8000 gh-131423: Update to OpenSSL 3.0.16. (GH-131839) · python/cpython@de8bc17 · GitHub
[go: up one dir, main page]
Skip to content

Commit de8bc17

Browse files
zoobazooba
authored
gh-131423: Update to OpenSSL 3.0.16. (GH-131839)
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix gh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
1 parent e460602 commit de8bc17

File tree

12 files changed

+74
-53
lines changed

12 files changed

+74
-53
lines changed

‎Lib/test/audit-tests.py

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,15 @@ def test_open(testfn):
208208
if not fn:
209209
continue
210210
with assertRaises(RuntimeError):
211-
fn(*args)
211+
try:
212+
fn(*args)
213+
except NotImplementedError:
214+
if fn == load_dh_params:
215+
# Not callable in some builds
216+
load_dh_params = None
217+
raise RuntimeError
218+
else:
219+
raise
212220

213221
actual_mode = [(a[0], a[1]) for e, a in hook.seen if e == "open" and a[1]]
214222
actual_flag = [(a[0], a[2]) for e, a in hook.seen if e == "open" and not a[1]]

‎Lib/test/test_audit.py

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ def run_test_in_subprocess(self, *args):
2323
with subprocess.Popen(
2424
[sys.executable, "-X utf8", AUDIT_TESTS_PY, *args],
2525
encoding="utf-8",
26+
errors="backslashreplace",
2627
stdout=subprocess.PIPE,
2728
stderr=subprocess.PIPE,
2829
) as p:

‎Lib/test/test_ssl.py

Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1348,10 +1348,14 @@ def test_load_verify_cadata(self):
13481348
with self.assertRaises(ssl.SSLError):
13491349
ctx.load_verify_locations(cadata=cacert_der + b"A")
13501350

1351-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
13521351
def test_load_dh_params(self):
13531352
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
1354-
ctx.load_dh_params(DHFILE)
1353+
try:
1354+
ctx.load_dh_params(DHFILE)
1355+
except RuntimeError:
1356+
if Py_DEBUG_WIN32:
1357+
self.skipTest("not supported on Win32 debug build")
1358+
raise
13551359
if os.name != 'nt':
13561360
ctx.load_dh_params(BYTES_DHFILE)
13571361
self.assertRaises(TypeError, ctx.load_dh_params)
@@ -1676,12 +1680,17 @@ def test_str(self):
16761680
self.assertEqual(str(e), "foo")
16771681
self.assertEqual(e.errno, 1)
16781682

1679-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
16801683
def test_lib_reason(self):
16811684
# Test the library and reason attributes
16821685
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
1683-
with self.assertRaises(ssl.SSLError) as cm:
1684-
ctx.load_dh_params(CERTFILE)
1686+
try:
1687+
with self.assertRaises(ssl.SSLError) as cm:
1688+
ctx.load_dh_params(CERTFILE)
1689+
except RuntimeError:
1690+
if Py_DEBUG_WIN32:
1691+
self.skipTest("not supported on Win32 debug build")
1692+
raise
1693+
16851694
self.assertEqual(cm.exception.library, 'PEM')
16861695
regex = "(NO_START_LINE|UNSUPPORTED_PUBLIC_KEY_TYPE)"
16871696
self.assertRegex(cm.exception.reason, regex)
@@ -4060,13 +4069,17 @@ def test_no_legacy_server_connect(self):
40604069
chatty=True, connectionchatty=True,
40614070
sni_name=hostname)
40624071

4063-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
40644072
def test_dh_params(self):
40654073
# Check we can get a connection with ephemeral Diffie-Hellman
40664074
client_context, server_context, hostname = testing_context()
40674075
# test scenario needs TLS <= 1.2
40684076
client_context.maximum_version = ssl.TLSVersion.TLSv1_2
4069-
server_context.load_dh_params(DHFILE)
4077+
try:
4078+
server_context.load_dh_params(DHFILE)
4079+
except RuntimeError:
4080+
if Py_DEBUG_WIN32:
4081+
self.skipTest("not supported on Win32 debug build")
4082+
raise
40704083
server_context.set_ciphers("kEDH")
40714084
server_context.maximum_version = ssl.TLSVersion.TLSv1_2
40724085
stats = server_params_test(client_context, server_context,
@@ -4846,14 +4859,18 @@ def keylog_lines(self, fname=os_helper.TESTFN):
48464859
return len(list(f))
48474860

48484861
@requires_keylog
4849-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48504862
def test_keylog_defaults(self):
48514863
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48524864
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
48534865
self.assertEqual(ctx.keylog_filename, None)
48544866

48554867
self.assertFalse(os.path.isfile(os_helper.TESTFN))
4856-
ctx.keylog_filename = os_helper.TESTFN
4868+
try:
4869+
ctx.keylog_filename = os_helper.TESTFN
4870+
except RuntimeError:
4871+
if Py_DEBUG_WIN32:
4872+
self.skipTest("not supported on Win32 debug build")
4873+
raise
48574874
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
48584875
self.assertTrue(os.path.isfile(os_helper.TESTFN))
48594876
self.assertEqual(self.keylog_lines(), 1)
@@ -4870,12 +4887,17 @@ def test_keylog_defaults(self):
48704887
ctx.keylog_filename = 1
48714888

48724889
@requires_keylog
4873-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48744890
def test_keylog_filename(self):
48754891
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48764892
client_context, server_context, hostname = testing_context()
48774893

4878-
client_context.keylog_filename = os_helper.TESTFN
4894+
try:
4895+
client_context.keylog_filename = os_helper.TESTFN
4896+
except RuntimeError:
4897+
if Py_DEBUG_WIN32:
4898+
self.skipTest("not supported on Win32 debug build")
4899+
raise
4900+
48794901
server = ThreadedEchoServer(context=server_context, chatty=False)
48804902
with server:
48814903
with client_context.wrap_socket(socket.socket(),
@@ -4908,7 +4930,6 @@ def test_keylog_filename(self):
49084930
@requires_keylog
49094931
@unittest.skipIf(sys.flags.ignore_environment,
49104932
"test is not compatible with ignore_environment")
4911-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
49124933
def test_keylog_env(self):
49134934
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
49144935
with unittest.mock.patch.dict(os.environ):
@@ -4918,7 +4939,12 @@ def test_keylog_env(self):
49184939
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
49194940
self.assertEqual(ctx.keylog_filename, None)
49204941

4921-
ctx = ssl.create_default_context()
4942+
try:
4943+
ctx = ssl.create_default_context()
4944+
except RuntimeError:
4945+
if Py_DEBUG_WIN32:
4946+
self.skipTest("not supported on Win32 debug build")
4947+
raise
49224948
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
49234949

49244950
ctx = ssl._create_stdlib_context()

‎Misc/NEWS.d/next/Windows/2025-03-28-13-22-55.gh-issue-131423.vI-LqV.rst

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Update bundled version of OpenSSL to 3.0.16. The new build also disables
2+
uplink support, which may be relevant to embedders but has no impact on
3+
normal use.

‎Misc/externals.spdx.json

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,21 +70,21 @@
7070
"checksums": [
7171
{
7272
"algorithm": "SHA256",
73-
"checksumValue": "1550c87996a0858474a9dd179deab2c55eb73726b9a140b32865b02fd3d8a86b"
73+
"checksumValue": "6bb739ecddbd2cfb6d255eb5898437a9b5739277dee931338d3275bac5d96ba2"
7474
}
7575
],
76-
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.15.tar.gz",
76+
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.16.tar.gz",
7777
"externalRefs": [
7878
{
7979
"referenceCategory": "SECURITY",
80-
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.15:*:*:*:*:*:*:*",
80+
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.16:*:*:*:*:*:*:*",
8181
"referenceType": "cpe23Type"
8282
}
8383
],
8484
"licenseConcluded": "NOASSERTION",
8585
"name": "openssl",
8686
"primaryPackagePurpose": "SOURCE",
87-
"versionInfo": "3.0.15"
87+
"versionInfo": "3.0.16"
8888
},
8989
{
9090
"SPDXID": "SPDXRef-PACKAGE-sqlite",

‎Modules/_ssl.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4370,6 +4370,12 @@ _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath)
43704370
FILE *f;
43714371
DH *dh;
43724372

4373+
#if defined(MS_WINDOWS) && defined(_DEBUG)
4374+
PyErr_SetString(PyExc_NotImplementedError,
4375+
"load_dh_params: unavailable on Windows debug build");
4376+
return NULL;
4377+
#endif
4378+
43734379
f = _Py_fopen_obj(filepath, "rb");
43744380
if (f == NULL)
43754381
return NULL;

‎Modules/_ssl/debughelpers.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,13 @@ _PySSLContext_get_keylog_filename(PySSLContext *self, void *c) {
164164
static int
165165
_PySSLContext_set_keylog_filename(PySSLContext *self, PyObject *arg, void *c) {
166166
FILE *fp;
167+
168+
#if defined(MS_WINDOWS) && defined(_DEBUG)
169+
PyErr_SetString(PyExc_NotImplementedError,
170+
"set_keylog_filename: unavailable on Windows debug build");
171+
return -1;
172+
#endif
173+
167174
/* Reset variables and callback first */
168175
SSL_CTX_set_keylog_callback(self->ctx, NULL);
169176
Py_CLEAR(self->keylog_filename);

‎PCbuild/_ssl.vcxproj

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,6 @@
9999
</ItemDefinitionGroup>
100100
<ItemGroup>
101101
<ClCompile Include="..\Modules\_ssl.c" />
102-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
103-
<PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;$(PreprocessorDefinitions)</PreprocessorDefinitions>
104-
</ClCompile>
105102
</ItemGroup>
106103
<ItemGroup>
107104
<ResourceCompile Include="..\PC\python_nt.rc" />

‎PCbuild/_ssl.vcxproj.filters

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@
1212
<ClCompile Include="..\Modules\_ssl.c">
1313
<Filter>Source Files</Filter>
1414
</ClCompile>
15-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
16-
<Filter>Source Files</Filter>
17-
</ClCompile>
1815
</ItemGroup>
1916
<ItemGroup>
2017
<ResourceCompile Include="..\PC\python_nt.rc">

‎PCbuild/get_externals.bat

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ echo.Fetching external libraries...
5353
set libraries=
5454
set libraries=%libraries% bzip2-1.0.8
5555
if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.4.4
56-
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.15
56+
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.16
5757
set libraries=%libraries% mpdecimal-4.0.0
5858
set libraries=%libraries% sqlite-3.45.3.0
5959
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.15.0
@@ -77,7 +77,7 @@ echo.Fetching external binaries...
7777

7878
set binaries=
7979
if NOT "%IncludeLibffi%"=="false" set binaries=%binaries% libffi-3.4.4
80-
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.15
80+
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.16.1
8181
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.15.0
8282
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06
8383

‎PCbuild/openssl.vcxproj

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -67,47 +67,23 @@
6767
set VCINSTALLDIR=$(VCInstallDir)
6868
if not exist "$(IntDir.TrimEnd('\'))" mkdir "$(IntDir.TrimEnd('\'))"
6969
cd /D "$(IntDir.TrimEnd('\'))"
70-
$(Perl) "$(opensslDir)\configure" $(OpenSSLPlatform) no-asm
70+
$(Perl) "$(opensslDir)\configure" $(OpenSSLPlatform) no-asm no-uplink
7171
nmake
7272
</NMakeBuildCommandLine>
7373
</PropertyGroup>
7474

7575
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
7676

77-
<Target Name="_PatchUplink" BeforeTargets="Build">
78-
<PropertyGroup>
79-
<Uplink>$(opensslDir)\ms\uplink.c</Uplink>
80-
<BeforePatch>((h = GetModuleHandle(NULL)) == NULL)</BeforePatch>
81-
<AfterPatch>((h = GetModuleHandleA("_ssl.pyd")) == NULL) if ((h = GetModuleHandleA("_ssl_d.pyd")) == NULL) if ((h = GetModuleHandle(NULL)) == NULL /*patched*/)</AfterPatch>
82-
</PropertyGroup>
83-
<Error Text="Cannot find $(Uplink)" Condition="!Exists($(Uplink))" />
84-
<PropertyGroup>
85-
<_Original>$([System.IO.File]::ReadAllText($(Uplink)))</_Original>
86-
<_Patched>$(_Original.Replace($(BeforePatch), $(AfterPatch)))</_Patched>
87-
<IsPatched>false</IsPatched>
88-
<IsPatched Condition="$(_Patched) == $(_Original)">true</IsPatched>
89-
</PropertyGroup>
90-
<Message Text="$(Uplink) is already patched" Importance="normal" Condition="$(IsPatched)" />
91-
<Message Text="Patching $(Uplink)" Importance="high" Condition="!$(IsPatched)" />
92-
<WriteLinesToFile File="$(Uplink)"
93-
Lines="$(_Patched)"
94-
Overwrite="true"
95-
Encoding="ASCII"
96-
Condition="!$(IsPatched)" />
97-
</Target>
98-
9977
<Target Name="_CopyToOutput" AfterTargets="Build">
10078
<ItemGroup>
10179
<_Built Include="$(opensslDir)\LICENSE" />
10280
<_Built Include="$(IntDir)\libcrypto.lib;$(IntDir)\libcrypto-*.dll;$(IntDir)\libcrypto-*.pdb" />
10381
<_Built Include="$(IntDir)\libssl.lib;$(IntDir)\libssl-*.dll;$(IntDir)\libssl-*.pdb" />
104-
<_AppLink Include="$(opensslDir)\ms\applink.c" />
10582
<_Include Include="$(opensslDir)\Include\openssl\*.h" />
10683
<_Include Include="$(IntDir)\include\openssl\*.h" />
10784
</ItemGroup>
10885
<MakeDir Directories="$(opensslOutDir)\include\openssl" />
10986
<Copy SourceFiles="@(_Built)" DestinationFolder="$(opensslOutDir)" />
110-
<Copy SourceFiles="@(_AppLink)" DestinationFolder="$(opensslOutDir)\include" />
11187
<Copy SourceFiles="@(_Include)" DestinationFolder="$(opensslOutDir)\include\openssl" />
11288
</Target>
11389

‎PCbuild/python.props

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,8 @@
7575
<libffiOutDir Condition="$(libffiOutDir) == ''">$(libffiDir)$(ArchName)\</libffiOutDir>
7676
<libffiIncludeDir Condition="$(libffiIncludeDir) == ''">$(libffiOutDir)include</libffiIncludeDir>
7777
<mpdecimalDir Condition="$(mpdecimalDir) == ''">$(ExternalsDir)\mpdecimal-4.0.0\</mpdecimalDir>
78-
<opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-3.0.15\</opensslDir>
79-
<opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-3.0.15\$(ArchName)\</opensslOutDir>
78+
<opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-3.0.16\</opensslDir>
79+
<opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-3.0.16.1\$(ArchName)\</opensslOutDir>
8080
<opensslIncludeDir Condition="$(opensslIncludeDir) == ''">$(opensslOutDir)include</opensslIncludeDir>
8181
<nasmDir Condition="$(nasmDir) == ''">$(ExternalsDir)\nasm-2.11.06\</nasmDir>
8282
<zlibDir Condition="$(zlibDir) == ''">$(ExternalsDir)\zlib-1.3.1\</zlibDir>

0 commit comments

Comments
 (0)
0