Mirror
/
cpython
mirror of https://github.com/python/cpython
4
1
Fork 0
Code Issues Releases Wiki Activity

gh-107077: Raise SSLCertVerificationError even if the error is set via SSL_ERROR_SYSCALL (#107586) 

Co-authored-by: T. Wouters <thomas@python.org>
This commit is contained in:
Pablo Galindo Salgado 2023-08-03 13:37:14 +01:00 committed by GitHub
parent a73daf54eb
commit 77e09192b5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst Normal file
View File

@ -0,0 +1,6 @@
Seems that in some conditions, OpenSSL will return ``SSL_ERROR_SYSCALL``
instead of ``SSL_ERROR_SSL`` when a certification verification has failed,
but the error parameters will still contain ``ERR_LIB_SSL`` and
``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and
raising the appropiate ``ssl.SSLCertVerificationError``. Patch by Pablo
Galindo

4
Modules/_ssl.c
View File

@ -667,6 +667,10 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
errstr = "Some I/O error occurred";
}
} else {
if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
type = state->PySSLCertVerificationErrorObject;
}
p = PY_SSL_ERROR_SYSCALL;
}
break;