8000 bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190) (GH-17500) · openSUSE-Python/cpython@e3b7f80 · GitHub
[go: up one dir, main page]
Skip to content
8000

Commit e3b7f80

Browse files
miss-islingtonmcepl
miss-islington
authored and
mcepl
committed
bpo-38820: OpenSSL 3.0.0 compatibility. (pythonGH-17190) (pythonGH-17500)
test_openssl_version now accepts version 3.0.0. getpeercert() no longer returns IPv6 addresses with a trailing new line. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38820 (cherry picked from commit 2b7de66) Co-authored-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38820 Automerge-Triggered-By: @tiran
1 parent 7b5f2a6 commit e3b7f80

File tree

4 files changed

+59
-7
lines changed

4 files changed

+59
-7
lines changed

‎Doc/library/ssl.rst

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1143,6 +1143,9 @@ SSL sockets also have the following additional methods and attributes:
11431143
The returned dictionary includes additional X509v3 extension items
11441144
such as ``crlDistributionPoints``, ``caIssuers`` and ``OCSP`` URIs.
11451145

1146+
.. versionchanged:: 3.6.15-27
1147+
IPv6 address strings no longer have a trailing new line.
1148+
11461149
.. method:: SSLSocket.cipher()
11471150

11481151
Returns a three-value tuple containing the name of the cipher being used, the

‎Lib/test/test_ssl.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -367,7 +367,7 @@ def test_parse_cert_CVE_2013_4238(self):
367367
('email', 'null@python.org\x00user@example.org'),
368368
('URI', 'http://null.python.org\x00http://example.org'),
369369
('IP Address', '192.0.2.1'),
370-
('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
370+
('IP Address', '2001:DB8:0:0:0:0:0:1'))
371371
else:
372372
# OpenSSL 0.9.7 doesn't support IPv6 addresses in subjectAltName
373373
san = (('DNS', 'altnull.python.org\x00example.com'),
@@ -394,7 +394,7 @@ def test_parse_all_sans(self):
394394
(('commonName', 'dirname example'),))),
395395
('URI', 'https://www.python.org/'),
396396
('IP Address', '127.0.0.1'),
397-
('IP Address', '0:0:0:0:0:0:0:1\n'),
397+
('IP Address', '0:0:0:0:0:0:0:1'),
398398
('Registered ID', '1.2.3.4.5')
399399
)
400400
)
@@ -421,11 +421,11 @@ def test_openssl_version(self):
421421
# Some sanity checks follow
422422
# >= 0.9
423423
self.assertGreaterEqual(n, 0x900000)
424-
# < 3.0
425-
self.assertLess(n, 0x30000000)
424+
# < 4.0
425+
self.assertLess(n, 0x40000000)
426426
major, minor, fix, patch, status = t
427-
self.assertGreaterEqual(major, 0)
428-
self.assertLess(major, 3)
427+
self.assertGreaterEqual(major, 1)
428+
self.assertLess(major, 4)
429429
self.assertGreaterEqual(minor, 0)
430430
self.assertLess(minor, 256)
431431
self.assertGreaterEqual(fix, 0)

‎Misc/NEWS.d/next/Library/2019-11-16-16-09-07.bpo-38820.ivhUSV.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Make Python compatible with OpenSSL 3.0.0. :func:`ssl.SSLSocket.getpeercert`
2+
no longer returns IPv6 addresses with a trailing new line.

‎Modules/_ssl.c

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1204,14 +1204,61 @@ _get_peer_alt_names (X509 *certificate) {
12041204
PyTuple_SET_ITEM(t, 1, v);
12051205
break;
12061206

1207+
case GEN_IPADD:
1208+
/* OpenSSL < 3.0.0 adds a trailing \n to IPv6. 3.0.0 removed
1209+
* the trailing newline. Remove it in all versions
1210+
*/
1211+
t = PyTuple_New(2);
1212+
if (t == NULL)
1213+
goto fail;
1214+
1215+
v = PyUnicode_FromString("IP Address");
1216+
if (v == NULL) {
1217+
Py_DECREF(t);
1218+
goto fail;
1219+
}
1220+
PyTuple_SET_ITEM(t, 0, v);
1221+
1222+
if (name->d.ip->length == 4) {
1223+
unsigned char *p = name->d.ip->data;
1224+
v = PyUnicode_FromFormat(
1225+
"%d.%d.%d.%d",
1226+
p[0], p[1], p[2], p[3]
1227+
);
1228+
} else if (name->d.ip->length == 16) {
1229+
/* PyUnicode_FromFormat() does not support %X */
1230+
unsigned char *p = name->d.ip->data;
1231+
len = sprintf(
1232+
buf,
1233+
"%X:%X:%X:%X:%X:%X:%X:%X",
1234+
p[0] << 8 | p[1],
1235+
p[2] << 8 | p[3],
1236+
p[4] << 8 | p[5],
1237+
p[6] << 8 | p[7],
1238+
p[8] << 8 | p[9],
1239+
p[10] << 8 | p[11],
1240+
p[12] << 8 | p[13],
1241+
p[14] << 8 | p[15]
1242+
);
1243+
v = PyUnicode_FromStringAndSize(buf, len);
1244+
} else {
1245+
v = PyUnicode_FromString("<invalid>");
1246+
}
1247+
1248+
if (v == NULL) {
1249+
Py_DECREF(t);
1250+
goto fail;
1251+
}
1252+
PyTuple_SET_ITEM(t, 1, v);
1253+
break;
1254+
12071255
default:
12081256
/* for everything else, we use the OpenSSL print form */
12091257
switch (gntype) {
12101258
/* check for new general name type */
12111259
case GEN_OTHERNAME:
12121260
case GEN_X400:
12131261
case GEN_EDIPARTY:
1214-
case GEN_IPADD:
12151262
case GEN_RID:
12161263
break;
12171264
default:

0 commit comments

Comments
 (0)
0