Skip to content

Commit d8863f8

Browse files
vstinnerpicnixz
authored and
SquallATF
committed
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)
OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
1 parent 38b01eb commit d8863f8

4 files changed

Lines changed: 58 additions & 31 deletions

File tree

‎Lib/test/test_ssl.py‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -396,7 +396,7 @@ def test_constants(self):
396396
ssl.OP_NO_COMPRESSION
397397
self.assertEqual(ssl.HAS_SNI, True)
398398
self.assertEqual(ssl.HAS_ECDH, True)
399-
self.assertEqual(ssl.HAS_TLSv1_2, True)
399+
self.assertIsInstance(ssl.HAS_TLSv1_2, bool)
400400
self.assertEqual(ssl.HAS_TLSv1_3, True)
401401
ssl.OP_NO_SSLv2
402402
ssl.OP_NO_SSLv3
@@ -587,11 +587,11 @@ def test_openssl_version(self):
587587
# Some sanity checks follow
588588
# >= 1.1.1
589589
self.assertGreaterEqual(n, 0x10101000)
590-
# < 4.0
591-
self.assertLess(n, 0x40000000)
590+
# < 5.0
591+
self.assertLess(n, 0x50000000)
592592
major, minor, fix, patch, status = t
593593
self.assertGreaterEqual(major, 1)
594-
self.assertLess(major, 4)
594+
self.assertLess(major, 5)
595595
self.assertGreaterEqual(minor, 0)
596596
self.assertLess(minor, 256)
597597
self.assertGreaterEqual(fix, 0)
@@ -657,12 +657,14 @@ def test_openssl111_deprecations(self):
657657
ssl.OP_NO_TLSv1_2,
658658
ssl.OP_NO_TLSv1_3
659659
]
660-
protocols = [
661-
ssl.PROTOCOL_TLSv1,
662-
ssl.PROTOCOL_TLSv1_1,
663-
ssl.PROTOCOL_TLSv1_2,
664-
ssl.PROTOCOL_TLS
665-
]
660+
protocols = []
661+
if hasattr(ssl, 'PROTOCOL_TLSv1'):
662+
protocols.append(ssl.PROTOCOL_TLSv1)
663+
if hasattr(ssl, 'PROTOCOL_TLSv1_1'):
664+
protocols.append(ssl.PROTOCOL_TLSv1_1)
665+
if hasattr(ssl, 'PROTOCOL_TLSv1_2'):
666+
protocols.append(ssl.PROTOCOL_TLSv1_2)
667+
protocols.append(ssl.PROTOCOL_TLS)
666668
versions = [
667669
ssl.TLSVersion.SSLv3,
668670
ssl.TLSVersion.TLSv1,
@@ -1156,6 +1158,7 @@ def test_min_max_version(self):
11561158
ssl.TLSVersion.TLSv1,
11571159
ssl.TLSVersion.TLSv1_1,
11581160
ssl.TLSVersion.TLSv1_2,
1161+
ssl.TLSVersion.TLSv1_3,
11591162
ssl.TLSVersion.SSLv3,
11601163
}
11611164
)
@@ -1169,7 +1172,7 @@ def test_min_max_version(self):
11691172
with self.assertRaises(ValueError):
11701173
ctx.minimum_version = 42
11711174

1172-
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
1175+
if has_tls_protocol('PROTOCOL_TLSv1_1'):
11731176
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1)
11741177

11751178
self.assertIn(
@@ -1664,23 +1667,24 @@ def test__create_stdlib_context(self):
16641667
self.assertFalse(ctx.check_hostname)
16651668
self._assert_context_options(ctx)
16661669

1667-
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
1670+
if has_tls_protocol('PROTOCOL_TLSv1'):
16681671
with warnings_helper.check_warnings():
16691672
ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1)
16701673
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
16711674
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
16721675
self._assert_context_options(ctx)
16731676

1674-
with warnings_helper.check_warnings():
1675-
ctx = ssl._create_stdlib_context(
1676-
ssl.PROTOCOL_TLSv1_2,
1677-
cert_reqs=ssl.CERT_REQUIRED,
1678-
check_hostname=True
1679-
)
1680-
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1681-
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1682-
self.assertTrue(ctx.check_hostname)
1683-
self._assert_context_options(ctx)
1677+
if has_tls_protocol('PROTOCOL_TLSv1_2'):
1678+
with warnings_helper.check_warnings():
1679+
ctx = ssl._create_stdlib_context(
1680+
ssl.PROTOCOL_TLSv1_2,
1681+
cert_reqs=ssl.CERT_REQUIRED,
1682+
check_hostname=True
1683+
)
1684+
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1685+
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1686+
self.assertTrue(ctx.check_hostname)
1687+
self._assert_context_options(ctx)
16841688

16851689
ctx = ssl._create_stdlib_context(purpose=ssl.Purpose.CLIENT_AUTH)
16861690
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_SERVER)
@@ -3576,10 +3580,10 @@ def test_protocol_tlsv1_2(self):
35763580
client_options=ssl.OP_NO_TLSv1_2)
35773581

35783582
try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2')
3579-
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
3583+
if has_tls_protocol('PROTOCOL_TLSv1'):
35803584
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False)
35813585
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False)
3582-
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
3586+
if has_tls_protocol('PROTOCOL_TLSv1_1'):
35833587
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
35843588
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False)
35853589

‎Modules/_ssl.c‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,17 @@ static void _PySSLFixErrno(void) {
134134
#error Unsupported OpenSSL version
135135
#endif
136136

137+
#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
138+
# define OPENSSL_NO_SSL3
139+
# define OPENSSL_NO_TLS1
140+
# define OPENSSL_NO_TLS1_1
141+
# define OPENSSL_NO_TLS1_2
142+
# define OPENSSL_NO_SSL3_METHOD
143+
# define OPENSSL_NO_TLS1_METHOD
144+
# define OPENSSL_NO_TLS1_1_METHOD
145+
# define OPENSSL_NO_TLS1_2_METHOD
146+
#endif
147+
137148
/* OpenSSL API 1.1.0+ does not include version methods */
138149
#ifndef OPENSSL_NO_SSL3_METHOD
139150
extern const SSL_METHOD *SSLv3_method(void);
@@ -1133,7 +1144,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name)
11331144

11341145
static PyObject *
11351146
_create_tuple_for_attribute(_sslmodulestate *state,
1136-
ASN1_OBJECT *name, ASN1_STRING *value)
1147+
const ASN1_OBJECT *name, const ASN1_STRING *value)
11371148
{
11381149
Py_ssize_t buflen;
11391150
PyObject *pyattr;
@@ -1162,16 +1173,16 @@ _create_tuple_for_attribute(_sslmodulestate *state,
11621173
}
11631174

11641175
static PyObject *
1165-
_create_tuple_for_X509_NAME (_sslmodulestate *state, X509_NAME *xname)
1176+
_create_tuple_for_X509_NAME(_sslmodulestate *state, const X509_NAME *xname)
11661177
{
11671178
PyObject *dn = NULL; /* tuple which represents the "distinguished name" */
11681179
PyObject *rdn = NULL; /* tuple to hold a "relative distinguished name" */
11691180
PyObject *rdnt;
11701181
PyObject *attr = NULL; /* tuple to hold an attribute */
11711182
int entry_count = X509_NAME_entry_count(xname);
1172-
X509_NAME_ENTRY *entry;
1173-
ASN1_OBJECT *name;
1174-
ASN1_STRING *value;
1183+
const X509_NAME_ENTRY *entry;
1184+
const ASN1_OBJECT *name;
1185+
const ASN1_STRING *value;
11751186
int index_counter;
11761187
int rdn_level = -1;
11771188
int retcode;
@@ -6506,9 +6517,15 @@ sslmodule_init_constants(PyObject *m)
65066517
ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
65076518
ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
65086519
ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
6520+
#ifndef OPENSSL_NO_TLS1
65096521
ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
6522+
#endif
6523+
#ifndef OPENSSL_NO_TLS1_1
65106524
ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
6525+
#endif
6526+
#ifndef OPENSSL_NO_TLS1_2
65116527
ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
6528+
#endif
65126529

65136530
#define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1
65146531

‎Modules/_ssl/cert.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,8 @@ _ssl_Certificate_get_info_impl(PySSLCertificate *self)
128128
}
129129

130130
static PyObject*
131-
_x509name_print(_sslmodulestate *state, X509_NAME *name, int indent, unsigned long flags)
131+
_x509name_print(_sslmodulestate *state, const X509_NAME *name,
132+
int indent, unsigned long flags)
132133
{
133134
PyObject *res;
134135
BIO *biobuf;

‎Tools/ssl/multissltests.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -414,9 +414,11 @@ class BuildOpenSSL(AbstractBuilder):
414414
def _post_install(self):
415415
if self.version.startswith("3."):
416416
self._post_install_3xx()
417+
elif self.version.startswith("4."):
418+
self._post_install_4xx()
417419

418420
def _build_src(self, config_args=()):
419-
if self.version.startswith("3."):
421+
if self.version.startswith(("3.", "4.")):
420422
config_args += ("enable-fips",)
421423
super()._build_src(config_args)
422424

@@ -432,6 +434,9 @@ def _post_install_3xx(self):
432434
lib64 = self.lib_dir + "64"
433435
os.symlink(lib64, self.lib_dir)
434436

437+
def _post_install_4xx(self):
438+
self._post_install_3xx()
439+
435440
@property
436441
def short_version(self):
437442
"""Short version for OpenSSL download URL"""

0 commit comments

Comments
 (0)