Skip to content

Python: skip test_parse_cert_CVE_2013_4238 under wolfSSL#333

Open
julek-wolfssl wants to merge 1 commit intowolfSSL:masterfrom
julek-wolfssl:python-null-byte-update
Open

Python: skip test_parse_cert_CVE_2013_4238 under wolfSSL#333
julek-wolfssl wants to merge 1 commit intowolfSSL:masterfrom
julek-wolfssl:python-null-byte-update

Conversation

@julek-wolfssl
Copy link
Copy Markdown
Member

wolfSSL now rejects NUL bytes in dNSName/rfc822Name/URI SAN entries
during ASN.1 decoding (RFC 5280 4.2.1.6), so loading nullbytecert.pem
raises ssl.SSLError instead of returning the SAN list with the embedded
NULs preserved. Update the 3.12.11, 3.13.4, and 3.13.7 patches so the
test asserts the SSLError and returns early, dropping the now-dead
wolfSSL-specific SAN comparison branch.

wolfSSL now rejects NUL bytes in dNSName/rfc822Name/URI SAN entries
during ASN.1 decoding (RFC 5280 4.2.1.6), so loading nullbytecert.pem
raises ssl.SSLError instead of returning the SAN list with the embedded
NULs preserved. Update the 3.12.11, 3.13.4, and 3.13.7 patches so the
test asserts the SSLError and returns early, dropping the now-dead
wolfSSL-specific SAN comparison branch.
@julek-wolfssl
Copy link
Copy Markdown
Member Author

Updates expected behaviour for wolfSSL/wolfssl#10279

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates the wolfSSL-specific Python patch sets to reflect stricter SAN parsing behavior (wolfSSL now rejects embedded NUL bytes during ASN.1 decoding), aligning the affected CPython SSL test with the new behavior.

Changes:

  • Update test_parse_cert_CVE_2013_4238 to assert ssl.SSLError under wolfSSL and return early.
  • Remove the now-obsolete wolfSSL-only SAN tuple comparison branch in that test across the maintained patch versions.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
Python/wolfssl-python-3.13.7.patch Adjusts test_parse_cert_CVE_2013_4238 to expect an SSLError under wolfSSL due to NUL-byte SAN rejection.
Python/wolfssl-python-3.13.4.patch Same test adjustment as 3.13.7, applied to the 3.13.4 patch set.
Python/wolfssl-python-3.12.11.patch Same test adjustment as 3.13.x, applied to the 3.12.11 patch set.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants