[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

python setuptools lacks SNI support in stretch

TL;DR: Python setuptools is going to lose the ability to talk to pypi in
the near future.

As documented at [1] and [2], Fastly, the CDN that serves
files.pythonhosted.org and pypi.python.org is going to disable support
for clients that don't support the SNI TLS protocol extension.

It seems that Fastly recently made (and then reverted) this change,
which is convenient for us as it gave a bit of a preview into what's
going to happen once they make the change permanent.

One user reported connectivity issues to files.pythonhosted.org [3],
which prompted me to investigate why.  As noted in their post, python in
stretch does support SNI, but it appears that it wasn't being used.

As shown in the wireshark decoding of the TLS client hello message when
connecting to pypi.python.org, the SNI extension was not in use.
Comparable packet captures from buster include a line matching
"Extension: server_name", which indicates the presense of the SNI
protocol extension. 

I believe we will need an update python's setuptools packages to address
this issue; it seems as though python itself has full support for SNI.

Frame 4: 304 bytes on wire (2432 bits), 304 bytes captured (2432 bits)
Ethernet II, Src: 02:4a:6e:2e:54:45 (02:4a:6e:2e:54:45), Dst: 02:8f:53:6f:64:ef (02:8f:53:6f:64:ef)
Internet Protocol Version 4, Src:, Dst:
Transmission Control Protocol, Src Port: 58854, Dst Port: 443, Seq: 1, Ack: 1, Len: 238
Transport Layer Security
    TLSv1.2 Record Layer: Handshake Protocol: Client Hello
        Content Type: Handshake (22)
        Version: TLS 1.0 (0x0301)
        Length: 233
        Handshake Protocol: Client Hello
            Handshake Type: Client Hello (1)
            Length: 229
            Version: TLS 1.2 (0x0303)
            Random: 9da5bf0013f2a241c06b223ccb4e27a662ac537fdcecd60d7aba8ec617caf96a
            Session ID Length: 0
            Cipher Suites Length: 124
            Cipher Suites (62 suites)
            Compression Methods Length: 1
            Compression Methods (1 method)
            Extensions Length: 64
            Extension: ec_point_formats (len=4)
            Extension: supported_groups (len=4)
            Extension: session_ticket (len=0)
            Extension: encrypt_then_mac (len=0)
            Extension: extended_master_secret (len=0)
            Extension: signature_algorithms (len=32)

1. https://status.python.org/incidents/hzmjhqsdjqgb
2. https://github.com/pypa/pypi-support/issues/978
3. https://github.com/pypa/pypi-support/issues/978#issuecomment-806100294

Attachment: signature.asc
Description: PGP signature

Reply to: