[Python-checkins] gh-94172: Remove ssl.PROTOCOL_SSLv2 dead code (#94312)
vstinner
webhook-mailer at python.org
Tue Jun 28 07:57:16 EDT 2022
https://github.com/python/cpython/commit/600c65c094b0b48704d8ec2416930648052ba715
commit: 600c65c094b0b48704d8ec2416930648052ba715
branch: main
author: Victor Stinner <vstinner at python.org>
committer: vstinner <vstinner at python.org>
date: 2022-06-28T13:57:08+02:00
summary:
gh-94172: Remove ssl.PROTOCOL_SSLv2 dead code (#94312)
Remove dead code related to ssl.PROTOCOL_SSLv2. ssl.PROTOCOL_SSLv2
was already removed in Python 3.10.
In test_ssl, @requires_tls_version('SSLv2') always returned False.
Extract of the removed code: "OpenSSL has removed support for SSLv2".
files:
M Doc/library/ssl.rst
M Lib/test/test_ssl.py
M Modules/_ssl.c
diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
index 1bbcd7a1964ea..19225c85ff762 100644
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -645,21 +645,6 @@ Constants
Use :data:`PROTOCOL_TLS` instead.
-.. data:: PROTOCOL_SSLv2
-
- Selects SSL version 2 as the channel encryption protocol.
-
- This protocol is not available if OpenSSL is compiled with the
- ``no-ssl2`` option.
-
- .. warning::
-
- SSL version 2 is insecure. Its use is highly discouraged.
-
- .. deprecated:: 3.6
-
- OpenSSL has removed support for SSLv2.
-
.. data:: PROTOCOL_SSLv3
Selects SSL version 3 as the channel encryption protocol.
@@ -1438,11 +1423,10 @@ to speed up repeated connections from the same clients.
The context is created with secure default values. The options
:data:`OP_NO_COMPRESSION`, :data:`OP_CIPHER_SERVER_PREFERENCE`,
:data:`OP_SINGLE_DH_USE`, :data:`OP_SINGLE_ECDH_USE`,
- :data:`OP_NO_SSLv2` (except for :data:`PROTOCOL_SSLv2`),
+ :data:`OP_NO_SSLv2`,
and :data:`OP_NO_SSLv3` (except for :data:`PROTOCOL_SSLv3`) are
set by default. The initial cipher suite list contains only ``HIGH``
- ciphers, no ``NULL`` ciphers and no ``MD5`` ciphers (except for
- :data:`PROTOCOL_SSLv2`).
+ ciphers, no ``NULL`` ciphers and no ``MD5`` ciphers.
.. deprecated:: 3.10
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 559eea9fbabf6..544adad89f586 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -208,10 +208,6 @@ def has_tls_version(version):
:param version: TLS version name or ssl.TLSVersion member
:return: bool
"""
- if version == "SSLv2":
- # never supported and not even in TLSVersion enum
- return False
-
if isinstance(version, str):
version = ssl.TLSVersion.__members__[version]
@@ -3129,37 +3125,10 @@ def test_ssl_cert_verify_error(self):
self.assertIn(msg, repr(e))
self.assertIn('certificate verify failed', repr(e))
- @requires_tls_version('SSLv2')
- def test_protocol_sslv2(self):
- """Connecting to an SSLv2 server with various client options"""
- if support.verbose:
- sys.stdout.write("\n")
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True)
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True, ssl.CERT_OPTIONAL)
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True, ssl.CERT_REQUIRED)
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLS, False)
- if has_tls_version('SSLv3'):
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv3, False)
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLSv1, False)
- # SSLv23 client with specific SSL options
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLS, False,
- client_options=ssl.OP_NO_SSLv3)
- try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLS, False,
- client_options=ssl.OP_NO_TLSv1)
-
def test_PROTOCOL_TLS(self):
"""Connecting to an SSLv23 server with various client options"""
if support.verbose:
sys.stdout.write("\n")
- if has_tls_version('SSLv2'):
- try:
- try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_SSLv2, True)
- except OSError as x:
- # this fails on some older versions of OpenSSL (0.9.7l, for instance)
- if support.verbose:
- sys.stdout.write(
- " SSL2 client to SSL23 server test unexpectedly failed:\n %s\n"
- % str(x))
if has_tls_version('SSLv3'):
try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_SSLv3, False)
try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLS, True)
@@ -3197,8 +3166,6 @@ def test_protocol_sslv3(self):
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, 'SSLv3')
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_OPTIONAL)
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_REQUIRED)
- if has_tls_version('SSLv2'):
- try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv2, False)
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_TLS, False,
client_options=ssl.OP_NO_SSLv3)
try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_TLSv1, False)
@@ -3211,8 +3178,6 @@ def test_protocol_tlsv1(self):
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, 'TLSv1')
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_OPTIONAL)
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_REQUIRED)
- if has_tls_version('SSLv2'):
- try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv2, False)
if has_tls_version('SSLv3'):
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv3, False)
try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLS, False,
@@ -3225,8 +3190,6 @@ def test_protocol_tlsv1_1(self):
if support.verbose:
sys.stdout.write("\n")
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_1, 'TLSv1.1')
- if has_tls_version('SSLv2'):
- try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv2, False)
if has_tls_version('SSLv3'):
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv3, False)
try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLS, False,
@@ -3245,8 +3208,6 @@ def test_protocol_tlsv1_2(self):
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2',
server_options=ssl.OP_NO_SSLv3|ssl.OP_NO_SSLv2,
client_options=ssl.OP_NO_SSLv3|ssl.OP_NO_SSLv2,)
- if has_tls_version('SSLv2'):
- try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv2, False)
if has_tls_version('SSLv3'):
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv3, False)
try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLS, False,
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index f19ee6815af39..8ff15d18fb637 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -138,9 +138,6 @@ extern const SSL_METHOD *TLSv1_2_method(void);
#define INVALID_SOCKET (-1)
#endif
-/* OpenSSL 1.1 does not have SSL 2.0 */
-#define OPENSSL_NO_SSL2
-
/* Default cipher suites */
#ifndef PY_SSL_DEFAULT_CIPHERS
#define PY_SSL_DEFAULT_CIPHERS 1
@@ -5825,10 +5822,6 @@ sslmodule_init_constants(PyObject *m)
#undef ADD_AD_CONSTANT
/* protocol versions */
-#ifndef OPENSSL_NO_SSL2
- PyModule_AddIntConstant(m, "PROTOCOL_SSLv2",
- PY_SSL_VERSION_SSL2);
-#endif
#ifndef OPENSSL_NO_SSL3
PyModule_AddIntConstant(m, "PROTOCOL_SSLv3",
PY_SSL_VERSION_SSL3);
@@ -5938,11 +5931,7 @@ sslmodule_init_constants(PyObject *m)
addbool(m, "HAS_NPN", 0);
addbool(m, "HAS_ALPN", 1);
-#if defined(SSL2_VERSION) && !defined(OPENSSL_NO_SSL2)
- addbool(m, "HAS_SSLv2", 1);
-#else
addbool(m, "HAS_SSLv2", 0);
-#endif
#if defined(SSL3_VERSION) && !defined(OPENSSL_NO_SSL3)
addbool(m, "HAS_SSLv3", 1);
More information about the Python-checkins
mailing list