Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit de8bc17

Browse filesBrowse files
zoobazooba
authored
gh-131423: Update to OpenSSL 3.0.16. (GH-131839)
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix gh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
1 parent e460602 commit de8bc17
Copy full SHA for de8bc17

12 files changed

+74
-53
lines changed

‎Lib/test/audit-tests.py

Copy file name to clipboardExpand all lines: Lib/test/audit-tests.py
+9-1Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,15 @@ def test_open(testfn):
208208
if not fn:
209209
continue
210210
with assertRaises(RuntimeError):
211-
fn(*args)
211+
try:
212+
fn(*args)
213+
except NotImplementedError:
214+
if fn == load_dh_params:
215+
# Not callable in some builds
216+
load_dh_params = None
217+
raise RuntimeError
218+
else:
219+
raise
212220

213221
actual_mode = [(a[0], a[1]) for e, a in hook.seen if e == "open" and a[1]]
214222
actual_flag = [(a[0], a[2]) for e, a in hook.seen if e == "open" and not a[1]]

‎Lib/test/test_audit.py

Copy file name to clipboardExpand all lines: Lib/test/test_audit.py
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ def run_test_in_subprocess(self, *args):
2323
with subprocess.Popen(
2424
[sys.executable, "-X utf8", AUDIT_TESTS_PY, *args],
2525
encoding="utf-8",
26+
errors="backslashreplace",
2627
stdout=subprocess.PIPE,
2728
stderr=subprocess.PIPE,
2829
) as p:

‎Lib/test/test_ssl.py

Copy file name to clipboardExpand all lines: Lib/test/test_ssl.py
+39-13Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1348,10 +1348,14 @@ def test_load_verify_cadata(self):
13481348
with self.assertRaises(ssl.SSLError):
13491349
ctx.load_verify_locations(cadata=cacert_der + b"A")
13501350

1351-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
13521351
def test_load_dh_params(self):
13531352
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
1354-
ctx.load_dh_params(DHFILE)
1353+
try:
1354+
ctx.load_dh_params(DHFILE)
1355+
except RuntimeError:
1356+
if Py_DEBUG_WIN32:
1357+
self.skipTest("not supported on Win32 debug build")
1358+
raise
13551359
if os.name != 'nt':
13561360
ctx.load_dh_params(BYTES_DHFILE)
13571361
self.assertRaises(TypeError, ctx.load_dh_params)
@@ -1676,12 +1680,17 @@ def test_str(self):
16761680
self.assertEqual(str(e), "foo")
16771681
self.assertEqual(e.errno, 1)
16781682

1679-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
16801683
def test_lib_reason(self):
16811684
# Test the library and reason attributes
16821685
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
1683-
with self.assertRaises(ssl.SSLError) as cm:
1684-
ctx.load_dh_params(CERTFILE)
1686+
try:
1687+
with self.assertRaises(ssl.SSLError) as cm:
1688+
ctx.load_dh_params(CERTFILE)
1689+
except RuntimeError:
1690+
if Py_DEBUG_WIN32:
1691+
self.skipTest("not supported on Win32 debug build")
1692+
raise
1693+
16851694
self.assertEqual(cm.exception.library, 'PEM')
16861695
regex = "(NO_START_LINE|UNSUPPORTED_PUBLIC_KEY_TYPE)"
16871696
self.assertRegex(cm.exception.reason, regex)
@@ -4060,13 +4069,17 @@ def test_no_legacy_server_connect(self):
40604069
chatty=True, connectionchatty=True,
40614070
sni_name=hostname)
40624071

4063-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
40644072
def test_dh_params(self):
40654073
# Check we can get a connection with ephemeral Diffie-Hellman
40664074
client_context, server_context, hostname = testing_context()
40674075
# test scenario needs TLS <= 1.2
40684076
client_context.maximum_version = ssl.TLSVersion.TLSv1_2
4069-
server_context.load_dh_params(DHFILE)
4077+
try:
4078+
server_context.load_dh_params(DHFILE)
4079+
except RuntimeError:
4080+
if Py_DEBUG_WIN32:
4081+
self.skipTest("not supported on Win32 debug build")
4082+
raise
40704083
server_context.set_ciphers("kEDH")
40714084
server_context.maximum_version = ssl.TLSVersion.TLSv1_2
40724085
stats = server_params_test(client_context, server_context,
@@ -4846,14 +4859,18 @@ def keylog_lines(self, fname=os_helper.TESTFN):
48464859
return len(list(f))
48474860

48484861
@requires_keylog
4849-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48504862
def test_keylog_defaults(self):
48514863
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48524864
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
48534865
self.assertEqual(ctx.keylog_filename, None)
48544866

48554867
self.assertFalse(os.path.isfile(os_helper.TESTFN))
4856-
ctx.keylog_filename = os_helper.TESTFN
4868+
try:
4869+
ctx.keylog_filename = os_helper.TESTFN
4870+
except RuntimeError:
4871+
if Py_DEBUG_WIN32:
4872+
self.skipTest("not supported on Win32 debug build")
4873+
raise
48574874
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
48584875
self.assertTrue(os.path.isfile(os_helper.TESTFN))
48594876
self.assertEqual(self.keylog_lines(), 1)
@@ -4870,12 +4887,17 @@ def test_keylog_defaults(self):
48704887
ctx.keylog_filename = 1
48714888

48724889
@requires_keylog
4873-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48744890
def test_keylog_filename(self):
48754891
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48764892
client_context, server_context, hostname = testing_context()
48774893

4878-
client_context.keylog_filename = os_helper.TESTFN
4894+
try:
4895+
client_context.keylog_filename = os_helper.TESTFN
4896+
except RuntimeError:
4897+
if Py_DEBUG_WIN32:
4898+
self.skipTest("not supported on Win32 debug build")
4899+
raise
4900+
48794901
server = ThreadedEchoServer(context=server_context, chatty=False)
48804902
with server:
48814903
with client_context.wrap_socket(socket.socket(),
@@ -4908,7 +4930,6 @@ def test_keylog_filename(self):
49084930
@requires_keylog
49094931
@unittest.skipIf(sys.flags.ignore_environment,
49104932
"test is not compatible with ignore_environment")
4911-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
49124933
def test_keylog_env(self):
49134934
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
49144935
with unittest.mock.patch.dict(os.environ):
@@ -4918,7 +4939,12 @@ def test_keylog_env(self):
49184939
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
49194940
self.assertEqual(ctx.keylog_filename, None)
49204941

4921-
ctx = ssl.create_default_context()
4942+
try:
4943+
ctx = ssl.create_default_context()
4944+
except RuntimeError:
4945+
if Py_DEBUG_WIN32:
4946+
self.skipTest("not supported on Win32 debug build")
4947+
raise
49224948
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
49234949

49244950
ctx = ssl._create_stdlib_context()

‎Misc/NEWS.d/next/Windows/2025-03-28-13-22-55.gh-issue-131423.vI-LqV.rst

Copy file name to clipboard
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Update bundled version of OpenSSL to 3.0.16. The new build also disables
2+
uplink support, which may be relevant to embedders but has no impact on
3+
normal use.

‎Misc/externals.spdx.json

Copy file name to clipboardExpand all lines: Misc/externals.spdx.json
+4-4Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,21 +70,21 @@
7070
"checksums": [
7171
{
7272
"algorithm": "SHA256",
73-
"checksumValue": "1550c87996a0858474a9dd179deab2c55eb73726b9a140b32865b02fd3d8a86b"
73+
"checksumValue": "6bb739ecddbd2cfb6d255eb5898437a9b5739277dee931338d3275bac5d96ba2"
7474
}
7575
],
76-
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.15.tar.gz",
76+
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.16.tar.gz",
7777
"externalRefs": [
7878
{
7979
"referenceCategory": "SECURITY",
80-
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.15:*:*:*:*:*:*:*",
80+
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.16:*:*:*:*:*:*:*",
8181
"referenceType": "cpe23Type"
8282
}
8383
],
8484
"licenseConcluded": "NOASSERTION",
8585
"name": "openssl",
8686
"primaryPackagePurpose": "SOURCE",
87-
"versionInfo": "3.0.15"
87+
"versionInfo": "3.0.16"
8888
},
8989
{
9090
"SPDXID": "SPDXRef-PACKAGE-sqlite",

‎Modules/_ssl.c

Copy file name to clipboardExpand all lines: Modules/_ssl.c
+6Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4370,6 +4370,12 @@ _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath)
43704370
FILE *f;
43714371
DH *dh;
43724372

4373+
#if defined(MS_WINDOWS) && defined(_DEBUG)
4374+
PyErr_SetString(PyExc_NotImplementedError,
4375+
"load_dh_params: unavailable on Windows debug build");
4376+
return NULL;
4377+
#endif
4378+
43734379
f = _Py_fopen_obj(filepath, "rb");
43744380
if (f == NULL)
43754381
return NULL;

‎Modules/_ssl/debughelpers.c

Copy file name to clipboardExpand all lines: Modules/_ssl/debughelpers.c
+7Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,13 @@ _PySSLContext_get_keylog_filename(PySSLContext *self, void *c) {
164164
static int
165165
_PySSLContext_set_keylog_filename(PySSLContext *self, PyObject *arg, void *c) {
166166
FILE *fp;
167+
168+
#if defined(MS_WINDOWS) && defined(_DEBUG)
169+
PyErr_SetString(PyExc_NotImplementedError,
170+
"set_keylog_filename: unavailable on Windows debug build");
171+
return -1;
172+
#endif
173+
167174
/* Reset variables and callback first */
168175
SSL_CTX_set_keylog_callback(self->ctx, NULL);
169176
Py_CLEAR(self->keylog_filename);

‎PCbuild/_ssl.vcxproj

Copy file name to clipboardExpand all lines: PCbuild/_ssl.vcxproj
-3Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,6 @@
9999
</ItemDefinitionGroup>
100100
<ItemGroup>
101101
<ClCompile Include="..\Modules\_ssl.c" />
102-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
103-
<PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;$(PreprocessorDefinitions)</PreprocessorDefinitions>
104-
</ClCompile>
105102
</ItemGroup>
106103
<ItemGroup>
107104
<ResourceCompile Include="..\PC\python_nt.rc" />

‎PCbuild/_ssl.vcxproj.filters

Copy file name to clipboardExpand all lines: PCbuild/_ssl.vcxproj.filters
-3Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@
1212
<ClCompile Include="..\Modules\_ssl.c">
1313
<Filter>Source Files</Filter>
1414
</ClCompile>
15-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
16-
<Filter>Source Files</Filter>
17-
</ClCompile>
1815
</ItemGroup>
1916
<ItemGroup>
2017
<ResourceCompile Include="..\PC\python_nt.rc">

‎PCbuild/get_externals.bat

Copy file name to clipboardExpand all lines: PCbuild/get_externals.bat
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ echo.Fetching external libraries...
5353
set libraries=
5454
set libraries=%libraries% bzip2-1.0.8
5555
if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.4.4
56-
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.15
56+
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.16
5757
set libraries=%libraries% mpdecimal-4.0.0
5858
set libraries=%libraries% sqlite-3.45.3.0
5959
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.15.0
@@ -77,7 +77,7 @@ echo.Fetching external binaries...
7777

7878
set binaries=
7979
if NOT "%IncludeLibffi%"=="false" set binaries=%binaries% libffi-3.4.4
80-
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.15
80+
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.16.1
8181
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.15.0
8282
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06
8383

‎PCbuild/openssl.vcxproj

Copy file name to clipboardExpand all lines: PCbuild/openssl.vcxproj
+1-25Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -67,47 +67,23 @@
6767
set VCINSTALLDIR=$(VCInstallDir)
6868
if not exist "$(IntDir.TrimEnd('\'))" mkdir "$(IntDir.TrimEnd('\'))"
6969
cd /D "$(IntDir.TrimEnd('\'))"
70-
$(Perl) "$(opensslDir)\configure" $(OpenSSLPlatform) no-asm
70+
$(Perl) "$(opensslDir)\configure" $(OpenSSLPlatform) no-asm no-uplink
7171
nmake
7272
</NMakeBuildCommandLine>
7373
</PropertyGroup>
7474

7575
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
7676

77-
<Target Name="_PatchUplink" BeforeTargets="Build">
78-
<PropertyGroup>
79-
<Uplink>$(opensslDir)\ms\uplink.c</Uplink>
80-
<BeforePatch>((h = GetModuleHandle(NULL)) == NULL)</BeforePatch>
81-
<AfterPatch>((h = GetModuleHandleA("_ssl.pyd")) == NULL) if ((h = GetModuleHandleA("_ssl_d.pyd")) == NULL) if ((h = GetModuleHandle(NULL)) == NULL /*patched*/)</AfterPatch>
82-
</PropertyGroup>
83-
<Error Text="Cannot find $(Uplink)" Condition="!Exists($(Uplink))" />
84-
<PropertyGroup>
85-
<_Original>$([System.IO.File]::ReadAllText($(Uplink)))</_Original>
86-
<_Patched>$(_Original.Replace($(BeforePatch), $(AfterPatch)))</_Patched>
87-
<IsPatched>false</IsPatched>
88-
<IsPatched Condition="$(_Patched) == $(_Original)">true</IsPatched>
89-
</PropertyGroup>
90-
<Message Text="$(Uplink) is already patched" Importance="normal" Condition="$(IsPatched)" />
91-
<Message Text="Patching $(Uplink)" Importance="high" Condition="!$(IsPatched)" />
92-
<WriteLinesToFile File="$(Uplink)"
93-
Lines="$(_Patched)"
94-
Overwrite="true"
95-
Encoding="ASCII"
96-
Condition="!$(IsPatched)" />
97-
</Target>
98-
9977
<Target Name="_CopyToOutput" AfterTargets="Build">
10078
<ItemGroup>
10179
<_Built Include="$(opensslDir)\LICENSE" />
10280
<_Built Include="$(IntDir)\libcrypto.lib;$(IntDir)\libcrypto-*.dll;$(IntDir)\libcrypto-*.pdb" />
10381
<_Built Include="$(IntDir)\libssl.lib;$(IntDir)\libssl-*.dll;$(IntDir)\libssl-*.pdb" />
104-
<_AppLink Include="$(opensslDir)\ms\applink.c" />
10582
<_Include Include="$(opensslDir)\Include\openssl\*.h" />
10683
<_Include Include="$(IntDir)\include\openssl\*.h" />
10784
</ItemGroup>
10885
<MakeDir Directories="$(opensslOutDir)\include\openssl" />
10986
<Copy SourceFiles="@(_Built)" DestinationFolder="$(opensslOutDir)" />
110-
<Copy SourceFiles="@(_AppLink)" DestinationFolder="$(opensslOutDir)\include" />
11187
<Copy SourceFiles="@(_Include)" DestinationFolder="$(opensslOutDir)\include\openssl" />
11288
</Target>
11389

‎PCbuild/python.props

Copy file name to clipboardExpand all lines: PCbuild/python.props
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -75,8 +75,8 @@
7575
<libffiOutDir Condition="$(libffiOutDir) == ''">$(libffiDir)$(ArchName)\</libffiOutDir>
7676
<libffiIncludeDir Condition="$(libffiIncludeDir) == ''">$(libffiOutDir)include</libffiIncludeDir>
7777
<mpdecimalDir Condition="$(mpdecimalDir) == ''">$(ExternalsDir)\mpdecimal-4.0.0\</mpdecimalDir>
78-
<opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-3.0.15\</opensslDir>
79-
<opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-3.0.15\$(ArchName)\</opensslOutDir>
78+
<opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-3.0.16\</opensslDir>
79+
<opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-3.0.16.1\$(ArchName)\</opensslOutDir>
8080
<opensslIncludeDir Condition="$(opensslIncludeDir) == ''">$(opensslOutDir)include</opensslIncludeDir>
8181
<nasmDir Condition="$(nasmDir) == ''">$(ExternalsDir)\nasm-2.11.06\</nasmDir>
8282
<zlibDir Condition="$(zlibDir) == ''">$(ExternalsDir)\zlib-1.3.1\</zlibDir>

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.