8000 bpo-43794: OpenSSL 3.0.0: set OP_IGNORE_UNEXPECTED_EOF by default (GH… · python/cpython@e18ebd9 · GitHub
[go: up one dir, main page]

Skip to content

Commit e18ebd9

Browse files
bpo-43794: OpenSSL 3.0.0: set OP_IGNORE_UNEXPECTED_EOF by default (GH-25309)
Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit 6f37ebc) Co-authored-by: Christian Heimes <christian@python.org>
1 parent a28398e commit e18ebd9

File tree

4 files changed

+20
-1
lines changed

4 files changed

+20
-1
lines changed

Doc/library/ssl.rst

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -886,6 +886,14 @@ Constants
886886

887887
.. versionadded:: 3.6
888888

889+
.. data:: OP_IGNORE_UNEXPECTED_EOF
890+
891+
Ignore unexpected shutdown of TLS connections.
892+
893+
This option is only available with OpenSSL 3.0.0 and later.
894+
895+
.. versionadded:: 3.10
896+
889897
.. data:: HAS_ALPN
890898

891899
Whether the OpenSSL library has built-in support for the *Application-Layer

Lib/test/test_ssl.py

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ def data_file(*name):
143143
OP_SINGLE_ECDH_USE = getattr(ssl, "OP_SINGLE_ECDH_USE", 0)
144144
OP_CIPHER_SERVER_PREFERENCE = getattr(ssl, "OP_CIPHER_SERVER_PREFERENCE", 0)
145145
OP_ENABLE_MIDDLEBOX_COMPAT = getattr(ssl, "OP_ENABLE_MIDDLEBOX_COMPAT", 0)
146+
OP_IGNORE_UNEXPECTED_EOF = getattr(ssl, "OP_IGNORE_UNEXPECTED_EOF", 0)
146147

147148
# Ubuntu has patched OpenSSL and changed behavior of security level 2
148149
# see https://bugs.python.org/issue41561#msg389003
@@ -1161,7 +1162,8 @@ def test_options(self):
11611162
# SSLContext also enables these by default
11621163
default |= (OP_NO_COMPRESSION | OP_CIPHER_SERVER_PREFERENCE |
11631164
OP_SINGLE_DH_USE | OP_SINGLE_ECDH_USE |
1164-
OP_ENABLE_MIDDLEBOX_COMPAT)
1165+
OP_ENABLE_MIDDLEBOX_COMPAT |
1166+
OP_IGNORE_UNEXPECTED_EOF)
11651167
self.assertEqual(default, ctx.options)
11661168
ctx.options |= ssl.OP_NO_TLSv1
11671169
self.assertEqual(default | ssl.OP_NO_TLSv1, ctx.options)
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Add :data:`ssl.OP_IGNORE_UNEXPECTED_EOF` constants (OpenSSL 3.0.0)

Modules/_ssl.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3214,6 +3214,10 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
32143214
#endif
32153215
#ifdef SSL_OP_SINGLE_ECDH_USE
32163216
options |= SSL_OP_SINGLE_ECDH_USE;
3217+
#endif
3218+
#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
3219+
/* Make OpenSSL 3.0.0 behave like 1.1.1 */
3220+
options |= SSL_OP_IGNORE_UNEXPECTED_EOF;
32173221
#endif
32183222
SSL_CTX_set_options(self->ctx, options);
32193223

@@ -6273,6 +6277,10 @@ PyInit__ssl(void)
62736277
PyModule_AddIntConstant(m, "OP_NO_RENEGOTIATION",
62746278
SSL_OP_NO_RENEGOTIATION);
62756279
#endif
6280+
#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
6281+
PyModule_AddIntConstant(m, "OP_IGNORE_UNEXPECTED_EOF",
6282+
SSL_OP_IGNORE_UNEXPECTED_EOF);
6283+
#endif
62766284

62776285
#ifdef X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT
62786286
PyModule_AddIntConstant(m, "HOSTFLAG_ALWAYS_CHECK_SUBJECT",

0 commit comments

Comments
 (0)
0