Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OpenSSL 3.0.0: Handle UNEXPECTED_EOF_WHILE_READING / wrap SSL_OP_IGNORE_UNEXPECTED_EOF #87960

Closed
tiran opened this issue Apr 9, 2021 · 6 comments
Closed
Assignees
Labels
3.8 3.9 3.10 expert-SSL type-bug

Comments

@tiran
Copy link
Member

@tiran tiran commented Apr 9, 2021

BPO 43794
Nosy @tiran, @agronholm, @miss-islington
PRs
  • #25309
  • #25313
  • #25314
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = 'https://github.com/tiran'
    closed_at = <Date 2021-05-02.14:07:05.788>
    created_at = <Date 2021-04-09.14:13:11.374>
    labels = ['expert-SSL', 'type-bug', '3.8', '3.9', '3.10']
    title = 'OpenSSL 3.0.0: Handle UNEXPECTED_EOF_WHILE_READING / wrap SSL_OP_IGNORE_UNEXPECTED_EOF'
    updated_at = <Date 2021-12-11.23:41:17.142>
    user = 'https://github.com/tiran'

    bugs.python.org fields:

    activity = <Date 2021-12-11.23:41:17.142>
    actor = 'alex.gronholm'
    assignee = 'christian.heimes'
    closed = True
    closed_date = <Date 2021-05-02.14:07:05.788>
    closer = 'christian.heimes'
    components = ['SSL']
    creation = <Date 2021-04-09.14:13:11.374>
    creator = 'christian.heimes'
    dependencies = []
    files = []
    hgrepos = []
    issue_num = 43794
    keywords = ['patch']
    message_count = 6.0
    messages = ['390632', '390640', '390642', '390643', '392699', '408350']
    nosy_count = 3.0
    nosy_names = ['christian.heimes', 'alex.gronholm', 'miss-islington']
    pr_nums = ['25309', '25313', '25314']
    priority = 'normal'
    resolution = 'fixed'
    stage = 'resolved'
    status = 'closed'
    superseder = None
    type = 'behavior'
    url = 'https://bugs.python.org/issue43794'
    versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']

    @tiran
    Copy link
    Member Author

    @tiran tiran commented Apr 9, 2021

    OpenSSL 3.0.0 state machine handles unexpected EOFs more strict and requires peers to properly shut down connections. The old OpenSSL 1.1.1 behavior can be get back with SSL_OP_IGNORE_UNEXPECTED_EOF.

    I propose to add the option by default until Python's ssl module has better ways to perform one-way shutdown of connections.

    https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_options.html

    Some TLS implementations do not send the mandatory close_notify alert on shutdown. If the application tries to wait for the close_notify alert but the peer closes the connection without sending it, an error is generated. When this option is enabled the peer does not need to send the close_notify alert and a closed connection will be treated as if the close_notify alert was received.

    You should only enable this option if the protocol running over TLS can detect a truncation attack itself, and that the application is checking for that truncation attack.

    @tiran tiran self-assigned this Apr 9, 2021
    @tiran tiran added expert-SSL type-bug 3.8 3.9 3.10 labels Apr 9, 2021
    @tiran tiran self-assigned this Apr 9, 2021
    @tiran tiran added expert-SSL type-bug labels Apr 9, 2021
    @tiran
    Copy link
    Member Author

    @tiran tiran commented Apr 9, 2021

    New changeset 6f37ebc by Christian Heimes in branch 'master':
    bpo-43794: OpenSSL 3.0.0: set OP_IGNORE_UNEXPECTED_EOF by default (GH-25309)
    6f37ebc

    @miss-islington
    Copy link
    Contributor

    @miss-islington miss-islington commented Apr 9, 2021

    New changeset e18ebd9 by Miss Islington (bot) in branch '3.8':
    bpo-43794: OpenSSL 3.0.0: set OP_IGNORE_UNEXPECTED_EOF by default (GH-25309)
    e18ebd9

    @miss-islington
    Copy link
    Contributor

    @miss-islington miss-islington commented Apr 9, 2021

    New changeset 54d89a3 by Miss Islington (bot) in branch '3.9':
    bpo-43794: OpenSSL 3.0.0: set OP_IGNORE_UNEXPECTED_EOF by default (GH-25309)
    54d89a3

    @tiran
    Copy link
    Member Author

    @tiran tiran commented May 2, 2021

    I have updated whatsnew in #70003.

    @tiran tiran closed this as completed May 2, 2021
    @tiran tiran closed this as completed May 2, 2021
    @agronholm
    Copy link
    Mannequin

    @agronholm agronholm mannequin commented Dec 11, 2021

    OpenSSL 1.1.1 also handled EOFs strictly, but this behavior was generally suppressed in the ssl module through the default setting of suppress_ragged_eofs=True (thus enabling truncation attacks by default). The PR changes the behavior of existing applications in such a way that previously detectable unexpected EOFs are now no longer detectable by default. To make matters worse, EOF errors are not translated to SSLEOFError anymore, and instead I have to match the strerror attribute in SSLError to detect this condition.

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Labels
    3.8 3.9 3.10 expert-SSL type-bug
    Projects
    None yet
    Development

    No branches or pull requests

    2 participants