Skip to content

Commit aa73841

Browse files
zoobazooba
authored
bpo-35926: Add support for OpenSSL 1.1.1b on Windows (GH-11779)
1 parent 876756e commit aa73841

File tree

12 files changed

+69
-42
lines changed

12 files changed

+69
-42
lines changed

‎.azure-pipelines/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ jobs:
5959
variables:
6060
testRunTitle: '$(build.sourceBranchName)-linux'
6161
testRunPlatform: linux
62-
openssl_version: 1.1.0j
62+
openssl_version: 1.1.1b
6363

6464
steps:
6565
- template: ./posix-steps.yml
@@ -116,7 +116,7 @@ jobs:
116116
variables:
117117
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
118118
testRunPlatform: linux-coverage
119-
openssl_version: 1.1.0j
119+
openssl_version: 1.1.1b
120120

121121
steps:
122122
- template: ./posix-steps.yml

‎Lib/test/test_asyncio/test_sslproto.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -494,8 +494,8 @@ def test_start_tls_server_1(self):
494494

495495
server_context = test_utils.simple_server_sslcontext()
496496
client_context = test_utils.simple_client_sslcontext()
497-
if sys.platform.startswith('freebsd'):
498-
# bpo-35031: Some FreeBSD buildbots fail to run this test
497+
if sys.platform.startswith('freebsd') or sys.platform.startswith('win'):
498+
# bpo-35031: Some FreeBSD and Windows buildbots fail to run this test
499499
# as the eof was not being received by the server if the payload
500500
# size is not big enough. This behaviour only appears if the
501501
# client is using TLS1.3.

‎Lib/test/test_ssl.py

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2214,14 +2214,17 @@ def wrap_conn(self):
22142214
self.sock, server_side=True)
22152215
self.server.selected_npn_protocols.append(self.sslconn.selected_npn_protocol())
22162216
self.server.selected_alpn_protocols.append(self.sslconn.selected_alpn_protocol())
2217-
except (ConnectionResetError, BrokenPipeError) as e:
2217+
except (ConnectionResetError, BrokenPipeError, ConnectionAbortedError) as e:
22182218
# We treat ConnectionResetError as though it were an
22192219
# SSLError - OpenSSL on Ubuntu abruptly closes the
22202220
# connection when asked to use an unsupported protocol.
22212221
#
22222222
# BrokenPipeError is raised in TLS 1.3 mode, when OpenSSL
22232223
# tries to send session tickets after handshake.
22242224
# https://github.com/openssl/openssl/issues/6342
2225+
#
2226+
# ConnectionAbortedError is raised in TLS 1.3 mode, when OpenSSL
2227+
# tries to send session tickets after handshake when using WinSock.
22252228
self.server.conn_errors.append(str(e))
22262229
if self.server.chatty:
22272230
handle_error("\n server: bad connection attempt from " + repr(self.addr) + ":\n")
@@ -2352,7 +2355,7 @@ def run(self):
23522355
sys.stdout.write(" server: read %r (%s), sending back %r (%s)...\n"
23532356
% (msg, ctype, msg.lower(), ctype))
23542357
self.write(msg.lower())
2355-
except ConnectionResetError:
2358+
except (ConnectionResetError, ConnectionAbortedError):
23562359
# XXX: OpenSSL 1.1.1 sometimes raises ConnectionResetError
23572360
# when connection is not shut down gracefully.
23582361
if self.server.chatty and support.verbose:
@@ -2362,6 +2365,18 @@ def run(self):
23622365
)
23632366
self.close()
23642367
self.running = False
2368+
except ssl.SSLError as err:
2369+
# On Windows sometimes test_pha_required_nocert receives the
2370+
# PEER_DID_NOT_RETURN_A_CERTIFICATE exception
2371+
# before the 'tlsv13 alert certificate required' exception.
2372+
# If the server is stopped when PEER_DID_NOT_RETURN_A_CERTIFICATE
2373+
# is received test_pha_required_nocert fails with ConnectionResetError
2374+
# because the underlying socket is closed
2375+
if 'PEER_DID_NOT_RETURN_A_CERTIFICATE' == err.reason:
2376+
if self.server.chatty and support.verbose:
2377+
sys.stdout.write(err.args[1])
2378+
# test_pha_required_nocert is expecting this exception
2379+
raise ssl.SSLError('tlsv13 alert certificate required')
23652380
except OSError:
23662381
if self.server.chatty:
23672382
handle_error("Test server failure:\n")

‎Misc/ACKS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1088,6 +1088,7 @@ Tim Mitchell
10881088
Zubin Mithra
10891089
Florian Mladitsch
10901090
Doug Moen
1091+
Paul Monson
10911092
The Dragon De Monsyne
10921093
Bastien Montagne
10931094
Skip Montanaro

‎Misc/NEWS.d/next/Windows/2019-03-01-16-43-45.bpo-35926.mLszHo.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Update to OpenSSL 1.1.1b for Windows.

‎Modules/_ssl.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -669,7 +669,7 @@ fill_and_set_sslerror(PySSLSocket *sslsock, PyObject *type, int ssl_errno,
669669
if (msg == NULL)
670670
goto fail;
671671

672-
init_value = Py_BuildValue("iN", ssl_errno, msg);
672+
init_value = Py_BuildValue("iN", ERR_GET_REASON(ssl_errno), msg);
673673
if (init_value == NULL)
674674
goto fail;
675675

‎PCbuild/get_externals.bat

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ echo.Fetching external libraries...
4949

5050
set libraries=
5151
set libraries=%libraries% bzip2-1.0.6
52-
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-1.1.0j
52+
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-1.1.1b
5353
set libraries=%libraries% sqlite-3.21.0.0
5454
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.9.0
5555
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tk-8.6.9.0
@@ -72,7 +72,7 @@ for %%e in (%libraries%) do (
7272
echo.Fetching external binaries...
7373

7474
set binaries=
75-
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-1.1.0j
75+
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-1.1.1b
7676
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.9.0
7777
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06
7878

‎PCbuild/openssl.props

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@
1111
</ItemDefinitionGroup>
1212
<PropertyGroup>
1313
<_DLLSuffix>-1_1</_DLLSuffix>
14-
<_DLLSuffix Condition="$(Platform) == 'x64'">$(_DLLSuffix)-x64</_DLLSuffix>
14+
<_DLLSuffix Condition="$(Platform) == 'ARM'">$(_DLLSuffix)-arm</_DLLSuffix>
15+
<_DLLSuffix Condition="$(Platform) == 'ARM64'">$(_DLLSuffix)-arm64</_DLLSuffix>
1516
</PropertyGroup>
1617
<ItemGroup>
1718
<_SSLDLL Include="$(opensslOutDir)\libcrypto$(_DLLSuffix).dll" />

‎PCbuild/openssl.vcxproj

Lines changed: 33 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,21 @@
11
<?xml version="1.0" encoding="utf-8"?>
22
<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
33
<ItemGroup Label="ProjectConfigurations">
4-
<ProjectConfiguration Include="Debug|Win32">
5-
<Configuration>Debug</Configuration>
6-
<Platform>Win32</Platform>
7-
</ProjectConfiguration>
84
<ProjectConfiguration Include="Release|Win32">
95
<Configuration>Release</Configuration>
106
<Platform>Win32</Platform>
117
</ProjectConfiguration>
12-
<ProjectConfiguration Include="PGInstrument|Win32">
13-
<Configuration>PGInstrument</Configuration>
14-
<Platform>Win32</Platform>
15-
</ProjectConfiguration>
16-
<ProjectConfiguration Include="PGInstrument|x64">
17-
<Configuration>PGInstrument</Configuration>
18-
<Platform>x64</Platform>
19-
</ProjectConfiguration>
20-
<ProjectConfiguration Include="PGUpdate|Win32">
21-
<Configuration>PGUpdate</Configuration>
22-
<Platform>Win32</Platform>
23-
</ProjectConfiguration>
24-
<ProjectConfiguration Include="PGUpdate|x64">
25-
<Configuration>PGUpdate</Configuration>
8+
<ProjectConfiguration Include="Release|x64">
9+
<Configuration>Release</Configuration>
2610
<Platform>x64</Platform>
2711
</ProjectConfiguration>
28-
<ProjectConfiguration Include="Debug|x64">
29-
<Configuration>Debug</Configuration>
30-
<Platform>x64</Platform>
12+
<ProjectConfiguration Include="Release|ARM">
13+
<Configuration>Release</Configuration>
14+
<Platform>ARM</Platform>
3115
</ProjectConfiguration>
32-
<ProjectConfiguration Include="Release|x64">
16+
<ProjectConfiguration Include="Release|ARM64">
3317
<Configuration>Release</Configuration>
34-
<Platform>x64</Platform>
18+
<Platform>ARM64</Platform>
3519
</ProjectConfiguration>
3620
</ItemGroup>
3721
<PropertyGroup Label="Globals">
@@ -40,15 +24,36 @@
4024

4125
<Import Project="python.props" />
4226
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
43-
44-
<PropertyGroup Label="Configuration">
27+
28+
<PropertyGroup Label="Configuration" Condition="$(Platform) == 'Win32'">
4529
<ConfigurationType>Makefile</ConfigurationType>
4630
<Bitness>32</Bitness>
47-
<Bitness Condition="$(Platform) == 'x64'">64</Bitness>
4831
<ArchName>x86</ArchName>
49-
<ArchName Condition="$(Platform) == 'x64'">amd64</ArchName>
5032
<OpenSSLPlatform>VC-WIN32</OpenSSLPlatform>
51-
<OpenSSLPlatform Condition="$(Platform) == 'x64'">VC-WIN64A</OpenSSLPlatform>
33+
<SupportSigning>true</SupportSigning>
34+
</PropertyGroup>
35+
36+
<PropertyGroup Label="Configuration" Condition="$(Platform) == 'x64'">
37+
<ConfigurationType>Makefile</ConfigurationType>
38+
<Bitness>64</Bitness>
39+
<ArchName>amd64</ArchName>
40+
<OpenSSLPlatform>VC-WIN64A-masm</OpenSSLPlatform>
41+
<SupportSigning>true</SupportSigning>
42+
</PropertyGroup>
43+
44+
<PropertyGroup Label="Configuration" Condition="$(Platform) == 'ARM'">
45+
<ConfigurationType>Makefile</ConfigurationType>
46+
<Bitness>ARM</Bitness>
47+
<ArchName>ARM</ArchName>
48+
<OpenSSLPlatform>VC-WIN32-ARM</OpenSSLPlatform>
49+
<SupportSigning>true</SupportSigning>
50+
</PropertyGroup>
51+
52+
<PropertyGroup Label="Configuration" Condition="$(Platform) == 'ARM64'">
53+
<ConfigurationType>Makefile</ConfigurationType>
54+
<Bitness>ARM64</Bitness>
55+
<ArchName>ARM64</ArchName>
56+
<OpenSSLPlatform>VC-WIN64-ARM</OpenSSLPlatform>
5257
<SupportSigning>true</SupportSigning>
5358
</PropertyGroup>
5459

‎PCbuild/prepare_ssl.bat

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ if ERRORLEVEL 1 (echo Cannot locate MSBuild.exe on PATH or as MSBUILD variable &
4242
call "%PCBUILD%\find_python.bat" "%PYTHON%"
4343
if ERRORLEVEL 1 (echo Cannot locate python.exe on PATH or as PYTHON variable & exit /b 3)
4444

45-
call "%PCBUILD%\get_externals.bat" --openssl-src %ORG_SETTING%
45+
call "%PCBUILD%\get_externals.bat" --openssl-src --no-openssl %ORG_SETTING%
4646

4747
if "%PERL%" == "" where perl > "%TEMP%\perl.loc" 2> nul && set /P PERL= <"%TEMP%\perl.loc" & del "%TEMP%\perl.loc"
4848
if "%PERL%" == "" (echo Cannot locate perl.exe on PATH or as PERL variable & exit /b 4)
@@ -51,4 +51,8 @@ if "%PERL%" == "" (echo Cannot locate perl.exe on PATH or as PERL variable & exi
5151
if errorlevel 1 exit /b
5252
%MSBUILD% "%PCBUILD%\openssl.vcxproj" /p:Configuration=Release /p:Platform=x64
5353
if errorlevel 1 exit /b
54+
%MSBUILD% "%PCBUILD%\openssl.vcxproj" /p:Configuration=Release /p:Platform=ARM
55+
if errorlevel 1 exit /b
56+
%MSBUILD% "%PCBUILD%\openssl.vcxproj" /p:Configuration=Release /p:Platform=ARM64
57+
if errorlevel 1 exit /b
5458

0 commit comments

Comments
 (0)