python/erldistpy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

tls: keep maximum_version at MAXIMUM_SUPPORTED (was wrong workaround)

Browse source 
Reverted the TLS 1.2 max default I added while chasing what turned out
to be a make_post_sell bug, not an OTP bug. The actual root cause of
the production smoke-test failure was that mps_wallet_dist_health
hardcoded the REG_SEND target as 'Elixir.Wallet.Service' but portal
registers the relay as 'Elixir.Wallet.Bridge' — REG_SEND to an
unregistered name silently drops at the dist driver, presenting as the
'peer closed after 0/4 bytes' symptom that I misdiagnosed as a TLS
problem. Fix landed in make_post_sell 1.2.1.

erldistpy's defaults should stay where Python ssl wants them; callers
who want a specific version can still pin via kwargs.
This commit is contained in:
russell@unturf.com 2026-06-17 10:59:42 -04:00
parent 35d0eca342
commit ff5ec74fc2
No known key found for this signature in database
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
erldistpy/tls.py
View file

@ -36,6 +36,7 @@ def make_dist_tls_context(
ca: str, ca: str,
check_hostname: bool = False, check_hostname: bool = False,
minimum_version: ssl.TLSVersion = ssl.TLSVersion.TLSv1_2, minimum_version: ssl.TLSVersion = ssl.TLSVersion.TLSv1_2,
maximum_version: ssl.TLSVersion = ssl.TLSVersion.MAXIMUM_SUPPORTED,
) -> ssl.SSLContext: ) -> ssl.SSLContext:
"""Build an SSLContext for a TLS-dist client. """Build an SSLContext for a TLS-dist client.
@ -43,11 +44,16 @@ def make_dist_tls_context(
and requires one). ``check_hostname=False`` because dist nodes are and requires one). ``check_hostname=False`` because dist nodes are
identified by their cookie + cert chain, not by SNI hostname; flip identified by their cookie + cert chain, not by SNI hostname; flip
on if your CA pins per-node CNs. on if your CA pins per-node CNs.
``maximum_version`` defaults to the highest version Python's ssl
supports (TLS 1.3 in practice). Pin to TLS 1.2 explicitly only if
you hit interop issues against an older Erlang peer.
""" """
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
ctx.check_hostname = check_hostname ctx.check_hostname = check_hostname
ctx.verify_mode = ssl.CERT_REQUIRED ctx.verify_mode = ssl.CERT_REQUIRED
ctx.minimum_version = minimum_version ctx.minimum_version = minimum_version
ctx.maximum_version = maximum_version
ctx.load_cert_chain(certfile=cert, keyfile=key) ctx.load_cert_chain(certfile=cert, keyfile=key)
ctx.load_verify_locations(cafile=ca) ctx.load_verify_locations(cafile=ca)
return ctx return ctx