FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

bpo-31429: Define TLS cipher suite on build time by tiran · Pull Request #3532 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

bpo-31429: Define TLS cipher suite on build time - #3532

Merged
tiran merged 1 commit into
python:masterfrom
tiran:bpo-31429-cipher-suite
Jan 29, 2018
ConversationCommits (1)ChecksFiles changed
Merged

bpo-31429: Define TLS cipher suite on build time #3532
tiran merged 1 commit into
python:masterfrom
tiran:bpo-31429-cipher-suite

Conversation

tiran commented Sep 13, 2017 •
edited
Loading

Copy link
Copy Markdown
Member

Until now Python used a hard coded white list of default TLS cipher
suites. The old approach has multiple downsides. OpenSSL's default
selection was completely overruled. Python did neither benefit from new
cipher suites (ChaCha20, TLS 1.3 suites) nor blacklisted cipher suites.
For example we used to re-enable 3DES.

Python now defaults to OpenSSL DEFAULT cipher suite selection and black
lists all unwanted ciphers. Downstream vendors can override the default
cipher list with --with-ssl-default-suites.

Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue31429

tiran added type-feature A feature request or enhancement type-security A security issue labels Sep 13, 2017

encukou commented Jan 18, 2018

Copy link
Copy Markdown
Member

Is there any way I can help move this forward?

tiran commented Jan 18, 2018

Copy link
Copy Markdown
Member Author

I'm not yet sure this patch can land in 3.7. LibreSSL is messing up my plans.

tiran force-pushed the bpo-31429-cipher-suite branch from c111937 to 4f4c506 Compare January 20, 2018 15:04
tiran changed the title bpo-31429: [WIP] --with-ssl-default-suites bpo-31429: Define TLS cipher suite on build time Jan 20, 2018

tiran commented Jan 20, 2018

Copy link
Copy Markdown
Member Author

This PR can be merged after #3462 has landed or we forcefully unsupport OpenSSL < 1.0.2.

tiran force-pushed the bpo-31429-cipher-suite branch from 4f4c506 to b33e892 Compare January 20, 2018 15:08
tiran force-pushed the bpo-31429-cipher-suite branch 2 times, most recently from fddbdb2 to 236097d Compare January 28, 2018 21:20
tiran requested review from alex, njsmith and pitrou January 28, 2018 21:21

tiran commented Jan 28, 2018

Copy link
Copy Markdown
Member Author

@ned-deily Fedora upstream would love have this PR in 3.7. It's also going to make your life as 3.7 security maintainer easier.

@alex @njsmith @pitrou Please review

alex reviewed Jan 28, 2018
View reviewed changes

alex left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Looks ok minus these comments, but I'm not really qualified to review configure changes.

Comment thread Lib/ssl.py Outdated

alex Jan 28, 2018

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

You can just remove this elif block entirely :-)

tiran Jan 28, 2018

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Done

Comment thread Misc/NEWS.d/next/Build/2017-09-13-08-52-58.bpo-31429._vO3LJ.rst Outdated

alex Jan 28, 2018

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Probably needs the WIP removed :-)

tiran Jan 28, 2018

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Oh, I forgot to update the old blurb. I have created a new one and also added 3.7 whatsnew.

Comment thread Modules/_ssl.c Outdated

alex Jan 28, 2018

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Is this still needed after the other change to require 1.0.2?

tiran Jan 28, 2018

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Not really, I added it for doubleplusgood paranoia reasons and just removed it.

tiran force-pushed the bpo-31429-cipher-suite branch 2 times, most recently from ed16875 to 724de80 Compare January 28, 2018 21:41
bpo-31429: Define TLS cipher suite on build time
ea6427f 
Until now Python used a hard coded white list of default TLS cipher
suites. The old approach has multiple downsides. OpenSSL's default
selection was completely overruled. Python did neither benefit from new
cipher suites (ChaCha20, TLS 1.3 suites) nor blacklisted cipher suites.
For example we used to re-enable 3DES.

Python now defaults to OpenSSL DEFAULT cipher suite selection and black
lists all unwanted ciphers. Downstream vendors can override the default
cipher list with --with-ssl-default-suites.

Signed-off-by: Christian Heimes <christian@python.org>
tiran force-pushed the bpo-31429-cipher-suite branch from 724de80 to ea6427f Compare January 29, 2018 07:49
pitrou approved these changes Jan 29, 2018
View reviewed changes

pitrou left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

This looks both fine and useful to me.

tiran merged commit 892d66e into python:master Jan 29, 2018

bedevere-bot commented Jan 29, 2018

Copy link
Copy Markdown

@tiran: Please replace # with GH- in the commit message next time. Thanks!

tiran deleted the bpo-31429-cipher-suite branch January 29, 2018 13:10
sfackler added a commit to rust-openssl/rust-openssl that referenced this pull request Feb 21, 2018
Update SslConnector cipher list
67cc49c 
Based off of python/cpython#3532, we use OpenSSL's default cipher list
and turn of things we don't like. This can't be used with 1.0.1,
however, which had a poor default set. There, we use the old defaults,
with the bits that aren't implemented in 1.0.1 removed (namely TLSv1.3
suites and ChaCha).
sfackler added a commit to rust-openssl/rust-openssl that referenced this pull request Feb 21, 2018
Update SslConnector cipher list
7192a52 
Based off of python/cpython#3532, we use OpenSSL's default cipher list
and turn of things we don't like. This can't be used with 1.0.1,
however, which had a poor default set. There, we use the old defaults,
with the bits that aren't implemented in 1.0.1 removed (namely TLSv1.3
suites and ChaCha).
sfackler mentioned this pull request Feb 21, 2018
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

alex alex left review comments
pitrou pitrou approved these changes
njsmith Awaiting requested review from njsmith

Assignees

No one assigned

Labels

type-feature A feature request or enhancement type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

Back | FazBrowse Home | New Git URL