Disabling SSLv3 support

[kroeckx]

BPO	22935
Nosy	@malemburg, @doko42, @pitrou, @vstinner, @larryhastings, @giampaolo, @tiran, @benjaminp, @ned-deily, @alex, @dstufft
Files	python2.7-nossl3.patch get_server_certificate_sslv3.patch get_server_certificate_sslv23.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2015-01-06.12:41:26.627>
created_at = <Date 2014-11-24.22:14:20.290>
labels = ['build', 'release-blocker']
title = 'Disabling SSLv3 support'
updated_at = <Date 2015-01-06.15:03:50.345>
user = 'https://bugs.python.org/kroeckx'

bugs.python.org fields:

activity = <Date 2015-01-06.15:03:50.345>
actor = 'berker.peksag'
assignee = 'none'
closed = True
closed_date = <Date 2015-01-06.12:41:26.627>
closer = 'vstinner'
components = ['Build']
creation = <Date 2014-11-24.22:14:20.290>
creator = 'kroeckx'
dependencies = []
files = ['37268', '37423', '37424']
hgrepos = []
issue_num = 22935
keywords = ['patch']
message_count = 30.0
messages = ['231624', '231625', '231626', '231627', '231813', '231815', '231911', '231942', '232236', '232238', '232315', '232522', '232525', '232526', '232527', '232528', '232530', '232542', '232543', '232545', '232546', '232547', '232548', '232551', '232552', '233447', '233448', '233522', '233523', '233533']
nosy_count = 14.0
nosy_names = ['lemburg', 'doko', 'janssen', 'pitrou', 'vstinner', 'larry', 'giampaolo.rodola', 'christian.heimes', 'benjamin.peterson', 'ned.deily', 'alex', 'python-dev', 'dstufft', 'kroeckx']
pr_nums = []
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'compile error'
url = 'https://bugs.python.org/issue22935'
versions = ['Python 2.7', 'Python 3.4', 'Python 3.5']

[kroeckx]

Hi,

The attached patch makes python work when openssl doesn't have SSLv3 support. It also updates the documentation, which has already improved a lot since my original patch.

The current upstream openssl when compiled with no-ssl2 it defines OPENSSL_NO_SSL2, drops the SSLv2_* method and drops support for SSLv2 in the SSLv23_* methods. When build with no-ssl3 it defines OPENSSL_NO_SSL3 and currently just drops supports for SSLv3 in the SSLv23_method, it does not yet drop the SSLv3_* methods. It's still being argued whether no-ssl3 should drop those symbols or that a new option will be used instead.

So that means that with OPENSSL_NO_SSL3 defined it could be that the SSLv3_* methods still exist and that you can create a socket that only support SSLv3.

I made the SSLv3 methods go away in python if OPENSSL_NO_SSL3 is defined. This at least makes things easier for the test suite so that you know you can test a combination like v3 with v23 or not.

This patch is for 2.7. Please let me know if you need a patch for a different version.

[alex]

FWIW, Debian expiremental appears to be using a different #define for this. Here's how we handled it in pyca/cryptography: pyca/cryptography@04a3f1f

[kroeckx]

I know what I uploaded to Debian experimental. And I can't promise that I'll keep that define. I suggest you assume that NO_SSL3 will disable both.

[alex]

Good to know, thanks.

[vstinner]

FYI LibreSSL also disabled SSLv2 and SSLv3.

[doko42]

maybe it's time to generalise this one, still found on all branches:

# Issue python/cpython#53661: Ubuntu hijacks their OpenSSL and forcefully disables SSLv2
def skip_if_broken_ubuntu_ssl(func):

[ned-deily]

Clearly we need to support openssl's without SSLv3 so I think some version of this needs to be applied to all branches (preferably in time for 2.7.9, Benjamin?). Kurt, if you haven't already, could you sign the contributor agreement so we can use the patch (https://www.python.org/psf/contrib/contrib-form/)? And I guess it would be nice to generalize the SSLv2 checks as doko suggests.

[kroeckx]

I've just signed the contributor agreement

[python-dev]

New changeset 49d267a58cc2 by Benjamin Peterson in branch '2.7':
allow ssl module to compile if openssl doesn't support SSL 3 (closes bpo-22935)
https://hg.python.org/cpython/rev/49d267a58cc2

New changeset 4077e0cd8d48 by Benjamin Peterson in branch '3.4':
allow ssl module to compile if openssl doesn't support SSL 3 (closes bpo-22935)
https://hg.python.org/cpython/rev/4077e0cd8d48

New changeset fbf3747e721c by Benjamin Peterson in branch 'default':
merge 3.4 (bpo-22935)
https://hg.python.org/cpython/rev/fbf3747e721c

[vstinner]

The documentation should be modified to explain that SSLv2 and SSLv3 are
not always available.

[kroeckx]

I did update the documentation to mention that, but it seems none of my documentation changes got applied.

[ned-deily]

The changes for 3.4 are incomplete:

>>> import ssl
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/py/dev/34/source/Lib/ssl.py", line 122, in <module>
    from _ssl import PROTOCOL_SSLv3, PROTOCOL_SSLv23, PROTOCOL_TLSv1
ImportError: cannot import name 'PROTOCOL_SSLv3'

For the default (3.5) branch, f776771ab0ee for bpo-21068 changed ssl.py to handle missing SSLv3 support; 3.4 needs something similar.