Skip to content

/ cpython Public

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-41561: Add workaround for Ubuntu's custom security level #24915

Merged
merged 2 commits into from Mar 18, 2021
Merged

bpo-41561: Add workaround for Ubuntu's custom security level #24915

merged 2 commits into from Mar 18, 2021

Conversation

@tiran
Copy link
Member

@tiran tiran commented Mar 18, 2021 •
edited by miss-islington

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See: https://bugs.python.org/issue43382
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue41561

Automerge-Triggered-By: GH:tiran
@tiran tiran force-pushed the bpo-41561-ubuntu-ssl branch 2 times, most recently from c5881ef to 23ee4b1 Mar 18, 2021
@tiran
bpo-41561: Add workaround for Ubuntu's custom security level
6a96b30 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See: https://bugs.python.org/issue43382
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
@tiran tiran force-pushed the bpo-41561-ubuntu-ssl branch from 23ee4b1 to 6a96b30 Mar 18, 2021
@tiran tiran marked this pull request as ready for review Mar 18, 2021
@tiran tiran requested review from gpshead and brandtbucher Mar 18, 2021
tiran
tiran reviewed Mar 18, 2021
View changes
Lib/test/test_ssl.py Outdated
def is_ubuntu():
try:
# assume that any references of "ubuntu" implies Ubuntu-like distro
with open("/etc/os-release") as f:
Copy link
Member Author

@tiran tiran Mar 18, 2021

I'm deliberately not using platform.freedesktop_os_release() here. The function is 3.10-only and I want to backport the fix to 3.7 to 3.9.

Copy link
Member

@brandtbucher brandtbucher Mar 18, 2021

I noticed that platform.freedesktop_os_release() opens with encoding="utf-8" and also checks /usr/lib/os-release. Are either of those steps necessary here?

Copy link
Member

@gpshead gpshead Mar 18, 2021

shouldn't we be more specific than "is_ubuntu"? which particular versions. 20.04 yes. but what about others? do they still do this in 20.10 and (soon to be replaced by) 21.04? what about 18.04? have we heard back on the upstream ubuntu issues about the future of their apparently uncommon implementation choice?

Copy link
Member Author

@tiran tiran Mar 18, 2021

I'll add encoding="utf-8". The check for /usr/lib/os-release is not necessary on Ubuntu. /etc/os-release always exists.

I don't want to spend more time on this issue than necessary. I have already spent way to much time on a platform that I don't even use. The approach isn't perfect but good enough to fix testing on Ubuntu.

20.04, 20.10, and 21.04 are definitely affected. The man page https://manpages.ubuntu.com/manpages/hirsute/man3/SSL_CTX_set_security_level.3ssl.html is a good indicator. If you see On Ubuntu, TLS versions below 1.2 are not permitted. then the custom policy applies.

brandtbucher
brandtbucher approved these changes Mar 18, 2021
View changes
Copy link
Member

@brandtbucher brandtbucher left a comment

I know very little nothing about OpenSSL/TLS, but the rest looks good!

.github/workflows/build.yml Show resolved Hide resolved
@tiran
Open with utf-8 encoding
719f100
@tiran
Copy link
Member Author

@tiran tiran commented Mar 18, 2021

Thanks @gpshead and @brandtbucher

@miss-islington miss-islington merged commit f6c6b58 into python:master Mar 18, 2021
11 checks passed
@miss-islington
Copy link
Contributor

@miss-islington miss-islington commented Mar 18, 2021

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington added a commit to miss-islington/cpython that referenced this issue Mar 18, 2021
@tiran @miss-islington
bpo-41561: Add workaround for Ubuntu's custom security level (pythonG…
2393fb6 
…H-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 18, 2021

GH-24925 is a backport of this pull request to the 3.9 branch.

miss-islington added a commit to miss-islington/cpython that referenced this issue Mar 18, 2021
@tiran @miss-islington
bpo-41561: Add workaround for Ubuntu's custom security level (pythonG…
578805c 
…H-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 18, 2021

GH-24926 is a backport of this pull request to the 3.8 branch.

@miss-islington
Copy link
Contributor

@miss-islington miss-islington commented Mar 18, 2021

Sorry, @tiran, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker f6c6b5821bff815bdc810de53992fd1fbdb2edd4 3.7

@miss-islington miss-islington self-assigned this Mar 18, 2021
miss-islington added a commit that referenced this issue Mar 18, 2021
@tiran @miss-islington
bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)
3365e68 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
miss-islington added a commit that referenced this issue Mar 18, 2021
@tiran @miss-islington
bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)
5051167 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
tiran added a commit to tiran/cpython that referenced this issue Mar 18, 2021
@tiran
[3.7] bpo-41561: Add workaround for Ubuntu's custom security level (p…
00765de 
…ythonGH-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot
Copy link

@bedevere-bot bedevere-bot commented Mar 18, 2021

GH-24928 is a backport of this pull request to the 3.7 branch.

@tiran tiran mentioned this pull request Mar 19, 2021
Closed
jab added a commit to jab/cpython that referenced this issue Mar 20, 2021
@jab
Merge branch 'master' into justin39/aiter-c
97d06e5 
* master: (129 commits)
  bpo-43452: Micro-optimizations to PyType_Lookup (pythonGH-24804)
  bpo-43517: Fix false positive in detection of circular imports (python#24895)
  bpo-43494: Make some minor changes to lnotab notes (pythonGH-24861)
  Mention that code.co_lnotab is deprecated in what's new for 3.10. (python#24902)
  bpo-43244: Remove symtable.h header file (pythonGH-24910)
  bpo-43466: Add --with-openssl-rpath configure option (pythonGH-24820)
  Fix a typo in c-analyzer (pythonGH-24468)
  bpo-41561: Add workaround for Ubuntu's custom security level (pythonGH-24915)
  bpo-43521: Allow ast.unparse with empty sets and NaN (pythonGH-24897)
  bpo-43244: Remove the PyAST_Validate() function (pythonGH-24911)
  bpo-43541: Fix PyEval_EvalCodeEx() regression (pythonGH-24918)
  bpo-43244: Fix test_peg_generators on Windows (pythonGH-24913)
  bpo-39342: Expose X509_V_FLAG_ALLOW_PROXY_CERTS in ssl module (pythonGH-18011)
  bpo-43244: Fix test_peg_generator for PyAST_Validate() (pythonGH-24912)
  bpo-42128: Add 'missing :' syntax error message to match statements (pythonGH-24733)
  bpo-43244: Add pycore_ast.h header file (pythonGH-24908)
  bpo-43244: Rename pycore_ast.h to pycore_ast_state.h (pythonGH-24907)
  Remove unnecessary imports in the grammar parser (pythonGH-24904)
  bpo-35883: Py_DecodeLocale() escapes invalid Unicode characters (pythonGH-24843)
  Add PEP 626 to what's new in 3.10. (python#24892)
  ...
kreathon added a commit to kreathon/cpython that referenced this issue May 2, 2021
@tiran @kreathon
bpo-41561: Add workaround for Ubuntu's custom security level (pythonG…
9def321 
…H-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See: 
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
ned-deily pushed a commit that referenced this issue May 3, 2021
@tiran
[3.7] bpo-41561: Add workaround for Ubuntu's custom security level (G…
64be96a 
…H-24915) (GH-24928)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@brandtbucher brandtbucher

@gpshead gpshead

Assignees

@miss-islington miss-islington

Labels
CLA signed 🤖 automerge
Projects
None yet
Milestone
No milestone
6 participants
@tiran @miss-islington @bedevere-bot @gpshead @brandtbucher @the-knights-who-say-ni