fix

youknowone · youknowone · commit f0d6e631ca14 · 2025-11-15T19:07:02.000+09:00
diff --git a/stdlib/build.rs b/stdlib/build.rs
@@ -23,25 +23,28 @@ fn main() {
         println!("cargo::rustc-check-cfg=cfg({cfg})");
     }
 
-    #[allow(clippy::unusual_byte_groupings)]
-    if let Ok(v) = std::env::var("DEP_OPENSSL_VERSION_NUMBER") {
-        println!("cargo:rustc-env=OPENSSL_API_VERSION={v}");
-        // cfg setup from openssl crate's build script
-        let version = u64::from_str_radix(&v, 16).unwrap();
-        for (ver, cfg) in ossl_vers {
-            if version >= ver {
-                println!("cargo:rustc-cfg={cfg}");
+    #[cfg(feature = "ssl-openssl")]
+    {
+        #[allow(clippy::unusual_byte_groupings)]
+        if let Ok(v) = std::env::var("DEP_OPENSSL_VERSION_NUMBER") {
+            println!("cargo:rustc-env=OPENSSL_API_VERSION={v}");
+            // cfg setup from openssl crate's build script
+            let version = u64::from_str_radix(&v, 16).unwrap();
+            for (ver, cfg) in ossl_vers {
+                if version >= ver {
+                    println!("cargo:rustc-cfg={cfg}");
+                }
             }
         }
-    }
-    if let Ok(v) = std::env::var("DEP_OPENSSL_CONF") {
-        for conf in v.split(',') {
-            println!("cargo:rustc-cfg=osslconf=\"{conf}\"");
+        if let Ok(v) = std::env::var("DEP_OPENSSL_CONF") {
+            for conf in v.split(',') {
+                println!("cargo:rustc-cfg=osslconf=\"{conf}\"");
+            }
+        }
+        // it's possible for openssl-sys to link against the system openssl under certain conditions,
+        // so let the ssl module know to only perform a probe if we're actually vendored
+        if std::env::var("DEP_OPENSSL_VENDORED").is_ok_and(|s| s == "1") {
+            println!("cargo::rustc-cfg=openssl_vendored")
         }
-    }
-    // it's possible for openssl-sys to link against the system openssl under certain conditions,
-    // so let the ssl module know to only perform a probe if we're actually vendored
-    if std::env::var("DEP_OPENSSL_VENDORED").is_ok_and(|s| s == "1") {
-        println!("cargo::rustc-cfg=openssl_vendored")
     }
 }
diff --git a/stdlib/src/ssl/cert.rs b/stdlib/src/ssl/cert.rs
@@ -1007,9 +1007,9 @@ impl ClientCertVerifier for DeferredClientCertVerifier {
     }
 
     fn client_auth_mandatory(&self) -> bool {
-        // Return false to make client auth optional during handshake
-        // This allows the handshake to complete even if client cert is invalid
-        false
+        // Delegate to inner verifier to respect CERT_REQUIRED mode
+        // This ensures client certificates are mandatory when verify_mode=CERT_REQUIRED
+        self.inner.client_auth_mandatory()
     }
 
     fn root_hint_subjects(&self) -> &[rustls::DistinguishedName] {
diff --git a/stdlib/src/ssl/compat.rs b/stdlib/src/ssl/compat.rs
@@ -238,6 +238,18 @@ pub(super) fn create_ssl_cert_verification_error(
         vm,
     )?;
 
+    // Set library and reason attributes like CPython (for test_httplib.py compatibility)
+    exc.as_object()
+        .set_attr("library", vm.ctx.new_str("SSL").as_object().to_owned(), vm)?;
+    exc.as_object().set_attr(
+        "reason",
+        vm.ctx
+            .new_str("CERTIFICATE_VERIFY_FAILED")
+            .as_object()
+            .to_owned(),
+        vm,
+    )?;
+
     Ok(exc)
 }
 
@@ -473,13 +485,13 @@ impl SslError {
         // Set library and reason attributes like CPython
         // Ignore errors as they're extremely rare (e.g., out of memory)
         let _ = exc.as_object().set_attr(
-            "_library",
+            "library",
             vm.ctx.new_str(library).as_object().to_owned(),
             vm,
         );
         let _ =
             exc.as_object()
-                .set_attr("_reason", vm.ctx.new_str(reason).as_object().to_owned(), vm);
+                .set_attr("reason", vm.ctx.new_str(reason).as_object().to_owned(), vm);
 
         exc
     }

Original file line number	Diff line number	Diff line change
`@@ -1007,9 +1007,9 @@ impl ClientCertVerifier for DeferredClientCertVerifier {`
`1007`	`1007`	`}`
`1008`	`1008`
`1009`	`1009`	`fn client_auth_mandatory(&self) -> bool {`
`1010`		`- // Return false to make client auth optional during handshake`
`1011`		`- // This allows the handshake to complete even if client cert is invalid`
`1012`		`- false`
	`1010`	`+ // Delegate to inner verifier to respect CERT_REQUIRED mode`
	`1011`	`+ // This ensures client certificates are mandatory when verify_mode=CERT_REQUIRED`
	`1012`	`+ self.inner.client_auth_mandatory()`
`1013`	`1013`	`}`
`1014`	`1014`
`1015`	`1015`	`fn root_hint_subjects(&self) -> &[rustls::DistinguishedName] {`