Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated the version Python to 3.9.18 as needed for OpenSSL Windows update #20058

Merged
merged 3 commits into from
Oct 11, 2023

Conversation

carlosroman
Copy link
Contributor

What does this PR do?

Upgrades the version of OpenSSL being used to 1.1.1w. Fixes CVE-2023-4807, CVE-2023-3817 and CVE-2023-3446.
See https://www.openssl.org/news/openssl-1.1.1-notes.html for more details.

Windows OpenSSL upgrade: OpenSSL 1.1.1w.

Motivation

The current version of OpenSSL being used on Windows (version 1.1.1u) has some reported CVEs that are mitigated by version 1.1.1w.

Describe how to test/QA your changes

  • Run an Agent with Python 3 (either Agent 6 configured with py3 or an Agent 7)
  • Execute agent status and validate Python version
  • Validate the Python integrations are working properly

Reviewer's Checklist

  • If known, an appropriate milestone has been selected; otherwise the Triage milestone is set.
  • Use the major_change label if your change either has a major impact on the code base, is impacting multiple teams or is changing important well-established internals of the Agent. This label will be use during QA to make sure each team pay extra attention to the changed behavior. For any customer facing change use a releasenote.
  • A release note has been added or the changelog/no-changelog label has been applied.
  • Changed code has automated tests for its functionality.
  • Adequate QA/testing plan information is provided if the qa/skip-qa label is not applied.
  • At least one team/.. label has been applied, indicating the team(s) that should QA this change.
  • If applicable, docs team has been notified or an issue has been opened on the documentation repo.
  • If applicable, the need-change/operator and need-change/helm labels have been applied.
  • If applicable, the k8s/<min-version> label, indicating the lowest Kubernetes version compatible with this feature.
  • If applicable, the config template has been updated.

@carlosroman carlosroman added this to the 7.50.0 milestone Oct 11, 2023
@carlosroman carlosroman requested review from a team as code owners October 11, 2023 10:41
@@ -58,19 +58,19 @@
end

else
default_version "3.9.17-26e6052"
default_version "3.9.18-38f3b72"
dependency "vc_redist_14"

if windows_arch_i386?
dependency "vc_ucrt_redist"

source :url => "https://dd-agent-omnibus.s3.amazonaws.com/python-windows-#{version}-x86.zip",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm curious as to how this bucket is provided with the artifact 🤔

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is done via this gitlab pipeline defined here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When we move to Python 3.11 we will no longer be using that fork of Python.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah right I forgot we are using a fork. Thanks for the clarification!

@pr-commenter
Copy link

pr-commenter bot commented Oct 11, 2023

Bloop Bleep... Dogbot Here

Regression Detector Results

Run ID: 29421279-5620-4b70-9935-d83ac025eefe
Baseline: e6046a2
Comparison: 48cc782
Total datadog-agent CPUs: 7

Explanation

A regression test is an integrated performance test for datadog-agent in a repeatable rig, with varying configuration for datadog-agent. What follows is a statistical summary of a brief datadog-agent run for each configuration across SHAs given above. The goal of these tests are to determine quickly if datadog-agent performance is changed and to what degree by a pull request.

Because a target's optimization goal performance in each experiment will vary somewhat each time it is run, we can only estimate mean differences in optimization goal relative to the baseline target. We express these differences as a percentage change relative to the baseline target, denoted "Δ mean %". These estimates are made to a precision that balances accuracy and cost control. We represent this precision as a 90.00% confidence interval denoted "Δ mean % CI": there is a 90.00% chance that the true value of "Δ mean %" is in that interval.

We decide whether a change in performance is a "regression" -- a change worth investigating further -- if both of the following two criteria are true:

  1. The estimated |Δ mean %| ≥ 5.00%. This criterion intends to answer the question "Does the estimated change in mean optimization goal performance have a meaningful impact on your customers?". We assume that when |Δ mean %| < 5.00%, the impact on your customers is not meaningful. We also assume that a performance change in optimization goal is worth investigating whether it is an increase or decrease, so long as the magnitude of the change is sufficiently large.

  2. Zero is not in the 90.00% confidence interval "Δ mean % CI" about "Δ mean %". This statement is equivalent to saying that there is at least a 90.00% chance that the mean difference in optimization goal is not zero. This criterion intends to answer the question, "Is there a statistically significant difference in mean optimization goal performance?". It also means there is no more than a 10.00% chance this criterion reports a statistically significant difference when the true difference in mean optimization goal is zero -- a "false positive". We assume you are willing to accept a 10.00% chance of inaccurately detecting a change in performance when no true difference exists.

The table below, if present, lists those experiments that have experienced a statistically significant change in mean optimization goal performance between baseline and comparison SHAs with 90.00% confidence OR have been detected as newly erratic. Negative values of "Δ mean %" mean that baseline is faster, whereas positive values of "Δ mean %" mean that comparison is faster. Results that do not exhibit more than a ±5.00% change in their mean optimization goal are discarded. An experiment is erratic if its coefficient of variation is greater than 0.1. The abbreviated table will be omitted if no interesting change is observed.

No interesting changes in experiment optimization goals with confidence ≥ 90.00% and |Δ mean %| ≥ 5.00%.

Fine details of change detection per experiment.
experiment goal Δ mean % Δ mean % CI confidence
uds_dogstatsd_to_api_nodist_200MiB ingress throughput +0.45 [+0.34, +0.56] 100.00%
trace_agent_msgpack ingress throughput +0.02 [-0.10, +0.14] 23.10%
tcp_dd_logs_filter_exclude ingress throughput +0.01 [-0.05, +0.06] 11.84%
uds_dogstatsd_to_api_nodist_64MiB ingress throughput +0.00 [-0.13, +0.13] 0.68%
file_to_blackhole egress throughput +0.00 [-1.38, +1.38] 0.00%
uds_dogstatsd_to_api_nodist_100MiB ingress throughput -0.00 [-0.13, +0.13] 0.23%
uds_dogstatsd_to_api_nodist_32MiB ingress throughput -0.00 [-0.13, +0.13] 0.38%
uds_dogstatsd_to_api_nodist_16MiB ingress throughput -0.00 [-0.12, +0.12] 3.85%
uds_dogstatsd_to_api_nodist_1MiB ingress throughput -0.01 [-0.02, +0.00] 79.93%
trace_agent_json ingress throughput -0.02 [-0.15, +0.11] 16.38%
tcp_syslog_to_blackhole ingress throughput -0.12 [-0.25, +0.02] 83.07%
uds_dogstatsd_to_api ingress throughput -0.63 [-2.79, +1.53] 36.81%
otel_to_otel_logs ingress throughput -1.02 [-2.60, +0.56] 71.12%
file_tree egress throughput -2.81 [-4.57, -1.04] 99.11%

Copy link
Contributor

@buraizu buraizu left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving with some very minor updates for consistency

@carlosroman carlosroman merged commit 915f5e1 into main Oct 11, 2023
9 of 10 checks passed
@carlosroman carlosroman deleted the carlosroman/AMLII-1108-windows-py3.9.18-openssl branch October 11, 2023 15:14
carlosroman added a commit that referenced this pull request Oct 11, 2023
…date (#20058)

* Updated the version Python to 3.9.18 as needed for OpenSSL Windows update

* Update releasenotes/notes/update-python-openssl-on-windows-to-1.1.1w-0a00d9c8a0cfde12.yaml

Co-authored-by: Bryce Eadie <[email protected]>

* Update releasenotes/notes/update-python-openssl-on-windows-to-1.1.1w-0a00d9c8a0cfde12.yaml

Co-authored-by: Bryce Eadie <[email protected]>

---------

Co-authored-by: Bryce Eadie <[email protected]>
carlosroman added a commit that referenced this pull request Oct 11, 2023
…date (#20058)

* Updated the version Python to 3.9.18 as needed for OpenSSL Windows update

* Update releasenotes/notes/update-python-openssl-on-windows-to-1.1.1w-0a00d9c8a0cfde12.yaml

Co-authored-by: Bryce Eadie <[email protected]>

* Update releasenotes/notes/update-python-openssl-on-windows-to-1.1.1w-0a00d9c8a0cfde12.yaml

Co-authored-by: Bryce Eadie <[email protected]>

---------

Co-authored-by: Bryce Eadie <[email protected]>
carlosroman added a commit that referenced this pull request Oct 11, 2023
…date (#20058) (#20072)

* Updated the version Python to 3.9.18 as needed for OpenSSL Windows update

* Update releasenotes/notes/update-python-openssl-on-windows-to-1.1.1w-0a00d9c8a0cfde12.yaml



* Update releasenotes/notes/update-python-openssl-on-windows-to-1.1.1w-0a00d9c8a0cfde12.yaml



---------

Co-authored-by: Bryce Eadie <[email protected]>
carlosroman added a commit that referenced this pull request Oct 11, 2023
…date (#20058) (#20073)

* Updated the version Python to 3.9.18 as needed for OpenSSL Windows update

* Update releasenotes/notes/update-python-openssl-on-windows-to-1.1.1w-0a00d9c8a0cfde12.yaml



* Update releasenotes/notes/update-python-openssl-on-windows-to-1.1.1w-0a00d9c8a0cfde12.yaml



---------

Co-authored-by: Bryce Eadie <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants