Skip to content

Commit

Permalink
pythongh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (pyth…
Browse files Browse the repository at this point in the history
…on#105174)

Upgrade builds to OpenSSL 1.1.1u.

This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t.

The Mac/BuildScript/build-installer.py was already updated.

Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it.

Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting).

backports of this prior to 3.12 will not include the openssl 3.1 header.
  • Loading branch information
gpshead authored Jun 1, 2023
1 parent a241003 commit ede89af
Show file tree
Hide file tree
Showing 13 changed files with 8,794 additions and 18 deletions.
4 changes: 2 additions & 2 deletions .azure-pipelines/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ jobs:
variables:
testRunTitle: '$(build.sourceBranchName)-linux'
testRunPlatform: linux
openssl_version: 1.1.1t
openssl_version: 1.1.1u

steps:
- template: ./posix-steps.yml
Expand All @@ -83,7 +83,7 @@ jobs:
variables:
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
testRunPlatform: linux-coverage
openssl_version: 1.1.1t
openssl_version: 1.1.1u

steps:
- template: ./posix-steps.yml
Expand Down
4 changes: 2 additions & 2 deletions .azure-pipelines/pr.yml
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ jobs:
variables:
testRunTitle: '$(system.pullRequest.TargetBranch)-linux'
testRunPlatform: linux
openssl_version: 1.1.1t
openssl_version: 1.1.1u

steps:
- template: ./posix-steps.yml
Expand All @@ -83,7 +83,7 @@ jobs:
variables:
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
testRunPlatform: linux-coverage
openssl_version: 1.1.1t
openssl_version: 1.1.1u

steps:
- template: ./posix-steps.yml
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -257,7 +257,7 @@ jobs:
needs: check_source
if: needs.check_source.outputs.run_tests == 'true'
env:
OPENSSL_VER: 1.1.1t
OPENSSL_VER: 1.1.1u
PYTHONSTRICTEXTENSIONBUILD: 1
steps:
- uses: actions/checkout@v3
Expand Down Expand Up @@ -326,7 +326,7 @@ jobs:
strategy:
fail-fast: false
matrix:
openssl_ver: [1.1.1t, 3.0.8, 3.1.0-beta1]
openssl_ver: [1.1.1u, 3.0.9, 3.1.1]
env:
OPENSSL_VER: ${{ matrix.openssl_ver }}
MULTISSL_DIR: ${{ github.workspace }}/multissl
Expand Down Expand Up @@ -378,7 +378,7 @@ jobs:
needs: check_source
if: needs.check_source.outputs.run_tests == 'true' && needs.check_source.outputs.run_hypothesis == 'true'
env:
OPENSSL_VER: 1.1.1t
OPENSSL_VER: 1.1.1u
PYTHONSTRICTEXTENSIONBUILD: 1
steps:
- uses: actions/checkout@v3
Expand Down Expand Up @@ -487,7 +487,7 @@ jobs:
needs: check_source
if: needs.check_source.outputs.run_tests == 'true'
env:
OPENSSL_VER: 1.1.1t
OPENSSL_VER: 1.1.1u
PYTHONSTRICTEXTENSIONBUILD: 1
ASAN_OPTIONS: detect_leaks=0:allocator_may_return_null=1:handle_segv=0
steps:
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
The version of OpenSSL used in our binary builds has been upgraded to 1.1.1u
to address several CVEs.
4 changes: 3 additions & 1 deletion Modules/_ssl.c
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,9 @@ static void _PySSLFixErrno(void) {
#endif

/* Include generated data (error codes) */
#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
#if (OPENSSL_VERSION_NUMBER >= 0x30100000L)
#include "_ssl_data_31.h"
#elif (OPENSSL_VERSION_NUMBER >= 0x30000000L)
#include "_ssl_data_300.h"
#elif (OPENSSL_VERSION_NUMBER >= 0x10101000L) && !defined(LIBRESSL_VERSION_NUMBER)
#include "_ssl_data_111.h"
Expand Down
17 changes: 16 additions & 1 deletion Modules/_ssl_data_111.h
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2021-04-09T09:36:21.493286 */
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2023-06-01T02:58:04.081473 */
static struct py_ssl_library_code library_codes[] = {
#ifdef ERR_LIB_ASN1
{"ASN1", ERR_LIB_ASN1},
Expand Down Expand Up @@ -1375,6 +1375,11 @@ static struct py_ssl_error_code error_codes[] = {
#else
{"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151},
#endif
#ifdef CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM},
#else
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", 46, 194},
#endif
#ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE
{"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE},
#else
Expand Down Expand Up @@ -4860,6 +4865,11 @@ static struct py_ssl_error_code error_codes[] = {
#else
{"MISSING_PARAMETERS", 20, 290},
#endif
#ifdef SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
{"MISSING_PSK_KEX_MODES_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION},
#else
{"MISSING_PSK_KEX_MODES_EXTENSION", 20, 310},
#endif
#ifdef SSL_R_MISSING_RSA_CERTIFICATE
{"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE},
#else
Expand Down Expand Up @@ -5065,6 +5075,11 @@ static struct py_ssl_error_code error_codes[] = {
#else
{"NULL_SSL_METHOD_PASSED", 20, 196},
#endif
#ifdef SSL_R_OCSP_CALLBACK_FAILURE
{"OCSP_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_OCSP_CALLBACK_FAILURE},
#else
{"OCSP_CALLBACK_FAILURE", 20, 294},
#endif
#ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED
{"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED},
#else
Expand Down
Loading

0 comments on commit ede89af

Please sign in to comment.