Bug 7015 - python: Disables SSLv3
Summary: python: Disables SSLv3
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: connectivity (show other bugs)
Version: 1.8
Hardware: x86 Multiple
: Medium+ normal
Target Milestone: 1.7.2
Assignee: Sona Sarmadi
QA Contact:
URL:
Whiteboard:
Depends on:
Blocks:
 
Reported: 2014-12-03 06:55 UTC by Sona Sarmadi
Modified: 2015-02-11 17:43 UTC (History)
4 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: Don't know

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sona Sarmadi 2014-12-03 06:55:15 UTC 
This is related to "SSLv3 POODLE vulnerability CVE-2014-3566" https://bugzilla.yoctoproject.org/show_bug.cgi?id=6843

I have found two patches which disables SSLv3 in python, one from python.org and one from debian.org:
1) http://bugs.python.org/issue22638 (patch name: issue22638.diff,  http://bugs.python.org/file36926/issue22638.diff)
This patch disables SSLv3 by default for Python. But I couldn't apply this patch. It seems this is for newer python version.

2) https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768611#22 (python2.7-nossl3.patch) Building without SSLv3 support when openssl is built without any support for SSLv3

I have applied patch #2, I am running some tests. I will send the patch to OE-core.
Comment 1 Sona Sarmadi 2014-12-11 11:27:09 UTC 
The patch from python.org (http://bugs.python.org/issue22638) is for 2.7.9. The ssl module in 2.7.9 was backported from Python 3, its code is vastly different. So this patch can not be applied for our version. 
2.7.9 should be released soon in December or January.


Patch from Debian (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=768611#17)seems not disable SSLv3 in python. 

root@p2020rdb:~# python
>>> import ssl
>>> print ssl.PROTOCOL_SSLv3
1
>>> print ssl.PROTOCOL_SSLv2
0
>>> print ssl.PROTOCOL_SSLv23
2

We need to disable SSLv3 in openssl (i.e. define OPENSSL_NO_SSL3) for this Debian patch to work. I have added this define in ssl/ssl.h file, but this doesn't seem to help:

ssl/ssl.h

#ifndef OPENSSL_NO_SSL3
#define OPENSSL_NO_SSL3
#endif

My conclusion is that we upgrade python version in master to 2.7.9 to get this fix. Applying Debian patch seems to be risky, since we need to do additional manual changes.
Comment 2 Sona Sarmadi 2014-12-11 11:30:25 UTC 
This issue is realted to [Bug 7059] Upgrade python 2.x to 2.7.9
Comment 3 Sona Sarmadi 2014-12-16 12:39:17 UTC 
I applied Debian patch, disable SSLv3 in Openssl and run some tests:
Poky (Yocto Project Reference Distro) 1.7 qemuarm /dev/ttyAMA0

qemuarm login: root
root@qemuarm:~# python
Python 2.7.3 (default, Dec 16 2014, 10:31:44)
[GCC 4.9.1] on linux2
Type "help", "copyright", "credits" or "license" for more information.

I can import "PROTOCOL_SSLv23" and "PROTOCOL_TLSv1" but not "PROTOCOL_SSLv3" so it seems tha SSLv3 is disabled:

>>> from _ssl import PROTOCOL_SSLv23
>>> from _ssl import PROTOCOL_TLSv1
>>> from _ssl import PROTOCOL_SSLv3
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: cannot import name PROTOCOL_SSLv3
>>>

But this doesn't look good:
>>> import ssl
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python2.7/ssl.py", line 76, in <module>
    from _ssl import PROTOCOL_SSLv3, PROTOCOL_SSLv23, PROTOCOL_TLSv1
ImportError: cannot import name PROTOCOL_SSLv3
>>>

Python has released 2.7.9 which disables SSLv3. I will download the source code and see how they have fixed this issue.
Comment 4 Richard Purdie 2015-02-02 14:12:39 UTC 
Was fixed in master with: http://git.yoctoproject.org/cgit.cgi/poky/commit/?id=103663075ebc916958079cb2c4b350eb2222894b