AttributeError: module 'lib' has no attribute 'SSL_OP_NO_TLSv1_3'

[lgov]

Hi,

I rebuilt a docker image today, based on Ubuntu 18.04 and got the following exception in a small Python script:

  File "/usr/local/lib/python3.6/dist-packages/urllib3/contrib/pyopenssl.py", line 50, in <module>
    import OpenSSL.SSL
  File "/usr/local/lib/python3.6/dist-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/usr/local/lib/python3.6/dist-packages/OpenSSL/SSL.py", line 149, in <module>
    OP_NO_TLSv1_3 = _lib.SSL_OP_NO_TLSv1_3
AttributeError: module 'lib' has no attribute 'SSL_OP_NO_TLSv1_3'

Purpose of my python script is to connect to a AWS S3 bucket over https, so there are a couple of layers of code before OpenSSL code is run. But it's not specific to my script, I get the same exception when running pip list.

I suppose the problem here is that I haven't installed the required version of a dependency, but I'll investigate that further.

[alex]

What version of cryptography do you have installed?

…

On Sat, Nov 28, 2020 at 5:26 PM Lieven Govaerts ***@***.***> wrote: Hi, I rebuilt a docker image today, based on Ubuntu 18.04 and got the following exception in a small Python script: File "/usr/local/lib/python3.6/dist-packages/urllib3/contrib/pyopenssl.py", line 50, in <module> import OpenSSL.SSL File "/usr/local/lib/python3.6/dist-packages/OpenSSL/__init__.py", line 8, in <module> from OpenSSL import crypto, SSL File "/usr/local/lib/python3.6/dist-packages/OpenSSL/SSL.py", line 149, in <module> OP_NO_TLSv1_3 = _lib.SSL_OP_NO_TLSv1_3 AttributeError: module 'lib' has no attribute 'SSL_OP_NO_TLSv1_3' Purpose of my python script is to connect to a AWS S3 bucket over https, so there are a couple of layers of code before OpenSSL code is run. But it's not specific to my script, I get the same exception when running pip list. I suppose the problem here is that I haven't installed the required version of a dependency, but I'll investigate that further. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#970>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBF2LVQMSYVCQYPH45DSSF2KZANCNFSM4UGCKTJQ> .

-- All that is necessary for evil to succeed is for good people to do nothing.

[lgov]

...
__version__ = "20.0.0"

__title__ = "pyOpenSSL"
__uri__ = "https://pyopenssl.org/"
__summary__ = "Python wrapper module around the OpenSSL library"
__author__ = "The pyOpenSSL developers"
__email__ = "cryptography-dev@python.org"
__license__ = "Apache License, Version 2.0"
__copyright__ = "Copyright 2001-2020 {0}".format(__author__)

cat /usr/lib/python3/dist-packages/cryptography/__about__.py 
...
__version__ = "2.1.4"
...

This version doesn't meet the minimum requirements of pyopenssl, but it's the one that is pre-installed in the image. Just a bit surprised that pip doesn't automatically upgrade the cryptography package...

[alex]

You should not be mixing distro packages and pip packages.

[koniiiik]

This issue also affects systems with source builds of cryptography against openssl 1.1.0:

$  docker run --rm -it python:3.6-stretch bash
root@24f6707b548f:/# openssl version
OpenSSL 1.1.0l  10 Sep 2019
root@24f6707b548f:/# pip install --no-binary ':all:' pyopenssl
Collecting pyopenssl
  Downloading pyOpenSSL-20.0.0.tar.gz (173 kB)
     |████████████████████████████████| 173 kB 2.5 MB/s 
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
    Preparing wheel metadata ... done
Collecting cryptography>=3.2
  Downloading cryptography-3.3.1.tar.gz (539 kB)
     |████████████████████████████████| 539 kB 11.4 MB/s 
  Installing build dependencies ... done
  Getting requirements to build wheel ... done
    Preparing wheel metadata ... done
Collecting cffi>=1.12
  Using cached cffi-1.14.4.tar.gz (471 kB)
Collecting pycparser
  Using cached pycparser-2.20.tar.gz (161 kB)
Collecting six>=1.5.2
  Downloading six-1.15.0.tar.gz (33 kB)
Skipping wheel build for cffi, due to binaries being disabled for it.
Skipping wheel build for pycparser, due to binaries being disabled for it.
Skipping wheel build for six, due to binaries being disabled for it.
Building wheels for collected packages: pyopenssl, cryptography
  Building wheel for pyopenssl (PEP 517) ... done
  Created wheel for pyopenssl: filename=pyOpenSSL-20.0.0-py2.py3-none-any.whl size=54015 sha256=65343c44a4564b3586b9b9a6eaee9f88573f2ff0ef7430e778f98575b03e9eff
  Stored in directory: /root/.cache/pip/wheels/19/b6/83/5dd6cc916f8270462cb66241870ca012208208b1d447e99793
  Building wheel for cryptography (PEP 517) ... done
  Created wheel for cryptography: filename=cryptography-3.3.1-cp36-cp36m-linux_x86_64.whl size=985884 sha256=2c74ebb08d7cce28f003e06e3564b7cabdc0c154d229808b73447ff3def54394
  Stored in directory: /root/.cache/pip/wheels/1a/55/d3/e4def74afc4abd59779d4f717838681ff06b0c68ed60b8e489
Successfully built pyopenssl cryptography
Installing collected packages: pycparser, six, cffi, cryptography, pyopenssl
    Running setup.py install for pycparser ... done
    Running setup.py install for six ... done
    Running setup.py install for cffi ... done
Successfully installed cffi-1.14.4 cryptography-3.3.1 pycparser-2.20 pyopenssl-20.0.0 six-1.15.0
root@24f6707b548f:/# python -c 'import OpenSSL.SSL'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/local/lib/python3.6/site-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/usr/local/lib/python3.6/site-packages/OpenSSL/SSL.py", line 149, in <module>
    OP_NO_TLSv1_3 = _lib.SSL_OP_NO_TLSv1_3
AttributeError: module 'lib' has no attribute 'SSL_OP_NO_TLSv1_3'

The problem is that OP_NO_TLSv1_3 was first defined in openssl 1.1.1, whereas the changelog states tha tonly versions below 1.1 were dropped. In fact, the docs still list 1.0.2 at https://www.pyopenssl.org/en/stable/install.html#supported-openssl-versions. I'll try to fire off a quick PR to update the docs to reflect this.