Mailman 3 January 2012 - Python-checkins

cpython (3.2): Clarify that ssl.OP_ALL can be different from OpenSSL's SSL_OP_ALL.
by antoine.pitrou Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/f8f9724e427c changeset: 74650:f8f9724e427c branch: 3.2 parent: 74648:4386686a035d user: Antoine Pitrou <solipsis(a)pitrou.net> date: Fri Jan 27 10:02:55 2012 +0100 summary: Clarify that ssl.OP_ALL can be different from OpenSSL's SSL_OP_ALL. files: Doc/library/ssl.rst | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -316,7 +316,8 @@ .. data:: OP_ALL Enables workarounds for various bugs present in other SSL implementations. - This option is set by default. + This option is set by default. It does not necessarily set the same + flags as OpenSSL's ``SSL_OP_ALL`` constant. .. versionadded:: 3.2 -- Repository URL: http://hg.python.org/cpython

1 0

cpython (merge 3.2 -> default): Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV
by antoine.pitrou Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/d1390175fdc6 changeset: 74649:d1390175fdc6 parent: 74644:082eea3fc9bc parent: 74648:4386686a035d user: Antoine Pitrou <solipsis(a)pitrou.net> date: Fri Jan 27 09:53:29 2012 +0100 summary: Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. files: Misc/NEWS | 3 +++ Modules/_ssl.c | 6 ++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS --- a/Misc/NEWS +++ b/Misc/NEWS @@ -461,6 +461,9 @@ Library ------- +- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC + IV attack countermeasure. + - Issue #13847: time.localtime() and time.gmtime() now raise an OSError instead of ValueError on failure. time.ctime() and time.asctime() now raises an OSError if localtime() failed. time.clock() now raises a RuntimeError if the diff --git a/Modules/_ssl.c b/Modules/_ssl.c --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1566,7 +1566,8 @@ self->ctx = ctx; /* Defaults */ SSL_CTX_set_verify(self->ctx, SSL_VERIFY_NONE, NULL); - SSL_CTX_set_options(self->ctx, SSL_OP_ALL); + SSL_CTX_set_options(self->ctx, + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); #define SID_CTX "Python" SSL_CTX_set_session_id_context(self->ctx, (const unsigned char *) SID_CTX, @@ -2533,7 +2534,8 @@ PY_SSL_VERSION_TLS1); /* protocol options */ - PyModule_AddIntConstant(m, "OP_ALL", SSL_OP_ALL); + PyModule_AddIntConstant(m, "OP_ALL", + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); PyModule_AddIntConstant(m, "OP_NO_SSLv2", SSL_OP_NO_SSLv2); PyModule_AddIntConstant(m, "OP_NO_SSLv3", SSL_OP_NO_SSLv3); PyModule_AddIntConstant(m, "OP_NO_TLSv1", SSL_OP_NO_TLSv1); -- Repository URL: http://hg.python.org/cpython

1 0

cpython (3.1): Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV
by antoine.pitrou Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/e7706bdaaa0d changeset: 74647:e7706bdaaa0d branch: 3.1 parent: 74538:73dad4940b88 user: Antoine Pitrou <solipsis(a)pitrou.net> date: Fri Jan 27 09:48:47 2012 +0100 summary: Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. files: Misc/NEWS | 3 +++ Modules/_ssl.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS --- a/Misc/NEWS +++ b/Misc/NEWS @@ -13,6 +13,9 @@ Library ------- +- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC + IV attack countermeasure. + - Issue #11603: Fix a crash when __str__ is rebound as __repr__. Patch by Andreas Stührk. diff --git a/Modules/_ssl.c b/Modules/_ssl.c --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -365,7 +365,8 @@ } /* ssl compatibility */ - SSL_CTX_set_options(self->ctx, SSL_OP_ALL); + SSL_CTX_set_options(self->ctx, + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); verification_mode = SSL_VERIFY_NONE; if (certreq == PY_SSL_CERT_OPTIONAL) -- Repository URL: http://hg.python.org/cpython

1 0

cpython (merge 3.1 -> 3.2): Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV
by antoine.pitrou Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/4386686a035d changeset: 74648:4386686a035d branch: 3.2 parent: 74639:90368391f0f9 parent: 74647:e7706bdaaa0d user: Antoine Pitrou <solipsis(a)pitrou.net> date: Fri Jan 27 09:50:45 2012 +0100 summary: Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. files: Misc/NEWS | 3 +++ Modules/_ssl.c | 6 ++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS --- a/Misc/NEWS +++ b/Misc/NEWS @@ -111,6 +111,9 @@ Library ------- +- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC + IV attack countermeasure. + - Issue #13772: In os.symlink() under Windows, do not try to guess the link target's type (file or directory). The detection was buggy and made the call non-atomic (therefore prone to race conditions). diff --git a/Modules/_ssl.c b/Modules/_ssl.c --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -1481,7 +1481,8 @@ self->ctx = ctx; /* Defaults */ SSL_CTX_set_verify(self->ctx, SSL_VERIFY_NONE, NULL); - SSL_CTX_set_options(self->ctx, SSL_OP_ALL); + SSL_CTX_set_options(self->ctx, + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); #define SID_CTX "Python" SSL_CTX_set_session_id_context(self->ctx, (const unsigned char *) SID_CTX, @@ -2143,7 +2144,8 @@ PY_SSL_VERSION_TLS1); /* protocol options */ - PyModule_AddIntConstant(m, "OP_ALL", SSL_OP_ALL); + PyModule_AddIntConstant(m, "OP_ALL", + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); PyModule_AddIntConstant(m, "OP_NO_SSLv2", SSL_OP_NO_SSLv2); PyModule_AddIntConstant(m, "OP_NO_SSLv3", SSL_OP_NO_SSLv3); PyModule_AddIntConstant(m, "OP_NO_TLSv1", SSL_OP_NO_TLSv1); -- Repository URL: http://hg.python.org/cpython

1 0

cpython (merge 2.6 -> 2.7): Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV
by antoine.pitrou Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/8dec547c23d3 changeset: 74646:8dec547c23d3 branch: 2.7 parent: 74637:f18662285248 parent: 74645:9a4131ada792 user: Antoine Pitrou <solipsis(a)pitrou.net> date: Fri Jan 27 09:44:08 2012 +0100 summary: Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. files: Misc/NEWS | 3 +++ Modules/_ssl.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS --- a/Misc/NEWS +++ b/Misc/NEWS @@ -90,6 +90,9 @@ Library ------- +- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC + IV attack countermeasure. + - Issue #6631: Disallow relative file paths in urllib urlopen methods. - Issue #13781: Prevent gzip.GzipFile from using the dummy filename provided by diff --git a/Modules/_ssl.c b/Modules/_ssl.c --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -369,7 +369,8 @@ } /* ssl compatibility */ - SSL_CTX_set_options(self->ctx, SSL_OP_ALL); + SSL_CTX_set_options(self->ctx, + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); verification_mode = SSL_VERIFY_NONE; if (certreq == PY_SSL_CERT_OPTIONAL) -- Repository URL: http://hg.python.org/cpython

1 0

cpython (2.6): Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV
by antoine.pitrou Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/9a4131ada792 changeset: 74645:9a4131ada792 branch: 2.6 parent: 73245:62fa61f2ee7d user: Antoine Pitrou <solipsis(a)pitrou.net> date: Fri Jan 27 09:42:45 2012 +0100 summary: Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC IV attack countermeasure. files: Misc/NEWS | 3 +++ Modules/_ssl.c | 3 ++- 2 files changed, 5 insertions(+), 1 deletions(-) diff --git a/Misc/NEWS b/Misc/NEWS --- a/Misc/NEWS +++ b/Misc/NEWS @@ -13,6 +13,9 @@ Library ------- +- Issue #13885: CVE-2011-3389: the _ssl module would always disable the CBC + IV attack countermeasure. + What's New in Python 2.6.7? =========================== diff --git a/Modules/_ssl.c b/Modules/_ssl.c --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -357,7 +357,8 @@ } /* ssl compatibility */ - SSL_CTX_set_options(self->ctx, SSL_OP_ALL); + SSL_CTX_set_options(self->ctx, + SSL_OP_ALL & ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS); verification_mode = SSL_VERIFY_NONE; if (certreq == PY_SSL_CERT_OPTIONAL) -- Repository URL: http://hg.python.org/cpython

1 0

Daily reference leaks (082eea3fc9bc): sum=0
by solipsis＠pitrou.net Jan. 27, 2012

Jan. 27, 2012

results for 082eea3fc9bc on branch "default" -------------------------------------------- Command line was: ['./python', '-m', 'test.regrtest', '-uall', '-R', '3:3:/home/antoine/cpython/refleaks/reflogxesYJK', '-x']

1 0

cpython (merge default -> default): Merge
by brett.cannon Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/082eea3fc9bc changeset: 74644:082eea3fc9bc parent: 74643:ecf4a7bb8807 parent: 74642:856f0864437a user: Brett Cannon <brett(a)python.org> date: Thu Jan 26 19:09:44 2012 -0500 summary: Merge files: Lib/test/test_time.py | 27 +++++++++++++-------- Misc/NEWS | 3 +- Modules/timemodule.c | 38 ++++++++++++++++++++++-------- 3 files changed, 45 insertions(+), 23 deletions(-) diff --git a/Lib/test/test_time.py b/Lib/test/test_time.py --- a/Lib/test/test_time.py +++ b/Lib/test/test_time.py @@ -309,7 +309,7 @@ for t in (-2, -1, 0, 1): try: tt = time.localtime(t) - except (OverflowError, ValueError): + except (OverflowError, OSError): pass else: self.assertEqual(time.mktime(tt), t) @@ -345,16 +345,21 @@ def test_localtime_failure(self): # Issue #13847: check for localtime() failure - invalid_time_t = 2**60 - try: - time.localtime(invalid_time_t) - except ValueError as err: - if str(err) == "timestamp out of range for platform time_t": - self.skipTest("need 64-bit time_t") - else: - raise - except OSError: - pass + invalid_time_t = None + for time_t in (-1, 2**30, 2**33, 2**60): + try: + time.localtime(time_t) + except ValueError as err: + if str(err) == "timestamp out of range for platform time_t": + self.skipTest("need 64-bit time_t") + else: + raise + except OSError: + invalid_time_t = time_t + break + if invalid_time_t is None: + self.skipTest("unable to find an invalid time_t value") + self.assertRaises(OSError, time.localtime, invalid_time_t) self.assertRaises(OSError, time.gmtime, invalid_time_t) self.assertRaises(OSError, time.ctime, invalid_time_t) diff --git a/Misc/NEWS b/Misc/NEWS --- a/Misc/NEWS +++ b/Misc/NEWS @@ -463,7 +463,8 @@ - Issue #13847: time.localtime() and time.gmtime() now raise an OSError instead of ValueError on failure. time.ctime() and time.asctime() now raises an - OSError if localtime() failed. + OSError if localtime() failed. time.clock() now raises a RuntimeError if the + processor time used is not available or its value cannot be represented - Issue #13862: Fix spurious failure in test_zlib due to runtime/compile time minor versions not matching. diff --git a/Modules/timemodule.c b/Modules/timemodule.c --- a/Modules/timemodule.c +++ b/Modules/timemodule.c @@ -62,6 +62,31 @@ Return the current time in seconds since the Epoch.\n\ Fractions of a second may be present if the system clock provides them."); +#if defined(HAVE_CLOCK) + +#ifndef CLOCKS_PER_SEC +#ifdef CLK_TCK +#define CLOCKS_PER_SEC CLK_TCK +#else +#define CLOCKS_PER_SEC 1000000 +#endif +#endif + +static PyObject * +pyclock(void) +{ + clock_t value; + value = clock(); + if (value == (clock_t)-1) { + PyErr_SetString(PyExc_RuntimeError, + "the processor time used is not available " + "or its value cannot be represented"); + return NULL; + } + return PyFloat_FromDouble((double)value / CLOCKS_PER_SEC); +} +#endif /* HAVE_CLOCK */ + #if defined(MS_WINDOWS) && !defined(__BORLANDC__) /* Win32 has better clock replacement; we have our own version, due to Mark Hammond and Tim Peters */ @@ -79,8 +104,7 @@ if (!QueryPerformanceFrequency(&freq) || freq.QuadPart == 0) { /* Unlikely to happen - this works on all intel machines at least! Revert to clock() */ - return PyFloat_FromDouble(((double)clock()) / - CLOCKS_PER_SEC); + return pyclock(); } divisor = (double)freq.QuadPart; } @@ -91,18 +115,10 @@ #elif defined(HAVE_CLOCK) -#ifndef CLOCKS_PER_SEC -#ifdef CLK_TCK -#define CLOCKS_PER_SEC CLK_TCK -#else -#define CLOCKS_PER_SEC 1000000 -#endif -#endif - static PyObject * time_clock(PyObject *self, PyObject *unused) { - return PyFloat_FromDouble(((double)clock()) / CLOCKS_PER_SEC); + return pyclock(); } #endif /* HAVE_CLOCK */ -- Repository URL: http://hg.python.org/cpython

1 0

cpython: Relocate importlib._case_ok to importlib._bootstrap.
by brett.cannon Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/ecf4a7bb8807 changeset: 74643:ecf4a7bb8807 parent: 74638:dc3de15b43db user: Brett Cannon <brett(a)python.org> date: Thu Jan 26 19:03:52 2012 -0500 summary: Relocate importlib._case_ok to importlib._bootstrap. This required updating the code to use posix instead of os. This is all being done to make bootstrapping easier to removing dependencies that are kept in importlib.__init__ and thus outside of the single file to bootstrap from. files: Lib/importlib/__init__.py | 19 ----------------- Lib/importlib/_bootstrap.py | 27 +++++++++++++++++++++++++ 2 files changed, 27 insertions(+), 19 deletions(-) diff --git a/Lib/importlib/__init__.py b/Lib/importlib/__init__.py --- a/Lib/importlib/__init__.py +++ b/Lib/importlib/__init__.py @@ -33,25 +33,6 @@ # Bootstrap help ##################################################### -# TODO: Expose from import.c, else handle encode/decode as _os.environ returns -# bytes. -def _case_ok(directory, check): - """Check if the directory contains something matching 'check'. - - No check is done if the file/directory exists or not. - - """ - if 'PYTHONCASEOK' in os.environ: - return True - if not directory: - directory = os.getcwd() - if check in os.listdir(directory): - return True - return False - -_bootstrap._case_ok = _case_ok - - # Required built-in modules. try: import posix as _os diff --git a/Lib/importlib/_bootstrap.py b/Lib/importlib/_bootstrap.py --- a/Lib/importlib/_bootstrap.py +++ b/Lib/importlib/_bootstrap.py @@ -18,6 +18,33 @@ # Bootstrap-related code ###################################################### +# TODO: when not on any of these platforms, replace _case_ok() w/ +# ``lambda x,y: True``. +CASE_OK_PLATFORMS = 'win', 'cygwin', 'darwin' + +def _case_ok(directory, check): + """Check if the directory contains something matching 'check' + case-sensitively when running on Windows or OS X. + + If running on Window or OS X and PYTHONCASEOK is a defined environment + variable then no case-sensitive check is performed. No check is done to see + if what is being checked for exists, so if the platform is not Windows or + OS X then assume the case is fine. + + """ + if (any(map(sys.platform.startswith, CASE_OK_PLATFORMS)) and + b'PYTHONCASEOK' not in _os.environ): + if not directory: + directory = '.' + if check in _os.listdir(directory): + return True + else: + return False + else: + return True + + + # TODO: Expose from marshal def _w_long(x): """Convert a 32-bit integer to little-endian. -- Repository URL: http://hg.python.org/cpython

1 0

cpython: Issue #13847: Make test_localtime_failure() more robust
by victor.stinner Jan. 27, 2012

Jan. 27, 2012

http://hg.python.org/cpython/rev/856f0864437a changeset: 74642:856f0864437a user: Victor Stinner <victor.stinner(a)haypocalc.com> date: Fri Jan 27 01:03:25 2012 +0100 summary: Issue #13847: Make test_localtime_failure() more robust Skip the test if we are unable to find an invalid time_t value. files: Lib/test/test_time.py | 25 +++++++++++++++---------- 1 files changed, 15 insertions(+), 10 deletions(-) diff --git a/Lib/test/test_time.py b/Lib/test/test_time.py --- a/Lib/test/test_time.py +++ b/Lib/test/test_time.py @@ -345,16 +345,21 @@ def test_localtime_failure(self): # Issue #13847: check for localtime() failure - invalid_time_t = 2**60 - try: - time.localtime(invalid_time_t) - except ValueError as err: - if str(err) == "timestamp out of range for platform time_t": - self.skipTest("need 64-bit time_t") - else: - raise - except OSError: - pass + invalid_time_t = None + for time_t in (-1, 2**30, 2**33, 2**60): + try: + time.localtime(time_t) + except ValueError as err: + if str(err) == "timestamp out of range for platform time_t": + self.skipTest("need 64-bit time_t") + else: + raise + except OSError: + invalid_time_t = time_t + break + if invalid_time_t is None: + self.skipTest("unable to find an invalid time_t value") + self.assertRaises(OSError, time.localtime, invalid_time_t) self.assertRaises(OSError, time.gmtime, invalid_time_t) self.assertRaises(OSError, time.ctime, invalid_time_t) -- Repository URL: http://hg.python.org/cpython

1 0