8000 Raise SSLCertVerificationError even if the error is set via SSL_ERROR… · openSUSE-Python/cpython@51e7cd8 · GitHub
[go: up one dir, main page]
Skip to content

Commit 51e7cd8

Browse files
pablogsalYhg1s
authored and
mcepl
committed
Raise SSLCertVerificationError even if the error is set via SSL_ERROR_SYSCALL
Seems that in some conditions, OpenSSL will return set ``SSL_ERROR_SYSCALL`` instead of ``SSL_ERROR_SSL`` when a certification verification has failed, but the error parameters will still contain ``ERR_LIB_SSL`` and ``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and raising the appropiate ``ssl.SSLCertVerificationError``. Co-authored-by: T. Wouters <thomas@python.org> Fixes: gh#python#107077 From-PR: gh#python/cpython!107586 Patch: openssl-300-raise-SSLCertVerificationError.patch Released-in: 3.8.19
1 parent 4964d59 commit 51e7cd8

File tree

2 files changed

+10
-0
lines changed

2 files changed

+10
-0
lines changed

‎Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
Seems that in some conditions, OpenSSL will return ``SSL_ERROR_SYSCALL``
2+
instead of ``SSL_ERROR_SSL`` when a certification verification has failed,
3+
but the error parameters will still contain ``ERR_LIB_SSL`` and
4+
``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and
5+
raising the appropiate ``ssl.SSLCertVerificationError``. Patch by Pablo
6+
Galindo

‎Modules/_ssl.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -621,6 +621,10 @@ PySSL_SetError(PySSLSocket *obj, int ret, const char *filename, int lineno)
621621
errstr = "Some I/O error occurred";
622622
}
623623
} else {
624+
if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
625+
ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
626+
type = state->PySSLCertVerificationErrorObject;
627+
}
624628
p = PY_SSL_ERROR_SYSCALL;
625629
}
626630
break;

0 commit comments

Comments
 (0)
0