Skip to content

Possibly unintentional change in ssl #114905

Open
@serhiy-storchaka

Description

@serhiy-storchaka

There is a possibly unintentional effect of #25455.

In Python 3.9:

>>> import ssl
>>> ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1_2, cert_reqs=ssl.CERT_NONE, check_hostname=True)
<ssl.SSLContext object at 0x7f93d68253c0>

In Python 3.10:

>>> import ssl
>>> ssl._create_stdlib_context(ssl.PROTOCOL_TLSv1_2, cert_reqs=ssl.CERT_NONE, check_hostname=True)
/home/serhiy/py/cpython3.10/Lib/ssl.py:806: DeprecationWarning: ssl.PROTOCOL_TLSv1_2 is deprecated
  context = SSLContext(protocol)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/serhiy/py/cpython3.10/Lib/ssl.py", line 809, in _create_unverified_context
    context.verify_mode = cert_reqs
  File "/home/serhiy/py/cpython3.10/Lib/ssl.py", line 738, in verify_mode
    super(SSLContext, SSLContext).verify_mode.__set__(self, value)
ValueError: Cannot set verify_mode to CERT_NONE when check_hostname is enabled.

This code not only emits a DeprecationWarning (it was expected), but also raises a ValueError.

This change left a confusing remnant in the code (see #103625) which can be safely deleted if this change was intentional. But this corner case is not covered by tests, this effect was not documented, so it is not known whether it was intentional change or error.

cc @tiran

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixes3.12only security fixes3.13bugs and security fixestopic-SSL

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions