Attachment #194703 for bug #229386

Lines 1-4 Link Here

(-)Makefile.version (-1 / +1 lines)
1	# Mk/Uses/python.mk includes this file, don't remove it!	1	# Mk/Uses/python.mk includes this file, don't remove it!
2	# $FreeBSD$	2	# $FreeBSD$
3		3
4	PYTHON_PORTVERSION= 3.6.5	4	PYTHON_PORTVERSION= 3.6.6

Lines 1-3 Link Here

(-)distinfo (-3 / +3 lines)
1	TIMESTAMP = 1522342511	1	TIMESTAMP = 1530180972
2	SHA256 (python/Python-3.6.5.tar.xz) = f434053ba1b5c8a5cc597e966ead3c5143012af827fd3f0697d21450bb8d87a6	2	SHA256 (python/Python-3.6.6.tar.xz) = d79bc15d456e73a3173a2938f18a17e5149c850ebdedf84a78067f501ee6e16f
3	SIZE (python/Python-3.6.5.tar.xz) = 17049912	3	SIZE (python/Python-3.6.6.tar.xz) = 17156744




From f5befbb0d1526f18eb2b24eabb48c3b761c624a2 Mon Sep 17 00:00:00 2001
From: Christian Heimes <christian@python.org>
Date: Sat, 24 Mar 2018 18:38:14 +0100
Subject: [PATCH] [3.6] bpo-33127: Compatibility patch for LibreSSL 2.7.0
 (GH-6210) (GH-6214)

LibreSSL 2.7 introduced OpenSSL 1.1.0 API. The ssl module now detects
LibreSSL 2.7 and only provides API shims for OpenSSL < 1.1.0 and
LibreSSL < 2.7.

Documentation updates and fixes for failing tests will be provided in
another patch set.

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 4ca0739c9d97ac7cd45499e0d31be68dc659d0e1)

Co-authored-by: Christian Heimes <christian@python.org>
---
 Lib/test/test_ssl.py                               |  1 +
 .../2018-03-24-15-08-24.bpo-33127.olJmHv.rst       |  1 +
 Modules/_ssl.c                                     | 24 ++++++++++++++--------
 Tools/ssl/multissltests.py                         |  3 ++-
 4 files changed, 20 insertions(+), 9 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 8dd3b4145078..9785a59a7e49 100644
--- Lib/test/test_ssl.py.orig
+++ Lib/test/test_ssl.py
@@ -1687,6 +1687,7 @@ def test_get_ca_certs_capath(self):
         self.assertEqual(len(ctx.get_ca_certs()), 1)
 
     @needs_sni
+    @unittest.skipUnless(hasattr(ssl, "PROTOCOL_TLSv1_2"), "needs TLS 1.2")
     def test_context_setget(self):
         # Check that the context of a connected socket can be replaced.
         ctx1 = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
diff --git a/Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst b/Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst
new file mode 100644
index 000000000000..635aabbde031
--- /dev/null
+++ Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst
@@ -0,0 +1 @@
+The ssl module now compiles with LibreSSL 2.7.1.
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index c54e43c2b48a..5e007da858bd 100644
--- Modules/_ssl.c.orig
+++ Modules/_ssl.c
@@ -106,6 +106,12 @@ struct py_ssl_library_code {
 
 #if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
 #  define OPENSSL_VERSION_1_1 1
+#  define PY_OPENSSL_1_1_API 1
+#endif
+
+/* LibreSSL 2.7.0 provides necessary OpenSSL 1.1.0 APIs */
+#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER >= 0x2070000fL
+#  define PY_OPENSSL_1_1_API 1
 #endif
 
 /* Openssl comes with TLSv1.1 and TLSv1.2 between 1.0.0h and 1.0.1
@@ -152,16 +158,18 @@ struct py_ssl_library_code {
 #define INVALID_SOCKET (-1)
 #endif
 
-#ifdef OPENSSL_VERSION_1_1
-/* OpenSSL 1.1.0+ */
-#ifndef OPENSSL_NO_SSL2
-#define OPENSSL_NO_SSL2
-#endif
-#else /* OpenSSL < 1.1.0 */
-#if defined(WITH_THREAD)
+/* OpenSSL 1.0.2 and LibreSSL needs extra code for locking */
+#if !defined(OPENSSL_VERSION_1_1) && defined(WITH_THREAD)
 #define HAVE_OPENSSL_CRYPTO_LOCK
 #endif
 
+#if defined(OPENSSL_VERSION_1_1) && !defined(OPENSSL_NO_SSL2)
+#define OPENSSL_NO_SSL2
+#endif
+
+#ifndef PY_OPENSSL_1_1_API
+/* OpenSSL 1.1 API shims for OpenSSL < 1.1.0 and LibreSSL < 2.7.0 */
+
 #define TLS_method SSLv23_method
 #define TLS_client_method SSLv23_client_method
 #define TLS_server_method SSLv23_server_method
@@ -227,7 +235,7 @@ SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *s)
     return s->tlsext_tick_lifetime_hint;
 }
 
-#endif /* OpenSSL < 1.1.0 or LibreSSL */
+#endif /* OpenSSL < 1.1.0 or LibreSSL < 2.7.0 */
 
 
 enum py_ssl_error {
diff --git a/Tools/ssl/multissltests.py b/Tools/ssl/multissltests.py
index ce5bbd85308c..ba4529ae0611 100755
--- Tools/ssl/multissltests.py.orig
+++ Tools/ssl/multissltests.py
@@ -57,8 +57,9 @@
 ]
 
 LIBRESSL_RECENT_VERSIONS = [
-    "2.5.3",
     "2.5.5",
+    "2.6.4",
+    "2.7.1",
 ]
 
 # store files in ../multissl


Return to bug 229386

Lines 1-112 Link Here

(-)files/patch-issue33127 (-112 lines)
1	From f5befbb0d1526f18eb2b24eabb48c3b761c624a2 Mon Sep 17 00:00:00 2001
2	From: Christian Heimes <christian@python.org>
3	Date: Sat, 24 Mar 2018 18:38:14 +0100
4	Subject: [PATCH] [3.6] bpo-33127: Compatibility patch for LibreSSL 2.7.0
5	(GH-6210) (GH-6214)
6
7	LibreSSL 2.7 introduced OpenSSL 1.1.0 API. The ssl module now detects
8	LibreSSL 2.7 and only provides API shims for OpenSSL < 1.1.0 and
9	LibreSSL < 2.7.
10
11	Documentation updates and fixes for failing tests will be provided in
12	another patch set.
13
14	Signed-off-by: Christian Heimes <christian@python.org>.
15	(cherry picked from commit 4ca0739c9d97ac7cd45499e0d31be68dc659d0e1)
16
17	Co-authored-by: Christian Heimes <christian@python.org>
18	---
19	Lib/test/test_ssl.py \| 1 +
20	.../2018-03-24-15-08-24.bpo-33127.olJmHv.rst \| 1 +
21	Modules/_ssl.c \| 24 ++++++++++++++--------
22	Tools/ssl/multissltests.py \| 3 ++-
23	4 files changed, 20 insertions(+), 9 deletions(-)
24	create mode 100644 Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst
25
26	diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
27	index 8dd3b4145078..9785a59a7e49 100644
28	--- Lib/test/test_ssl.py.orig
29	+++ Lib/test/test_ssl.py
30	@@ -1687,6 +1687,7 @@ def test_get_ca_certs_capath(self):
31	self.assertEqual(len(ctx.get_ca_certs()), 1)
32
33	@needs_sni
34	+ @unittest.skipUnless(hasattr(ssl, "PROTOCOL_TLSv1_2"), "needs TLS 1.2")
35	def test_context_setget(self):
36	# Check that the context of a connected socket can be replaced.
37	ctx1 = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
38	diff --git a/Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst b/Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst
39	new file mode 100644
40	index 000000000000..635aabbde031
41	--- /dev/null
42	+++ Misc/NEWS.d/next/Library/2018-03-24-15-08-24.bpo-33127.olJmHv.rst
43	@@ -0,0 +1 @@
44	+The ssl module now compiles with LibreSSL 2.7.1.
45	diff --git a/Modules/_ssl.c b/Modules/_ssl.c
46	index c54e43c2b48a..5e007da858bd 100644
47	--- Modules/_ssl.c.orig
48	+++ Modules/_ssl.c
49	@@ -106,6 +106,12 @@ struct py_ssl_library_code {
50
51	#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && !defined(LIBRESSL_VERSION_NUMBER)
52	# define OPENSSL_VERSION_1_1 1
53	+# define PY_OPENSSL_1_1_API 1
54	+#endif
55	+
56	+/* LibreSSL 2.7.0 provides necessary OpenSSL 1.1.0 APIs */
57	+#if defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER >= 0x2070000fL
58	+# define PY_OPENSSL_1_1_API 1
59	#endif
60
61	/* Openssl comes with TLSv1.1 and TLSv1.2 between 1.0.0h and 1.0.1
62	@@ -152,16 +158,18 @@ struct py_ssl_library_code {
63	#define INVALID_SOCKET (-1)
64	#endif
65
66	-#ifdef OPENSSL_VERSION_1_1
67	-/* OpenSSL 1.1.0+ */
68	-#ifndef OPENSSL_NO_SSL2
69	-#define OPENSSL_NO_SSL2
70	-#endif
71	-#else /* OpenSSL < 1.1.0 */
72	-#if defined(WITH_THREAD)
73	+/* OpenSSL 1.0.2 and LibreSSL needs extra code for locking */
74	+#if !defined(OPENSSL_VERSION_1_1) && defined(WITH_THREAD)
75	#define HAVE_OPENSSL_CRYPTO_LOCK
76	#endif
77
78	+#if defined(OPENSSL_VERSION_1_1) && !defined(OPENSSL_NO_SSL2)
79	+#define OPENSSL_NO_SSL2
80	+#endif
81	+
82	+#ifndef PY_OPENSSL_1_1_API
83	+/* OpenSSL 1.1 API shims for OpenSSL < 1.1.0 and LibreSSL < 2.7.0 */
84	+
85	#define TLS_method SSLv23_method
86	#define TLS_client_method SSLv23_client_method
87	#define TLS_server_method SSLv23_server_method
88	@@ -227,7 +235,7 @@ SSL_SESSION_get_ticket_lifetime_hint(const SSL_SESSION *s)
89	return s->tlsext_tick_lifetime_hint;
90	}
91
92	-#endif /* OpenSSL < 1.1.0 or LibreSSL */
93	+#endif /* OpenSSL < 1.1.0 or LibreSSL < 2.7.0 */
94
95
96	enum py_ssl_error {
97	diff --git a/Tools/ssl/multissltests.py b/Tools/ssl/multissltests.py
98	index ce5bbd85308c..ba4529ae0611 100755
99	--- Tools/ssl/multissltests.py.orig
100	+++ Tools/ssl/multissltests.py
101	@@ -57,8 +57,9 @@
102	]
103
104	LIBRESSL_RECENT_VERSIONS = [
105	- "2.5.3",
106	"2.5.5",
107	+ "2.6.4",
108	+ "2.7.1",
109	]
110
111	# store files in ../multissl
112

Lines 2112-2118 Link Here

(-)pkg-plist (-3 / +15 lines)
2112	lib/python%%XYDOT%%/ensurepip/__pycache__/_uninstall.cpython-%%XY%%.opt-1.pyc	2112	lib/python%%XYDOT%%/ensurepip/__pycache__/_uninstall.cpython-%%XY%%.opt-1.pyc
2113	lib/python%%XYDOT%%/ensurepip/__pycache__/_uninstall.cpython-%%XY%%.opt-2.pyc	2113	lib/python%%XYDOT%%/ensurepip/__pycache__/_uninstall.cpython-%%XY%%.opt-2.pyc
2114	lib/python%%XYDOT%%/ensurepip/__pycache__/_uninstall.cpython-%%XY%%.pyc	2114	lib/python%%XYDOT%%/ensurepip/__pycache__/_uninstall.cpython-%%XY%%.pyc
2115	lib/python%%XYDOT%%/ensurepip/_bundled/pip-9.0.3-py2.py3-none-any.whl	2115	lib/python%%XYDOT%%/ensurepip/_bundled/pip-10.0.1-py2.py3-none-any.whl
2116	lib/python%%XYDOT%%/ensurepip/_bundled/setuptools-39.0.1-py2.py3-none-any.whl	2116	lib/python%%XYDOT%%/ensurepip/_bundled/setuptools-39.0.1-py2.py3-none-any.whl
2117	lib/python%%XYDOT%%/ensurepip/_uninstall.py	2117	lib/python%%XYDOT%%/ensurepip/_uninstall.py
2118	lib/python%%XYDOT%%/enum.py	2118	lib/python%%XYDOT%%/enum.py
Lines 2424-2429 Link Here
2424	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_calltips.cpython-%%XY%%.opt-1.pyc	2424	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_calltips.cpython-%%XY%%.opt-1.pyc
2425	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_calltips.cpython-%%XY%%.opt-2.pyc	2425	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_calltips.cpython-%%XY%%.opt-2.pyc
2426	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_calltips.cpython-%%XY%%.pyc	2426	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_calltips.cpython-%%XY%%.pyc
		2427	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_codecontext.cpython-36.opt-1.pyc
		2428	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_codecontext.cpython-36.opt-2.pyc
		2429	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_codecontext.cpython-36.pyc
2427	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_colorizer.cpython-%%XY%%.opt-1.pyc	2430	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_colorizer.cpython-%%XY%%.opt-1.pyc
2428	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_colorizer.cpython-%%XY%%.opt-2.pyc	2431	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_colorizer.cpython-%%XY%%.opt-2.pyc
2429	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_colorizer.cpython-%%XY%%.pyc	2432	lib/python%%XYDOT%%/idlelib/idle_test/__pycache__/test_colorizer.cpython-%%XY%%.pyc
Lines 2536-2541 Link Here
2536	lib/python%%XYDOT%%/idlelib/idle_test/test_autoexpand.py	2539	lib/python%%XYDOT%%/idlelib/idle_test/test_autoexpand.py
2537	lib/python%%XYDOT%%/idlelib/idle_test/test_browser.py	2540	lib/python%%XYDOT%%/idlelib/idle_test/test_browser.py
2538	lib/python%%XYDOT%%/idlelib/idle_test/test_calltips.py	2541	lib/python%%XYDOT%%/idlelib/idle_test/test_calltips.py
		2542	lib/python%%XYDOT%%/idlelib/idle_test/test_codecontext.py
2539	lib/python%%XYDOT%%/idlelib/idle_test/test_colorizer.py	2543	lib/python%%XYDOT%%/idlelib/idle_test/test_colorizer.py
2540	lib/python%%XYDOT%%/idlelib/idle_test/test_config.py	2544	lib/python%%XYDOT%%/idlelib/idle_test/test_config.py
2541	lib/python%%XYDOT%%/idlelib/idle_test/test_config_key.py	2545	lib/python%%XYDOT%%/idlelib/idle_test/test_config_key.py
Lines 2716-2725 Link Here
2716	lib/python%%XYDOT%%/lib-dynload/unicodedata.so	2720	lib/python%%XYDOT%%/lib-dynload/unicodedata.so
2717	%%NO_DEBUG%%lib/python%%XYDOT%%/lib-dynload/xxlimited.so	2721	%%NO_DEBUG%%lib/python%%XYDOT%%/lib-dynload/xxlimited.so
2718	lib/python%%XYDOT%%/lib-dynload/zlib.so	2722	lib/python%%XYDOT%%/lib-dynload/zlib.so
		2723	lib/python%%XYDOT%%/lib2to3/Grammar%%XYZDOT%%.final.0.pickle
2719	lib/python%%XYDOT%%/lib2to3/Grammar.txt	2724	lib/python%%XYDOT%%/lib2to3/Grammar.txt
2720	lib/python%%XYDOT%%/lib2to3/Grammar%%XYZDOT%%.final.0.pickle	2725	lib/python%%XYDOT%%/lib2to3/PatternGrammar%%XYZDOT%%.final.0.pickle
2721	lib/python%%XYDOT%%/lib2to3/PatternGrammar.txt	2726	lib/python%%XYDOT%%/lib2to3/PatternGrammar.txt
2722	lib/python%%XYDOT%%/lib2to3/PatternGrammar%%XYZDOT%%.final.0.pickle
2723	lib/python%%XYDOT%%/lib2to3/__init__.py	2727	lib/python%%XYDOT%%/lib2to3/__init__.py
2724	lib/python%%XYDOT%%/lib2to3/__main__.py	2728	lib/python%%XYDOT%%/lib2to3/__main__.py
2725	lib/python%%XYDOT%%/lib2to3/__pycache__/__init__.cpython-%%XY%%.opt-1.pyc	2729	lib/python%%XYDOT%%/lib2to3/__pycache__/__init__.cpython-%%XY%%.opt-1.pyc
Lines 3535-3540 Link Here
3535	lib/python%%XYDOT%%/test/__pycache__/test_baseexception.cpython-%%XY%%.opt-1.pyc	3539	lib/python%%XYDOT%%/test/__pycache__/test_baseexception.cpython-%%XY%%.opt-1.pyc
3536	lib/python%%XYDOT%%/test/__pycache__/test_baseexception.cpython-%%XY%%.opt-2.pyc	3540	lib/python%%XYDOT%%/test/__pycache__/test_baseexception.cpython-%%XY%%.opt-2.pyc
3537	lib/python%%XYDOT%%/test/__pycache__/test_baseexception.cpython-%%XY%%.pyc	3541	lib/python%%XYDOT%%/test/__pycache__/test_baseexception.cpython-%%XY%%.pyc
		3542	lib/python%%XYDOT%%/test/__pycache__/test_bdb.cpython-36.opt-1.pyc
		3543	lib/python%%XYDOT%%/test/__pycache__/test_bdb.cpython-36.opt-2.pyc
		3544	lib/python%%XYDOT%%/test/__pycache__/test_bdb.cpython-36.pyc
3538	lib/python%%XYDOT%%/test/__pycache__/test_bigaddrspace.cpython-%%XY%%.opt-1.pyc	3545	lib/python%%XYDOT%%/test/__pycache__/test_bigaddrspace.cpython-%%XY%%.opt-1.pyc
3539	lib/python%%XYDOT%%/test/__pycache__/test_bigaddrspace.cpython-%%XY%%.opt-2.pyc	3546	lib/python%%XYDOT%%/test/__pycache__/test_bigaddrspace.cpython-%%XY%%.opt-2.pyc
3540	lib/python%%XYDOT%%/test/__pycache__/test_bigaddrspace.cpython-%%XY%%.pyc	3547	lib/python%%XYDOT%%/test/__pycache__/test_bigaddrspace.cpython-%%XY%%.pyc
Lines 5021-5026 Link Here
5021	lib/python%%XYDOT%%/test/libregrtest/__pycache__/setup.cpython-%%XY%%.opt-1.pyc	5028	lib/python%%XYDOT%%/test/libregrtest/__pycache__/setup.cpython-%%XY%%.opt-1.pyc
5022	lib/python%%XYDOT%%/test/libregrtest/__pycache__/setup.cpython-%%XY%%.opt-2.pyc	5029	lib/python%%XYDOT%%/test/libregrtest/__pycache__/setup.cpython-%%XY%%.opt-2.pyc
5023	lib/python%%XYDOT%%/test/libregrtest/__pycache__/setup.cpython-%%XY%%.pyc	5030	lib/python%%XYDOT%%/test/libregrtest/__pycache__/setup.cpython-%%XY%%.pyc
		5031	lib/python%%XYDOT%%/test/libregrtest/__pycache__/utils.cpython-36.opt-1.pyc
		5032	lib/python%%XYDOT%%/test/libregrtest/__pycache__/utils.cpython-36.opt-2.pyc
		5033	lib/python%%XYDOT%%/test/libregrtest/__pycache__/utils.cpython-36.pyc
5024	lib/python%%XYDOT%%/test/libregrtest/cmdline.py	5034	lib/python%%XYDOT%%/test/libregrtest/cmdline.py
5025	lib/python%%XYDOT%%/test/libregrtest/main.py	5035	lib/python%%XYDOT%%/test/libregrtest/main.py
5026	lib/python%%XYDOT%%/test/libregrtest/refleak.py	5036	lib/python%%XYDOT%%/test/libregrtest/refleak.py
Lines 5028-5033 Link Here
5028	lib/python%%XYDOT%%/test/libregrtest/runtest_mp.py	5038	lib/python%%XYDOT%%/test/libregrtest/runtest_mp.py
5029	lib/python%%XYDOT%%/test/libregrtest/save_env.py	5039	lib/python%%XYDOT%%/test/libregrtest/save_env.py
5030	lib/python%%XYDOT%%/test/libregrtest/setup.py	5040	lib/python%%XYDOT%%/test/libregrtest/setup.py
		5041	lib/python%%XYDOT%%/test/libregrtest/utils.py
5031	lib/python%%XYDOT%%/test/list_tests.py	5042	lib/python%%XYDOT%%/test/list_tests.py
5032	lib/python%%XYDOT%%/test/lock_tests.py	5043	lib/python%%XYDOT%%/test/lock_tests.py
5033	lib/python%%XYDOT%%/test/mailcap.txt	5044	lib/python%%XYDOT%%/test/mailcap.txt
Lines 5222-5227 Link Here
5222	lib/python%%XYDOT%%/test/test_augassign.py	5233	lib/python%%XYDOT%%/test/test_augassign.py
5223	lib/python%%XYDOT%%/test/test_base64.py	5234	lib/python%%XYDOT%%/test/test_base64.py
5224	lib/python%%XYDOT%%/test/test_baseexception.py	5235	lib/python%%XYDOT%%/test/test_baseexception.py
		5236	lib/python%%XYDOT%%/test/test_bdb.py
5225	lib/python%%XYDOT%%/test/test_bigaddrspace.py	5237	lib/python%%XYDOT%%/test/test_bigaddrspace.py
5226	lib/python%%XYDOT%%/test/test_bigmem.py	5238	lib/python%%XYDOT%%/test/test_bigmem.py
5227	lib/python%%XYDOT%%/test/test_binascii.py	5239	lib/python%%XYDOT%%/test/test_binascii.py