Fix locking in cert_store_stats and get_ca_certs
This commit is contained in:
xinsheng3
parent
5f6ffa357a
commit
9c1277e3b0
@ -0,0 +1,150 @@
|
|||||||
|
From bce693111bff906ccf9281c22371331aaff766ab Mon Sep 17 00:00:00 2001
|
||||||
|
From: David Benjamin <davidben@google.com>
|
||||||
|
Date: Thu, 15 Feb 2024 19:24:51 -0500
|
||||||
|
Subject: [PATCH] gh-114572: Fix locking in cert_store_stats and get_ca_certs
|
||||||
|
(#114573)
|
||||||
|
|
||||||
|
* gh-114572: Fix locking in cert_store_stats and get_ca_certs
|
||||||
|
|
||||||
|
cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
|
||||||
|
X509_STORE_get0_objects, but reading the result requires a lock. See
|
||||||
|
https://github.com/openssl/openssl/pull/23224 for details.
|
||||||
|
|
||||||
|
Instead, use X509_STORE_get1_objects, newly added in that PR.
|
||||||
|
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
|
||||||
|
polyfill it with X509_STORE_lock and X509_STORE_unlock.
|
||||||
|
|
||||||
|
* Work around const-correctness problem
|
||||||
|
|
||||||
|
* Add missing X509_STORE_get1_objects failure check
|
||||||
|
|
||||||
|
* Add blurb
|
||||||
|
---
|
||||||
|
...-01-26-22-14-09.gh-issue-114572.t1QMQD.rst | 4 ++
|
||||||
|
Modules/_ssl.c | 65 +++++++++++++++++--
|
||||||
|
2 files changed, 64 insertions(+), 5 deletions(-)
|
||||||
|
create mode 100644 Misc/NEWS.d/next/Security/2024-01-26-22-14-09.gh-issue-114572.t1QMQD.rst
|
||||||
|
|
||||||
|
diff --git a/Misc/NEWS.d/next/Security/2024-01-26-22-14-09.gh-issue-114572.t1QMQD.rst b/Misc/NEWS.d/next/Security/2024-01-26-22-14-09.gh-issue-114572.t1QMQD.rst
|
||||||
|
new file mode 100644
|
||||||
|
index 0000000000..b4f9fe64db
|
||||||
|
--- /dev/null
|
||||||
|
+++ b/Misc/NEWS.d/next/Security/2024-01-26-22-14-09.gh-issue-114572.t1QMQD.rst
|
||||||
|
@@ -0,0 +1,4 @@
|
||||||
|
+:meth:`ssl.SSLContext.cert_store_stats` and
|
||||||
|
+:meth:`ssl.SSLContext.get_ca_certs` now correctly lock access to the
|
||||||
|
+certificate store, when the :class:`ssl.SSLContext` is shared across
|
||||||
|
+multiple threads.
|
||||||
|
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
|
||||||
|
index bc30290942..950ee36630 100644
|
||||||
|
--- a/Modules/_ssl.c
|
||||||
|
+++ b/Modules/_ssl.c
|
||||||
|
@@ -4553,6 +4553,50 @@ set_sni_callback(PySSLContext *self, PyObject *arg, void *c)
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
+#if OPENSSL_VERSION_NUMBER < 0x30300000L
|
||||||
|
+static X509_OBJECT *x509_object_dup(const X509_OBJECT *obj)
|
||||||
|
+{
|
||||||
|
+ int ok;
|
||||||
|
+ X509_OBJECT *ret = X509_OBJECT_new();
|
||||||
|
+ if (ret == NULL) {
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+ switch (X509_OBJECT_get_type(obj)) {
|
||||||
|
+ case X509_LU_X509:
|
||||||
|
+ ok = X509_OBJECT_set1_X509(ret, X509_OBJECT_get0_X509(obj));
|
||||||
|
+ break;
|
||||||
|
+ case X509_LU_CRL:
|
||||||
|
+ /* X509_OBJECT_get0_X509_CRL was not const-correct prior to 3.0.*/
|
||||||
|
+ ok = X509_OBJECT_set1_X509_CRL(
|
||||||
|
+ ret, X509_OBJECT_get0_X509_CRL((X509_OBJECT *)obj));
|
||||||
|
+ break;
|
||||||
|
+ default:
|
||||||
|
+ /* We cannot duplicate unrecognized types in a polyfill, but it is
|
||||||
|
+ * safe to leave an empty object. The caller will ignore it. */
|
||||||
|
+ ok = 1;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ if (!ok) {
|
||||||
|
+ X509_OBJECT_free(ret);
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+ return ret;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
+static STACK_OF(X509_OBJECT) *
|
||||||
|
+X509_STORE_get1_objects(X509_STORE *store)
|
||||||
|
+{
|
||||||
|
+ STACK_OF(X509_OBJECT) *ret;
|
||||||
|
+ if (!X509_STORE_lock(store)) {
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+ ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store),
|
||||||
|
+ x509_object_dup, X509_OBJECT_free);
|
||||||
|
+ X509_STORE_unlock(store);
|
||||||
|
+ return ret;
|
||||||
|
+}
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
PyDoc_STRVAR(PySSLContext_sni_callback_doc,
|
||||||
|
"Set a callback that will be called when a server name is provided by the SSL/TLS client in the SNI extension.\n\
|
||||||
|
\n\
|
||||||
|
@@ -4582,7 +4626,12 @@ _ssl__SSLContext_cert_store_stats_impl(PySSLContext *self)
|
||||||
|
int x509 = 0, crl = 0, ca = 0, i;
|
||||||
|
|
||||||
|
store = SSL_CTX_get_cert_store(self->ctx);
|
||||||
|
- objs = X509_STORE_get0_objects(store);
|
||||||
|
+ objs = X509_STORE_get1_objects(store);
|
||||||
|
+ if (objs == NULL) {
|
||||||
|
+ PyErr_SetString(PyExc_MemoryError, "failed to query cert store");
|
||||||
|
+ return NULL;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
|
||||||
|
obj = sk_X509_OBJECT_value(objs, i);
|
||||||
|
switch (X509_OBJECT_get_type(obj)) {
|
||||||
|
@@ -4596,12 +4645,11 @@ _ssl__SSLContext_cert_store_stats_impl(PySSLContext *self)
|
||||||
|
crl++;
|
||||||
|
break;
|
||||||
|
default:
|
||||||
|
- /* Ignore X509_LU_FAIL, X509_LU_RETRY, X509_LU_PKEY.
|
||||||
|
- * As far as I can tell they are internal states and never
|
||||||
|
- * stored in a cert store */
|
||||||
|
+ /* Ignore unrecognized types. */
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
+ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free);
|
||||||
|
return Py_BuildValue("{sisisi}", "x509", x509, "crl", crl,
|
||||||
|
"x509_ca", ca);
|
||||||
|
}
|
||||||
|
@@ -4633,7 +4681,12 @@ _ssl__SSLContext_get_ca_certs_impl(PySSLContext *self, int binary_form)
|
||||||
|
}
|
||||||
|
|
||||||
|
store = SSL_CTX_get_cert_store(self->ctx);
|
||||||
|
- objs = X509_STORE_get0_objects(store);
|
||||||
|
+ objs = X509_STORE_get1_objects(store);
|
||||||
|
+ if (objs == NULL) {
|
||||||
|
+ PyErr_SetString(PyExc_MemoryError, "failed to query cert store");
|
||||||
|
+ goto error;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
|
||||||
|
X509_OBJECT *obj;
|
||||||
|
X509 *cert;
|
||||||
|
@@ -4661,9 +4714,11 @@ _ssl__SSLContext_get_ca_certs_impl(PySSLContext *self, int binary_form)
|
||||||
|
}
|
||||||
|
Py_CLEAR(ci);
|
||||||
|
}
|
||||||
|
+ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free);
|
||||||
|
return rlist;
|
||||||
|
|
||||||
|
error:
|
||||||
|
+ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free);
|
||||||
|
Py_XDECREF(ci);
|
||||||
|
Py_XDECREF(rlist);
|
||||||
|
return NULL;
|
||||||
|
--
|
||||||
|
2.45.1.windows.1
|
||||||
|
|
||||||
12
python3.spec
12
python3.spec
@ -3,7 +3,7 @@ Summary: Interpreter of the Python3 programming language
|
|||||||
URL: https://www.python.org/
|
URL: https://www.python.org/
|
||||||
|
|
||||||
Version: 3.11.6
|
Version: 3.11.6
|
||||||
Release: 2
|
Release: 3
|
||||||
License: Python-2.0
|
License: Python-2.0
|
||||||
|
|
||||||
%global branchversion 3.11
|
%global branchversion 3.11
|
||||||
@ -88,6 +88,8 @@ Source1: pyconfig.h
|
|||||||
Patch1: 00001-rpath.patch
|
Patch1: 00001-rpath.patch
|
||||||
Patch251: 00251-change-user-install-location.patch
|
Patch251: 00251-change-user-install-location.patch
|
||||||
|
|
||||||
|
Patch6000: backport-3.11-gh-114572-Fix-locking-in-cert_store_stats-and-get_ca.patch
|
||||||
|
|
||||||
Patch9000: add-the-sm3-method-for-obtaining-the-salt-value.patch
|
Patch9000: add-the-sm3-method-for-obtaining-the-salt-value.patch
|
||||||
Patch9001: 0001-add-loongarch64-support-for-python.patch
|
Patch9001: 0001-add-loongarch64-support-for-python.patch
|
||||||
|
|
||||||
@ -185,6 +187,8 @@ rm configure pyconfig.h.in
|
|||||||
%patch1 -p1
|
%patch1 -p1
|
||||||
%patch251 -p1
|
%patch251 -p1
|
||||||
|
|
||||||
|
%patch6000 -p1
|
||||||
|
|
||||||
%patch9000 -p1
|
%patch9000 -p1
|
||||||
%patch9001 -p1
|
%patch9001 -p1
|
||||||
|
|
||||||
@ -848,6 +852,12 @@ export BEP_GTDLIST="$BEP_GTDLIST_TMP"
|
|||||||
%{_mandir}/*/*
|
%{_mandir}/*/*
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Web Jul 10 2024 xinsheng <xinsheng3@huawei.com> - 3.11.6-3
|
||||||
|
- Type:bugfix
|
||||||
|
- CVE:NA
|
||||||
|
- SUG:NA
|
||||||
|
- DESC:Fix locking in cert_store_stats and get_ca_certs
|
||||||
|
|
||||||
* Mon Feb 26 2024 Wenlong Zhang<zhangwenlong@loongson.cn> - 3.11.6-2
|
* Mon Feb 26 2024 Wenlong Zhang<zhangwenlong@loongson.cn> - 3.11.6-2
|
||||||
- Type:bugfix
|
- Type:bugfix
|
||||||
- CVE:NA
|
- CVE:NA
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user