Package: python2.7
Tags: patch
Attached is a patch that makes python2.7 when openssl is build
without any support for SSLv3.
Kurt
diff -ur python2.7-2.7.8.orig/Doc/library/ssl.rst python2.7-2.7.8/Doc/library/ssl.rst
--- python2.7-2.7.8.orig/Doc/library/ssl.rst 2014-11-08 16:39:22.496814968 +0100
+++ python2.7-2.7.8/Doc/library/ssl.rst 2014-11-08 17:01:36.300342867 +0100
@@ -528,15 +528,25 @@
.. data:: PROTOCOL_SSLv23
- Selects SSL version 2 or 3 as the channel encryption protocol. This is a
- setting to use with servers for maximum compatibility with the other end of
- an SSL connection, but it may cause the specific ciphers chosen for the
- encryption to be of fairly low quality.
+ Supports any SSL / TLS protocol supported. This will by default try to
+ negiotate TLS 1.2 when you have openssl version 1.0.1+ or TLS 1.0 with
+ older version. It will select the highest version supported by both the
+ client and the server.
+
+ You should always use this for both client and server.
+
+ You can alter the behaviour of it with settings like OP_NO_TLSv1_2.
.. data:: PROTOCOL_SSLv3
- Selects SSL version 3 as the channel encryption protocol. For clients, this
- is the maximally compatible SSL variant.
+ Selects SSL version 3 as the channel encryption protocol.
+
+ This protocol is not available if OpenSSL is compiled with OPENSSL_NO_SSL3
+ flag.
+
+ .. warning::
+
+ SSL version 3 is insecure. Its use is highly discouraged.
.. data:: PROTOCOL_TLSv1
@@ -551,9 +561,8 @@
.. data:: PROTOCOL_TLSv1_2
- Selects TLS version 1.2 as the channel encryption protocol. This is the most
- modern version, and probably the best choice for maximum protection, if both
- sides can speak it. Available only with openssl version 1.0.1+.
+ Selects TLS version 1.2 as the channel encryption protocol.
+ Available only with openssl version 1.0.1+.
.. versionadded:: 2.7.9
diff -ur python2.7-2.7.8.orig/Lib/test/test_ftplib.py python2.7-2.7.8/Lib/test/test_ftplib.py
--- python2.7-2.7.8.orig/Lib/test/test_ftplib.py 2014-06-30 04:05:34.000000000 +0200
+++ python2.7-2.7.8/Lib/test/test_ftplib.py 2014-11-08 17:08:07.795989747 +0100
@@ -693,7 +693,7 @@
def test_auth_ssl(self):
try:
- self.client.ssl_version = ssl.PROTOCOL_SSLv3
+ self.client.ssl_version = ssl.PROTOCOL_SSLv23
self.client.auth()
self.assertRaises(ValueError, self.client.auth)
finally:
diff -ur python2.7-2.7.8.orig/Lib/test/test_ssl.py python2.7-2.7.8/Lib/test/test_ssl.py
--- python2.7-2.7.8.orig/Lib/test/test_ssl.py 2014-11-08 16:39:22.532814198 +0100
+++ python2.7-2.7.8/Lib/test/test_ssl.py 2014-11-08 17:07:48.884393293 +0100
@@ -2223,20 +2223,24 @@
sys.stdout.write(
" SSL2 client to SSL23 server test unexpectedly failed:\n %s\n"
% str(x))
- try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3')
+ if hasattr(ssl, 'PROTOCOL_SSLv3'):
+ try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3')
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True)
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, 'TLSv1')
- try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_OPTIONAL)
+ if hasattr(ssl, 'PROTOCOL_SSLv3'):
+ try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_OPTIONAL)
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True, ssl.CERT_OPTIONAL)
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_OPTIONAL)
- try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_REQUIRED)
+ if hasattr(ssl, 'PROTOCOL_SSLv3'):
+ try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_REQUIRED)
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True, ssl.CERT_REQUIRED)
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_REQUIRED)
# Server with specific SSL options
- try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, False,
+ if hasattr(ssl, 'PROTOCOL_SSLv3'):
+ try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv3, False,
server_options=ssl.OP_NO_SSLv3)
# Will choose TLSv1
try_protocol_combo(ssl.PROTOCOL_SSLv23, ssl.PROTOCOL_SSLv23, True,
@@ -2246,6 +2250,8 @@
@skip_if_broken_ubuntu_ssl
+ @unittest.skipUnless(hasattr(ssl, 'PROTOCOL_SSLv3'),
+ "OpenSSL is compiled without SSLv3 support")
def test_protocol_sslv3(self):
"""Connecting to an SSLv3 server with various client options"""
if support.verbose:
@@ -2273,7 +2279,8 @@
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_REQUIRED)
if hasattr(ssl, 'PROTOCOL_SSLv2'):
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv2, False)
- try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv3, False)
+ if hasattr(ssl, 'PROTOCOL_SSLv3'):
+ try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv3, False)
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv23, False,
client_options=ssl.OP_NO_TLSv1)
@@ -2288,7 +2295,8 @@
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_1, 'TLSv1.1')
if hasattr(ssl, 'PROTOCOL_SSLv2'):
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv2, False)
- try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv3, False)
+ if hasattr(ssl, 'PROTOCOL_SSLv3'):
+ try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv3, False)
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv23, False,
client_options=ssl.OP_NO_TLSv1_1)
@@ -2310,7 +2318,8 @@
client_options=ssl.OP_NO_SSLv3|ssl.OP_NO_SSLv2,)
if hasattr(ssl, 'PROTOCOL_SSLv2'):
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv2, False)
- try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv3, False)
+ if hasattr(ssl, 'PROTOCOL_SSLv3'):
+ try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv3, False)
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv23, False,
client_options=ssl.OP_NO_TLSv1_2)
diff -ur python2.7-2.7.8.orig/Modules/_ssl.c python2.7-2.7.8/Modules/_ssl.c
--- python2.7-2.7.8.orig/Modules/_ssl.c 2014-11-08 16:39:22.584813085 +0100
+++ python2.7-2.7.8/Modules/_ssl.c 2014-11-08 16:40:41.775118686 +0100
@@ -1997,8 +1997,10 @@
else if (proto_version == PY_SSL_VERSION_TLS1_2)
ctx = SSL_CTX_new(TLSv1_2_method());
#endif
+#ifndef OPENSSL_NO_SSL3
else if (proto_version == PY_SSL_VERSION_SSL3)
ctx = SSL_CTX_new(SSLv3_method());
+#endif
#ifndef OPENSSL_NO_SSL2
else if (proto_version == PY_SSL_VERSION_SSL2)
ctx = SSL_CTX_new(SSLv2_method());
@@ -4013,8 +4015,10 @@
PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
PY_SSL_VERSION_SSL2);
#endif
+#ifndef OPENSSL_NO_SSL2
PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
PY_SSL_VERSION_SSL3);
+#endif
PyModule_AddIntConstant(m, "PROTOCOL_SSLv23",
PY_SSL_VERSION_SSL23);
PyModule_AddIntConstant(m, "PROTOCOL_TLSv1",
