Skip to content

Commit a170fa1

Browse files
tirantiran
authored
bpo-31346: Use PROTOCOL_TLS_CLIENT/SERVER (#3058)
Replaces PROTOCOL_TLSv* and PROTOCOL_SSLv23 with PROTOCOL_TLS_CLIENT and PROTOCOL_TLS_SERVER. Signed-off-by: Christian Heimes <[email protected]>
1 parent 4df60f1 commit a170fa1

File tree

13 files changed

+321
-310
lines changed

13 files changed

+321
-310
lines changed

‎Lib/asyncio/test_utils.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ def dummy_ssl_context():
4545
if ssl is None:
4646
return None
4747
else:
48-
return ssl.SSLContext(ssl.PROTOCOL_SSLv23)
48+
return ssl.SSLContext(ssl.PROTOCOL_TLS)
4949

5050

5151
def run_briefly(loop):

‎Lib/ftplib.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -719,7 +719,7 @@ class FTP_TLS(FTP):
719719
'221 Goodbye.'
720720
>>>
721721
'''
722-
ssl_version = ssl.PROTOCOL_SSLv23
722+
ssl_version = ssl.PROTOCOL_TLS_CLIENT
723723

724724
def __init__(self, host='', user='', passwd='', acct='', keyfile=None,
725725
certfile=None, context=None,
@@ -753,7 +753,7 @@ def auth(self):
753753
'''Set up secure control connection by using TLS/SSL.'''
754754
if isinstance(self.sock, ssl.SSLSocket):
755755
raise ValueError("Already using TLS")
756-
if self.ssl_version >= ssl.PROTOCOL_SSLv23:
756+
if self.ssl_version >= ssl.PROTOCOL_TLS:
757757
resp = self.voidcmd('AUTH TLS')
758758
else:
759759
resp = self.voidcmd('AUTH SSL')

‎Lib/ssl.py‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -522,7 +522,7 @@ def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
522522
context.load_default_certs(purpose)
523523
return context
524524

525-
def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=None,
525+
def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=CERT_NONE,
526526
check_hostname=False, purpose=Purpose.SERVER_AUTH,
527527
certfile=None, keyfile=None,
528528
cafile=None, capath=None, cadata=None):
@@ -541,9 +541,12 @@ def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=None,
541541
# by default.
542542
context = SSLContext(protocol)
543543

544+
if not check_hostname:
545+
context.check_hostname = False
544546
if cert_reqs is not None:
545547
context.verify_mode = cert_reqs
546-
context.check_hostname = check_hostname
548+
if check_hostname:
549+
context.check_hostname = True
547550

548551
if keyfile and not certfile:
549552
raise ValueError("certfile must be specified")

‎Lib/test/test_asyncio/test_events.py‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -824,13 +824,13 @@ def test_ssl_connect_accepted_socket(self):
824824
'SSL not supported with proactor event loops before Python 3.5'
825825
)
826826

827-
server_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
827+
server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
828828
server_context.load_cert_chain(ONLYCERT, ONLYKEY)
829829
if hasattr(server_context, 'check_hostname'):
830830
server_context.check_hostname = False
831831
server_context.verify_mode = ssl.CERT_NONE
832832

833-
client_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
833+
client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
834834
if hasattr(server_context, 'check_hostname'):
835835
client_context.check_hostname = False
836836
client_context.verify_mode = ssl.CERT_NONE
@@ -985,7 +985,7 @@ def test_create_unix_server_path_socket_error(self):
985985
self.loop.run_until_complete(f)
986986

987987
def _create_ssl_context(self, certfile, keyfile=None):
988-
sslcontext = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
988+
sslcontext = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
989989
sslcontext.options |= ssl.OP_NO_SSLv2
990990
sslcontext.load_cert_chain(certfile, keyfile)
991991
return sslcontext
@@ -1082,7 +1082,7 @@ def test_create_server_ssl_verify_failed(self):
10821082
server, host, port = self._make_ssl_server(
10831083
lambda: proto, SIGNED_CERTFILE)
10841084

1085-
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
1085+
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
10861086
sslcontext_client.options |= ssl.OP_NO_SSLv2
10871087
sslcontext_client.verify_mode = ssl.CERT_REQUIRED
10881088
if hasattr(sslcontext_client, 'check_hostname'):
@@ -1116,7 +1116,7 @@ def test_create_unix_server_ssl_verify_failed(self):
11161116
server, path = self._make_ssl_unix_server(
11171117
lambda: proto, SIGNED_CERTFILE)
11181118

1119-
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
1119+
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
11201120
sslcontext_client.options |= ssl.OP_NO_SSLv2
11211121
sslcontext_client.verify_mode = ssl.CERT_REQUIRED
11221122
if hasattr(sslcontext_client, 'check_hostname'):
@@ -1150,7 +1150,7 @@ def test_create_server_ssl_match_failed(self):
11501150
server, host, port = self._make_ssl_server(
11511151
lambda: proto, SIGNED_CERTFILE)
11521152

1153-
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
1153+
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
11541154
sslcontext_client.options |= ssl.OP_NO_SSLv2
11551155
sslcontext_client.verify_mode = ssl.CERT_REQUIRED
11561156
sslcontext_client.load_verify_locations(
@@ -1183,7 +1183,7 @@ def test_create_unix_server_ssl_verified(self):
11831183
server, path = self._make_ssl_unix_server(
11841184
lambda: proto, SIGNED_CERTFILE)
11851185

1186-
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
1186+
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
11871187
sslcontext_client.options |= ssl.OP_NO_SSLv2
11881188
sslcontext_client.verify_mode = ssl.CERT_REQUIRED
11891189
sslcontext_client.load_verify_locations(cafile=SIGNING_CA)
@@ -1212,7 +1212,7 @@ def test_create_server_ssl_verified(self):
12121212
server, host, port = self._make_ssl_server(
12131213
lambda: proto, SIGNED_CERTFILE)
12141214

1215-
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
1215+
sslcontext_client = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
12161216
sslcontext_client.options |= ssl.OP_NO_SSLv2
12171217
sslcontext_client.verify_mode = ssl.CERT_REQUIRED
12181218
sslcontext_client.load_verify_locations(cafile=SIGNING_CA)

‎Lib/test/test_ftplib.py‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -902,17 +902,11 @@ def test_auth_issued_twice(self):
902902
self.client.auth()
903903
self.assertRaises(ValueError, self.client.auth)
904904

905-
def test_auth_ssl(self):
906-
try:
907-
self.client.ssl_version = ssl.PROTOCOL_SSLv23
908-
self.client.auth()
909-
self.assertRaises(ValueError, self.client.auth)
910-
finally:
911-
self.client.ssl_version = ssl.PROTOCOL_TLSv1
912-
913905
def test_context(self):
914906
self.client.quit()
915-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
907+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
908+
ctx.check_hostname = False
909+
ctx.verify_mode = ssl.CERT_NONE
916910
self.assertRaises(ValueError, ftplib.FTP_TLS, keyfile=CERTFILE,
917911
context=ctx)
918912
self.assertRaises(ValueError, ftplib.FTP_TLS, certfile=CERTFILE,
@@ -941,9 +935,9 @@ def test_ccc(self):
941935

942936
def test_check_hostname(self):
943937
self.client.quit()
944-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
945-
ctx.verify_mode = ssl.CERT_REQUIRED
946-
ctx.check_hostname = True
938+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
939+
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
940+
self.assertEqual(ctx.check_hostname, True)
947941
ctx.load_verify_locations(CAFILE)
948942
self.client = ftplib.FTP_TLS(context=ctx, timeout=TIMEOUT)
949943

‎Lib/test/test_httplib.py‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1583,8 +1583,9 @@ def test_networked_good_cert(self):
15831583
import ssl
15841584
support.requires('network')
15851585
with support.transient_internet('self-signed.pythontest.net'):
1586-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1587-
context.verify_mode = ssl.CERT_REQUIRED
1586+
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
1587+
self.assertEqual(context.verify_mode, ssl.CERT_REQUIRED)
1588+
self.assertEqual(context.check_hostname, True)
15881589
context.load_verify_locations(CERT_selfsigned_pythontestdotnet)
15891590
h = client.HTTPSConnection('self-signed.pythontest.net', 443, context=context)
15901591
h.request('GET', '/')
@@ -1599,8 +1600,7 @@ def test_networked_bad_cert(self):
15991600
import ssl
16001601
support.requires('network')
16011602
with support.transient_internet('self-signed.pythontest.net'):
1602-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1603-
context.verify_mode = ssl.CERT_REQUIRED
1603+
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
16041604
context.load_verify_locations(CERT_localhost)
16051605
h = client.HTTPSConnection('self-signed.pythontest.net', 443, context=context)
16061606
with self.assertRaises(ssl.SSLError) as exc_info:
@@ -1620,8 +1620,7 @@ def test_local_good_hostname(self):
16201620
# The (valid) cert validates the HTTP hostname
16211621
import ssl
16221622
server = self.make_server(CERT_localhost)
1623-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1624-
context.verify_mode = ssl.CERT_REQUIRED
1623+
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
16251624
context.load_verify_locations(CERT_localhost)
16261625
h = client.HTTPSConnection('localhost', server.port, context=context)
16271626
self.addCleanup(h.close)
@@ -1634,9 +1633,7 @@ def test_local_bad_hostname(self):
16341633
# The (valid) cert doesn't validate the HTTP hostname
16351634
import ssl
16361635
server = self.make_server(CERT_fakehostname)
1637-
context = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
1638-
context.verify_mode = ssl.CERT_REQUIRED
1639-
context.check_hostname = True
1636+
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
16401637
context.load_verify_locations(CERT_fakehostname)
16411638
h = client.HTTPSConnection('localhost', server.port, context=context)
16421639
with self.assertRaises(ssl.CertificateError):

‎Lib/test/test_imaplib.py‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -479,9 +479,9 @@ class NewIMAPSSLTests(NewIMAPTestsMixin, unittest.TestCase):
479479
server_class = SecureTCPServer
480480

481481
def test_ssl_raises(self):
482-
ssl_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
483-
ssl_context.verify_mode = ssl.CERT_REQUIRED
484-
ssl_context.check_hostname = True
482+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
483+
self.assertEqual(ssl_context.verify_mode, ssl.CERT_REQUIRED)
484+
self.assertEqual(ssl_context.check_hostname, True)
485485
ssl_context.load_verify_locations(CAFILE)
486486

487487
with self.assertRaisesRegex(ssl.CertificateError,
@@ -492,9 +492,7 @@ def test_ssl_raises(self):
492492
client.shutdown()
493493

494494
def test_ssl_verified(self):
495-
ssl_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
496-
ssl_context.verify_mode = ssl.CERT_REQUIRED
497-
ssl_context.check_hostname = True
495+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
498496
ssl_context.load_verify_locations(CAFILE)
499497

500498
_, server = self._setup(SimpleIMAPHandler)
@@ -871,9 +869,7 @@ class ThreadedNetworkedTestsSSL(ThreadedNetworkedTests):
871869

872870
@reap_threads
873871
def test_ssl_verified(self):
874-
ssl_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
875-
ssl_context.verify_mode = ssl.CERT_REQUIRED
876-
ssl_context.check_hostname = True
872+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
877873
ssl_context.load_verify_locations(CAFILE)
878874

879875
with self.assertRaisesRegex(
@@ -953,7 +949,9 @@ def tearDown(self):
953949
pass
954950

955951
def create_ssl_context(self):
956-
ssl_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
952+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
953+
ssl_context.check_hostname = False
954+
ssl_context.verify_mode = ssl.CERT_NONE
957955
ssl_context.load_cert_chain(CERTFILE)
958956
return ssl_context
959957

‎Lib/test/test_logging.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1792,7 +1792,7 @@ def test_output(self):
17921792
else:
17931793
here = os.path.dirname(__file__)
17941794
localhost_cert = os.path.join(here, "keycert.pem")
1795-
sslctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
1795+
sslctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
17961796
sslctx.load_cert_chain(localhost_cert)
17971797

17981798
context = ssl.create_default_context(cafile=localhost_cert)

‎Lib/test/test_poplib.py‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -352,10 +352,10 @@ def test_stls(self):
352352
@requires_ssl
353353
def test_stls_context(self):
354354
expected = b'+OK Begin TLS negotiation'
355-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
355+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
356356
ctx.load_verify_locations(CAFILE)
357-
ctx.verify_mode = ssl.CERT_REQUIRED
358-
ctx.check_hostname = True
357+
self.assertEqual(ctx.verify_mode, ssl.CERT_REQUIRED)
358+
self.assertEqual(ctx.check_hostname, True)
359359
with self.assertRaises(ssl.CertificateError):
360360
resp = self.client.stls(context=ctx)
361361
self.client = poplib.POP3("localhost", self.server.port, timeout=3)
@@ -392,7 +392,9 @@ def test__all__(self):
392392
self.assertIn('POP3_SSL', poplib.__all__)
393393

394394
def test_context(self):
395-
ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
395+
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
396+
ctx.check_hostname = False
397+
ctx.verify_mode = ssl.CERT_NONE
396398
self.assertRaises(ValueError, poplib.POP3_SSL, self.server.host,
397399
self.server.port, keyfile=CERTFILE, context=ctx)
398400
self.assertRaises(ValueError, poplib.POP3_SSL, self.server.host,

‎Lib/test/test_smtpnet.py‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,9 @@ class SmtpTest(unittest.TestCase):
2525

2626
def test_connect_starttls(self):
2727
support.get_attribute(smtplib, 'SMTP_SSL')
28-
context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
28+
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
29+
context.check_hostname = False
30+
context.verify_mode = ssl.CERT_NONE
2931
with support.transient_internet(self.testServer):
3032
server = smtplib.SMTP(self.testServer, self.remotePort)
3133
try:
@@ -58,7 +60,9 @@ def test_connect_default_port(self):
5860
server.quit()
5961

6062
def test_connect_using_sslcontext(self):
61-
context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
63+
context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
64+
context.check_hostname = False
65+
context.verify_mode = ssl.CERT_NONE
6266
support.get_attribute(smtplib, 'SMTP_SSL')
6367
with support.transient_internet(self.testServer):
6468
server = smtplib.SMTP_SSL(self.testServer, self.remotePort, context=context)

0 commit comments

Comments
 (0)