8000 bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190) · python/cpython@2b7de66 · GitHub
[go: up one dir, main page]
Skip to content

Commit 2b7de66

Browse files
tiranmiss-islington
tiran
authored and
miss-islington
committed
bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190)
test_openssl_version now accepts version 3.0.0. getpeercert() no longer returns IPv6 addresses with a trailing new line. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38820
1 parent 15fb7fa commit 2b7de66

File tree

4 files changed

+59
-7
lines changed

4 files changed

+59
-7
lines changed

‎Doc/library/ssl.rst

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1256,6 +1256,9 @@ SSL sockets also have the following additional methods and attributes:
12561256
The returned dictionary includes additional X509v3 extension items
12571257
such as ``crlDistributionPoints``, ``caIssuers`` and ``OCSP`` URIs.
12581258

1259+
.. versionchanged:: 3.9
1260+
IPv6 address strings no longer have a trailing new line.
1261+
12591262
.. method:: SSLSocket.cipher()
12601263

12611264
Returns a three-value tuple containing the name of the cipher being used, the

‎Lib/test/test_ssl.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -488,7 +488,7 @@ def test_parse_cert_CVE_2013_4238(self):
488488
('email', 'null@python.org\x00user@example.org'),
489489
('URI', 'http://null.python.org\x00http://example.org'),
490490
('IP Address', '192.0.2.1'),
491-
('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
491+
('IP Address', '2001:DB8:0:0:0:0:0:1'))
492492
else:
493493
# OpenSSL 0.9.7 doesn't support IPv6 addresses in subjectAltName
494494
san = (('DNS', 'altnull.python.org\x00example.com'),
@@ -515,7 +515,7 @@ def test_parse_all_sans(self):
515515
(('commonName', 'dirname example'),))),
516516
('URI', 'https://www.python.org/'),
517517
('IP Address', '127.0.0.1'),
518-
('IP Address', '0:0:0:0:0:0:0:1\n'),
518+
('IP Address', '0:0:0:0:0:0:0:1'),
519519
('Registered ID', '1.2.3.4.5')
520520
)
521521
)
@@ -542,11 +542,11 @@ def test_openssl_version(self):
542542
# Some sanity checks follow
543543
# >= 0.9
544544
self.assertGreaterEqual(n, 0x900000)
545-
# < 3.0
546-
self.assertLess(n, 0x30000000)
545+
# < 4.0
546+
self.assertLess(n, 0x40000000)
547547
major, minor, fix, patch, status = t
548-
self.assertGreaterEqual(major, 0)
549-
self.assertLess(major, 3)
548+
self.assertGreaterEqual(major, 1)
549+
self.assertLess(major, 4)
550550
self.assertGreaterEqual(minor, 0)
551551
self.assertLess(minor, 256)
552552
self.assertGreaterEqual(fix, 0)

‎Misc/NEWS.d/next/Library/2019-11-16-16-09-07.bpo-38820.ivhUSV.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Make Python compatible with OpenSSL 3.0.0. :func:`ssl.SSLSocket.getpeercert`
2+
no longer returns IPv6 addresses with a trailing new line.

‎Modules/_ssl.c

Lines changed: 48 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1410,14 +1410,61 @@ _get_peer_alt_names (X509 *certificate) {
14101410
PyTuple_SET_ITEM(t, 1, v);
14111411
break;
14121412

1413+
case GEN_IPADD:
1414+
/* OpenSSL < 3.0.0 adds a trailing \n to IPv6. 3.0.0 removed
1415+
* the trailing newline. Remove it in all versions
1416+
*/
1417+
t = PyTuple_New(2);
1418+
if (t == NULL)
1419+
goto fail;
1420+
1421+
v = PyUnicode_FromString("IP Address");
1422+
if (v == NULL) {
1423+
Py_DECREF(t);
1424+
goto fail;
1425+
}
1426+
PyTuple_SET_ITEM(t, 0, v);
1427+
1428+
if (name->d.ip->length == 4) {
1429+
unsigned char *p = name->d.ip->data;
1430+
v = PyUnicode_FromFormat(
1431+
"%d.%d.%d.%d",
1432+
p[0], p[1], p[2], p[3]
1433+
);
1434+
} else if (name->d.ip->length == 16) {
1435+
/* PyUnicode_FromFormat() does not support %X */
1436+
unsigned char *p = name->d.ip->data;
1437+
len = sprintf(
1438+
buf,
1439+
"%X:%X:%X:%X:%X:%X:%X:%X",
1440+
p[0] << 8 | p[1],
1441+
p[2] << 8 | p[3],
1442+
p[4] << 8 | p[5],
1443+
p[6] << 8 | p[7],
1444+
p[8] << 8 | p[9],
1445+
p[10] << 8 | p[11],
1446+
p[12] << 8 | p[13],
1447+
p[14] << 8 | p[15]
1448+
);
1449+
v = PyUnicode_FromStringAndSize(buf, len);
1450+
} else {
1451+
v = PyUnicode_FromString("<invalid>");
1452+
}
1453+
1454+
if (v == NULL) {
1455+
Py_DECREF(t);
1456+
goto fail;
1457+
}
1458+
PyTuple_SET_ITEM(t, 1, v);
1459+
break;
1460+
14131461
default:
14141462
/* for everything else, we use the OpenSSL print form */
14151463
switch (gntype) {
14161464
/* check for new general name type */
14171465
case GEN_OTHERNAME:
14181466
case GEN_X400:
14191467
case GEN_EDIPARTY:
1420-
case GEN_IPADD:
14211468
case GEN_RID:
14221469
break;
14231470
default:

0 commit comments

Comments
 (0)
0