bpo-41561: Add workaround for Ubuntu's custom security level #24915

tiran · 2021-03-18T09:35:51Z

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See: https://bugs.python.org/issue43382
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue41561

Automerge-Triggered-By: GH:tiran

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level 2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow TLS 1.0 and 1.1 on security level 2. See: https://bugs.python.org/issue43382 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 Signed-off-by: Christian Heimes <christian@python.org>

tiran · 2021-03-18T10:57:59Z

Lib/test/test_ssl.py

+def is_ubuntu():
+    try:
+        # assume that any references of "ubuntu" implies Ubuntu-like distro
+        with open("/etc/os-release") as f:


I'm deliberately not using platform.freedesktop_os_release() here. The function is 3.10-only and I want to backport the fix to 3.7 to 3.9.

I noticed that platform.freedesktop_os_release() opens with encoding="utf-8" and also checks /usr/lib/os-release. Are either of those steps necessary here?

shouldn't we be more specific than "is_ubuntu"? which particular versions. 20.04 yes. but what about others? do they still do this in 20.10 and (soon to be replaced by) 21.04? what about 18.04? have we heard back on the upstream ubuntu issues about the future of their apparently uncommon implementation choice?

I'll add encoding="utf-8". The check for /usr/lib/os-release is not necessary on Ubuntu. /etc/os-release always exists.

I don't want to spend more time on this issue than necessary. I have already spent way to much time on a platform that I don't even use. The approach isn't perfect but good enough to fix testing on Ubuntu.

20.04, 20.10, and 21.04 are definitely affected. The man page https://manpages.ubuntu.com/manpages/hirsute/man3/SSL_CTX_set_security_level.3ssl.html is a good indicator. If you see On Ubuntu, TLS versions below 1.2 are not permitted. then the custom policy applies.

brandtbucher

I know ~~very little~~ nothing about OpenSSL/TLS, but the rest looks good!

.github/workflows/build.yml

tiran · 2021-03-18T22:06:40Z

Thanks @gpshead and @brandtbucher

miss-islington · 2021-03-18T22:06:53Z

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

…H-24915) Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level 2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow TLS 1.0 and 1.1 on security level 2. See: See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit f6c6b58) Co-authored-by: Christian Heimes <christian@python.org>

bedevere-bot · 2021-03-18T22:07:08Z

GH-24925 is a backport of this pull request to the 3.9 branch.

…H-24915) Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level 2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow TLS 1.0 and 1.1 on security level 2. See: See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit f6c6b58) Co-authored-by: Christian Heimes <christian@python.org>

bedevere-bot · 2021-03-18T22:07:15Z

GH-24926 is a backport of this pull request to the 3.8 branch.

miss-islington · 2021-03-18T22:07:17Z

Sorry, @tiran, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker f6c6b5821bff815bdc810de53992fd1fbdb2edd4 3.7

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level 2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow TLS 1.0 and 1.1 on security level 2. See: See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 Signed-off-by: Christian Heimes <christian@python.org> (cherry picked from commit f6c6b58) Co-authored-by: Christian Heimes <christian@python.org>

…ythonGH-24915) Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level 2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow TLS 1.0 and 1.1 on security level 2. See: See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 Signed-off-by: Christian Heimes <christian@python.org>. (cherry picked from commit f6c6b58) Co-authored-by: Christian Heimes <christian@python.org>

bedevere-bot · 2021-03-18T22:46:01Z

GH-24928 is a backport of this pull request to the 3.7 branch.

* master: (129 commits) bpo-43452: Micro-optimizations to PyType_Lookup (pythonGH-24804) bpo-43517: Fix false positive in detection of circular imports (python#24895) bpo-43494: Make some minor changes to lnotab notes (pythonGH-24861) Mention that code.co_lnotab is deprecated in what's new for 3.10. (python#24902) bpo-43244: Remove symtable.h header file (pythonGH-24910) bpo-43466: Add --with-openssl-rpath configure option (pythonGH-24820) Fix a typo in c-analyzer (pythonGH-24468) bpo-41561: Add workaround for Ubuntu's custom security level (pythonGH-24915) bpo-43521: Allow ast.unparse with empty sets and NaN (pythonGH-24897) bpo-43244: Remove the PyAST_Validate() function (pythonGH-24911) bpo-43541: Fix PyEval_EvalCodeEx() regression (pythonGH-24918) bpo-43244: Fix test_peg_generators on Windows (pythonGH-24913) bpo-39342: Expose X509_V_FLAG_ALLOW_PROXY_CERTS in ssl module (pythonGH-18011) bpo-43244: Fix test_peg_generator for PyAST_Validate() (pythonGH-24912) bpo-42128: Add 'missing :' syntax error message to match statements (pythonGH-24733) bpo-43244: Add pycore_ast.h header file (pythonGH-24908) bpo-43244: Rename pycore_ast.h to pycore_ast_state.h (pythonGH-24907) Remove unnecessary imports in the grammar parser (pythonGH-24904) bpo-35883: Py_DecodeLocale() escapes invalid Unicode characters (pythonGH-24843) Add PEP 626 to what's new in 3.10. (python#24892) ...

…H-24915) (GH-24928) Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level 2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow TLS 1.0 and 1.1 on security level 2. See: See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 Signed-off-by: Christian Heimes <christian@python.org>. (cherry picked from commit f6c6b58) Co-authored-by: Christian Heimes <christian@python.org>

tiran added needs backport to 3.7 needs backport to 3.9 only security fixes labels Mar 18, 2021

the-knights-who-say-ni added the CLA signed label Mar 18, 2021

bedevere-bot added the awaiting core review label Mar 18, 2021

tiran force-pushed the bpo-41561-ubuntu-ssl branch 2 times, most recently from c5881ef to 23ee4b1 Compare March 18, 2021 10:24

tiran force-pushed the bpo-41561-ubuntu-ssl branch from 23ee4b1 to 6a96b30 Compare March 18, 2021 10:28

tiran marked this pull request as ready for review March 18, 2021 10:29

tiran requested review from gpshead and brandtbucher March 18, 2021 10:29

tiran commented Mar 18, 2021

View reviewed changes

brandtbucher approved these changes Mar 18, 2021

View reviewed changes

.github/workflows/build.yml Show resolved Hide resolved

bedevere-bot added awaiting merge and removed awaiting core review labels Mar 18, 2021

Open with utf-8 encoding

719f100

gpshead approved these changes Mar 18, 2021

View reviewed changes

tiran added the 🤖 automerge label Mar 18, 2021

miss-islington merged commit f6c6b58 into python:master Mar 18, 2021

bedevere-bot removed the awaiting merge label Mar 18, 2021

bedevere-bot removed the needs backport to 3.9 only security fixes label Mar 18, 2021

bedevere-bot removed the needs backport to 3.8 label Mar 18, 2021

miss-islington self-assigned this Mar 18, 2021

bedevere-bot removed the needs backport to 3.7 label Mar 18, 2021

tiran mentioned this pull request Mar 19, 2021

Tests fail when run under Ubuntu 20.04 due to global security minimums pyca/pyopenssl#1002

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

bpo-41561: Add workaround for Ubuntu's custom security level #24915

bpo-41561: Add workaround for Ubuntu's custom security level #24915

tiran commented Mar 18, 2021 •

edited by miss-islington

Loading

tiran Mar 18, 2021

brandtbucher Mar 18, 2021

gpshead Mar 18, 2021

tiran Mar 18, 2021

brandtbucher left a comment

tiran commented Mar 18, 2021

miss-islington commented Mar 18, 2021

bedevere-bot commented Mar 18, 2021

bedevere-bot commented Mar 18, 2021

miss-islington commented Mar 18, 2021

bedevere-bot commented Mar 18, 2021

bpo-41561: Add workaround for Ubuntu's custom security level #24915

bpo-41561: Add workaround for Ubuntu's custom security level #24915

Conversation

tiran commented Mar 18, 2021 • edited by miss-islington Loading

tiran Mar 18, 2021

Choose a reason for hiding this comment

brandtbucher Mar 18, 2021

Choose a reason for hiding this comment

gpshead Mar 18, 2021

Choose a reason for hiding this comment

tiran Mar 18, 2021

Choose a reason for hiding this comment

brandtbucher left a comment

Choose a reason for hiding this comment

tiran commented Mar 18, 2021

miss-islington commented Mar 18, 2021

bedevere-bot commented Mar 18, 2021

bedevere-bot commented Mar 18, 2021

miss-islington commented Mar 18, 2021

bedevere-bot commented Mar 18, 2021

tiran commented Mar 18, 2021 •

edited by miss-islington

Loading