From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Thu, 3 Aug 2023 14:09:27 +0000 (-0700)
Subject: [3.11] gh-107077: Raise SSLCertVerificationError even if the error is set via SSL_ERR... 
X-Git-Tag: v3.11.5~98
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4f65f03f2d597881e1a805e91579d10889299a3d;p=thirdparty%2FPython%2Fcpython.git

[3.11] gh-107077: Raise SSLCertVerificationError even if the error is set via SSL_ERROR_SYSCALL (GH-107586) (#107588)

Co-authored-by: Pablo Galindo Salgado <Pablogsal@gmail.com>
Co-authored-by: T. Wouters <thomas@python.org>
---

diff --git a/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst b/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst
new file mode 100644
index 000000000000..ecaf437a48e0
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2023-08-03-12-52-19.gh-issue-107077.-pzHD6.rst
@@ -0,0 +1,6 @@
+Seems that in some conditions, OpenSSL will return ``SSL_ERROR_SYSCALL``
+instead of ``SSL_ERROR_SSL`` when a certification verification has failed,
+but the error parameters will still contain ``ERR_LIB_SSL`` and
+``SSL_R_CERTIFICATE_VERIFY_FAILED``. We are now detecting this situation and
+raising the appropiate ``ssl.SSLCertVerificationError``. Patch by Pablo
+Galindo
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 092572239244..4ccd1240bac3 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -650,6 +650,10 @@ PySSL_SetError(PySSLSocket *sslsock, int ret, const char *filename, int lineno)
                     errstr = "Some I/O error occurred";
                 }
             } else {
+                if (ERR_GET_LIB(e) == ERR_LIB_SSL &&
+                        ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) {
+                    type = state->PySSLCertVerificationErrorObject;
+                }
                 p = PY_SSL_ERROR_SYSCALL;
             }
             break;