Skip to content

Commit d7b6e66

Browse files
vstinnerpicnixz
authored and
miss-islington
committed
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (pythonGH-146217)
OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. (cherry picked from commit 3364e7e) Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
1 parent 5a4959b commit d7b6e66

4 files changed

Lines changed: 58 additions & 31 deletions

File tree

‎Lib/test/test_ssl.py‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -357,7 +357,7 @@ def test_constants(self):
357357
ssl.OP_NO_COMPRESSION
358358
self.assertEqual(ssl.HAS_SNI, True)
359359
self.assertEqual(ssl.HAS_ECDH, True)
360-
self.assertEqual(ssl.HAS_TLSv1_2, True)
360+
self.assertIsInstance(ssl.HAS_TLSv1_2, bool)
361361
self.assertEqual(ssl.HAS_TLSv1_3, True)
362362
ssl.OP_NO_SSLv2
363363
ssl.OP_NO_SSLv3
@@ -547,11 +547,11 @@ def test_openssl_version(self):
547547
# Some sanity checks follow
548548
# >= 1.1.1
549549
self.assertGreaterEqual(n, 0x10101000)
550-
# < 4.0
551-
self.assertLess(n, 0x40000000)
550+
# < 5.0
551+
self.assertLess(n, 0x50000000)
552552
major, minor, fix, patch, status = t
553553
self.assertGreaterEqual(major, 1)
554-
self.assertLess(major, 4)
554+
self.assertLess(major, 5)
555555
self.assertGreaterEqual(minor, 0)
556556
self.assertLess(minor, 256)
557557
self.assertGreaterEqual(fix, 0)
@@ -617,12 +617,14 @@ def test_openssl111_deprecations(self):
617617
ssl.OP_NO_TLSv1_2,
618618
ssl.OP_NO_TLSv1_3
619619
]
620-
protocols = [
621-
ssl.PROTOCOL_TLSv1,
622-
ssl.PROTOCOL_TLSv1_1,
623-
ssl.PROTOCOL_TLSv1_2,
624-
ssl.PROTOCOL_TLS
625-
]
620+
protocols = []
621+
if hasattr(ssl, 'PROTOCOL_TLSv1'):
622+
protocols.append(ssl.PROTOCOL_TLSv1)
623+
if hasattr(ssl, 'PROTOCOL_TLSv1_1'):
624+
protocols.append(ssl.PROTOCOL_TLSv1_1)
625+
if hasattr(ssl, 'PROTOCOL_TLSv1_2'):
626+
protocols.append(ssl.PROTOCOL_TLSv1_2)
627+
protocols.append(ssl.PROTOCOL_TLS)
626628
versions = [
627629
ssl.TLSVersion.SSLv3,
628630
ssl.TLSVersion.TLSv1,
@@ -1116,6 +1118,7 @@ def test_min_max_version(self):
11161118
ssl.TLSVersion.TLSv1,
11171119
ssl.TLSVersion.TLSv1_1,
11181120
ssl.TLSVersion.TLSv1_2,
1121+
ssl.TLSVersion.TLSv1_3,
11191122
ssl.TLSVersion.SSLv3,
11201123
}
11211124
)
@@ -1129,7 +1132,7 @@ def test_min_max_version(self):
11291132
with self.assertRaises(ValueError):
11301133
ctx.minimum_version = 42
11311134

1132-
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
1135+
if has_tls_protocol('PROTOCOL_TLSv1_1'):
11331136
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1)
11341137

11351138
self.assertIn(
@@ -1582,23 +1585,24 @@ def test__create_stdlib_context(self):
15821585
self.assertFalse(ctx.check_hostname)
15831586
self._assert_context_options(ctx)
15841587

1585-
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
1588+
if has_tls_protocol('PROTOCOL_TLSv1'):
15861589
with warnings_helper.check_warnings():
15871590
ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1)
15881591
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
15891592
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
15901593
self._assert_context_options(ctx)
15911594

1592-
with warnings_helper.check_warnings():
1593-
ctx = ssl._create_stdlib_context(
1594-
ssl.PROTOCOL_TLSv1_2,
1595-
cert_reqs=ssl.CERT_REQUIRED,
1596-
check_hostname=True
1597-
)
1598-
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1599-
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1600-
self.assertTrue(ctx.check_hostname)
1601-
self._assert_context_options(ctx)
1595+
if has_tls_protocol('PROTOCOL_TLSv1_2'):
1596+
with warnings_helper.check_warnings():
1597+
ctx = ssl._create_stdlib_context(
1598+
ssl.PROTOCOL_TLSv1_2,
1599+
cert_reqs=ssl.CERT_REQUIRED,
1600+
check_hostname=True
1601+
)
1602+
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1603+
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1604+
self.assertTrue(ctx.check_hostname)
1605+
self._assert_context_options(ctx)
16021606

16031607
ctx = ssl._create_stdlib_context(purpose=ssl.Purpose.CLIENT_AUTH)
16041608
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_SERVER)
@@ -3460,10 +3464,10 @@ def test_protocol_tlsv1_2(self):
34603464
client_options=ssl.OP_NO_TLSv1_2)
34613465

34623466
try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2')
3463-
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
3467+
if has_tls_protocol('PROTOCOL_TLSv1'):
34643468
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False)
34653469
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False)
3466-
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
3470+
if has_tls_protocol('PROTOCOL_TLSv1_1'):
34673471
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
34683472
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False)
34693473

‎Modules/_ssl.c‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,17 @@ static void _PySSLFixErrno(void) {
130130
#error Unsupported OpenSSL version
131131
#endif
132132

133+
#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
134+
# define OPENSSL_NO_SSL3
135+
# define OPENSSL_NO_TLS1
136+
# define OPENSSL_NO_TLS1_1
137+
# define OPENSSL_NO_TLS1_2
138+
# define OPENSSL_NO_SSL3_METHOD
139+
# define OPENSSL_NO_TLS1_METHOD
140+
# define OPENSSL_NO_TLS1_1_METHOD
141+
# define OPENSSL_NO_TLS1_2_METHOD
142+
#endif
143+
133144
/* OpenSSL API 1.1.0+ does not include version methods */
134145
#ifndef OPENSSL_NO_SSL3_METHOD
135146
extern const SSL_METHOD *SSLv3_method(void);
@@ -1084,7 +1095,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name)
10841095

10851096
static PyObject *
10861097
_create_tuple_for_attribute(_sslmodulestate *state,
1087-
ASN1_OBJECT *name, ASN1_STRING *value)
1098+
const ASN1_OBJECT *name, const ASN1_STRING *value)
10881099
{
10891100
Py_ssize_t buflen;
10901101
PyObject *pyattr;
@@ -1113,16 +1124,16 @@ _create_tuple_for_attribute(_sslmodulestate *state,
11131124
}
11141125

11151126
static PyObject *
1116-
_create_tuple_for_X509_NAME (_sslmodulestate *state, X509_NAME *xname)
1127+
_create_tuple_for_X509_NAME(_sslmodulestate *state, const X509_NAME *xname)
11171128
{
11181129
PyObject *dn = NULL; /* tuple which represents the "distinguished name" */
11191130
PyObject *rdn = NULL; /* tuple to hold a "relative distinguished name" */
11201131
PyObject *rdnt;
11211132
PyObject *attr = NULL; /* tuple to hold an attribute */
11221133
int entry_count = X509_NAME_entry_count(xname);
1123-
X509_NAME_ENTRY *entry;
1124-
ASN1_OBJECT *name;
1125-
ASN1_STRING *value;
1134+
const X509_NAME_ENTRY *entry;
1135+
const ASN1_OBJECT *name;
1136+
const ASN1_STRING *value;
11261137
int index_counter;
11271138
int rdn_level = -1;
11281139
int retcode;
@@ -6430,9 +6441,15 @@ sslmodule_init_constants(PyObject *m)
64306441
ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
64316442
ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
64326443
ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
6444+
#ifndef OPENSSL_NO_TLS1
64336445
ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
6446+
#endif
6447+
#ifndef OPENSSL_NO_TLS1_1
64346448
ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
6449+
#endif
6450+
#ifndef OPENSSL_NO_TLS1_2
64356451
ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
6452+
#endif
64366453

64376454
#define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1
64386455

‎Modules/_ssl/cert.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,8 @@ _ssl_Certificate_get_info_impl(PySSLCertificate *self)
128128
}
129129

130130
static PyObject*
131-
_x509name_print(_sslmodulestate *state, X509_NAME *name, int indent, unsigned long flags)
131+
_x509name_print(_sslmodulestate *state, const X509_NAME *name,
132+
int indent, unsigned long flags)
132133
{
133134
PyObject *res;
134135
BIO *biobuf;

‎Tools/ssl/multissltests.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -415,9 +415,11 @@ class BuildOpenSSL(AbstractBuilder):
415415
def _post_install(self):
416416
if self.version.startswith("3."):
417417
self._post_install_3xx()
418+
elif self.version.startswith("4."):
419+
self._post_install_4xx()
418420

419421
def _build_src(self, config_args=()):
420-
if self.version.startswith("3."):
422+
if self.version.startswith(("3.", "4.")):
421423
config_args += ("enable-fips",)
422424
super()._build_src(config_args)
423425

@@ -433,6 +435,9 @@ def _post_install_3xx(self):
433435
lib64 = self.lib_dir + "64"
434436
os.symlink(lib64, self.lib_dir)
435437

438+
def _post_install_4xx(self):
439+
self._post_install_3xx()
440+
436441
@property
437442
def short_version(self):
438443
"""Short version for OpenSSL download URL"""

0 commit comments

Comments
 (0)