[issue23965] test_ssl failure on Fedora 22

Martin Panter added the comment: Sorry bug disabling v3 by default is Issue 25530 -- ___ Python tracker ___

[issue23965] test_ssl failure on Fedora 22

Martin Panter added the comment: I suspect the patches here are out of date considering SSL v3 has been disabled by default in Python via Issue 25613, revision 56f64ec9259f. Is there any bits of the patches worth resurrecting (for cleaner logic, future-proofing or something)? Or is this

[issue23965] test_ssl failure on Fedora 22

Nick Coghlan added the comment: This is working fine on Fedora 23, so yeah, I think the change to always disallow SSLv3 by default resolved it. -- resolution: -> out of date status: open -> closed ___ Python tracker

[issue23965] test_ssl failure on Fedora 22

STINNER Victor added the comment: test_ssl is still failing on Fedora 22. I updated Nick's patch (I worked on the default branch). With the patch, test_ssl pass. I didn't try it on other platforms. -- nosy: +haypo Added file:

[issue23965] test_ssl failure on Fedora 22

Antoine Pitrou added the comment: As I already said, patch looks fine assuming you've checked it doesn't break mainstream platforms :) -- ___ Python tracker

[issue23965] test_ssl failure on Fedora 22

Nick Coghlan added the comment: I've attached the patch for my initial attempt at addressing this, but I think my results show I went down completely the wrong path. Specifically, the three new tests are failing: FAIL: test_protocol_sslv23_not_available (test.test_ssl.ThreadedTests)

[issue23965] test_ssl failure on Fedora 22

Nick Coghlan added the comment: The attached patch creates a TLSv1 context at test_ssl import time to see if SSLv2 and SSLv3 peers are disallowed by default. The test expectations for context options, SSLv23 and SSLv3 are then adjusted accordingly. The context options tests are also updated

[issue23965] test_ssl failure on Fedora 22

Antoine Pitrou added the comment: Patch looks fine to me, assuming the tests don't fail, of course. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23965 ___

[issue23965] test_ssl failure on Fedora 22

Antoine Pitrou added the comment: As Christian, I suspect that SSLv3 is progressively getting disabled in distro builds of OpenSSL. -- ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23965

[issue23965] test_ssl failure on Fedora 22

Nick Coghlan added the comment: Yeah, I belatedly realised I was overcomplicating things, and the test failures really are just due the change in the context options to disallow SSLv3 peers by default. I have an idea for how to fix that, and I think it will make the handling of the NO_SSLv2

[issue23965] test_ssl failure on Fedora 22

Mark Daoust added the comment: I think I might have found a related/real world example. I'm on a mac with OSX-10.10.3 and test_ssl passes, but when I try to install jupyter_notebook it attempts to download some css, and gives what looks like an identical error to the first one, in the initial

[issue23965] test_ssl failure on Fedora 22

Ned Deily added the comment: (@suki, I assume this is the issue reported here: https://github.com/jupyter/notebook/issues/111 ?) -- nosy: +ned.deily ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23965

[issue23965] test_ssl failure on Fedora 22

Nick Coghlan added the comment: Digging into the test_options failure suggests Christian is right (although I think it has more to do with https://fedoraproject.org/wiki/Changes/CryptoPolicy than it does with FIPS): ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1) bin(ctx.options)

[issue23965] test_ssl failure on Fedora 22

Christian Heimes added the comment: I suspect that the FIPS version of OpenSSL can't create a SSLv3 server anymore. -- nosy: +alex, dstufft, giampaolo.rodola, janssen, pitrou ___ Python tracker rep...@bugs.python.org http://bugs.python.org/issue23965

[issue23965] test_ssl failure on Fedora 22

New submission from Kushal Das: OpenSSL version openssl-1.0.1k-6.fc22.x86_64 ssl.OPENSSL_VERSION 'OpenSSL 1.0.1k-fips 8 Jan 2015' == ERROR: test_protocol_sslv23 (test.test_ssl.ThreadedTests) Connecting to an SSLv23 server