8000 [3.8] bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190) (GH-17499) · python/cpython@9d3cacd · GitHub
[go: up one dir, main page]
Skip to content

Commit 9d3cacd

Browse files
miss-islingtonmiss-islington
authored
[3.8] bpo-38820: OpenSSL 3.0.0 compatibility. (GH-17190) (GH-17499)
test_openssl_version now accepts version 3.0.0. getpeercert() no longer returns IPv6 addresses with a trailing new line. Signed-off-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38820 (cherry picked from commit 2b7de66) Co-authored-by: Christian Heimes <christian@python.org> https://bugs.python.org/issue38820 Automerge-Triggered-By: @tiran
1 parent 930cef2 commit 9d3cacd

File tree

4 files changed

+59
-7
lines changed

4 files changed

+59
-7
lines changed

‎Doc/library/ssl.rst

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1256,6 +1256,9 @@ SSL sockets also have the following additional methods and attributes:
12561256
The returned dictionary includes additional X509v3 extension items
12571257
such as ``crlDistributionPoints``, ``caIssuers`` and ``OCSP`` URIs.
12581258

1259+
.. versionchanged:: 3.8.1
1260+
IPv6 address strings no longer have a trailing new line.
1261+
12591262
.. method:: SSLSocket.cipher()
12601263

12611264
Returns a three-value tuple containing the name of the cipher being used, the

‎Lib/test/test_ssl.py

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -485,7 +485,7 @@ def test_parse_cert_CVE_2013_4238(self):
485485
('email', 'null@python.org\x00user@example.org'),
486486
('URI', 'http://null.python.org\x00http://example.org'),
487487
('IP Address', '192.0.2.1'),
488-
('IP Address', '2001:DB8:0:0:0:0:0:1\n'))
488+
('IP Address', '2001:DB8:0:0:0:0:0:1'))
489489
else:
490490
# OpenSSL 0.9.7 doesn't support IPv6 addresses in subjectAltName
491491
san = (('DNS', 'altnull.python.org\x00example.com'),
@@ -512,7 +512,7 @@ def test_parse_all_sans(self):
512512
(('commonName', 'dirname example'),))),
513513
('URI', 'https://www.python.org/'),
514514
('IP Address', '127.0.0.1'),
515-
('IP Address', '0:0:0:0:0:0:0:1\n'),
515+
('IP Address', '0:0:0:0:0:0:0:1'),
516516
('Registered ID', '1.2.3.4.5')
517517
)
518518
)
@@ -539,11 +539,11 @@ def test_openssl_version(self):
539539
# Some sanity checks follow
540540
# >= 0.9
541541
self.assertGreaterEqual(n, 0x900000)
542-
# < 3.0
543-
self.assertLess(n, 0x30000000)
542+
# < 4.0
543+
self.assertLess(n, 0x40000000)
544544
major, minor, fix, patch, status = t
545-
self.assertGreaterEqual(major, 0)
546-
self.assertLess(major, 3)
545+
self.assertGreaterEqual(major, 1)
546+
self.assertLess(major, 4)
547547
self.assertGreaterEqual(minor, 0)
548548
self.assertLess(minor, 256)
549549
self.assertGreaterEqual(fix, 0)

‎Misc/NEWS.d/next/Library/2019-11-16-16-09-07.bpo-38820.ivhUSV.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Make Python compatible with OpenSSL 3.0.0. :func:`ssl.SSLSocket.getpeercert`
2+
no longer returns IPv6 addresses with a trailing new line.

‎Modules/_ssl.c

Lines changed: 48 additions & 1 deletion
+
Py_DECREF(t);
Original file line numberDiff line numberDiff line change
@@ -1410,14 +1410,61 @@ _get_peer_alt_names (X509 *certificate) {
14101410
PyTuple_SET_ITEM(t, 1, v);
14111411
break;
14121412

1413+
case GEN_IPADD:
1414+
/* OpenSSL < 3.0.0 adds a trailing \n to IPv6. 3.0.0 removed
1415+
* the trailing newline. Remove it in all versions
1416+
*/
1417+
t = PyTuple_New(2);
1418+
if (t == NULL)
1419+
goto fail;
1420+
1421+
v = PyUnicode_FromString("IP Address");
1422+
if (v == NULL) {
1423+
Py_DECREF(t);
1424+
goto fail;
1425+
}
1426+
PyTuple_SET_ITEM(t, 0, v);
1427+
1428+
if (name->d.ip->length == 4) {
1429+
unsigned char *p = name->d.ip->data;
1430+
v = PyUnicode_FromFormat(
1431+
"%d.%d.%d.%d",
1432+
p[0], p[1], p[2], p[3]
1433+
);
1434+
} else if (name->d.ip->length == 16) {
1435+
/* PyUnicode_FromFormat() does not support %X */
1436+
unsigned char *p = name->d.ip->data;
1437+
len = sprintf(
1438+
buf,
1439+
"%X:%X:%X:%X:%X:%X:%X:%X",
1440+
p[0] << 8 | p[1],
1441+
p[2] << 8 | p[3],
1442+
p[4] << 8 | p[5],
1443+
p[6] << 8 | p[7],
1444+
p[8] << 8 | p[9],
1445+
p[10] << 8 | p[11],
1446+
p[12] << 8 | p[13],
1447+
p[14] << 8 | p[15]
1448+
);
1449+
v = PyUnicode_FromStringAndSize(buf, len);
1450+
} else {
1451+
v = PyUnicode_FromString("<invalid>");
1452+
}
1453+
1454+
if (v == NULL) {
1455
1456+
goto fail;
1457+
}
1458+
PyTuple_SET_ITEM(t, 1, v);
1459+
break;
1460+
14131461
default:
14141462
/* for everything else, we use the OpenSSL print form */
14151463
switch (gntype) {
14161464
/* check for new general name type */
14171465
case GEN_OTHERNAME:
14181466
case GEN_X400:
14191467
case GEN_EDIPARTY:
1420-
case GEN_IPADD:
14211468
case GEN_RID:
14221469
break;
14231470
default:

0 commit comments

Comments
 (0)
0