Skip to content

Commit e15de14

Browse files
gpsheadned-deily
gpshead
and
ned-deily
authoredJun 5, 2023
[3.9] pythongh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (pythonGH-105174) (pythonGH-105200) (python#105205)
Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) Co-authored-by: Ned Deily <nad@python.org>
·
v3.9.21v3.9.17
1 parent c9bf00b commit e15de14

File tree

12 files changed

+186
-18
lines changed

12 files changed

+186
-18
lines changed
 

‎.azure-pipelines/ci.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
variables:
5858
testRunTitle: '$(build.sourceBranchName)-linux'
5959
testRunPlatform: linux
60-
openssl_version: 1.1.1t
60+
openssl_version: 1.1.1u
6161

6262
steps:
6363
- template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
8383
variables:
8484
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
8585
testRunPlatform: linux-coverage
86-
openssl_version: 1.1.1t
86+
openssl_version: 1.1.1u
8787

8888
steps:
8989
- template: ./posix-steps.yml

‎.azure-pipelines/pr.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
variables:
5858
testRunTitle: '$(system.pullRequest.TargetBranch)-linux'
5959
testRunPlatform: linux
60-
openssl_version: 1.1.1t
60+
openssl_version: 1.1.1u
6161

6262
steps:
6363
- template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
8383
variables:
8484
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
8585
testRunPlatform: linux-coverage
86-
openssl_version: 1.1.1t
86+
openssl_version: 1.1.1u
8787

8888
steps:
8989
- template: ./posix-steps.yml

‎.github/workflows/build.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ jobs:
177177
needs: check_source
178178
if: needs.check_source.outputs.run_tests == 'true'
179179
env:
180-
OPENSSL_VER: 1.1.1t
180+
OPENSSL_VER: 1.1.1u
181181
PYTHONSTRICTEXTENSIONBUILD: 1
182182
steps:
183183
- uses: actions/checkout@v3
@@ -219,7 +219,7 @@ jobs:
219219
strategy:
220220
fail-fast: false
221221
matrix:
222-
openssl_ver: [1.0.2u, 1.1.0l, 1.1.1t, 3.0.8, 3.1.0-beta1]
222+
openssl_ver: [1.0.2u, 1.1.0l, 1.1.1u, 3.0.9, 3.1.1]
223223
env:
224224
OPENSSL_VER: ${{ matrix.openssl_ver }}
225225
MULTISSL_DIR: ${{ github.workspace }}/multissl

‎Mac/BuildScript/build-installer.py

+3-3
Original file line numberDiff line numberDiff line change
@@ -244,9 +244,9 @@ def library_recipes():
244244

245245
result.extend([
246246
dict(
247-
name="OpenSSL 1.1.1t",
248-
url="https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
249-
checksum='1cfee919e0eac6be62c88c5ae8bcd91e',
247+
name="OpenSSL 1.1.1u",
248+
url="https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
249+
checksum='72f7ba7395f0f0652783ba1089aa0dcc',
250250
buildrecipe=build_universal_openssl,
251251
configure=None,
252252
install=None,

‎Misc/NEWS.d/next/Security/2023-06-01-03-24-58.gh-issue-103142.GLWDMX.rst

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
The version of OpenSSL used in our binary builds has been upgraded to 1.1.1u
2+
to address several CVEs.

‎Misc/NEWS.d/next/macOS/2023-05-30-23-30-46.gh-issue-103142.55lMXQ.rst

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Update macOS installer to use OpenSSL 1.1.1u.

‎Modules/_ssl_data_111.h

+16-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2021-04-09T09:36:21.493286 */
1+
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2023-06-01T02:58:04.081473 */
22
static struct py_ssl_library_code library_codes[] = {
33
#ifdef ERR_LIB_ASN1
44
{"ASN1", ERR_LIB_ASN1},
@@ -1375,6 +1375,11 @@ static struct py_ssl_error_code error_codes[] = {
13751375
#else
13761376
{"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151},
13771377
#endif
1378+
#ifdef CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM
1379+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM},
1380+
#else
1381+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", 46, 194},
1382+
#endif
13781383
#ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE
13791384
{"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE},
13801385
#else
@@ -4860,6 +4865,11 @@ static struct py_ssl_error_code error_codes[] = {
48604865
#else
48614866
{"MISSING_PARAMETERS", 20, 290},
48624867
#endif
4868+
#ifdef SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
4869+
{"MISSING_PSK_KEX_MODES_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION},
4870+
#else
4871+
{"MISSING_PSK_KEX_MODES_EXTENSION", 20, 310},
4872+
#endif
48634873
#ifdef SSL_R_MISSING_RSA_CERTIFICATE
48644874
{"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE},
48654875
#else
@@ -5065,6 +5075,11 @@ static struct py_ssl_error_code error_codes[] = {
50655075
#else
50665076
{"NULL_SSL_METHOD_PASSED", 20, 196},
50675077
#endif
5078+
#ifdef SSL_R_OCSP_CALLBACK_FAILURE
5079+
{"OCSP_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_OCSP_CALLBACK_FAILURE},
5080+
#else
5081+
{"OCSP_CALLBACK_FAILURE", 20, 294},
5082+
#endif
50685083
#ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED
50695084
{"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED},
50705085
#else

‎Modules/_ssl_data_300.h

+151-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2021-04-09T09:44:43.288448 */
1+
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2023-06-01T03:03:52.163218 */
22
static struct py_ssl_library_code library_codes[] = {
33
#ifdef ERR_LIB_ASN1
44
{"ASN1", ERR_LIB_ASN1},
@@ -1035,6 +1035,11 @@ static struct py_ssl_error_code error_codes[] = {
10351035
#else
10361036
{"NO_INVERSE", 3, 108},
10371037
#endif
1038+
#ifdef BN_R_NO_PRIME_CANDIDATE
1039+
{"NO_PRIME_CANDIDATE", ERR_LIB_BN, BN_R_NO_PRIME_CANDIDATE},
1040+
#else
1041+
{"NO_PRIME_CANDIDATE", 3, 121},
1042+
#endif
10381043
#ifdef BN_R_NO_SOLUTION
10391044
{"NO_SOLUTION", ERR_LIB_BN, BN_R_NO_SOLUTION},
10401045
#else
@@ -1255,6 +1260,11 @@ static struct py_ssl_error_code error_codes[] = {
12551260
#else
12561261
{"INVALID_OPTION", 58, 174},
12571262
#endif
1263+
#ifdef CMP_R_MISSING_CERTID
1264+
{"MISSING_CERTID", ERR_LIB_CMP, CMP_R_MISSING_CERTID},
1265+
#else
1266+
{"MISSING_CERTID", 58, 165},
1267+
#endif
12581268
#ifdef CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION
12591269
{"MISSING_KEY_INPUT_FOR_CREATING_PROTECTION", ERR_LIB_CMP, CMP_R_MISSING_KEY_INPUT_FOR_CREATING_PROTECTION},
12601270
#else
@@ -1280,21 +1290,41 @@ static struct py_ssl_error_code error_codes[] = {
12801290
#else
12811291
{"MISSING_PRIVATE_KEY", 58, 131},
12821292
#endif
1293+
#ifdef CMP_R_MISSING_PRIVATE_KEY_FOR_POPO
1294+
{"MISSING_PRIVATE_KEY_FOR_POPO", ERR_LIB_CMP, CMP_R_MISSING_PRIVATE_KEY_FOR_POPO},
1295+
#else
1296+
{"MISSING_PRIVATE_KEY_FOR_POPO", 58, 190},
1297+
#endif
12831298
#ifdef CMP_R_MISSING_PROTECTION
12841299
{"MISSING_PROTECTION", ERR_LIB_CMP, CMP_R_MISSING_PROTECTION},
12851300
#else
12861301
{"MISSING_PROTECTION", 58, 143},
12871302
#endif
1303+
#ifdef CMP_R_MISSING_PUBLIC_KEY
1304+
{"MISSING_PUBLIC_KEY", ERR_LIB_CMP, CMP_R_MISSING_PUBLIC_KEY},
1305+
#else
1306+
{"MISSING_PUBLIC_KEY", 58, 183},
1307+
#endif
12881308
#ifdef CMP_R_MISSING_REFERENCE_CERT
12891309
{"MISSING_REFERENCE_CERT", ERR_LIB_CMP, CMP_R_MISSING_REFERENCE_CERT},
12901310
#else
12911311
{"MISSING_REFERENCE_CERT", 58, 168},
12921312
#endif
1313+
#ifdef CMP_R_MISSING_SECRET
1314+
{"MISSING_SECRET", ERR_LIB_CMP, CMP_R_MISSING_SECRET},
1315+
#else
1316+
{"MISSING_SECRET", 58, 178},
1317+
#endif
12931318
#ifdef CMP_R_MISSING_SENDER_IDENTIFICATION
12941319
{"MISSING_SENDER_IDENTIFICATION", ERR_LIB_CMP, CMP_R_MISSING_SENDER_IDENTIFICATION},
12951320
#else
12961321
{"MISSING_SENDER_IDENTIFICATION", 58, 111},
12971322
#endif
1323+
#ifdef CMP_R_MISSING_TRUST_ANCHOR
1324+
{"MISSING_TRUST_ANCHOR", ERR_LIB_CMP, CMP_R_MISSING_TRUST_ANCHOR},
1325+
#else
1326+
{"MISSING_TRUST_ANCHOR", 58, 179},
1327+
#endif
12981328
#ifdef CMP_R_MISSING_TRUST_STORE
12991329
{"MISSING_TRUST_STORE", ERR_LIB_CMP, CMP_R_MISSING_TRUST_STORE},
13001330
#else
@@ -1455,6 +1485,11 @@ static struct py_ssl_error_code error_codes[] = {
14551485
#else
14561486
{"WRONG_ALGORITHM_OID", 58, 138},
14571487
#endif
1488+
#ifdef CMP_R_WRONG_CERTID
1489+
{"WRONG_CERTID", ERR_LIB_CMP, CMP_R_WRONG_CERTID},
1490+
#else
1491+
{"WRONG_CERTID", 58, 189},
1492+
#endif
14581493
#ifdef CMP_R_WRONG_CERTID_IN_RP
14591494
{"WRONG_CERTID_IN_RP", ERR_LIB_CMP, CMP_R_WRONG_CERTID_IN_RP},
14601495
#else
@@ -1885,6 +1920,11 @@ static struct py_ssl_error_code error_codes[] = {
18851920
#else
18861921
{"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151},
18871922
#endif
1923+
#ifdef CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM
1924+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM},
1925+
#else
1926+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", 46, 194},
1927+
#endif
18881928
#ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE
18891929
{"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE},
18901930
#else
@@ -2045,6 +2085,11 @@ static struct py_ssl_error_code error_codes[] = {
20452085
#else
20462086
{"RECURSIVE_DIRECTORY_INCLUDE", 14, 111},
20472087
#endif
2088+
#ifdef CONF_R_RELATIVE_PATH
2089+
{"RELATIVE_PATH", ERR_LIB_CONF, CONF_R_RELATIVE_PATH},
2090+
#else
2091+
{"RELATIVE_PATH", 14, 125},
2092+
#endif
20482093
#ifdef CONF_R_SSL_COMMAND_SECTION_EMPTY
20492094
{"SSL_COMMAND_SECTION_EMPTY", ERR_LIB_CONF, CONF_R_SSL_COMMAND_SECTION_EMPTY},
20502095
#else
@@ -2235,6 +2280,11 @@ static struct py_ssl_error_code error_codes[] = {
22352280
#else
22362281
{"INSUFFICIENT_SECURE_DATA_SPACE", 15, 108},
22372282
#endif
2283+
#ifdef CRYPTO_R_INVALID_NEGATIVE_VALUE
2284+
{"INVALID_NEGATIVE_VALUE", ERR_LIB_CRYPTO, CRYPTO_R_INVALID_NEGATIVE_VALUE},
2285+
#else
2286+
{"INVALID_NEGATIVE_VALUE", 15, 122},
2287+
#endif
22382288
#ifdef CRYPTO_R_INVALID_NULL_ARGUMENT
22392289
{"INVALID_NULL_ARGUMENT", ERR_LIB_CRYPTO, CRYPTO_R_INVALID_NULL_ARGUMENT},
22402290
#else
@@ -2605,6 +2655,11 @@ static struct py_ssl_error_code error_codes[] = {
26052655
#else
26062656
{"SEED_LEN_SMALL", 10, 110},
26072657
#endif
2658+
#ifdef DSA_R_TOO_MANY_RETRIES
2659+
{"TOO_MANY_RETRIES", ERR_LIB_DSA, DSA_R_TOO_MANY_RETRIES},
2660+
#else
2661+
{"TOO_MANY_RETRIES", 10, 116},
2662+
#endif
26082663
#ifdef DSO_R_CTRL_FAILED
26092664
{"CTRL_FAILED", ERR_LIB_DSO, DSO_R_CTRL_FAILED},
26102665
#else
@@ -2745,6 +2800,11 @@ static struct py_ssl_error_code error_codes[] = {
27452800
#else
27462801
{"EC_GROUP_NEW_BY_NAME_FAILURE", 16, 119},
27472802
#endif
2803+
#ifdef EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED
2804+
{"EXPLICIT_PARAMS_NOT_SUPPORTED", ERR_LIB_EC, EC_R_EXPLICIT_PARAMS_NOT_SUPPORTED},
2805+
#else
2806+
{"EXPLICIT_PARAMS_NOT_SUPPORTED", 16, 127},
2807+
#endif
27482808
#ifdef EC_R_FAILED_MAKING_PUBLIC_KEY
27492809
{"FAILED_MAKING_PUBLIC_KEY", ERR_LIB_EC, EC_R_FAILED_MAKING_PUBLIC_KEY},
27502810
#else
@@ -2850,6 +2910,11 @@ static struct py_ssl_error_code error_codes[] = {
28502910
#else
28512911
{"INVALID_KEY", 16, 116},
28522912
#endif
2913+
#ifdef EC_R_INVALID_LENGTH
2914+
{"INVALID_LENGTH", ERR_LIB_EC, EC_R_INVALID_LENGTH},
2915+
#else
2916+
{"INVALID_LENGTH", 16, 117},
2917+
#endif
28532918
#ifdef EC_R_INVALID_NAMED_GROUP_CONVERSION
28542919
{"INVALID_NAMED_GROUP_CONVERSION", ERR_LIB_EC, EC_R_INVALID_NAMED_GROUP_CONVERSION},
28552920
#else
@@ -3010,6 +3075,11 @@ static struct py_ssl_error_code error_codes[] = {
30103075
#else
30113076
{"SLOT_FULL", 16, 108},
30123077
#endif
3078+
#ifdef EC_R_TOO_MANY_RETRIES
3079+
{"TOO_MANY_RETRIES", ERR_LIB_EC, EC_R_TOO_MANY_RETRIES},
3080+
#else
3081+
{"TOO_MANY_RETRIES", 16, 176},
3082+
#endif
30133083
#ifdef EC_R_UNDEFINED_GENERATOR
30143084
{"UNDEFINED_GENERATOR", ERR_LIB_EC, EC_R_UNDEFINED_GENERATOR},
30153085
#else
@@ -3690,6 +3760,11 @@ static struct py_ssl_error_code error_codes[] = {
36903760
#else
36913761
{"PUBLIC_KEY_NOT_RSA", 6, 106},
36923762
#endif
3763+
#ifdef EVP_R_SETTING_XOF_FAILED
3764+
{"SETTING_XOF_FAILED", ERR_LIB_EVP, EVP_R_SETTING_XOF_FAILED},
3765+
#else
3766+
{"SETTING_XOF_FAILED", 6, 227},
3767+
#endif
36933768
#ifdef EVP_R_SET_DEFAULT_PROPERTY_FAILURE
36943769
{"SET_DEFAULT_PROPERTY_FAILURE", ERR_LIB_EVP, EVP_R_SET_DEFAULT_PROPERTY_FAILURE},
36953770
#else
@@ -3865,6 +3940,11 @@ static struct py_ssl_error_code error_codes[] = {
38653940
#else
38663941
{"FAILED_READING_DATA", 61, 128},
38673942
#endif
3943+
#ifdef HTTP_R_HEADER_PARSE_ERROR
3944+
{"HEADER_PARSE_ERROR", ERR_LIB_HTTP, HTTP_R_HEADER_PARSE_ERROR},
3945+
#else
3946+
{"HEADER_PARSE_ERROR", 61, 126},
3947+
#endif
38683948
#ifdef HTTP_R_INCONSISTENT_CONTENT_LENGTH
38693949
{"INCONSISTENT_CONTENT_LENGTH", ERR_LIB_HTTP, HTTP_R_INCONSISTENT_CONTENT_LENGTH},
38703950
#else
@@ -3935,6 +4015,16 @@ static struct py_ssl_error_code error_codes[] = {
39354015
#else
39364016
{"RESPONSE_PARSE_ERROR", 61, 104},
39374017
#endif
4018+
#ifdef HTTP_R_RETRY_TIMEOUT
4019+
{"RETRY_TIMEOUT", ERR_LIB_HTTP, HTTP_R_RETRY_TIMEOUT},
4020+
#else
4021+
{"RETRY_TIMEOUT", 61, 129},
4022+
#endif
4023+
#ifdef HTTP_R_SERVER_CANCELED_CONNECTION
4024+
{"SERVER_CANCELED_CONNECTION", ERR_LIB_HTTP, HTTP_R_SERVER_CANCELED_CONNECTION},
4025+
#else
4026+
{"SERVER_CANCELED_CONNECTION", 61, 127},
4027+
#endif
39384028
#ifdef HTTP_R_SOCK_NOT_SUPPORTED
39394029
{"SOCK_NOT_SUPPORTED", ERR_LIB_HTTP, HTTP_R_SOCK_NOT_SUPPORTED},
39404030
#else
@@ -4100,6 +4190,16 @@ static struct py_ssl_error_code error_codes[] = {
41004190
#else
41014191
{"UNSUPPORTED_REQUESTORNAME_TYPE", 39, 129},
41024192
#endif
4193+
#ifdef OSSL_DECODER_R_COULD_NOT_DECODE_OBJECT
4194+
{"COULD_NOT_DECODE_OBJECT", ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_COULD_NOT_DECODE_OBJECT},
4195+
#else
4196+
{"COULD_NOT_DECODE_OBJECT", 60, 101},
4197+
#endif
4198+
#ifdef OSSL_DECODER_R_DECODER_NOT_FOUND
4199+
{"DECODER_NOT_FOUND", ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_DECODER_NOT_FOUND},
4200+
#else
4201+
{"DECODER_NOT_FOUND", 60, 102},
4202+
#endif
41034203
#ifdef OSSL_DECODER_R_MISSING_GET_PARAMS
41044204
{"MISSING_GET_PARAMS", ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_MISSING_GET_PARAMS},
41054205
#else
@@ -4190,6 +4290,11 @@ static struct py_ssl_error_code error_codes[] = {
41904290
#else
41914291
{"NOT_PARAMETERS", 44, 104},
41924292
#endif
4293+
#ifdef OSSL_STORE_R_NO_LOADERS_FOUND
4294+
{"NO_LOADERS_FOUND", ERR_LIB_OSSL_STORE, OSSL_STORE_R_NO_LOADERS_FOUND},
4295+
#else
4296+
{"NO_LOADERS_FOUND", 44, 123},
4297+
#endif
41934298
#ifdef OSSL_STORE_R_PASSPHRASE_CALLBACK_ERROR
41944299
{"PASSPHRASE_CALLBACK_ERROR", ERR_LIB_OSSL_STORE, OSSL_STORE_R_PASSPHRASE_CALLBACK_ERROR},
41954300
#else
@@ -4935,6 +5040,11 @@ static struct py_ssl_error_code error_codes[] = {
49355040
#else
49365041
{"INVALID_DIGEST_SIZE", 57, 218},
49375042
#endif
5043+
#ifdef PROV_R_INVALID_INPUT_LENGTH
5044+
{"INVALID_INPUT_LENGTH", ERR_LIB_PROV, PROV_R_INVALID_INPUT_LENGTH},
5045+
#else
5046+
{"INVALID_INPUT_LENGTH", 57, 230},
5047+
#endif
49385048
#ifdef PROV_R_INVALID_ITERATION_COUNT
49395049
{"INVALID_ITERATION_COUNT", ERR_LIB_PROV, PROV_R_INVALID_ITERATION_COUNT},
49405050
#else
@@ -4970,6 +5080,11 @@ static struct py_ssl_error_code error_codes[] = {
49705080
#else
49715081
{"INVALID_MODE", 57, 125},
49725082
#endif
5083+
#ifdef PROV_R_INVALID_OUTPUT_LENGTH
5084+
{"INVALID_OUTPUT_LENGTH", ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH},
5085+
#else
5086+
{"INVALID_OUTPUT_LENGTH", 57, 217},
5087+
#endif
49735088
#ifdef PROV_R_INVALID_PADDING_MODE
49745089
{"INVALID_PADDING_MODE", ERR_LIB_PROV, PROV_R_INVALID_PADDING_MODE},
49755090
#else
@@ -5035,6 +5150,16 @@ static struct py_ssl_error_code error_codes[] = {
50355150
#else
50365151
{"KEY_SIZE_TOO_SMALL", 57, 171},
50375152
#endif
5153+
#ifdef PROV_R_LENGTH_TOO_LARGE
5154+
{"LENGTH_TOO_LARGE", ERR_LIB_PROV, PROV_R_LENGTH_TOO_LARGE},
5155+
#else
5156+
{"LENGTH_TOO_LARGE", 57, 202},
5157+
#endif
5158+
#ifdef PROV_R_MISMATCHING_DOMAIN_PARAMETERS
5159+
{"MISMATCHING_DOMAIN_PARAMETERS", ERR_LIB_PROV, PROV_R_MISMATCHING_DOMAIN_PARAMETERS},
5160+
#else
5161+
{"MISMATCHING_DOMAIN_PARAMETERS", 57, 203},
5162+
#endif
50385163
#ifdef PROV_R_MISSING_CEK_ALG
50395164
{"MISSING_CEK_ALG", ERR_LIB_PROV, PROV_R_MISSING_CEK_ALG},
50405165
#else
@@ -5695,6 +5820,11 @@ static struct py_ssl_error_code error_codes[] = {
56955820
#else
56965821
{"INVALID_LABEL", 4, 160},
56975822
#endif
5823+
#ifdef RSA_R_INVALID_LENGTH
5824+
{"INVALID_LENGTH", ERR_LIB_RSA, RSA_R_INVALID_LENGTH},
5825+
#else
5826+
{"INVALID_LENGTH", 4, 181},
5827+
#endif
56985828
#ifdef RSA_R_INVALID_MESSAGE_LENGTH
56995829
{"INVALID_MESSAGE_LENGTH", ERR_LIB_RSA, RSA_R_INVALID_MESSAGE_LENGTH},
57005830
#else
@@ -5880,6 +6010,11 @@ static struct py_ssl_error_code error_codes[] = {
58806010
#else
58816011
{"Q_NOT_PRIME", 4, 129},
58826012
#endif
6013+
#ifdef RSA_R_RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT
6014+
{"RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT", ERR_LIB_RSA, RSA_R_RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT},
6015+
#else
6016+
{"RANDOMNESS_SOURCE_STRENGTH_INSUFFICIENT", 4, 180},
6017+
#endif
58836018
#ifdef RSA_R_RSA_OPERATIONS_NOT_SUPPORTED
58846019
{"RSA_OPERATIONS_NOT_SUPPORTED", ERR_LIB_RSA, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED},
58856020
#else
@@ -6680,6 +6815,11 @@ static struct py_ssl_error_code error_codes[] = {
66806815
#else
66816816
{"INVALID_TICKET_KEYS_LENGTH", 20, 325},
66826817
#endif
6818+
#ifdef SSL_R_LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED
6819+
{"LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED", ERR_LIB_SSL, SSL_R_LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED},
6820+
#else
6821+
{"LEGACY_SIGALG_DISALLOWED_OR_UNSUPPORTED", 20, 333},
6822+
#endif
66836823
#ifdef SSL_R_LENGTH_MISMATCH
66846824
{"LENGTH_MISMATCH", ERR_LIB_SSL, SSL_R_LENGTH_MISMATCH},
66856825
#else
@@ -6725,6 +6865,11 @@ static struct py_ssl_error_code error_codes[] = {
67256865
#else
67266866
{"MISSING_PARAMETERS", 20, 290},
67276867
#endif
6868+
#ifdef SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
6869+
{"MISSING_PSK_KEX_MODES_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION},
6870+
#else
6871+
{"MISSING_PSK_KEX_MODES_EXTENSION", 20, 310},
6872+
#endif
67286873
#ifdef SSL_R_MISSING_RSA_CERTIFICATE
67296874
{"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE},
67306875
#else
@@ -6940,6 +7085,11 @@ static struct py_ssl_error_code error_codes[] = {
69407085
#else
69417086
{"NULL_SSL_METHOD_PASSED", 20, 196},
69427087
#endif
7088+
#ifdef SSL_R_OCSP_CALLBACK_FAILURE
7089+
{"OCSP_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_OCSP_CALLBACK_FAILURE},
7090+
#else
7091+
{"OCSP_CALLBACK_FAILURE", 20, 305},
7092+
#endif
69437093
#ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED
69447094
{"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED},
69457095
#else

‎PCbuild/get_externals.bat

+2-2
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ echo.Fetching external libraries...
5353
set libraries=
5454
set libraries=%libraries% bzip2-1.0.8
5555
if NOT "%IncludeLibffiSrc%"=="false" set libraries=%libraries% libffi-3.3.0
56-
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-1.1.1t
56+
if NOT "%IncludeSSLSrc%"=="false" set libraries=%libraries% openssl-1.1.1u
5757
set libraries=%libraries% sqlite-3.37.2.0
5858
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tcl-core-8.6.12.0
5959
if NOT "%IncludeTkinterSrc%"=="false" set libraries=%libraries% tk-8.6.12.0
@@ -77,7 +77,7 @@ echo.Fetching external binaries...
7777

7878
set binaries=
7979
if NOT "%IncludeLibffi%"=="false" set binaries=%binaries% libffi-3.3.0
80-
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-1.1.1t
80+
if NOT "%IncludeSSL%"=="false" set binaries=%binaries% openssl-bin-1.1.1u
8181
if NOT "%IncludeTkinter%"=="false" set binaries=%binaries% tcltk-8.6.12.0
8282
if NOT "%IncludeSSLSrc%"=="false" set binaries=%binaries% nasm-2.11.06
8383

‎PCbuild/python.props

+2-2
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,8 @@
6868
<libffiDir Condition="$(libffiDir) == ''">$(ExternalsDir)libffi-3.3.0\</libffiDir>
6969
<libffiOutDir Condition="$(libffiOutDir) == ''">$(libffiDir)$(ArchName)\</libffiOutDir>
7070
<libffiIncludeDir Condition="$(libffiIncludeDir) == ''">$(libffiOutDir)include</libffiIncludeDir>
71-
<opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-1.1.1t\</opensslDir>
72-
<opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-1.1.1t\$(ArchName)\</opensslOutDir>
71+
<opensslDir Condition="$(opensslDir) == ''">$(ExternalsDir)openssl-1.1.1u\</opensslDir>
72+
<opensslOutDir Condition="$(opensslOutDir) == ''">$(ExternalsDir)openssl-bin-1.1.1u\$(ArchName)\</opensslOutDir>
7373
<opensslIncludeDir Condition="$(opensslIncludeDir) == ''">$(opensslOutDir)include</opensslIncludeDir>
7474
<nasmDir Condition="$(nasmDir) == ''">$(ExternalsDir)\nasm-2.11.06\</nasmDir>
7575
<zlibDir Condition="$(zlibDir) == ''">$(ExternalsDir)\zlib-1.2.12\</zlibDir>

‎PCbuild/readme.txt

+1-1
Original file line numberDiff line numberDiff line change
@@ -164,7 +164,7 @@ _lzma
164164
Homepage:
165165
https://tukaani.org/xz/
166166
_ssl
167-
Python wrapper for version 1.1.1t of the OpenSSL secure sockets
167+
Python wrapper for version 1.1.1u of the OpenSSL secure sockets
168168
library, which is downloaded from our binaries repository at
169169
https://github.com/python/cpython-bin-deps.
170170

‎Tools/ssl/multissltests.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@
4949
]
5050

5151
OPENSSL_RECENT_VERSIONS = [
52-
"1.1.1t",
53-
"3.0.8"
52+
"1.1.1u",
53+
"3.0.9",
5454
]
5555

5656
LIBRESSL_OLD_VERSIONS = [

0 commit comments

Comments
 (0)
Please sign in to comment.