1From 308e4f113891bea997bcac7e7e48a18956478265 Mon Sep 17 00:00:00 2001
2From: Michael Forney <mforney@mforney.org>
3Date: Tue, 5 Oct 2021 14:44:43 -0700
4Subject: [PATCH] Re-add support for libressl
5
6---
7 Modules/_hashopenssl.c | 4 +++
8 Modules/_ssl.c | 58 +++++++++++++++++++++------------
9 Modules/_ssl/debughelpers.c | 4 +++
10 Modules/clinic/_hashopenssl.c.h | 10 +++++-
11 Modules/clinic/_ssl.c.h | 28 ++++++++++++----
12 5 files changed, 77 insertions(+), 27 deletions(-)
13
14diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c
15index b9e68c05c3..75eb76266a 100644
16--- a/Modules/_hashopenssl.c
17+++ b/Modules/_hashopenssl.c
18@@ -40,10 +40,12 @@
19
20 #define MUNCH_SIZE INT_MAX
21
22+#ifndef LIBRESSL_VERSION_NUMBER
23 #define PY_OPENSSL_HAS_SCRYPT 1
24 #define PY_OPENSSL_HAS_SHA3 1
25 #define PY_OPENSSL_HAS_SHAKE 1
26 #define PY_OPENSSL_HAS_BLAKE2 1
27+#endif
28
29 static PyModuleDef _hashlibmodule;
30
31@@ -1794,6 +1796,7 @@ hashlib_md_meth_names(PyObject *module)
32 return 0;
33 }
34
35+#ifndef LIBRESSL_VERSION_NUMBER
36 /*[clinic input]
37 _hashlib.get_fips_mode -> int
38
39@@ -1831,6 +1834,7 @@ _hashlib_get_fips_mode_impl(PyObject *module)
40 return result;
41 #endif
42 }
43+#endif
44
45
46 static int
47diff --git a/Modules/_ssl.c b/Modules/_ssl.c
48index 6c63301b2a..d8a70d5511 100644
49--- a/Modules/_ssl.c
50+++ b/Modules/_ssl.c
51@@ -291,8 +291,10 @@ typedef struct {
52 int post_handshake_auth;
53 #endif
54 PyObject *msg_cb;
55+#ifndef LIBRESSL_VERSION_NUMBER
56 PyObject *keylog_filename;
57 BIO *keylog_bio;
58+#endif
59 /* Cached module state, also used in SSLSocket and SSLSession code. */
60 _sslmodulestate *state;
61 } PySSLContext;
62@@ -1829,6 +1831,7 @@ _ssl__SSLSocket_getpeercert_impl(PySSLSocket *self, int binary_mode)
63 return result;
64 }
65
66+#ifndef LIBRESSL_VERSION_NUMBER
67 /*[clinic input]
68 _ssl._SSLSocket.get_verified_chain
69
70@@ -1892,6 +1895,7 @@ _ssl__SSLSocket_get_unverified_chain_impl(PySSLSocket *self)
71 }
72 return retval;
73 }
74+#endif
75
76 static PyObject *
77 cipher_to_tuple(const SSL_CIPHER *cipher)
78@@ -2298,8 +2302,7 @@ static PyObject *
79 _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
80 /*[clinic end generated code: output=aa7a6be5527358d8 input=77262d994fe5100a]*/
81 {
82- size_t count = 0;
83- int retval;
84+ int len;
85 int sockstate;
86 _PySSLError err;
87 int nonblocking;
88@@ -2317,6 +2320,12 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
89 Py_INCREF(sock);
90 }
91
92+ if (b->len > INT_MAX) {
93+ PyErr_Format(PyExc_OverflowError,
94+ "string longer than %d bytes", INT_MAX);
95+ goto error;
96+ }
97+
98 if (sock != NULL) {
99 /* just in case the blocking state of the socket has been changed */
100 nonblocking = (sock->sock_timeout >= 0);
101@@ -2346,8 +2355,8 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
102
103 do {
104 PySSL_BEGIN_ALLOW_THREADS
105- retval = SSL_write_ex(self->ssl, b->buf, (size_t)b->len, &count);
106- err = _PySSL_errno(retval == 0, self->ssl, retval);
107+ len = SSL_write(self->ssl, b->buf, (int)b->len);
108+ err = _PySSL_errno(len <= 0, self->ssl, len);
109 PySSL_END_ALLOW_THREADS
110 self->err = err;
111
112@@ -2380,11 +2389,11 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
113 err.ssl == SSL_ERROR_WANT_WRITE);
114
115 Py_XDECREF(sock);
116- if (retval == 0)
117- return PySSL_SetError(self, retval, __FILE__, __LINE__);
118+ if (len <= 0)
119+ return PySSL_SetError(self, len, __FILE__, __LINE__);
120 if (PySSL_ChainExceptions(self) < 0)
121 return NULL;
122- return PyLong_FromSize_t(count);
123+ return PyLong_FromLong(len);
124 error:
125 Py_XDECREF(sock);
126 PySSL_ChainExceptions(self);
127@@ -2418,7 +2427,7 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
128
129 /*[clinic input]
130 _ssl._SSLSocket.read
131- size as len: Py_ssize_t
132+ size as len: int
133 [
134 buffer: Py_buffer(accept={rwbuffer})
135 ]
136@@ -2428,14 +2437,13 @@ Read up to size bytes from the SSL socket.
137 [clinic start generated code]*/
138
139 static PyObject *
140-_ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
141- int group_right_1, Py_buffer *buffer)
142-/*[clinic end generated code: output=49b16e6406023734 input=ec48bf622be1c4a1]*/
143+_ssl__SSLSocket_read_impl(PySSLSocket *self, int len, int group_right_1,
144+ Py_buffer *buffer)
145+/*[clinic end generated code: output=00097776cec2a0af input=ff157eb918d0905b]*/
146 {
147 PyObject *dest = NULL;
148 char *mem;
149- size_t count = 0;
150- int retval;
151+ int count;
152 int sockstate;
153 _PySSLError err;
154 int nonblocking;
155@@ -2498,8 +2506,8 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
156
157 do {
158 PySSL_BEGIN_ALLOW_THREADS
159- retval = SSL_read_ex(self->ssl, mem, (size_t)len, &count);
160- err = _PySSL_errno(retval == 0, self->ssl, retval);
161+ count = SSL_read(self->ssl, mem, len);
162+ err = _PySSL_errno(count <= 0, self->ssl, count);
163 PySSL_END_ALLOW_THREADS
164 self->err = err;
165
166@@ -2532,8 +2540,8 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
167 } while (err.ssl == SSL_ERROR_WANT_READ ||
168 err.ssl == SSL_ERROR_WANT_WRITE);
169
170- if (retval == 0) {
171- PySSL_SetError(self, retval, __FILE__, __LINE__);
172+ if (count <= 0) {
173+ PySSL_SetError(self, count, __FILE__, __LINE__);
174 goto error;
175 }
176 if (self->exc_type != NULL)
177@@ -2546,7 +2554,7 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
178 return dest;
179 }
180 else {
181- return PyLong_FromSize_t(count);
182+ return PyLong_FromLong(count);
183 }
184
185 error:
186@@ -3062,8 +3070,10 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
187 self->hostflags = X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS;
188 self->protocol = proto_version;
189 self->msg_cb = NULL;
190+#ifndef LIBRESSL_VERSION_NUMBER
191 self->keylog_filename = NULL;
192 self->keylog_bio = NULL;
193+#endif
194 self->alpn_protocols = NULL;
195 self->set_sni_cb = NULL;
196 self->state = get_ssl_state(module);
197@@ -3187,6 +3197,7 @@ context_clear(PySSLContext *self)
198 {
199 Py_CLEAR(self->set_sni_cb);
200 Py_CLEAR(self->msg_cb);
201+#ifndef LIBRESSL_VERSION_NUMBER
202 Py_CLEAR(self->keylog_filename);
203 if (self->keylog_bio != NULL) {
204 PySSL_BEGIN_ALLOW_THREADS
205@@ -3194,6 +3205,7 @@ context_clear(PySSLContext *self)
206 PySSL_END_ALLOW_THREADS
207 self->keylog_bio = NULL;
208 }
209+#endif
210 return 0;
211 }
212
213@@ -3535,7 +3547,7 @@ set_maximum_version(PySSLContext *self, PyObject *arg, void *c)
214 return set_min_max_proto_version(self, arg, 1);
215 }
216
217-#ifdef TLS1_3_VERSION
218+#if defined(TLS1_3_VERSION) && !defined(LIBRESSL_VERSION_NUMBER)
219 static PyObject *
220 get_num_tickets(PySSLContext *self, void *c)
221 {
222@@ -3568,12 +3580,14 @@ PyDoc_STRVAR(PySSLContext_num_tickets_doc,
223 "Control the number of TLSv1.3 session tickets");
224 #endif /* TLS1_3_VERSION */
225
226+#ifndef LIBRESSL_VERSION_NUMBER
227 static PyObject *
228 get_security_level(PySSLContext *self, void *c)
229 {
230 return PyLong_FromLong(SSL_CTX_get_security_level(self->ctx));
231 }
232 PyDoc_STRVAR(PySSLContext_security_level_doc, "The current security level");
233+#endif
234
235 static PyObject *
236 get_options(PySSLContext *self, void *c)
237@@ -4603,13 +4617,15 @@ static PyGetSetDef context_getsetlist[] = {
238 (setter) set_minimum_version, NULL},
239 {"maximum_version", (getter) get_maximum_version,
240 (setter) set_maximum_version, NULL},
241+#ifndef LIBRESSL_VERSION_NUMBER
242 {"keylog_filename", (getter) _PySSLContext_get_keylog_filename,
243 (setter) _PySSLContext_set_keylog_filename, NULL},
244+#endif
245 {"_msg_callback", (getter) _PySSLContext_get_msg_callback,
246 (setter) _PySSLContext_set_msg_callback, NULL},
247 {"sni_callback", (getter) get_sni_callback,
248 (setter) set_sni_callback, PySSLContext_sni_callback_doc},
249-#ifdef TLS1_3_VERSION
250+#if defined(TLS1_3_VERSION) && !defined(LIBRESSL_VERSION_NUMBER)
251 {"num_tickets", (getter) get_num_tickets,
252 (setter) set_num_tickets, PySSLContext_num_tickets_doc},
253 #endif
254@@ -4628,8 +4644,10 @@ static PyGetSetDef context_getsetlist[] = {
255 (setter) set_verify_flags, NULL},
256 {"verify_mode", (getter) get_verify_mode,
257 (setter) set_verify_mode, NULL},
258+#ifndef LIBRESSL_VERSION_NUMBER
259 {"security_level", (getter) get_security_level,
260 NULL, PySSLContext_security_level_doc},
261+#endif
262 {NULL}, /* sentinel */
263 };
264
265diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c
266index 03c125eb44..d992c5bc02 100644
267--- a/Modules/_ssl/debughelpers.c
268+++ b/Modules/_ssl/debughelpers.c
269@@ -114,6 +114,8 @@ _PySSLContext_set_msg_callback(PySSLContext *self, PyObject *arg, void *c) {
270 return 0;
271 }
272
273+#ifndef LIBRESSL_VERSION_NUMBER
274+
275 static void
276 _PySSL_keylog_callback(const SSL *ssl, const char *line)
277 {
278@@ -217,3 +219,5 @@ _PySSLContext_set_keylog_filename(PySSLContext *self, PyObject *arg, void *c) {
279 SSL_CTX_set_keylog_callback(self->ctx, _PySSL_keylog_callback);
280 return 0;
281 }
282+
283+#endif
284diff --git a/Modules/clinic/_hashopenssl.c.h b/Modules/clinic/_hashopenssl.c.h
285index de01489e6a..c686eddea8 100644
286--- a/Modules/clinic/_hashopenssl.c.h
287+++ b/Modules/clinic/_hashopenssl.c.h
288@@ -1275,6 +1275,8 @@ _hashlib_HMAC_hexdigest(HMACobject *self, PyObject *Py_UNUSED(ignored))
289 return _hashlib_HMAC_hexdigest_impl(self);
290 }
291
292+#if !defined(LIBRESSL_VERSION_NUMBER)
293+
294 PyDoc_STRVAR(_hashlib_get_fips_mode__doc__,
295 "get_fips_mode($module, /)\n"
296 "--\n"
297@@ -1310,6 +1312,8 @@ _hashlib_get_fips_mode(PyObject *module, PyObject *Py_UNUSED(ignored))
298 return return_value;
299 }
300
301+#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
302+
303 PyDoc_STRVAR(_hashlib_compare_digest__doc__,
304 "compare_digest($module, a, b, /)\n"
305 "--\n"
306@@ -1385,4 +1389,8 @@ _hashlib_compare_digest(PyObject *module, PyObject *const *args, Py_ssize_t narg
307 #ifndef _HASHLIB_SCRYPT_METHODDEF
308 #define _HASHLIB_SCRYPT_METHODDEF
309 #endif /* !defined(_HASHLIB_SCRYPT_METHODDEF) */
310-/*[clinic end generated code: output=162369cb9d43f1cc input=a9049054013a1b77]*/
311+
312+#ifndef _HASHLIB_GET_FIPS_MODE_METHODDEF
313+ #define _HASHLIB_GET_FIPS_MODE_METHODDEF
314+#endif /* !defined(_HASHLIB_GET_FIPS_MODE_METHODDEF) */
315+/*[clinic end generated code: output=a110f274fb33395d input=a9049054013a1b77]*/
316diff --git a/Modules/clinic/_ssl.c.h b/Modules/clinic/_ssl.c.h
317index b59b129af8..f6bcd09e03 100644
318--- a/Modules/clinic/_ssl.c.h
319+++ b/Modules/clinic/_ssl.c.h
320@@ -88,6 +88,8 @@ _ssl__SSLSocket_getpeercert(PySSLSocket *self, PyObject *const *args, Py_ssize_t
321 return return_value;
322 }
323
324+#if !defined(LIBRESSL_VERSION_NUMBER)
325+
326 PyDoc_STRVAR(_ssl__SSLSocket_get_verified_chain__doc__,
327 "get_verified_chain($self, /)\n"
328 "--\n"
329@@ -105,6 +107,10 @@ _ssl__SSLSocket_get_verified_chain(PySSLSocket *self, PyObject *Py_UNUSED(ignore
330 return _ssl__SSLSocket_get_verified_chain_impl(self);
331 }
332
333+#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
334+
335+#if !defined(LIBRESSL_VERSION_NUMBER)
336+
337 PyDoc_STRVAR(_ssl__SSLSocket_get_unverified_chain__doc__,
338 "get_unverified_chain($self, /)\n"
339 "--\n"
340@@ -122,6 +128,8 @@ _ssl__SSLSocket_get_unverified_chain(PySSLSocket *self, PyObject *Py_UNUSED(igno
341 return _ssl__SSLSocket_get_unverified_chain_impl(self);
342 }
343
344+#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
345+
346 PyDoc_STRVAR(_ssl__SSLSocket_shared_ciphers__doc__,
347 "shared_ciphers($self, /)\n"
348 "--\n"
349@@ -271,25 +279,25 @@ PyDoc_STRVAR(_ssl__SSLSocket_read__doc__,
350 {"read", (PyCFunction)_ssl__SSLSocket_read, METH_VARARGS, _ssl__SSLSocket_read__doc__},
351
352 static PyObject *
353-_ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
354- int group_right_1, Py_buffer *buffer);
355+_ssl__SSLSocket_read_impl(PySSLSocket *self, int len, int group_right_1,
356+ Py_buffer *buffer);
357
358 static PyObject *
359 _ssl__SSLSocket_read(PySSLSocket *self, PyObject *args)
360 {
361 PyObject *return_value = NULL;
362- Py_ssize_t len;
363+ int len;
364 int group_right_1 = 0;
365 Py_buffer buffer = {NULL, NULL};
366
367 switch (PyTuple_GET_SIZE(args)) {
368 case 1:
369- if (!PyArg_ParseTuple(args, "n:read", &len)) {
370+ if (!PyArg_ParseTuple(args, "i:read", &len)) {
371 goto exit;
372 }
373 break;
374 case 2:
375- if (!PyArg_ParseTuple(args, "nw*:read", &len, &buffer)) {
376+ if (!PyArg_ParseTuple(args, "iw*:read", &len, &buffer)) {
377 goto exit;
378 }
379 group_right_1 = 1;
380@@ -1351,6 +1359,14 @@ _ssl_enum_crls(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyObje
381
382 #endif /* defined(_MSC_VER) */
383
384+#ifndef _SSL__SSLSOCKET_GET_VERIFIED_CHAIN_METHODDEF
385+ #define _SSL__SSLSOCKET_GET_VERIFIED_CHAIN_METHODDEF
386+#endif /* !defined(_SSL__SSLSOCKET_GET_VERIFIED_CHAIN_METHODDEF) */
387+
388+#ifndef _SSL__SSLSOCKET_GET_UNVERIFIED_CHAIN_METHODDEF
389+ #define _SSL__SSLSOCKET_GET_UNVERIFIED_CHAIN_METHODDEF
390+#endif /* !defined(_SSL__SSLSOCKET_GET_UNVERIFIED_CHAIN_METHODDEF) */
391+
392 #ifndef _SSL_ENUM_CERTIFICATES_METHODDEF
393 #define _SSL_ENUM_CERTIFICATES_METHODDEF
394 #endif /* !defined(_SSL_ENUM_CERTIFICATES_METHODDEF) */
395@@ -1358,4 +1374,4 @@ _ssl_enum_crls(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyObje
396 #ifndef _SSL_ENUM_CRLS_METHODDEF
397 #define _SSL_ENUM_CRLS_METHODDEF
398 #endif /* !defined(_SSL_ENUM_CRLS_METHODDEF) */
399-/*[clinic end generated code: output=5a7d7bf5cf8ee092 input=a9049054013a1b77]*/
400+/*[clinic end generated code: output=0e12e5e4ee2221b5 input=a9049054013a1b77]*/
401--
4022.32.0
403
