summaryrefslogtreecommitdiffstats
path: root/Modules/_ssl.c
Commit message (Collapse)AuthorAgeFilesLines
* gh-107913: Fix possible losses of OSError error codes (GH-107930)Serhiy Storchaka2023-08-261-4/+4
| | | | | | Functions like PyErr_SetFromErrno() and SetFromWindowsErr() should be called immediately after using the C API which sets errno or the Windows error code.
* gh-107077: Raise SSLCertVerificationError even if the error is set via ↵Pablo Galindo Salgado2023-08-031-0/+4
| | | | | | SSL_ERROR_SYSCALL (#107586) Co-authored-by: T. Wouters <thomas@python.org>
* gh-86493: Modernize modules initialization code (GH-106858)Serhiy Storchaka2023-07-251-1/+1
| | | | | Use PyModule_Add() or PyModule_AddObjectRef() instead of soft deprecated PyModule_AddObject().
* gh-106320: Remove _PyIsSelectable_fd() C API (#107142)Victor Stinner2023-07-231-0/+1
| | | | Move _PyIsSelectable_fd() macro to the internal C API (pycore_fileutils.h).
* gh-86493: Use PyModule_Add() instead of PyModule_AddObjectRef() (GH-106860)Serhiy Storchaka2023-07-181-7/+1
|
* gh-86493: Fix possible leaks in some modules initialization (GH-106768)Serhiy Storchaka2023-07-181-4/+4
| | | | Fix _ssl, _stat, _testinternalcapi, _threadmodule, cmath, math, posix, time.
* gh-106831: Fix NULL check of d2i_SSL_SESSION() result in _ssl.c (#106832)Nikita Sobolev2023-07-171-3/+4
|
* gh-106687: _ssl: use uint64_t for SSL options (#106700)Victor Stinner2023-07-171-26/+54
| | | | | | | | SSL_CTX_get_options() uses uint64_t for options: https://www.openssl.org/docs/man3.1/man3/SSL_CTX_get_options.html Fix this compiler warning on Windows with MSC: conversion from 'uint64_t' to 'long', possible loss of data
* gh-105293: Do not call SSL_CTX_set_session_id_context on client side SSL ↵Grant Ramsay2023-07-141-5/+9
| | | | | | | | | | context (#105295) * gh-105293: Do not call SSL_CTX_set_session_id_context on client side SSL context Openssl states this is a "server side only" operation. Calling this on a client side socket can result in unexpected behavior * Add news entry on SSL "set session id context" changes
* gh-104922: remove PY_SSIZE_T_CLEAN (#106315)Inada Naoki2023-07-021-2/+0
|
* gh-105927: _ssl GET_SOCKET() uses _PyWeakref_GET_REF() (#106002)Victor Stinner2023-06-231-2/+12
|
* gh-105927: _ssl uses _PyWeakref_GET_REF() (#105965)Victor Stinner2023-06-211-13/+24
|
* gh-105375: Harden _ssl initialisation (#105599)Erlend E. Aasland2023-06-111-5/+11
| | | | Add proper error handling to prevent reference leaks and overwritten exceptions.
* gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (#105174)Gregory P. Smith2023-06-011-1/+3
| | | | | | | | | | | | | Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header.
* GH-103092: isolate `_ssl` (#104725)Kumar Aditya2023-05-221-3/+16
|
* gh-98836: Extend PyUnicode_FromFormat() (GH-98838)Serhiy Storchaka2023-05-211-4/+1
| | | | | | | | | * Support for conversion specifiers o (octal) and X (uppercase hexadecimal). * Support for length modifiers j (intmax_t) and t (ptrdiff_t). * Length modifiers are now applied to all integer conversions. * Support for wchar_t C strings (%ls and %lV). * Support for variable width and precision (*). * Support for flag - (left alignment).
* gh-99113: Add Py_MOD_PER_INTERPRETER_GIL_SUPPORTED (gh-104205)Eric Snow2023-05-051-0/+3
| | | Here we are doing no more than adding the value for Py_mod_multiple_interpreters and using it for stdlib modules. We will start checking for it in gh-104206 (once PyInterpreterState.ceval.own_gil is added in gh-104204).
* gh-103242: Migrate SSLContext.set_ecdh_curve not to use deprecated APIs ↵Dong-hee Na2023-04-081-3/+8
| | | | | (#103378) Migrate `SSLContext.set_ecdh_curve()` not to use deprecated OpenSSL APIs.
* gh-100062: Remove error code tables from _ssl and err_names_to_codes (GH-100063)David Benjamin2023-04-031-14/+0
| | | | | | | | | | Prior to https://github.com/python/cpython/pull/25300, the make_ssl_data.py script used various tables, exposed in _ssl, to update the error list. After that PR, this is no longer used. Moreover, the err_names_to_codes map isn't used at all. Clean those up. This gets them out of the way if, in the future, OpenSSL provides an API to do what the code here is doing directly. (https://github.com/openssl/openssl/issues/19848)
* fix typo in _ssl.c (GH-103192)Ikko Eltociear Ashimine2023-04-021-1/+1
| | | | | seperated -> separated Automerge-Triggered-By: GH:AlexWaygood
* gh-100372: Use BIO_eof to detect EOF for SSL_FILETYPE_ASN1 (GH-100373)David Benjamin2023-03-241-4/+6
| | | | | | | In PEM, we need to parse until error and then suppress `PEM_R_NO_START_LINE`, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing `ASN1_R_HEADER_TOO_LONG` doesn't quite work because that error also covers some cases that should be rejected. Instead, check `BIO_eof` early and stop the loop that way. Automerge-Triggered-By: GH:Yhg1s
* gh-96931: Fix incorrect results in ssl.SSLSocket.shared_ciphers (#96932)Benjamin Fogle2023-03-221-8/+28
|
* GH-95494: Fix transport EOF handling in OpenSSL 3.0 (GH-95495)David Benjamin2023-03-221-4/+10
| | | | | | | | | | | | | | | | | | | | | GH-25309 enabled SSL_OP_IGNORE_UNEXPECTED_EOF by default, with a comment that it restores OpenSSL 1.1.1 behavior, but this wasn't quite right. That option causes OpenSSL to treat transport EOF as the same as close_notify (i.e. SSL_ERROR_ZERO_RETURN), whereas Python actually has distinct SSLEOFError and SSLZeroReturnError exceptions. (The latter is usually mapped to a zero return from read.) In OpenSSL 1.1.1, the ssl module would raise them for transport EOF and close_notify, respectively. In OpenSSL 3.0, both act like close_notify. Fix this by, instead, just detecting SSL_R_UNEXPECTED_EOF_WHILE_READING and mapping that to the other exception type. There doesn't seem to have been any unit test of this error, so fill in the missing one. This had to be done with the BIO path because it's actually slightly tricky to simulate a transport EOF with Python's fd based APIs. (If you instruct the server to close the socket, it gets confused, probably because the server's SSL object is still referencing the now dead fd?)
* gh-102192: remove redundant exception fields from ssl module socket (#102466)Irit Katriel2023-03-161-19/+9
|
* gh-102255: Improve build support for Windows API partitions (GH-102256)Max Bachmann2023-03-091-0/+4
| | | | | Add `MS_WINDOWS_DESKTOP`, `MS_WINDOWS_APPS`, `MS_WINDOWS_SYSTEM` and `MS_WINDOWS_GAMES` preprocessor definitions to allow switching off functionality missing from particular API partitions ("partitions" are used in Windows to identify overlapping subsets of APIs). CPython only officially supports `MS_WINDOWS_DESKTOP` and `MS_WINDOWS_SYSTEM` (APPS is included by normal desktop builds, but APPS without DESKTOP is not covered). Other configurations are a convenience for people building their own runtimes. `MS_WINDOWS_GAMES` is for the Xbox subset of the Windows API, which is also available on client OS, but is restricted compared to `MS_WINDOWS_DESKTOP`. These restrictions may change over time, as they relate to the build headers rather than the OS support, and so we assume that Xbox builds will use the latest available version of the GDK.
* gh-89051: Add ssl.OP_LEGACY_SERVER_CONNECT (#93927)Thomas Grainger2022-12-201-0/+2
| | | | | | Co-authored-by: blurb-it[bot] <43283697+blurb-it[bot]@users.noreply.github.com> Co-authored-by: Christian Heimes <christian@python.org> Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com> Fixes https://github.com/python/cpython/issues/89051
* bpo-15999: Accept arbitrary values for boolean parameters. (#15609)Serhiy Storchaka2022-12-031-4/+4
| | | builtins and extension module functions and methods that expect boolean values for parameters now accept any Python object rather than just a bool or int type. This is more consistent with how native Python code itself behaves.
* gh-96828: Add an `ssl.OP_ENABLE_KTLS` option (GH-96830)Illia Volochii2022-11-241-0/+3
| | | Expose the constant when OpenSSL defines it.
* gh-99300: Use Py_NewRef() in Modules/ directory (#99468)Victor Stinner2022-11-141-37/+19
| | | | Replace Py_INCREF() and Py_XINCREF() with Py_NewRef() and Py_XNewRef() in test C files of the Modules/ directory.
* gh-95095: Use SSL_CTX_get_max_proto_version instead of SSL_CTX_ctrl (GH-95096)David Benjamin2022-07-211-2/+2
| | | | | | | The wrapper macros are more readable and match the form recommended in the OpenSSL documentation. They also slightly less error-prone, as the mapping of arguments to SSL_CTX_ctrl is not always clear. (Though in this case it's straightforward.) https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_get_max_proto_version.html
* gh-94637: Release GIL in SSLContext.set_default_verify_paths (GH-94658)Christian Heimes2022-07-091-1/+5
|
* gh-94172: Remove ssl.PROTOCOL_SSLv2 dead code (#94312)Victor Stinner2022-06-281-11/+0
| | | | | | | | Remove dead code related to ssl.PROTOCOL_SSLv2. ssl.PROTOCOL_SSLv2 was already removed in Python 3.10. In test_ssl, @requires_tls_version('SSLv2') always returned False. Extract of the removed code: "OpenSSL has removed support for SSLv2".
* gh-94199: Remove ssl.RAND_pseudo_bytes() function (#94202)Victor Stinner2022-06-241-19/+0
| | | | Remove the ssl.RAND_pseudo_bytes() function, deprecated in Python 3.6: use os.urandom() or ssl.RAND_bytes() instead.
* gh-94101 Disallow instantiation of SSLSession objects (GH-94102)chgnrdv2022-06-221-1/+2
| | | | | Fixes #94101 Automerge-Triggered-By: GH:tiran
* bpo-46541: remove usage of _Py_IDENTIFIER from _ssl module (GH-31599)Kumar Aditya2022-03-011-10/+32
|
* bpo-46232: Fix parsing of certs with bit string in DN (GH-30351)Christian Heimes2022-02-201-7/+19
|
* bpo-46613: Add PyType_GetModuleByDef to the public API (GH-31081)Petr Viktorin2022-02-111-2/+2
| | | | | * Make PyType_GetModuleByDef public (remove underscore) Co-authored-by: Victor Stinner <vstinner@python.org>
* bpo-46541: Replace core use of _Py_IDENTIFIER() with statically initialized ↵Eric Snow2022-02-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | global objects. (gh-30928) We're no longer using _Py_IDENTIFIER() (or _Py_static_string()) in any core CPython code. It is still used in a number of non-builtin stdlib modules. The replacement is: PyUnicodeObject (not pointer) fields under _PyRuntimeState, statically initialized as part of _PyRuntime. A new _Py_GET_GLOBAL_IDENTIFIER() macro facilitates lookup of the fields (along with _Py_GET_GLOBAL_STRING() for non-identifier strings). https://bugs.python.org/issue46541#msg411799 explains the rationale for this change. The core of the change is in: * (new) Include/internal/pycore_global_strings.h - the declarations for the global strings, along with the macros * Include/internal/pycore_runtime_init.h - added the static initializers for the global strings * Include/internal/pycore_global_objects.h - where the struct in pycore_global_strings.h is hooked into _PyRuntimeState * Tools/scripts/generate_global_objects.py - added generation of the global string declarations and static initializers I've also added a --check flag to generate_global_objects.py (along with make check-global-objects) to check for unused global strings. That check is added to the PR CI config. The remainder of this change updates the core code to use _Py_GET_GLOBAL_IDENTIFIER() instead of _Py_IDENTIFIER() and the related _Py*Id functions (likewise for _Py_GET_GLOBAL_STRING() instead of _Py_static_string()). This includes adding a few functions where there wasn't already an alternative to _Py*Id(), replacing the _Py_Identifier * parameter with PyObject *. The following are not changed (yet): * stop using _Py_IDENTIFIER() in the stdlib modules * (maybe) get rid of _Py_IDENTIFIER(), etc. entirely -- this may not be doable as at least one package on PyPI using this (private) API * (maybe) intern the strings during runtime init https://bugs.python.org/issue46541
* bpo-46670: Remove unused macros in the Modules directory (GH-31194)Victor Stinner2022-02-071-2/+0
| | | | | * bpo-46670: Remove unused macros in the Modules directory * Add again LINKAT_DIR_FD_CONVERTER: generated by Argument Clinic
* bpo-45439: Move _PyObject_CallNoArgs() to pycore_call.h (GH-28895)Victor Stinner2021-10-121-1/+1
| | | | | | | * Move _PyObject_CallNoArgs() to pycore_call.h (internal C API). * _ssl, _sqlite and _testcapi extensions now call the public PyObject_CallNoArgs() function, rather than _PyObject_CallNoArgs(). * _lsprof extension is now built with Py_BUILD_CORE_MODULE macro defined to get access to internal _PyObject_CallNoArgs().
* bpo-45439: Rename _PyObject_CallNoArg() to _PyObject_CallNoArgs() (GH-28891)Victor Stinner2021-10-111-1/+1
| | | | | Fix typo in the private _PyObject_CallNoArg() function name: rename it to _PyObject_CallNoArgs() to be consistent with the public function PyObject_CallNoArgs().
* bpo-41710: Add private _PyDeadline_Get() function (GH-28674)Victor Stinner2021-10-011-14/+20
| | | | | | | | Add a private C API for deadlines: add _PyDeadline_Init() and _PyDeadline_Get() functions. * Add _PyTime_Add() and _PyTime_Mul() functions which compute t1+t2 and t1*t2 and clamp the result on overflow. * _PyTime_MulDiv() now uses _PyTime_Add() and _PyTime_Mul().
* bpo-41710: Add _PyTime_AsTimespec_clamp() (GH-28629)Victor Stinner2021-09-301-1/+1
| | | | | | | | | | | | | | | Add the _PyTime_AsTimespec_clamp() function: similar to _PyTime_AsTimespec(), but clamp to _PyTime_t min/max and don't raise an exception. PyThread_acquire_lock_timed() now uses _PyTime_AsTimespec_clamp() to remove the Py_UNREACHABLE() code path. * Add _PyTime_AsTime_t() function. * Add PY_TIME_T_MIN and PY_TIME_T_MAX constants. * Replace _PyTime_AsTimeval_noraise() with _PyTime_AsTimeval_clamp(). * Add pytime_divide_round_up() function. * Fix integer overflow in pytime_divide(). * Add pytime_divmod() function.
* Fix typo in a comment in Modules/_ssl.c: s/validata/validate/ (GH-27993)Adam Dangoor2021-08-271-1/+1
|
* bpo-42854: Correctly use size_t for _ssl._SSLSocket.read and ↵Pablo Galindo Salgado2021-07-231-6/+6
| | | | _ssl._SSLSocket.write (GH-27271)
* bpo-44389: Fix typo in ssl deprecation warning message (GH-26754)Joe2021-06-171-1/+1
| | | `ssl.SSL_NO_TLS` should be `ssl.OP_NO_TLS`.
* bpo-44389: Fix deprecation of OP_NO_TLSv1_3 (GH-26700)Christian Heimes2021-06-131-1/+1
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-44389: Remove duplicate SSL_OP_NO_TLSv1_2 flag (GH-26680)Erlend Egeberg Aasland2021-06-121-1/+1
|
* bpo-44362: ssl: improve deprecation warnings and docs (GH-26646)Christian Heimes2021-06-111-14/+28
| | | Signed-off-by: Christian Heimes <christian@python.org>
* bpo-44252: Correctly implement gc support for SSLError objects (GH-26439)Pablo Galindo2021-05-281-2/+1
|
generated by cgit v0.12 at 2024-12-11 09:05:57 (GMT)