urllib3 v2 (unreleased) negotiates the wrong version of TLS when used with OpenSSL 1.0.2

Subject

urllib3 v2 negotiates the wrong version of TLS when used with OpenSSL 1.0.2

Note: I secretly reported this issue, but was asked to make a public issue instead because this is in an unreleased version

Environment

Python 3.7 on centos 7 dockerfile here: https://gist.github.com/graingert/5013c338991753b059424d1d7a41b875

Steps to Reproduce

# import tlslite.messages
import sys
import ssl
import concurrent.futures
import socket
import urllib3.util
import pprint
import trustme


ca = trustme.CA()
hostname = "test-host.example.org"
server_cert = ca.issue_cert(hostname)


def client(sock):
    ctx = urllib3.util.create_urllib3_context(ssl_minimum_version=ssl.TLSVersion.TLSv1_2)
    ca.configure_trust(ctx)
    with ctx.wrap_socket(sock, server_hostname=hostname) as ssock:
        print(f"client connection made! ssock.cipher()={ssock.cipher()} ssock.version()={ssock.version()}")
        pass

def server(sock):
    ctx = ssl.create_default_context(purpose=ssl.Purpose.CLIENT_AUTH)
    ctx.minimum_version = ssl.TLSVersion.TLSv1
    ctx.maximum_version = ssl.TLSVersion.TLSv1
    ctx.options |= ssl.OP_NO_TLSv1_2 | ssl.OP_NO_TLSv1_1
    print(ctx.options)
    server_cert.configure_cert(ctx)
    with ctx.wrap_socket(sock, server_side=True) as ssock:
        print(f"server connection made! ssock.cipher()={ssock.cipher()} ssock.version()={ssock.version()}")
        pass


def main():
    with concurrent.futures.ThreadPoolExecutor(max_workers=2) as tpe:
        a, b = socket.socketpair()
        with a, b:
            a.settimeout(1)
            b.settimeout(2)
            client_fut = tpe.submit(client, a)
            server_fut = tpe.submit(server, b)
            for fut in concurrent.futures.as_completed([client_fut, server_fut]):
                fut.result()


if __name__ == "__main__":
    sys.exit(main())

Expected Behavior

Traceback (most recent call last):
  File "/home/graingert/projects/py37-old-ssl/demo.py", line 48, in <module>
    sys.exit(main())
  File "/home/graingert/projects/py37-old-ssl/demo.py", line 44, in main
    fut.result()
  File "/usr/lib/python3.10/concurrent/futures/_base.py", line 439, in result
    return self.__get_result()
  File "/usr/lib/python3.10/concurrent/futures/_base.py", line 391, in __get_result
    raise self._exception
  File "/usr/lib/python3.10/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/home/graingert/projects/py37-old-ssl/demo.py", line 30, in server
    with ctx.wrap_socket(sock, server_side=True) as ssock:
  File "/usr/lib/python3.10/ssl.py", line 512, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1070, in _create
    self.do_handshake()
  File "/usr/lib/python3.10/ssl.py", line 1341, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL] internal error (_ssl.c:997)

Actual Behavior

Options.OP_ALL|OP_NO_TLSv1_1|OP_NO_TLSv1_2|OP_NO_SSLv3|OP_NO_SSLv2|OP_CIPHER_SERVER_PREFERENCE|OP_SINGLE_DH_USE|OP_SINGLE_ECDH_USE|OP_NO_COMPRESSION
server connection made! ssock.cipher()=('ECDHE-RSA-AES256-SHA', 'TLSv1/SSLv3', 256) ssock.version()=TLSv1
client connection made! ssock.cipher()=('ECDHE-RSA-AES256-SHA', 'TLSv1/SSLv3', 256) ssock.version()=TLSv1
Removing intermediate container 4123de09e3b3

this is because ssl.SSLContext.minimum_version is silently ignored in Python3.7 when running on openssl 1.0.2

[sethmlarson]

Closing as superseded by https://github.com/urllib3/urllib3/issues/2168.

[sethmlarson]

Now that we’ve changed https://github.com/urllib3/urllib3/issues/2168 to drop OpenSSL <1.1.1 I’m not sure this will be needed for v2.0.