Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 1553834

Summary:	[RFE] enable ssl python 3.6
Product:	Red Hat Software Collections	Reporter:	Steven Walter <stwalter>
Component:	rh-python36-container	Assignee:	Tomas Orsava <torsava>
Status:	CLOSED NOTABUG	QA Contact:	BaseOS QE - Apps <qe-baseos-apps>
Severity:	medium	Docs Contact:	Lenka Špačková <lkuprova>
Priority:	unspecified
Version:	rh-python36	CC:	aos-bugs, bparees, cheimes, jokerman, kwalker, mmccomas, rwicker, torsava
Target Milestone:	---	Keywords:	FutureFeature
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-04-11 15:27:17 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Steven Walter 2018-03-09 16:24:26 UTC

1. Proposed title of this feature request
Enable SSL in python 3.6 by default

3. What is the nature and description of the request?

Python 3.6 S2I image: NO SSL enabled. 
 
$ docker run -it --rm --name testpython3 registry.access.redhat.com/rhscl/python-36-rhel7 /bin/bash
(app-root) python
Python 3.6.3 (default, Oct  5 2017, 20:27:50)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-11)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import socket
>>> hasattr(socket, "ssl")
False
>>>
A false response means that python SSL library was not compiled into python installation on the image.

Python 27 is working as intended: See below
Python2.7 Image
$ docker run -it --rm --name testpython2 python-27-rhel7 /bin/bash
(app-root)python
Python 2.7.13 (default, Feb  8 2017, 06:57:18)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-11)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import socket
>>> hasattr(socket, "ssl")
True

A True response means that python SSL has been compiled into the python installation on the image.

This is important to customer as all SSL calls by the python app are failing. For instance they needed to add "trusted-host" to pip.conf to skip SSL checks when pulling dependencies from on-site repos 


4. Why does the customer need this? (List the business requirements here)
Security, to be FIPS compliant


7. Is there already an existing RFE upstream or in Red Hat bugzilla?
Not that I found
 

8. Does the customer have any specific timeline dependencies?
 ASAP

Comment 4 Christian Heimes 2018-04-11 15:07:35 UTC

The correct way to test for ssl support is "import ssl".

socket.ssl was an undocumented, deprecated feature of Python 2 that is no longer available in Python 3. It was never officially supported by upstream.

Fun fact: I'm the upstream owner and maintainer of the ssl module. Until now I wasn't aware that Python 2.7 had socket.ssl. The feature is neither tested nor documented.

Comment 5 Christian Heimes 2018-04-11 15:14:31 UTC

Update: socket.ssl is no longer documentd and supported since Python 2.6.0. It was removed from py3k (later Python 3.0) in 2007.

Comment 6 Tomas Orsava 2018-04-11 15:27:00 UTC

Hi Steven, SSL is enabled in our Python images.

The problem is that the `socket.ssl()` function has been deprecated since Python 2.6 and removed in Python 3. It is replaced by the `ssl.wrapsocket()` function that works on all our Python images:


Python 2.7:

$ python
Python 2.7.13 (default, Feb  8 2017, 06:57:18)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-11)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
>>> hasattr(ssl, "wrap_socket")
True


Python 3.6

$ python
Python 3.6.3 (default, Jan  9 2018, 10:19:07)
[GCC 4.8.5 20150623 (Red Hat 4.8.5-11)] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
>>> hasattr(ssl, "wrap_socket")
True


I'm closing this as NOTABUG, but feel free to reopen if needed.

Comment 7 Christian Heimes 2018-04-11 15:27:52 UTC

Also: Don't use ssl.wrap_socket(). It's bad, slow, and insecure.