="Build">
10078
<ItemGroup>
10179
<_Built Include="$(opensslDir)\LICENSE" />
10280
<_Built Include="$(IntDir)\libcrypto.lib;$(IntDir)\libcrypto-*.dll;$(IntDir)\libcrypto-*.pdb" />
10381
<_Built Include="$(IntDir)\libssl.lib;$(IntDir)\libssl-*.dll;$(IntDir)\libssl-*.pdb" />
104-
<_AppLink Include="$(opensslDir)\ms\applink.c" />
10582
<_Include Include="$(opensslDir)\Include\openssl\*.h" />
10683
<_Include Include="$(IntDir)\include\openssl\*.h" />
10784
</ItemGroup>
10885
<MakeDir Directories="$(opensslOutDir)\include\openssl" />
10986
<Copy SourceFiles="@(_Built)" DestinationFolder="$(opensslOutDir)" />
110-
<Copy SourceFiles="@(_AppLink)" DestinationFolder="$(opensslOutDir)\include" />
11187
<Copy SourceFiles="@(_Include)" DestinationFolder="$(opensslOutDir)\include\openssl" />
11288
</Target>
11389

0 commit comments

Comments
 (0)