Skip to content

Commit 82b17f4

Browse files
zoobaseehwan80
zooba
authored and
seehwan80
committed
pythongh-131423: Update to OpenSSL 3.0.16. (pythonGH-131839)
The bin tag is 3.0.16.1 because we rebuilt without uplink support to fix pythongh-131804. This PR also prevents making calls that are now unsafe without uplink, and updates the tests to property interpret these failures as unsupported.
1 parent 90b4973 commit 82b17f4

File tree

12 files changed

+74
-53
lines changed

12 files changed

+74
-53
lines changed

‎Lib/test/audit-tests.py‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -208,7 +208,15 @@ def test_open(testfn):
208208
if not fn:
209209
continue
210210
with assertRaises(RuntimeError):
211-
fn(*args)
211+
try:
212+
fn(*args)
213+
except NotImplementedError:
214+
if fn == load_dh_params:
215+
# Not callable in some builds
216+
load_dh_params = None
217+
raise RuntimeError
218+
else:
219+
raise
212220

213221
actual_mode = [(a[0], a[1]) for e, a in hook.seen if e == "open" and a[1]]
214222
actual_flag = [(a[0], a[2]) for e, a in hook.seen if e == "open" and not a[1]]

‎Lib/test/test_audit.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ def run_test_in_subprocess(self, *args):
2323
with subprocess.Popen(
2424
[sys.executable, "-X utf8", AUDIT_TESTS_PY, *args],
2525
encoding="utf-8",
26+
errors="backslashreplace",
2627
stdout=subprocess.PIPE,
2728
stderr=subprocess.PIPE,
2829
) as p:

‎Lib/test/test_ssl.py‎

Lines changed: 39 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1321,10 +1321,14 @@ def test_load_verify_cadata(self):
13211321
with self.assertRaises(ssl.SSLError):
13221322
ctx.load_verify_locations(cadata=cacert_der + b"A")
13231323

1324-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
13251324
def test_load_dh_params(self):
13261325
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
1327-
ctx.load_dh_params(DHFILE)
1326+
try:
1327+
ctx.load_dh_params(DHFILE)
1328+
except RuntimeError:
1329+
if Py_DEBUG_WIN32:
1330+
self.skipTest("not supported on Win32 debug build")
1331+
raise
13281332
ctx.load_dh_params(BYTES_DHFILE)
13291333
self.assertRaises(TypeError, ctx.load_dh_params)
13301334
self.assertRaises(TypeError, ctx.load_dh_params, None)
@@ -1648,12 +1652,17 @@ def test_str(self):
16481652
self.assertEqual(str(e), "foo")
16491653
self.assertEqual(e.errno, 1)
16501654

1651-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
16521655
def test_lib_reason(self):
16531656
# Test the library and reason attributes
16541657
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
1655-
with self.assertRaises(ssl.SSLError) as cm:
1656-
ctx.load_dh_params(CERTFILE)
1658+
try:
1659+
with self.assertRaises(ssl.SSLError) as cm:
1660+
ctx.load_dh_params(CERTFILE)
1661+
except RuntimeError:
1662+
if Py_DEBUG_WIN32:
1663+
self.skipTest("not supported on Win32 debug build")
1664+
raise
1665+
16571666
self.assertEqual(cm.exception.library, 'PEM')
16581667
regex = "(NO_START_LINE|UNSUPPORTED_PUBLIC_KEY_TYPE)"
16591668
self.assertRegex(cm.exception.reason, regex)
@@ -4032,13 +4041,17 @@ def test_no_legacy_server_connect(self):
40324041
chatty=True, connectionchatty=True,
40334042
sni_name=hostname)
40344043

4035-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
40364044
def test_dh_params(self):
40374045
# Check we can get a connection with ephemeral Diffie-Hellman
40384046
client_context, server_context, hostname = testing_context()
40394047
# test scenario needs TLS <= 1.2
40404048
client_context.maximum_version = ssl.TLSVersion.TLSv1_2
4041-
server_context.load_dh_params(DHFILE)
4049+
try:
4050+
server_context.load_dh_params(DHFILE)
4051+
except RuntimeError:
4052+
if Py_DEBUG_WIN32:
4053+
self.skipTest("not supported on Win32 debug build")
4054+
raise
40424055
server_context.set_ciphers("kEDH")
40434056
server_context.maximum_version = ssl.TLSVersion.TLSv1_2
40444057
stats = server_params_test(client_context, server_context,
@@ -4819,14 +4832,18 @@ def keylog_lines(self, fname=os_helper.TESTFN):
48194832
return len(list(f))
48204833

48214834
@requires_keylog
4822-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48234835
def test_keylog_defaults(self):
48244836
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48254837
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
48264838
self.assertEqual(ctx.keylog_filename, None)
48274839

48284840
self.assertFalse(os.path.isfile(os_helper.TESTFN))
4829-
ctx.keylog_filename = os_helper.TESTFN
4841+
try:
4842+
ctx.keylog_filename = os_helper.TESTFN
4843+
except RuntimeError:
4844+
if Py_DEBUG_WIN32:
4845+
self.skipTest("not supported on Win32 debug build")
4846+
raise
48304847
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
48314848
self.assertTrue(os.path.isfile(os_helper.TESTFN))
48324849
self.assertEqual(self.keylog_lines(), 1)
@@ -4843,12 +4860,17 @@ def test_keylog_defaults(self):
48434860
ctx.keylog_filename = 1
48444861

48454862
@requires_keylog
4846-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48474863
def test_keylog_filename(self):
48484864
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48494865
client_context, server_context, hostname = testing_context()
48504866

4851-
client_context.keylog_filename = os_helper.TESTFN
4867+
try:
4868+
client_context.keylog_filename = os_helper.TESTFN
4869+
except RuntimeError:
4870+
if Py_DEBUG_WIN32:
4871+
self.skipTest("not supported on Win32 debug build")
4872+
raise
4873+
48524874
server = ThreadedEchoServer(context=server_context, chatty=False)
48534875
with server:
48544876
with client_context.wrap_socket(socket.socket(),
@@ -4881,7 +4903,6 @@ def test_keylog_filename(self):
48814903
@requires_keylog
48824904
@unittest.skipIf(sys.flags.ignore_environment,
48834905
"test is not compatible with ignore_environment")
4884-
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
48854906
def test_keylog_env(self):
48864907
self.addCleanup(os_helper.unlink, os_helper.TESTFN)
48874908
with unittest.mock.patch.dict(os.environ):
@@ -4891,7 +4912,12 @@ def test_keylog_env(self):
48914912
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
48924913
self.assertEqual(ctx.keylog_filename, None)
48934914

4894-
ctx = ssl.create_default_context()
4915+
try:
4916+
ctx = ssl.create_default_context()
4917+
except RuntimeError:
4918+
if Py_DEBUG_WIN32:
4919+
self.skipTest("not supported on Win32 debug build")
4920+
raise
48954921
self.assertEqual(ctx.keylog_filename, os_helper.TESTFN)
48964922

48974923
ctx = ssl._create_stdlib_context()

‎Misc/NEWS.d/next/Windows/2025-03-28-13-22-55.gh-issue-131423.vI-LqV.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
Update bundled version of OpenSSL to 3.0.16. The new build also disables
2+
uplink support, which may be relevant to embedders but has no impact on
3+
normal use.

‎Misc/externals.spdx.json‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,21 +70,21 @@
7070
"checksums": [
7171
{
7272
"algorithm": "SHA256",
73-
"checksumValue": "1550c87996a0858474a9dd179deab2c55eb73726b9a140b32865b02fd3d8a86b"
73+
"checksumValue": "6bb739ecddbd2cfb6d255eb5898437a9b5739277dee931338d3275bac5d96ba2"
7474
}
7575
],
76-
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.15.tar.gz",
76+
"downloadLocation": "https://github.com/python/cpython-source-deps/archive/refs/tags/openssl-3.0.16.tar.gz",
7777
"externalRefs": [
7878
{
7979
"referenceCategory": "SECURITY",
80-
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.15:*:*:*:*:*:*:*",
80+
"referenceLocator": "cpe:2.3:a:openssl:openssl:3.0.16:*:*:*:*:*:*:*",
8181
"referenceType": "cpe23Type"
8282
}
8383
],
8484
"licenseConcluded": "NOASSERTION",
8585
"name": "openssl",
8686
"primaryPackagePurpose": "SOURCE",
87-
"versionInfo": "3.0.15"
87+
"versionInfo": "3.0.16"
8888
},
8989
{
9090
"SPDXID": "SPDXRef-PACKAGE-sqlite",

‎Modules/_ssl.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4427,6 +4427,12 @@ _ssl__SSLContext_load_dh_params_impl(PySSLContext *self, PyObject *filepath)
44274427
FILE *f;
44284428
DH *dh;
44294429

4430+
#if defined(MS_WINDOWS) && defined(_DEBUG)
4431+
PyErr_SetString(PyExc_NotImplementedError,
4432+
"load_dh_params: unavailable on Windows debug build");
4433+
return NULL;
4434+
#endif
4435+
44304436
f = Py_fopen(filepath, "rb");
44314437
if (f == NULL)
44324438
return NULL;

‎Modules/_ssl/debughelpers.c‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,13 @@ _PySSLContext_set_keylog_filename(PyObject *op, PyObject *arg,
174174
{
175175
PySSLContext *self = PySSLContext_CAST(op);
176176
FILE *fp;
177+
178+
#if defined(MS_WINDOWS) && defined(_DEBUG)
179+
PyErr_SetString(PyExc_NotImplementedError,
180+
"set_keylog_filename: unavailable on Windows debug build");
181+
return -1;
182+
#endif
183+
177184
/* Reset variables and callback first */
178185
SSL_CTX_set_keylog_callback(self->ctx, NULL);
179186
Py_CLEAR(self->keylog_filename);

‎PCbuild/_ssl.vcxproj‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,9 +99,6 @@
9999
</ItemDefinitionGroup>
100100
<ItemGroup>
101101
<ClCompile Include="..\Modules\_ssl.c" />
102-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
103-
<PreprocessorDefinitions>_CRT_SECURE_NO_WARNINGS;$(PreprocessorDefinitions)</PreprocessorDefinitions>
104-
</ClCompile>
105102
</ItemGroup>
106103
<ItemGroup>
107104
<ResourceCompile Include="..\PC\python_nt.rc" />

‎PCbuild/_ssl.vcxproj.filters‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,6 @@
1212
<ClCompile Include="..\Modules\_ssl.c">
1313
<Filter>Source Files</Filter>
1414
</ClCompile>
15-
<ClCompile Include="$(opensslIncludeDir)\applink.c">
16-
<Filter>Source Files</Filter>
17-
</ClCompile>
1815
</ItemGroup>
1916
<ItemGroup>
2017
<ResourceCompile Include="..\PC\python_nt.rc">

‎PCbuild/get_externals.bat‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ echo.Fetching external libraries...
5353
set libraries=
5454
set libraries=%libraries% bzip2-1.0.8
5555
if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.4.4
56-
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.15
56+
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-3.0.16
5757
set libraries=%libraries% mpdecimal-4.0.0
5858
set libraries=%libraries% sqlite-3.45.3.0
5959
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.15.0
@@ -77,7 +77,7 @@ echo.Fetching external binaries...
7777

7878
set binaries=
7979
if NOT "%IncludeLibffi%"=="false" set binaries=%binaries% libffi-3.4.4
80-
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.15
80+
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-3.0.16.1
8181
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.15.0
8282
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06
8383

0 commit comments

Comments
 (0)