Attachment #498600 for bug #592480

Lines 50-55 Link Here

(-)Python-3.4.6-orig/Doc/library/ssl.rst (-19 / +84 lines)
50	helps manage settings and certificates, which can then be inherited	50	helps manage settings and certificates, which can then be inherited
51	by SSL sockets created through the :meth:`SSLContext.wrap_socket` method.	51	by SSL sockets created through the :meth:`SSLContext.wrap_socket` method.
52		52
		53	.. versionchanged:: 3.6
		54
		55	OpenSSL 0.9.8, 1.0.0 and 1.0.1 are deprecated and no longer supported.
		56	In the future the ssl module will require at least OpenSSL 1.0.2 or
		57	1.1.0.
		58
53		59
54	Functions, Constants, and Exceptions	60	Functions, Constants, and Exceptions
55	------------------------------------	61	------------------------------------
Lines 179-185 Link Here
179	use. Typically, the server chooses a particular protocol version, and the	185	use. Typically, the server chooses a particular protocol version, and the
180	client must adapt to the server's choice. Most of the versions are not	186	client must adapt to the server's choice. Most of the versions are not
181	interoperable with the other versions. If not specified, the default is	187	interoperable with the other versions. If not specified, the default is
182	:data:`PROTOCOL_SSLv23`; it provides the most compatibility with other	188	:data:`PROTOCOL_TLS`; it provides the most compatibility with other
183	versions.	189	versions.
184		190
185	Here's a table showing which versions in a client (down the side) can connect	191	Here's a table showing which versions in a client (down the side) can connect
Lines 188-198 Link Here
188	.. table::	194	.. table::
189		195
190	======================== ========= ========= ========== ========= =========== ===========	196	======================== ========= ========= ========== ========= =========== ===========
191	client / server SSLv2 SSLv3 SSLv23 TLSv1 TLSv1.1 TLSv1.2	197	client / server SSLv2 SSLv3 TLS TLSv1 TLSv1.1 TLSv1.2
192	------------------------ --------- --------- ---------- --------- ----------- -----------	198	------------------------ --------- --------- ---------- --------- ----------- -----------
193	SSLv2 yes no yes no no no	199	SSLv2 yes no yes no no no
194	SSLv3 no yes yes no no no	200	SSLv3 no yes yes no no no
195	SSLv23 no yes yes yes yes yes	201	TLS (SSLv23) no yes yes yes yes yes
196	TLSv1 no no yes yes no no	202	TLSv1 no no yes yes no no
197	TLSv1.1 no no yes no yes no	203	TLSv1.1 no no yes no yes no
198	TLSv1.2 no no yes no no yes	204	TLSv1.2 no no yes no no yes
Lines 245-251 Link Here
245	:const:`None`, this function can choose to trust the system's default	251	:const:`None`, this function can choose to trust the system's default
246	CA certificates instead.	252	CA certificates instead.
247		253
248	The settings are: :data:`PROTOCOL_SSLv23`, :data:`OP_NO_SSLv2`, and	254	The settings are: :data:`PROTOCOL_TLS`, :data:`OP_NO_SSLv2`, and
249	:data:`OP_NO_SSLv3` with high encryption cipher suites without RC4 and	255	:data:`OP_NO_SSLv3` with high encryption cipher suites without RC4 and
250	without unauthenticated cipher suites. Passing :data:`~Purpose.SERVER_AUTH`	256	without unauthenticated cipher suites. Passing :data:`~Purpose.SERVER_AUTH`
251	as purpose sets :data:`~SSLContext.verify_mode` to :data:`CERT_REQUIRED`	257	as purpose sets :data:`~SSLContext.verify_mode` to :data:`CERT_REQUIRED`
Lines 317-322 Link Here
317		323
318	.. versionadded:: 3.3	324	.. versionadded:: 3.3
319		325
		326	.. deprecated:: 3.6
		327
		328	OpenSSL has deprecated :func:`ssl.RAND_pseudo_bytes`, use
		329	:func:`ssl.RAND_bytes` instead.
		330
320	.. function:: RAND_status()	331	.. function:: RAND_status()
321		332
322	Return ``True`` if the SSL pseudo-random number generator has been seeded	333	Return ``True`` if the SSL pseudo-random number generator has been seeded
Lines 335-340 Link Here
335	See http://egd.sourceforge.net/ or http://prngd.sourceforge.net/ for sources	346	See http://egd.sourceforge.net/ or http://prngd.sourceforge.net/ for sources
336	of entropy-gathering daemons.	347	of entropy-gathering daemons.
337		348
		349	Availability: not available with LibreSSL and OpenSSL > 1.1.0
		350
338	.. function:: RAND_add(bytes, entropy)	351	.. function:: RAND_add(bytes, entropy)
339		352
340	Mix the given bytes into the SSL pseudo-random number generator. The	353	Mix the given bytes into the SSL pseudo-random number generator. The
Lines 390-396 Link Here
390	>>> time.ctime(ssl.cert_time_to_seconds("May 9 00:00:00 2007 GMT"))	403	>>> time.ctime(ssl.cert_time_to_seconds("May 9 00:00:00 2007 GMT"))
391	'Wed May 9 00:00:00 2007'	404	'Wed May 9 00:00:00 2007'
392		405
393	.. function:: get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None)	406	.. function:: get_server_certificate(addr, ssl_version=PROTOCOL_TLS, ca_certs=None)
394		407
395	Given the address ``addr`` of an SSL-protected server, as a (hostname,	408	Given the address ``addr`` of an SSL-protected server, as a (hostname,
396	port-number) pair, fetches the server's certificate, and returns it as a	409	port-number) pair, fetches the server's certificate, and returns it as a
Lines 428-433 Link Here
428	* :attr:`openssl_capath_env` - OpenSSL's environment key that points to a capath,	441	* :attr:`openssl_capath_env` - OpenSSL's environment key that points to a capath,
429	* :attr:`openssl_capath` - hard coded path to a capath directory	442	* :attr:`openssl_capath` - hard coded path to a capath directory
430		443
		444	Availability: LibreSSL ignores the environment vars
		445	:attr:`openssl_cafile_env` and :attr:`openssl_capath_env`
		446
431	.. versionadded:: 3.4	447	.. versionadded:: 3.4
432		448
433	.. function:: enum_certificates(store_name)	449	.. function:: enum_certificates(store_name)
Lines 545-555 Link Here
545		561
546	.. versionadded:: 3.4.4	562	.. versionadded:: 3.4.4
547		563
548	.. data:: PROTOCOL_SSLv23	564	.. data:: PROTOCOL_TLS
549		565
550	Selects the highest protocol version that both the client and server support.	566	Selects the highest protocol version that both the client and server support.
551	Despite the name, this option can select "TLS" protocols as well as "SSL".	567	Despite the name, this option can select "TLS" protocols as well as "SSL".
552		568
		569	.. versionadded:: 3.6
		570
		571	.. data:: PROTOCOL_SSLv23
		572
		573	Alias for data:`PROTOCOL_TLS`.
		574
		575	.. deprecated:: 3.6
		576
		577	Use data:`PROTOCOL_TLS` instead.
		578
553	.. data:: PROTOCOL_SSLv2	579	.. data:: PROTOCOL_SSLv2
554		580
555	Selects SSL version 2 as the channel encryption protocol.	581	Selects SSL version 2 as the channel encryption protocol.
Lines 561-566 Link Here
561		587
562	SSL version 2 is insecure. Its use is highly discouraged.	588	SSL version 2 is insecure. Its use is highly discouraged.
563		589
		590	.. deprecated:: 3.6
		591
		592	OpenSSL has removed support for SSLv2.
		593
564	.. data:: PROTOCOL_SSLv3	594	.. data:: PROTOCOL_SSLv3
565		595
566	Selects SSL version 3 as the channel encryption protocol.	596	Selects SSL version 3 as the channel encryption protocol.
Lines 572-581 Link Here
572		602
573	SSL version 3 is insecure. Its use is highly discouraged.	603	SSL version 3 is insecure. Its use is highly discouraged.
574		604
		605	.. deprecated:: 3.6
		606
		607	OpenSSL has deprecated all version specific protocols. Use the default
		608	protocol data:`PROTOCOL_TLS` with flags like data:`OP_NO_SSLv3` instead.
		609
575	.. data:: PROTOCOL_TLSv1	610	.. data:: PROTOCOL_TLSv1
576		611
577	Selects TLS version 1.0 as the channel encryption protocol.	612	Selects TLS version 1.0 as the channel encryption protocol.
578		613
		614	.. deprecated:: 3.6
		615
		616	OpenSSL has deprecated all version specific protocols. Use the default
		617	protocol data:`PROTOCOL_TLS` with flags like data:`OP_NO_SSLv3` instead.
		618
579	.. data:: PROTOCOL_TLSv1_1	619	.. data:: PROTOCOL_TLSv1_1
580		620
581	Selects TLS version 1.1 as the channel encryption protocol.	621	Selects TLS version 1.1 as the channel encryption protocol.
Lines 583-588 Link Here
583		623
584	.. versionadded:: 3.4	624	.. versionadded:: 3.4
585		625
		626	.. deprecated:: 3.6
		627
		628	OpenSSL has deprecated all version specific protocols. Use the default
		629	protocol data:`PROTOCOL_TLS` with flags like data:`OP_NO_SSLv3` instead.
		630
586	.. data:: PROTOCOL_TLSv1_2	631	.. data:: PROTOCOL_TLSv1_2
587		632
588	Selects TLS version 1.2 as the channel encryption protocol. This is the	633	Selects TLS version 1.2 as the channel encryption protocol. This is the
Lines 591-596 Link Here
591		636
592	.. versionadded:: 3.4	637	.. versionadded:: 3.4
593		638
		639	.. deprecated:: 3.6
		640
		641	OpenSSL has deprecated all version specific protocols. Use the default
		642	protocol data:`PROTOCOL_TLS` with flags like data:`OP_NO_SSLv3` instead.
		643
594	.. data:: OP_ALL	644	.. data:: OP_ALL
595		645
596	Enables workarounds for various bugs present in other SSL implementations.	646	Enables workarounds for various bugs present in other SSL implementations.
Lines 602-624 Link Here
602	.. data:: OP_NO_SSLv2	652	.. data:: OP_NO_SSLv2
603		653
604	Prevents an SSLv2 connection. This option is only applicable in	654	Prevents an SSLv2 connection. This option is only applicable in
605	conjunction with :const:`PROTOCOL_SSLv23`. It prevents the peers from	655	conjunction with :const:`PROTOCOL_TLS`. It prevents the peers from
606	choosing SSLv2 as the protocol version.	656	choosing SSLv2 as the protocol version.
607		657
608	.. versionadded:: 3.2	658	.. versionadded:: 3.2
609		659
		660	.. deprecated:: 3.6
		661
		662	SSLv2 is deprecated
		663
		664
610	.. data:: OP_NO_SSLv3	665	.. data:: OP_NO_SSLv3
611		666
612	Prevents an SSLv3 connection. This option is only applicable in	667	Prevents an SSLv3 connection. This option is only applicable in
613	conjunction with :const:`PROTOCOL_SSLv23`. It prevents the peers from	668	conjunction with :const:`PROTOCOL_TLS`. It prevents the peers from
614	choosing SSLv3 as the protocol version.	669	choosing SSLv3 as the protocol version.
615		670
616	.. versionadded:: 3.2	671	.. versionadded:: 3.2
617		672
		673	.. deprecated:: 3.6
		674
		675	SSLv3 is deprecated
		676
618	.. data:: OP_NO_TLSv1	677	.. data:: OP_NO_TLSv1
619		678
620	Prevents a TLSv1 connection. This option is only applicable in	679	Prevents a TLSv1 connection. This option is only applicable in
621	conjunction with :const:`PROTOCOL_SSLv23`. It prevents the peers from	680	conjunction with :const:`PROTOCOL_TLS`. It prevents the peers from
622	choosing TLSv1 as the protocol version.	681	choosing TLSv1 as the protocol version.
623		682
624	.. versionadded:: 3.2	683	.. versionadded:: 3.2
Lines 626-632 Link Here
626	.. data:: OP_NO_TLSv1_1	685	.. data:: OP_NO_TLSv1_1
627		686
628	Prevents a TLSv1.1 connection. This option is only applicable in conjunction	687	Prevents a TLSv1.1 connection. This option is only applicable in conjunction
629	with :const:`PROTOCOL_SSLv23`. It prevents the peers from choosing TLSv1.1 as	688	with :const:`PROTOCOL_TLS`. It prevents the peers from choosing TLSv1.1 as
630	the protocol version. Available only with openssl version 1.0.1+.	689	the protocol version. Available only with openssl version 1.0.1+.
631		690
632	.. versionadded:: 3.4	691	.. versionadded:: 3.4
Lines 634-640 Link Here
634	.. data:: OP_NO_TLSv1_2	693	.. data:: OP_NO_TLSv1_2
635		694
636	Prevents a TLSv1.2 connection. This option is only applicable in conjunction	695	Prevents a TLSv1.2 connection. This option is only applicable in conjunction
637	with :const:`PROTOCOL_SSLv23`. It prevents the peers from choosing TLSv1.2 as	696	with :const:`PROTOCOL_TLS`. It prevents the peers from choosing TLSv1.2 as
638	the protocol version. Available only with openssl version 1.0.1+.	697	the protocol version. Available only with openssl version 1.0.1+.
639		698
640	.. versionadded:: 3.4	699	.. versionadded:: 3.4
Lines 996-1012 Link Here
996	It also manages a cache of SSL sessions for server-side sockets, in order	1055	It also manages a cache of SSL sessions for server-side sockets, in order
997	to speed up repeated connections from the same clients.	1056	to speed up repeated connections from the same clients.
998		1057
999	.. class:: SSLContext(protocol)	1058	.. class:: SSLContext(protocol=PROTOCOL_TLS)
1000		1059
1001	Create a new SSL context. You must pass protocol which must be one	1060	Create a new SSL context. You may pass protocol which must be one
1002	of the ``PROTOCOL_*`` constants defined in this module.	1061	of the ``PROTOCOL_*`` constants defined in this module.
1003	:data:`PROTOCOL_SSLv23` is currently recommended for maximum	1062	:data:`PROTOCOL_TLS` is currently recommended for maximum
1004	interoperability.	1063	interoperability and default value.
1005		1064
1006	.. seealso::	1065	.. seealso::
1007	:func:`create_default_context` lets the :mod:`ssl` module choose	1066	:func:`create_default_context` lets the :mod:`ssl` module choose
1008	security settings for a given purpose.	1067	security settings for a given purpose.
1009		1068
		1069	.. versionchanged:: 3.6
		1070
		1071	:data:`PROTOCOL_TLS` is the default value.
		1072
1010		1073
1011	:class:`SSLContext` objects have the following methods and attributes:	1074	:class:`SSLContext` objects have the following methods and attributes:
1012		1075
Lines 1489-1495 Link Here
1489	a context from scratch (but beware that you might not get the settings	1552	a context from scratch (but beware that you might not get the settings
1490	right)::	1553	right)::
1491		1554
1492	>>> context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)	1555	>>> context = ssl.SSLContext(ssl.PROTOCOL_TLS)
1493	>>> context.verify_mode = ssl.CERT_REQUIRED	1556	>>> context.verify_mode = ssl.CERT_REQUIRED
1494	>>> context.check_hostname = True	1557	>>> context.check_hostname = True
1495	>>> context.load_verify_locations("/etc/ssl/certs/ca-bundle.crt")	1558	>>> context.load_verify_locations("/etc/ssl/certs/ca-bundle.crt")
Lines 1754-1768 Link Here
1754		1817
1755	SSL versions 2 and 3 are considered insecure and are therefore dangerous to	1818	SSL versions 2 and 3 are considered insecure and are therefore dangerous to
1756	use. If you want maximum compatibility between clients and servers, it is	1819	use. If you want maximum compatibility between clients and servers, it is
1757	recommended to use :const:`PROTOCOL_SSLv23` as the protocol version and then	1820	recommended to use :const:`PROTOCOL_TLS` as the protocol version and then
1758	disable SSLv2 and SSLv3 explicitly using the :data:`SSLContext.options`	1821	disable SSLv2 and SSLv3 explicitly using the :data:`SSLContext.options`
1759	attribute::	1822	attribute::
1760		1823
1761	context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)	1824	context = ssl.SSLContext(ssl.PROTOCOL_TLS)
1762	context.options \|= ssl.OP_NO_SSLv2	1825	context.options \|= ssl.OP_NO_SSLv2
1763	context.options \|= ssl.OP_NO_SSLv3	1826	context.options \|= ssl.OP_NO_SSLv3
		1827	context.options \|= ssl.OP_NO_TLSv1
		1828	context.options \|= ssl.OP_NO_TLSv1_1
1764		1829
1765	The SSL context created above will only allow TLSv1 and later (if	1830	The SSL context created above will only allow TLSv1.2 and later (if
1766	supported by your system) connections.	1831	supported by your system) connections.
1767		1832
1768	Cipher selection	1833	Cipher selection

Lines 51-56 Link Here

(-)Python-3.4.6-orig/Lib/ssl.py (-8 / +14 lines)
51	PROTOCOL_SSLv2	51	PROTOCOL_SSLv2
52	PROTOCOL_SSLv3	52	PROTOCOL_SSLv3
53	PROTOCOL_SSLv23	53	PROTOCOL_SSLv23
		54	PROTOCOL_TLS
54	PROTOCOL_TLSv1	55	PROTOCOL_TLSv1
55	PROTOCOL_TLSv1_1	56	PROTOCOL_TLSv1_1
56	PROTOCOL_TLSv1_2	57	PROTOCOL_TLSv1_2
Lines 92-98 Link Here
92	import sys	93	import sys
93	import os	94	import os
94	from collections import namedtuple	95	from collections import namedtuple
95	from enum import Enum as _Enum	96	from enum import Enum as _Enum, IntEnum as _IntEnum
96		97
97	import _ssl # if we can't import it, let the error propagate	98	import _ssl # if we can't import it, let the error propagate
98		99
Lines 126-132 Link Here
126		127
127	from _ssl import _OPENSSL_API_VERSION	128	from _ssl import _OPENSSL_API_VERSION
128		129
		130	_IntEnum._convert(
		131	'_SSLMethod', __name__,
		132	lambda name: name.startswith('PROTOCOL_') and name != 'PROTOCOL_SSLv23',
		133	source=_ssl)
129		134
		135	PROTOCOL_SSLv23 = _SSLMethod.PROTOCOL_SSLv23 = _SSLMethod.PROTOCOL_TLS
130	_PROTOCOL_NAMES = {value: name for name, value in globals().items() if name.startswith('PROTOCOL_')}	136	_PROTOCOL_NAMES = {value: name for name, value in globals().items() if name.startswith('PROTOCOL_')}
131	try:	137	try:
132	from _ssl import PROTOCOL_SSLv2	138	from _ssl import PROTOCOL_SSLv2
Lines 342-354 Link Here
342	__slots__ = ('protocol', '__weakref__')	348	__slots__ = ('protocol', '__weakref__')
343	_windows_cert_stores = ("CA", "ROOT")	349	_windows_cert_stores = ("CA", "ROOT")
344		350
345	def __new__(cls, protocol, args, *kwargs):	351	def __new__(cls, protocol=PROTOCOL_TLS, args, *kwargs):
346	self = _SSLContext.__new__(cls, protocol)	352	self = _SSLContext.__new__(cls, protocol)
347	if protocol != _SSLv2_IF_EXISTS:	353	if protocol != _SSLv2_IF_EXISTS:
348	self.set_ciphers(_DEFAULT_CIPHERS)	354	self.set_ciphers(_DEFAULT_CIPHERS)
349	return self	355	return self
350		356
351	def __init__(self, protocol):	357	def __init__(self, protocol=PROTOCOL_TLS):
352	self.protocol = protocol	358	self.protocol = protocol
353		359
354	def wrap_socket(self, sock, server_side=False,	360	def wrap_socket(self, sock, server_side=False,
Lines 402-408 Link Here
402	if not isinstance(purpose, _ASN1Object):	408	if not isinstance(purpose, _ASN1Object):
403	raise TypeError(purpose)	409	raise TypeError(purpose)
404		410
405	context = SSLContext(PROTOCOL_SSLv23)	411	context = SSLContext(PROTOCOL_TLS)
406		412
407	# SSLv2 considered harmful.	413	# SSLv2 considered harmful.
408	context.options \|= OP_NO_SSLv2	414	context.options \|= OP_NO_SSLv2
Lines 439-445 Link Here
439	context.load_default_certs(purpose)	445	context.load_default_certs(purpose)
440	return context	446	return context
441		447
442	def _create_unverified_context(protocol=PROTOCOL_SSLv23, *, cert_reqs=None,	448	def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=None,
443	check_hostname=False, purpose=Purpose.SERVER_AUTH,	449	check_hostname=False, purpose=Purpose.SERVER_AUTH,
444	certfile=None, keyfile=None,	450	certfile=None, keyfile=None,
445	cafile=None, capath=None, cadata=None):	451	cafile=None, capath=None, cadata=None):
Lines 495-501 Link Here
495		501
496	def __init__(self, sock=None, keyfile=None, certfile=None,	502	def __init__(self, sock=None, keyfile=None, certfile=None,
497	server_side=False, cert_reqs=CERT_NONE,	503	server_side=False, cert_reqs=CERT_NONE,
498	ssl_version=PROTOCOL_SSLv23, ca_certs=None,	504	ssl_version=PROTOCOL_TLS, ca_certs=None,
499	do_handshake_on_connect=True,	505	do_handshake_on_connect=True,
500	family=AF_INET, type=SOCK_STREAM, proto=0, fileno=None,	506	family=AF_INET, type=SOCK_STREAM, proto=0, fileno=None,
501	suppress_ragged_eofs=True, npn_protocols=None, ciphers=None,	507	suppress_ragged_eofs=True, npn_protocols=None, ciphers=None,
Lines 877-883 Link Here
877		883
878	def wrap_socket(sock, keyfile=None, certfile=None,	884	def wrap_socket(sock, keyfile=None, certfile=None,
879	server_side=False, cert_reqs=CERT_NONE,	885	server_side=False, cert_reqs=CERT_NONE,
880	ssl_version=PROTOCOL_SSLv23, ca_certs=None,	886	ssl_version=PROTOCOL_TLS, ca_certs=None,
881	do_handshake_on_connect=True,	887	do_handshake_on_connect=True,
882	suppress_ragged_eofs=True,	888	suppress_ragged_eofs=True,
883	ciphers=None):	889	ciphers=None):
Lines 924-930 Link Here
924	d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]	930	d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]
925	return base64.decodebytes(d.encode('ASCII', 'strict'))	931	return base64.decodebytes(d.encode('ASCII', 'strict'))
926		932
927	def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv23, ca_certs=None):	933	def get_server_certificate(addr, ssl_version=PROTOCOL_TLS, ca_certs=None):
928	"""Retrieve the certificate from the server at the specified address,	934	"""Retrieve the certificate from the server at the specified address,
929	and return it as a PEM-encoded string.	935	and return it as a PEM-encoded string.
930	If 'ca_certs' is specified, validate the server cert against it.	936	If 'ca_certs' is specified, validate the server cert against it.

Lines 23-28 Link Here

(-)Python-3.4.6-orig/Lib/test/test_ssl.py (-19 / +38 lines)
23		23
24	PROTOCOLS = sorted(ssl._PROTOCOL_NAMES)	24	PROTOCOLS = sorted(ssl._PROTOCOL_NAMES)
25	HOST = support.HOST	25	HOST = support.HOST
		26	IS_LIBRESSL = ssl.OPENSSL_VERSION.startswith('LibreSSL')
		27	IS_OPENSSL_1_1 = not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (1, 1, 0)
		28
26		29
27	def data_file(*name):	30	def data_file(*name):
28	return os.path.join(os.path.dirname(__file__), *name)	31	return os.path.join(os.path.dirname(__file__), *name)
Lines 655-661 Link Here
655	def test_constructor(self):	658	def test_constructor(self):
656	for protocol in PROTOCOLS:	659	for protocol in PROTOCOLS:
657	ssl.SSLContext(protocol)	660	ssl.SSLContext(protocol)
658	self.assertRaises(TypeError, ssl.SSLContext)	661	ctx = ssl.SSLContext()
		662	self.assertEqual(ctx.protocol, ssl.PROTOCOL_TLS)
659	self.assertRaises(ValueError, ssl.SSLContext, -1)	663	self.assertRaises(ValueError, ssl.SSLContext, -1)
660	self.assertRaises(ValueError, ssl.SSLContext, 42)	664	self.assertRaises(ValueError, ssl.SSLContext, 42)
661		665
Lines 676-690 Link Here
676	def test_options(self):	680	def test_options(self):
677	ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)	681	ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
678	# OP_ALL \| OP_NO_SSLv2 \| OP_NO_SSLv3 is the default value	682	# OP_ALL \| OP_NO_SSLv2 \| OP_NO_SSLv3 is the default value
679	self.assertEqual(ssl.OP_ALL \| ssl.OP_NO_SSLv2 \| ssl.OP_NO_SSLv3,	683	default = (ssl.OP_ALL \| ssl.OP_NO_SSLv2 \| ssl.OP_NO_SSLv3)
680	ctx.options)	684	if not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (1, 1, 0):
		685	default \|= ssl.OP_NO_COMPRESSION
		686	self.assertEqual(default, ctx.options)
681	ctx.options \|= ssl.OP_NO_TLSv1	687	ctx.options \|= ssl.OP_NO_TLSv1
682	self.assertEqual(ssl.OP_ALL \| ssl.OP_NO_SSLv2 \| ssl.OP_NO_SSLv3 \| ssl.OP_NO_TLSv1,	688	self.assertEqual(default \| ssl.OP_NO_TLSv1, ctx.options)
683	ctx.options)
684	if can_clear_options():	689	if can_clear_options():
685	ctx.options = (ctx.options & ~ssl.OP_NO_SSLv2) \| ssl.OP_NO_TLSv1	690	ctx.options = (ctx.options & ~ssl.OP_NO_TLSv1)
686	self.assertEqual(ssl.OP_ALL \| ssl.OP_NO_TLSv1 \| ssl.OP_NO_SSLv3,	691	self.assertEqual(default, ctx.options)
687	ctx.options)
688	ctx.options = 0	692	ctx.options = 0
689	# Ubuntu has OP_NO_SSLv3 forced on by default	693	# Ubuntu has OP_NO_SSLv3 forced on by default
690	self.assertEqual(0, ctx.options & ~ssl.OP_NO_SSLv3)	694	self.assertEqual(0, ctx.options & ~ssl.OP_NO_SSLv3)
Lines 1020-1025 Link Here
1020	self.assertRaises(TypeError, ctx.load_default_certs, 'SERVER_AUTH')	1024	self.assertRaises(TypeError, ctx.load_default_certs, 'SERVER_AUTH')
1021		1025
1022	@unittest.skipIf(sys.platform == "win32", "not-Windows specific")	1026	@unittest.skipIf(sys.platform == "win32", "not-Windows specific")
		1027	@unittest.skipIf(IS_LIBRESSL, "LibreSSL doesn't support env vars")
1023	def test_load_default_certs_env(self):	1028	def test_load_default_certs_env(self):
1024	ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)	1029	ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1025	with support.EnvironmentVarGuard() as env:	1030	with support.EnvironmentVarGuard() as env:
Lines 2756-2779 Link Here
2756	(['abc', 'def'], 'abc')	2761	(['abc', 'def'], 'abc')
2757	]	2762	]
2758	for client_protocols, expected in protocol_tests:	2763	for client_protocols, expected in protocol_tests:
2759	server_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)	2764	server_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
2760	server_context.load_cert_chain(CERTFILE)	2765	server_context.load_cert_chain(CERTFILE)
2761	server_context.set_npn_protocols(server_protocols)	2766	server_context.set_npn_protocols(server_protocols)
2762	client_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)	2767	client_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
2763	client_context.load_cert_chain(CERTFILE)	2768	client_context.load_cert_chain(CERTFILE)
2764	client_context.set_npn_protocols(client_protocols)	2769	client_context.set_npn_protocols(client_protocols)
2765	stats = server_params_test(client_context, server_context,	2770	stats = server_params_test(client_context, server_context,
2766	chatty=True, connectionchatty=True)	2771	chatty=True, connectionchatty=True)
2767		2772
2768	msg = "failed trying %s (s) and %s (c).\n" \	2773	try:
2769	"was expecting %s, but got %%s from the %%s" \	2774	stats = server_params_test(client_context,
2770	% (str(server_protocols), str(client_protocols),	2775	server_context,
2771	str(expected))	2776	chatty=True,
2772	client_result = stats['client_npn_protocol']	2777	connectionchatty=True)
2773	self.assertEqual(client_result, expected, msg % (client_result, "client"))	2778	except ssl.SSLError as e:
2774	server_result = stats['server_npn_protocols'][-1] \	2779	stats = e
2775	if len(stats['server_npn_protocols']) else 'nothing'	2780
2776	self.assertEqual(server_result, expected, msg % (server_result, "server"))	2781	if expected is None and IS_OPENSSL_1_1:
		2782	# OpenSSL 1.1.0 raises handshake error
		2783	self.assertIsInstance(stats, ssl.SSLError)
		2784	else:
		2785	msg = "failed trying %s (s) and %s (c).\n" \
		2786	"was expecting %s, but got %%s from the %%s" \
		2787	% (str(server_protocols), str(client_protocols),
		2788	str(expected))
		2789	client_result = stats['client_alpn_protocol']
		2790	self.assertEqual(client_result, expected,
		2791	msg % (client_result, "client"))
		2792	server_result = stats['server_alpn_protocols'][-1] \
		2793	if len(stats['server_alpn_protocols']) else 'nothing'
		2794	self.assertEqual(server_result, expected,
		2795	msg % (server_result, "server"))
2777		2796
2778	def sni_contexts(self):	2797	def sni_contexts(self):
2779	server_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)	2798	server_context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)





/* EVP is the preferred interface to hashing in OpenSSL */
#include <openssl/evp.h>
#include <openssl/hmac.h>
/* We use the object interface to discover what hashes OpenSSL supports. */
#include <openssl/objects.h>
#include "openssl/err.h"

#define HASH_OBJ_CONSTRUCTOR 0
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
/* OpenSSL < 1.1.0 */
#define EVP_MD_CTX_new EVP_MD_CTX_create
#define EVP_MD_CTX_free EVP_MD_CTX_destroy
#define HAS_FAST_PKCS5_PBKDF2_HMAC 0
#include <openssl/hmac.h>
#else
/* OpenSSL >= 1.1.0 */
#define HAS_FAST_PKCS5_PBKDF2_HMAC 1
#endif


/* Minimum OpenSSL version needed to support sha224 and higher. */
#if defined(OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x00908000)
#define _OPENSSL_SUPPORTS_SHA2

typedef struct {
    PyObject_HEAD
    PyObject            *name;  /* name of this hash algorithm */
    EVP_MD_CTX           *ctx;   /* OpenSSL message digest context */
#ifdef WITH_THREAD
    PyThread_type_lock   lock;  /* OpenSSL context lock */
#endif


#define DEFINE_CONSTS_FOR_NEW(Name)  \
    static PyObject *CONST_ ## Name ## _name_obj = NULL; \
    static EVP_MD_CTX CONST_new_ ## Name ## _ctx; \
    static EVP_MD_CTX *CONST_new_ ## Name ## _ctx_p = NULL;

DEFINE_CONSTS_FOR_NEW(md5)

#endif


/* LCOV_EXCL_START */
static PyObject *
_setException(PyObject *exc)
{
    unsigned long errcode;
    const char *lib, *func, *reason;

    errcode = ERR_peek_last_error();
    if (!errcode) {
        PyErr_SetString(exc, "unknown reasons");
        return NULL;
    }
    ERR_clear_error();

    lib = ERR_lib_error_string(errcode);
    func = ERR_func_error_string(errcode);
    reason = ERR_reason_error_string(errcode);

    if (lib && func) {
        PyErr_Format(exc, "[%s: %s] %s", lib, func, reason);
    }
    else if (lib) {
        PyErr_Format(exc, "[%s] %s", lib, reason);
    }
    else {
        PyErr_SetString(exc, reason);
    }
    return NULL;
}
/* LCOV_EXCL_STOP */

static EVPobject *
newEVPobject(PyObject *name)
{
    EVPobject *retval = (EVPobject *)PyObject_New(EVPobject, &EVPtype);
    if (retval == NULL) {
        return NULL;
    }

    retval->ctx = EVP_MD_CTX_new();
    if (retval->ctx == NULL) {
        PyErr_NoMemory();
        return NULL;
    }

    /* save the name for .name to return */
    Py_INCREF(name);
    retval->name = name;
        retval->name = name;
#ifdef WITH_THREAD
    retval->lock = NULL;
#endif
    }

    return retval;
}

            process = MUNCH_SIZE;
        else
            process = Py_SAFE_DOWNCAST(len, Py_ssize_t, unsigned int);
        EVP_DigestUpdate(self->ctx, (const void*)cp, process);
        len -= process;
        cp += process;
    }

    if (self->lock != NULL)
        PyThread_free_lock(self->lock);
#endif
    EVP_MD_CTX_free(self->ctx);
    Py_XDECREF(self->name);
    PyObject_Del(self);
}

static int
locked_EVP_MD_CTX_copy(EVP_MD_CTX *new_ctx_p, EVPobject *self)
{
    int result;
    ENTER_HASHLIB(self);
    result = EVP_MD_CTX_copy(new_ctx_p, self->ctx);
    LEAVE_HASHLIB(self);
    return result;
}

/* External methods for a hash object */

    if ( (newobj = newEVPobject(self->name))==NULL)
        return NULL;

    if (!locked_EVP_MD_CTX_copy(newobj->ctx, self)) {
        return _setException(PyExc_ValueError);
    }
    return (PyObject *)newobj;
}


EVP_digest(EVPobject *self, PyObject *unused)
{
    unsigned char digest[EVP_MAX_MD_SIZE];
    EVP_MD_CTX *temp_ctx;
    PyObject *retval;
    unsigned int digest_size;

    temp_ctx = EVP_MD_CTX_new();
    if (temp_ctx == NULL) {
        PyErr_NoMemory();
        return NULL;
    }

    if (!locked_EVP_MD_CTX_copy(temp_ctx, self)) {
        return _setException(PyExc_ValueError);
    }
    digest_size = EVP_MD_CTX_size(temp_ctx);
    EVP_DigestFinal(temp_ctx, digest, NULL);

    retval = PyBytes_FromStringAndSize((const char *)digest, digest_size);
    EVP_MD_CTX_free(temp_ctx);
    return retval;
}


EVP_hexdigest(EVPobject *self, PyObject *unused)
{
    unsigned char digest[EVP_MAX_MD_SIZE];
    EVP_MD_CTX *temp_ctx;
    PyObject *retval;
    char *hex_digest;
    unsigned int i, j, digest_size;

    temp_ctx = EVP_MD_CTX_new();
    if (temp_ctx == NULL) {
        PyErr_NoMemory();
        return NULL;
    }

    /* Get the raw (binary) digest value */
    if (!locked_EVP_MD_CTX_copy(temp_ctx, self)) {
        return _setException(PyExc_ValueError);
    }
    digest_size = EVP_MD_CTX_size(temp_ctx);
    EVP_DigestFinal(temp_ctx, digest, NULL);

    EVP_MD_CTX_free(temp_ctx);

    /* Allocate a new buffer */
    hex_digest = PyMem_Malloc(digest_size * 2 + 1);

EVP_get_block_size(EVPobject *self, void *closure)
{
    long block_size;
    block_size = EVP_MD_CTX_block_size(self->ctx);
    return PyLong_FromLong(block_size);
}


EVP_get_digest_size(EVPobject *self, void *closure)
{
    long size;
    size = EVP_MD_CTX_size(self->ctx);
    return PyLong_FromLong(size);
}


            PyBuffer_Release(&view);
        return -1;
    }
    EVP_DigestInit(self->ctx, digest);

    self->name = name_obj;
    Py_INCREF(self->name);

        return NULL;

    if (initial_ctx) {
        EVP_MD_CTX_copy(self->ctx, initial_ctx);
    } else {
        EVP_DigestInit(self->ctx, digest);
    }

    if (cp && len) {


#define PY_PBKDF2_HMAC 1

#if !HAS_FAST_PKCS5_PBKDF2_HMAC
/* Improved implementation of PKCS5_PBKDF2_HMAC()
 *
 * PKCS5_PBKDF2_HMAC_fast() hashes the password exactly one time instead of

    HMAC_CTX_cleanup(&hctx_tpl);
    return 1;
}
#endif

/* LCOV_EXCL_START */
static PyObject *
_setException(PyObject *exc)
{
    unsigned long errcode;
    const char *lib, *func, *reason;

    errcode = ERR_peek_last_error();
    if (!errcode) {
        PyErr_SetString(exc, "unknown reasons");
        return NULL;
    }
    ERR_clear_error();

    lib = ERR_lib_error_string(errcode);
    func = ERR_func_error_string(errcode);
    reason = ERR_reason_error_string(errcode);

    if (lib && func) {
        PyErr_Format(exc, "[%s: %s] %s", lib, func, reason);
    }
    else if (lib) {
        PyErr_Format(exc, "[%s] %s", lib, reason);
    }
    else {
        PyErr_SetString(exc, reason);
    }
    return NULL;
}
/* LCOV_EXCL_STOP */

PyDoc_STRVAR(pbkdf2_hmac__doc__,
"pbkdf2_hmac(hash_name, password, salt, iterations, dklen=None) -> key\n\

    key = PyBytes_AS_STRING(key_obj);

    Py_BEGIN_ALLOW_THREADS
#if HAS_FAST_PKCS5_PBKDF2_HMAC
    retval = PKCS5_PBKDF2_HMAC((char*)password.buf, (int)password.len,
                               (unsigned char *)salt.buf, (int)salt.len,
                               iterations, digest, dklen,
                               (unsigned char *)key);
#else
    retval = PKCS5_PBKDF2_HMAC_fast((char*)password.buf, (int)password.len,
                                    (unsigned char *)salt.buf, (int)salt.len,
                                    iterations, digest, dklen,
                                    (unsigned char *)key);
#endif
    Py_END_ALLOW_THREADS

    if (!retval) {

    if (CONST_ ## NAME ## _name_obj == NULL) { \
        CONST_ ## NAME ## _name_obj = PyUnicode_FromString(#NAME); \
        if (EVP_get_digestbyname(#NAME)) { \
            CONST_new_ ## NAME ## _ctx_p = EVP_MD_CTX_new(); \
            EVP_DigestInit(CONST_new_ ## NAME ## _ctx_p, EVP_get_digestbyname(#NAME)); \
        } \
    } \

Lines 55-60 Link Here

(-)Python-3.4.6-orig/Modules/_ssl.c (-40 / +132 lines)
55	#include <sys/poll.h>	55	#include <sys/poll.h>
56	#endif	56	#endif
57		57
		58	/* Don't warn about deprecated functions */
		59	#ifdef __GNUC__
		60	#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
		61	#endif
		62	#ifdef __clang__
		63	#pragma clang diagnostic ignored "-Wdeprecated-declarations"
		64	#endif
		65
58	/* Include OpenSSL header files */	66	/* Include OpenSSL header files */
59	#include "openssl/rsa.h"	67	#include "openssl/rsa.h"
60	#include "openssl/crypto.h"	68	#include "openssl/crypto.h"
Lines 90-95 Link Here
90	/* Include generated data (error codes) */	98	/* Include generated data (error codes) */
91	#include "_ssl_data.h"	99	#include "_ssl_data.h"
92		100
		101	#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
		102	# define OPENSSL_VERSION_1_1 1
		103	#endif
		104
93	/* Openssl comes with TLSv1.1 and TLSv1.2 between 1.0.0h and 1.0.1	105	/* Openssl comes with TLSv1.1 and TLSv1.2 between 1.0.0h and 1.0.1
94	http://www.openssl.org/news/changelog.html	106	http://www.openssl.org/news/changelog.html
95	*/	107	*/
Lines 108-113 Link Here
108	# define HAVE_SNI 0	120	# define HAVE_SNI 0
109	#endif	121	#endif
110		122
		123	#ifdef OPENSSL_VERSION_1_1
		124	/* OpenSSL 1.1.0+ */
		125	#ifndef OPENSSL_NO_SSL2
		126	#define OPENSSL_NO_SSL2
		127	#endif
		128	#else /* OpenSSL < 1.1.0 */
		129	#if defined(WITH_THREAD)
		130	#define HAVE_OPENSSL_CRYPTO_LOCK
		131	#endif
		132
		133	#define TLS_method SSLv23_method
		134
		135	static int X509_NAME_ENTRY_set(const X509_NAME_ENTRY *ne)
		136	{
		137	return ne->set;
		138	}
		139
		140	#ifndef OPENSSL_NO_COMP
		141	static int COMP_get_type(const COMP_METHOD *meth)
		142	{
		143	return meth->type;
		144	}
		145
		146	static const char COMP_get_name(const COMP_METHOD meth)
		147	{
		148	return meth->name;
		149	}
		150	#endif
		151
		152	static pem_password_cb SSL_CTX_get_default_passwd_cb(SSL_CTX ctx)
		153	{
		154	return ctx->default_passwd_callback;
		155	}
		156
		157	static void SSL_CTX_get_default_passwd_cb_userdata(SSL_CTX ctx)
		158	{
		159	return ctx->default_passwd_callback_userdata;
		160	}
		161
		162	static int X509_OBJECT_get_type(X509_OBJECT *x)
		163	{
		164	return x->type;
		165	}
		166
		167	static X509 X509_OBJECT_get0_X509(X509_OBJECT x)
		168	{
		169	return x->data.x509;
		170	}
		171
		172	static int BIO_up_ref(BIO *b)
		173	{
		174	CRYPTO_add(&b->references, 1, CRYPTO_LOCK_BIO);
		175	return 1;
		176	}
		177
		178	static STACK_OF(X509_OBJECT) X509_STORE_get0_objects(X509_STORE store) {
		179	return store->objs;
		180	}
		181
		182	static X509_VERIFY_PARAM X509_STORE_get0_param(X509_STORE store)
		183	{
		184	return store->param;
		185	}
		186	#endif /* OpenSSL < 1.1.0 or LibreSSL */
187
188
111	enum py_ssl_error {	189	enum py_ssl_error {
112	/* these mirror ssl.h */	190	/* these mirror ssl.h */
113	PY_SSL_ERROR_NONE,	191	PY_SSL_ERROR_NONE,
Lines 138-144 Link Here
138	enum py_ssl_version {	216	enum py_ssl_version {
139	PY_SSL_VERSION_SSL2,	217	PY_SSL_VERSION_SSL2,
140	PY_SSL_VERSION_SSL3=1,	218	PY_SSL_VERSION_SSL3=1,
141	PY_SSL_VERSION_SSL23,	219	PY_SSL_VERSION_TLS,
142	#if HAVE_TLSv1_2	220	#if HAVE_TLSv1_2
143	PY_SSL_VERSION_TLS1,	221	PY_SSL_VERSION_TLS1,
144	PY_SSL_VERSION_TLS1_1,	222	PY_SSL_VERSION_TLS1_1,
Lines 691-697 Link Here
691		769
692	/* check to see if we've gotten to a new RDN */	770	/* check to see if we've gotten to a new RDN */
693	if (rdn_level >= 0) {	771	if (rdn_level >= 0) {
694	if (rdn_level != entry->set) {	772	if (rdn_level != X509_NAME_ENTRY_set(entry)) {
695	/* yes, new RDN */	773	/* yes, new RDN */
696	/* add old RDN to DN */	774	/* add old RDN to DN */
697	rdnt = PyList_AsTuple(rdn);	775	rdnt = PyList_AsTuple(rdn);
Lines 708-714 Link Here
708	goto fail0;	786	goto fail0;
709	}	787	}
710	}	788	}
711	rdn_level = entry->set;	789	rdn_level = X509_NAME_ENTRY_set(entry);
712		790
713	/* now add this attribute to the current RDN */	791	/* now add this attribute to the current RDN */
714	name = X509_NAME_ENTRY_get_object(entry);	792	name = X509_NAME_ENTRY_get_object(entry);
Lines 811-828 Link Here
811	goto fail;	889	goto fail;
812	}	890	}
813		891
814	p = ext->value->data;	892	p = X509_EXTENSION_get_data(ext)->data;
815	if (method->it)	893	if (method->it)
816	names = (GENERAL_NAMES*)	894	names = (GENERAL_NAMES*)
817	(ASN1_item_d2i(NULL,	895	(ASN1_item_d2i(NULL,
818	&p,	896	&p,
819	ext->value->length,	897	X509_EXTENSION_get_data(ext)->length,
820	ASN1_ITEM_ptr(method->it)));	898	ASN1_ITEM_ptr(method->it)));
821	else	899	else
822	names = (GENERAL_NAMES*)	900	names = (GENERAL_NAMES*)
823	(method->d2i(NULL,	901	(method->d2i(NULL,
824	&p,	902	&p,
825	ext->value->length));	903	X509_EXTENSION_get_data(ext)->length));
826		904
827	for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {	905	for(j = 0; j < sk_GENERAL_NAME_num(names); j++) {
828	/* get a rendering of each name in the set of names */	906	/* get a rendering of each name in the set of names */
Lines 1033-1045 Link Here
1033	int i, j;	1111	int i, j;
1034	PyObject lst, res = NULL;	1112	PyObject lst, res = NULL;
1035		1113
1036	#if OPENSSL_VERSION_NUMBER < 0x10001000L	1114	#if OPENSSL_VERSION_NUMBER >= 0x10001000L
1037	dps = X509_get_ext_d2i(certificate, NID_crl_distribution_points, NULL, NULL);
1038	#else
1039	/* Calls x509v3_cache_extensions and sets up crldp */	1115	/* Calls x509v3_cache_extensions and sets up crldp */
1040	X509_check_ca(certificate);	1116	X509_check_ca(certificate);
1041	dps = certificate->crldp;
1042	#endif	1117	#endif
		1118	dps = X509_get_ext_d2i(certificate, NID_crl_distribution_points, NULL, NULL);
1043		1119
1044	if (dps == NULL)	1120	if (dps == NULL)
1045	return Py_None;	1121	return Py_None;
Lines 1427-1435 Link Here
1427	if (self->ssl == NULL)	1503	if (self->ssl == NULL)
1428	Py_RETURN_NONE;	1504	Py_RETURN_NONE;
1429	comp_method = SSL_get_current_compression(self->ssl);	1505	comp_method = SSL_get_current_compression(self->ssl);
1430	if (comp_method == NULL \|\| comp_method->type == NID_undef)	1506	if (comp_method == NULL \|\| COMP_get_type(comp_method) == NID_undef)
1431	Py_RETURN_NONE;	1507	Py_RETURN_NONE;
1432	short_name = OBJ_nid2sn(comp_method->type);	1508	short_name = COMP_get_name(comp_method);
1433	if (short_name == NULL)	1509	if (short_name == NULL)
1434	Py_RETURN_NONE;	1510	Py_RETURN_NONE;
1435	return PyUnicode_DecodeFSDefault(short_name);	1511	return PyUnicode_DecodeFSDefault(short_name);
Lines 2003-2010 Link Here
2003	else if (proto_version == PY_SSL_VERSION_SSL2)	2079	else if (proto_version == PY_SSL_VERSION_SSL2)
2004	ctx = SSL_CTX_new(SSLv2_method());	2080	ctx = SSL_CTX_new(SSLv2_method());
2005	#endif	2081	#endif
2006	else if (proto_version == PY_SSL_VERSION_SSL23)	2082	else if (proto_version == PY_SSL_VERSION_TLS)
2007	ctx = SSL_CTX_new(SSLv23_method());	2083	ctx = SSL_CTX_new(TLS_method());
2008	else	2084	else
2009	proto_version = -1;	2085	proto_version = -1;
2010	PySSL_END_ALLOW_THREADS	2086	PySSL_END_ALLOW_THREADS
Lines 2047-2054 Link Here
2047	#ifndef OPENSSL_NO_ECDH	2123	#ifndef OPENSSL_NO_ECDH
2048	/* Allow automatic ECDH curve selection (on OpenSSL 1.0.2+), or use	2124	/* Allow automatic ECDH curve selection (on OpenSSL 1.0.2+), or use
2049	prime256v1 by default. This is Apache mod_ssl's initialization	2125	prime256v1 by default. This is Apache mod_ssl's initialization
2050	policy, so we should be safe. */	2126	policy, so we should be safe. OpenSSL 1.1 has it enabled by default.
2051	#if defined(SSL_CTX_set_ecdh_auto)	2127	*/
		2128	#if defined(SSL_CTX_set_ecdh_auto) && !defined(OPENSSL_VERSION_1_1)
2052	SSL_CTX_set_ecdh_auto(self->ctx, 1);	2129	SSL_CTX_set_ecdh_auto(self->ctx, 1);
2053	#else	2130	#else
2054	{	2131	{
Lines 2259-2268 Link Here
2259	get_verify_flags(PySSLContext self, void c)	2336	get_verify_flags(PySSLContext self, void c)
2260	{	2337	{
2261	X509_STORE *store;	2338	X509_STORE *store;
		2339	X509_VERIFY_PARAM *param;
2262	unsigned long flags;	2340	unsigned long flags;
2263		2341
2264	store = SSL_CTX_get_cert_store(self->ctx);	2342	store = SSL_CTX_get_cert_store(self->ctx);
2265	flags = X509_VERIFY_PARAM_get_flags(store->param);	2343	param = X509_STORE_get0_param(store);
		2344	flags = X509_VERIFY_PARAM_get_flags(param);
2266	return PyLong_FromUnsignedLong(flags);	2345	return PyLong_FromUnsignedLong(flags);
2267	}	2346	}
2268		2347
Lines 2270-2291 Link Here
2270	set_verify_flags(PySSLContext self, PyObject arg, void *c)	2349	set_verify_flags(PySSLContext self, PyObject arg, void *c)
2271	{	2350	{
2272	X509_STORE *store;	2351	X509_STORE *store;
		2352	X509_VERIFY_PARAM *param;
2273	unsigned long new_flags, flags, set, clear;	2353	unsigned long new_flags, flags, set, clear;
2274		2354
2275	if (!PyArg_Parse(arg, "k", &new_flags))	2355	if (!PyArg_Parse(arg, "k", &new_flags))
2276	return -1;	2356	return -1;
2277	store = SSL_CTX_get_cert_store(self->ctx);	2357	store = SSL_CTX_get_cert_store(self->ctx);
2278	flags = X509_VERIFY_PARAM_get_flags(store->param);	2358	param = X509_STORE_get0_param(store);
		2359	flags = X509_VERIFY_PARAM_get_flags(param);
2279	clear = flags & ~new_flags;	2360	clear = flags & ~new_flags;
2280	set = ~flags & new_flags;	2361	set = ~flags & new_flags;
2281	if (clear) {	2362	if (clear) {
2282	if (!X509_VERIFY_PARAM_clear_flags(store->param, clear)) {	2363	if (!X509_VERIFY_PARAM_clear_flags(param, clear)) {
2283	_setSSLError(NULL, 0, __FILE__, __LINE__);	2364	_setSSLError(NULL, 0, __FILE__, __LINE__);
2284	return -1;	2365	return -1;
2285	}	2366	}
2286	}	2367	}
2287	if (set) {	2368	if (set) {
2288	if (!X509_VERIFY_PARAM_set_flags(store->param, set)) {	2369	if (!X509_VERIFY_PARAM_set_flags(param, set)) {
2289	_setSSLError(NULL, 0, __FILE__, __LINE__);	2370	_setSSLError(NULL, 0, __FILE__, __LINE__);
2290	return -1;	2371	return -1;
2291	}	2372	}
Lines 2455-2462 Link Here
2455	char *kwlist[] = {"certfile", "keyfile", "password", NULL};	2536	char *kwlist[] = {"certfile", "keyfile", "password", NULL};
2456	PyObject certfile, keyfile = NULL, *password = NULL;	2537	PyObject certfile, keyfile = NULL, *password = NULL;
2457	PyObject certfile_bytes = NULL, keyfile_bytes = NULL;	2538	PyObject certfile_bytes = NULL, keyfile_bytes = NULL;
2458	pem_password_cb *orig_passwd_cb = self->ctx->default_passwd_callback;	2539	pem_password_cb *orig_passwd_cb = SSL_CTX_get_default_passwd_cb(self->ctx);
2459	void *orig_passwd_userdata = self->ctx->default_passwd_callback_userdata;	2540	void *orig_passwd_userdata = SSL_CTX_get_default_passwd_cb_userdata(self->ctx);
2460	_PySSLPasswordInfo pw_info = { NULL, NULL, NULL, 0, 0 };	2541	_PySSLPasswordInfo pw_info = { NULL, NULL, NULL, 0, 0 };
2461	int r;	2542	int r;
2462		2543
Lines 2587-2594 Link Here
2587	cert = d2i_X509_bio(biobuf, NULL);	2668	cert = d2i_X509_bio(biobuf, NULL);
2588	} else {	2669	} else {
2589	cert = PEM_read_bio_X509(biobuf, NULL,	2670	cert = PEM_read_bio_X509(biobuf, NULL,
2590	self->ctx->default_passwd_callback,	2671	SSL_CTX_get_default_passwd_cb(self->ctx),
2591	self->ctx->default_passwd_callback_userdata);	2672	SSL_CTX_get_default_passwd_cb_userdata(self->ctx)
		2673	);
2592	}	2674	}
2593	if (cert == NULL) {	2675	if (cert == NULL) {
2594	break;	2676	break;
Lines 3036-3060 Link Here
3036	cert_store_stats(PySSLContext *self)	3118	cert_store_stats(PySSLContext *self)
3037	{	3119	{
3038	X509_STORE *store;	3120	X509_STORE *store;
		3121	STACK_OF(X509_OBJECT) *objs;
3039	X509_OBJECT *obj;	3122	X509_OBJECT *obj;
3040	int x509 = 0, crl = 0, pkey = 0, ca = 0, i;	3123	int x509 = 0, crl = 0, ca = 0, i;
3041		3124
3042	store = SSL_CTX_get_cert_store(self->ctx);	3125	store = SSL_CTX_get_cert_store(self->ctx);
3043	for (i = 0; i < sk_X509_OBJECT_num(store->objs); i++) {	3126	objs = X509_STORE_get0_objects(store);
3044	obj = sk_X509_OBJECT_value(store->objs, i);	3127	for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
3045	switch (obj->type) {	3128	obj = sk_X509_OBJECT_value(objs, i);
		3129	switch (X509_OBJECT_get_type(obj)) {
3046	case X509_LU_X509:	3130	case X509_LU_X509:
3047	x509++;	3131	x509++;
3048	if (X509_check_ca(obj->data.x509)) {	3132	if (X509_check_ca(X509_OBJECT_get0_X509(obj))) {
3049	ca++;	3133	ca++;
3050	}	3134	}
3051	break;	3135	break;
3052	case X509_LU_CRL:	3136	case X509_LU_CRL:
3053	crl++;	3137	crl++;
3054	break;	3138	break;
3055	case X509_LU_PKEY:
3056	pkey++;
3057	break;
3058	default:	3139	default:
3059	/* Ignore X509_LU_FAIL, X509_LU_RETRY, X509_LU_PKEY.	3140	/* Ignore X509_LU_FAIL, X509_LU_RETRY, X509_LU_PKEY.
3060	* As far as I can tell they are internal states and never	3141	* As far as I can tell they are internal states and never
Lines 3079-3084 Link Here
3079	{	3160	{
3080	char *kwlist[] = {"binary_form", NULL};	3161	char *kwlist[] = {"binary_form", NULL};
3081	X509_STORE *store;	3162	X509_STORE *store;
		3163	STACK_OF(X509_OBJECT) *objs;
3082	PyObject ci = NULL, rlist = NULL;	3164	PyObject ci = NULL, rlist = NULL;
3083	int i;	3165	int i;
3084	int binary_mode = 0;	3166	int binary_mode = 0;
Lines 3093-3109 Link Here
3093	}	3175	}
3094		3176
3095	store = SSL_CTX_get_cert_store(self->ctx);	3177	store = SSL_CTX_get_cert_store(self->ctx);
3096	for (i = 0; i < sk_X509_OBJECT_num(store->objs); i++) {	3178	objs = X509_STORE_get0_objects(store);
		3179	for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
3097	X509_OBJECT *obj;	3180	X509_OBJECT *obj;
3098	X509 *cert;	3181	X509 *cert;
3099		3182
3100	obj = sk_X509_OBJECT_value(store->objs, i);	3183	obj = sk_X509_OBJECT_value(objs, i);
3101	if (obj->type != X509_LU_X509) {	3184	if (X509_OBJECT_get_type(obj) != X509_LU_X509) {
3102	/* not a x509 cert */	3185	/* not a x509 cert */
3103	continue;	3186	continue;
3104	}	3187	}
3105	/* CA for any purpose */	3188	/* CA for any purpose */
3106	cert = obj->data.x509;	3189	cert = X509_OBJECT_get0_X509(obj);
3107	if (!X509_check_ca(cert)) {	3190	if (!X509_check_ca(cert)) {
3108	continue;	3191	continue;
3109	}	3192	}
Lines 3776-3785 Link Here
3776	};	3859	};
3777		3860
3778		3861
3779	#ifdef WITH_THREAD	3862	#ifdef HAVE_OPENSSL_CRYPTO_LOCK
3780		3863
3781	/* an implementation of OpenSSL threading operations in terms	3864	/* an implementation of OpenSSL threading operations in terms
3782	of the Python C thread library */	3865	* of the Python C thread library
		3866	* Only used up to 1.0.2. OpenSSL 1.1.0+ has its own locking code.
		3867	*/
3783		3868
3784	static PyThread_type_lock *_ssl_locks = NULL;	3869	static PyThread_type_lock *_ssl_locks = NULL;
3785		3870
Lines 3860-3866 Link Here
3860	return 1;	3945	return 1;
3861	}	3946	}
3862		3947
3863	#endif /* def HAVE_THREAD */	3948	#endif /* HAVE_OPENSSL_CRYPTO_LOCK for WITH_THREAD && OpenSSL < 1.1.0 */
3864		3949
3865	PyDoc_STRVAR(module_doc,	3950	PyDoc_STRVAR(module_doc,
3866	"Implementation module for SSL socket operations. See the socket module\n\	3951	"Implementation module for SSL socket operations. See the socket module\n\
Lines 3927-3937 Link Here
3927	SSL_load_error_strings();	4012	SSL_load_error_strings();
3928	SSL_library_init();	4013	SSL_library_init();
3929	#ifdef WITH_THREAD	4014	#ifdef WITH_THREAD
		4015	#ifdef HAVE_OPENSSL_CRYPTO_LOCK
3930	/* note that this will start threading if not already started */	4016	/* note that this will start threading if not already started */
3931	if (!_setup_ssl_threads()) {	4017	if (!_setup_ssl_threads()) {
3932	return NULL;	4018	return NULL;
3933	}	4019	}
		4020	#elif OPENSSL_VERSION_1_1 && defined(OPENSSL_THREADS)
		4021	/* OpenSSL 1.1.0 builtin thread support is enabled */
		4022	_ssl_locks_count++;
3934	#endif	4023	#endif
		4024	#endif /* WITH_THREAD */
3935	OpenSSL_add_all_algorithms();	4025	OpenSSL_add_all_algorithms();
3936		4026
3937	/* Add symbols to module dict */	4027	/* Add symbols to module dict */
Lines 4075-4081 Link Here
4075	PY_SSL_VERSION_SSL3);	4165	PY_SSL_VERSION_SSL3);
4076	#endif	4166	#endif
4077	PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",	4167	PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",
4078	PY_SSL_VERSION_SSL23);	4168	PY_SSL_VERSION_TLS);
		4169	PyModule_AddIntConstant(m, "PROTOCOL_TLS",
		4170	PY_SSL_VERSION_TLS);
4079	PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",	4171	PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",
4080	PY_SSL_VERSION_TLS1);	4172	PY_SSL_VERSION_TLS1);
4081	#if HAVE_TLSv1_2	4173	#if HAVE_TLSv1_2

Return to bug 592480

Lines 20-26 Link Here

(-)Python-3.4.6-orig/Modules/_hashopenssl.c (-59 / +107 lines)
20		20
21	/* EVP is the preferred interface to hashing in OpenSSL */	21	/* EVP is the preferred interface to hashing in OpenSSL */
22	#include <openssl/evp.h>	22	#include <openssl/evp.h>
23	#include <openssl/hmac.h>
24	/* We use the object interface to discover what hashes OpenSSL supports. */	23	/* We use the object interface to discover what hashes OpenSSL supports. */
25	#include <openssl/objects.h>	24	#include <openssl/objects.h>
26	#include "openssl/err.h"	25	#include "openssl/err.h"
Lines 31-36 Link Here
31	#define HASH_OBJ_CONSTRUCTOR 0	30	#define HASH_OBJ_CONSTRUCTOR 0
32	#endif	31	#endif
33		32
		33	#if (OPENSSL_VERSION_NUMBER < 0x10100000L) \|\| defined(LIBRESSL_VERSION_NUMBER)
		34	/* OpenSSL < 1.1.0 */
		35	#define EVP_MD_CTX_new EVP_MD_CTX_create
		36	#define EVP_MD_CTX_free EVP_MD_CTX_destroy
		37	#define HAS_FAST_PKCS5_PBKDF2_HMAC 0
		38	#include <openssl/hmac.h>
		39	#else
		40	/* OpenSSL >= 1.1.0 */
		41	#define HAS_FAST_PKCS5_PBKDF2_HMAC 1
		42	#endif
		43
		44
34	/* Minimum OpenSSL version needed to support sha224 and higher. */	45	/* Minimum OpenSSL version needed to support sha224 and higher. */
35	#if defined(OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x00908000)	46	#if defined(OPENSSL_VERSION_NUMBER) && (OPENSSL_VERSION_NUMBER >= 0x00908000)
36	#define _OPENSSL_SUPPORTS_SHA2	47	#define _OPENSSL_SUPPORTS_SHA2
Lines 39-45 Link Here
39	typedef struct {	50	typedef struct {
40	PyObject_HEAD	51	PyObject_HEAD
41	PyObject name; / name of this hash algorithm */	52	PyObject name; / name of this hash algorithm */
42	EVP_MD_CTX ctx; /* OpenSSL message digest context */	53	EVP_MD_CTX ctx; / OpenSSL message digest context */
43	#ifdef WITH_THREAD	54	#ifdef WITH_THREAD
44	PyThread_type_lock lock; /* OpenSSL context lock */	55	PyThread_type_lock lock; /* OpenSSL context lock */
45	#endif	56	#endif
Lines 51-57 Link Here
51		62
52	#define DEFINE_CONSTS_FOR_NEW(Name) \	63	#define DEFINE_CONSTS_FOR_NEW(Name) \
53	static PyObject *CONST_ ## Name ## _name_obj = NULL; \	64	static PyObject *CONST_ ## Name ## _name_obj = NULL; \
54	static EVP_MD_CTX CONST_new_ ## Name ## _ctx; \
55	static EVP_MD_CTX *CONST_new_ ## Name ## _ctx_p = NULL;	65	static EVP_MD_CTX *CONST_new_ ## Name ## _ctx_p = NULL;
56		66
57	DEFINE_CONSTS_FOR_NEW(md5)	67	DEFINE_CONSTS_FOR_NEW(md5)
Lines 64-82 Link Here
64	#endif	74	#endif
65		75
66		76
		77	/* LCOV_EXCL_START */
		78	static PyObject *
		79	_setException(PyObject *exc)
		80	{
		81	unsigned long errcode;
		82	const char lib, func, *reason;
		83
		84	errcode = ERR_peek_last_error();
		85	if (!errcode) {
		86	PyErr_SetString(exc, "unknown reasons");
		87	return NULL;
		88	}
		89	ERR_clear_error();
		90
		91	lib = ERR_lib_error_string(errcode);
		92	func = ERR_func_error_string(errcode);
		93	reason = ERR_reason_error_string(errcode);
		94
		95	if (lib && func) {
		96	PyErr_Format(exc, "[%s: %s] %s", lib, func, reason);
		97	}
		98	else if (lib) {
		99	PyErr_Format(exc, "[%s] %s", lib, reason);
		100	}
		101	else {
		102	PyErr_SetString(exc, reason);
		103	}
		104	return NULL;
		105	}
		106	/* LCOV_EXCL_STOP */
		107
67	static EVPobject *	108	static EVPobject *
68	newEVPobject(PyObject *name)	109	newEVPobject(PyObject *name)
69	{	110	{
70	EVPobject retval = (EVPobject )PyObject_New(EVPobject, &EVPtype);	111	EVPobject retval = (EVPobject )PyObject_New(EVPobject, &EVPtype);
		112	if (retval == NULL) {
		113	return NULL;
		114	}
		115
		116	retval->ctx = EVP_MD_CTX_new();
		117	if (retval->ctx == NULL) {
		118	PyErr_NoMemory();
		119	return NULL;
		120	}
71		121
72	/* save the name for .name to return */	122	/* save the name for .name to return */
73	if (retval != NULL) {	123	Py_INCREF(name);
74	Py_INCREF(name);	124	retval->name = name;
75	retval->name = name;
76	#ifdef WITH_THREAD	125	#ifdef WITH_THREAD
77	retval->lock = NULL;	126	retval->lock = NULL;
78	#endif	127	#endif
79	}
80		128
81	return retval;	129	return retval;
82	}	130	}
Lines 91-97 Link Here
91	process = MUNCH_SIZE;	139	process = MUNCH_SIZE;
92	else	140	else
93	process = Py_SAFE_DOWNCAST(len, Py_ssize_t, unsigned int);	141	process = Py_SAFE_DOWNCAST(len, Py_ssize_t, unsigned int);
94	EVP_DigestUpdate(&self->ctx, (const void*)cp, process);	142	EVP_DigestUpdate(self->ctx, (const void*)cp, process);
95	len -= process;	143	len -= process;
96	cp += process;	144	cp += process;
97	}	145	}
Lines 106-121 Link Here
106	if (self->lock != NULL)	154	if (self->lock != NULL)
107	PyThread_free_lock(self->lock);	155	PyThread_free_lock(self->lock);
108	#endif	156	#endif
109	EVP_MD_CTX_cleanup(&self->ctx);	157	EVP_MD_CTX_free(self->ctx);
110	Py_XDECREF(self->name);	158	Py_XDECREF(self->name);
111	PyObject_Del(self);	159	PyObject_Del(self);
112	}	160	}
113		161
114	static void locked_EVP_MD_CTX_copy(EVP_MD_CTX new_ctx_p, EVPobject self)	162	static int
		163	locked_EVP_MD_CTX_copy(EVP_MD_CTX new_ctx_p, EVPobject self)
115	{	164	{
		165	int result;
116	ENTER_HASHLIB(self);	166	ENTER_HASHLIB(self);
117	EVP_MD_CTX_copy(new_ctx_p, &self->ctx);	167	result = EVP_MD_CTX_copy(new_ctx_p, self->ctx);
118	LEAVE_HASHLIB(self);	168	LEAVE_HASHLIB(self);
		169	return result;
119	}	170	}
120		171
121	/* External methods for a hash object */	172	/* External methods for a hash object */
Lines 131-137 Link Here
131	if ( (newobj = newEVPobject(self->name))==NULL)	182	if ( (newobj = newEVPobject(self->name))==NULL)
132	return NULL;	183	return NULL;
133		184
134	locked_EVP_MD_CTX_copy(&newobj->ctx, self);	185	if (!locked_EVP_MD_CTX_copy(newobj->ctx, self)) {
		186	return _setException(PyExc_ValueError);
		187	}
135	return (PyObject *)newobj;	188	return (PyObject *)newobj;
136	}	189	}
137		190
Lines 142-157 Link Here
142	EVP_digest(EVPobject self, PyObject unused)	195	EVP_digest(EVPobject self, PyObject unused)
143	{	196	{
144	unsigned char digest[EVP_MAX_MD_SIZE];	197	unsigned char digest[EVP_MAX_MD_SIZE];
145	EVP_MD_CTX temp_ctx;	198	EVP_MD_CTX *temp_ctx;
146	PyObject *retval;	199	PyObject *retval;
147	unsigned int digest_size;	200	unsigned int digest_size;
148		201
149	locked_EVP_MD_CTX_copy(&temp_ctx, self);	202	temp_ctx = EVP_MD_CTX_new();
150	digest_size = EVP_MD_CTX_size(&temp_ctx);	203	if (temp_ctx == NULL) {
151	EVP_DigestFinal(&temp_ctx, digest, NULL);	204	PyErr_NoMemory();
		205	return NULL;
		206	}
		207
		208	if (!locked_EVP_MD_CTX_copy(temp_ctx, self)) {
		209	return _setException(PyExc_ValueError);
		210	}
		211	digest_size = EVP_MD_CTX_size(temp_ctx);
		212	EVP_DigestFinal(temp_ctx, digest, NULL);
152		213
153	retval = PyBytes_FromStringAndSize((const char *)digest, digest_size);	214	retval = PyBytes_FromStringAndSize((const char *)digest, digest_size);
154	EVP_MD_CTX_cleanup(&temp_ctx);	215	EVP_MD_CTX_free(temp_ctx);
155	return retval;	216	return retval;
156	}	217	}
157		218
Lines 162-178 Link Here
162	EVP_hexdigest(EVPobject self, PyObject unused)	223	EVP_hexdigest(EVPobject self, PyObject unused)
163	{	224	{
164	unsigned char digest[EVP_MAX_MD_SIZE];	225	unsigned char digest[EVP_MAX_MD_SIZE];
165	EVP_MD_CTX temp_ctx;	226	EVP_MD_CTX *temp_ctx;
166	PyObject *retval;	227	PyObject *retval;
167	char *hex_digest;	228	char *hex_digest;
168	unsigned int i, j, digest_size;	229	unsigned int i, j, digest_size;
169		230
		231	temp_ctx = EVP_MD_CTX_new();
		232	if (temp_ctx == NULL) {
		233	PyErr_NoMemory();
		234	return NULL;
		235	}
		236
170	/* Get the raw (binary) digest value */	237	/* Get the raw (binary) digest value */
171	locked_EVP_MD_CTX_copy(&temp_ctx, self);	238	if (!locked_EVP_MD_CTX_copy(temp_ctx, self)) {
172	digest_size = EVP_MD_CTX_size(&temp_ctx);	239	return _setException(PyExc_ValueError);
173	EVP_DigestFinal(&temp_ctx, digest, NULL);	240	}
		241	digest_size = EVP_MD_CTX_size(temp_ctx);
		242	EVP_DigestFinal(temp_ctx, digest, NULL);
174		243
175	EVP_MD_CTX_cleanup(&temp_ctx);	244	EVP_MD_CTX_free(temp_ctx);
176		245
177	/* Allocate a new buffer */	246	/* Allocate a new buffer */
178	hex_digest = PyMem_Malloc(digest_size * 2 + 1);	247	hex_digest = PyMem_Malloc(digest_size * 2 + 1);
Lines 241-247 Link Here
241	EVP_get_block_size(EVPobject self, void closure)	310	EVP_get_block_size(EVPobject self, void closure)
242	{	311	{
243	long block_size;	312	long block_size;
244	block_size = EVP_MD_CTX_block_size(&self->ctx);	313	block_size = EVP_MD_CTX_block_size(self->ctx);
245	return PyLong_FromLong(block_size);	314	return PyLong_FromLong(block_size);
246	}	315	}
247		316
Lines 249-255 Link Here
249	EVP_get_digest_size(EVPobject self, void closure)	318	EVP_get_digest_size(EVPobject self, void closure)
250	{	319	{
251	long size;	320	long size;
252	size = EVP_MD_CTX_size(&self->ctx);	321	size = EVP_MD_CTX_size(self->ctx);
253	return PyLong_FromLong(size);	322	return PyLong_FromLong(size);
254	}	323	}
255		324
Lines 310-316 Link Here
310	PyBuffer_Release(&view);	379	PyBuffer_Release(&view);
311	return -1;	380	return -1;
312	}	381	}
313	EVP_DigestInit(&self->ctx, digest);	382	EVP_DigestInit(self->ctx, digest);
314		383
315	self->name = name_obj;	384	self->name = name_obj;
316	Py_INCREF(self->name);	385	Py_INCREF(self->name);
Lines 407-415 Link Here
407	return NULL;	476	return NULL;
408		477
409	if (initial_ctx) {	478	if (initial_ctx) {
410	EVP_MD_CTX_copy(&self->ctx, initial_ctx);	479	EVP_MD_CTX_copy(self->ctx, initial_ctx);
411	} else {	480	} else {
412	EVP_DigestInit(&self->ctx, digest);	481	EVP_DigestInit(self->ctx, digest);
413	}	482	}
414		483
415	if (cp && len) {	484	if (cp && len) {
Lines 475-480 Link Here
475		544
476	#define PY_PBKDF2_HMAC 1	545	#define PY_PBKDF2_HMAC 1
477		546
		547	#if !HAS_FAST_PKCS5_PBKDF2_HMAC
478	/* Improved implementation of PKCS5_PBKDF2_HMAC()	548	/* Improved implementation of PKCS5_PBKDF2_HMAC()
479	*	549	*
480	* PKCS5_PBKDF2_HMAC_fast() hashes the password exactly one time instead of	550	* PKCS5_PBKDF2_HMAC_fast() hashes the password exactly one time instead of
Lines 556-592 Link Here
556	HMAC_CTX_cleanup(&hctx_tpl);	626	HMAC_CTX_cleanup(&hctx_tpl);
557	return 1;	627	return 1;
558	}	628	}
		629	#endif
559		630
560	/* LCOV_EXCL_START */
561	static PyObject *
562	_setException(PyObject *exc)
563	{
564	unsigned long errcode;
565	const char lib, func, *reason;
566
567	errcode = ERR_peek_last_error();
568	if (!errcode) {
569	PyErr_SetString(exc, "unknown reasons");
570	return NULL;
571	}
572	ERR_clear_error();
573
574	lib = ERR_lib_error_string(errcode);
575	func = ERR_func_error_string(errcode);
576	reason = ERR_reason_error_string(errcode);
577
578	if (lib && func) {
579	PyErr_Format(exc, "[%s: %s] %s", lib, func, reason);
580	}
581	else if (lib) {
582	PyErr_Format(exc, "[%s] %s", lib, reason);
583	}
584	else {
585	PyErr_SetString(exc, reason);
586	}
587	return NULL;
588	}
589	/* LCOV_EXCL_STOP */
590		631
591	PyDoc_STRVAR(pbkdf2_hmac__doc__,	632	PyDoc_STRVAR(pbkdf2_hmac__doc__,
592	"pbkdf2_hmac(hash_name, password, salt, iterations, dklen=None) -> key\n\	633	"pbkdf2_hmac(hash_name, password, salt, iterations, dklen=None) -> key\n\
Lines 668-677 Link Here
668	key = PyBytes_AS_STRING(key_obj);	709	key = PyBytes_AS_STRING(key_obj);
669		710
670	Py_BEGIN_ALLOW_THREADS	711	Py_BEGIN_ALLOW_THREADS
		712	#if HAS_FAST_PKCS5_PBKDF2_HMAC
		713	retval = PKCS5_PBKDF2_HMAC((char*)password.buf, (int)password.len,
		714	(unsigned char *)salt.buf, (int)salt.len,
		715	iterations, digest, dklen,
		716	(unsigned char *)key);
		717	#else
671	retval = PKCS5_PBKDF2_HMAC_fast((char*)password.buf, (int)password.len,	718	retval = PKCS5_PBKDF2_HMAC_fast((char*)password.buf, (int)password.len,
672	(unsigned char *)salt.buf, (int)salt.len,	719	(unsigned char *)salt.buf, (int)salt.len,
673	iterations, digest, dklen,	720	iterations, digest, dklen,
674	(unsigned char *)key);	721	(unsigned char *)key);
		722	#endif
675	Py_END_ALLOW_THREADS	723	Py_END_ALLOW_THREADS
676		724
677	if (!retval) {	725	if (!retval) {
Lines 790-796 Link Here
790	if (CONST_ ## NAME ## _name_obj == NULL) { \	838	if (CONST_ ## NAME ## _name_obj == NULL) { \
791	CONST_ ## NAME ## _name_obj = PyUnicode_FromString(#NAME); \	839	CONST_ ## NAME ## _name_obj = PyUnicode_FromString(#NAME); \
792	if (EVP_get_digestbyname(#NAME)) { \	840	if (EVP_get_digestbyname(#NAME)) { \
793	CONST_new_ ## NAME ## _ctx_p = &CONST_new_ ## NAME ## _ctx; \	841	CONST_new_ ## NAME ## _ctx_p = EVP_MD_CTX_new(); \
794	EVP_DigestInit(CONST_new_ ## NAME ## _ctx_p, EVP_get_digestbyname(#NAME)); \	842	EVP_DigestInit(CONST_new_ ## NAME ## _ctx_p, EVP_get_digestbyname(#NAME)); \
795	} \	843	} \
796	} \	844	} \