logo

oasis

Own branch of Oasis Linux (upstream: <https://git.sr.ht/~mcf/oasis/>) git clone https://anongit.hacktivis.me/git/oasis.git

0002-Re-add-support-for-libressl.patch (13821B)

    

  1. From 308e4f113891bea997bcac7e7e48a18956478265 Mon Sep 17 00:00:00 2001
  2. From: Michael Forney <mforney@mforney.org>
  3. Date: Tue, 5 Oct 2021 14:44:43 -0700
  4. Subject: [PATCH] Re-add support for libressl
  6. ---
  7.  Modules/_hashopenssl.c          |  4 +++
  8.  Modules/_ssl.c                  | 58 +++++++++++++++++++++------------
  9.  Modules/_ssl/debughelpers.c     |  4 +++
  10.  Modules/clinic/_hashopenssl.c.h | 10 +++++-
  11.  Modules/clinic/_ssl.c.h         | 28 ++++++++++++----
  12.  5 files changed, 77 insertions(+), 27 deletions(-)
  14. diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c
  15. index b9e68c05c3..75eb76266a 100644
  16. --- a/Modules/_hashopenssl.c
  17. +++ b/Modules/_hashopenssl.c
  18. @@ -40,10 +40,12 @@
  19.  
  20.  #define MUNCH_SIZE INT_MAX
  21.  
  22. +#ifndef LIBRESSL_VERSION_NUMBER
  23.  #define PY_OPENSSL_HAS_SCRYPT 1
  24.  #define PY_OPENSSL_HAS_SHA3 1
  25.  #define PY_OPENSSL_HAS_SHAKE 1
  26.  #define PY_OPENSSL_HAS_BLAKE2 1
  27. +#endif
  28.  
  29.  static PyModuleDef _hashlibmodule;
  30.  
  31. @@ -1794,6 +1796,7 @@ hashlib_md_meth_names(PyObject *module)
  32.      return 0;
  33.  }
  34.  
  35. +#ifndef LIBRESSL_VERSION_NUMBER
  36.  /*[clinic input]
  37.  _hashlib.get_fips_mode -> int
  38.  
  39. @@ -1831,6 +1834,7 @@ _hashlib_get_fips_mode_impl(PyObject *module)
  40.      return result;
  41.  #endif
  42.  }
  43. +#endif
  44.  
  45.  
  46.  static int
  47. diff --git a/Modules/_ssl.c b/Modules/_ssl.c
  48. index 6c63301b2a..d8a70d5511 100644
  49. --- a/Modules/_ssl.c
  50. +++ b/Modules/_ssl.c
  51. @@ -291,8 +291,10 @@ typedef struct {
  52.      int post_handshake_auth;
  53.  #endif
  54.      PyObject *msg_cb;
  55. +#ifndef LIBRESSL_VERSION_NUMBER
  56.      PyObject *keylog_filename;
  57.      BIO *keylog_bio;
  58. +#endif
  59.      /* Cached module state, also used in SSLSocket and SSLSession code. */
  60.      _sslmodulestate *state;
  61.  } PySSLContext;
  62. @@ -1829,6 +1831,7 @@ _ssl__SSLSocket_getpeercert_impl(PySSLSocket *self, int binary_mode)
  63.      return result;
  64.  }
  65.  
  66. +#ifndef LIBRESSL_VERSION_NUMBER
  67.  /*[clinic input]
  68.  _ssl._SSLSocket.get_verified_chain
  69.  
  70. @@ -1892,6 +1895,7 @@ _ssl__SSLSocket_get_unverified_chain_impl(PySSLSocket *self)
  71.      }
  72.      return retval;
  73.  }
  74. +#endif
  75.  
  76.  static PyObject *
  77.  cipher_to_tuple(const SSL_CIPHER *cipher)
  78. @@ -2298,8 +2302,7 @@ static PyObject *
  79.  _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
  80.  /*[clinic end generated code: output=aa7a6be5527358d8 input=77262d994fe5100a]*/
  81.  {
  82. -    size_t count = 0;
  83. -    int retval;
  84. +    int len;
  85.      int sockstate;
  86.      _PySSLError err;
  87.      int nonblocking;
  88. @@ -2317,6 +2320,12 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
  89.          Py_INCREF(sock);
  90.      }
  91.  
  92. +    if (b->len > INT_MAX) {
  93. +        PyErr_Format(PyExc_OverflowError,
  94. +                     "string longer than %d bytes", INT_MAX);
  95. +        goto error;
  96. +    }
  97. +
  98.      if (sock != NULL) {
  99.          /* just in case the blocking state of the socket has been changed */
  100.          nonblocking = (sock->sock_timeout >= 0);
  101. @@ -2346,8 +2355,8 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
  102.  
  103.      do {
  104.          PySSL_BEGIN_ALLOW_THREADS
  105. -        retval = SSL_write_ex(self->ssl, b->buf, (size_t)b->len, &count);
  106. -        err = _PySSL_errno(retval == 0, self->ssl, retval);
  107. +        len = SSL_write(self->ssl, b->buf, (int)b->len);
  108. +        err = _PySSL_errno(len <= 0, self->ssl, len);
  109.          PySSL_END_ALLOW_THREADS
  110.          self->err = err;
  111.  
  112. @@ -2380,11 +2389,11 @@ _ssl__SSLSocket_write_impl(PySSLSocket *self, Py_buffer *b)
  113.               err.ssl == SSL_ERROR_WANT_WRITE);
  114.  
  115.      Py_XDECREF(sock);
  116. -    if (retval == 0)
  117. -        return PySSL_SetError(self, retval, __FILE__, __LINE__);
  118. +    if (len <= 0)
  119. +        return PySSL_SetError(self, len, __FILE__, __LINE__);
  120.      if (PySSL_ChainExceptions(self) < 0)
  121.          return NULL;
  122. -    return PyLong_FromSize_t(count);
  123. +    return PyLong_FromLong(len);
  124.  error:
  125.      Py_XDECREF(sock);
  126.      PySSL_ChainExceptions(self);
  127. @@ -2418,7 +2427,7 @@ _ssl__SSLSocket_pending_impl(PySSLSocket *self)
  128.  
  129.  /*[clinic input]
  130.  _ssl._SSLSocket.read
  131. -    size as len: Py_ssize_t
  132. +    size as len: int
  133.      [
  134.      buffer: Py_buffer(accept={rwbuffer})
  135.      ]
  136. @@ -2428,14 +2437,13 @@ Read up to size bytes from the SSL socket.
  137.  [clinic start generated code]*/
  138.  
  139.  static PyObject *
  140. -_ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
  141. -                          int group_right_1, Py_buffer *buffer)
  142. -/*[clinic end generated code: output=49b16e6406023734 input=ec48bf622be1c4a1]*/
  143. +_ssl__SSLSocket_read_impl(PySSLSocket *self, int len, int group_right_1,
  144. +                          Py_buffer *buffer)
  145. +/*[clinic end generated code: output=00097776cec2a0af input=ff157eb918d0905b]*/
  146.  {
  147.      PyObject *dest = NULL;
  148.      char *mem;
  149. -    size_t count = 0;
  150. -    int retval;
  151. +    int count;
  152.      int sockstate;
  153.      _PySSLError err;
  154.      int nonblocking;
  155. @@ -2498,8 +2506,8 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
  156.  
  157.      do {
  158.          PySSL_BEGIN_ALLOW_THREADS
  159. -        retval = SSL_read_ex(self->ssl, mem, (size_t)len, &count);
  160. -        err = _PySSL_errno(retval == 0, self->ssl, retval);
  161. +        count = SSL_read(self->ssl, mem, len);
  162. +        err = _PySSL_errno(count <= 0, self->ssl, count);
  163.          PySSL_END_ALLOW_THREADS
  164.          self->err = err;
  165.  
  166. @@ -2532,8 +2540,8 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
  167.      } while (err.ssl == SSL_ERROR_WANT_READ ||
  168.               err.ssl == SSL_ERROR_WANT_WRITE);
  169.  
  170. -    if (retval == 0) {
  171. -        PySSL_SetError(self, retval, __FILE__, __LINE__);
  172. +    if (count <= 0) {
  173. +        PySSL_SetError(self, count, __FILE__, __LINE__);
  174.          goto error;
  175.      }
  176.      if (self->exc_type != NULL)
  177. @@ -2546,7 +2554,7 @@ _ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
  178.          return dest;
  179.      }
  180.      else {
  181. -        return PyLong_FromSize_t(count);
  182. +        return PyLong_FromLong(count);
  183.      }
  184.  
  185.  error:
  186. @@ -3062,8 +3070,10 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version)
  187.      self->hostflags = X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS;
  188.      self->protocol = proto_version;
  189.      self->msg_cb = NULL;
  190. +#ifndef LIBRESSL_VERSION_NUMBER
  191.      self->keylog_filename = NULL;
  192.      self->keylog_bio = NULL;
  193. +#endif
  194.      self->alpn_protocols = NULL;
  195.      self->set_sni_cb = NULL;
  196.      self->state = get_ssl_state(module);
  197. @@ -3187,6 +3197,7 @@ context_clear(PySSLContext *self)
  198.  {
  199.      Py_CLEAR(self->set_sni_cb);
  200.      Py_CLEAR(self->msg_cb);
  201. +#ifndef LIBRESSL_VERSION_NUMBER
  202.      Py_CLEAR(self->keylog_filename);
  203.      if (self->keylog_bio != NULL) {
  204.          PySSL_BEGIN_ALLOW_THREADS
  205. @@ -3194,6 +3205,7 @@ context_clear(PySSLContext *self)
  206.          PySSL_END_ALLOW_THREADS
  207.          self->keylog_bio = NULL;
  208.      }
  209. +#endif
  210.      return 0;
  211.  }
  212.  
  213. @@ -3535,7 +3547,7 @@ set_maximum_version(PySSLContext *self, PyObject *arg, void *c)
  214.      return set_min_max_proto_version(self, arg, 1);
  215.  }
  216.  
  217. -#ifdef TLS1_3_VERSION
  218. +#if defined(TLS1_3_VERSION) && !defined(LIBRESSL_VERSION_NUMBER)
  219.  static PyObject *
  220.  get_num_tickets(PySSLContext *self, void *c)
  221.  {
  222. @@ -3568,12 +3580,14 @@ PyDoc_STRVAR(PySSLContext_num_tickets_doc,
  223.  "Control the number of TLSv1.3 session tickets");
  224.  #endif /* TLS1_3_VERSION */
  225.  
  226. +#ifndef LIBRESSL_VERSION_NUMBER
  227.  static PyObject *
  228.  get_security_level(PySSLContext *self, void *c)
  229.  {
  230.      return PyLong_FromLong(SSL_CTX_get_security_level(self->ctx));
  231.  }
  232.  PyDoc_STRVAR(PySSLContext_security_level_doc, "The current security level");
  233. +#endif
  234.  
  235.  static PyObject *
  236.  get_options(PySSLContext *self, void *c)
  237. @@ -4603,13 +4617,15 @@ static PyGetSetDef context_getsetlist[] = {
  238.                          (setter) set_minimum_version, NULL},
  239.      {"maximum_version", (getter) get_maximum_version,
  240.                          (setter) set_maximum_version, NULL},
  241. +#ifndef LIBRESSL_VERSION_NUMBER
  242.      {"keylog_filename", (getter) _PySSLContext_get_keylog_filename,
  243.                          (setter) _PySSLContext_set_keylog_filename, NULL},
  244. +#endif
  245.      {"_msg_callback", (getter) _PySSLContext_get_msg_callback,
  246.                        (setter) _PySSLContext_set_msg_callback, NULL},
  247.      {"sni_callback", (getter) get_sni_callback,
  248.                       (setter) set_sni_callback, PySSLContext_sni_callback_doc},
  249. -#ifdef TLS1_3_VERSION
  250. +#if defined(TLS1_3_VERSION) && !defined(LIBRESSL_VERSION_NUMBER)
  251.      {"num_tickets", (getter) get_num_tickets,
  252.                      (setter) set_num_tickets, PySSLContext_num_tickets_doc},
  253.  #endif
  254. @@ -4628,8 +4644,10 @@ static PyGetSetDef context_getsetlist[] = {
  255.                       (setter) set_verify_flags, NULL},
  256.      {"verify_mode", (getter) get_verify_mode,
  257.                      (setter) set_verify_mode, NULL},
  258. +#ifndef LIBRESSL_VERSION_NUMBER
  259.      {"security_level", (getter) get_security_level,
  260.                         NULL, PySSLContext_security_level_doc},
  261. +#endif
  262.      {NULL},            /* sentinel */
  263.  };
  264.  
  265. diff --git a/Modules/_ssl/debughelpers.c b/Modules/_ssl/debughelpers.c
  266. index 03c125eb44..d992c5bc02 100644
  267. --- a/Modules/_ssl/debughelpers.c
  268. +++ b/Modules/_ssl/debughelpers.c
  269. @@ -114,6 +114,8 @@ _PySSLContext_set_msg_callback(PySSLContext *self, PyObject *arg, void *c) {
  270.      return 0;
  271.  }
  272.  
  273. +#ifndef LIBRESSL_VERSION_NUMBER
  274. +
  275.  static void
  276.  _PySSL_keylog_callback(const SSL *ssl, const char *line)
  277.  {
  278. @@ -217,3 +219,5 @@ _PySSLContext_set_keylog_filename(PySSLContext *self, PyObject *arg, void *c) {
  279.      SSL_CTX_set_keylog_callback(self->ctx, _PySSL_keylog_callback);
  280.      return 0;
  281.  }
  282. +
  283. +#endif
  284. diff --git a/Modules/clinic/_hashopenssl.c.h b/Modules/clinic/_hashopenssl.c.h
  285. index de01489e6a..c686eddea8 100644
  286. --- a/Modules/clinic/_hashopenssl.c.h
  287. +++ b/Modules/clinic/_hashopenssl.c.h
  288. @@ -1275,6 +1275,8 @@ _hashlib_HMAC_hexdigest(HMACobject *self, PyObject *Py_UNUSED(ignored))
  289.      return _hashlib_HMAC_hexdigest_impl(self);
  290.  }
  291.  
  292. +#if !defined(LIBRESSL_VERSION_NUMBER)
  293. +
  294.  PyDoc_STRVAR(_hashlib_get_fips_mode__doc__,
  295.  "get_fips_mode($module, /)\n"
  296.  "--\n"
  297. @@ -1310,6 +1312,8 @@ _hashlib_get_fips_mode(PyObject *module, PyObject *Py_UNUSED(ignored))
  298.      return return_value;
  299.  }
  300.  
  301. +#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
  302. +
  303.  PyDoc_STRVAR(_hashlib_compare_digest__doc__,
  304.  "compare_digest($module, a, b, /)\n"
  305.  "--\n"
  306. @@ -1385,4 +1389,8 @@ _hashlib_compare_digest(PyObject *module, PyObject *const *args, Py_ssize_t narg
  307.  #ifndef _HASHLIB_SCRYPT_METHODDEF
  308.      #define _HASHLIB_SCRYPT_METHODDEF
  309.  #endif /* !defined(_HASHLIB_SCRYPT_METHODDEF) */
  310. -/*[clinic end generated code: output=162369cb9d43f1cc input=a9049054013a1b77]*/
  311. +
  312. +#ifndef _HASHLIB_GET_FIPS_MODE_METHODDEF
  313. +    #define _HASHLIB_GET_FIPS_MODE_METHODDEF
  314. +#endif /* !defined(_HASHLIB_GET_FIPS_MODE_METHODDEF) */
  315. +/*[clinic end generated code: output=a110f274fb33395d input=a9049054013a1b77]*/
  316. diff --git a/Modules/clinic/_ssl.c.h b/Modules/clinic/_ssl.c.h
  317. index b59b129af8..f6bcd09e03 100644
  318. --- a/Modules/clinic/_ssl.c.h
  319. +++ b/Modules/clinic/_ssl.c.h
  320. @@ -88,6 +88,8 @@ _ssl__SSLSocket_getpeercert(PySSLSocket *self, PyObject *const *args, Py_ssize_t
  321.      return return_value;
  322.  }
  323.  
  324. +#if !defined(LIBRESSL_VERSION_NUMBER)
  325. +
  326.  PyDoc_STRVAR(_ssl__SSLSocket_get_verified_chain__doc__,
  327.  "get_verified_chain($self, /)\n"
  328.  "--\n"
  329. @@ -105,6 +107,10 @@ _ssl__SSLSocket_get_verified_chain(PySSLSocket *self, PyObject *Py_UNUSED(ignore
  330.      return _ssl__SSLSocket_get_verified_chain_impl(self);
  331.  }
  332.  
  333. +#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
  334. +
  335. +#if !defined(LIBRESSL_VERSION_NUMBER)
  336. +
  337.  PyDoc_STRVAR(_ssl__SSLSocket_get_unverified_chain__doc__,
  338.  "get_unverified_chain($self, /)\n"
  339.  "--\n"
  340. @@ -122,6 +128,8 @@ _ssl__SSLSocket_get_unverified_chain(PySSLSocket *self, PyObject *Py_UNUSED(igno
  341.      return _ssl__SSLSocket_get_unverified_chain_impl(self);
  342.  }
  343.  
  344. +#endif /* !defined(LIBRESSL_VERSION_NUMBER) */
  345. +
  346.  PyDoc_STRVAR(_ssl__SSLSocket_shared_ciphers__doc__,
  347.  "shared_ciphers($self, /)\n"
  348.  "--\n"
  349. @@ -271,25 +279,25 @@ PyDoc_STRVAR(_ssl__SSLSocket_read__doc__,
  350.      {"read", (PyCFunction)_ssl__SSLSocket_read, METH_VARARGS, _ssl__SSLSocket_read__doc__},
  351.  
  352.  static PyObject *
  353. -_ssl__SSLSocket_read_impl(PySSLSocket *self, Py_ssize_t len,
  354. -                          int group_right_1, Py_buffer *buffer);
  355. +_ssl__SSLSocket_read_impl(PySSLSocket *self, int len, int group_right_1,
  356. +                          Py_buffer *buffer);
  357.  
  358.  static PyObject *
  359.  _ssl__SSLSocket_read(PySSLSocket *self, PyObject *args)
  360.  {
  361.      PyObject *return_value = NULL;
  362. -    Py_ssize_t len;
  363. +    int len;
  364.      int group_right_1 = 0;
  365.      Py_buffer buffer = {NULL, NULL};
  366.  
  367.      switch (PyTuple_GET_SIZE(args)) {
  368.          case 1:
  369. -            if (!PyArg_ParseTuple(args, "n:read", &len)) {
  370. +            if (!PyArg_ParseTuple(args, "i:read", &len)) {
  371.                  goto exit;
  372.              }
  373.              break;
  374.          case 2:
  375. -            if (!PyArg_ParseTuple(args, "nw*:read", &len, &buffer)) {
  376. +            if (!PyArg_ParseTuple(args, "iw*:read", &len, &buffer)) {
  377.                  goto exit;
  378.              }
  379.              group_right_1 = 1;
  380. @@ -1351,6 +1359,14 @@ _ssl_enum_crls(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyObje
  381.  
  382.  #endif /* defined(_MSC_VER) */
  383.  
  384. +#ifndef _SSL__SSLSOCKET_GET_VERIFIED_CHAIN_METHODDEF
  385. +    #define _SSL__SSLSOCKET_GET_VERIFIED_CHAIN_METHODDEF
  386. +#endif /* !defined(_SSL__SSLSOCKET_GET_VERIFIED_CHAIN_METHODDEF) */
  387. +
  388. +#ifndef _SSL__SSLSOCKET_GET_UNVERIFIED_CHAIN_METHODDEF
  389. +    #define _SSL__SSLSOCKET_GET_UNVERIFIED_CHAIN_METHODDEF
  390. +#endif /* !defined(_SSL__SSLSOCKET_GET_UNVERIFIED_CHAIN_METHODDEF) */
  391. +
  392.  #ifndef _SSL_ENUM_CERTIFICATES_METHODDEF
  393.      #define _SSL_ENUM_CERTIFICATES_METHODDEF
  394.  #endif /* !defined(_SSL_ENUM_CERTIFICATES_METHODDEF) */
  395. @@ -1358,4 +1374,4 @@ _ssl_enum_crls(PyObject *module, PyObject *const *args, Py_ssize_t nargs, PyObje
  396.  #ifndef _SSL_ENUM_CRLS_METHODDEF
  397.      #define _SSL_ENUM_CRLS_METHODDEF
  398.  #endif /* !defined(_SSL_ENUM_CRLS_METHODDEF) */
  399. -/*[clinic end generated code: output=5a7d7bf5cf8ee092 input=a9049054013a1b77]*/
  400. +/*[clinic end generated code: output=0e12e5e4ee2221b5 input=a9049054013a1b77]*/
  401. -- 
  402. 2.32.0