Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Request: Limit SSL monkey patching for SNI support #5365

Closed
JustinMaxwell opened this issue Feb 24, 2020 · 2 comments
Closed

Request: Limit SSL monkey patching for SNI support #5365

JustinMaxwell opened this issue Feb 24, 2020 · 2 comments

Comments

@JustinMaxwell
Copy link

I'm requesting we reconsider the unconditional use of "urllib3.contrib.pyopenssl.inject_into_urllib3()".

Added 7 years ago, the goal was to "add SNI support for Python 2" #749

"urllib3.contrib.pyopenssl.inject_into_urllib3()" is described to "Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.": (https://github.com/urllib3/urllib3/blob/master/src/urllib3/contrib/pyopenssl.py)

Request justification:
1: Security/stability: Monkey patching to swap out standard library use for a 3rd party library should arguably be more surgical, especially for ssl. If the patch is for support in Python2, then at least check for a major version. Or even better, check if SNI support is already present ssl.HAS_SNI.

2: Unnecessary: As of Dec. 10, 2014, the entirety of Python 3.4's ssl module has been backported for Python 2.7.9. See PEP 466 for justification. https://www.python.org/downloads/release/python-279/. This enables SNI support in the standard library for > v2.7.9

3: Inflexible: As implemented, there is no way to disable this behavior. The only option to prevent requests use of pyopenssl context is to uninstall pyopenssl for my entire python environment.
Summary.

@WhyNotHugo

@nateprewitt
Copy link
Member

Resolving as duplicate of #5267. We have a PR up now with the goal of only loading this as necessary going forward.

@JustinMaxwell
Copy link
Author

Don't use pyOpenSSL unless no SNI is detected #5443

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Aug 31, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants