Description

vstinner

opened on Jun 24, 2022

Issue body actions

The commit 2875c60 deprecated many ssl and hashlib functions in Python 3.10:

• ssl.OP_NO_SSLv2
• ssl.OP_NO_SSLv3
• ssl.OP_NO_TLSv1
• ssl.OP_NO_TLSv1_1
• ssl.OP_NO_TLSv1_2
• ssl.OP_NO_TLSv1_3
• ssl.PROTOCOL_SSLv2
• ssl.PROTOCOL_SSLv3
• ssl.PROTOCOL_SSLv23 (alias for PROTOCOL_TLS)
• ssl.PROTOCOL_TLS
• ssl.PROTOCOL_TLSv1
• ssl.PROTOCOL_TLSv1_1
• ssl.PROTOCOL_TLSv1_2
• ssl.TLSVersion.SSLv3
• ssl.TLSVersion.TLSv1
• ssl.TLSVersion.TLSv1_1
• ssl.wrap_socket()
• ssl.RAND_pseudo_bytes()
• ssl.RAND_egd() (already removed since it's not supported by OpenSSL 1.1.1)
• ssl.SSLContext() without a protocol argument
• ssl.match_hostname()
• hashlib.pbkdf2_hmac() (pure Python implementation, fast OpenSSL function will stay)

They emit a DeprecationWarning in Python 3.10 and 3.11. According to PEP 387, they can now be removed in Python 3.12.

I'm not sure that we should actively remove all of these deprecated features, it should be decided on a case by case basis. Backward compatibility is even more complex when it's about security and old security protocols like SSL and old TLS versions.

• PR: gh-94199: Remove ssl.wrap_socket() documentation #99023

Activity

1. vstinner

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Jun 24, 2022
2. vstinner

   added a commit that references this issue on Jun 24, 2022

   gh-94199: Remove ssl.RAND_pseudo_bytes() function (#94202)

   d435a18
3. vstinner commented on Jun 24, 2022

   

   vstinner

   on Jun 24, 2022

   MemberAuthor

   More actions

   • ssl.RAND_pseudo_bytes: gh-94199: Remove ssl.RAND_pseudo_bytes() function #94202
   • ssl.match_hostname: gh-94199: Remove ssl.match_hostname() function #94224
   • ssl.wrap_socket: gh-94199: Remove the ssl.wrap_socket() function #94203
   • hashlib.pbkdf2_hmac: gh-94199: Remove hashlib.pbkdf2_hmac() Python implementation #94200
4. vstinner commented on Jun 24, 2022

   

   vstinner

   on Jun 24, 2022

   MemberAuthor

   More actions

   What's New in Python 3.10 lists many deprecated ssl functions and announces: "will be removed in 3.11" (Python 3.11).

   But in the meanwhile, PEP 387 was updated to require a feature to be deprecated for 2 Python releases (Python 3.10 and 3.11), not only a single Python release. Some functions were deprecated way before Python 3.10 (emit a DeprecationWarning).
5. tiran

   added a commit that references this issue on Jun 25, 2022

   gh-94199: Remove ssl.match_hostname() function (#94224)

   944c7d8
6. serhiy-storchaka

   added a commit that references this issue on Jun 26, 2022

   Revert 30935 defer bpo45162 to 312 (#94285)

   1ffde3e
7. ambv

   added a commit that references this issue on Jun 28, 2022

   gh-94199: Remove hashlib.pbkdf2_hmac() Python implementation (GH-94200)

   71d5299
8. gvanrossum

   added a commit that references this issue on Jun 30, 2022

   pythongh-94199: Remove hashlib.pbkdf2_hmac() Python implementation (p…

   8603119
9. tiran commented on Jul 8, 2022

   

   tiran

   on Jul 8, 2022

   Member

   More actions

   I have created ticket #94598 to track removal of SSL 3.0, TLS 1.0, and TLS 1.1 related features.
10. vstinner commented on Jul 8, 2022

    

    vstinner

    on Jul 8, 2022

    MemberAuthor

    More actions

    I have created ticket #94598 to track removal of SSL 3.0, TLS 1.0, and TLS 1.1 related features.

    Thank you for that!
11. vstinner

    added a commit that references this issue on Jul 8, 2022

    gh-94199: Remove the ssl.wrap_socket() function (#94203)

    00464bb
12. illia-v commented on Nov 2, 2022

    

    illia-v

    on Nov 2, 2022

    Contributor

    More actions

    Please note that ssl.wrap_socket is still documented on https://docs.python.org/3.12/library/ssl.html#ssl.wrap_socket despite it was removed.
13. vstinner commented on Nov 2, 2022

    

    vstinner

    on Nov 2, 2022

    MemberAuthor

    More actions

    Please note that ssl.wrap_socket is still documented on https://docs.python.org/3.12/library/ssl.html#ssl.wrap_socket despite it was removed.

    Oops, right. I propose PR #99023 to update the doc.
14. vstinner

    added a commit that references this issue on Nov 3, 2022

    gh-94199: Remove ssl.wrap_socket() documentation (#99023)

    cff1c20
15. vstinner commented on Nov 3, 2022

    

    vstinner

    on Nov 3, 2022

    MemberAuthor

    More actions

    I merged the last PR to remove keyfile, certfile and check_hostname parameters: ef0e72b

    I close the issue. I removed enough ssl deprecated functions for a single version and @tiran created #94598 to track removal of SSL 3.0, TLS 1.0, and TLS 1.1 related features.
16. vstinner

    closed this as completedon Nov 3, 2022
17. gnossen

    added a commit that references this issue on Jun 21, 2023

    [Test] Use `ssl.SSLContext.wrap_socket`, not `ssl.wrap_socket` (#33492)

    011e116
18. Amer7G7 commented on Dec 29, 2023

    

    Amer7G7

    on Dec 29, 2023 · Hidden as spam

    show commentMore actions
19. taratatach

    added 3 commits that reference this issue on Mar 12, 2024

    deps: Upgrade `tornado` to v6.4

    29271c2

    deps: Upgrade `tornado` to v6.0

    2e5be2b

    deps: Upgrade `tornado` to v6.0

    f33d362

Issue actions