Skip to content

Commit 3364e7e

Browse files
vstinnerpicnixz
vstinner
and
picnixz
authored
gh-146207: Add support for OpenSSL 4.0.0 alpha1 (#146217)
OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
1 parent 08f6b33 commit 3364e7e

File tree

4 files changed

+58
-31
lines changed

4 files changed

+58
-31
lines changed

‎Lib/test/test_ssl.py‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -395,7 +395,7 @@ def test_constants(self):
395395
ssl.OP_NO_COMPRESSION
396396
self.assertEqual(ssl.HAS_SNI, True)
397397
self.assertEqual(ssl.HAS_ECDH, True)
398-
self.assertEqual(ssl.HAS_TLSv1_2, True)
398+
self.assertIsInstance(ssl.HAS_TLSv1_2, bool)
399399
self.assertEqual(ssl.HAS_TLSv1_3, True)
400400
ssl.OP_NO_SSLv2
401401
ssl.OP_NO_SSLv3
@@ -586,11 +586,11 @@ def test_openssl_version(self):
586586
# Some sanity checks follow
587587
# >= 1.1.1
588588
self.assertGreaterEqual(n, 0x10101000)
589-
# < 4.0
590-
self.assertLess(n, 0x40000000)
589+
# < 5.0
590+
self.assertLess(n, 0x50000000)
591591
major, minor, fix, patch, status = t
592592
self.assertGreaterEqual(major, 1)
593-
self.assertLess(major, 4)
593+
self.assertLess(major, 5)
594594
self.assertGreaterEqual(minor, 0)
595595
self.assertLess(minor, 256)
596596
self.assertGreaterEqual(fix, 0)
@@ -656,12 +656,14 @@ def test_openssl111_deprecations(self):
656656
ssl.OP_NO_TLSv1_2,
657657
ssl.OP_NO_TLSv1_3
658658
]
659-
protocols = [
660-
ssl.PROTOCOL_TLSv1,
661-
ssl.PROTOCOL_TLSv1_1,
662-
ssl.PROTOCOL_TLSv1_2,
663-
ssl.PROTOCOL_TLS
664-
]
659+
protocols = []
660+
if hasattr(ssl, 'PROTOCOL_TLSv1'):
661+
protocols.append(ssl.PROTOCOL_TLSv1)
662+
if hasattr(ssl, 'PROTOCOL_TLSv1_1'):
663+
protocols.append(ssl.PROTOCOL_TLSv1_1)
664+
if hasattr(ssl, 'PROTOCOL_TLSv1_2'):
665+
protocols.append(ssl.PROTOCOL_TLSv1_2)
666+
protocols.append(ssl.PROTOCOL_TLS)
665667
versions = [
666668
ssl.TLSVersion.SSLv3,
667669
ssl.TLSVersion.TLSv1,
@@ -1205,6 +1207,7 @@ def test_min_max_version(self):
12051207
ssl.TLSVersion.TLSv1,
12061208
ssl.TLSVersion.TLSv1_1,
12071209
ssl.TLSVersion.TLSv1_2,
1210+
ssl.TLSVersion.TLSv1_3,
12081211
ssl.TLSVersion.SSLv3,
12091212
}
12101213
)
@@ -1218,7 +1221,7 @@ def test_min_max_version(self):
12181221
with self.assertRaises(ValueError):
12191222
ctx.minimum_version = 42
12201223

1221-
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
1224+
if has_tls_protocol('PROTOCOL_TLSv1_1'):
12221225
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1_1)
12231226

12241227
self.assertIn(
@@ -1675,23 +1678,24 @@ def test__create_stdlib_context(self):
16751678
self.assertFalse(ctx.check_hostname)
16761679
self._assert_context_options(ctx)
16771680

1678-
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
1681+
if has_tls_protocol('PROTOCOL_TLSv1'):
16791682
with warnings_helper.check_warnings():
16801683
ctx = ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1)
16811684
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
16821685
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
16831686
self._assert_context_options(ctx)
16841687

1685-
with warnings_helper.check_warnings():
1686-
ctx = ssl._create_stdlib_context(
1687-
ssl.PROTOCOL_TLSv1_2,
1688-
cert_reqs=ssl.CERT_REQUIRED,
1689-
check_hostname=True
1690-
)
1691-
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1692-
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1693-
self.assertTrue(ctx.check_hostname)
1694-
self._assert_context_options(ctx)
1688+
if has_tls_protocol('PROTOCOL_TLSv1_2'):
1689+
with warnings_helper.check_warnings():
1690+
ctx = ssl._create_stdlib_context(
1691+
ssl.PROTOCOL_TLSv1_2,
1692+
cert_reqs=ssl.CERT_REQUIRED,
1693+
check_hostname=True
1694+
)
1695+
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1696+
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1697+
self.assertTrue(ctx.check_hostname)
1698+
self._assert_context_options(ctx)
16951699

16961700
ctx = ssl._create_stdlib_context(purpose=ssl.Purpose.CLIENT_AUTH)
16971701
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_SERVER)
@@ -3654,10 +3658,10 @@ def test_protocol_tlsv1_2(self):
36543658
client_options=ssl.OP_NO_TLSv1_2)
36553659

36563660
try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2')
3657-
if has_tls_protocol(ssl.PROTOCOL_TLSv1):
3661+
if has_tls_protocol('PROTOCOL_TLSv1'):
36583662
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False)
36593663
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False)
3660-
if has_tls_protocol(ssl.PROTOCOL_TLSv1_1):
3664+
if has_tls_protocol('PROTOCOL_TLSv1_1'):
36613665
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
36623666
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False)
36633667

‎Modules/_ssl.c‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,17 @@ static void _PySSLFixErrno(void) {
164164
#error Unsupported OpenSSL version
165165
#endif
166166

167+
#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
168+
# define OPENSSL_NO_SSL3
169+
# define OPENSSL_NO_TLS1
170+
# define OPENSSL_NO_TLS1_1
171+
# define OPENSSL_NO_TLS1_2
172+
# define OPENSSL_NO_SSL3_METHOD
173+
# define OPENSSL_NO_TLS1_METHOD
174+
# define OPENSSL_NO_TLS1_1_METHOD
175+
# define OPENSSL_NO_TLS1_2_METHOD
176+
#endif
177+
167178
/* OpenSSL API 1.1.0+ does not include version methods */
168179
#ifndef OPENSSL_NO_SSL3_METHOD
169180
extern const SSL_METHOD *SSLv3_method(void);
@@ -1151,7 +1162,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name)
11511162

11521163
static PyObject *
11531164
_create_tuple_for_attribute(_sslmodulestate *state,
1154-
ASN1_OBJECT *name, ASN1_STRING *value)
1165+
const ASN1_OBJECT *name, const ASN1_STRING *value)
11551166
{
11561167
Py_ssize_t buflen;
11571168
PyObject *pyattr;
@@ -1180,16 +1191,16 @@ _create_tuple_for_attribute(_sslmodulestate *state,
11801191
}
11811192

11821193
static PyObject *
1183-
_create_tuple_for_X509_NAME (_sslmodulestate *state, X509_NAME *xname)
1194+
_create_tuple_for_X509_NAME(_sslmodulestate *state, const X509_NAME *xname)
11841195
{
11851196
PyObject *dn = NULL; /* tuple which represents the "distinguished name" */
11861197
PyObject *rdn = NULL; /* tuple to hold a "relative distinguished name" */
11871198
PyObject *rdnt;
11881199
PyObject *attr = NULL; /* tuple to hold an attribute */
11891200
int entry_count = X509_NAME_entry_count(xname);
1190-
X509_NAME_ENTRY *entry;
1191-
ASN1_OBJECT *name;
1192-
ASN1_STRING *value;
1201+
const X509_NAME_ENTRY *entry;
1202+
const ASN1_OBJECT *name;
1203+
const ASN1_STRING *value;
11931204
int index_counter;
11941205
int rdn_level = -1;
11951206
int retcode;
@@ -6967,9 +6978,15 @@ sslmodule_init_constants(PyObject *m)
69676978
ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
69686979
ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
69696980
ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
6981+
#ifndef OPENSSL_NO_TLS1
69706982
ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
6983+
#endif
6984+
#ifndef OPENSSL_NO_TLS1_1
69716985
ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
6986+
#endif
6987+
#ifndef OPENSSL_NO_TLS1_2
69726988
ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
6989+
#endif
69736990

69746991
#define ADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1
69756992

‎Modules/_ssl/cert.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,8 @@ _ssl_Certificate_get_info_impl(PySSLCertificate *self)
128128
}
129129

130130
static PyObject*
131-
_x509name_print(_sslmodulestate *state, X509_NAME *name, int indent, unsigned long flags)
131+
_x509name_print(_sslmodulestate *state, const X509_NAME *name,
132+
int indent, unsigned long flags)
132133
{
133134
PyObject *res;
134135
BIO *biobuf;

‎Tools/ssl/multissltests.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -429,9 +429,11 @@ class BuildOpenSSL(AbstractBuilder):
429429
def _post_install(self):
430430
if self.version.startswith("3."):
431431
self._post_install_3xx()
432+
elif self.version.startswith("4."):
433+
self._post_install_4xx()
432434

433435
def _build_src(self, config_args=()):
434-
if self.version.startswith("3."):
436+
if self.version.startswith(("3.", "4.")):
435437
config_args += ("enable-fips",)
436438
super()._build_src(config_args)
437439

@@ -447,6 +449,9 @@ def _post_install_3xx(self):
447449
lib64 = self.lib_dir + "64"
448450
os.symlink(lib64, self.lib_dir)
449451

452+
def _post_install_4xx(self):
453+
self._post_install_3xx()
454+
450455
@property
451456
def short_version(self):
452457
"""Short version for OpenSSL download URL"""

0 commit comments

Comments
 (0)