[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: The part with "make ftplib, imaplib, nntplib, pop3lib, smtplib etc. validate certs by default" was not implemented. These modules still default to unverified connections. -- ___ Python tracker

[issue28022] SSL releated deprecation for 3.6

Nick Guenther added the comment: Hello everyone, and thank you as usual for all your hard work keeping the python ecosystem going. I saw that the start of this thread said it was going to > - make ftplib, imaplib, nntplib, pop3lib, smtplib etc. validate certs by > default. but this hasn't

[issue28022] SSL releated deprecation for 3.6

Change by Christian Heimes : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___

[issue28022] SSL releated deprecation for 3.6

Change by Christian Heimes : -- versions: +Python 3.10 -Python 3.6, Python 3.7 ___ Python tracker ___ ___ Python-bugs-list mailing

[issue28022] SSL releated deprecation for 3.6

Serhiy Storchaka added the comment: Shouldn't this issue be closed? Since SSL context arguments are not supported in 2.7, the deprecated arguments can't be removed until EOL of 2.7. -- ___ Python tracker

[issue28022] SSL releated deprecation for 3.6

Changes by Christian Heimes : -- components: +SSL ___ Python tracker ___ ___

[issue28022] SSL releated deprecation for 3.6

Roundup Robot added the comment: New changeset 57e88d1159fc by Christian Heimes in branch 'default': Issue #28022: Catch another deprecation warning in imaplib https://hg.python.org/cpython/rev/57e88d1159fc -- ___ Python tracker

[issue28022] SSL releated deprecation for 3.6

Serhiy Storchaka added the comment: test_imaplib is failed too. == ERROR: test_logincapa_with_client_certfile (test.test_imaplib.RemoteIMAP_SSLTest) --

[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: Thanks for the report. "./python -Werror -m test -uall test_httplib" is now passing for me. -- ___ Python tracker

[issue28022] SSL releated deprecation for 3.6

Roundup Robot added the comment: New changeset 2e541e994927 by Christian Heimes in branch 'default': Issue 28022: Catch deprecation warning in test_httplib, reported by Martin Panter https://hg.python.org/cpython/rev/2e541e994927 -- ___ Python

[issue28022] SSL releated deprecation for 3.6

Martin Panter added the comment: New test failure when using -Werror: == ERROR: test_local_bad_hostname (test.test_httplib.HTTPSTest) -- Traceback (most recent

[issue28022] SSL releated deprecation for 3.6

Nick Coghlan added the comment: Leaving the option of context caching entirely to the caller would definitely make things simpler - my main interest is just in avoiding a hard compatibility break for folks that aren't doing anything particularly wrong, by which I mean specifically cases where

[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: The performance benefit is not worth the risk. For 10 httplib requests to pypi.python.org, a shared SSLContext is about 5% faster than a new context for each request. Session resumption improves the simple test case by another 20%. --

[issue28022] SSL releated deprecation for 3.6

Nick Coghlan added the comment: That sounds like the "re" module would be a better exemplar for an SSL module convenience API design than "random" then - that has a similar model of needing an LRU cache for the compiled patterns for performance reasons, while still making working with the

[issue28022] SSL releated deprecation for 3.6

Donald Stufft added the comment: Thinking about that more, it's a bit harder than the Random module as well. The only state the random module has to worry about is the seed and internal state of the RNG. However, many of the arguments to ssl.wrap_socket change the SSLContext options for

[issue28022] SSL releated deprecation for 3.6

Donald Stufft added the comment: An implicit global SSL Context? It kinda sounds a bit gross. -- ___ Python tracker ___

[issue28022] SSL releated deprecation for 3.6

Nick Coghlan added the comment: I asked in more detail about this on the list, but my main question is why can't wrap_socket() be fixed by doing a rip-and-replace on its internals (e.g. by using a model similar to the one in random, where there's an implicit global Random instance that gets

[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: I have pushed all deprecation except ssl.wrap_socket(). Nick raised some concerns. I like to discourage people to use it because it hurts performance and is no longer best practice. How about we mark the function as legacy function and move it to a less

[issue28022] SSL releated deprecation for 3.6

Roundup Robot added the comment: New changeset aed3c541b2f1 by Christian Heimes in branch 'default': Issue #28022: Deprecate ssl-related arguments in favor of SSLContext. https://hg.python.org/cpython/rev/aed3c541b2f1 -- nosy: +python-dev ___ Python

[issue28022] SSL releated deprecation for 3.6

Nick Coghlan added the comment: +1 for a common note in all affected modules along the lines of "An appropriately configured SSLContext should be provided for any use cases that involve accepting self-signed certificates, privately signed certificates, or any other kind of certificate that

[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: In the mean time I have reconsidered my position. How about we *document* that a future version of Python will very all TLS/SSL connections by default. Users have to explicitly pass an unverified context if they still want the old behavior. --

[issue28022] SSL releated deprecation for 3.6

Nick Coghlan added the comment: +1 for directing all programmatic configuration through SSLContext However, implicitly verifying certificates for protocols other than HTTPS needs to be contingent on a properly designed approach to configuration that leaves informed users in full control of

[issue28022] SSL releated deprecation for 3.6

Martin Panter added the comment: How does that tie in with SSLObject.read() and write(). I have never used this class, but the documentation refers back to SSLSocket. It seems there are no recv() etc methods to use as an alternative. So maybe deprecate read() and write() on SSLSocket only,

[issue28022] SSL releated deprecation for 3.6

Changes by Christian Heimes : -- stage: needs patch -> patch review ___ Python tracker ___

[issue28022] SSL releated deprecation for 3.6

Changes by Christian Heimes : -- keywords: +patch Added file: http://bugs.python.org/file44492/ssl_deprecations.patch ___ Python tracker

[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: I have deprecated cafile, capath and cadefault for urlopen(). The function didn't pop up on my radar because I was looking for certfile and cert_file, not cafile. I also added deprecations to the documentation of SSLSocket.read and write. --

[issue28022] SSL releated deprecation for 3.6

Senthil Kumaran added the comment: Yes, urllib.request.urlopen needs an update too. It takes those certfile and keyfile and usage of those could be deprecated in favor of context. -- ___ Python tracker

[issue28022] SSL releated deprecation for 3.6

Martin Panter added the comment: urllib.request.urlopen() should be affected too right? -- nosy: +martin.panter ___ Python tracker ___

[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: First draft of a patch: https://github.com/tiran/cpython/commits/feature/ssl_deprecation -- ___ Python tracker ___

[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: memo to me: check if SSLContext.wrap_socket() can deal with a fileno as sock argument. -- ___ Python tracker ___

[issue28022] SSL releated deprecation for 3.6

Changes by Senthil Kumaran : -- nosy: +orsenthil ___ Python tracker ___ ___

[issue28022] SSL releated deprecation for 3.6

STINNER Victor added the comment: I like the idea of using SSLContext as the obvious and only choice to "configure" SSL. -- ___ Python tracker ___

[issue28022] SSL releated deprecation for 3.6

Christian Heimes added the comment: Another deprecation: I like to deprecate all arguments from SSLSocket.__init__() and require users to go through SSLContext.wrap_socket(). It's going to make the implementation much simpler. The argument list is just crazy: class SSLSocket(socket): def

[issue28022] SSL releated deprecation for 3.6

STINNER Victor added the comment: > - make ftplib, imaplib, nntplib, pop3lib, smtplib etc. validate certs by > default. I'm not sure about this one: http://legacy.python.org/dev/peps/pep-0476/#other-protocols -- nosy: +haypo ___ Python tracker

[issue28022] SSL releated deprecation for 3.6

Cory Benfield added the comment: 10/10, yes. I will happily provide code review for this. -- nosy: +Lukasa ___ Python tracker ___

[issue28022] SSL releated deprecation for 3.6

New submission from Christian Heimes: I like to deprecate some SSL related parts of Python: - ssl.wrap_socket() is a horrible abomination. People should use SSLContext.wrap_socket() instead - all certfile/cert_file, keyfile/key_file and check_hostname arguments. Use context / ssl_context