Python: undefined symbol: TLSv1_method when importing ssl

Question

I'm running Python 3.5.6 on a distribution where TLS versions below 1.2 have been compiled out of OpenSSL by passing these options to./configure: no-ssl no-tls1 no-tls1_1 no-ssl3-method no-tls1-method no-tls1_1-method . The OpenSSL version is 1.1.1d. Python 3 is built from source at distro build time and linked against the version of OpenSSL included in the distro.

Everything builds successfully, but when I try to import the ssl library in Python, I get the following error:

$ python3
Python 3.5.6 (default, Mar 23 2020, 05:11:33)
[GCC 8.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import ssl
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.5/ssl.py", line 99, in <module>
    import _ssl             # if we can't import it, let the error propagate
ImportError: /usr/lib/python3.5/lib-dynload/_ssl.cpython-35m-aarch64-linux-gnu.so: undefined symbol: TLSv1_method

I don't understand why this error occurs at runtime. The only reference I can find in the Python 3.5.6 code to TLSv1_method is line 3088 of _ssl.c:

ctx = SSL_CTX_new(TLSv1_method());

Using no-tls1-method does compile out the implementation of TLSv1_method , and that line in the Python code is not guarded by any #ifdef . But I'd expect that to cause a failure at link time for the _ssl.cpython-35m-aarch64-linux-gnu.so module, not at runtime when Python tries to import the module. What's going on here, and is there a way to fix it without patching Python? I cannot upgrade the version of OpenSSL or Python in use.

Answer 1

It seems that my confusion resulted from misunderstanding how _ssl.cpython-35m-aarch64-linux-gnu.so links to OpenSSL. I assumed that it was statically linked, but it's actually dynamically linked to libssl.so . This is why the error occurs at runtime when the shared object is loaded.

It seems, then, that the only way to fix this without updating Python is to patch the call to TLSv1_method to use the generic TLS_method instead. I'll leave this question open for a few days though in case anyone has a better suggestion.

Edit: I filed a Python bug for this issue. It should be fixed in a future release.