|
| 1 | +From 732c7d512e7cdf656a3f02a38c329b14a14a8573 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Seth Michael Larson <seth@python.org> |
| 3 | +Date: Fri, 19 Apr 2024 11:21:40 -0700 |
| 4 | +Subject: [PATCH] [3.9] gh-114572: Fix locking in cert_store_stats and |
| 5 | + get_ca_certs |
| 6 | + |
| 7 | +--- |
| 8 | + ...-04-19-11-21-13.gh-issue-114572.t1QMQD.rst | 4 + |
| 9 | + Modules/_ssl.c | 91 ++++++++++++++++++- |
| 10 | + 2 files changed, 92 insertions(+), 3 deletions(-) |
| 11 | + create mode 100644 Misc/NEWS.d/next/Security/2024-04-19-11-21-13.gh-issue-114572.t1QMQD.rst |
| 12 | + |
| 13 | +diff --git a/Misc/NEWS.d/next/Security/2024-04-19-11-21-13.gh-issue-114572.t1QMQD.rst b/Misc/NEWS.d/next/Security/2024-04-19-11-21-13.gh-issue-114572.t1QMQD.rst |
| 14 | +new file mode 100644 |
| 15 | +index 00000000000000..b4f9fe64db0615 |
| 16 | +--- /dev/null |
| 17 | ++++ b/Misc/NEWS.d/next/Security/2024-04-19-11-21-13.gh-issue-114572.t1QMQD.rst |
| 18 | +@@ -0,0 +1,4 @@ |
| 19 | ++:meth:`ssl.SSLContext.cert_store_stats` and |
| 20 | ++:meth:`ssl.SSLContext.get_ca_certs` now correctly lock access to the |
| 21 | ++certificate store, when the :class:`ssl.SSLContext` is shared across |
| 22 | ++multiple threads. |
| 23 | +diff --git a/Modules/_ssl.c b/Modules/_ssl.c |
| 24 | +index 3f95d3e10374d8..5e0be34d6f3fe3 100644 |
| 25 | +--- a/Modules/_ssl.c |
| 26 | ++++ b/Modules/_ssl.c |
| 27 | +@@ -166,6 +166,10 @@ extern const SSL_METHOD *TLSv1_2_method(void); |
| 28 | + # define PY_OPENSSL_1_1_API 1 |
| 29 | + #endif |
| 30 | + |
| 31 | ++#if (OPENSSL_VERSION_NUMBER >= 0x30300000L) && !defined(LIBRESSL_VERSION_NUMBER) |
| 32 | ++# define OPENSSL_VERSION_3_3 1 |
| 33 | ++#endif |
| 34 | ++ |
| 35 | + /* SNI support (client- and server-side) appeared in OpenSSL 1.0.0 and 0.9.8f |
| 36 | + * This includes the SSL_set_SSL_CTX() function. |
| 37 | + */ |
| 38 | +@@ -210,6 +214,16 @@ extern const SSL_METHOD *TLSv1_2_method(void); |
| 39 | + #define HAVE_OPENSSL_CRYPTO_LOCK |
| 40 | + #endif |
| 41 | + |
| 42 | ++/* OpenSSL 1.1+ allows locking X509_STORE, 1.0.2 doesn't. */ |
| 43 | ++#ifdef OPENSSL_VERSION_1_1 |
| 44 | ++#define HAVE_OPENSSL_X509_STORE_LOCK |
| 45 | ++#endif |
| 46 | ++ |
| 47 | ++/* OpenSSL 3.3 added the X509_STORE_get1_objects API */ |
| 48 | ++#ifdef OPENSSL_VERSION_3_3 |
| 49 | ++#define HAVE_OPENSSL_X509_STORE_GET1_OBJECTS 1 |
| 50 | ++#endif |
| 51 | ++ |
| 52 | + #if defined(OPENSSL_VERSION_1_1) && !defined(OPENSSL_NO_SSL2) |
| 53 | + #define OPENSSL_NO_SSL2 |
| 54 | + #endif |
| 55 | +@@ -4675,6 +4689,54 @@ set_sni_callback(PySSLContext *self, PyObject *arg, void *c) |
| 56 | + #endif |
| 57 | + } |
| 58 | + |
| 59 | ++/* Shim of X509_STORE_get1_objects API from OpenSSL 3.3 |
| 60 | ++ * Only available with the X509_STORE_lock() API */ |
| 61 | ++#if defined(HAVE_OPENSSL_X509_STORE_LOCK) && !defined(OPENSSL_VERSION_3_3) |
| 62 | ++#define HAVE_OPENSSL_X509_STORE_GET1_OBJECTS 1 |
| 63 | ++ |
| 64 | ++static X509_OBJECT *x509_object_dup(const X509_OBJECT *obj) |
| 65 | ++{ |
| 66 | ++ int ok; |
| 67 | ++ X509_OBJECT *ret = X509_OBJECT_new(); |
| 68 | ++ if (ret == NULL) { |
| 69 | ++ return NULL; |
| 70 | ++ } |
| 71 | ++ switch (X509_OBJECT_get_type(obj)) { |
| 72 | ++ case X509_LU_X509: |
| 73 | ++ ok = X509_OBJECT_set1_X509(ret, X509_OBJECT_get0_X509(obj)); |
| 74 | ++ break; |
| 75 | ++ case X509_LU_CRL: |
| 76 | ++ /* X509_OBJECT_get0_X509_CRL was not const-correct prior to 3.0.*/ |
| 77 | ++ ok = X509_OBJECT_set1_X509_CRL( |
| 78 | ++ ret, X509_OBJECT_get0_X509_CRL((X509_OBJECT *)obj)); |
| 79 | ++ break; |
| 80 | ++ default: |
| 81 | ++ /* We cannot duplicate unrecognized types in a polyfill, but it is |
| 82 | ++ * safe to leave an empty object. The caller will ignore it. */ |
| 83 | ++ ok = 1; |
| 84 | ++ break; |
| 85 | ++ } |
| 86 | ++ if (!ok) { |
| 87 | ++ X509_OBJECT_free(ret); |
| 88 | ++ return NULL; |
| 89 | ++ } |
| 90 | ++ return ret; |
| 91 | ++} |
| 92 | ++ |
| 93 | ++static STACK_OF(X509_OBJECT) * |
| 94 | ++X509_STORE_get1_objects(X509_STORE *store) |
| 95 | ++{ |
| 96 | ++ STACK_OF(X509_OBJECT) *ret; |
| 97 | ++ if (!X509_STORE_lock(store)) { |
| 98 | ++ return NULL; |
| 99 | ++ } |
| 100 | ++ ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store), |
| 101 | ++ x509_object_dup, X509_OBJECT_free); |
| 102 | ++ X509_STORE_unlock(store); |
| 103 | ++ return ret; |
| 104 | ++} |
| 105 | ++#endif |
| 106 | ++ |
| 107 | + PyDoc_STRVAR(PySSLContext_sni_callback_doc, |
| 108 | + "Set a callback that will be called when a server name is provided by the SSL/TLS client in the SNI extension.\n\ |
| 109 | + \n\ |
| 110 | +@@ -4704,7 +4766,15 @@ _ssl__SSLContext_cert_store_stats_impl(PySSLContext *self) |
| 111 | + int x509 = 0, crl = 0, ca = 0, i; |
| 112 | + |
| 113 | + store = SSL_CTX_get_cert_store(self->ctx); |
| 114 | ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS |
| 115 | ++ objs = X509_STORE_get1_objects(store); |
| 116 | ++ if (objs == NULL) { |
| 117 | ++ PyErr_SetString(PyExc_MemoryError, "failed to query cert store"); |
| 118 | ++ return NULL; |
| 119 | ++ } |
| 120 | ++#else |
| 121 | + objs = X509_STORE_get0_objects(store); |
| 122 | ++#endif |
| 123 | + for (i = 0; i < sk_X509_OBJECT_num(objs); i++) { |
| 124 | + obj = sk_X509_OBJECT_value(objs, i); |
| 125 | + switch (X509_OBJECT_get_type(obj)) { |
| 126 | +@@ -4718,12 +4788,13 @@ _ssl__SSLContext_cert_store_stats_impl(PySSLContext *self) |
| 127 | + crl++; |
| 128 | + break; |
| 129 | + default: |
| 130 | +- /* Ignore X509_LU_FAIL, X509_LU_RETRY, X509_LU_PKEY. |
| 131 | +- * As far as I can tell they are internal states and never |
| 132 | +- * stored in a cert store */ |
| 133 | ++ /* Ignore unrecognized types. */ |
| 134 | + break; |
| 135 | + } |
| 136 | + } |
| 137 | ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS |
| 138 | ++ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free); |
| 139 | ++#endif |
| 140 | + return Py_BuildValue("{sisisi}", "x509", x509, "crl", crl, |
| 141 | + "x509_ca", ca); |
| 142 | + } |
| 143 | +@@ -4755,7 +4826,15 @@ _ssl__SSLContext_get_ca_certs_impl(PySSLContext *self, int binary_form) |
| 144 | + } |
| 145 | + |
| 146 | + store = SSL_CTX_get_cert_store(self->ctx); |
| 147 | ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS |
| 148 | ++ objs = X509_STORE_get1_objects(store); |
| 149 | ++ if (objs == NULL) { |
| 150 | ++ PyErr_SetString(PyExc_MemoryError, "failed to query cert store"); |
| 151 | ++ return NULL; |
| 152 | ++ } |
| 153 | ++#else |
| 154 | + objs = X509_STORE_get0_objects(store); |
| 155 | ++#endif |
| 156 | + for (i = 0; i < sk_X509_OBJECT_num(objs); i++) { |
| 157 | + X509_OBJECT *obj; |
| 158 | + X509 *cert; |
| 159 | +@@ -4783,9 +4862,15 @@ _ssl__SSLContext_get_ca_certs_impl(PySSLContext *self, int binary_form) |
| 160 | + } |
| 161 | + Py_CLEAR(ci); |
| 162 | + } |
| 163 | ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS |
| 164 | ++ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free); |
| 165 | ++#endif |
| 166 | + return rlist; |
| 167 | + |
| 168 | + error: |
| 169 | ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS |
| 170 | ++ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free); |
| 171 | ++#endif |
| 172 | + Py_XDECREF(ci); |
| 173 | + Py_XDECREF(rlist); |
| 174 | + return NULL; |
0 commit comments