Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix python 3.13 patch #2026

Merged
merged 1 commit into from
Dec 2, 2024
Merged

Fix python 3.13 patch #2026

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 30 additions & 56 deletions tests/ci/integration/python_patch/3.13/aws-lc-cpython.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py
index 6e63a88..7dc83d7 100644
index 9d853d2..656f109 100644
--- a/Lib/test/test_httplib.py
+++ b/Lib/test/test_httplib.py
@@ -2066,7 +2066,7 @@ def test_host_port(self):
@@ -2073,7 +2073,7 @@ def test_host_port(self):

def test_tls13_pha(self):
import ssl
Expand All @@ -12,18 +12,18 @@ index 6e63a88..7dc83d7 100644
# just check status of PHA flag
h = client.HTTPSConnection('localhost', 443)
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 0e50d09..f4b7b3c 100644
index 7fdd2be..7d8839f 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -41,6 +41,7 @@
@@ -43,6 +43,7 @@
from ssl import Purpose, TLSVersion, _TLSContentType, _TLSMessageType, _TLSAlertType

Py_DEBUG_WIN32 = support.Py_DEBUG and sys.platform == 'win32'
+Py_OPENSSL_IS_AWSLC = "AWS-LC" in ssl.OPENSSL_VERSION

PROTOCOLS = sorted(ssl._PROTOCOL_NAMES)
HOST = socket_helper.HOST
@@ -174,7 +175,7 @@ def is_ubuntu():
@@ -177,7 +178,7 @@ def is_ubuntu():
except FileNotFoundError:
return False

Expand All @@ -32,18 +32,18 @@ index 0e50d09..f4b7b3c 100644
def seclevel_workaround(*ctxs):
""""Lower security level to '1' and allow all ciphers for TLS 1.0/1"""
for ctx in ctxs:
@@ -4001,6 +4002,7 @@ def test_no_legacy_server_connect(self):
@@ -4061,6 +4062,7 @@ def test_no_legacy_server_connect(self):
sni_name=hostname)

@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
+ @unittest.skipIf(Py_OPENSSL_IS_AWSLC, "AWS-LC doesn't support (FF)DHE")
def test_dh_params(self):
# Check we can get a connection with ephemeral Diffie-Hellman
client_context, server_context, hostname = testing_context()
@@ -4364,14 +4366,14 @@ def test_session_handling(self):
@@ -4424,14 +4426,14 @@ def test_session_handling(self):
def test_psk(self):
psk = bytes.fromhex('deadbeef')

- client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+ client_context, server_context, _ = testing_context()
+
Expand All @@ -52,15 +52,15 @@ index 0e50d09..f4b7b3c 100644
client_context.maximum_version = ssl.TLSVersion.TLSv1_2
client_context.set_ciphers('PSK')
client_context.set_psk_client_callback(lambda hint: (None, psk))

- server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
server_context.maximum_version = ssl.TLSVersion.TLSv1_2
server_context.set_ciphers('PSK')
server_context.set_psk_server_callback(lambda identity: psk)
@@ -4443,14 +4445,14 @@ def server_callback(identity):
@@ -4503,14 +4505,14 @@ def server_callback(identity):
self.assertEqual(identity, client_identity)
return psk

- client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+ client_context, server_context, _ = testing_context()
+
Expand All @@ -69,12 +69,12 @@ index 0e50d09..f4b7b3c 100644
client_context.minimum_version = ssl.TLSVersion.TLSv1_3
client_context.set_ciphers('PSK')
client_context.set_psk_client_callback(client_callback)

- server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
server_context.minimum_version = ssl.TLSVersion.TLSv1_3
server_context.set_ciphers('PSK')
server_context.set_psk_server_callback(server_callback, identity_hint)
@@ -4461,7 +4463,10 @@ def server_callback(identity):
@@ -4521,7 +4523,10 @@ def server_callback(identity):
s.connect((HOST, server.port))


Expand All @@ -86,7 +86,7 @@ index 0e50d09..f4b7b3c 100644
class TestPostHandshakeAuth(unittest.TestCase):
def test_pha_setter(self):
protocols = [
@@ -4737,6 +4742,31 @@ def test_internal_chain_server(self):
@@ -4835,6 +4840,31 @@ def test_internal_chain_server(self):
self.assertEqual(res, b'\x02\n')


Expand Down Expand Up @@ -119,10 +119,10 @@ index 0e50d09..f4b7b3c 100644
requires_keylog = unittest.skipUnless(
HAS_KEYLOG, 'test requires OpenSSL 1.1.1 with keylog callback')
diff --git a/Modules/Setup b/Modules/Setup
index cd1cf24..53bcc4c 100644
index e4acf6b..e4dd9b4 100644
--- a/Modules/Setup
+++ b/Modules/Setup
@@ -208,11 +208,11 @@ PYTHONPATH=$(COREPYTHONPATH)
@@ -211,11 +211,11 @@ PYTHONPATH=$(COREPYTHONPATH)
#_hashlib _hashopenssl.c $(OPENSSL_INCLUDES) $(OPENSSL_LDFLAGS) -lcrypto

# To statically link OpenSSL:
Expand All @@ -140,13 +140,13 @@ index cd1cf24..53bcc4c 100644
# The _tkinter module.
#
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index f7fdbf4..204d501 100644
index a7a278d..3e29a2b 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -187,6 +187,11 @@ extern const SSL_METHOD *TLSv1_2_method(void);
@@ -186,6 +186,11 @@ extern const SSL_METHOD *TLSv1_2_method(void);
#endif


+#if !defined(SSL_VERIFY_POST_HANDSHAKE) || !defined(TLS1_3_VERSION) || defined(OPENSSL_NO_TLS1_3)
+ #define PY_SSL_NO_POST_HS_AUTH
+#endif
Expand All @@ -155,7 +155,7 @@ index f7fdbf4..204d501 100644
enum py_ssl_error {
/* these mirror ssl.h */
PY_SSL_ERROR_NONE,
@@ -231,7 +236,7 @@ enum py_proto_version {
@@ -230,7 +235,7 @@ enum py_proto_version {
PY_PROTO_TLSv1 = TLS1_VERSION,
PY_PROTO_TLSv1_1 = TLS1_1_VERSION,
PY_PROTO_TLSv1_2 = TLS1_2_VERSION,
Expand All @@ -164,7 +164,7 @@ index f7fdbf4..204d501 100644
PY_PROTO_TLSv1_3 = TLS1_3_VERSION,
#else
PY_PROTO_TLSv1_3 = 0x304,
@@ -293,7 +298,7 @@ typedef struct {
@@ -292,7 +297,7 @@ typedef struct {
*/
unsigned int hostflags;
int protocol;
Expand All @@ -173,7 +173,7 @@ index f7fdbf4..204d501 100644
int post_handshake_auth;
#endif
PyObject *msg_cb;
@@ -873,7 +878,7 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
@@ -870,7 +875,7 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
SSL_set_mode(self->ssl,
SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER | SSL_MODE_AUTO_RETRY);

Expand All @@ -182,24 +182,24 @@ index f7fdbf4..204d501 100644
if (sslctx->post_handshake_auth == 1) {
if (socket_type == PY_SSL_SERVER) {
/* bpo-37428: OpenSSL does not ignore SSL_VERIFY_POST_HANDSHAKE.
@@ -1016,6 +1021,7 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
@@ -1014,6 +1019,7 @@ _ssl__SSLSocket_do_handshake_impl(PySSLSocket *self)
} while (err.ssl == SSL_ERROR_WANT_READ ||
err.ssl == SSL_ERROR_WANT_WRITE);
Py_XDECREF(sock);
+
if (ret < 1)
return PySSL_SetError(self, __FILE__, __LINE__);
if (PySSL_ChainExceptions(self) < 0)
@@ -2775,7 +2781,7 @@ static PyObject *
@@ -2836,7 +2842,7 @@ static PyObject *
_ssl__SSLSocket_verify_client_post_handshake_impl(PySSLSocket *self)
/*[clinic end generated code: output=532147f3b1341425 input=6bfa874810a3d889]*/
/*[clinic end generated code: output=532147f3b1341425 input=42b5bb1f0981eda1]*/
{
-#ifdef TLS1_3_VERSION
+#if !defined(PY_SSL_NO_POST_HS_AUTH)
int err = SSL_verify_client_post_handshake(self->ssl);
if (err == 0)
return _setSSLError(get_state_sock(self), NULL, 0, __FILE__, __LINE__);
@@ -3198,7 +3204,7 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
@@ -3217,7 +3223,7 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
X509_VERIFY_PARAM_set_flags(params, X509_V_FLAG_TRUSTED_FIRST);
X509_VERIFY_PARAM_set_hostflags(params, self->hostflags);

Expand All @@ -208,25 +208,7 @@ index f7fdbf4..204d501 100644
self->post_handshake_auth = 0;
SSL_CTX_set_post_handshake_auth(self->ctx, self->post_handshake_auth);
#endif
@@ -3576,7 +3582,7 @@ set_maximum_version(PySSLContext *self, PyObject *arg, void *c)
return set_min_max_proto_version(self, arg, 1);
}

-#ifdef TLS1_3_VERSION
+#if defined(TLS1_3_VERSION) && !defined(OPENSSL_NO_TLS1_3)
static PyObject *
get_num_tickets(PySSLContext *self, void *c)
{
@@ -3607,7 +3613,7 @@ set_num_tickets(PySSLContext *self, PyObject *arg, void *c)

PyDoc_STRVAR(PySSLContext_num_tickets_doc,
"Control the number of TLSv1.3 session tickets");
-#endif /* TLS1_3_VERSION */
+#endif /* defined(TLS1_3_VERSION) */

static PyObject *
get_security_level(PySSLContext *self, void *c)
@@ -3710,14 +3716,14 @@ set_check_hostname(PySSLContext *self, PyObject *arg, void *c)
@@ -3861,14 +3867,14 @@ _ssl__SSLContext_check_hostname_set_impl(PySSLContext *self, PyObject *value)

static PyObject *
get_post_handshake_auth(PySSLContext *self, void *c) {
Expand All @@ -243,17 +225,9 @@ index f7fdbf4..204d501 100644
static int
set_post_handshake_auth(PySSLContext *self, PyObject *arg, void *c) {
if (arg == NULL) {
@@ -4959,14 +4965,14 @@ static PyGetSetDef context_getsetlist[] = {
(setter) _PySSLContext_set_msg_callback, NULL},
{"sni_callback", (getter) get_sni_callback,
(setter) set_sni_callback, PySSLContext_sni_callback_doc},
-#ifdef TLS1_3_VERSION
+#if defined(TLS1_3_VERSION) && !defined(OPENSSL_NO_TLS1_3)
{"num_tickets", (getter) get_num_tickets,
(setter) set_num_tickets, PySSLContext_num_tickets_doc},
@@ -5146,7 +5152,7 @@ static PyGetSetDef context_getsetlist[] = {
#endif
{"options", (getter) get_options,
(setter) set_options, NULL},
_SSL__SSLCONTEXT_OPTIONS_GETSETDEF
{"post_handshake_auth", (getter) get_post_handshake_auth,
-#ifdef TLS1_3_VERSION
+#if !defined(PY_SSL_NO_POST_HS_AUTH)
Expand Down
Loading