mirrors/cpython
1
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-12-23 09:19:18 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

[3.9] gh-107077: Raise SSLCertVerificationError even if the error is set via SSL_ERROR_SYSCALL (GH-107586) (#107590)

Browse source 
(cherry picked from commit 77e09192b5)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
Co-authored-by: T. Wouters <thomas@python.org>
Co-authored-by: Łukasz Langa <lukasz@langa.pl>
Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
This commit is contained in:
Miss Islington (bot) 2024-02-21 17:02:34 +01:00 • committed by GitHub
parent 4b68e5d7ab
commit 468ba95c79
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst Normal file
View file

@ -0,0 +1,6 @@
Seems that in some conditions, OpenSSL will return ``SSL_ERROR_SYSCALL``
instead of ``SSL_ERROR_SSL`` when a certification verification has failed,
but the error parameters will still contain ``ERR_LIB_SSL`` and
``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and
raising the appropiate ``ssl.SSLCertVerificationError``. Patch by Pablo
Galindo

4
Modules/_ssl.c
View file

@ -817,6 +817,10 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
errstr = "Some I/O error occurred";
}
} else {
if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
type = PySSLCertVerificationErrorObject;
}
p = PY_SSL_ERROR_SYSCALL;
}
break;