SSL releated deprecation for 3.6

[tiran]

BPO	28022
Nosy	@ncoghlan, @orsenthil, @vstinner, @giampaolo, @tiran, @kousu, @alex, @vadmium, @serhiy-storchaka, @dstufft, @Lukasa
Files	ssl_deprecations.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = <Date 2021-04-17.10:48:13.818>
created_at = <Date 2016-09-08.15:19:02.658>
labels = ['type-security', 'expert-SSL', 'library', '3.10', 'docs']
title = 'SSL releated deprecation for 3.6'
updated_at = <Date 2021-08-08.19:17:15.658>
user = 'https://github.com/tiran'

bugs.python.org fields:

activity = <Date 2021-08-08.19:17:15.658>
actor = 'christian.heimes'
assignee = 'christian.heimes'
closed = True
closed_date = <Date 2021-04-17.10:48:13.818>
closer = 'christian.heimes'
components = ['Documentation', 'Library (Lib)', 'SSL']
creation = <Date 2016-09-08.15:19:02.658>
creator = 'christian.heimes'
dependencies = []
files = ['44492']
hgrepos = []
issue_num = 28022
keywords = ['patch']
message_count = 30.0
messages = ['275043', '275056', '275109', '275127', '275129', '275134', '275144', '275230', '275243', '275291', '275300', '275306', '275308', '275603', '275699', '275700', '275726', '275727', '275728', '275730', '275737', '275739', '275767', '275816', '275817', '275843', '275853', '304733', '399231', '399235']
nosy_count = 13.0
nosy_names = ['ncoghlan', 'janssen', 'orsenthil', 'vstinner', 'giampaolo.rodola', 'christian.heimes', 'kousu', 'alex', 'python-dev', 'martin.panter', 'serhiy.storchaka', 'dstufft', 'Lukasa']
pr_nums = []
priority = 'high'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue28022'
versions = ['Python 3.10']

[tiran]

I like to deprecate some SSL related parts of Python:

• ssl.wrap_socket() is a horrible abomination. People should use SSLContext.wrap_socket() instead
• all certfile/cert_file, keyfile/key_file and check_hostname arguments. Use context / ssl_context instead.
• make ftplib, imaplib, nntplib, pop3lib, smtplib etc. validate certs by default.

[Lukasa]

10/10, yes. I will happily provide code review for this.

[vstinner]

• make ftplib, imaplib, nntplib, pop3lib, smtplib etc. validate certs by default.

I'm not sure about this one:
http://legacy.python.org/dev/peps/pep-0476/#other-protocols

[tiran]

Another deprecation: I like to deprecate all arguments from SSLSocket.__init__() and require users to go through SSLContext.wrap_socket(). It's going to make the implementation much simpler. The argument list is just crazy:

class SSLSocket(socket):
    def __init__(self, sock=None, keyfile=None, certfile=None,
                 server_side=False, cert_reqs=CERT_NONE,
                 ssl_version=PROTOCOL_TLS, ca_certs=None,
                 do_handshake_on_connect=True,
                 family=AF_INET, type=SOCK_STREAM, proto=0, fileno=None,
                 suppress_ragged_eofs=True, npn_protocols=None, ciphers=None,
                 server_hostname=None,
                 _context=None):

[vstinner]

I like the idea of using SSLContext as the obvious and only choice to
"configure" SSL.

[tiran]

memo to me: check if SSLContext.wrap_socket() can deal with a fileno as sock argument.

[tiran]

First draft of a patch: https://github.com/tiran/cpython/commits/feature/ssl_deprecation

[vadmium]

urllib.request.urlopen() should be affected too right?

[orsenthil]

Yes, urllib.request.urlopen needs an update too. It takes those certfile and keyfile and usage of those could be deprecated in favor of context.

[tiran]

I have deprecated cafile, capath and cadefault for urlopen(). The function didn't pop up on my radar because I was looking for certfile and cert_file, not cafile. I also added deprecations to the documentation of SSLSocket.read and write.