[Bug 1904988] Re: [SRU] set defaults to be sslv23 not tlsv1
Mathew Hodson
1904988 at bugs.launchpad.net
Sat Jan 16 23:02:52 UTC 2021
python-eventlet (0.19.0-2) experimental; urgency=medium
[ Ondřej Nový ]
* d/{control,copyright}: Use my @debian.org email address
* d/p/use-packaged-python-mock-rather-than-embedded.patch:
Rebased and fixed for new release
* Dropped
- d/p/enforce-tlsv1-always.patch
- d/p/set-defaults-to-be-tlsv1-not-sslv23.patch
This patches was setting TLSv1 protocol as only allowed and don't
allowed TLS 1.1 + 1.2. Eventlet wrapper should not change SSL settings,
users should use ssl.create_default_context for better/safe defaults.
[...]
-- Ondřej Nový <onovy at debian.org> Fri, 12 Aug 2016 11:13:34 +0200
--
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1904988
Title:
[SRU] set defaults to be sslv23 not tlsv1
Status in python-eventlet package in Ubuntu:
Fix Released
Status in python-eventlet source package in Xenial:
Triaged
Bug description:
[Impact]
* python-eventlet=0.18.4-1ubuntu1 (xenial) is applying the d/p/set-
defaults-to-be-tlsv1-not-sslv23.patch to set defaults to be tlsv1 not
sslv23
* This will prevent xenial users from using tlsv1_1 and tlsv1_2, so we
should set defaults to be sslv23 not tlsv1 to allow xenial users enjoy
the benefit of tlsv1_2 as well.
* set-defaults-to-be-tlsv1-not-sslv23.patch was already dropped by
python-eventlet 0.19.0-2 [1] in Ubuntu Yakkety.
[Test Case]
* Install an SSL based Spice OpenStack test env, and apply this
python-eventlet patch as well onto the nova-cloud-controller units.
* Run the "nmap --script ssl-enum-ciphers -p 6082 <spice-ip>" test and
confirm whether it shows tlsv1_2
[Regression Potential]
xenial uses openssl=1.0.2g-1ubuntu4.17, so according to page [2] after
openssl 1.0.0 an SSLv23 client would not attempt SSLv2 connections so
it just brings tlsv1_0, tlsv1_1 and tlsv1_2, it's more convenient and
safer than just having tlsv1_0. and the upstream is also using sslv23
as well [3], and python-eventlet=0.19.0-2 started to the same thing as
well.
So no regression is expected.
[1] https://launchpad.net/ubuntu/+source/python-eventlet/0.19.0-2
[2] https://docs.python.org/2/library/ssl.html#socket-creation
[3] https://github.com/eventlet/eventlet/blob/v0.18.4/eventlet/green/ssl.py#L51
[Discussion]
The first package upload was missing the bug reference so a second package was uploaded. The first can be rejected.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/python-eventlet/+bug/1904988/+subscriptions
More information about the Ubuntu-sponsors
mailing list