From 3b1a8b3bbe2ff77975a13255c23a0f0bb4d55ebe Mon Sep 17 00:00:00 2001 From: Benjamin Peterson Date: Thu, 7 Jan 2016 21:37:37 -0800 Subject: enable SSL_MODE_RELEASE_BUFFERS Patch by Cory Benfield. --- Misc/NEWS | 3 +++ Modules/_ssl.c | 17 +++++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/Misc/NEWS b/Misc/NEWS index fd22bbb..61b62f7 100644 --- a/Misc/NEWS +++ b/Misc/NEWS @@ -41,6 +41,9 @@ Core and Builtins Library ------- +- Issue #25672: In the ssl module, enable the SSL_MODE_RELEASE_BUFFERS mode + option if it is safe to do so. + - Issue #22570: Add 'path' attribute to pathlib.Path objects, returning the same as str(), to make it more similar to DirEntry. Library code can now write getattr(p, 'path', p) to get the path as diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 8818d26..1c68000 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -2219,6 +2219,7 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version) PySSLContext *self; long options; SSL_CTX *ctx = NULL; + unsigned long libver; PySSL_BEGIN_ALLOW_THREADS if (proto_version == PY_SSL_VERSION_TLS1) @@ -2281,6 +2282,22 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version) options |= SSL_OP_NO_SSLv3; SSL_CTX_set_options(self->ctx, options); +#if defined(SSL_MODE_RELEASE_BUFFERS) + /* Set SSL_MODE_RELEASE_BUFFERS. This potentially greatly reduces memory + usage for no cost at all. However, don't do this for OpenSSL versions + between 1.0.1 and 1.0.1h or 1.0.0 and 1.0.0m, which are affected by CVE + 2014-0198. I can't find exactly which beta fixed this CVE, so be + conservative and assume it wasn't fixed until release. We do this check + at runtime to avoid problems from the dynamic linker. + See #25672 for more on this. */ + libver = SSLeay(); + if (!(libver >= 0x10001000UL && libver < 0x1000108fUL) && + !(libver >= 0x10000000UL && libver < 0x100000dfUL)) { + SSL_CTX_set_mode(self->ctx, SSL_MODE_RELEASE_BUFFERS); + } +#endif + + #ifndef OPENSSL_NO_ECDH /* Allow automatic ECDH curve selection (on OpenSSL 1.0.2+), or use prime256v1 by default. This is Apache mod_ssl's initialization -- cgit v0.12