File openssl-300-raise-SSLCertVerificationError.patch of Package python36

Overview Repositories Revisions Requests Users Attributes Meta

File openssl-300-raise-SSLCertVerificationError.patch of Package python36

From 20ad4c53e6a7d111fb03a1be8bda6e91740c6ca5 Mon Sep 17 00:00:00 2001
From: Pablo Galindo <pablogsal@gmail.com>
Date: Thu, 3 Aug 2023 12:52:50 +0100
Subject: [PATCH] Raise SSLCertVerificationError even if the error is set via
 SSL_ERROR_SYSCALL

Seems that in some conditions, OpenSSL will return set
``SSL_ERROR_SYSCALL`` instead of ``SSL_ERROR_SSL``
when a certification verification has failed, but the
error parameters will still contain ``ERR_LIB_SSL``
and ``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now
detecting this situation and raising the appropiate
``ssl.SSLCertVerificationError``.

Co-authored-by: T. Wouters <thomas@python.org>
Fixes: gh#python/cpython#107077
From-PR: gh#python/cpython!107586
Patch: openssl-300-raise-SSLCertVerificationError.patch
Released-in: 3.8.19
---
 .../Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst  | 6 ++++++
 Modules/_ssl.c                                              | 4 ++++
 2 files changed, 10 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst

diff --git a/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst b/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst
new file mode 100644
index 00000000000..ecaf437a48e
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst
@@ -0,0 +1,6 @@
+Seems that in some conditions, OpenSSL will return ``SSL_ERROR_SYSCALL``
+instead of ``SSL_ERROR_SSL`` when a certification verification has failed,
+but the error parameters will still contain ``ERR_LIB_SSL`` and
+``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and
+raising the appropiate ``ssl.SSLCertVerificationError``. Patch by Pablo
+Galindo
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 36d0706e8f0..1ff4a6a23f6 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -621,6 +621,10 @@ PySSL_SetError(PySSLSocket *obj, int ret, const char *filename, int lineno)
                     errstr = "Some I/O error occurred";
                 }
             } else {
+                if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
+                        ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
+                    type = state->PySSLCertVerificationErrorObject;
+                }
                 p = PY_SSL_ERROR_SYSCALL;
             }
             break;
-- 
2.46.1

Places

File openssl-300-raise-SSLCertVerificationError.patch of Package python36

Places