[Python-bugs-list] [ python-Bugs-232460 ] SSL Support (Apparently) Broken on Solaris

Thu, 11 Oct 2001 09:07:17 -0700

Bugs item #232460, was opened at 2001-02-14 19:14
You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=105470&aid=232460&group_id=5470

Category: Extension Modules
Group: Platform-specific
Status: Open
Resolution: None
>Priority: 5
Submitted By: David M. Beazley (beazley)
>Assigned to: Jeremy Hylton (jhylton)
Summary: SSL Support (Apparently) Broken on Solaris

Initial Comment:
I have spent about 10 hours banging on this with no luck.

Python   :  Python-2.0
Platform :  SPARC Solaris 2.8
Compiler :  Sun Workshop Pro v5.0, gcc-2.95-2
OpenSSL  :  openssl-0.9.6 and 0.9.5.

Problem -

All attempts to open a SSL connection result in an "SSL_connect error".

I have tried various combinations of keys and certificates.
I have looked at the Python source code extensively and added debugging to try and get more information.  I have run the system using the openssl s_client and s_server testing tools.   I have recompiled everything in various configurations of versions and compilers.  In all cases, the same error is generated.

That said, has *ANYBODY* gotten this to work on Solaris?  
If so, do you have any details that can be shared?

Cheers,

Dave

P.S. I will submit a patch if I can ever get this to actually work.

----------------------------------------------------------------------

Comment By: Martin v. Löwis (loewis)
Date: 2001-07-28 10:39

Message:
Logged In: YES 
user_id=21627

I still have the same problem, both on my own installation 
(both with 2.1.1, and with the CVS), as well as on 
cf.sf.net:/home/users/loewis/Python-2.1.1/python
(you need to set LD_LIBRARY_PATH=/usr/local/ssl/lib to use
this one).

----------------------------------------------------------------------

Comment By: Guido van Rossum (gvanrossum)
Date: 2001-04-14 20:30

Message:
Logged In: YES 
user_id=6380

David, is this still broken?

On the SourceForge compile farm I can use SSL just fine.

Check out my directory
/home/users/gvanrossum/Python-2.1-solaris on
cf.sourceforge.net.

----------------------------------------------------------------------

Comment By: Guido van Rossum (gvanrossum)
Date: 2001-04-10 11:55

Message:
Logged In: YES 
user_id=6380

So, David, you still interested in this?

----------------------------------------------------------------------

Comment By: A.M. Kuchling (akuchling)
Date: 2001-03-20 07:58

Message:
Logged In: YES 
user_id=11375

Moshe checked in patch #405101 to the CVS tree.  David, can
you update and see if it fixed the problem for you?

----------------------------------------------------------------------

Comment By: Moshe Zadka (moshez)
Date: 2001-03-18 02:30

Message:
Logged In: YES 
user_id=11645

I just want to me-too Neil, since I submitted the original
patch. I think it *did* fix problems on Solaris, as long
as the user is running EGD and set up RANDFILE env. variable
properly. Otherwise, you won't be getting connect errors,
but a warning from Python about using a non-secure way to
generate seed.
(For the record, the problem is that Solaris doesn't have a
/dev/urandom like Linux does)

----------------------------------------------------------------------

Comment By: Neil Schemenauer (nascheme)
Date: 2001-03-02 07:49

Message:
Logged In: YES 
user_id=35752

It looks like patch "[ #405101 ] Add Random Seeding to
OpenSSL" might fix this.  Assigning to Andrew since he
is assigned that patch too.

----------------------------------------------------------------------

Comment By: David M. Beazley (beazley)
Date: 2001-02-15 06:12

Message:
A followup on this bug....  It appears that Python is not properly
seeding the OpenSSL random number generator when it creates a secure
socket.  This, in turn, causes the SSL_connect() function to fail due
to improper random number seeding (although the error wasn't
obvious--at least not to me).   This is also due to an apparent
"feature" of Solaris not providing a usable /dev/random device.

A simple fix is to modify init_socket() in socketmodule.c to include
a call to RAND_seed() like this:                                     

#ifdef USE_SSL
        SSL_load_error_strings();
        SSLeay_add_ssl_algorithms();
        /* Sick hack for Solaris */
        {
           char bogus[64];
           /* Fill in bogus with some random noise */
           ...
           RAND_seed(bogus, 64);
        }
        ...
#endif

Presumably one would need to think about the randomness actually
passed to RAND_seed()  (I have done nothing above).                   

Here are related comments from the OpenSSL FAQ: 

"Cryptographic software needs a source of unpredictable data to work
correctly. Many open source operating systems provide a "randomness
device" that serves this purpose. On other systems, applications have
to call the RAND_add() or RAND_seed() function with appropriate data
before generating keys or performing public key encryption.     

Some broken applications do not do this. As of version
0.9.5, the OpenSSL functions that need randomness report an error if
the random number generator has not been seeded with at least 128 bits of
randomness. If this error occurs, please contact the author of the
application you are using. It is likely that it never worked
correctly. OpenSSL 0.9.5 and later make the error visible by refusing
to perform potentially insecure encryption."

Python-2.1a2 does not appear to include a fix, but I can't test it to
find out (since 2.1a2 doesn't compile on my machine).                   

Cheers,

Dave

----------------------------------------------------------------------

You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=105470&aid=232460&group_id=5470