◐ Shell
reader mode source ↗
Skip to content

bpo-41561: Add workaround for Ubuntu's custom security level#24915

Merged
miss-islington merged 2 commits into
python:masterfrom
tiran:bpo-41561-ubuntu-ssl
Mar 18, 2021
Merged

bpo-41561: Add workaround for Ubuntu's custom security level#24915
miss-islington merged 2 commits into
python:masterfrom
tiran:bpo-41561-ubuntu-ssl

Conversation

@tiran

@tiran tiran commented Mar 18, 2021 •
edited by miss-islington
Loading

Copy link
Copy Markdown
Member

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See: https://bugs.python.org/issue43382
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue41561

Automerge-Triggered-By: GH:tiran

@tiran tiran force-pushed the bpo-41561-ubuntu-ssl branch 2 times, most recently from c5881ef to 23ee4b1 Compare March 18, 2021 10:24
@tiran
bpo-41561: Add workaround for Ubuntu's custom security level …
6a96b30 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See: https://bugs.python.org/issue43382
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
@tiran tiran force-pushed the bpo-41561-ubuntu-ssl branch from 23ee4b1 to 6a96b30 Compare March 18, 2021 10:28
@tiran tiran marked this pull request as ready for review March 18, 2021 10:29
@tiran tiran requested review from brandtbucher and gpshead March 18, 2021 10:29
brandtbucher
brandtbucher approved these changes Mar 18, 2021
View reviewed changes

@brandtbucher brandtbucher left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hide comment

I know very little nothing about OpenSSL/TLS, but the rest looks good!

@tiran

tiran commented Mar 18, 2021

Copy link
Copy Markdown
Member Author

Thanks @gpshead and @brandtbucher

@miss-islington miss-islington merged commit f6c6b58 into python:master Mar 18, 2021
@miss-islington

miss-islington commented Mar 18, 2021

Copy link
Copy Markdown
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7, 3.8, 3.9.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 18, 2021
@tiran @miss-islington
bpo-41561: Add workaround for Ubuntu's custom security level (pythonG… …
2393fb6 
…H-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot

bedevere-bot commented Mar 18, 2021

Copy link
Copy Markdown

GH-24925 is a backport of this pull request to the 3.9 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Mar 18, 2021
@tiran @miss-islington
bpo-41561: Add workaround for Ubuntu's custom security level (pythonG… …
578805c 
…H-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot

bedevere-bot commented Mar 18, 2021

Copy link
Copy Markdown

GH-24926 is a backport of this pull request to the 3.8 branch.

@miss-islington

miss-islington commented Mar 18, 2021

Copy link
Copy Markdown
Contributor

Sorry, @tiran, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker f6c6b5821bff815bdc810de53992fd1fbdb2edd4 3.7

@miss-islington miss-islington self-assigned this Mar 18, 2021
miss-islington added a commit that referenced this pull request Mar 18, 2021
@miss-islington @tiran
bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) …
3365e68 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
miss-islington added a commit that referenced this pull request Mar 18, 2021
@miss-islington @tiran
bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) …
5051167 
Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
tiran added a commit to tiran/cpython that referenced this pull request Mar 18, 2021
@tiran
[3.7] bpo-41561: Add workaround for Ubuntu's custom security level (p… …
00765de 
…ythonGH-24915)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
@bedevere-bot

bedevere-bot commented Mar 18, 2021

Copy link
Copy Markdown

GH-24928 is a backport of this pull request to the 3.7 branch.

@tiran tiran mentioned this pull request Mar 19, 2021
Closed
jab added a commit to jab/cpython that referenced this pull request Mar 20, 2021
@jab
Merge branch 'master' into justin39/aiter-c …
97d06e5 
* master: (129 commits)
  bpo-43452: Micro-optimizations to PyType_Lookup (pythonGH-24804)
  bpo-43517: Fix false positive in detection of circular imports (python#24895)
  bpo-43494: Make some minor changes to lnotab notes (pythonGH-24861)
  Mention that code.co_lnotab is deprecated in what's new for 3.10. (python#24902)
  bpo-43244: Remove symtable.h header file (pythonGH-24910)
  bpo-43466: Add --with-openssl-rpath configure option (pythonGH-24820)
  Fix a typo in c-analyzer (pythonGH-24468)
  bpo-41561: Add workaround for Ubuntu's custom security level (pythonGH-24915)
  bpo-43521: Allow ast.unparse with empty sets and NaN (pythonGH-24897)
  bpo-43244: Remove the PyAST_Validate() function (pythonGH-24911)
  bpo-43541: Fix PyEval_EvalCodeEx() regression (pythonGH-24918)
  bpo-43244: Fix test_peg_generators on Windows (pythonGH-24913)
  bpo-39342: Expose X509_V_FLAG_ALLOW_PROXY_CERTS in ssl module (pythonGH-18011)
  bpo-43244: Fix test_peg_generator for PyAST_Validate() (pythonGH-24912)
  bpo-42128: Add 'missing :' syntax error message to match statements (pythonGH-24733)
  bpo-43244: Add pycore_ast.h header file (pythonGH-24908)
  bpo-43244: Rename pycore_ast.h to pycore_ast_state.h (pythonGH-24907)
  Remove unnecessary imports in the grammar parser (pythonGH-24904)
  bpo-35883: Py_DecodeLocale() escapes invalid Unicode characters (pythonGH-24843)
  Add PEP 626 to what's new in 3.10. (python#24892)
  ...
ned-deily pushed a commit that referenced this pull request May 3, 2021
@tiran
[3.7] bpo-41561: Add workaround for Ubuntu's custom security level (G… …
64be96a 
…H-24915) (GH-24928)

Ubuntu 20.04 comes with a patched OpenSSL 1.1.1. Default security level
2 blocks TLS 1.0 and 1.1 connections. Regular OpenSSL 1.1.1 builds allow
TLS 1.0 and 1.1 on security level 2.

See:
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878
See: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625
Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit f6c6b58)

Co-authored-by: Christian Heimes <christian@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@brandtbucher brandtbucher brandtbucher approved these changes

@gpshead gpshead gpshead approved these changes

Assignees

@miss-islington miss-islington

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

6 participants

@tiran @miss-islington @bedevere-bot @gpshead @brandtbucher @the-knights-who-say-ni