Let's update ssl error codes

[dimaqq]

BPO	39953
Nosy	@tiran, @benjaminp, @alex, @ambv, @dimaqq, @dstufft, @aixtools, @asottile, @eamanu, @miss-islington, @shihai1991
PRs	closes bpo-39953: Update OpenSSL error codes table. #19082 [3.8] closes bpo-39953: Update OpenSSL error codes table. (GH-19082) #19478 closes bpo-39953: Generate ifdefs around library code definitions. #19490 [3.8] closes bpo-39953: Generate ifdefs around library code definitions. (GH-19490) #19491 [3.8] closes bpo-40266, closes bpo-39953: Use numeric lib code if compiling against old OpenSSL. (GH-19506) #19507

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2020-04-14.03:11:51.487>
created_at = <Date 2020-03-13.04:07:50.824>
labels = ['extension-modules', 'build', '3.8', '3.9', 'release-blocker']
title = "Let's update ssl error codes"
updated_at = <Date 2020-04-16.13:35:40.938>
user = 'https://github.com/dimaqq'

bugs.python.org fields:

activity = <Date 2020-04-16.13:35:40.938>
actor = 'Michael.Felt'
assignee = 'none'
closed = True
closed_date = <Date 2020-04-14.03:11:51.487>
closer = 'benjamin.peterson'
components = ['Extension Modules']
creation = <Date 2020-03-13.04:07:50.824>
creator = 'Dima.Tisnek'
dependencies = []
files = []
hgrepos = []
issue_num = 39953
keywords = ['patch']
message_count = 19.0
messages = ['364074', '366218', '366219', '366229', '366234', '366261', '366262', '366263', '366318', '366346', '366358', '366359', '366361', '366511', '366513', '366515', '366527', '366553', '366596']
nosy_count = 13.0
nosy_names = ['janssen', 'christian.heimes', 'benjamin.peterson', 'alex', 'SilentGhost', 'lukasz.langa', 'Dima.Tisnek', 'dstufft', 'Michael.Felt', 'Anthony Sottile', 'eamanu', 'miss-islington', 'shihai1991']
pr_nums = ['19082', '19478', '19490', '19491', '19507']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'compile error'
url = 'https://bugs.python.org/issue39953'
versions = ['Python 3.8', 'Python 3.9']

[dimaqq]

Let's consider ssl error 291 (https://bugs.python.org/issue39951):

It was introduced into openssl 2 years ago: openssl/openssl@358ffa0

The documentation states:
SSL_R_APPLICATION_DATA_AFTER_CLOSE_NOTIFY:291:\
application data after close notify

The ssl.h header file contains:

define SSL_R_APPLICATION_DATA_AFTER_CLOSE_NOTIFY 291

The master branch of openssl contains this definition too:
https://github.com/openssl/openssl/blob/master/include/openssl/sslerr.h
# define SSL_R_APPLICATION_DATA_AFTER_CLOSE_NOTIFY 291

But what does Python say?
ssl.SSLError: [SSL: KRB5_S_INIT] application data after close notify (_ssl.c:2629)

What's KRB5? It supposedly stands for Kerberos5, and it too is seemingly present in openssl header file:
/usr/local/Cellar/openssl/1.0.2s/include/openssl/ssl.h
2951:# define SSL_R_KRB5_S_INIT 291

Moreover, cpython source code contains a fallback, should this value not be defined:
https://github.com/python/cpython/blob/master/Modules/_ssl_data.h
  #ifdef SSL_R_KRB5_S_INIT
    {"KRB5_S_INIT", ERR_LIB_SSL, SSL_R_KRB5_S_INIT},
  #else
    {"KRB5_S_INIT", ERR_LIB_SSL, 291},
  #endif

Thus, today, Python reports an error with wrong *label* but correct *text*:
[SSL: KRB5_S_INIT] application data after close notify

The label and text don't match each other, because... well... I guess that's why we should fix it :)

[benjaminp]

New changeset 3e0dd37 by Benjamin Peterson in branch 'master':
closes bpo-39953: Update OpenSSL error codes table. (GH-19082)
3e0dd37

[miss-islington]

New changeset 2714c90 by Miss Islington (bot) in branch '3.8':
closes bpo-39953: Update OpenSSL error codes table. (GH-19082)
2714c90

[shihai1991]

Got some compiling error of _ssl extension module in my vm after PR19082 merged:
building '_ssl' extension
gcc -pthread -Wno-unused-result -Wsign-compare -g -Og -Wall -fPIC -I./Include -I. -I/usr/local/include -I/temp/shihai/cpython/Include -I/temp/shihai/cpython -c /temp/shihai/cpython/Modules/_ssl.c -o build/temp.linux-x86_64-3.9-pydebug/temp/shihai/cpython/Modules/_ssl.o
In file included from /temp/shihai/cpython/Modules/_ssl.c:136:
/temp/shihai/cpython/Modules/_ssl_data.h:6:15: error: ‘ERR_LIB_ASYNC’ undeclared here (not in a function); did you mean ‘ERR_LIB_ASN1’?
6 | {"ASYNC", ERR_LIB_ASYNC},
| ^~~~~~~~~~~~~
| ERR_LIB_ASN1
/temp/shihai/cpython/Modules/_ssl_data.h:13:12: error: ‘ERR_LIB_CT’ undeclared here (not in a function); did you mean ‘ERR_LIB_CMS’?
13 | {"CT", ERR_LIB_CT},
| ^~~~~~~~~~
| ERR_LIB_CMS
/temp/shihai/cpython/Modules/_ssl_data.h:19:13: error: ‘ERR_LIB_KDF’ undeclared here (not in a function); did you mean ‘ERR_LIB_BUF’?
19 | {"KDF", ERR_LIB_KDF},
| ^~~~~~~~~~~
| ERR_LIB_BUF
In file included from /temp/shihai/cpython/Modules/_ssl.c:136:
/temp/shihai/cpython/Modules/_ssl_data.h:598:28: warning: initialization of ‘int’ from ‘struct py_ssl_library_code *’ makes integer from pointer without a cast [-Wint-conversion]
598 | {"FAILED_TO_SET_POOL", ERR_LIB_ASYNC, 101},
| ^~~~~~~~~~~~~
/temp/shihai/cpython/Modules/_ssl_data.h:598:28: note: (near initialization for ‘error_codes[112].library’)
/temp/shihai/cpython/Modules/_ssl_data.h:598:28: error: initializer element is not constant
/temp/shihai/cpython/Modules/_ssl_data.h:598:28: note: (near initialization for ‘error_codes[112].library’)
/temp/shihai/cpython/Modules/_ssl_data.h:603:32: warning: initialization of ‘int’ from ‘struct py_ssl_library_code *’ makes integer from pointer without a cast [-Wint-conversion]
603 | {"FAILED_TO_SWAP_CONTEXT", ERR_LIB_ASYNC, 102},

[tiran]

The PR broke backwards compatibility with OpenSSL 1.0.2 and LibreSSL. OpenSSL 1.1.x introduced new error codes or reused existing numbers for different errors codes.

Although OpenSSL 1.0.2 has reached EOL we should keep keep Python 3.8 and 3.9 compatible with the API.