Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 3de4919

Browse files
author
Victor Stinner
committed
Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional
OpenSSL is now compiled with OPENSSL_NO_SSL2 defined (without the SSLv2 protocol) on Debian: fix the ssl module on Debian Testing and Debian Sid. Optimize also ssl.get_protocol_name(): speed does matter!
1 parent 3a0792d commit 3de4919

5 files changed

Lines changed: 60 additions & 36 deletions

File tree

‎Doc/library/ssl.rst‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,9 @@ Constants
292292

293293
Selects SSL version 2 as the channel encryption protocol.
294294

295+
This protocol is not available if OpenSSL is compiled with OPENSSL_NO_SSL2
296+
flag.
297+
295298
.. warning::
296299

297300
SSL version 2 is insecure. Its use is highly discouraged.

‎Lib/ssl.py‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -62,8 +62,6 @@
6262
from _ssl import OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_INFO, OPENSSL_VERSION
6363
from _ssl import _SSLContext, SSLError
6464
from _ssl import CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
65-
from _ssl import (PROTOCOL_SSLv2, PROTOCOL_SSLv3, PROTOCOL_SSLv23,
66-
PROTOCOL_TLSv1)
6765
from _ssl import OP_ALL, OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_TLSv1
6866
from _ssl import RAND_status, RAND_egd, RAND_add
6967
from _ssl import (
@@ -78,6 +76,19 @@
7876
SSL_ERROR_INVALID_ERROR_CODE,
7977
)
8078
from _ssl import HAS_SNI
79+
from _ssl import (PROTOCOL_SSLv3, PROTOCOL_SSLv23,
80+
PROTOCOL_TLSv1)
81+
_PROTOCOL_NAMES = {
82+
PROTOCOL_TLSv1: "TLSv1",
83+
PROTOCOL_SSLv23: "SSLv23",
84+
PROTOCOL_SSLv3: "SSLv3",
85+
}
86+
try:
87+
from _ssl import PROTOCOL_SSLv2
88+
except ImportError:
89+
pass
90+
else:
91+
_PROTOCOL_NAMES[PROTOCOL_SSLv2] = "SSLv2"
8192

8293
from socket import getnameinfo as _getnameinfo
8394
from socket import error as socket_error
@@ -552,13 +563,4 @@ def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None):
552563
return DER_cert_to_PEM_cert(dercert)
553564

554565
def get_protocol_name(protocol_code):
555-
if protocol_code == PROTOCOL_TLSv1:
556-
return "TLSv1"
557-
elif protocol_code == PROTOCOL_SSLv23:
558-
return "SSLv23"
559-
elif protocol_code == PROTOCOL_SSLv2:
560-
return "SSLv2"
561-
elif protocol_code == PROTOCOL_SSLv3:
562-
return "SSLv3"
563-
else:
564-
return "<unknown>"
566+
return _PROTOCOL_NAMES.get(protocol_code, '<unknown>')

‎Lib/test/test_ssl.py‎

Lines changed: 34 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,11 @@
2121
ssl = support.import_module("ssl")
2222

2323
PROTOCOLS = [
24-
ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv3,
24+
ssl.PROTOCOL_SSLv3,
2525
ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1
2626
]
27+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
28+
PROTOCOLS.append(ssl.PROTOCOL_SSLv2)
2729

2830
HOST = support.HOST
2931

@@ -67,22 +69,25 @@ def no_sslv2_implies_sslv3_hello():
6769

6870
# Issue #9415: Ubuntu hijacks their OpenSSL and forcefully disables SSLv2
6971
def skip_if_broken_ubuntu_ssl(func):
70-
@functools.wraps(func)
71-
def f(*args, **kwargs):
72-
try:
73-
ssl.SSLContext(ssl.PROTOCOL_SSLv2)
74-
except ssl.SSLError:
75-
if (ssl.OPENSSL_VERSION_INFO == (0, 9, 8, 15, 15) and
76-
platform.linux_distribution() == ('debian', 'squeeze/sid', '')):
77-
raise unittest.SkipTest("Patched Ubuntu OpenSSL breaks behaviour")
78-
return func(*args, **kwargs)
79-
return f
72+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
73+
@functools.wraps(func)
74+
def f(*args, **kwargs):
75+
try:
76+
ssl.SSLContext(ssl.PROTOCOL_SSLv2)
77+
except ssl.SSLError:
78+
if (ssl.OPENSSL_VERSION_INFO == (0, 9, 8, 15, 15) and
79+
platform.linux_distribution() == ('debian', 'squeeze/sid', '')):
80+
raise unittest.SkipTest("Patched Ubuntu OpenSSL breaks behaviour")
81+
return func(*args, **kwargs)
82+
return f
83+
else:
84+
return func
8085

8186

8287
class BasicSocketTests(unittest.TestCase):
8388

8489
def test_constants(self):
85-
ssl.PROTOCOL_SSLv2
90+
#ssl.PROTOCOL_SSLv2
8691
ssl.PROTOCOL_SSLv23
8792
ssl.PROTOCOL_SSLv3
8893
ssl.PROTOCOL_TLSv1
@@ -310,7 +315,8 @@ class ContextTests(unittest.TestCase):
310315

311316
@skip_if_broken_ubuntu_ssl
312317
def test_constructor(self):
313-
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv2)
318+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
319+
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv2)
314320
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
315321
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv3)
316322
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
@@ -1204,6 +1210,8 @@ def connector():
12041210
t.join()
12051211

12061212
@skip_if_broken_ubuntu_ssl
1213+
@unittest.skipUnless(hasattr(ssl, 'PROTOCOL_SSLv2'),
1214+
"OpenSSL is compiled without SSLv2 support")
12071215
def test_protocol_sslv2(self):
12081216
"""Connecting to an SSLv2 server with various client options"""
12091217
if support.verbose:
@@ -1229,14 +1237,15 @@ def test_protocol_sslv23(self):
12291237
"""Connecting to an SSLv23 server with various client options"""
12301238
if support.verbose:
12311239
sys.stdout.write("\n")
1232-
try:
1233-
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv2, True)
1234-
except (ssl.SSLError, socket.error) as x:
1235-
# this fails on some older versions of OpenSSL (0.9.7l, for instance)
1236-
if support.verbose:
1237-
sys.stdout.write(
1238-
" SSL2 client to SSL23 server test unexpectedly failed:\n %s\n"
1239-
% str(x))
1240+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
1241+
try:
1242+
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv2, True)
1243+
except (ssl.SSLError, socket.error) as x:
1244+
# this fails on some older versions of OpenSSL (0.9.7l, for instance)
1245+
if support.verbose:
1246+
sys.stdout.write(
1247+
" SSL2 client to SSL23 server test unexpectedly failed:\n %s\n"
1248+
% str(x))
12401249
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, True)
12411250
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True)
12421251
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, True)
@@ -1267,7 +1276,8 @@ def test_protocol_sslv3(self):
12671276
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True)
12681277
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True, ssl.CERT_OPTIONAL)
12691278
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, True, ssl.CERT_REQUIRED)
1270-
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv2, False)
1279+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
1280+
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv2, False)
12711281
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv23, False)
12721282
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_TLSv1, False)
12731283
if no_sslv2_implies_sslv3_hello():
@@ -1283,7 +1293,8 @@ def test_protocol_tlsv1(self):
12831293
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True)
12841294
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True, ssl.CERT_OPTIONAL)
12851295
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, True, ssl.CERT_REQUIRED)
1286-
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv2, False)
1296+
if hasattr(ssl, 'PROTOCOL_SSLv2'):
1297+
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv2, False)
12871298
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv3, False)
12881299
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv23, False)
12891300

‎Misc/NEWS‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,8 @@ Core and Builtins
140140
Library
141141
-------
142142

143+
- Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional.
144+
143145
- Issue #8407: The signal handler writes the signal number as a single byte
144146
instead of a nul byte into the wakeup file descriptor. So it is possible to
145147
wait more than one signal and know which signals were raised.

‎Modules/_ssl.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,8 +63,10 @@ enum py_ssl_cert_requirements {
6363
};
6464

6565
enum py_ssl_version {
66+
#ifndef OPENSSL_NO_SSL2
6667
PY_SSL_VERSION_SSL2,
67-
PY_SSL_VERSION_SSL3,
68+
#endif
69+
PY_SSL_VERSION_SSL3=1,
6870
PY_SSL_VERSION_SSL23,
6971
PY_SSL_VERSION_TLS1
7072
};
@@ -1447,8 +1449,10 @@ context_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
14471449
ctx = SSL_CTX_new(TLSv1_method());
14481450
else if (proto_version == PY_SSL_VERSION_SSL3)
14491451
ctx = SSL_CTX_new(SSLv3_method());
1452+
#ifndef OPENSSL_NO_SSL2
14501453
else if (proto_version == PY_SSL_VERSION_SSL2)
14511454
ctx = SSL_CTX_new(SSLv2_method());
1455+
#endif
14521456
else if (proto_version == PY_SSL_VERSION_SSL23)
14531457
ctx = SSL_CTX_new(SSLv23_method());
14541458
else
@@ -2107,8 +2111,10 @@ PyInit__ssl(void)
21072111
PY_SSL_CERT_REQUIRED);
21082112

21092113
/* protocol versions */
2114+
#ifndef OPENSSL_NO_SSL2
21102115
PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
21112116
PY_SSL_VERSION_SSL2);
2117+
#endif
21122118
PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
21132119
PY_SSL_VERSION_SSL3);
21142120
PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",

0 commit comments

Comments
 (0)