Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1203672 > unrolled thread
| Started by | Petter Reinholdtsen <pere@hungry.com> |
|---|---|
| First post | 2024-07-09 09:10 +0200 |
| Last post | 2024-08-13 08:10 +0200 |
| Articles | 3 — 1 participant |
Back to article view | Back to linux.debian.bugs.dist
Bug#1075997: pagekite: Fail with python 3.12 (AttributeError: module 'ssl' has no attribute 'wrap_socket') Petter Reinholdtsen <pere@hungry.com> - 2024-07-09 09:10 +0200
Bug#1075997: pagekite: Fail with python 3.12 (AttributeError: module 'ssl' has no attribute 'wrap_socket') Petter Reinholdtsen <pere@hungry.com> - 2024-07-10 07:40 +0200
Bug#1075997: pagekite: Fail with python 3.12 (AttributeError: module 'ssl' has no attribute 'wrap_socket') Petter Reinholdtsen <pere@hungry.com> - 2024-08-13 08:10 +0200
| From | Petter Reinholdtsen <pere@hungry.com> |
|---|---|
| Date | 2024-07-09 09:10 +0200 |
| Subject | Bug#1075997: pagekite: Fail with python 3.12 (AttributeError: module 'ssl' has no attribute 'wrap_socket') |
| Message-ID | <IYd97-Rbt-1@gated-at.bofh.it> |
Package: python3-socksipychain
Version: 2.1.2-1
Severity: important
The pagekite version in testing (1.5.2.201011-2.1) currently fail with
python 3.12 on Freedombox, with this error in the journald log:
juli 09 08:53:22 freedombox pagekite[592]: ts=668cde62;
t=2024-07-09T06:53:22; ll=dc; err=Error in connect: Traceback (most
recent call last): File
"/usr/lib/python3/dist-packages/sockschain/__init__.py", line 200, in
SSL_Connect fd = ssl.wrap_socket(sock, keyfile=ctx.privatekey_file,
^^^^^^^^^^^^^^^ AttributeError: module 'ssl' has no attribute
'wrap_socket' During handling of the above exception, another
exception occurred: Traceback (most recent call last): File
"/usr/lib/python3/dist-packages/pagekite/proto/conns.py", line 647, in
_BackEnd data, parse = self._Connect(server, conns)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File
"/usr/lib/python3/dist-packages/pagekite/proto/conns.py", line 466, in
_Connect self.fd.connect((sspec[0], int(sspec[1]))) File
"/usr/lib/python3/dist-packages/sockschain/__init__.py", line 1058, in
connect self.__negotiatessl(nexthop[0], nexthop[1], proxy, File
"/usr/lib/python3/dist-packages/sockschain/__init__.py", line 965, in
__negotiatessl self.__sock = SSL_Connect(ctx, self.__sock,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File
"/usr/lib/python3/dist-packages/sockschain/__init__.py", line 209, in
SSL_Connect fd = ssl.wrap_socket(sock, keyfile=ctx.privatekey_file,
^^^^^^^^^^^^^^^ AttributeError: module 'ssl' has no attribute
'wrap_socket'
The problem seem to be caused by a upgrade to python 3.12, Which state
in the list of news in
<URL: https://docs.python.org/3.12/whatsnew/3.12.html#ssl >:
* Remove the ssl.wrap_socket() function, deprecated in Python 3.7:
instead, create a ssl.SSLContext object and call its
ssl.SSLContext.wrap_socket method. Any package that still uses
ssl.wrap_socket() is broken and insecure. The function neither sends
a SNI TLS extension nor validates the server hostname. Code is
subject to CWE-295 (Improper Certificate Validation).
This issue might be related to https://bugs.debian.org/914931 (Fail to
connect to pagekite.me services with openssl installed) and
https://bugs.debian.org/863740 (Fail to connect to pagekite, claim
invalid ssl cert).
The problematic code from
/usr/lib/python3/dist-packages/sockschain/__init__.py currently look
like this:
def SSL_Connect(ctx, sock,
server_side=False, accepted=False, connected=False,
verify_names=None):
if DEBUG: DEBUG('*** TLS is provided by native Python ssl')
reqs = (verify_names and ssl.CERT_REQUIRED or ssl.CERT_NONE)
try:
fd = ssl.wrap_socket(sock, keyfile=ctx.privatekey_file,
certfile=ctx.certchain_file,
cert_reqs=reqs,
ca_certs=ctx.ca_certs,
do_handshake_on_connect=False,
ssl_version=ctx.method,
ciphers=ctx.ciphers,
server_side=server_side)
except:
fd = ssl.wrap_socket(sock, keyfile=ctx.privatekey_file,
certfile=ctx.certchain_file,
cert_reqs=reqs,
ca_certs=ctx.ca_certs,
do_handshake_on_connect=False,
ssl_version=ctx.method,
server_side=server_side)
if verify_names:
fd.do_handshake()
if not SSL_CheckPeerName(fd, verify_names):
raise SSL.Error(('Cert not in %s (%s)'
) % (verify_names, reqs))
return fd
--
Happy hacking
Petter Reinholdtsen
[toc] | [next] | [standalone]
| From | Petter Reinholdtsen <pere@hungry.com> |
|---|---|
| Date | 2024-07-10 07:40 +0200 |
| Message-ID | <IYydz-148G-1@gated-at.bofh.it> |
| In reply to | #1203672 |
I had a look, but have not yet been able to figure out the correct
solution.
I tested this draft patch, but it is incomplete and not working.
--- /usr/lib/python3/dist-packages/sockschain/__init__.py.orig 2024-07-10 07:20:11.900229940 +0200
+++ /usr/lib/python3/dist-packages/sockschain/__init__.py 2024-07-10 07:23:32.072978598 +0200
@@ -105,7 +105,7 @@
from OpenSSL import SSL
HAVE_SSL = HAVE_PYOPENSSL = True
- def SSL_Connect(ctx, sock,
+ def SSL_Connect(ctx, sock, destaddr, destport,
server_side=False, accepted=False, connected=False,
verify_names=None):
if DEBUG: DEBUG('*** TLS is provided by pyOpenSSL')
@@ -191,27 +191,24 @@
return (valid > 0)
- def SSL_Connect(ctx, sock,
+ def SSL_Connect(ctx, sock, destaddr, destport,
server_side=False, accepted=False, connected=False,
verify_names=None):
if DEBUG: DEBUG('*** TLS is provided by native Python ssl')
reqs = (verify_names and ssl.CERT_REQUIRED or ssl.CERT_NONE)
+ context = ssl.create_default_context()
+
+ with socket.create_connection((destaddr, destport)) as sock:
try:
- fd = ssl.wrap_socket(sock, keyfile=ctx.privatekey_file,
- certfile=ctx.certchain_file,
- cert_reqs=reqs,
- ca_certs=ctx.ca_certs,
+ fd = context.wrap_socket(sock,
do_handshake_on_connect=False,
- ssl_version=ctx.method,
ciphers=ctx.ciphers,
+ server_hostname=destaddr,
server_side=server_side)
except:
- fd = ssl.wrap_socket(sock, keyfile=ctx.privatekey_file,
- certfile=ctx.certchain_file,
- cert_reqs=reqs,
- ca_certs=ctx.ca_certs,
+ fd = context.wrap_socket(sock,
do_handshake_on_connect=False,
- ssl_version=ctx.method,
+ server_hostname=destaddr,
server_side=server_side)
if verify_names:
@@ -962,7 +959,7 @@
ctx.load_verify_locations(ca_certs)
self.__sock.setblocking(1)
- self.__sock = SSL_Connect(ctx, self.__sock,
+ self.__sock = SSL_Connect(ctx, self.__sock, destaddr, destport,
connected=True, verify_names=want_hosts)
except:
if DEBUG: DEBUG('*** SSL problem: %s/%s/%s' % (sys.exc_info(),
I now get this error about incorrect certificate:
juli 10 07:24:45 freedombox pagekite[17017]: ts=668e1b1d;
t=2024-07-10T05:24:45; ll=15; err=Error in connect: Traceback (most
recent call last): File
"/usr/lib/python3/dist-packages/pagekite/proto/conns.py", line 647, in
_BackEnd data, parse = self._Connect(server, conns)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File
"/usr/lib/python3/dist-packages/pagekite/proto/conns.py", line 466, in
_Connect self.fd.connect((sspec[0], int(sspec[1]))) File
"/usr/lib/python3/dist-packages/sockschain/__init__.py", line 1055, in
connect self.__negotiatessl(nexthop[0], nexthop[1], proxy, File
"/usr/lib/python3/dist-packages/sockschain/__init__.py", line 962, in
__negotiatessl self.__sock = SSL_Connect(ctx, self.__sock, destaddr,
destport, ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File
"/usr/lib/python3/dist-packages/sockschain/__init__.py", line 215, in
SSL_Connect fd.do_handshake() File "/usr/lib/python3.12/ssl.py", line
1320, in do_handshake self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED]
certificate verify failed: IP address mismatch, certificate is not
valid for '95.216.167.199'. (_ssl.c:1000)
Perhaps the problem is using IP and not name? Hope to find time to
investigate further.
--
Happy hacking
Petter Reinholdtsen
[toc] | [prev] | [next] | [standalone]
| From | Petter Reinholdtsen <pere@hungry.com> |
|---|---|
| Date | 2024-08-13 08:10 +0200 |
| Message-ID | <JaSTf-4FUd-3@gated-at.bofh.it> |
| In reply to | #1203672 |
[Sunil Mohan Adapa]
> I have a slightly different patch. I have been able to eliminate the
> error and also replace the old method with new one while keeping all
> the old behavior. I have tested that it was able to connect
> successfully to the server. However, I don't have credits in my
> account. Please help test it further. If it looks good, we can make a
> release of the package.
I can confirm that this got my pagekite working again.
The service emit some strange messages to journald, but I believe those
are not relevant for this error and not fatal:
pagekite[20706]: /usr/lib/python3/dist-packages/pagekite/pk.py:1242: SyntaxWarning: invalid escape sequence '\.'
pagekite[20706]: 'localhost': '((::ffff:)?127\..*|::1)',
pagekite[20706]: /usr/lib/python3/dist-packages/pagekite/common.py:153: SyntaxWarning: invalid escape sequence '\.'
pagekite[20706]: SERVICE_DOMAIN_RE = re.compile('\.(' + '|'.join(SERVICE_DOMAINS) + ')$')
pagekite[20706]: /usr/lib/python3/dist-packages/pagekite/proto/selectables.py:656: SyntaxWarning: invalid escape sequence '\s'
pagekite[20706]: XMPP_REGEXP = re.compile("<[^>]+\sto=([^\s>]+)[^>]*>")
pagekite[20706]: /usr/lib/python3/dist-packages/pagekite/proto/filters.py:163: SyntaxWarning: invalid escape sequence '\d'
pagekite[20706]: HTTP_HEADER = re.compile('(?ism)^(([A-Z]+) ([^\n]+) HTTP/\d+\.\d+\s*)$')
pagekite[20706]: /usr/lib/python3/dist-packages/pagekite/proto/filters.py:216: SyntaxWarning: invalid escape sequence '\.'
pagekite[20706]: '(?:wp-admin/(?!admin-ajax|css/)|wp-config\.php'
pagekite[20706]: /usr/lib/python3/dist-packages/pagekite/proto/filters.py:218: SyntaxWarning: invalid escape sequence '\.'
pagekite[20706]: '|system32/|\.\.|\.ht(?:access|pass)'
pagekite[20706]: /usr/lib/python3/dist-packages/pagekite/proto/filters.py:222: SyntaxWarning: invalid escape sequence '\.'
pagekite[20706]: '|(?:adm[^\n]*|install[^\n]*|setup)\.php)'
pagekite[20706]: /usr/lib/python3/dist-packages/pagekite/proto/filters.py:224: SyntaxWarning: invalid escape sequence '\d'
pagekite[20706]: ' HTTP/\d+\.\d+\s*)$')
Perhaps worthy of its own bug report, or to be ignored as not fatal?
--
Happy hacking
Petter Reinholdtsen
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web