8000 [3.12] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-… · python/cpython@25543ae · GitHub
[go: up one dir, main page]
Skip to content

Commit 25543ae

Browse files
miss-islingtongpshead
miss-islington
and
gpshead
authored
[3.12] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (#105199)
gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header. (cherry picked from commit ede89af) Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>
1 parent 6375287 commit 25543ae

File tree

13 files changed

+8794
-18
lines changed

13 files changed

+8794
-18
lines changed

‎.azure-pipelines/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
variables:
5858
testRunTitle: '$(build.sourceBranchName)-linux'
5959
testRunPlatform: linux
60-
openssl_version: 1.1.1t
60+
openssl_version: 1.1.1u
6161

6262
steps:
6363
- template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
8383
variables:
8484
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
8585
testRunPlatform: linux-coverage
86-
openssl_version: 1.1.1t
86+
openssl_version: 1.1.1u
8787

8888
steps:
8989
- template: ./posix-steps.yml

‎.azure-pipelines/pr.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
variables:
5858
testRunTitle: '$(system.pullRequest.TargetBranch)-linux'
5959
testRunPlatform: linux
60-
openssl_version: 1.1.1t
60+
openssl_version: 1.1.1u
6161

6262
steps:
6363
- template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
8383
variables:
8484
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
8585
testRunPlatform: linux-coverage
86-
openssl_version: 1.1.1t
86+
openssl_version: 1.1.1u
8787

8888
steps:
8989
- template: ./posix-steps.yml

‎.github/workflows/build.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ jobs:
264264
needs: check_source
265265
if: needs.check_source.outputs.run_tests == 'true'
266266
env:
267-
OPENSSL_VER: 1.1.1t
267+
OPENSSL_VER: 1.1.1u
268268
PYTHONSTRICTEXTENSIONBUILD: 1
269269
steps:
270270
- uses: actions/checkout@v3
@@ -333,7 +333,7 @@ jobs:
333333
strategy:
334334
fail-fast: false
335335
matrix:
336-
openssl_ver: [1.1.1t, 3.0.8, 3.1.0-beta1]
336+
openssl_ver: [1.1.1u, 3.0.9, 3.1.1]
337337
env:
338338
OPENSSL_VER: ${{ matrix.openssl_ver }}
339339
MULTISSL_DIR: ${{ github.workspace }}/multissl
@@ -385,7 +385,7 @@ jobs:
385385
needs: check_source
386386
if: needs.check_source.outputs.run_tests == 'true' && needs.check_source.outputs.run_hypothesis == 'true'
387387
env:
388-
OPENSSL_VER: 1.1.1t
388+
OPENSSL_VER: 1.1.1u
389389
PYTHONSTRICTEXTENSIONBUILD: 1
390390
steps:
391391
- uses: actions/checkout@v3
@@ -494,7 +494,7 @@ jobs:
494494
needs: check_source
495495
if: needs.check_source.outputs.run_tests == 'true'
496496
env:
497-
OPENSSL_VER: 1.1.1t
497+
OPENSSL_VER: 1.1.1u
498498
PYTHONSTRICTEXTENSIONBUILD: 1
499499
ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
500500
steps:

‎Misc/NEWS.d/next/Security/2023-06-01-03-24-58.gh-issue-103142.GLWDMX.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
The version of OpenSSL used in our binary builds has been upgraded to 1.1.1u
2+
to address several CVEs.

‎Modules/_ssl.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,9 @@ static void _PySSLFixErrno(void) {
116116
#endif
117117

118118
/* Include generated data (error codes) */
119-
#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
119+
#if (OPENSSL_VERSION_NUMBER >= 0x30100000L)
120+
#include "_ssl_data_31.h"
121+
#elif (OPENSSL_VERSION_NUMBER >= 0x30000000L)
120122
#include "_ssl_data_300.h"
121123
#elif (OPENSSL_VERSION_NUMBER >= 0x10101000L) && !defined(LIBRESSL_VERSION_NUMBER)
122124
#include "_ssl_data_111.h"

‎Modules/_ssl_data_111.h

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2021-04-09T09:36:21.493286 */
1+
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2023-06-01T02:58:04.081473 */
22
static struct py_ssl_library_code library_codes[] = {
33
#ifdef ERR_LIB_ASN1
44
{"ASN1", ERR_LIB_ASN1},
@@ -1375,6 +1375,11 @@ static struct py_ssl_error_code error_codes[] = {
13751375
#else
13761376
{"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151},
13771377
#endif
1378+
#ifdef CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM
1379+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM},
1380+
#else
1381+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", 46, 194},
1382+
#endif
13781383
#ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE
13791384
{"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE},
13801385
#else
@@ -4860,6 +4865,11 @@ static struct py_ssl_error_code error_codes[] = {
48604865
#else
48614866
{"MISSING_PARAMETERS", 20, 290},
48624867
#endif
4868+
#ifdef SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
4869+
{"MISSING_PSK_KEX_MODES_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION},
4870+
#else
4871+
{"MISSING_PSK_KEX_MODES_EXTENSION", 20, 310},
4872+
#endif
48634873
#ifdef SSL_R_MISSING_RSA_CERTIFICATE
48644874
{"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE},
48654875
#else
@@ -5065,6 +5075,11 @@ static struct py_ssl_error_code error_codes[] = {
50655075
#else
50665076
{"NULL_SSL_METHOD_PASSED", 20, 196},
50675077
#endif
5078+
#ifdef SSL_R_OCSP_CALLBACK_FAILURE
5079+
{"OCSP_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_OCSP_CALLBACK_FAILURE},
5080+
#else
5081+
{"OCSP_CALLBACK_FAILURE", 20, 294},
5082+
#endif
50685083
#ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED
50695084
{"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED},
50705085
#else

0 commit comments

Comments
 (0)
0