bpo-30714: ALPN changes for OpenSSL 1.1.0f #2305
Conversation
|
@tiran, thanks for your PR! By analyzing the history of the files in this pull request, we identified @Yhg1s, @benjaminp, @vadmium and @tiran to be potential reviewers. |
Doc/library/ssl.rst
Outdated
| both sides support ALPN but cannot agree on a protocol. | ||
| OpenSSL 1.1.0 to 1.1.0e will abort the handshake and raise :exc:`SSLError` | ||
| when both sides support ALPN but cannot agree on a protocol. 1.1.0f+ | ||
| behaves like 1.0.2. |
There was a problem hiding this comment.
rather than stating "behaves like 1.0.2" how about describing that behavior; I don't see how 1.0.2 behaves explicitly described anywhere.
There was a problem hiding this comment.
The "AMD64 Debian PGO 3.x" buildbot is still failing, so it would be nice to get the fix :-)
http://buildbot.python.org/all/builders/AMD64%20Debian%20PGO%203.x/builds/1023/steps/test/logs/stdio
Misc/NEWS
Outdated
| @@ -1410,6 +1410,9 @@ Tools/Demos | |||
| Tests | |||
| ----- | |||
|
|
|||
| * bpo-30714: Address ALPN callback changes for OpenSSL 1.1.0f. The latest | |||
| version behaves like OpenSSL 1.0.2 and no longer aborts handshake. | |||
There was a problem hiding this comment.
Can you please convert the NEWS item to blurb?
|
@tiran: If you are too busy, I can try to convert the NEWS entry if you prefer. |
OpenSSL 1.1.0 to 1.1.0e aborted the handshake when server and client could not agree on a protocol using ALPN. OpenSSL 1.1.0f changed that. The most recent version now behaves like OpenSSL 1.0.2 again. The ALPN callback can pretend to not been set. See openssl/openssl#3158 for more details Signed-off-by: Christian Heimes <christian@python.org>
|
Sorry @tiran and @tiran, I had trouble checking out the |
|
Sorry, @tiran and @tiran, I could not cleanly backport this to |
|
I removed the backport labels, the change was already backported to 2.7 and 3.6. |
OpenSSL 1.1.0 to 1.1.0e aborted the handshake when server and client
could not agree on a protocol using ALPN. OpenSSL 1.1.0f changed that.
The most recent version now behaves like OpenSSL 1.0.2 again. The ALPN
callback can pretend to not been set.
See openssl/openssl#3158 for more details
Signed-off-by: Christian Heimes christian@python.org
https://bugs.python.org/issue30714