Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

gh-105293: Do not call SSL_CTX_set_session_id_context on client side SSL context (#105295) 

* gh-105293: Do not call SSL_CTX_set_session_id_context on client side SSL context

Openssl states this is a "server side only" operation.
Calling this on a client side socket can result in unexpected behavior

* Add news entry on SSL "set session id context" changes
This commit is contained in:
Grant Ramsay 2023-07-14 19:10:54 +12:00 committed by GitHub
parent 490295d651
commit 21d98be422
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Misc/NEWS.d/next/Library/2023-07-14-14-53-58.gh-issue-105293.kimf_i.rst Normal file
View File

@ -0,0 +1,2 @@
Remove call to ``SSL_CTX_set_session_id_context`` during client side context
creation in the :mod:`ssl` module.

14
Modules/_ssl.c
View File

@ -847,6 +847,15 @@ newPySSLSocket(PySSLContext *sslctx, PySocketSockObject *sock,
_setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__);
return NULL;
}
if (socket_type == PY_SSL_SERVER) {
#define SID_CTX "Python"
/* Set the session id context (server-side only) */
SSL_set_session_id_context(self->ssl, (const unsigned char *) SID_CTX,
sizeof(SID_CTX));
#undef SID_CTX
}
/* bpo43522 and OpenSSL < 1.1.1l: copy hostflags manually */
#if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION < 0x101010cf
X509_VERIFY_PARAM *ssl_params = SSL_get0_param(self->ssl);
@ -3186,11 +3195,6 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
usage for no cost at all. */
SSL_CTX_set_mode(self->ctx, SSL_MODE_RELEASE_BUFFERS);
#define SID_CTX "Python"
SSL_CTX_set_session_id_context(self->ctx, (const unsigned char *) SID_CTX,
sizeof(SID_CTX));
#undef SID_CTX
params = SSL_CTX_get0_param(self->ctx);
/* Improve trust chain building when cross-signed intermediate
certificates are present. See https://bugs.python.org/issue23476. */