Skip to content

Commit fb7e750

Browse files
paulmonzooba
paulmon
authored and
zooba
committed
bpo-35926: Add support for OpenSSL 1.1.1b on Windows (pythonGH-11779)
1 parent d9e006b commit fb7e750

File tree

12 files changed

+70
-42
lines changed

12 files changed

+70
-42
lines changed

‎.azure-pipelines/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
variables:
6060
testRunTitle: '$(build.sourceBranchName)-linux'
6161
testRunPlatform: linux
62-
openssl_version: 1.1.0j
62+
openssl_version: 1.1.1b
6363

6464
steps:
6565
- template: ./posix-steps.yml
@@ -116,7 +116,7 @@ jobs:
116116
variables:
117117
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
118118
testRunPlatform: linux-coverage
119-
openssl_version: 1.1.0j
119+
openssl_version: 1.1.1b
120120

121121
steps:
122122
- template: ./posix-steps.yml

‎Lib/test/test_asyncio/test_sslproto.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -497,8 +497,8 @@ def test_start_tls_server_1(self):
497497

498498
server_context = test_utils.simple_server_sslcontext()
499499
client_context = test_utils.simple_client_sslcontext()
500-
if sys.platform.startswith('freebsd'):
501-
# bpo-35031: Some FreeBSD buildbots fail to run this test
500+
if sys.platform.startswith('freebsd') or sys.platform.startswith('win'):
501+
# bpo-35031: Some FreeBSD and Windows buildbots fail to run this test
502502
# as the eof was not being received by the server if the payload
503503
# size is not big enough. This behaviour only appears if the
504504
# client is using TLS1.3.

‎Lib/test/test_ssl.py

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2188,14 +2188,17 @@ def wrap_conn(self):
21882188
self.sock, server_side=True)
21892189
self.server.selected_npn_protocols.append(self.sslconn.selected_npn_protocol())
21902190
self.server.selected_alpn_protocols.append(self.sslconn.selected_alpn_protocol())
2191-
except (ConnectionResetError, BrokenPipeError) as e:
2191+
except (ConnectionResetError, BrokenPipeError, ConnectionAbortedError) as e:
21922192
# We treat ConnectionResetError as though it were an
21932193
# SSLError - OpenSSL on Ubuntu abruptly closes the
21942194
# connection when asked to use an unsupported protocol.
21952195
#
21962196
# BrokenPipeError is raised in TLS 1.3 mode, when OpenSSL
21972197
# tries to send session tickets after handshake.
21982198
# https://github.com/openssl/openssl/issues/6342
2199+
#
2200+
# ConnectionAbortedError is raised in TLS 1.3 mode, when OpenSSL
2201+
# tries to send session tickets after handshake when using WinSock.
21992202
self.server.conn_errors.append(str(e))
22002203
if self.server.chatty:
22012204
handle_error("\n server: bad connection attempt from " + repr(self.addr) + ":\n")
@@ -2326,7 +2329,7 @@ def run(self):
23262329
sys.stdout.write(" server: read %r (%s), sending back %r (%s)...\n"
23272330
% (msg, ctype, msg.lower(), ctype))
23282331
self.write(msg.lower())
2329-
except ConnectionResetError:
2332+
except (ConnectionResetError, ConnectionAbortedError):
23302333
# XXX: OpenSSL 1.1.1 sometimes raises ConnectionResetError
23312334
# when connection is not shut down gracefully.
23322335
if self.server.chatty and support.verbose:
@@ -2336,6 +2339,18 @@ def run(self):
23362339
)
23372340
self.close()
23382341
self.running = False
2342+
except ssl.SSLError as err:
2343+
# On Windows sometimes test_pha_required_nocert receives the
2344+
# PEER_DID_NOT_RETURN_A_CERTIFICATE exception
2345+
# before the 'tlsv13 alert certificate required' exception.
2346+
# If the server is stopped when PEER_DID_NOT_RETURN_A_CERTIFICATE
2347+
# is received test_pha_required_nocert fails with ConnectionResetError
2348+
# because the underlying socket is closed
2349+
if 'PEER_DID_NOT_RETURN_A_CERTIFICATE' == err.reason:
2350+
if self.server.chatty and support.verbose:
2351+
sys.stdout.write(err.args[1])
2352+
# test_pha_required_nocert is expecting this exception
2353+
raise ssl.SSLError('tlsv13 alert certificate required')
23392354
except OSError:
23402355
if self.server.chatty:
23412356
handle_error("Test server failure:\n")

‎Misc/ACKS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1104,6 +1104,7 @@ Florian Mladitsch
11041104
Doug Moen
11051105
Jakub Molinski
11061106
Juliette Monsel
1107+
Paul Monson
11071108
The Dragon De Monsyne
11081109
Bastien Montagne
11091110
Skip Montanaro

‎Misc/NEWS.d/next/Windows/2019-03-01-16-43-45.bpo-35926.mLszHo.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Update to OpenSSL 1.1.1b for Windows.

‎Modules/_ssl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -669,7 +669,7 @@ fill_and_set_sslerror(PySSLSocket *sslsock, PyObject *type, int ssl_errno,
669669
if (msg == NULL)
670670
goto fail;
671671

672-
init_value = Py_BuildValue("iN", ssl_errno, msg);
672+
init_value = Py_BuildValue("iN", ERR_GET_REASON(ssl_errno), msg);
673673
if (init_value == NULL)
674674
goto fail;
675675

‎PCbuild/get_externals.bat

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ echo.Fetching external libraries...
5353
set libraries=
5454
set libraries=%libraries% bzip2-1.0.6
5555
if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.3.0-rc0-r1
56-
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-1.1.0j
56+
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-1.1.1b
5757
set libraries=%libraries% sqlite-3.21.0.0
5858
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.9.0
5959
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tk-8.6.9.0
@@ -77,7 +77,7 @@ echo.Fetching external binaries...
7777

7878
set binaries=
7979
if NOT "%IncludeLibffi%"=="false" set binaries=%binaries% libffi
80-
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-1.1.0j
80+
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-1.1.1b
8181
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.9.0
8282
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06
8383

‎PCbuild/openssl.props

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@
1111
</ItemDefinitionGroup>
1212
<PropertyGroup>
1313
<_DLLSuffix>-1_1</_DLLSuffix>
14-
<_DLLSuffix Condition="$(Platform) == 'x64'">$(_DLLSuffix)-x64</_DLLSuffix>
14+
<_DLLSuffix Condition="$(Platform) == 'ARM'">$(_DLLSuffix)-arm</_DLLSuffix>
15+
<_DLLSuffix Condition="$(Platform) == 'ARM64'">$(_DLLSuffix)-arm64</_DLLSuffix>
1516
</PropertyGroup>
1617
<ItemGroup>
1718
<_SSLDLL Include="$(opensslOutDir)\libcrypto$(_DLLSuffix).dll" />

‎PCbuild/openssl.vcxproj

Lines changed: 33 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,21 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<ItemGroup Label="ProjectConfigurations">
4-
<ProjectConfiguration Include="Debug|Win32">
5-
<Configuration>Debug</Configuration>
6-
<Platform>Win32</Platform>
7-
</ProjectConfiguration>
84
<ProjectConfiguration Include="Release|Win32">
95
<Configuration>Release</Configuration>
106
<Platform>Win32</Platform>
117
</ProjectConfiguration>
12-
<ProjectConfiguration Include="PGInstrument|Win32">
13-
<Configuration>PGInstrument</Configuration>
14-
<Platform>Win32</Platform>
15-
</ProjectConfiguration>
16-
<ProjectConfiguration Include="PGInstrument|x64">
17-
<Configuration>PGInstrument</Configuration>
18-
<Platform>x64</Platform>
19-
</ProjectConfiguration>
20-
<ProjectConfiguration Include="PGUpdate|Win32">
21-
<Configuration>PGUpdate</Configuration>
22-
<Platform>Win32</Platform>
23-
</ProjectConfiguration>
24-
<ProjectConfiguration Include="PGUpdate|x64">
25-
<Configuration>PGUpdate</Configuration>
8+
<ProjectConfiguration Include="Release|x64">
9+
<Configuration>Release</Configuration>
2610
<Platform>x64</Platform>
2711
</ProjectConfiguration>
28-
<ProjectConfiguration Include="Debug|x64">
29-
<Configuration>Debug</Configuration>
30-
<Platform>x64</Platform>
12+
<ProjectConfiguration Include="Release|ARM">
13+
<Configuration>Release</Configuration>
14+
<Platform>ARM</Platform>
3115
</ProjectConfiguration>
32-
<ProjectConfiguration Include="Release|x64">
16+
<ProjectConfiguration Include="Release|ARM64">
3317
<Configuration>Release</Configuration>
34-
<Platform>x64</Platform>
18+
<Platform>ARM64</Platform>
3519
</ProjectConfiguration>
3620
</ItemGroup>
3721
<PropertyGroup Label="Globals">
@@ -40,15 +24,36 @@
4024

4125
<Import Project="python.props" />
4226
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
43-
44-
<PropertyGroup Label="Configuration">
27+
28+
<PropertyGroup Label="Configuration" Condition="$(Platform) == 'Win32'">
4529
<ConfigurationType>Makefile</ConfigurationType>
4630
<Bitness>32</Bitness>
47-
<Bitness Condition="$(Platform) == 'x64'">64</Bitness>
4831
<ArchName>x86</ArchName>
49-
<ArchName Condition="$(Platform) == 'x64'">amd64</ArchName>
5032
<OpenSSLPlatform>VC-WIN32</OpenSSLPlatform>
51-
<OpenSSLPlatform Condition="$(Platform) == 'x64'">VC-WIN64A</OpenSSLPlatform>
33+
<SupportSigning>true</SupportSigning>
34+
</PropertyGroup>
35+
36+
<PropertyGroup Label="Configuration" Condition="$(Platform) == 'x64'">
37+
<ConfigurationType>Makefile</ConfigurationType>
38+
<Bitness>64</Bitness>
39+
<ArchName>amd64</ArchName>
40+
<OpenSSLPlatform>VC-WIN64A-masm</OpenSSLPlatform>
41+
<SupportSigning>true</SupportSigning>
42+
</PropertyGroup>
43+
44+
<PropertyGroup Label="Configuration" Condition="$(Platform) == 'ARM'">
45+
<ConfigurationType>Makefile</ConfigurationType>
46+
<Bitness>ARM</Bitness>
47+
<ArchName>ARM</ArchName>
48+
<OpenSSLPlatform>VC-WIN32-ARM</OpenSSLPlatform>
49+
<SupportSigning>true</SupportSigning>
50+
</PropertyGroup>
51+
52+
<PropertyGroup Label="Configuration" Condition="$(Platform) == 'ARM64'">
53+
<ConfigurationType>Makefile</ConfigurationType>
54+
<Bitness>ARM64</Bitness>
55+
<ArchName>ARM64</ArchName>
56+
<OpenSSLPlatform>VC-WIN64-ARM</OpenSSLPlatform>
5257
<SupportSigning>true</SupportSigning>
5358
</PropertyGroup>
5459

‎PCbuild/prepare_ssl.bat

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ if ERRORLEVEL 1 (echo Cannot locate MSBuild.exe on PATH or as MSBUILD variable &
4242
call "%PCBUILD%\find_python.bat" "%PYTHON%"
4343
if ERRORLEVEL 1 (echo Cannot locate python.exe on PATH or as PYTHON variable & exit /b 3)
4444

45-
call "%PCBUILD%\get_externals.bat" --openssl-src %ORG_SETTING%
45+
call "%PCBUILD%\get_externals.bat" --openssl-src --no-openssl %ORG_SETTING%
4646

4747
if "%PERL%" == "" where perl > "%TEMP%\perl.loc" 2> nul && set /P PERL= <"%TEMP%\perl.loc" & del "%TEMP%\perl.loc"
4848
if "%PERL%" == "" (echo Cannot locate perl.exe on PATH or as PERL variable & exit /b 4)
@@ -51,4 +51,8 @@ if "%PERL%" == "" (echo Cannot locate perl.exe on PATH or as PERL variable & exi
5151
if errorlevel 1 exit /b
5252
%MSBUILD% "%PCBUILD%\openssl.vcxproj" /p:Configuration=Release /p:Platform=x64
5353
if errorlevel 1 exit /b
54+
%MSBUILD% "%PCBUILD%\openssl.vcxproj" /p:Configuration=Release /p:Platform=ARM
55+
if errorlevel 1 exit /b
56+
%MSBUILD% "%PCBUILD%\openssl.vcxproj" /p:Configuration=Release /p:Platform=ARM64
57+
if errorlevel 1 exit /b
5458

‎PCbuild/python.props

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
-->
2727
<ArchName Condition="'$(ArchName)' == '' and $(Platform) == 'x64'">amd64</ArchName>
2828
<ArchName Condition="'$(ArchName)' == '' and $(Platform) == 'ARM'">arm32</ArchName>
29+
<ArchName Condition="'$(ArchName)' == '' and $(Platform) == 'ARM64'">arm64</ArchName>
2930
<ArchName Condition="'$(ArchName)' == ''">win32</ArchName>
3031

3132
<!-- Root directory of the repository -->
@@ -56,8 +57,8 @@
5657
<libffiDir>$(ExternalsDir)libffi\</libffiDir>
5758
<libffiOutDir>$(ExternalsDir)libffi\$(ArchName)\</libffiOutDir>
5859
<libffiIncludeDir>$(libffiOutDir)include</libffiIncludeDir>
59-
<opensslDir>$(ExternalsDir)openssl-1.1.0j\</opensslDir>
60-
<opensslOutDir>$(ExternalsDir)openssl-bin-1.1.0j\$(ArchName)\</opensslOutDir>
60+
<opensslDir>$(ExternalsDir)openssl-1.1.1b\</opensslDir>
61+
<opensslOutDir>$(ExternalsDir)openssl-bin-1.1.1b\$(ArchName)\</opensslOutDir>
6162
<opensslIncludeDir>$(opensslOutDir)include</opensslIncludeDir>
6263
<nasmDir>$(ExternalsDir)\nasm-2.11.06\</nasmDir>
6364
<zlibDir>$(ExternalsDir)\zlib-1.2.11\</zlibDir>

‎PCbuild/readme.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ _lzma
165165
Homepage:
166166
http://tukaani.org/xz/
167167
_ssl
168-
Python wrapper for version 1.1.0h of the OpenSSL secure sockets
168+
Python wrapper for version 1.1.1b of the OpenSSL secure sockets
169169
library, which is downloaded from our binaries repository at
170170
https://github.com/python/cpython-bin-deps.
171171

0 commit comments

Comments
 (0)