Bug 7015

Summary: python: Disables SSLv3
Product: [Build System, Metadata & Runtime] OE-Core Reporter: Sona Sarmadi <sona.sarmadi>
Component: connectivityAssignee: Sona Sarmadi <sona.sarmadi>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: Medium+ CC: meta.mr.watcher, meta.watcher, richard.purdie, sgw
Version: 1.8   
Target Milestone: 1.7.2   
Hardware: x86   
OS: Multiple   
Whiteboard:
OS type for building Yocto: --- Type of Regression: ---
Verified: Documentation change: Don't know

Description Sona Sarmadi 2014-12-03 06:55:15 UTC 
This is related to "SSLv3 POODLE vulnerability CVE-2014-3566" https://bugzilla.yoctoproject.org/show_bug.cgi?id=6843

I have found two patches which disables SSLv3 in python, one from python.org and one from debian.org:
1) http://bugs.python.org/issue22638 (patch name: issue22638.diff,  http://bugs.python.org/file36926/issue22638.diff)
This patch disables SSLv3 by default for Python. But I couldn't apply this patch. It seems this is for newer python version.

2) https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768611#22 (python2.7-nossl3.patch) Building without SSLv3 support when openssl is built without any support for SSLv3

I have applied patch #2, I am running some tests. I will send the patch to OE-core.
Comment 1 Sona Sarmadi 2014-12-11 11:27:09 UTC 
The patch from python.org (http://bugs.python.org/issue22638) is for 2.7.9. The ssl module in 2.7.9 was backported from Python 3, its code is vastly different. So this patch can not be applied for our version. 
2.7.9 should be released soon in December or January.


Patch from Debian (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768611#17)seems not disable SSLv3 in python. 

root@p2020rdb:~# python
>>> import ssl
>>> print ssl.PROTOCOL_SSLv3
1
>>> print ssl.PROTOCOL_SSLv2
0
>>> print ssl.PROTOCOL_SSLv23
2

We need to disable SSLv3 in openssl (i.e. define OPENSSL_NO_SSL3) for this Debian patch to work. I have added this define in ssl/ssl.h file, but this doesn't seem to help:

ssl/ssl.h

#ifndef OPENSSL_NO_SSL3
#define OPENSSL_NO_SSL3
#endif

My conclusion is that we upgrade python version in master to 2.7.9 to get this fix. Applying Debian patch seems to be risky, since we need to do additional manual changes.
Comment 2 Sona Sarmadi 2014-12-11 11:30:25 UTC 
This issue is realted to [Bug 7059] Upgrade python 2.x to 2.7.9
Comment 3 Sona Sarmadi 2014-12-16 12:39:17 UTC 
I applied Debian patch, disable SSLv3 in Openssl and run some tests:
Poky (Yocto Project Reference Distro) 1.7 qemuarm /dev/ttyAMA0

qemuarm login: root
root@qemuarm:~# python
Python 2.7.3 (default, Dec 16 2014, 10:31:44)
[GCC 4.9.1] on linux2
Type "help", "copyright", "credits" or "license" for more information.

I can import "PROTOCOL_SSLv23" and "PROTOCOL_TLSv1" but not "PROTOCOL_SSLv3" so it seems tha SSLv3 is disabled:

>>> from _ssl import PROTOCOL_SSLv23
>>> from _ssl import PROTOCOL_TLSv1
>>> from _ssl import PROTOCOL_SSLv3
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: cannot import name PROTOCOL_SSLv3
>>>

But this doesn't look good:
>>> import ssl
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/ssl.py", line 76, in <module>
    from _ssl import PROTOCOL_SSLv3, PROTOCOL_SSLv23, PROTOCOL_TLSv1
ImportError: cannot import name PROTOCOL_SSLv3
>>>

Python has released 2.7.9 which disables SSLv3. I will download the source code and see how they have fixed this issue.
Comment 4 Richard Purdie 2015-02-02 14:12:39 UTC 
Was fixed in master with: http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=103663075ebc916958079cb2c4b350eb2222894b