Skip to content

bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1#6976

Merged
tiran merged 1 commit intopython:masterfrom
tiran:bpo-33570-tls13-ciphers
May 22, 2018
Merged

bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1#6976
tiran merged 1 commit intopython:masterfrom
tiran:bpo-33570-tls13-ciphers

Conversation

@tiran
Copy link
Member

@tiran tiran commented May 18, 2018 •
edited by bedevere-bot
Loading

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue33570

@tiran tiran force-pushed the bpo-33570-tls13-ciphers branch from 2419687 to 999d316 Compare May 20, 2018 14:48
@tiran tiran requested a review from gpshead as a code owner May 20, 2018 15:56
@tiran tiran force-pushed the bpo-33570-tls13-ciphers branch from 33bdb1f to d897229 Compare May 20, 2018 16:21
gpshead
gpshead reviewed May 20, 2018
View reviewed changes
Lib/test/test_asyncio/test_subprocess.py Outdated
Copy link
Member

@gpshead gpshead May 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think the changes in this file belong in this PR?

Lib/test/test_ssl.py Outdated
Copy link
Member

@gpshead gpshead May 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is called test_default_ciphers but the test seems to be explicitly setting which ciphers are used so the name doesn't make much sense. I don't see any defaults. it appears to be testing that defaults can be overridden and that cipher negotiation fails properly?

Copy link
Member

@gpshead gpshead May 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if i'm misunderstanding, i suggest adding a comment to explain the test. :)

Copy link
Member Author

@tiran tiran May 20, 2018

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that the test name doesn't reflect the test case. In fact I don't know the original intention of the test. Let's rename it to test_no_shared_ciphers

@tiran tiran force-pushed the bpo-33570-tls13-ciphers branch 2 times, most recently from b69f2fd to 2fdba44 Compare May 20, 2018 19:24
@tiran
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1
c412812 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>
@tiran tiran force-pushed the bpo-33570-tls13-ciphers branch from 2fdba44 to c412812 Compare May 22, 2018 19:09
@tiran
Copy link
Member Author

tiran commented May 22, 2018

@gpshead PR is ready

@gpshead
Copy link
Member

gpshead commented May 22, 2018

i'll let you do the merging.

@tiran tiran merged commit e8eb6cb into python:master May 22, 2018
@miss-islington
Copy link
Contributor

miss-islington commented May 22, 2018

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6, 3.7.
🐍🍒⛏🤖

@tiran
Copy link
Member Author

tiran commented May 22, 2018

thx @gpshead
3.6 and 2.7 will need manual backporting

@tiran tiran deleted the bpo-33570-tls13-ciphers branch May 22, 2018 20:50
@bedevere-bot
Copy link

bedevere-bot commented May 22, 2018

GH-7064 is a backport of this pull request to the 3.7 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request May 22, 2018
@tiran @miss-islington
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (pythonGH-6976)
cb54175 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit e8eb6cb)

Co-authored-by: Christian Heimes <christian@python.org>
@miss-islington
Copy link
Contributor

miss-islington commented May 22, 2018

Sorry, @tiran, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker e8eb6cb7920ded66abc5d284319a8539bdc2bae3 2.7

@miss-islington
Copy link
Contributor

miss-islington commented May 22, 2018

Sorry, @tiran, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker e8eb6cb7920ded66abc5d284319a8539bdc2bae3 3.6

miss-islington added a commit that referenced this pull request May 22, 2018
@miss-islington @tiran
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976)
cd57b48 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit e8eb6cb)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot
Copy link

bedevere-bot commented Aug 14, 2018

GH-8760 is a backport of this pull request to the 3.6 branch.

tiran added a commit to tiran/cpython that referenced this pull request Aug 14, 2018
@tiran
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (pythonGH-6976)
6159bb5 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>
tiran added a commit that referenced this pull request Aug 15, 2018
@tiran
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976) (GH-8760)
3e630c5 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>
tiran added a commit to tiran/cpython that referenced this pull request Aug 15, 2018
@tiran
[2.7] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (pythonGH-6976) (p…
9e32244 
…ythonGH-8760)

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 3e630c5)

Co-authored-by: Christian Heimes <christian@python.org>
stratakis pushed a commit to stratakis/cpython that referenced this pull request Nov 20, 2018
@tiran @stratakis
[2.7] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (pythonGH-6976) (p…
584c110 
…ythonGH-8760)

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 3e630c5)

Co-authored-by: Christian Heimes <christian@python.org>
vstinner pushed a commit that referenced this pull request Feb 15, 2019
@stratakis @tiran @vstinner
[2.7] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976) (GH-8760) (
c49f63c 
GH-10607)

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 3e630c5)
Co-authored-by: Christian Heimes <christian@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Assignees

@tiran tiran

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@tiran @gpshead @miss-islington @bedevere-bot @the-knights-who-say-ni