GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — bpo-41561: Add workaround for Ubuntu's custom security level by tiran · Pull Request #24915 · python/cpython

Conversation

@tiran

@tiran tiran commented Mar 18, 2021 •
edited by miss-islington
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See: https://bugs.python.org/issue43382
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes [email protected]

https://bugs.python.org/issue41561

Automerge-Triggered-By: GH:tiran

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@tiran tiran added needs backport to 3.7 labels Mar 18, 2021
@the-knights-who-say-ni the-knights-who-say-ni added the CLA signed label Mar 18, 2021
@bedevere-bot bedevere-bot added the awaiting core review label Mar 18, 2021
@tiran
tiran force-pushed the bpo-41561-ubuntu-ssl branch 2 times, most recently from c5881ef to 23ee4b1 Compare March 18, 2021 10:24
@tiran
bpo-41561: Add workaround for Ubuntu's custom security level
6a96b30 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See: https://bugs.python.org/issue43382
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <[email protected]>
@tiran
tiran force-pushed the bpo-41561-ubuntu-ssl branch from 23ee4b1 to 6a96b30 Compare March 18, 2021 10:28
@tiran
tiran marked this pull request as ready for review March 18, 2021 10:29
@tiran
tiran requested review from brandtbucher and gpshead March 18, 2021 10:29
tiran
tiran commented Mar 18, 2021
View reviewed changes
Comment thread Lib/test/test_ssl.py Outdated
def is_ubuntu():
try:
# assume that any references of "ubuntu" implies Ubuntu-like distro
with open("/etc/os-release") as f:

@tiran tiran Mar 18, 2021

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm deliberately not using platform.freedesktop_os_release() here. The function is 3.10-only and I want to backport the fix to 3.7 to 3.9.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@brandtbucher brandtbucher Mar 18, 2021

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed that platform.freedesktop_os_release() opens with encoding="utf-8" and also checks /usr/lib/os-release. Are either of those steps necessary here?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@gpshead gpshead Mar 18, 2021

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shouldn't we be more specific than "is_ubuntu"? which particular versions. 20.04 yes. but what about others? do they still do this in 20.10 and (soon to be replaced by) 21.04? what about 18.04? have we heard back on the upstream ubuntu issues about the future of their apparently uncommon implementation choice?

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@tiran tiran Mar 18, 2021

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll add encoding="utf-8". The check for /usr/lib/os-release is not necessary on Ubuntu. /etc/os-release always exists.

I don't want to spend more time on this issue than necessary. I have already spent way to much time on a platform that I don't even use. The approach isn't perfect but good enough to fix testing on Ubuntu.

20.04, 20.10, and 21.04 are definitely affected. The man page https://manpages.ubuntu.com/manpages/hirsute/man3/SSL_CTX_set_security_level.3ssl.html is a good indicator. If you see On Ubuntu, TLS versions below 1.2 are not permitted. then the custom policy applies.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
brandtbucher
brandtbucher approved these changes Mar 18, 2021
View reviewed changes

@brandtbucher brandtbucher left a comment

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know very little nothing about OpenSSL/TLS, but the rest looks good!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
Comment thread .github/workflows/build.yml Resolved

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot added awaiting merge and removed awaiting core review labels Mar 18, 2021
@tiran
Open with utf-8 encoding
719f100
gpshead
gpshead approved these changes Mar 18, 2021
View reviewed changes
@tiran

tiran commented Mar 18, 2021

Copy link
Copy Markdown
Member Author

Thanks @gpshead and @brandtbucher
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@tiran tiran added the 🤖 automerge label Mar 18, 2021
@miss-islington
miss-islington merged commit f6c6b58 into python:master Mar 18, 2021
@miss-islington

miss-islington commented Mar 18, 2021

Copy link
Copy Markdown
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the awaiting merge label Mar 18, 2021
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 18, 2021
@tiran @miss-islington
bpo-41561: Add workaround for Ubuntu's custom security level (pythonG…
2393fb6 
…H-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <[email protected]>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <[email protected]>
@bedevere-bot bedevere-bot removed the needs backport to 3.9 label Mar 18, 2021
@bedevere-bot

bedevere-bot commented Mar 18, 2021

Copy link
Copy Markdown

GH-24925 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 18, 2021
@tiran @miss-islington
bpo-41561: Add workaround for Ubuntu's custom security level (pythonG…
578805c 
…H-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <[email protected]>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <[email protected]>
@bedevere-bot

bedevere-bot commented Mar 18, 2021

Copy link
Copy Markdown

GH-24926 is a backport of this pull request to the 3.8 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the needs backport to 3.8 label Mar 18, 2021
@miss-islington

miss-islington commented Mar 18, 2021

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker f6c6b5821bff815bdc810de53992fd1fbdb2edd4 3.7
tiran reacted with confused emoji
All reactions
  • 😕 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington miss-islington self-assigned this Mar 18, 2021
miss-islington added a commit that referenced this pull request Mar 18, 2021
@miss-islington @tiran
bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)
3365e68 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <[email protected]>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <[email protected]>
miss-islington added a commit that referenced this pull request Mar 18, 2021
@miss-islington @tiran
bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)
5051167 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <[email protected]>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <[email protected]>
tiran added a commit to tiran/cpython that referenced this pull request Mar 18, 2021
@tiran
[3.7] bpo-41561: Add workaround for Ubuntu's custom security level (p…
00765de 
…ythonGH-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <[email protected]>
@bedevere-bot

bedevere-bot commented Mar 18, 2021

Copy link
Copy Markdown

GH-24928 is a backport of this pull request to the 3.7 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the needs backport to 3.7 label Mar 18, 2021
@tiran tiran mentioned this pull request Mar 19, 2021
Tests fail when run under Ubuntu 20.04 due to global security minimums pyca/pyopenssl#1002
Closed
jab added a commit to jab/cpython that referenced this pull request Mar 20, 2021
@jab
Merge branch 'master' into justin39/aiter-c
97d06e5 
* master: (129 commits)
  bpo-43452: Micro-optimizations to PyType_Lookup (pythonGH-24804)
  bpo-43517: Fix false positive in detection of circular imports (python#24895)
  bpo-43494: Make some minor changes to lnotab notes (pythonGH-24861)
  Mention that code.co_lnotab is deprecated in what's new for 3.10. (python#24902)
  bpo-43244: Remove symtable.h header file (pythonGH-24910)
  bpo-43466: Add --with-openssl-rpath configure option (pythonGH-24820)
  Fix a typo in c-analyzer (pythonGH-24468)
  bpo-41561: Add workaround for Ubuntu's custom security level (pythonGH-24915)
  bpo-43521: Allow ast.unparse with empty sets and NaN (pythonGH-24897)
  bpo-43244: Remove the PyAST_Validate() function (pythonGH-24911)
  bpo-43541: Fix PyEval_EvalCodeEx() regression (pythonGH-24918)
  bpo-43244: Fix test_peg_generators on Windows (pythonGH-24913)
  bpo-39342: Expose X509_V_FLAG_ALLOW_PROXY_CERTS in ssl module (pythonGH-18011)
  bpo-43244: Fix test_peg_generator for PyAST_Validate() (pythonGH-24912)
  bpo-42128: Add 'missing :' syntax error message to match statements (pythonGH-24733)
  bpo-43244: Add pycore_ast.h header file (pythonGH-24908)
  bpo-43244: Rename pycore_ast.h to pycore_ast_state.h (pythonGH-24907)
  Remove unnecessary imports in the grammar parser (pythonGH-24904)
  bpo-35883: Py_DecodeLocale() escapes invalid Unicode characters (pythonGH-24843)
  Add PEP 626 to what's new in 3.10. (python#24892)
  ...
ned-deily pushed a commit that referenced this pull request May 3, 2021
@tiran
[3.7] bpo-41561: Add workaround for Ubuntu's custom security level (G…
64be96a 
…H-24915) (GH-24928)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@brandtbucher brandtbucher brandtbucher approved these changes
@gpshead gpshead gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@miss-islington miss-islington

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

6 participants

@tiran @miss-islington @bedevere-bot @gpshead @brandtbucher @the-knights-who-say-ni
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.