Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ssl: Fix locking in cert_store_stats and get_ca_certs #114572

Closed
davidben opened this issue Jan 25, 2024 · 1 comment
Closed

ssl: Fix locking in cert_store_stats and get_ca_certs #114572

davidben opened this issue Jan 25, 2024 · 1 comment
Labels
type-bug An unexpected behavior, bug, or error

Comments

@davidben
Copy link
Contributor

davidben commented Jan 25, 2024 •
edited by bedevere-app bot

Bug report

Bug description:

Filing this to attach a PR to.

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with X509_STORE_get0_objects, but reading the result requires a lock. See openssl/openssl#23224 for details.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux, macOS

Linked PRs
@davidben davidben added the type-bug An unexpected behavior, bug, or error label Jan 25, 2024
davidben added a commit to davidben/cpython that referenced this issue Jan 25, 2024
@davidben
pythongh-114572: Fix locking in cert_store_stats and get_ca_certs
529311e 
cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.
@bedevere-app bedevere-app bot mentioned this issue Jan 25, 2024
Merged
alex pushed a commit that referenced this issue Feb 16, 2024
@davidben
gh-114572: Fix locking in cert_store_stats and get_ca_certs (#114573)
bce6931 
* gh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Feb 16, 2024
@davidben @miss-islington
pythongh-114572: Fix locking in cert_store_stats and get_ca_certs (py…
5ecee31 
…thonGH-114573)

* pythongh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
@miss-islington miss-islington mentioned this issue Feb 16, 2024
Merged
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Feb 16, 2024
@davidben @miss-islington
pythongh-114572: Fix locking in cert_store_stats and get_ca_certs (py…
597d1bf 
…thonGH-114573)

* pythongh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
This was referenced Feb 16, 2024
Merged
Merged
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Feb 16, 2024
@davidben @miss-islington
pythongh-114572: Fix locking in cert_store_stats and get_ca_certs (py…
fa5c6d1 
…thonGH-114573)

* pythongh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
pablogsal pushed a commit that referenced this issue Feb 20, 2024
@miss-islington @davidben
[3.11] gh-114572: Fix locking in cert_store_stats and get_ca_certs (G…
01c37f1 
…H-114573) (#115549)

gh-114572: Fix locking in cert_store_stats and get_ca_certs (GH-114573)

* gh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
pablogsal pushed a commit that referenced this issue Feb 20, 2024
@miss-islington @davidben
[3.10] gh-114572: Fix locking in cert_store_stats and get_ca_certs (G…
37324b4 
…H-114573) (#115548)

gh-114572: Fix locking in cert_store_stats and get_ca_certs (GH-114573)

* gh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
encukou pushed a commit that referenced this issue Feb 29, 2024
@miss-islington @davidben
[3.12] gh-114572: Fix locking in cert_store_stats and get_ca_certs (G…
542f327 
…H-114573) (GH-115547)

gh-114572: Fix locking in cert_store_stats and get_ca_certs (GH-114573)

* gh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
@hugovk
Copy link
Member

hugovk commented Mar 15, 2024

Closing as the PR has been merged and backported. Thanks!

@hugovk hugovk closed this as completed Mar 15, 2024
@dongsupark dongsupark mentioned this issue Mar 25, 2024
Closed
diegorusso pushed a commit to diegorusso/cpython that referenced this issue Apr 17, 2024
@davidben @diegorusso
pythongh-114572: Fix locking in cert_store_stats and get_ca_certs (py…
eedb7c2 
…thon#114573)

* pythongh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
sethmlarson added a commit to sethmlarson/cpython that referenced this issue Apr 19, 2024
@sethmlarson
[3.9] pythongh-114572: Fix locking in cert_store_stats and get_ca_certs
732c7d5
@bedevere-app bedevere-app bot mentioned this issue Apr 19, 2024
Merged
sethmlarson added a commit to sethmlarson/cpython that referenced this issue Apr 30, 2024
@sethmlarson
[3.8] [3.9] pythongh-114572: Fix locking in cert_store_stats and get_…
e8268b1 
…ca_certs

(cherry picked from commit 732c7d5)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app bedevere-app bot mentioned this issue Apr 30, 2024
Merged
ambv pushed a commit that referenced this issue May 10, 2024
@sethmlarson
[3.8] gh-114572: Fix locking in cert_store_stats and get_ca_certs (#1…
29c9728 
…18442)

(cherry picked from commit 732c7d5)
ambv pushed a commit that referenced this issue May 10, 2024
@sethmlarson
[3.9] gh-114572: Fix locking in cert_store_stats and get_ca_certs (#1…
b228655 
…18109)
gentoo-bot pushed a commit to gentoo/cpython that referenced this issue May 21, 2024
@miss-islington @davidben @mgorny
[3.10] pythongh-114572: Fix locking in cert_store_stats and get_ca_ce…
8ed9d5e 
…rts (pythonGH-114573) (python#115548)

pythongh-114572: Fix locking in cert_store_stats and get_ca_certs (pythonGH-114573)

* pythongh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
gentoo-bot pushed a commit to gentoo/cpython that referenced this issue May 21, 2024
@miss-islington @davidben @mgorny
[3.10] pythongh-114572: Fix locking in cert_store_stats and get_ca_ce…
a6a90ca 
…rts (pythonGH-114573) (python#115548)

pythongh-114572: Fix locking in cert_store_stats and get_ca_certs (pythonGH-114573)

* pythongh-114572: Fix locking in cert_store_stats and get_ca_certs

cert_store_stats and get_ca_certs query the SSLContext's X509_STORE with
X509_STORE_get0_objects, but reading the result requires a lock. See
openssl/openssl#23224 for details.

Instead, use X509_STORE_get1_objects, newly added in that PR.
X509_STORE_get1_objects does not exist in current OpenSSLs, but we can
polyfill it with X509_STORE_lock and X509_STORE_unlock.

* Work around const-correctness problem

* Add missing X509_STORE_get1_objects failure check

* Add blurb
(cherry picked from commit bce6931)

Co-authored-by: David Benjamin <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type-bug An unexpected behavior, bug, or error
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@davidben @hugovk