ssl broken for python > 2.7.9

[joequant]

eventlet/eventlet#135

2.7.9 removed _sslwrap which means that the gevent ssl.py will fail.

[Eugeny]

Here's a working polyfill which works with gevent 1.0 + cpython 2.7.9

# Re-add sslwrap to Python 2.7.9
import inspect
__ssl__ = __import__('ssl')

try:
    _ssl = __ssl__._ssl
except AttributeError:
    _ssl = __ssl__._ssl2


def new_sslwrap(sock, server_side=False, keyfile=None, certfile=None, cert_reqs=__ssl__.CERT_NONE, ssl_version=__ssl__.PROTOCOL_SSLv23, ca_certs=None, ciphers=None):
    context = __ssl__.SSLContext(ssl_version)
    context.verify_mode = cert_reqs or __ssl__.CERT_NONE
    if ca_certs:
        context.load_verify_locations(ca_certs)
    if certfile:
        context.load_cert_chain(certfile, keyfile)
    if ciphers:
        context.set_ciphers(ciphers)

    caller_self = inspect.currentframe().f_back.f_locals['self']
    return context._wrap_socket(sock, server_side=server_side, ssl_sock=caller_self)

if not hasattr(_ssl, 'sslwrap'):
    _ssl.sslwrap = new_sslwrap

[alexcpsec]

Guys, a serious 👍 on this. Amazon issued a mandatory update on their Python 2.7 RPMs that seems to be backporting some of these things from 2.7.9. I can't tell what they updated, but it fails as above.

Took me a long time to trace the issue to this, and to figure out they issued this auto-update directive.

I assume there should be more people coming this way because of this. I'd be very grateful if you can prioritize this.

[cbsmith]

LIkewise. I just got hit too. It appears Amazon has backported these to their 2.7 Python RPMs, even though everything claims it is still 2.7.8. SOOO annoying.

[denik]

There's some discussion going on python bug tracker whether to restore _sslwrap or not.

[ellimilial]

This is quite irritating indeed. Digital Ocean Ubuntu Trusty 14.04 is on 2.7.8-1 (which, as @cbsmith mentioned, lacks _sslwrap), ended up forking and applying @Eugeny 's changes to make it work.

[alexcpsec]

@ellimilial I am not really a Python person, and I could not compile @Eugeny 's changes using cpython as they were. Did you make some adjustments on it to make it work?

[ellimilial]

@alexcpsec I forked from yesterday's master and applied the changes, then installed with pip: https://gist.github.com/ellimilial/5ef1d1917e00970d4457

Compiled on fresh Ubuntu 14.04 (python 2.7.8-1), but problems with compiling after installing some oldish python packages (breaking after gevent.corecext.c).

[alexcpsec]

@ellimilial Thanks! I'll give it a try

[zappjones]

This just bit us as well.
Amazon currently says our python version is 2.7.8 but it's most certainly breaking on this.
We applied this patch to ssl.py in gevent and it seems to be working great, thanks :)

[grubberr]

the problem already appeared on debian
debian 6 testing python2.7-2.7.8-11
it seems guys from debian already applied that ssl patches

root@server:~# dpkg -l python2.7
ii  python2.7                     2.7.8-11            amd64

root@bots71:~# python -c "import ssl ; ssl._ssl.sslwrap"
Traceback (most recent call last):
  File "<string>", line 1, in <module>
AttributeError: 'module' object has no attribute 'sslwrap'

[asieira]

+1

[pigmej]

So the problem is not only with sslwrap being removed.

2.7.9 (and then backported to 2.7.8) added arguments to ssl.SSLSocket.

Old definition was (gevent has still it):
__init__(self, sock, keyfile=None, certfile=None, server_side=False, cert_reqs=0, ssl_version=2, ca_certs=None, do_handshake_on_connect=True, suppress_ragged_eofs=True, ciphers=None)

New one is:
__init__(self, sock, keyfile=None, certfile=None, server_side=False, cert_reqs=0, ssl_version=2, ca_certs=None, do_handshake_on_connect=True, suppress_ragged_eofs=True, ciphers=None, server_hostname=None, _context=None)

// if someone needs a hack for this, then just add those to constructor and ignore, code will work (but host verification would not)

And as other already mentioned, that "briliant" idea is backported to 2.7.8 on debian/ubuntu, while is't not (yet?) on fedora 21

[italomaia]

Eugeny, your snippet fixed things for me. Thanks!
+1

[sailorfred]

This has hit us, too. Do we think there will be a fix soon that doesn't require an application patch that will likely need removing when ssl or gevent or both get updated? I need to set the higher ups' expectations.

[mtsgrd]

Is this an expected side effect of the issue? I'm on Yosemite 10.10.1 with Python 2.7.9 and I get this error after a gevent monkey patch.

 File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 154, in urlopen
    return opener.open(url, data, timeout)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 431, in open
    response = self._open(req, data)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 449, in _open
    '_open', req)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 409, in _call_chain
    result = func(*args)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1240, in https_open
    context=self._context)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/urllib2.py", line 1194, in do_open
    h.request(req.get_method(), req.get_selector(), req.data, headers)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1001, in request
    self._send_request(method, url, body, headers)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1035, in _send_request
    self.endheaders(body)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 997, in endheaders
    self._send_output(message_body)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 850, in _send_output
    self.send(msg)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 812, in send
    self.connect()
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/httplib.py", line 1212, in connect
    server_hostname=server_hostname)
  File "/usr/local/Cellar/python/2.7.9/Frameworks/Python.framework/Versions/2.7/lib/python2.7/ssl.py", line 350, in wrap_socket
    _context=self)
TypeError: __init__() got an unexpected keyword argument 'server_hostname'

[pigmej]

@mtsgrd that's exactly what I was talking about. So, yes it's "known".

[mtsgrd]

And could someone share their thoughts on side-effects by solving the above this way? mtsgrd@ae03921

edit: I see @pigmej suggests host verification is turned off when modifying the SSLSocket constructor to accept server_hostname and _context.

[josegonzalez]

I had this same issue, but was able to correct it by adding @Eugeny's fix as a custom ssl_279.py module in my app and then importing it. Seems to fix my flask/gevent/gunicorn app at least.

[josegonzalez]

As @pigmej mentioned, the SSLSocket issue is still a problem. Here's the "bad" code. I looked into the gevent code, don't know what the exact fix would be. Lame that this effects heroku apps :(

[mtsgrd]

@josegonzalez this hasn't affected our Heroku apps in my domain yet. Can you confirm you see it on Heroku?

As of yesterday, I now see this issue on Travis.

[josegonzalez]

I definitely saw this on heroku when I commented here last, so I downgraded my python to 2.7.8 to have it work.

[domenkozar]

Debian has a patch: https://bazaar.launchpad.net/~ubuntu-branches/ubuntu/utopic/python-gevent/utopic/view/head:/debian/patches/sslwrap.py

[tomster]

@iElectric you sure that patch works? i applied it to gevent 1.0.1 and that results in NameError: global name 'SSLContext' is not defined when running the patched version. looking at the initial file i cannot see how that patch should fix the issue.

does anybody have a fix for this?

[domenkozar]

Could you paste the whole traceback? Thanks!
On 19 Jan 2015 17:13, "Tom Lazar" notifications@github.com wrote:

@iElectric https://github.com/iElectric you sure that patch works? i
applied it to gevent 1.0.1 and that results in NameError: global name
'SSLContext' is not defined when running the patched version. looking at
the initial file i cannot see how that patch should fix the issue.

does anybody have a fix for this?

—
Reply to this email directly or view it on GitHub
#477 (comment).

[shazow]

FYI there's a $130 bounty on urllib3 for what I believe was this bug, who would be the appropriate person to claim it?

• wrap_socket does not accept server_hostname in 2.7.x (breaks with gevent) urllib3/urllib3#482
• https://www.bountysource.com/issues/5067076-wrap_socket-does-not-accept-server_hostname-in-2-7-x-breaks-with-gevent

[jamadden]

@sprin did the initial port, although there were several others involved in backporting from master to 1.0.x and reviewing and testing such as @Ivoz and @thedrow.

[shazow]

If one of you would like to submit a claim on Bountysource, I think you can describe the appropriate split and ask them to distribute the bounty accordingly. :) (Might need to send an email once a claim has been submitted.) Let me know if I can help!

[jasonwiener]

Thanks you guys! Really helped me out!

[transfluxus]

I'm using python 2.7.10 and gevent 1.0.1
when I try to upgrade gevent it fails
error: command 'cc' failed with exit status 1