Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2025-12-31 12:33:28 +00:00
Code Issues Projects Releases Packages Wiki Activity

[3.12] gh-107077: Raise SSLCertVerificationError even if the error is set via SSL_ERROR_SYSCALL (GH-107586) (#107587)

Browse source 
Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
Co-authored-by: T. Wouters <thomas@python.org>
This commit is contained in:
Miss Islington (bot) 2023-08-03 07:09:29 -07:00 • committed by GitHub
parent 12d1c494ae
commit 93fcf75878
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst Normal file
View file

@ -0,0 +1,6 @@
Seems that in some conditions, OpenSSL will return ``SSL_ERROR_SYSCALL``
instead of ``SSL_ERROR_SSL`` when a certification verification has failed,
but the error parameters will still contain ``ERR_LIB_SSL`` and
``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and
raising the appropiate ``ssl.SSLCertVerificationError``. Patch by Pablo
Galindo

4
Modules/_ssl.c
View file

@ -647,6 +647,10 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
errstr = "Some I/O error occurred";
}
} else {
if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
type = state->PySSLCertVerificationErrorObject;
}
p = PY_SSL_ERROR_SYSCALL;
}
break;