Skip to content

Commit 8352fd3

Browse files
Alan HuangAlan Huang
Alan Huang
authored and
Alan Huang
committed
bpo-34001: add checks for LibreSSL
LibreSSL behaves differently than OpenSSL when setting protocol bounds. This commit fixes some failing tests and adds checks and more detailed error messages.
1 parent 4254483 commit 8352fd3

File tree

1 file changed

+24
-0
lines changed

1 file changed

+24
-0
lines changed

Modules/_ssl.c

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3386,6 +3386,8 @@ set_min_max_proto_version(PySSLContext *self, PyObject *arg, int what)
33863386
long min;
33873387
long max;
33883388
long v;
3389+
long prev;
3390+
long new;
33893391
int result;
33903392

33913393
if (!PyArg_Parse(arg, "l", &v))
@@ -3432,7 +3434,18 @@ set_min_max_proto_version(PySSLContext *self, PyObject *arg, int what)
34323434
);
34333435
return -1;
34343436
}
3437+
prev = SSL_CTX_get_min_proto_version(self->ctx);
34353438
result = SSL_CTX_set_min_proto_version(self->ctx, v);
3439+
new = SSL_CTX_get_min_proto_version(self->ctx);
3440+
#if defined(LIBRESSL_VERSION_NUMBER)
3441+
if((v != 0 && v != new) ||
3442+
(v == 0 && PY_PROTO_MINIMUM_AVAILABLE != new)) {
3443+
PyErr_Format(PyExc_ValueError,
3444+
"Unsupported protocol version 0x%x", v);
3445+
SSL_CTX_set_min_proto_version(self->ctx, prev);
3446+
return -1;
3447+
}
3448+
#endif
34363449
}
34373450
else {
34383451
/* set_maximum_version */
@@ -3457,7 +3470,18 @@ set_min_max_proto_version(PySSLContext *self, PyObject *arg, int what)
34573470
);
34583471
return -1;
34593472
}
3473+
prev = SSL_CTX_get_max_proto_version(self->ctx);
34603474
result = SSL_CTX_set_max_proto_version(self->ctx, v);
3475+
new = SSL_CTX_get_max_proto_version(self->ctx);
3476+
#if defined(LIBRESSL_VERSION_NUMBER)
3477+
if((v != 0 && v != SSL_CTX_get_max_proto_version(self->ctx)) ||
3478+
(v == 0 && PY_PROTO_MAXIMUM_AVAILABLE != SSL_CTX_get_max_proto_version(self->ctx))) {
3479+
PyErr_Format(PyExc_ValueError,
3480+
"Unsupported protocol version 0x%x", v);
3481+
result = SSL_CTX_set_max_proto_version(self->ctx, prev);
3482+
return -1;
3483+
}
3484+
#endif
34613485
}
34623486
if (result == 0) {
34633487
PyErr_Format(PyExc_ValueError,

0 commit comments

Comments
 (0)