[Python-Dev] LibreSSL support
Christian Heimes
christian at python.org
Thu Jan 18 10:32:16 EST 2018
On 2018-01-16 21:17, Christian Heimes wrote:
> FYI, master on Travis CI now builds and uses OpenSSL 1.1.0g [1]. I have
> created a daily cronjob to populate Travis' cache with OpenSSL builds.
> Until the cache is filled, Linux CI will take an extra 5 minute.
I have messed up my initial research. :( When I was checking LibreSSL
and OpenSSL for features, I draw a wrong conclusion. LibreSSL is *not*
OpenSSL 1.0.2 compatible. It only implements some of the required
features from 1.0.2 (e.g. X509_check_hostname) but not
X509_VERIFY_PARAM_set1_host.
X509_VERIFY_PARAM_set1_host() is required to perform hostname
verification during the TLS handshake. Without the function, I'm unable
to fix Python's hostname matching code [1]. LibreSSL upstream knows
about the issue since 2016 [2]. I have opened another bug report [3].
We have two options until LibreSSL has addressed the issue:
1) Make the SSL module more secure, simpler and standard conform
2) Support LibreSSL
I started a vote on Twitter [4]. So far most people prefer security.
Christian
[1] https://bugs.python.org/issue31399
[2] https://github.com/pyca/cryptography/issues/3247
[3] https://github.com/libressl-portable/portable/issues/381
[4] https://twitter.com/reaperhulk/status/953991843565490176
More information about the Python-Dev
mailing list