Skip to content

bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 #6976

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 22, 2018
Merged

bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 #6976

merged 1 commit into from
May 22, 2018

Conversation

tiran
Copy link
Member

@tiran tiran commented May 18, 2018 •
edited by bedevere-bot
Loading

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes [email protected]

https://bugs.python.org/issue33570

@tiran tiran force-pushed the bpo-33570-tls13-ciphers branch from 2419687 to 999d316 Compare May 20, 2018 14:48
@tiran tiran requested a review from gpshead as a code owner May 20, 2018 15:56
@tiran tiran force-pushed the bpo-33570-tls13-ciphers branch from 33bdb1f to d897229 Compare May 20, 2018 16:21
gpshead
gpshead reviewed May 20, 2018
View reviewed changes
Lib/test/test_asyncio/test_subprocess.py Outdated
@@ -73,6 +74,29 @@ def test_proc_exited(self):

transport.close()

def test_subprocess_repr(self):
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think the changes in this file belong in this PR?

Lib/test/test_ssl.py Outdated
@@ -3440,16 +3437,15 @@ def test_do_handshake_enotconn(self):
self.assertEqual(cm.exception.errno, errno.ENOTCONN)

def test_default_ciphers(self):
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is called test_default_ciphers but the test seems to be explicitly setting which ciphers are used so the name doesn't make much sense. I don't see any defaults. it appears to be testing that defaults can be overridden and that cipher negotiation fails properly?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if i'm misunderstanding, i suggest adding a comment to explain the test. :)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree that the test name doesn't reflect the test case. In fact I don't know the original intention of the test. Let's rename it to test_no_shared_ciphers

@tiran tiran force-pushed the bpo-33570-tls13-ciphers branch 2 times, most recently from b69f2fd to 2fdba44 Compare May 20, 2018 19:24
@tiran
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1
c412812 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes <[email protected]>
@tiran tiran force-pushed the bpo-33570-tls13-ciphers branch from 2fdba44 to c412812 Compare May 22, 2018 19:09
@tiran
Copy link
Member Author

tiran commented May 22, 2018

@gpshead PR is ready

@gpshead
Copy link
Member

gpshead commented May 22, 2018

i'll let you do the merging.

@tiran tiran merged commit e8eb6cb into python:master May 22, 2018
@miss-islington
Copy link
Contributor

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 2.7, 3.6, 3.7.
🐍🍒⛏🤖

@tiran
Copy link
Member Author

tiran commented May 22, 2018

thx @gpshead
3.6 and 2.7 will need manual backporting

@tiran tiran deleted the bpo-33570-tls13-ciphers branch May 22, 2018 20:50
@bedevere-bot
Copy link

GH-7064 is a backport of this pull request to the 3.7 branch.

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request May 22, 2018
@tiran @miss-islington
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (pythonGH-6976)
cb54175 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes <[email protected]>
(cherry picked from commit e8eb6cb)

Co-authored-by: Christian Heimes <[email protected]>
@miss-islington
Copy link
Contributor

Sorry, @tiran, I could not cleanly backport this to 2.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker e8eb6cb7920ded66abc5d284319a8539bdc2bae3 2.7

@miss-islington
Copy link
Contributor

Sorry, @tiran, I could not cleanly backport this to 3.6 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker e8eb6cb7920ded66abc5d284319a8539bdc2bae3 3.6

miss-islington added a commit that referenced this pull request May 22, 2018
@miss-islington @tiran
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976)
cd57b48 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests and Travis config to test with latest OpenSSL.

Signed-off-by: Christian Heimes <[email protected]>
(cherry picked from commit e8eb6cb)

Co-authored-by: Christian Heimes <[email protected]>
@bedevere-bot
Copy link

GH-8760 is a backport of this pull request to the 3.6 branch.

tiran added a commit to tiran/cpython that referenced this pull request Aug 14, 2018
@tiran
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (pythonGH-6976)
6159bb5 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <[email protected]>
tiran added a commit that referenced this pull request Aug 15, 2018
@tiran
bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976) (GH-8760)
3e630c5 
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <[email protected]>
tiran added a commit to tiran/cpython that referenced this pull request Aug 15, 2018
@tiran
[2.7] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (pythonGH-6976) (p…
9e32244 
…ythonGH-8760)

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit 3e630c5)

Co-authored-by: Christian Heimes <[email protected]>
stratakis pushed a commit to stratakis/cpython that referenced this pull request Nov 20, 2018
@tiran @stratakis
[2.7] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (pythonGH-6976) (p…
584c110 
…ythonGH-8760)

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit 3e630c5)

Co-authored-by: Christian Heimes <[email protected]>
vstinner pushed a commit that referenced this pull request Feb 15, 2019
@stratakis @tiran @vstinner
[2.7] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976) (GH-8760) (
c49f63c 
GH-10607)

Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.

Also update multissltests to test with latest OpenSSL.

Signed-off-by: Christian Heimes <[email protected]>.
(cherry picked from commit 3e630c5)
Co-authored-by: Christian Heimes <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@gpshead gpshead gpshead approved these changes

Assignees

@tiran tiran

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@tiran @gpshead @miss-islington @bedevere-bot @the-knights-who-say-ni