Repository navigation
[3.5] Workaround or fix for SSL ".._KEY_TOO_SMALL" test failures #85355
Description
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = 'https://github.com/tiran'
closed_at = <Date 2020-10-04.14:09:02.758>
created_at = <Date 2020-07-01.14:35:46.438>
labels = ['tests', 'type-crash', 'release-blocker']
title = '[3.5] Workaround or fix for SSL ".._KEY_TOO_SMALL" test failures'
updated_at = <Date 2020-10-04.14:09:02.758>
user = 'https://github.com/larryhastings'bugs.python.org fields:
activity = <Date 2020-10-04.14:09:02.758>
actor = 'lukasz.langa'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2020-10-04.14:09:02.758>
closer = 'lukasz.langa'
components = ['Tests']
creation = <Date 2020-07-01.14:35:46.438>
creator = 'larry'
dependencies = []
files = ['49286', '49287', '49288', '49289', '49290']
hgrepos = []
issue_num = 41183
keywords = ['patch']
message_count = 25.0
messages = ['372755', '372756', '372810', '372812', '372815', '372816', '372817', '372818', '372819', '372820', '372822', '372824', '372825', '372826', '372827', '372850', '373396', '373744', '375431', '375560', '376713', '376715', '376723', '376724', '377681']
nosy_count = 4.0
nosy_names = ['vstinner', 'larry', 'christian.heimes', 'hroncok']
pr_nums = ['21258', '21278', '21882']
priority = 'release blocker'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'crash'
url = 'https://bugs.python.org/issue41183'
versions = ['Python 3.5']
Activity
larryhastings commentedon Jul 1, 2020
I'm testing 3.5.10rc1 on a freshly installed Linux (Pop!_OS 20.04), and I'm getting a lot of these test failures:
ssl.SSLError: [SSL: EE_KEY_TOO_SMALL] ee key too small (_ssl.c:2951)
Apparently the 2048 keys used in the tests are considered "too small" with brand-new builds of the SSL library.
Christian: you upgraded the test suite keys to 3072 bits back in 2018 (issue bpo-34542), but didn't backport this as far as 3.5 because it was in security-fixes-only mode. I experimented with taking your patch to 3.6 and applying it to 3.5, but 80% of the patches didn't apply cleanly. Could you either backport this upgrade to 3.5 (I'll happily accept the PR), or advise me on how to otherwise mitigate the problem? I don't really want to turn off all those tests. Thanks!
tiran commentedon Jul 1, 2020
I'll look into it.
larryhastings commentedon Jul 2, 2020
New changeset d565be8 by Christian Heimes in branch '3.5':
bpo-41183: Update test certs and keys (bpo-21258)
d565be8
larryhastings commentedon Jul 2, 2020
Thanks for the backport!
larryhastings commentedon Jul 2, 2020
Christian: Help! Again!
I merged your PR, pulled a fresh copy, built it, and ran the test suite. I get seven failures in I think the same modules.
Most of the failures are either "ssl.SSLError: [SSL] internal error (_ssl.c:728)", or some flavor of "OSError: [Errno 0] Error". Sadly not helpful.
But! Occasionally the test suite prints a very telling error:
ssl.SSLError: [SSL: DH_KEY_TOO_SMALL] dh key too small (_ssl.c:3233)
Attached is the output of running just those seven tests. (One test is now working, not sure why.)
Obviously these tests pass on the buildbots, I assume that's because their OpenSSL is slightly older. But I don't think I can ship 3.5.10rc1 if it won't build with current OpenSSL.
You should be able to simply pull the current 3.5 head (d565be8) to reproduce the error.
[-]Workaround or fix for SSL "EE_KEY_TOO_SMALL" test failures[/-][+]Workaround or fix for SSL ".._KEY_TOO_SMALL" test failures[/+][-]Workaround or fix for SSL "EE_KEY_TOO_SMALL" test failures[/-][+]Workaround or fix for SSL ".._KEY_TOO_SMALL" test failures[/+]18 remaining items
larryhastings commentedon Aug 17, 2020
Sadly, no. I get the same failures whether or not that environment variable is set. And I confirmed that the environment variable survives Python's testing harness, it doesn't get unset or overwritten.
vstinner commentedon Sep 11, 2020
Python 3.5.10 has been released, so I understand that this issue has been fixed. Thanks Christian Heimes for fixes ;-)
larryhastings commentedon Sep 11, 2020
Nope, it's not fixed.
vstinner commentedon Sep 11, 2020
Python 3.5.10 is not the last 3.5 release?
[-]Workaround or fix for SSL ".._KEY_TOO_SMALL" test failures[/-][+][3.5] Workaround or fix for SSL ".._KEY_TOO_SMALL" test failures[/+][-]Workaround or fix for SSL ".._KEY_TOO_SMALL" test failures[/-][+][3.5] Workaround or fix for SSL ".._KEY_TOO_SMALL" test failures[/+]larryhastings commentedon Sep 11, 2020
It depends on whether or not I get any more fixes for the rest of the month. (Theoretically 3.5 support ends on Sep 13, but I decided to extend it to the end of the month.)
I filed this on July 1, so it's already been two months, and the developer who would handle this has stopped replying. If I don't get a fix for this issue before the end of the month, then 3.5.10 will be the last release of 3.5 and this will simply go unfixed.
larryhastings commentedon Sep 29, 2020
A day and a half to go! Again, assuming that this won't be fixed and 3.5 will go EOL without supporting this year's Linux distro updates.