[proxy] web.archive.org — ← back | site home | direct (HTTPS) ↗ | proxy home | ◑ dark◐ light
/ cpython Public
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes #5663

Merged
merged 2 commits into from Feb 27, 2018
Merged

bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes #5663

merged 2 commits into from Feb 27, 2018

Conversation

Copy link
Member

tiran commented Feb 13, 2018 •
edited by bedevere-bot

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS 1.3. The feature is enabled by default for maximum compatibility with broken middle boxes. Users should be able to disable the hack and CPython's test suite needs it to verify default options.

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1-pre1 and TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by default. Some test cases only apply to TLS 1.2. Other tests currently fail because the threaded or async test servers stop after failure. I'm going to address these issues when OpenSSL 1.1.1 reaches beta.

Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue32947

tiran requested a review from as a code owner Feb 13, 2018
bpo-32947: OP_ENABLE_MIDDLEBOX_COMPAT for TLSv1.3
5b9c487 
OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes.

Users should be able to disable the hack and CPython's test suite needs
it to verify default options.

Signed-off-by: Christian Heimes <christian@python.org>
tiran requested review from 1st1 and asvetlov as code owners Feb 25, 2018
tiran changed the title [WIP] OpenSSL 1.1.1-pre1 / TLS 1.3 fixes OpenSSL 1.1.1-pre1 / TLS 1.3 fixes Feb 25, 2018
tiran changed the title OpenSSL 1.1.1-pre1 / TLS 1.3 fixes bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes Feb 25, 2018
bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes
1703358 
Misc fixes and workarounds for compatibility with OpenSSL 1.1.1-pre1 and
TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2. Other tests currently
fail because the threaded or async test servers stop after failure.

I'm going to address these issues when OpenSSL 1.1.1 reaches beta.

Signed-off-by: Christian Heimes <christian@python.org>
asvetlov approved these changes Feb 26, 2018
View changes
Copy link
Contributor

asvetlov left a comment

looks good

tiran merged commit 05d9fe3 into python:master Feb 27, 2018
4 checks passed
Copy link
Contributor

miss-islington commented Feb 27, 2018

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6, 3.7.
🐍🍒⛏🤖

Copy link

bedevere-bot commented Feb 27, 2018

@tiran: Please replace # with GH- in the commit message next time. Thanks!

tiran deleted the openssl111 branch Feb 27, 2018
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Feb 27, 2018
bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes (pythonGH-5663)
6a24a1b 
* bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1-pre1 and
TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2. Other tests currently
fail because the threaded or async test servers stop after failure.

I'm going to address these issues when OpenSSL 1.1.1 reaches beta.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options.

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 05d9fe3)

Co-authored-by: Christian Heimes <christian@python.org>
Copy link

bedevere-bot commented Feb 27, 2018

GH-5923 is a backport of this pull request to the 3.7 branch.

Copy link
Contributor

miss-islington commented Feb 27, 2018

Sorry, @tiran, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 05d9fe32a1245b9a798e49e0c1eb91f110935b69 2.7

Copy link
Contributor

miss-islington commented Feb 27, 2018

Sorry, @tiran, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 05d9fe32a1245b9a798e49e0c1eb91f110935b69 3.6

miss-islington added a commit that referenced this issue Feb 27, 2018
bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes (GH-5663)
2614ed4 
* bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1-pre1 and
TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2. Other tests currently
fail because the threaded or async test servers stop after failure.

I'm going to address these issues when OpenSSL 1.1.1 reaches beta.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options.

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 05d9fe3)

Co-authored-by: Christian Heimes <christian@python.org>
Copy link
Member

serhiy-storchaka commented Apr 22, 2018

Do you mind to create backports to 3.6 and 2.7 @tiran?

Copy link

bedevere-bot commented Aug 14, 2018

GH-8760 is a backport of this pull request to the 3.6 branch.

yahya-abou-imran pushed a commit to yahya-abou-imran/cpython that referenced this issue Nov 2, 2018
bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes (python#5663)
1b21f4a 
* bpo-32947: OpenSSL 1.1.1-pre1 / TLS 1.3 fixes

Misc fixes and workarounds for compatibility with OpenSSL 1.1.1-pre1 and
TLS 1.3 support. With OpenSSL 1.1.1, Python negotiates TLS 1.3 by
default. Some test cases only apply to TLS 1.2. Other tests currently
fail because the threaded or async test servers stop after failure.

I'm going to address these issues when OpenSSL 1.1.1 reaches beta.

OpenSSL 1.1.1 has added a new option OP_ENABLE_MIDDLEBOX_COMPAT for TLS
1.3. The feature is enabled by default for maximum compatibility with
broken middle boxes. Users should be able to disable the hack and CPython's test suite needs
it to verify default options.

Signed-off-by: Christian Heimes <christian@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

asvetlov

email-team

1st1

Assignees

tiran

Labels
CLA signed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants