PROTOCOL_SSLv3 is not defined error

[malarinv]

Is there any work around for this bug currently on this docker image?

gevent/gevent#513

[yosifkit]

Is it still broken? Do you have an example? The images contain python compiled from source tarballs directly from python.org and the linked issue has been merged/fixed in python itself. Do you know what releases of python this was fixed in?

[malarinv]

it is still broken.

steps to reproduce:

$docker run -it --rm python:2-onbuild /bin/bash
#pip install gevent
#python 
>>>> from gevent import ssl
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python2.7/site-packages/gevent/ssl.py", line 386, in <module>
    def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None):
NameError: name 'PROTOCOL_SSLv3' is not defined

[tianon]

This seems like it's relevant: (from https://docs.python.org/2/library/ssl.html#ssl.PROTOCOL_SSLv3)

This protocol is not be available if OpenSSL is compiled with the OPENSSL_NO_SSLv3 flag.

We just use OpenSSL from the Debian archive, but in looking at it on http://sources.debian.net/src/openssl/1.0.1j-1/debian/, I don't see anything explicitly disabling SSLv3, so I'm a little confused. Maybe I'm just missing something and someone else has a better eye?

[alexanderjulo]

I just hit this bug, too. I am no expert in this, but apparently the standard python on debian was patched to fix this bug. Is it possible this python would work with this patch?

I also found a [chat log[(https://botbot.me/freenode/cryptography-dev/2014-11-23/?page=2) that seemed to be related to this, but I am missing the knowledge/context to understand whether this contains really relevant information, just added it to be sure.

According to the linked debian bug this should be fixed in python v2.7.9 (which you are using here, but I extracted the source code from the container and I still see the unmatched version). I have verified that this bug does not occur with python:2.7.7, too.

[yosifkit]

Do we have a possible solution to fix this?

[hheimbuerger]

EDIT: @alexex is right, the python:2.7.7 image works, while the python:2.7.9 image does not work with gevent.

[tianon]

@hheimbuerger

@yosifkit: Do we have a possible solution to fix this?

If there's a good, upstream-supported way for us to fix this, we want the fix.

[hukka]

For some reason the gevent maintainer has not been active in many months and there has been no new release. But the patch is already in master. Our solution was to update gevent from github on top of the debian base image.

[camilonova]

Seems the fix was released: https://github.com/gevent/gevent/blob/1.0.2/changelog.rst#release-102-may-23-2015

Whats next?

[tianon]

I think the next thing to do would be to close this issue -- I can confirm that it's fixed:

$ docker run -it --rm python:2.7 bash
root@d8e79d80b016:/# pip install gevent
Collecting gevent
  Downloading gevent-1.0.2.tar.gz (1.7MB)
    100% |████████████████████████████████| 1.7MB 222kB/s 
Collecting greenlet>=0.4.7 (from gevent)
  Downloading greenlet-0.4.7.zip (77kB)
    100% |████████████████████████████████| 77kB 3.1MB/s 
Building wheels for collected packages: gevent, greenlet
  Running setup.py bdist_wheel for gevent
  Stored in directory: /root/.cache/pip/wheels/b4/c5/69/cb36960ac7193f6441df14dd58bf639bf944d37dd68c6edf32
  Running setup.py bdist_wheel for greenlet
  Stored in directory: /root/.cache/pip/wheels/d4/31/01/87f564270b259398bb74f0fcbd485f5009f3b26a879beec2d3
Successfully built gevent greenlet
Installing collected packages: greenlet, gevent
Successfully installed gevent-1.0.2 greenlet-0.4.7

👍