Skip to content

Commit b9eb9f7

Browse files
vstinnerpicnixz
authored and
miss-islington
committed
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (pythonGH-146217)
OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. (cherry picked from commit 3364e7e) Co-authored-by: Victor Stinner <vstinner@python.org> Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
1 parent f2b5131 commit b9eb9f7

4 files changed

Lines changed: 58 additions & 31 deletions

File tree

‎Lib/test/test_ssl.py‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -380,7 +380,7 @@ def test_constants(self):
380380
ssl.OP_NO_COMPRESSION
381381
self.assertEqual(ssl.HAS_SNI, True)
382382
self.assertEqual(ssl.HAS_ECDH, True)
383-
self.assertEqual(ssl.HAS_TLSv1_2, True)
383+
self.assertIsInstance(ssl.HAS_TLSv1_2, bool)
384384
self.assertEqual(ssl.HAS_TLSv1_3, True)
385385
ssl.OP_NO_SSLv2
386386
ssl.OP_NO_SSLv3
@@ -571,11 +571,11 @@ def test_openssl_version(self):
571571
# Some sanity checks follow
572572
# >= 1.1.1
573573
self.assertGreaterEqual(n, 0x10101000)
574-
# < 4.0
575-
self.assertLess(n, 0x40000000)
574+
# < 5.0
575+
self.assertLess(n, 0x50000000)
576576
major, minor, fix, patch, status = t
577577
self.assertGreaterEqual(major, 1)
578-
self.assertLess(major, 4)
578+
self.assertLess(major, 5)
579579
self.assertGreaterEqual(minor, 0)
580580
self.assertLess(minor, 256)
581581
self.assertGreaterEqual(fix, 0)
@@ -641,12 +641,14 @@ def test_openssl111_deprecations(self):
641641
ssl.OP_NO_TLSv1_2,
642642
ssl.OP_NO_TLSv1_3
643643
]
644-
protocols = [
645-
ssl.PROTOCOL_TLSv1,
646-
ssl.PROTOCOL_TLSv1_1,
647-
ssl.PROTOCOL_TLSv1_2,
648-
ssl.PROTOCOL_TLS
649-
]
644+
protocols = []
645+
if hasattr(ssl, 'PROTOCOL_TLSv1'):
646+
protocols.append(ssl.PROTOCOL_TLSv1)
647+
if hasattr(ssl, 'PROTOCOL_TLSv1_1'):
648+
protocols.append(ssl.PROTOCOL_TLSv1_1)
649+
if hasattr(ssl, 'PROTOCOL_TLSv1_2'):
650+
protocols.append(ssl.PROTOCOL_TLSv1_2)
651+
protocols.append(ssl.PROTOCOL_TLS)
650652
versions = [
651653
ssl.TLSVersion.SSLv3,
652654
ssl.TLSVersion.TLSv1,
@@ -1140,6 +1142,7 @@ def test_min_max_version(self):
11401142
ssl.TLSVersion.TLSv1,
11411143
ssl.TLSVersion.TLSv1_1,
11421144
ssl.TLSVersion.TLSv1_2,
1145+
ssl.TLSVersion.TLSv1_3,
11431146
ssl.TLSVersion.SSLv3,
11441147
}
11451148
)
@@ -1153,7 +1156,7 @@ def test_min_max_version(self):
11531156
with self.assertRaises(ValueError):
11541157
ctx.minimum_version = 42
11551158

1156-
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
1159+
if has_tls_protocol('PROTOCOL_TLSv1_1'):
11571160
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1)
11581161

11591162
self.assertIn(
@@ -1605,23 +1608,24 @@ def test__create_stdlib_context(self):
16051608
self.assertFalse(ctx.check_hostname)
16061609
self._assert_context_options(ctx)
16071610

1608-
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
1611+
if has_tls_protocol('PROTOCOL_TLSv1'):
16091612
with warnings_helper.check_warnings():
16101613
ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1)
16111614
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
16121615
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
16131616
self._assert_context_options(ctx)
16141617

1615-
with warnings_helper.check_warnings():
1616-
ctx = ssl._create_stdlib_context(
1617-
ssl.PROTOCOL_TLSv1_2,
1618-
cert_reqs=ssl.CERT_REQUIRED,
1619-
check_hostname=True
1620-
)
1621-
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1622-
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1623-
self.assertTrue(ctx.check_hostname)
1624-
self._assert_context_options(ctx)
1618+
if has_tls_protocol('PROTOCOL_TLSv1_2'):
1619+
with warnings_helper.check_warnings():
1620+
ctx = ssl._create_stdlib_context(
1621+
ssl.PROTOCOL_TLSv1_2,
1622+
cert_reqs=ssl.CERT_REQUIRED,
1623+
check_hostname=True
1624+
)
1625+
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1626+
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1627+
self.assertTrue(ctx.check_hostname)
1628+
self._assert_context_options(ctx)
16251629

16261630
ctx = ssl._create_stdlib_context(purpose=ssl.Purpose.CLIENT_AUTH)
16271631
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_SERVER)
@@ -3517,10 +3521,10 @@ def test_protocol_tlsv1_2(self):
35173521
client_options=ssl.OP_NO_TLSv1_2)
35183522

35193523
try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2')
3520-
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
3524+
if has_tls_protocol('PROTOCOL_TLSv1'):
35213525
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False)
35223526
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False)
3523-
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
3527+
if has_tls_protocol('PROTOCOL_TLSv1_1'):
35243528
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
35253529
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False)
35263530

‎Modules/_ssl.c‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,17 @@ static void _PySSLFixErrno(void) {
134134
#error Unsupported OpenSSL version
135135
#endif
136136

137+
#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
138+
# define OPENSSL_NO_SSL3
139+
# define OPENSSL_NO_TLS1
140+
# define OPENSSL_NO_TLS1_1
141+
# define OPENSSL_NO_TLS1_2
142+
# define OPENSSL_NO_SSL3_METHOD
143+
# define OPENSSL_NO_TLS1_METHOD
144+
# define OPENSSL_NO_TLS1_1_METHOD
145+
# define OPENSSL_NO_TLS1_2_METHOD
146+
#endif
147+
137148
/* OpenSSL API 1.1.0+ does not include version methods */
138149
#ifndef OPENSSL_NO_SSL3_METHOD
139150
extern const SSL_METHOD *SSLv3_method(void);
@@ -1133,7 +1144,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name)
11331144

11341145
static PyObject *
11351146
_create_tuple_for_attribute(_sslmodulestate *state,
1136-
ASN1_OBJECT *name, ASN1_STRING *value)
1147+
const ASN1_OBJECT *name, const ASN1_STRING *value)
11371148
{
11381149
Py_ssize_t buflen;
11391150
PyObject *pyattr;
@@ -1162,16 +1173,16 @@ _create_tuple_for_attribute(_sslmodulestate *state,
11621173
}
11631174

11641175
static PyObject *
1165-
_create_tuple_for_X509_NAME (_sslmodulestate *state, X509_NAME *xname)
1176+
_create_tuple_for_X509_NAME(_sslmodulestate *state, const X509_NAME *xname)
11661177
{
11671178
PyObject *dn = NULL; /* tuple which represents the "distinguished name" */
11681179
PyObject *rdn = NULL; /* tuple to hold a "relative distinguished name" */
11691180
PyObject *rdnt;
11701181
PyObject *attr = NULL; /* tuple to hold an attribute */
11711182
int entry_count = X509_NAME_entry_count(xname);
1172-
X509_NAME_ENTRY *entry;
1173-
ASN1_OBJECT *name;
1174-
ASN1_STRING *value;
1183+
const X509_NAME_ENTRY *entry;
1184+
const ASN1_OBJECT *name;
1185+
const ASN1_STRING *value;
11751186
int index_counter;
11761187
int rdn_level = -1;
11771188
int retcode;
@@ -6510,9 +6521,15 @@ sslmodule_init_constants(PyObject *m)
65106521
ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
65116522
ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
65126523
ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
6524+
#ifndef OPENSSL_NO_TLS1
65136525
ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
6526+
#endif
6527+
#ifndef OPENSSL_NO_TLS1_1
65146528
ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
6529+
#endif
6530+
#ifndef OPENSSL_NO_TLS1_2
65156531
ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
6532+
#endif
65166533

65176534
#define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1
65186535

‎Modules/_ssl/cert.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,8 @@ _ssl_Certificate_get_info_impl(PySSLCertificate *self)
128128
}
129129

130130
static PyObject*
131-
_x509name_print(_sslmodulestate *state, X509_NAME *name, int indent, unsigned long flags)
131+
_x509name_print(_sslmodulestate *state, const X509_NAME *name,
132+
int indent, unsigned long flags)
132133
{
133134
PyObject *res;
134135
BIO *biobuf;

‎Tools/ssl/multissltests.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -414,9 +414,11 @@ class BuildOpenSSL(AbstractBuilder):
414414
def _post_install(self):
415415
if self.version.startswith("3."):
416416
self._post_install_3xx()
417+
elif self.version.startswith("4."):
418+
self._post_install_4xx()
417419

418420
def _build_src(self, config_args=()):
419-
if self.version.startswith("3."):
421+
if self.version.startswith(("3.", "4.")):
420422
config_args += ("enable-fips",)
421423
super()._build_src(config_args)
422424

@@ -432,6 +434,9 @@ def _post_install_3xx(self):
432434
lib64 = self.lib_dir + "64"
433435
os.symlink(lib64, self.lib_dir)
434436

437+
def _post_install_4xx(self):
438+
self._post_install_3xx()
439+
435440
@property
436441
def short_version(self):
437442
"""Short version for OpenSSL download URL"""

0 commit comments

Comments
 (0)