bpo-34759: Fix error handling in ssl 'unwrap()'#9468
Merged
Conversation
OpenSSL follows the convention that whenever you call a function, it returns an error indicator value; and if this value is negative, then you need to go look at the actual error code to see what happened. Commit c6fd1c1 introduced a small mistake in _ssl__SSLSocket_shutdown_impl: instead of checking whether the error indicator was negative, it started checking whether the actual error code was negative, and it turns out that the error codes are never negative. So the effect was that 'unwrap()' lost the ability to raise SSL errors.
Contributor
Author
|
The commit that introduced this bug was backported to 3.6 and 3.7, so this needs to be too; but, I believe we caught it before either of those branches released, so no need for a news entry. |
vstinner
approved these changes
Sep 21, 2018
vstinner
left a comment
vstinner
left a comment
Member
There was a problem hiding this comment.
LGTM, but I would prefer that someone else also reviews the change. Thanks for adding more tests :-)
zooba
approved these changes
Sep 21, 2018
zooba
left a comment
zooba
left a comment
Member
There was a problem hiding this comment.
The fix is good. I can follow the test just fine and it also looks good, but I have to take it on faith that it's testing the scenario :)
Contributor
Author
|
I did check that the test fails without the fix. |
Contributor
|
Thanks @njsmith for the PR 🌮🎉.. I'm working now to backport this PR to: 3.6, 3.7. |
miss-islington
pushed a commit
to miss-islington/cpython
that referenced
this pull request
Sep 22, 2018
OpenSSL follows the convention that whenever you call a function, it returns an error indicator value; and if this value is negative, then you need to go look at the actual error code to see what happened. Commit c6fd1c1 introduced a small mistake in _ssl__SSLSocket_shutdown_impl: instead of checking whether the error indicator was negative, it started checking whether the actual error code was negative, and it turns out that the error codes are never negative. So the effect was that 'unwrap()' lost the ability to raise SSL errors. https://bugs.python.org/issue34759 (cherry picked from commit c0da582) Co-authored-by: Nathaniel J. Smith <njs@pobox.com>
|
GH-9491 is a backport of this pull request to the 3.7 branch. |
Contributor
|
Sorry, @njsmith, I could not cleanly backport this to |
tiran
pushed a commit
to tiran/cpython
that referenced
this pull request
Sep 22, 2018
OpenSSL follows the convention that whenever you call a function, it returns an error indicator value; and if this value is negative, then you need to go look at the actual error code to see what happened. Commit c6fd1c1 introduced a small mistake in _ssl__SSLSocket_shutdown_impl: instead of checking whether the error indicator was negative, it started checking whether the actual error code was negative, and it turns out that the error codes are never negative. So the effect was that 'unwrap()' lost the ability to raise SSL errors. https://bugs.python.org/issue34759. (cherry picked from commit c0da582) Co-authored-by: Nathaniel J. Smith <njs@pobox.com>
|
GH-9492 is a backport of this pull request to the 3.6 branch. |
miss-islington
added a commit
that referenced
this pull request
Sep 22, 2018
OpenSSL follows the convention that whenever you call a function, it returns an error indicator value; and if this value is negative, then you need to go look at the actual error code to see what happened. Commit c6fd1c1 introduced a small mistake in _ssl__SSLSocket_shutdown_impl: instead of checking whether the error indicator was negative, it started checking whether the actual error code was negative, and it turns out that the error codes are never negative. So the effect was that 'unwrap()' lost the ability to raise SSL errors. https://bugs.python.org/issue34759 (cherry picked from commit c0da582) Co-authored-by: Nathaniel J. Smith <njs@pobox.com>
miss-islington
pushed a commit
that referenced
this pull request
Sep 22, 2018
) OpenSSL follows the convention that whenever you call a function, it returns an error indicator value; and if this value is negative, then you need to go look at the actual error code to see what happened. Commit c6fd1c1 introduced a small mistake in _ssl__SSLSocket_shutdown_impl: instead of checking whether the error indicator was negative, it started checking whether the actual error code was negative, and it turns out that the error codes are never negative. So the effect was that 'unwrap()' lost the ability to raise SSL errors. https://bugs.python.org/issue34759. (cherry picked from commit c0da582) Co-authored-by: Nathaniel J. Smith <njs@pobox.com> https://bugs.python.org/issue34759
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
OpenSSL follows the convention that whenever you call a function, it
returns an error indicator value; and if this value is negative, then
you need to go look at the actual error code to see what happened.
Commit c6fd1c1 introduced a small mistake in
_ssl__SSLSocket_shutdown_impl: instead of checking whether the error
indicator was negative, it started checking whether the actual error
code was negative, and it turns out that the error codes are never
negative. So the effect was that 'unwrap()' lost the ability to raise
SSL errors.
https://bugs.python.org/issue34759