How do I get NPN support for PyOpenSSL?

Question

I have an application that uses PyOpenSSL. It depends upon the use of NPN. This used to work, but when I've re-created my virtual environment, the version of openssl PyOpenSSL is built against no longer supports NPN:

Traceback (most recent call last):
  File "/tmp/sbpv/http2/proxy1/test_proxy.py", line 60, in <module>
    sys.exit(main())
  File "/tmp/sbpv/http2/proxy1/test_proxy.py", line 46, in main
    proxy_http2.configure_http2_server(args.listen_port, args.server_port, args.https_pem)
  File "/home/bneradt/repos/proxy-verifier/test/autests/gold_tests/autest-site/proxy_http2.py", line 188, in configure_http2_server
    context.set_npn_advertise_callback(npn_advertise_cb)
  File "/home/bneradt/.local/share/virtualenvs/autests-kCEHOjhw/lib/python3.8/site-packages/OpenSSL/SSL.py", line 650, in explode
    raise NotImplementedError(error)
NotImplementedError: NPN not available

The current version of PyOpenSSL is 19.1.0. I've pulled back to PyOpenSSL 19.0.0 and 18.0.0, but they all seem to have been built against openssl1.1.1h:

$ python -c "import OpenSSL; print(OpenSSL.version.__version__)"
18.0.0

$ python -c "import OpenSSL; print(OpenSSL.SSL.SSLeay_version(OpenSSL.SSL.SSLEAY_VERSION))"                                                                                                                                                
b'OpenSSL 1.1.1h  22 Sep 2020'

$ python -c "import OpenSSL; print(OpenSSL._util.lib.Cryptography_HAS_NEXTPROTONEG)"                                                                                                                                                          
0

Do the openssl versions PyOpenSSL is built against get updated with regularity such that my recent installs of these have different openssl versions? Or am I confused about how this works and PyOpenSSL is somehow using some local openssl version?

To be succinct, the question I'm asking is: how do I get a version of PyOpenSSL with NPN support?

Answer 1

PyOpenSSL does not ship with the built version of openssl. It instead relies upon the cryptography Python module for that. If I pin the version of cryptography to 2.8 , then PyOpenSSL version 19.1.0 uses a version of openssl that has NPN support:

$ python -c "import OpenSSL; print(OpenSSL._util.lib.Cryptography_HAS_NEXTPROTONEG)"
1