Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch #85733

Closed
bugsrep mannequin opened this issue Aug 16, 2020 · 54 comments
Closed

test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch #85733

bugsrep mannequin opened this issue Aug 16, 2020 · 54 comments
Assignees
@tiran
Labels
3.8 only security fixes 3.9 only security fixes 3.10 only security fixes build The build process and cross-build tests Tests in the Lib/test dir topic-SSL

Comments

@bugsrep
Copy link
Mannequin

bugsrep mannequin commented Aug 16, 2020

BPO 41561
Nosy @smontanaro, @taleinat, @tiran, @ned-deily, @miss-islington, @tirkarthi
PRs
  • bpo-41561: skip test_min_max_version_mismatch (GH-22308) #22308
  • [3.9] bpo-41561: skip test_min_max_version_mismatch (GH-22308) #23363
  • [3.8] bpo-41561: skip test_min_max_version_mismatch (GH-22308) #23364
  • bpo-41561: Add workaround for Ubuntu's custom security level #24915
  • [3.9] bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) #24925
  • [3.8] bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) #24926
  • [3.7] bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) #24928
  • bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) #25355
  • [3.9] bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) #25358
  • [3.8] bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) #25359
  • [3.7] bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) #25858
    		•
    Files
  • test_ssl_ubuntu.diff
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/tiran'
closed_at = <Date 2021-04-12.10:26:28.003>
created_at = <Date 2020-08-16.04:10:49.115>
labels = ['expert-SSL', '3.8', '3.9', '3.10', 'build', 'tests']
title = 'test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch'
updated_at = <Date 2021-05-03.20:26:25.809>
user = 'https://bugs.python.org/bugsrep'

    bugs.python.org fields:

    activity = <Date 2021-05-03.20:26:25.809>
actor = 'ned.deily'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2021-04-12.10:26:28.003>
closer = 'christian.heimes'
components = ['Build', 'Tests', 'SSL']
creation = <Date 2020-08-16.04:10:49.115>
creator = 'bugsrep'
dependencies = []
files = ['49450']
hgrepos = []
issue_num = 41561
keywords = ['patch']
message_count = 54.0
messages = ['375502', '376501', '376521', '376669', '376688', '376690', '376705', '376710', '376768', '376817', '377048', '377085', '377112', '377115', '377116', '377117', '377145', '377148', '377155', '377172', '377174', '377179', '377221', '377224', '377225', '377228', '377232', '377240', '377252', '377297', '377403', '377415', '377516', '377517', '378089', '378103', '378440', '378510', '378662', '381328', '381331', '381333', '381514', '388020', '389003', '389020', '389042', '389044', '389045', '390832', '390834', '390835', '392838', '392839']
nosy_count = 8.0
nosy_names = ['skip.montanaro', 'taleinat', 'christian.heimes', 'ned.deily', 'Vladyslav.Bondar', 'miss-islington', 'xtreak', 'bugsrep']
pr_nums = ['22308', '23363', '23364', '24915', '24925', '24926', '24928', '25355', '25358', '25359', '25858']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'compile error'
url = 'https://bugs.python.org/issue41561'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']
    @bugsrep
    Copy link
    Mannequin Author

    bugsrep mannequin commented Aug 16, 2020

    FAIL: test_min_max_version_mismatch (test.test_ssl.ThreadedTests)
    ----------------------------------------------------------------------

    Traceback (most recent call last):
  File "/home/vbk/Downloads/Python-3.8.5/Lib/test/test_ssl.py", line 217, in wrapper
    return func(*args, **kw)
  File "/home/vbk/Downloads/Python-3.8.5/Lib/test/test_ssl.py", line 3841, in test_min_max_version_mismatch
    self.assertIn("alert", str(e.exception))
AssertionError: 'alert' not found in '[SSL: NO_PROTOCOLS_AVAILABLE] no protocols available (_ssl.c:1123)'

    @bugsrep bugsrep mannequin added 3.8 only security fixes labels Aug 16, 2020
    @bugsrep bugsrep mannequin assigned tiran Aug 16, 2020
    @bugsrep bugsrep mannequin added build The build process and cross-build tests Tests in the Lib/test dir topic-SSL labels Aug 16, 2020
    @smontanaro
    Copy link
    Contributor

    Has any progress been made on the Ubuntu 20.04 test_ssl failures? Is there any consensus about it being a Python or Ubuntu problem?

    @smontanaro
    Copy link
    Contributor

    This skips the breaking tests (but doesn't actually fix anything).

    @smontanaro smontanaro added 3.10 only security fixes and removed 3.8 only security fixes labels Sep 7, 2020
    @bugsrep
    Copy link
    Mannequin Author

    bugsrep mannequin commented Sep 10, 2020

    I don't know if it matters, but I started having this problem when I switched from Ubuntu 18.04 (native python3.7) to 20.04 (native python3.8.2). I specify --prefix to a folder in my home directory, but while running make test Ubuntu gives a system error which refers to Ubuntu's python. I don't know exactly at what test it happens, approximately in the middle, but it should not happen at all because the tests should only call the python compiled by me.

    @VladyslavBondar
    Copy link
    Mannequin

    VladyslavBondar mannequin commented Sep 10, 2020

    This will help to solve it

    https://stackoverflow.com/questions/61568215/openssl-v1-1-1-ubuntu-20-tlsv1-no-protocols-available

    But in my case I've defined:
    MinProtocol = None

    @smontanaro
    Copy link
    Contributor

    @Vladyslav.Bondar I can't tell where you are suggesting MinProtocol should be set. I don't see that particular string in any .c, .h or .py file in the Python source.

    @VladyslavBondar
    Copy link
    Mannequin

    VladyslavBondar mannequin commented Sep 11, 2020

    This is about openssl configuration in Ubuntu. In the latest Ubuntu, they disabled TLS 1.0/1.1.

    So to enable it back there is a workaround (taken from StackOverflow):

    You should modify openssl config: /etc/ssl/openssl.cnf

    You need to add this to the beginning of your config file:

    openssl_conf = default_conf

    And then this to the end:

    [ default_conf ]

    ssl_conf = ssl_sect

    [ssl_sect]

    system_default = ssl_default_sect

    [ssl_default_sect]
    MinProtocol = None
    CipherString = DEFAULT:@SECLEVEL=1

    @tirkarthi
    Copy link
    Member

    bpo-38815 also reported similar issue in test_min_max_version_mismatch.

    @bugsrep
    Copy link
    Mannequin Author

    bugsrep mannequin commented Sep 12, 2020

    I followed Vladyslav Bondar's 2020-09-11 09:10:30 recommendations and it worked:
    Tests result: SUCCESS

    Thank you.

    It is not clear though how Canonical built its python-3.8.2 which comes with Ubuntu-20.04. Does anyone know someone at Canonical to ask this question?

    @bugsrep bugsrep mannequin added 3.8 only security fixes and removed 3.10 only security fixes labels Sep 12, 2020
    @bugsrep
    Copy link
    Mannequin Author

    bugsrep mannequin commented Sep 13, 2020

    Can test_ssl script determine which TLS versions are enabled in a particular Linux distribution and run tests only for enabled versions?

    @bugsrep bugsrep mannequin added 3.9 only security fixes labels Oct 6, 2020
    @tiran
    Copy link
    Member

    tiran commented Oct 6, 2020

    It sounds like a Debian/Ubuntu patch is breaking an assumption. Did somebody report the bug with Debian/Ubuntu maintainers of OpenSSL already?

    Fedora also configures OpenSSL with minimum protocol version of TLS 1.2. The distribution does it in a slightly different way that makes the restriction discoverable and that is compatible with Python's test suite.

    @bugsrep
    Copy link
    Mannequin Author

    bugsrep mannequin commented Oct 11, 2020

    I started by asking a question at https://askubuntu.com/questions/1281942/pythons-test-ssl-fails-starting-from-ubuntu-20-04-i-need-to-find-a-person-at-c

    @bugsrep
    Copy link
    Mannequin Author

    bugsrep mannequin commented Oct 12, 2020

    I got an advice and posted the question at https://answers.launchpad.net/ubuntu/+source/openssl/+question/693423

    @bugsrep
    Copy link
    Mannequin Author

    bugsrep mannequin commented Oct 15, 2020

    I reported a bug at https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878

    @tiran
    Copy link
    Member

    tiran commented Nov 18, 2020

    New changeset ce04e71 by Christian Heimes in branch 'master':
    bpo-41561: skip test_min_max_version_mismatch (GH-22308)
    ce04e71

    @miss-islington
    Copy link
    Contributor

    New changeset 73e02ff by Miss Islington (bot) in branch '3.8':
    bpo-41561: skip test_min_max_version_mismatch (GH-22308)
    73e02ff

    @miss-islington
    Copy link
    Contributor

    New changeset 802ff7c by Miss Islington (bot) in branch '3.9':
    [3.9] bpo-41561: skip test_min_max_version_mismatch (GH-22308) (GH-23363)
    802ff7c

    @tiran tiran closed this as completed Nov 18, 2020
    @tiran tiran closed this as completed Nov 18, 2020
    @tiran tiran reopened this Nov 18, 2020
    @tiran tiran reopened this Nov 18, 2020
    @terryjreedy
    Copy link
    Member

    Christian, I don't see any open PRs to be commit reviewed.

    @terryjreedy terryjreedy added 3.10 only security fixes labels Nov 21, 2020
    @tiran
    Copy link
    Member

    tiran commented Mar 3, 2021

    Downstream has asked me to file a separate bug for internal error during handshake. The problem is tracked at https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 .

    @tiran
    Copy link
    Member

    tiran commented Mar 18, 2021

    I have discussed the problem with downstream engineers on the two issues

    The gist of the issue is: Canonical has taken a different approach than Debian and other distros to set minimum TLS version.

    Most distros use an openssl.cnf file to set "MinProtocol = TLSv1.2". The config file approach allows application to override the setting with SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION) and to detect the current minimum version with SSL_CTX_get_min_proto_version(ctx) == TLS1_VERSION.

    Ubuntu doesn't set "MinProtocol = TLSv1.2". Instead the distro has patched OpenSSL source code and modified the meaning of security level "2". Security level is a new OpenSSL API to set various security related settings. On Ubuntu SECLEVEL=2 prevents TLS 1.0 and 1.1 connection. Further SSL_CTX_get_min_proto_version(ctx) returns 0 (dummy value for minimum supported version). SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION) does not fail although TLS 1.0 is prohibited.

    https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_security_level.html
    Level 2: SSL version 3 is also not allowed
    Level 4: TLS versions below 1.2 are not permitted.

    https://manpages.ubuntu.com/manpages/focal/man3/SSL_CTX_set_security_level.3ssl.html
    Level 2: On Ubuntu, TLS versions below 1.2 are not permitted

    The combination of "Ubuntu changed the meaning of security level policy" and "SSL_CTX_get_min_proto_version(ctx) does not report minimum version" breaks our tests.

    OpenSSL doesn't provide an easy way to check if a SSL_CTX has a sane configuration. There is a way to check if a security policy allows a TLS version. I'm not sure if we should include the check in CPython and where to best put the check:

        void *sec_ex = SSL_CTX_get0_security_ex_data(ctx);
    sec_cb = SSL_CTX_get_security_callback(ctx);
    int result = sec_cb(NULL, ctx, SSL_SECOP_VERSION, 0, TLS1_VERSION, NULL, sec_ex);
    if (result && (SSL_CTX_get_min_proto_version(ctx) >=  TLS1_VERSION)) ...

    @tiran
    Copy link
    Member

    tiran commented Mar 18, 2021

    Dimitri John Ledkov from Canonical has opened a feature request for a context validation feature on the OpenSSL issue tracker, openssl/openssl#14607

    @miss-islington
    Copy link
    Contributor

    New changeset f6c6b58 by Christian Heimes in branch 'master':
    bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)
    f6c6b58

    @miss-islington
    Copy link
    Contributor

    New changeset 3365e68 by Miss Islington (bot) in branch '3.9':
    bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)
    3365e68

    @miss-islington
    Copy link
    Contributor

    New changeset 5051167 by Miss Islington (bot) in branch '3.8':
    bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915)
    5051167

    @tiran
    Copy link
    Member

    tiran commented Apr 12, 2021

    New changeset 3447750 by Christian Heimes in branch 'master':
    bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355)
    3447750

    @miss-islington
    Copy link
    Contributor

    New changeset 04425a9 by Miss Islington (bot) in branch '3.8':
    bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355)
    04425a9

    @miss-islington
    Copy link
    Contributor

    New changeset 0983e01 by Miss Islington (bot) in branch '3.9':
    bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355)
    0983e01

    @tiran tiran closed this as completed Apr 12, 2021
    @tiran tiran closed this as completed Apr 12, 2021
    @ned-deily
    Copy link
    Member

    New changeset 64be96a by Christian Heimes in branch '3.7':
    [3.7] bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) (GH-24928)
    64be96a

    @ned-deily
    Copy link
    Member

    New changeset 512742d by Miss Islington (bot) in branch '3.7':
    bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) (GH-25858)
    512742d

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees

    @tiran tiran

    Labels
    3.8 only security fixes 3.9 only security fixes 3.10 only security fixes build The build process and cross-build tests Tests in the Lib/test dir topic-SSL
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    7 participants
    @tiran @taleinat @smontanaro @tirkarthi @ned-deily @terryjreedy @miss-islington