FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

bpo-34001: Change handling of SSL protocol bounds with LibreSSL by alanhuang122 · Pull Request #8055 · python/cpython · GitHub

/ cpython Public

bpo-34001: Change handling of SSL protocol bounds with LibreSSL - #8055

Closed
alanhuang122 wants to merge 5 commits into
python:mainfrom
alanhuang122:bpo-34001
ConversationCommits (5)ChecksFiles changed
Closed

bpo-34001: Change handling of SSL protocol bounds with LibreSSL#8055
alanhuang122 wants to merge 5 commits into
python:mainfrom
alanhuang122:bpo-34001

Conversation

alanhuang122 commented Jul 2, 2018 •
edited
Loading

Copy link
Copy Markdown

There are two substantial changes made in this pull request:

  1. Under LibreSSL, bounds cannot be set such that minimum_version > maximum_version. 4254483 changes the behavior of set_min_max_proto_version on all builds to reflect that behavior, and introduces a new error message to indicate the issue.
  2. LibreSSL is more permissive than OpenSSL with regard to unknown protocol versions. Namely, LibreSSL allows the setting of unknown protocol versions, rounding to the nearest known protocol version (e.g., 42 -> 769 [TLSv1]), whereas OpenSSL does not. 8352fd3 implements a check to ensure that the result of a set operation is the expected value, and forbids/undoes the change otherwise.

https://bugs.python.org/issue34001

alanhuang122 force-pushed the bpo-34001 branch 2 times, most recently from c3547a9 to 21cd2f3 Compare July 3, 2018 00:25
Alan Huang added 2 commits July 2, 2018 19:42
bpo-34001: add checks for protocol boundary ranges
4254483 
Under LibreSSL, bounds cannot be set such that minimum_version >
maximum_version. This commit codifies that behavior, and
introduces a new error message to indicate the issue.
bpo-34001: add checks for LibreSSL
8352fd3 
LibreSSL behaves differently than OpenSSL when setting protocol
bounds. This commit fixes some failing tests and adds checks and
more detailed error messages.
alanhuang122 force-pushed the bpo-34001 branch 2 times, most recently from 6f890dc to 2df8050 Compare July 3, 2018 00:50
Alan Huang added 3 commits July 2, 2018 20:00
bpo-34001: fix tests
77d24d8 
This commit fixes tests by removing invalid range settings.
bpo-34001: add test for protocol boundary restrictions
2a09611 
This commit adds tests for the new {min,max}imum_version restrictions.
Attempting to set an invalid range should ValueError, and the value
should not be changed after the attempt.
bpo-34001: add blurb
f415a39
zhangyangyu requested a review from tiran July 3, 2018 06:55

tiran commented Jul 3, 2018

Copy link
Copy Markdown
Member

Hi, thanks for your patch.

OpenSSL may validate min and max protocol version soon, too. There is currently a patch under development. I'd prefer to wait how the OpenSSL patch plays out.

ghost commented Oct 24, 2018 •
edited by ghost
Loading

Copy link
Copy Markdown

Hi.

First, thank you for all the work done to get LibreSSL compatibility.

Python-3.7.1 with LibreSSL-2.8.2 and patches from #8055 and #8050
Compilation failed because of test_ssl failed.

A detailed list of all the patches that I use for my python-3.7.1 compilation with LibreSSL-2.8.2:
4254483
8352fd3
77d24d8
2a09611
f415a39
abc1b0a
3a421eb
d98c160

FAIL: test_min_max_version (test.test_ssl.ContextTests)

Traceback (most recent call last):
File "/tmp/makepkg/python/src/Python-3.7.1/Lib/test/test_ssl.py", line 1163, in test_min_max_version
ctx.maximum_version, ssl.TLSVersion.MAXIMUM_SUPPORTED
AssertionError: <TLSVersion.TLSv1_2: 771> != <TLSVersion.MAXIMUM_SUPPORTED: -1>

The complete compilation log:
python-3.7.1-2-libressl-2.8.2-1-WithPatches.txt

csabella commented Jan 12, 2020

Copy link
Copy Markdown
Contributor

@tiran, any updates after your last comment from July 2018? Thanks!

tiran removed their request for review April 17, 2021 21:04

iritkatriel commented Apr 11, 2022

Copy link
Copy Markdown
Member

https://bugs.python.org/issue34001 is closed. What is the status of this PR?

encukou commented Mar 28, 2024

Copy link
Copy Markdown
Member

The issue was closed with a different PR.
If there is still a problem, please file a new issue. (And mention this PR, we can reopen it.)

encukou closed this Mar 28, 2024
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

awaiting review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

Back | FazBrowse Home | New Git URL