[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Ned Deily added the comment: New changeset 512742d554f2c10e9a273855d87a68f5ee93ed29 by Miss Islington (bot) in branch '3.7': bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) (GH-25858) https://github.com/python/cpython/commit/512742d554f2c10e9a273855d87a68f5ee93ed29 --

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by miss-islington : -- pull_requests: +24541 pull_request: https://github.com/python/cpython/pull/25858 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Ned Deily added the comment: New changeset 64be96ae1f85ce6b3bca4328576cf62d73f77b2a by Christian Heimes in branch '3.7': [3.7] bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) (GH-24928) https://github.com/python/cpython/commit/64be96ae1f85ce6b3bca4328576cf62d73f77b2a

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Christian Heimes : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

miss-islington added the comment: New changeset 0983e01837714524fb164e784a8e96a2bc4bdf94 by Miss Islington (bot) in branch '3.9': bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) https://github.com/python/cpython/commit/0983e01837714524fb164e784a8e96a2bc4bdf94 --

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

miss-islington added the comment: New changeset 04425a922b598d03770619b0c658ee9874113550 by Miss Islington (bot) in branch '3.8': bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) https://github.com/python/cpython/commit/04425a922b598d03770619b0c658ee9874113550 --

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by miss-islington : -- pull_requests: +24093 pull_request: https://github.com/python/cpython/pull/25359 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by miss-islington : -- pull_requests: +24092 pull_request: https://github.com/python/cpython/pull/25358 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: New changeset 3447750073aff229b049e4ccd6217db2811dcfd1 by Christian Heimes in branch 'master': bpo-41561: Fix testing with OpenSSL 1.0.2 (GH-25355) https://github.com/python/cpython/commit/3447750073aff229b049e4ccd6217db2811dcfd1 --

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Christian Heimes : -- pull_requests: +24090 pull_request: https://github.com/python/cpython/pull/25355 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Christian Heimes : -- pull_requests: +23690 pull_request: https://github.com/python/cpython/pull/24928 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

miss-islington added the comment: New changeset 50511677f59464e612cfef0cd0e139fe07e87737 by Miss Islington (bot) in branch '3.8': bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) https://github.com/python/cpython/commit/50511677f59464e612cfef0cd0e139fe07e87737

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

miss-islington added the comment: New changeset 3365e684a83a6bc9e2e2198dca54b42711bd3c90 by Miss Islington (bot) in branch '3.9': bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) https://github.com/python/cpython/commit/3365e684a83a6bc9e2e2198dca54b42711bd3c90

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by miss-islington : -- pull_requests: +23689 pull_request: https://github.com/python/cpython/pull/24926 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by miss-islington : -- pull_requests: +23688 pull_request: https://github.com/python/cpython/pull/24925 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

miss-islington added the comment: New changeset f6c6b5821bff815bdc810de53992fd1fbdb2edd4 by Christian Heimes in branch 'master': bpo-41561: Add workaround for Ubuntu's custom security level (GH-24915) https://github.com/python/cpython/commit/f6c6b5821bff815bdc810de53992fd1fbdb2edd4

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: Dimitri John Ledkov from Canonical has opened a feature request for a context validation feature on the OpenSSL issue tracker, https://github.com/openssl/openssl/issues/14607 -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Christian Heimes : -- pull_requests: +23678 stage: commit review -> patch review pull_request: https://github.com/python/cpython/pull/24915 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: I have discussed the problem with downstream engineers on the two issues - https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 - https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 The gist of the issue is: Canonical has taken a

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Terry J. Reedy : -- nosy: -terry.reedy ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: Downstream has asked me to file a separate bug for internal error during handshake. The problem is tracked at https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1917625 . -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Terry J. Reedy added the comment: Christian, I don't see any open PRs to be commit reviewed. -- nosy: +terry.reedy versions: +Python 3.10 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Christian Heimes : -- resolution: fixed -> stage: resolved -> commit review status: closed -> open ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Christian Heimes : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

miss-islington added the comment: New changeset 802ff7c0d339376a1b974e57d2caca898310de3d by Miss Islington (bot) in branch '3.9': [3.9] bpo-41561: skip test_min_max_version_mismatch (GH-22308) (GH-23363) https://github.com/python/cpython/commit/802ff7c0d339376a1b974e57d2caca898310de3d

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

miss-islington added the comment: New changeset 73e02ff0d47c37cf2a8f137cfbea0b36d26c48bb by Miss Islington (bot) in branch '3.8': bpo-41561: skip test_min_max_version_mismatch (GH-22308) https://github.com/python/cpython/commit/73e02ff0d47c37cf2a8f137cfbea0b36d26c48bb --

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by miss-islington : -- pull_requests: +22257 pull_request: https://github.com/python/cpython/pull/23364 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by miss-islington : -- nosy: +miss-islington nosy_count: 6.0 -> 7.0 pull_requests: +22256 pull_request: https://github.com/python/cpython/pull/23363 ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: New changeset ce04e7105bc396c32667a22b928a712ba0778a3f by Christian Heimes in branch 'master': bpo-41561: skip test_min_max_version_mismatch (GH-22308) https://github.com/python/cpython/commit/ce04e7105bc396c32667a22b928a712ba0778a3f --

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I reported a bug at https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1899878 -- ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I got an advice and posted the question at https://answers.launchpad.net/ubuntu/+source/openssl/+question/693423 -- ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I started by asking a question at https://askubuntu.com/questions/1281942/pythons-test-ssl-fails-starting-from-ubuntu-20-04-i-need-to-find-a-person-at-c -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: It sounds like a Debian/Ubuntu patch is breaking an assumption. Did somebody report the bug with Debian/Ubuntu maintainers of OpenSSL already? Fedora also configures OpenSSL with minimum protocol version of TLS 1.2. The distribution does it in a slightly

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: Just tested python 3.9.0 - same issue. -- versions: +Python 3.9 ___ Python tracker ___ ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: Please note that test_ssl also passes if /etc/ssl/openssl.conf is modified per msg376705 by Vladyslav Bondar (with /usr/lib/x86_64-linux-gnu/libssl.so.1.1) -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I downloaded Ubuntu's openssl_1.1.1f.orig.tar.gz and openssl_1.1.1f-1ubuntu2.debian.tar.xz from https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2, but I did not know how to apply patches. In addition, too many files differ, so I could not

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: Yes, that would be useful. I suspect tls1.2-min-seclevel2.patch from the patch set https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2 might be the cause of this issue. -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: Is it worth comparing openssl vanilla code and configs with Ubuntu's version? -- ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: 1) I downloaded openssl-1.1.1g source code, compiled, exported LD_LIBRARY_PATH, did sudo ldconfig - ./python Lib/test/test_ssl.py now passes. If LD_LIBRARY_PATH is unset, it fails. Thank you for advice. 2) Tried the following independently from (1)

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: Did you set an rpath, reconfigure ldconfig, or LD_LIBRARY_PATH env var? If not then you compiled Python with an alternative OpenSSL installation but did not instruct the ld to load the alternative shared libraries. --with-openssl only modifies header and

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I added client_context.set_ciphers("@SECLEVEL=1:HIGH"), then added server_context.set_ciphers("@SECLEVEL=1:HIGH"). The test failed in both cases. I did not have problem with python 3.7.x. in Ubuntu 18.04. I have just tried compiling 3.7.5 in Ubuntu 20.04 and

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Tal Einat added the comment: Same. -- ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: What happens if you modify both contexts? -- ___ Python tracker ___ ___ Python-bugs-list

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Tal Einat added the comment: No, adding that after the first line of test_min_max_version_mismatch() still results in the same error: ssl.SSLError: [SSL: UNSUPPORTED_PROTOCOL] unsupported protocol (_ssl.c:1122) -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: Does "test_min_max_version_mismatch" pass on your system when you add client_context.set_ciphers("@SECLEVEL=1:HIGH") ? -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: Four times 'True' means that OpenSSL is compiled with TLS 1.0, 1,1, 1.2, and 1.3 support. SSLContext().minium_version == MINIMUM_SUPPORTED and maximum_version == MAXIMUM_SUPPORTED mean that no crypto policy setting or OpenSSL security level setting has

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Tal Einat added the comment: Likewise here on Ubuntu 20.04: (True, True, True, True) -1 -2 -- ___ Python tracker ___ ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: In case it's needed: TLSVersion.MAXIMUM_SUPPORTED == -1 TLSVersion.MINIMUM_SUPPORTED == -2 -- ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: (True, True, True, True) TLSVersion.MAXIMUM_SUPPORTED TLSVersion.MINIMUM_SUPPORTED -- ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: It's starting to look like a misconfiguration in either Ubuntu's OpenSSL build or your system. has_tls_version() checks compile time options and runtime configuration options. It should detect that TLS 1.1 and 1.0 are not available. "[SSL] internal error"

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: https://www.python.org/ftp/python/3.8.5/Python-3.8.5.tar.xz ... == ERROR: test_protocol_tlsv1 (test.test_ssl.ThreadedTests) Connecting to a TLSv1 server with various client options

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: On my system, it still fails. Here is the content of modified Lib/test/test_ssl.py: 3827 @requires_minimum_version 3828 @requires_tls_version('TLSv1_2') 3829 @requires_tls_version('TLSv1') 3830 def test_min_max_version_mismatch(self): 3831

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Christian Heimes : -- pull_requests: +21356 stage: -> patch review pull_request: https://github.com/python/cpython/pull/22308 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Skip Montanaro added the comment: > Could you please modify the test case to check for TLS 1.0 and run it Ubuntu? > > @requires_minimum_version > @requires_tls_version('TLSv1_2') > @requires_tls_version('TLSv1') > def test_min_max_version_mismatch(self): Confirmed.

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Christian Heimes added the comment: Could you please modify the test case to check for TLS 1.0 and run it Ubuntu? @requires_minimum_version @requires_tls_version('TLSv1_2') @requires_tls_version('TLSv1') def test_min_max_version_mismatch(self): For Python 3.10 I'm planning to

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I think it is not a real solution, just a workaround. What do you think the solution should be? -- ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Skip Montanaro added the comment: > > I confirm that Tal Einat's workaround also works. > Should workarounds be required to successfully run the test suite? I routinely unset PYTHONSTARTUP, but that's because I can and sometimes do weird things to support interactive use. It concerns me a bit

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I confirm that Tal Einat's workaround also works. -- versions: -Python 3.10, Python 3.9 ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Change by Tal Einat : -- versions: +Python 3.10, Python 3.9 ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Tal Einat added the comment: I just ran into this too on Ubuntu 20.04. I don't recommend changing /etc/ssl/openssl.cnf. Instead, make a local copy, for example at $HOME/cpython-dev-openssl.cnf, with the changes suggested by Vladyslav Bondar. Then run the tests with:

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: Can test_ssl script determine which TLS versions are enabled in a particular Linux distribution and run tests only for enabled versions? -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I followed Vladyslav Bondar's 2020-09-11 09:10:30 recommendations and it worked: Tests result: SUCCESS Thank you. It is not clear though how Canonical built its python-3.8.2 which comes with Ubuntu-20.04. Does anyone know someone at Canonical to ask this

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Karthikeyan Singaravelan added the comment: issue38815 also reported similar issue in test_min_max_version_mismatch. -- nosy: +xtreak ___ Python tracker ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Vladyslav Bondar added the comment: This is about openssl configuration in Ubuntu. In the latest Ubuntu, they disabled TLS 1.0/1.1. So to enable it back there is a workaround (taken from StackOverflow): You should modify openssl config: /etc/ssl/openssl.cnf You need to add this to the

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Skip Montanaro added the comment: @Vladyslav.Bondar I can't tell where you are suggesting MinProtocol should be set. I don't see that particular string in any .c, .h or .py file in the Python source. -- ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Vladyslav Bondar added the comment: This will help to solve it https://stackoverflow.com/questions/61568215/openssl-v1-1-1-ubuntu-20-tlsv1-no-protocols-available But in my case I've defined: MinProtocol = None -- nosy: +Vladyslav.Bondar ___

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Bug Reporter added the comment: I don't know if it matters, but I started having this problem when I switched from Ubuntu 18.04 (native python3.7) to 20.04 (native python3.8.2). I specify --prefix to a folder in my home directory, but while running make test Ubuntu gives a system error

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Skip Montanaro added the comment: This skips the breaking tests (but doesn't actually fix anything). -- keywords: +patch versions: +Python 3.10 -Python 3.8 Added file: https://bugs.python.org/file49450/test_ssl_ubuntu.diff ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

Skip Montanaro added the comment: Has any progress been made on the Ubuntu 20.04 test_ssl failures? Is there any consensus about it being a Python or Ubuntu problem? -- nosy: +skip.montanaro ___ Python tracker

[issue41561] test_ssl fails in Ubuntu 20.04: test_min_max_version_mismatch

New submission from Bug Reporter : FAIL: test_min_max_version_mismatch (test.test_ssl.ThreadedTests) -- Traceback (most recent call last): File "/home/vbk/Downloads/Python-3.8.5/Lib/test/test_ssl.py", line 217, in wrapper