[proxy] web.archive.org — ← back | site home | direct (HTTPS) ↗ | proxy home | ◑ dark◐ light

/ cpython Public

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bpo-32951: Disable SSLSocket/SSLObject constructor #5864

Merged
merged 1 commit into from Feb 27, 2018
Merged

bpo-32951: Disable SSLSocket/SSLObject constructor #5864

merged 1 commit into from Feb 27, 2018

Conversation

Copy link
Member

tiran commented Feb 24, 2018 •
edited by bedevere-bot

Direct instantiation of SSLSocket was never documented nor tested. It
had limitations, too. For example it was not possible to enabled
hostname verification except through ssl_version=PROTOCOL_TLS_CLIENT
with cert_reqs=CERT_REQUIRED.

The only test case for direct instantiation was added a couple of days
ago for IDNA testing.

Signed-off-by: Christian Heimes christian@python.org

https://bugs.python.org/issue32951

tiran force-pushed the sslsocket_no_instance branch from f26412b to fa2aa15 Compare Feb 25, 2018
tiran changed the title Remove support for instantiation of SSLSocket bpo-32951: Disable SSLSocket/SSLObject constructor Feb 25, 2018
tiran requested review from pitrou and alex Feb 25, 2018
bpo-32951: Disable SSLSocket/SSLObject constructor
47984b8 
Direct instantiation of SSLSocket and SSLObject objects is now prohibited.
The constructors were never documented, tested, or designed as public
constructors. The SSLSocket constructor had limitations. For example it was
not possible to enabled hostname verification except was
ssl_version=PROTOCOL_TLS_CLIENT with cert_reqs=CERT_REQUIRED.

SSLContext.wrap_socket() and SSLContext.wrap_bio are the recommended API
to construct SSLSocket and SSLObject instances. ssl.wrap_socket() is
also deprecated.

The only test case for direct instantiation was added a couple of days
ago for IDNA testing.

Signed-off-by: Christian Heimes <christian@python.org>
tiran force-pushed the sslsocket_no_instance branch from fa2aa15 to 47984b8 Compare Feb 27, 2018
tiran merged commit 9d50ab5 into python:master Feb 27, 2018
4 checks passed
Copy link

bedevere-bot commented Feb 27, 2018

@tiran: Please replace # with GH- in the commit message next time. Thanks!

Copy link
Contributor

miss-islington commented Feb 27, 2018

Thanks @tiran for the PR 🌮🎉.. I'm working now to backport this PR to: 3.7.
🐍🍒⛏🤖

Copy link
Contributor

miss-islington commented Feb 27, 2018

Sorry, @tiran, I could not cleanly backport this to 3.7 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker 9d50ab563df6307cabbcc9883cb8c52c614b0f22 3.7

tiran added a commit to tiran/cpython that referenced this issue Feb 27, 2018
[3.7] bpo-32951: Disable SSLSocket/SSLObject constructor (pythonGH-5864)
a66f15d 
Direct instantiation of SSLSocket and SSLObject objects is now prohibited.
The constructors were never documented, tested, or designed as public
constructors. The SSLSocket constructor had limitations. For example it was
not possible to enabled hostname verification except was
ssl_version=PROTOCOL_TLS_CLIENT with cert_reqs=CERT_REQUIRED.

SSLContext.wrap_socket() and SSLContext.wrap_bio are the recommended API
to construct SSLSocket and SSLObject instances. ssl.wrap_socket() is
also deprecated.

The only test case for direct instantiation was added a couple of days
ago for IDNA testing.

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 9d50ab5)

Co-authored-by: Christian Heimes <christian@python.org>
Copy link

bedevere-bot commented Feb 27, 2018

GH-5925 is a backport of this pull request to the 3.7 branch.

tiran added a commit that referenced this issue Feb 27, 2018
[3.7] bpo-32951: Disable SSLSocket/SSLObject constructor (GH-5864) (#…
89c2051 
…5925)

Direct instantiation of SSLSocket and SSLObject objects is now prohibited.
The constructors were never documented, tested, or designed as public
constructors. The SSLSocket constructor had limitations. For example it was
not possible to enabled hostname verification except was
ssl_version=PROTOCOL_TLS_CLIENT with cert_reqs=CERT_REQUIRED.

SSLContext.wrap_socket() and SSLContext.wrap_bio are the recommended API
to construct SSLSocket and SSLObject instances. ssl.wrap_socket() is
also deprecated.

The only test case for direct instantiation was added a couple of days
ago for IDNA testing.

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 9d50ab5)

Co-authored-by: Christian Heimes <christian@python.org>
hroncok mentioned this pull request May 19, 2018
Closed
yahya-abou-imran pushed a commit to yahya-abou-imran/cpython that referenced this issue Nov 2, 2018
bpo-32951: Disable SSLSocket/SSLObject constructor (python#5864)
0e28c21 
Direct instantiation of SSLSocket and SSLObject objects is now prohibited.
The constructors were never documented, tested, or designed as public
constructors. The SSLSocket constructor had limitations. For example it was
not possible to enabled hostname verification except was
ssl_version=PROTOCOL_TLS_CLIENT with cert_reqs=CERT_REQUIRED.

SSLContext.wrap_socket() and SSLContext.wrap_bio are the recommended API
to construct SSLSocket and SSLObject instances. ssl.wrap_socket() is
also deprecated.

The only test case for direct instantiation was added a couple of days
ago for IDNA testing.

Signed-off-by: Christian Heimes <christian@python.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

asvetlov

pitrou

alex

Assignees
No one assigned
Labels
CLA signed
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
5 participants