diff options
| author | Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> | 2023-08-03 14:09:32 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-08-03 14:09:32 (GMT) |
| commit | 24d54feafc28a9fb421de852d830cc370fe51db3 (patch) | |
| tree | 9af84910df0854d6f8d5b42b010e990086c6400f | |
| parent | a9e5e59b7d912b4a90c550fad6a2d208bf8a1ed9 (diff) | |
| download | cpython-24d54feafc28a9fb421de852d830cc370fe51db3.zip cpython-24d54feafc28a9fb421de852d830cc370fe51db3.tar.gz cpython-24d54feafc28a9fb421de852d830cc370fe51db3.tar.bz2 | |
[3.10] gh-107077: Raise SSLCertVerificationError even if the error is set via SSL_ERROR_SYSCALL (GH-107586) (#107589)
Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
Co-authored-by: T. Wouters <thomas@python.org>
| -rw-r--r-- | Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst | 6 | ||||
| -rw-r--r-- | Modules/_ssl.c | 4 |
2 files changed, 10 insertions, 0 deletions
diff --git a/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst b/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst new file mode 100644 index 0000000..ecaf437 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst @@ -0,0 +1,6 @@ +Seems that in some conditions, OpenSSL will return ``SSL_ERROR_SYSCALL`` +instead of ``SSL_ERROR_SSL`` when a certification verification has failed, +but the error parameters will still contain ``ERR_LIB_SSL`` and +``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and +raising the appropiate ``ssl.SSLCertVerificationError``. Patch by Pablo +Galindo diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 7a28f2d..bb0508f 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -656,6 +656,10 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno) errstr = "Some I/O error occurred"; } } else { + if (ERR_GET_LIB(e) == ERR_LIB_SSL && + ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) { + type = state->PySSLCertVerificationErrorObject; + } p = PY_SSL_ERROR_SYSCALL; } break; |