Raise SSLCertVerificationError even if the error is set via SSL_ERROR_SYSCALL

pablogsal · Yhg1s · mcepl · commit 763d57afb4e8 · 2024-04-12T00:42:12.000+02:00
Seems that in some conditions, OpenSSL will return set ``SSL_ERROR_SYSCALL`` instead of ``SSL_ERROR_SSL`` when a certification verification has failed, but the error parameters will still contain ``ERR_LIB_SSL`` and ``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and raising the appropiate ``ssl.SSLCertVerificationError``. Co-authored-by: T. Wouters <thomas@python.org> Fixes: gh#python#107077 From-PR: gh#python/cpython!107586 Patch: openssl-300-raise-SSLCertVerificationError.patch Released-in: 3.8.19
diff --git a/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst b/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst
@@ -0,0 +1,6 @@
+Seems that in some conditions, OpenSSL will return ``SSL_ERROR_SYSCALL``
+instead of ``SSL_ERROR_SSL`` when a certification verification has failed,
+but the error parameters will still contain ``ERR_LIB_SSL`` and
+``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and
+raising the appropiate ``ssl.SSLCertVerificationError``. Patch by Pablo
+Galindo
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
@@ -613,6 +613,10 @@ PySSL_SetError(PySSLSocket *obj, int ret, const char *filename, int lineno)
                     errstr = "Some I/O error occurred";
                 }
             } else {
+                if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
+                        ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
+                    type = state->PySSLCertVerificationErrorObject;
+                }
                 p = PY_SSL_ERROR_SYSCALL;
             }
             break;

Original file line number	Diff line number	Diff line change
`@@ -613,6 +613,10 @@ PySSL_SetError(PySSLSocket obj, int ret, const char filename, int lineno)`
`613`	`613`	`errstr = "Some I/O error occurred";`
`614`	`614`	`}`
`615`	`615`	`} else {`
	`616`	`+ if (ERR_GET_LIB(e) == ERR_LIB_SSL &&`
	`617`	`+ ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {`
	`618`	`+ type = state->PySSLCertVerificationErrorObject;`
	`619`	`+ }`
`616`	`620`	`p = PY_SSL_ERROR_SYSCALL;`
`617`	`621`	`}`
`618`	`622`	`break;`