c4822c6e4e
(cherry picked from Fedora commit 25de62e0679f67c5d244465a869314334bf71c1d) Resolves: RHEL-191730
76 lines
3.4 KiB
Diff
76 lines
3.4 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: David Benjamin <davidben@google.com>
|
|
Date: Fri, 24 Mar 2023 09:04:30 -0400
|
|
Subject: 00489: Use BIO_eof to detect EOF for SSL_FILETYPE_ASN1
|
|
|
|
In PEM, we need to parse until error and then suppress `PEM_R_NO_START_LINE`, because PEM allows arbitrary leading and trailing data. DER, however, does not. Parsing until error and suppressing `ASN1_R_HEADER_TOO_LONG` doesn't quite work because that error also covers some cases that should be rejected.
|
|
|
|
Instead, check `BIO_eof` early and stop the loop that way.
|
|
|
|
This fixes https://github.com/python/cpython/issues/151504 and adds compatibility with OpenSSL 3.5.7+
|
|
|
|
(cherry-picked from commit acfe02f3b05436658d92add6b168538b30f357f0)
|
|
---
|
|
Lib/test/test_ssl.py | 2 ++
|
|
.../2022-12-20-10-55-14.gh-issue-100372.utfP65.rst | 2 ++
|
|
Modules/_ssl.c | 10 ++++++----
|
|
3 files changed, 10 insertions(+), 4 deletions(-)
|
|
create mode 100644 Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
|
|
|
|
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
|
|
index a2e771ed7f..8eaf9bf22f 100644
|
|
--- a/Lib/test/test_ssl.py
|
|
+++ b/Lib/test/test_ssl.py
|
|
@@ -1512,6 +1512,8 @@ class ContextTests(unittest.TestCase):
|
|
"not enough data: cadata does not contain a certificate"
|
|
):
|
|
ctx.load_verify_locations(cadata=b"broken")
|
|
+ with self.assertRaises(ssl.SSLError):
|
|
+ ctx.load_verify_locations(cadata=cacert_der + b"A")
|
|
|
|
@unittest.skipIf(Py_DEBUG_WIN32, "Avoid mixing debug/release CRT on Windows")
|
|
def test_load_dh_params(self):
|
|
diff --git a/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst b/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
|
|
new file mode 100644
|
|
index 0000000000..ec37aff509
|
|
--- /dev/null
|
|
+++ b/Misc/NEWS.d/next/Library/2022-12-20-10-55-14.gh-issue-100372.utfP65.rst
|
|
@@ -0,0 +1,2 @@
|
|
+:meth:`ssl.SSLContext.load_verify_locations` no longer incorrectly accepts
|
|
+some cases of trailing data when parsing DER.
|
|
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
|
|
index 5e0be34d6f..a6d72056b0 100644
|
|
--- a/Modules/_ssl.c
|
|
+++ b/Modules/_ssl.c
|
|
@@ -4113,7 +4113,7 @@ _add_ca_certs(PySSLContext *self, const void *data, Py_ssize_t len,
|
|
{
|
|
BIO *biobuf = NULL;
|
|
X509_STORE *store;
|
|
- int retval = -1, err, loaded = 0;
|
|
+ int retval = -1, err, loaded = 0, was_bio_eof = 0;
|
|
|
|
assert(filetype == SSL_FILETYPE_ASN1 || filetype == SSL_FILETYPE_PEM);
|
|
|
|
@@ -4141,6 +4141,10 @@ _add_ca_certs(PySSLContext *self, const void *data, Py_ssize_t len,
|
|
int r;
|
|
|
|
if (filetype == SSL_FILETYPE_ASN1) {
|
|
+ if (BIO_eof(biobuf)) {
|
|
+ was_bio_eof = 1;
|
|
+ break;
|
|
+ }
|
|
cert = d2i_X509_bio(biobuf, NULL);
|
|
} else {
|
|
cert = PEM_read_bio_X509(biobuf, NULL,
|
|
@@ -4176,9 +4180,7 @@ _add_ca_certs(PySSLContext *self, const void *data, Py_ssize_t len,
|
|
}
|
|
_setSSLError(msg, 0, __FILE__, __LINE__);
|
|
retval = -1;
|
|
- } else if ((filetype == SSL_FILETYPE_ASN1) &&
|
|
- (ERR_GET_LIB(err) == ERR_LIB_ASN1) &&
|
|
- (ERR_GET_REASON(err) == ASN1_R_HEADER_TOO_LONG)) {
|
|
+ } else if ((filetype == SSL_FILETYPE_ASN1) && was_bio_eof) {
|
|
/* EOF ASN1 file, not an error */
|
|
ERR_clear_error();
|
|
retval = 0;
|