[Python-checkins] cpython (3.2): Issue #18747: document issue with OpenSSL's CPRNG state and fork

Tue Sep 30 14:46:58 CEST 2014

https://hg.python.org/cpython/rev/bdf73458df5f
changeset: 92661:bdf73458df5f
branch: 3.2
user: Christian Heimes <christian at cheimes.de>
date: Tue Oct 29 21:08:56 2013 +0100
summary:
 Issue #18747: document issue with OpenSSL's CPRNG state and fork
files:
 Doc/library/os.rst | 4 ++++
 Doc/library/ssl.rst | 8 ++++++++
 2 files changed, 12 insertions(+), 0 deletions(-)

diff --git a/Doc/library/os.rst b/Doc/library/os.rst
--- a/Doc/library/os.rst
+++ b/Doc/library/os.rst
@@ -1809,6 +1809,10 @@
 Note that some platforms including FreeBSD <= 6.3, Cygwin and OS/2 EMX have
 known issues when using fork() from a thread.
 
+ .. warning::
+
+ See :mod:`ssl` for applications that use the SSL module with fork().
+
 Availability: Unix.
 
 
diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -28,6 +28,14 @@
 operating system socket APIs. The installed version of OpenSSL may also
 cause variations in behavior.
 
+.. warning::
+
+ OpenSSL's internal random number generator does not properly handle fork.
+ Applications must change the PRNG state of the parent process if they use
+ any SSL feature with with :func:`os.fork`. Any successful call of
+ :func:`~ssl.RAND_add`, :func:`~ssl.RAND_bytes` or
+ :func:`~ssl.RAND_pseudo_bytes` is sufficient.
+
 This section documents the objects and functions in the ``ssl`` module; for more
 general information about TLS, SSL, and certificates, the reader is referred to
 the documents in the "See Also" section at the bottom.
-- 
Repository URL: https://hg.python.org/cpython
