Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 17ca323

Browse files
author
Victor Stinner
committed
(Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional
OpenSSL is now compiled with OPENSSL_NO_SSL2 defined (without the SSLv2 protocol) on Debian: fix the ssl module on Debian Testing and Debian Sid. Optimize also ssl.get_protocol_name(): speed does matter!
2 parents db93278 + ee18b6f commit 17ca323

5 files changed

Lines changed: 58 additions & 36 deletions

File tree

‎Doc/library/ssl.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -289,6 +289,9 @@ Constants
289289

290290
Selects SSL version 2 as the channel encryption protocol.
291291

292+
This protocol is not available if OpenSSL is compiled with OPENSSL_NO_SSL2
293+
flag.
294+
292295
.. warning::
293296

294297
SSL version 2 is insecure. Its use is highly discouraged.

‎Lib/ssl.py‎

Lines changed: 13 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,6 @@
6262
from _ssl import OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_INFO, OPENSSL_VERSION
6363
from _ssl import _SSLContext, SSLError
6464
from _ssl import CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
65-
from _ssl import (PROTOCOL_SSLv2, PROTOCOL_SSLv3, PROTOCOL_SSLv23,
66-
PROTOCOL_TLSv1)
6765
from _ssl import OP_ALL, OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_TLSv1
6866
from _ssl import RAND_status, RAND_egd, RAND_add
6967
from _ssl import (
@@ -78,6 +76,18 @@
7876
SSL_ERROR_INVALID_ERROR_CODE,
7977
)
8078
from _ssl import HAS_SNI
79+
from _ssl import PROTOCOL_SSLv3, PROTOCOL_SSLv23, PROTOCOL_TLSv1
80+
_PROTOCOL_NAMES = {
81+
PROTOCOL_TLSv1: "TLSv1",
82+
PROTOCOL_SSLv23: "SSLv23",
83+
PROTOCOL_SSLv3: "SSLv3",
84+
}
85+
try:
86+
from _ssl import PROTOCOL_SSLv2
87+
except ImportError:
88+
pass
89+
else:
90+
_PROTOCOL_NAMES[PROTOCOL_SSLv2] = "SSLv2"
8191

8292
from socket import getnameinfo as _getnameinfo
8393
from socket import error as socket_error
@@ -552,13 +562,4 @@ def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None):
552562
return DER_cert_to_PEM_cert(dercert)
553563

554564
def get_protocol_name(protocol_code):
555-
if protocol_code == PROTOCOL_TLSv1:
556-
return "TLSv1"
557-
elif protocol_code == PROTOCOL_SSLv23:
558-
return "SSLv23"
559-
elif protocol_code == PROTOCOL_SSLv2:
560-
return "SSLv2"
561-
elif protocol_code == PROTOCOL_SSLv3:
562-
return "SSLv3"
563-
else:
564-
return "<unknown>"
565+
return _PROTOCOL_NAMES.get(protocol_code, '<unknown>')

‎Lib/test/test_ssl.py‎

Lines changed: 33 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,11 @@
2121
ssl = support.import_module("ssl")
2222

2323
PROTOCOLS = [
24-
ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv3,
24+
ssl.PROTOCOL_SSLv3,
2525
ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1
2626
]
27+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
28+
PROTOCOLS.append(ssl.PROTOCOL_SSLv2)
2729

2830
HOST = support.HOST
2931

@@ -67,22 +69,25 @@ def no_sslv2_implies_sslv3_hello():
6769

6870
# Issue #9415: Ubuntu hijacks their OpenSSL and forcefully disables SSLv2
6971
def skip_if_broken_ubuntu_ssl(func):
70-
@functools.wraps(func)
71-
def f(*args, **kwargs):
72-
try:
73-
ssl.SSLContext(ssl.PROTOCOL_SSLv2)
74-
except ssl.SSLError:
75-
if (ssl.OPENSSL_VERSION_INFO == (0, 9, 8, 15, 15) and
76-
platform.linux_distribution() == ('debian', 'squeeze/sid', '')):
77-
raise unittest.SkipTest("Patched Ubuntu OpenSSL breaks behaviour")
78-
return func(*args, **kwargs)
79-
return f
72+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
73+
@functools.wraps(func)
74+
def f(*args, **kwargs):
75+
try:
76+
ssl.SSLContext(ssl.PROTOCOL_SSLv2)
77+
except ssl.SSLError:
78+
if (ssl.OPENSSL_VERSION_INFO == (0, 9, 8, 15, 15) and
79+
platform.linux_distribution() == ('debian', 'squeeze/sid', '')):
80+
raise unittest.SkipTest("Patched Ubuntu OpenSSL breaks behaviour")
81+
return func(*args, **kwargs)
82+
return f
83+
else:
84+
return func
8085

8186

8287
class BasicSocketTests(unittest.TestCase):
8388

8489
def test_constants(self):
85-
ssl.PROTOCOL_SSLv2
90+
#ssl.PROTOCOL_SSLv2
8691
ssl.PROTOCOL_SSLv23
8792
ssl.PROTOCOL_SSLv3
8893
ssl.PROTOCOL_TLSv1
@@ -310,7 +315,8 @@ class ContextTests(unittest.TestCase):
310315

311316
@skip_if_broken_ubuntu_ssl
312317
def test_constructor(self):
313-
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv2)
318+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
319+
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv2)
314320
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
315321
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv3)
316322
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
@@ -1199,6 +1205,7 @@ def connector():
11991205
t.join()
12001206

12011207
@skip_if_broken_ubuntu_ssl
1208+
@unittest.skipUnless(hasattr(ssl, 'PROTOCOL_SSLv2'), "need SSLv2")
12021209
def test_protocol_sslv2(self):
12031210
"""Connecting to an SSLv2 server with various client options"""
12041211
if support.verbose:
@@ -1224,14 +1231,15 @@ def test_protocol_sslv23(self):
12241231
"""Connecting to an SSLv23 server with various client options"""
12251232
if support.verbose:
12261233
sys.stdout.write("\n")
1227-
try:
1228-
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv2, True)
1229-
except (ssl.SSLError, socket.error) as x:
1230-
# this fails on some older versions of OpenSSL (0.9.7l, for instance)
1231-
if support.verbose:
1232-
sys.stdout.write(
1233-
" SSL2 client to SSL23 server test unexpectedly failed:\n %s\n"
1234-
% str(x))
1234+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
1235+
try:
1236+
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv2, True)
1237+
except (ssl.SSLError, socket.error) as x:
1238+
# this fails on some older versions of OpenSSL (0.9.7l, for instance)
1239+
if support.verbose:
1240+
sys.stdout.write(
1241+
" SSL2 client to SSL23 server test unexpectedly failed:\n %s\n"
1242+
% str(x))
12351243
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, True)
12361244
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True)
12371245
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, True)
@@ -1262,7 +1270,8 @@ def test_protocol_sslv3(self):
12621270
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True)
12631271
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True, ssl.CERT_OPTIONAL)
12641272
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True, ssl.CERT_REQUIRED)
1265-
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv2, False)
1273+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
1274+
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv2, False)
12661275
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv23, False)
12671276
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_TLSv1, False)
12681277
if no_sslv2_implies_sslv3_hello():
@@ -1278,7 +1287,8 @@ def test_protocol_tlsv1(self):
12781287
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True)
12791288
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True, ssl.CERT_OPTIONAL)
12801289
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True, ssl.CERT_REQUIRED)
1281-
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv2, False)
1290+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
1291+
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv2, False)
12821292
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv3, False)
12831293
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv23, False)
12841294

‎Misc/NEWS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -618,6 +618,8 @@ Core and Builtins
618618
Library
619619
-------
620620

621+
- Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional.
622+
621623
- Issue #10916: mmap should not segfault when a file is mapped using 0 as length
622624
and a non-zero offset, and an attempt to read past the end of file is made
623625
(IndexError is raised instead). Patch by Ross Lagerwall.

‎Modules/_ssl.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,10 @@ enum py_ssl_cert_requirements {
6363
};
6464

6565
enum py_ssl_version {
66+
#ifndef OPENSSL_NO_SSL2
6667
PY_SSL_VERSION_SSL2,
67-
PY_SSL_VERSION_SSL3,
68+
#endif
69+
PY_SSL_VERSION_SSL3=1,
6870
PY_SSL_VERSION_SSL23,
6971
PY_SSL_VERSION_TLS1
7072
};
@@ -1450,8 +1452,10 @@ context_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
14501452
ctx = SSL_CTX_new(TLSv1_method());
14511453
else if (proto_version == PY_SSL_VERSION_SSL3)
14521454
ctx = SSL_CTX_new(SSLv3_method());
1455+
#ifndef OPENSSL_NO_SSL2
14531456
else if (proto_version == PY_SSL_VERSION_SSL2)
14541457
ctx = SSL_CTX_new(SSLv2_method());
1458+
#endif
14551459
else if (proto_version == PY_SSL_VERSION_SSL23)
14561460
ctx = SSL_CTX_new(SSLv23_method());
14571461
else
@@ -2110,8 +2114,10 @@ PyInit__ssl(void)
21102114
PY_SSL_CERT_REQUIRED);
21112115

21122116
/* protocol versions */
2117+
#ifndef OPENSSL_NO_SSL2
21132118
PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
21142119
PY_SSL_VERSION_SSL2);
2120+
#endif
21152121
PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
21162122
PY_SSL_VERSION_SSL3);
21172123
PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",

0 commit comments

Comments
 (0)