Issue #18747: document issue with OpenSSL's CPRNG state and fork

diff --git a/Doc/library/os.rst b/Doc/library/os.rst
index 59457f75acd77c46481b1e5afd0873f2f031ed5e..2c33366c0dbe76b560bb95e13ce3555df6038716 100644 (file)
--- a/Doc/library/os.rst
+++ b/Doc/library/os.rst
@@ -2582,6 +2582,10 @@ written in Python, such as a mail server's external command delivery program.
    Note that some platforms including FreeBSD <= 6.3, Cygwin and OS/2 EMX have
    known issues when using fork() from a thread.
 
+   .. warning::
+
+      See :mod:`ssl` for applications that use the SSL module with fork().
+
    Availability: Unix.
 
 

diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
index a688e4609d4e7004749020c1a3b196faa6f29215..a12ce5b4436955e78b03d4923209485336c04701 100644 (file)
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -28,6 +28,14 @@ probably additional platforms, as long as OpenSSL is installed on that platform.
    operating system socket APIs.  The installed version of OpenSSL may also
    cause variations in behavior.
 
+.. warning::
+
+   OpenSSL's internal random number generator does not properly handle fork.
+   Applications must change the PRNG state of the parent process if they use
+   any SSL feature with with :func:`os.fork`. Any successful call of
+   :func:`~ssl.RAND_add`, :func:`~ssl.RAND_bytes` or
+   :func:`~ssl.RAND_pseudo_bytes` is sufficient.
+
 This section documents the objects and functions in the ``ssl`` module; for more
 general information about TLS, SSL, and certificates, the reader is referred to
 the documents in the "See Also" section at the bottom.