(original) (raw)

changeset: 87397:40d4be2b7258 user: Christian Heimes christian@cheimes.de date: Sat Nov 23 11:24:32 2013 +0100 files: Doc/library/ssl.rst Lib/test/test_ssl.py Modules/_ssl.c description: Issue #8813: X509_VERIFY_PARAM is only available on OpenSSL 0.9.8+ The patch removes the verify_flags feature on Mac OS X 10.4 with OpenSSL 0.9.7l 28 Sep 2006. diff -r 7c4d1daa0bc1 -r 40d4be2b7258 Doc/library/ssl.rst --- a/Doc/library/ssl.rst Sat Nov 23 00:24:15 2013 -0800 +++ b/Doc/library/ssl.rst Sat Nov 23 11:24:32 2013 +0100 @@ -1126,6 +1126,7 @@ The flags for certificate verification operations. You can set flags like :data:`VERIFY_CRL_CHECK_LEAF` by ORing them together. By default OpenSSL does neither require nor verify certificate revocation lists (CRLs). + Available only with openssl version 0.9.8+. .. versionadded:: 3.4 diff -r 7c4d1daa0bc1 -r 40d4be2b7258 Lib/test/test_ssl.py --- a/Lib/test/test_ssl.py Sat Nov 23 00:24:15 2013 -0800 +++ b/Lib/test/test_ssl.py Sat Nov 23 11:24:32 2013 +0100 @@ -82,6 +82,10 @@ # 0.9.7h or higher return ssl.OPENSSL_VERSION_INFO >= (0, 9, 7, 8, 15) +def have_verify_flags(): + # 0.9.8 or higher + return ssl.OPENSSL_VERSION_INFO >= (0, 9, 8, 0, 15) + def asn1time(cert_time): # Some versions of OpenSSL ignore seconds, see #18207 # 0.9.8.i @@ -667,6 +671,8 @@ with self.assertRaises(ValueError): ctx.verify_mode = 42 + @unittest.skipUnless(have_verify_flags(), + "verify_flags need OpenSSL > 0.9.8") def test_verify_flags(self): ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) # default value by OpenSSL @@ -1809,6 +1815,8 @@ self.assertLess(before, after) s.close() + @unittest.skipUnless(have_verify_flags(), + "verify_flags need OpenSSL > 0.9.8") def test_crl_check(self): if support.verbose: sys.stdout.write("\n") diff -r 7c4d1daa0bc1 -r 40d4be2b7258 Modules/_ssl.c --- a/Modules/_ssl.c Sat Nov 23 00:24:15 2013 -0800 +++ b/Modules/_ssl.c Sat Nov 23 11:24:32 2013 +0100 @@ -198,6 +198,11 @@ # define OPENSSL_NO_COMP #endif +/* X509_VERIFY_PARAM got added to OpenSSL in 0.9.8 */ +#if OPENSSL_VERSION_NUMBER >= 0x0090800fL +# define HAVE_OPENSSL_VERIFY_PARAM +#endif + typedef struct { PyObject_HEAD @@ -2230,6 +2235,7 @@ return 0; } +#ifdef HAVE_OPENSSL_VERIFY_PARAM static PyObject * get_verify_flags(PySSLContext *self, void *c) { @@ -2267,6 +2273,7 @@ } return 0; } +#endif static PyObject * get_options(PySSLContext *self, void *c) @@ -3088,8 +3095,10 @@ static PyGetSetDef context_getsetlist[] = { {"options", (getter) get_options, (setter) set_options, NULL}, +#ifdef HAVE_OPENSSL_VERIFY_PARAM {"verify_flags", (getter) get_verify_flags, (setter) set_verify_flags, NULL}, +#endif {"verify_mode", (getter) get_verify_mode, (setter) set_verify_mode, NULL}, {NULL}, /* sentinel */ /christian@cheimes.de