Skip to content

Commit dfb6372

Browse files
zoobazooba
authored
gh-131423: Update to OpenSSL 3.0.16. (GH-131839)
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix gh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
1 parent 7d447ac commit dfb6372

File tree

12 files changed

+74
-53
lines changed

12 files changed

+74
-53
lines changed

‎Lib/test/audit-tests.py‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,15 @@ def test_open(testfn):
208208
if not fn:
209209
continue
210210
with assertRaises(RuntimeError):
211-
fn(*args)
211+
try:
212+
fn(*args)
213+
except NotImplementedError:
214+
if fn == load_dh_params:
215+
# Not callable in some builds
216+
load_dh_params = None
217+
raise RuntimeError
218+
else:
219+
raise
212220

213221
actual_mode = [(a[0], a[1]) for e, a in hook.seen if e == "open" and a[1]]
214222
actual_flag = [(a[0], a[2]) for e, a in hook.seen if e == "open" and not a[1]]

‎Lib/test/test_audit.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ def do_test(self, *args):
2323
with subprocess.Popen(
2424
[sys.executable, "-X utf8", AUDIT_TESTS_PY, *args],
2525
encoding="utf-8",
26+
errors="backslashreplace",
2627
stdout=subprocess.PIPE,
2728
stderr=subprocess.PIPE,
2829
) as p:

‎Lib/test/test_ssl.py‎

Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1326,10 +1326,14 @@ def test_load_verify_cadata(self):
13261326
with self.assertRaises(ssl.SSLError):
13271327
ctx.load_verify_locations(cadata=cacert_der + b"A")
13281328

1329-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
13301329
def test_load_dh_params(self):
13311330
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
1332-
ctx.load_dh_params(DHFILE)
1331+
try:
1332+
ctx.load_dh_params(DHFILE)
1333+
except RuntimeError:
1334+
if Py_DEBUG_WIN32:
1335+
self.skipTest("not supported on Win32 debug build")
1336+
raise
13331337
if os.name != 'nt':
13341338
ctx.load_dh_params(BYTES_DHFILE)
13351339
self.assertRaises(TypeError, ctx.load_dh_params)
@@ -1650,12 +1654,17 @@ def test_str(self):
16501654
self.assertEqual(str(e), "foo")
16511655
self.assertEqual(e.errno, 1)
16521656

1653-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
16541657
def test_lib_reason(self):
16551658
# Test the library and reason attributes
16561659
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
1657-
with self.assertRaises(ssl.SSLError) as cm:
1658-
ctx.load_dh_params(CERTFILE)
1660+
try:
1661+
with self.assertRaises(ssl.SSLError) as cm:
1662+
ctx.load_dh_params(CERTFILE)
1663+
except RuntimeError:
1664+
if Py_DEBUG_WIN32:
1665+
self.skipTest("not supported on Win32 debug build")
1666+
raise
1667+
16591668
self.assertEqual(cm.exception.library, 'PEM')
16601669
regex = "(NO_START_LINE|UNSUPPORTED_PUBLIC_KEY_TYPE)"
16611670
self.assertRegex(cm.exception.reason, regex)
@@ -3960,13 +3969,17 @@ def test_no_legacy_server_connect(self):
39603969
chatty=True, connectionchatty=True,
39613970
sni_name=hostname)
39623971

3963-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
39643972
def test_dh_params(self):
39653973
# Check we can get a connection with ephemeral Diffie-Hellman
39663974
client_context, server_context, hostname = testing_context()
39673975
# test scenario needs TLS <= 1.2
39683976
client_context.maximum_version = ssl.TLSVersion.TLSv1_2
3969-
server_context.load_dh_params(DHFILE)
3977+
try:
3978+
server_context.load_dh_params(DHFILE)
3979+
except RuntimeError:
3980+
if Py_DEBUG_WIN32:
3981+
self.skipTest("not supported on Win32 debug build")
3982+
raise
39703983
server_context.set_ciphers("kEDH")
39713984
server_context.maximum_version = ssl.TLSVersion.TLSv1_2
39723985
stats = server_params_test(client_context, server_context,
@@ -4607,14 +4620,18 @@ def keylog_lines(self, fname=os_helper.TESTFN):
46074620
return len(list(f))
46084621

46094622
@requires_keylog
4610-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
46114623
def test_keylog_defaults(self):
46124624
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
46134625
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
46144626
self.assertEqual(ctx.keylog_filename, None)
46154627

46164628
self.assertFalse(os.path.isfile(os_helper.TESTFN))
4617-
ctx.keylog_filename = os_helper.TESTFN
4629+
try:
4630+
ctx.keylog_filename = os_helper.TESTFN
4631+
except RuntimeError:
4632+
if Py_DEBUG_WIN32:
4633+
self.skipTest("not supported on Win32 debug build")
4634+
raise
46184635
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
46194636
self.assertTrue(os.path.isfile(os_helper.TESTFN))
46204637
self.assertEqual(self.keylog_lines(), 1)
@@ -4631,12 +4648,17 @@ def test_keylog_defaults(self):
46314648
ctx.keylog_filename = 1
46324649

46334650
@requires_keylog
4634-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
46354651
def test_keylog_filename(self):
46364652
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
46374653
client_context, server_context, hostname = testing_context()
46384654

4639-
client_context.keylog_filename = os_helper.TESTFN
4655+
try:
4656+
client_context.keylog_filename = os_helper.TESTFN
4657+
except RuntimeError:
4658+
if Py_DEBUG_WIN32:
4659+
self.skipTest("not supported on Win32 debug build")
4660+
raise
4661+
46404662
server = ThreadedEchoServer(context=server_context, chatty=False)
46414663
with server:
46424664
with client_context.wrap_socket(socket.socket(),
@@ -4669,7 +4691,6 @@ def test_keylog_filename(self):
46694691
@requires_keylog
46704692
@unittest.skipIf(sys.flags.ignore_environment,
46714693
"test is not compatible with ignore_environment")
4672-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
46734694
def test_keylog_env(self):
46744695
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
46754696
with unittest.mock.patch.dict(os.environ):
@@ -4679,7 +4700,12 @@ def test_keylog_env(self):
46794700
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
46804701
self.assertEqual(ctx.keylog_filename, None)
46814702

4682-
ctx = ssl.create_default_context()
4703+
try:
4704+
ctx = ssl.create_default_context()
4705+
except RuntimeError:
4706+
if Py_DEBUG_WIN32:
4707+
self.skipTest("not supported on Win32 debug build")
4708+
raise
46834709
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
46844710

46854711
ctx = ssl._create_stdlib_context()

‎Misc/NEWS.d/next/Windows/2025-03-28-13-22-55.gh-issue-131423.vI-LqV.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Update bundled version of OpenSSL to 3.0.16. The new build also disables
2+
uplink support, which may be relevant to embedders but has no impact on
3+
normal use.

‎Misc/externals.spdx.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,21 +48,21 @@
4848
"checksums": [
4949
{
5050
"algorithm": "SHA256",
51-
"checksumValue": "1550c87996a0858474a9dd179deab2c55eb73726b9a140b32865b02fd3d8a86b"
51+
"checksumValue": "6bb739ecddbd2cfb6d255eb5898437a9b5739277dee931338d3275bac5d96ba2"
5252
}
5353
],
54-
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.15.tar.gz",
54+
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.16.tar.gz",
5555
"externalRefs": [
5656
{
5757
"referenceCategory": "SECURITY",
58-
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.15:*:*:*:*:*:*:*",
58+
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.16:*:*:*:*:*:*:*",
5959
"referenceType": "cpe23Type"
6060
}
6161
],
6262
"licenseConcluded": "NOASSERTION",
6363
"name": "openssl",
6464
"primaryPackagePurpose": "SOURCE",
65-
"versionInfo": "3.0.15"
65+
"versionInfo": "3.0.16"
6666
},
6767
{
6868
"SPDXID": "SPDXRef-PACKAGE-sqlite",

‎Modules/_ssl.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4136,6 +4136,12 @@ _ssl__SSLContext_load_dh_params(PySSLContext *self, PyObject *filepath)
41364136
FILE *f;
41374137
DH *dh;
41384138

4139+
#if defined(MS_WINDOWS) && defined(_DEBUG)
4140+
PyErr_SetString(PyExc_NotImplementedError,
4141+
"load_dh_params: unavailable on Windows debug build");
4142+
return NULL;
4143+
#endif
4144+
41394145
f = _Py_fopen_obj(filepath, "rb");
41404146
if (f == NULL)
41414147
return NULL;

‎Modules/_ssl/debughelpers.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,13 @@ _PySSLContext_get_keylog_filename(PySSLContext *self, void *c) {
164164
static int
165165
_PySSLContext_set_keylog_filename(PySSLContext *self, PyObject *arg, void *c) {
166166
FILE *fp;
167+
168+
#if defined(MS_WINDOWS) && defined(_DEBUG)
169+
PyErr_SetString(PyExc_NotImplementedError,
170+
"set_keylog_filename: unavailable on Windows debug build");
171+
return -1;
172+
#endif
173+
167174
/* Reset variables and callback first */
168175
SSL_CTX_set_keylog_callback(self->ctx, NULL);
169176
Py_CLEAR(self->keylog_filename);

‎PCbuild/_ssl.vcxproj‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,6 @@
9999
</ItemDefinitionGroup>
100100
<ItemGroup>
101101
<ClCompile Include="..\Modules\_ssl.c" />
102-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
103-
<PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;$(PreprocessorDefinitions)</PreprocessorDefinitions>
104-
</ClCompile>
105102
</ItemGroup>
106103
<ItemGroup>
107104
<ResourceCompile Include="..\PC\python_nt.rc" />

‎PCbuild/_ssl.vcxproj.filters‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@
1212
<ClCompile Include="..\Modules\_ssl.c">
1313
<Filter>Source Files</Filter>
1414
</ClCompile>
15-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
16-
<Filter>Source Files</Filter>
17-
</ClCompile>
1815
</ItemGroup>
1916
<ItemGroup>
2017
<ResourceCompile Include="..\PC\python_nt.rc">

‎PCbuild/get_externals.bat‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ echo.Fetching external libraries...
5353
set libraries=
5454
set libraries=%libraries% bzip2-1.0.8
5555
if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.4.4
56-
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.15
56+
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.16
5757
set libraries=%libraries% sqlite-3.45.3.0
5858
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.15.0
5959
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tk-8.6.15.0
@@ -77,7 +77,7 @@ echo.Fetching external binaries...
7777

7878
set binaries=
7979
if NOT "%IncludeLibffi%"=="false" set binaries=%binaries% libffi-3.4.4
80-
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.15
80+
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.16.1
8181
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.15.2
8282
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06
8383

0 commit comments

Comments
 (0)