Skip to content

[3.14] gh-148292: Add OpenSSL 4 support - #149783

Closed
vstinner wants to merge 6 commits into
python:3.14from
vstinner:openssl4
Closed

[3.14] gh-148292: Add OpenSSL 4 support#149783
vstinner wants to merge 6 commits into
python:3.14from
vstinner:openssl4

Conversation

@vstinner

@vstinnervstinner commented May 13, 2026•
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Member

vstinnerand others added 5 commits May 13, 2026 17:02
@vstinner@picnixz
pythongh-146207: Add support for OpenSSL 4.0.0 alpha1 (python#146217)
cf23df4
OpenSSL 4.0.0 alpha1 removed these functions:
* SSLv3_method()
* TLSv1_method()
* TLSv1_1_method()
* TLSv1_2_method()
Other changes:
* Update test_openssl_version().
* Update multissltests.py for OpenSSL 4.
* Add const qualifier to fix compiler warnings.
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
(cherry picked from commit 3364e7e)
@vstinner
pythongh-148600: Add Modules/_ssl_data_40.h data (python#148601)
c5e4ae0
The Modules/_ssl_data_40.h file was created with the commands:
python Tools/ssl/multissltests.py --steps=library --base-directory "$PWD/multissl" --openssl '4.0.0' --system Linux
python Tools/ssl/make_ssl_data.py multissl/src/openssl-4.0.0 Modules/_ssl_data_40.h
Update Modules/_ssl.c to include it on OpenSSL 4.0.0 and newer.
Update test_ssl for the new error message.
(cherry picked from commit 70eb56b)
@vstinner@gpshead
pythongh-148292: Update _ssl._SSLSocket for OpenSSL 4 (python#149102)
3c2a301
The _SSLSocket object now remembers if it gets an EOF error. In this
case, read(), sendfile(), write() and do_handshake method calls fail
with SSLEOFError without calling the underlying OpenSSL function.
Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 7b7fa3f)
@vstinner
pythongh-148292: Remove shutdown() test in test_ssl.test_got_eof() (p…
8191190
…ython#149366)
The shutdown() behavior depends too much on the operating system and
it's unrelated to the got_eof_error change.
(cherry picked from commit 1e21cf6)
@vstinner@clin1234
pythongh-148600: Add OpenSSL 4.0.0 support to test configurations (py…
c9a39e6
…thon#149356)
Co-authored-by: Charlie Lin <tuug@gmx.us>
(cherry picked from commit fc96028)
@vstinner
vstinner requested review from a team, gpshead and picnixz as code ownersMay 13, 2026 15:15
@vstinnervstinner added the needs backport to 3.13 bugs and security fixes label May 13, 2026
@bedevere-appbedevere-appBot mentioned this pull request May 13, 2026
Closed
@vstinner

vstinner commented May 15, 2026

Copy link
Copy Markdown
MemberAuthor

@picnixz@gpshead: Would you mind to review this change? Are you ok with backporting OpenSSL 4.0.0 support to Python 3.13 and 3.14 branches?

@cho-mcho-m mentioned this pull request May 18, 2026
Closed
@vstinner

vstinner commented May 21, 2026

Copy link
Copy Markdown
MemberAuthor

Ping @picnixz@gpshead. Are you ok with adding OpenSSL 4.0.0 support for Python 3.14?

@picnixz

picnixz commented May 21, 2026

Copy link
Copy Markdown
Member

Can we wait a bit before doing so? I do not want to fix openssl issues arising in a bugfix because we added support for OSSL4. It is a major change and for instance, I did not backport the use of the EVP API introduced in 3.x for HMAC to older releases.

I really want to wait for users to test 3.15 with 4.0, say until aftrr 3.15.1, and we can add it to 3.14 afterwards. It would not help backports though as each version has its own ssl.c (almost)

@vstinner

vstinner commented May 21, 2026

Copy link
Copy Markdown
MemberAuthor

Ok, in this case, I prefer closing my PR. For my own workflow, I prefer to not keep PRs opens for too long. The PR can be reopened/recreated later.

@vstinner
vstinner deleted the openssl4 branch May 21, 2026 11:35
@vstinnervstinner mentioned this pull request May 26, 2026
Closed
@native-api

native-api commented May 30, 2026

Copy link
Copy Markdown
Contributor

@vstinnerWe have applied this backport downstream in Pyenv so that users can link against OpenSSL 4 if they wish / if it's the default on their system.

Is it reasonable to expect that if there are further OpenSSL 4 -- related fixes before the official backport, they will be added to this PR?

@mattipmattip mentioned this pull request May 31, 2026
Open
@vstinner

vstinner commented Jun 1, 2026

Copy link
Copy Markdown
MemberAuthor

We can revisit (reopen) this PR later. If this PR is reopened, we will add further changes if there are more OpenSSL 4.0 changes.

@picnixz would like to wait for user feedback testing Python 3.15 with OpenSSL 4.0.

@picnixz

picnixz commented Jun 1, 2026

Copy link
Copy Markdown
Member

Yes I want to wait at least until 3.15.0 is out and we can reconsider this in 3.15.1.

@majabojarskamajabojarska mentioned this pull request Jun 16, 2026
Merged
@coderabbitaicoderabbitaiBot mentioned this pull request Jul 24, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpsheadgpsheadAwaiting requested review from gpsheadgpshead is a code owner
@picnixzpicnixzAwaiting requested review from picnixzpicnixz is a code owner
@ezio-melottiezio-melottiAwaiting requested review from ezio-melottiezio-melotti is a code owner
@hugovkhugovkAwaiting requested review from hugovkhugovk is a code owner
@AA-TurnerAA-TurnerAwaiting requested review from AA-TurnerAA-Turner is a code owner
@webknjazwebknjazAwaiting requested review from webknjazwebknjaz is a code owner

Assignees

No one assigned

Labels

awaiting core reviewneeds backport to 3.13bugs and security fixes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@vstinner@picnixz@native-api