Repository: Chia-Network/chia-blockchain
Pull request: better TLS1.3 check
A better and more compatible TLS check that works on versions of python using a non-openssl TLS library. Examples include the python3 version in Xcode which is using LibreSSL.

See issue #10285

Problem statement:
[Bug] 1.3 Cannot start farmer on a Mac with python3 from Xcode
### What happened?

Latest version 1.2.12.dev309 on a Mac running BigSur 11.5.2, and latest version of Xcode (13.2.1).

Here is the error when running chia start farmer

```python-traceback
 File "/Users/stipus/chia-blockchain/chia/daemon/server.py", line 1478, in async_run_daemon
    await ws_server.start()
  File "/Users/stipus/chia-blockchain/chia/daemon/server.py", line 171, in start
    self.ssl_context.minimum_version = ssl.TLSVersion.TLSv1_3
  File "/Applications/Xcode.app/Contents/Developer/Library/Frameworks/Python3.framework/Versions/3.8/lib/python3.8/ssl.py", line 586, in minimum_version
    super(SSLContext, SSLContext).minimum_version.__set__(self, value)
ValueError: Unsupported protocol version 0x304
Daemon not started yet
Failed to create the chia daemon
```

I had to edit server.py line 171 to 
```python
 self.ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2
```

### Version

1.2.12.dev309

### What platform are you using?

macOS

### What ui mode are you using?

CLI

### Relevant log output

_No response_

Hints from issue discussion:
I just checked the problem is caused by the latest commit to the server.py file.

https://github.com/Chia-Network/chia-blockchain/commit/34d44c1324ae634a0896f7b02eaa2802af9526cd

Thanks for the report, so it looks like the underlying openssl layer would support TLS 1.3 as it's reporting > 1.1.1 version. But the python SSL layer does not. This isn't handled properly by the code right now

Commit message: Code simplification and cleanup

Patch to review:
diff --git a/chia/daemon/server.py b/chia/daemon/server.py
index 1216d66de4c1..007c3ba86ca2 100644
--- a/chia/daemon/server.py
+++ b/chia/daemon/server.py
@@ -156,18 +156,23 @@ def __init__(
     async def start(self):
         self.log.info("Starting Daemon Server")
 
-        if ssl.OPENSSL_VERSION_NUMBER < 0x10101000:
+        # Note: the minimum_version has been already set to TLSv1_2
+        # in ssl_context_for_server()
+        # Daemon is internal connections, so override to TLS1.3 only
+        if ssl.HAS_TLSv1_3:
+            try:
+                self.ssl_context.minimum_version = ssl.TLSVersion.TLSv1_3
+            except ValueError:
+                self.ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2  # probably not needed but doesn't hurt
+
+        if self.ssl_context.minimum_version is not ssl.TLSVersion.TLSv1_3:
             self.log.warning(
                 (
-                    "Deprecation Warning: Your version of openssl (%s) does not support TLS1.3. "
+                    "Deprecation Warning: Your version of SSL (%s) does not support TLS1.3. "
                     "A future version of Chia will require TLS1.3."
                 ),
                 ssl.OPENSSL_VERSION,
             )
-        else:
-            if self.ssl_context is not None:
-                # Daemon is internal connections, so override to TLS1.3 only
-                self.ssl_context.minimum_version = ssl.TLSVersion.TLSv1_3
 
         def master_close_cb():
             asyncio.create_task(self.stop())


Code review comments:
diff_hunk: @@ -156,18 +156,23 @@ def __init__(
     async def start(self):
         self.log.info("Starting Daemon Server")
 
-        if ssl.OPENSSL_VERSION_NUMBER < 0x10101000:
+        # Note: the minimum_version has been already set to TLSv1_2
+        # in ssl_context_for_server()
+        # Daemon is internal connections, so override to TLS1.3 only
+        if ssl.HAS_TLSv1_3:
+            try:
+                self.ssl_context.minimum_version = ssl.TLSVersion.TLSv1_3
+            except ValueError:
+                self.ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2  # probably not needed but doesn't hurt
path: chia/daemon/server.py
text: @user1:
```suggestion
                # Just in case attempting but failing to set to 1.3 causes a confused
                # state, set back to 1.2.
                self.ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2
```

@author:
I made a small change here for comment nits