Skip to content

Commit 3364e7e

Browse files
vstinnerpicnixz
vstinner
and
picnixz
authored
gh-146207: Add support for OpenSSL 4.0.0 alpha1 (#146217)
OpenSSL 4.0.0 alpha1 removed these functions: * SSLv3_method() * TLSv1_method() * TLSv1_1_method() * TLSv1_2_method() Other changes: * Update test_openssl_version(). * Update multissltests.py for OpenSSL 4. * Add const qualifier to fix compiler warnings. Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
1 parent 08f6b33 commit 3364e7e

4 files changed

Lines changed: 58 additions & 31 deletions

File tree

‎Lib/test/test_ssl.py‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -395,7 +395,7 @@ def test_constants(self):
395395
ssl.OP_NO_COMPRESSION
396396
self.assertEqual(ssl.HAS_SNI, True)
397397
self.assertEqual(ssl.HAS_ECDH, True)
398-
self.assertEqual(ssl.HAS_TLSv1_2, True)
398+
self.assertIsInstance(ssl.HAS_TLSv1_2, bool)
399399
self.assertEqual(ssl.HAS_TLSv1_3, True)
400400
ssl.OP_NO_SSLv2
401401
ssl.OP_NO_SSLv3
@@ -586,11 +586,11 @@ def test_openssl_version(self):
586586
# Some sanity checks follow
587587
# >= 1.1.1
588588
self.assertGreaterEqual(n, 0x10101000)
589-
# < 4.0
590-
self.assertLess(n, 0x40000000)
589+
# < 5.0
590+
self.assertLess(n, 0x50000000)
591591
major, minor, fix, patch, status=t
592592
self.assertGreaterEqual(major, 1)
593-
self.assertLess(major, 4)
593+
self.assertLess(major, 5)
594594
self.assertGreaterEqual(minor, 0)
595595
self.assertLess(minor, 256)
596596
self.assertGreaterEqual(fix, 0)
@@ -656,12 +656,14 @@ def test_openssl111_deprecations(self):
656656
ssl.OP_NO_TLSv1_2,
657657
ssl.OP_NO_TLSv1_3
658658
]
659-
protocols= [
660-
ssl.PROTOCOL_TLSv1,
661-
ssl.PROTOCOL_TLSv1_1,
662-
ssl.PROTOCOL_TLSv1_2,
663-
ssl.PROTOCOL_TLS
664-
]
659+
protocols= []
660+
ifhasattr(ssl, 'PROTOCOL_TLSv1'):
661+
protocols.append(ssl.PROTOCOL_TLSv1)
662+
ifhasattr(ssl, 'PROTOCOL_TLSv1_1'):
663+
protocols.append(ssl.PROTOCOL_TLSv1_1)
664+
ifhasattr(ssl, 'PROTOCOL_TLSv1_2'):
665+
protocols.append(ssl.PROTOCOL_TLSv1_2)
666+
protocols.append(ssl.PROTOCOL_TLS)
665667
versions= [
666668
ssl.TLSVersion.SSLv3,
667669
ssl.TLSVersion.TLSv1,
@@ -1205,6 +1207,7 @@ def test_min_max_version(self):
12051207
ssl.TLSVersion.TLSv1,
12061208
ssl.TLSVersion.TLSv1_1,
12071209
ssl.TLSVersion.TLSv1_2,
1210+
ssl.TLSVersion.TLSv1_3,
12081211
ssl.TLSVersion.SSLv3,
12091212
}
12101213
)
@@ -1218,7 +1221,7 @@ def test_min_max_version(self):
12181221
withself.assertRaises(ValueError):
12191222
ctx.minimum_version=42
12201223

1221-
ifhas_tls_protocol(ssl.PROTOCOL_TLSv1_1):
1224+
ifhas_tls_protocol('PROTOCOL_TLSv1_1'):
12221225
ctx=ssl.SSLContext(ssl.PROTOCOL_TLSv1_1)
12231226

12241227
self.assertIn(
@@ -1675,23 +1678,24 @@ def test__create_stdlib_context(self):
16751678
self.assertFalse(ctx.check_hostname)
16761679
self._assert_context_options(ctx)
16771680

1678-
ifhas_tls_protocol(ssl.PROTOCOL_TLSv1):
1681+
ifhas_tls_protocol('PROTOCOL_TLSv1'):
16791682
withwarnings_helper.check_warnings():
16801683
ctx=ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1)
16811684
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1)
16821685
self.assertEqual(ctx.verify_mode, ssl.CERT_NONE)
16831686
self._assert_context_options(ctx)
16841687

1685-
withwarnings_helper.check_warnings():
1686-
ctx=ssl._create_stdlib_context(
1687-
ssl.PROTOCOL_TLSv1_2,
1688-
cert_reqs=ssl.CERT_REQUIRED,
1689-
check_hostname=True
1690-
)
1691-
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1692-
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1693-
self.assertTrue(ctx.check_hostname)
1694-
self._assert_context_options(ctx)
1688+
ifhas_tls_protocol('PROTOCOL_TLSv1_2'):
1689+
withwarnings_helper.check_warnings():
1690+
ctx=ssl._create_stdlib_context(
1691+
ssl.PROTOCOL_TLSv1_2,
1692+
cert_reqs=ssl.CERT_REQUIRED,
1693+
check_hostname=True
1694+
)
1695+
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLSv1_2)
1696+
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
1697+
self.assertTrue(ctx.check_hostname)
1698+
self._assert_context_options(ctx)
16951699

16961700
ctx=ssl._create_stdlib_context(purpose=ssl.Purpose.CLIENT_AUTH)
16971701
self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS_SERVER)
@@ -3654,10 +3658,10 @@ def test_protocol_tlsv1_2(self):
36543658
client_options=ssl.OP_NO_TLSv1_2)
36553659

36563660
try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2')
3657-
ifhas_tls_protocol(ssl.PROTOCOL_TLSv1):
3661+
ifhas_tls_protocol('PROTOCOL_TLSv1'):
36583662
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1, False)
36593663
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_2, False)
3660-
ifhas_tls_protocol(ssl.PROTOCOL_TLSv1_1):
3664+
ifhas_tls_protocol('PROTOCOL_TLSv1_1'):
36613665
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_1, False)
36623666
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_2, False)
36633667

‎Modules/_ssl.c‎

Lines changed: 22 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,17 @@ static void _PySSLFixErrno(void) {
164164
#error Unsupported OpenSSL version
165165
#endif
166166

167+
#if (OPENSSL_VERSION_NUMBER >= 0x40000000L)
168+
# defineOPENSSL_NO_SSL3
169+
# defineOPENSSL_NO_TLS1
170+
# defineOPENSSL_NO_TLS1_1
171+
# defineOPENSSL_NO_TLS1_2
172+
# defineOPENSSL_NO_SSL3_METHOD
173+
# defineOPENSSL_NO_TLS1_METHOD
174+
# defineOPENSSL_NO_TLS1_1_METHOD
175+
# defineOPENSSL_NO_TLS1_2_METHOD
176+
#endif
177+
167178
/* OpenSSL API 1.1.0+ does not include version methods */
168179
#ifndefOPENSSL_NO_SSL3_METHOD
169180
externconstSSL_METHOD*SSLv3_method(void);
@@ -1151,7 +1162,7 @@ _asn1obj2py(_sslmodulestate *state, const ASN1_OBJECT *name, int no_name)
11511162

11521163
staticPyObject*
11531164
_create_tuple_for_attribute(_sslmodulestate*state,
1154-
ASN1_OBJECT*name, ASN1_STRING*value)
1165+
constASN1_OBJECT*name,constASN1_STRING*value)
11551166
{
11561167
Py_ssize_tbuflen;
11571168
PyObject*pyattr;
@@ -1180,16 +1191,16 @@ _create_tuple_for_attribute(_sslmodulestate *state,
11801191
}
11811192

11821193
staticPyObject*
1183-
_create_tuple_for_X509_NAME(_sslmodulestate*state, X509_NAME*xname)
1194+
_create_tuple_for_X509_NAME(_sslmodulestate*state,constX509_NAME*xname)
11841195
{
11851196
PyObject*dn=NULL; /* tuple which represents the "distinguished name" */
11861197
PyObject*rdn=NULL; /* tuple to hold a "relative distinguished name" */
11871198
PyObject*rdnt;
11881199
PyObject*attr=NULL; /* tuple to hold an attribute */
11891200
intentry_count=X509_NAME_entry_count(xname);
1190-
X509_NAME_ENTRY*entry;
1191-
ASN1_OBJECT*name;
1192-
ASN1_STRING*value;
1201+
constX509_NAME_ENTRY*entry;
1202+
constASN1_OBJECT*name;
1203+
constASN1_STRING*value;
11931204
intindex_counter;
11941205
intrdn_level=-1;
11951206
intretcode;
@@ -6967,9 +6978,15 @@ sslmodule_init_constants(PyObject *m)
69676978
ADD_INT_CONST("PROTOCOL_TLS", PY_SSL_VERSION_TLS);
69686979
ADD_INT_CONST("PROTOCOL_TLS_CLIENT", PY_SSL_VERSION_TLS_CLIENT);
69696980
ADD_INT_CONST("PROTOCOL_TLS_SERVER", PY_SSL_VERSION_TLS_SERVER);
6981+
#ifndefOPENSSL_NO_TLS1
69706982
ADD_INT_CONST("PROTOCOL_TLSv1", PY_SSL_VERSION_TLS1);
6983+
#endif
6984+
#ifndefOPENSSL_NO_TLS1_1
69716985
ADD_INT_CONST("PROTOCOL_TLSv1_1", PY_SSL_VERSION_TLS1_1);
6986+
#endif
6987+
#ifndefOPENSSL_NO_TLS1_2
69726988
ADD_INT_CONST("PROTOCOL_TLSv1_2", PY_SSL_VERSION_TLS1_2);
6989+
#endif
69736990

69746991
#defineADD_OPTION(NAME, VALUE) if (sslmodule_add_option(m, NAME, (VALUE)) < 0) return -1
69756992

‎Modules/_ssl/cert.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,8 @@ _ssl_Certificate_get_info_impl(PySSLCertificate *self)
128128
}
129129

130130
staticPyObject*
131-
_x509name_print(_sslmodulestate*state, X509_NAME*name, intindent, unsigned longflags)
131+
_x509name_print(_sslmodulestate*state, constX509_NAME*name,
132+
intindent, unsigned longflags)
132133
{
133134
PyObject*res;
134135
BIO*biobuf;

‎Tools/ssl/multissltests.py‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -429,9 +429,11 @@ class BuildOpenSSL(AbstractBuilder):
429429
def_post_install(self):
430430
ifself.version.startswith("3."):
431431
self._post_install_3xx()
432+
elifself.version.startswith("4."):
433+
self._post_install_4xx()
432434

433435
def_build_src(self, config_args=()):
434-
ifself.version.startswith("3."):
436+
ifself.version.startswith(("3.", "4.")):
435437
config_args+= ("enable-fips",)
436438
super()._build_src(config_args)
437439

@@ -447,6 +449,9 @@ def _post_install_3xx(self):
447449
lib64=self.lib_dir+"64"
448450
os.symlink(lib64, self.lib_dir)
449451

452+
def_post_install_4xx(self):
453+
self._post_install_3xx()
454+
450455
@property
451456
defshort_version(self):
452457
"""Short version for OpenSSL download URL"""

0 commit comments

Comments
 (0)