Let Python choose the default SSL protocol for us.

Gbp-Pq: Name remove_ssl_2_3.patch

diff --git a/astropy/vo/samp/client.py b/astropy/vo/samp/client.py
index 63cf2f6fe37ecf06a7587b3b0ffe7e7885b77176..63328fe4b3400bd3906e61d6fef18ed401293556 100644 (file)
--- a/astropy/vo/samp/client.py
+++ b/astropy/vo/samp/client.py
@@ -85,13 +85,13 @@ class SAMPClient(object):
         passed from the Hub end of the connection.
 
     ssl_version : int, optional
-        Which version of the SSL protocol to use. Typically, the server
-        chooses a particular protocol version, and the client must adapt to
-        the server's choice. Most of the versions are not interoperable with
-        the other versions. If not specified the default SSL version is
-        `ssl.PROTOCOL_SSLv23`. This version provides the most compatibility
-        with other versions Hub side. Other SSL protocol versions are:
-        `ssl.PROTOCOL_SSLv2`, `ssl.PROTOCOL_SSLv3` and `ssl.PROTOCOL_TLSv1`.
+        Which version of the SSL protocol to use. Typically, the
+        server chooses a particular protocol version, and the client
+        must adapt to the server's choice. Most of the versions are
+        not interoperable with the other versions. If not specified,
+        the default SSL version is taken from the default in the
+        installed version of the Python standard `ssl` library.  See
+        the `ssl` documentation for more information.
 
     callable : bool, optional
         Whether the client can receive calls and notifications. If set to
@@ -118,9 +118,6 @@ class SAMPClient(object):
         if description is not None:
             metadata["samp.description.text"] = description
 
-        if SSL_SUPPORT and ssl_version is None:
-            ssl_version = ssl.PROTOCOL_SSLv23
-
         self._metadata = metadata
 
         self._addr = addr

diff --git a/astropy/vo/samp/hub.py b/astropy/vo/samp/hub.py
index 6e01b4f4adef2c550e5dc484190b76c6a8db496c..ba0044a7d82a7502241a762457bb5b80f1d5bcb7 100644 (file)
--- a/astropy/vo/samp/hub.py
+++ b/astropy/vo/samp/hub.py
@@ -114,14 +114,14 @@ class SAMPHubServer(object):
         passed from the Hub end of the connection.
 
     ssl_version : int, optional
-        The ``ssl_version`` option specifies which version of the SSL protocol
-        to use. Typically, the server chooses a particular protocol version,
-        and the client must adapt to the server's choice. Most of the versions
-        are not interoperable with the other versions. If not specified the
-        default SSL version is `ssl.PROTOCOL_SSLv23`. This version provides
-        the most compatibility with other versions client side. Other SSL
-        protocol versions are: `ssl.PROTOCOL_SSLv2`, `ssl.PROTOCOL_SSLv3` and
-        `ssl.PROTOCOL_TLSv1`.
+        The ``ssl_version`` option specifies which version of the SSL
+        protocol to use. Typically, the server chooses a particular
+        protocol version, and the client must adapt to the server's
+        choice. Most of the versions are not interoperable with the
+        other versions. If not specified, the default SSL version is
+        taken from the default in the installed version of the Python
+        standard `ssl` library.  See the `ssl` documentation for more
+        information.
 
     web_profile : bool, optional
         Enables or disables the Web Profile support.
@@ -165,9 +165,6 @@ class SAMPHubServer(object):
         self._client_timeout = client_timeout
         self._pool_size = pool_size
 
-        if SSL_SUPPORT and ssl_version is None:
-            ssl_version = ssl.PROTOCOL_SSLv23
-
         self._web_profile = web_profile
         self._web_profile_server = None
         self._web_profile_callbacks = {}

diff --git a/astropy/vo/samp/hub_proxy.py b/astropy/vo/samp/hub_proxy.py
index 503c063a4e7ef1ab388c2b8a36a6cd99f301d08d..d055b509cc344014dff565b081cd927cffd8d930 100644 (file)
--- a/astropy/vo/samp/hub_proxy.py
+++ b/astropy/vo/samp/hub_proxy.py
@@ -78,14 +78,14 @@ class SAMPHubProxy(object):
             certificate passed from the Hub end of the connection.
 
         ssl_version : int, optional
-            Which version of the SSL protocol to use. Typically, the server
-            chooses a particular protocol version, and the client must adapt
-            to the server's choice. Most of the versions are not interoperable
-            with the other versions. If not specified the default SSL version
-            is `ssl.PROTOCOL_SSLv3`. This version provides the most
-            compatibility with other versions server side. Other SSL protocol
-            versions are: `ssl.PROTOCOL_SSLv2`, `ssl.PROTOCOL_SSLv3` and
-            `ssl.PROTOCOL_TLSv1`.
+            Which version of the SSL protocol to use. Typically, the
+            server chooses a particular protocol version, and the
+            client must adapt to the server's choice. Most of the
+            versions are not interoperable with the other versions. If
+            not specified, the default SSL version is taken from the
+            default in the installed version of the Python standard
+            `ssl` library.  See the `ssl` documentation for more
+            information.
 
         pool_size : int, optional
             The number of socket connections opened to communicate with the
@@ -95,9 +95,6 @@ class SAMPHubProxy(object):
         self._connected = False
         self.lockfile = {}
 
-        if SSL_SUPPORT and ssl_version is None:
-            ssl_version = ssl.PROTOCOL_SSLv3
-
         if hub is not None and hub_params is not None:
             raise ValueError("Cannot specify both hub and hub_params")
 

diff --git a/astropy/vo/samp/hub_script.py b/astropy/vo/samp/hub_script.py
index 343319b4170d1f3e4c5c8b31752436ebbfc0fa0e..90b006f8aa3da0d22f00c795d4b67680f35e0713 100644 (file)
--- a/astropy/vo/samp/hub_script.py
+++ b/astropy/vo/samp/hub_script.py
@@ -148,10 +148,14 @@ def hub_script(timeout=0):
                                "SSL protocol to use. Typically, the server chooses a particular "
                                "protocol version, and the client must adapt to the server's choice. "
                                "Most of the versions are not interoperable with the other versions. "
-                               "If not specified the default SSL version is SSLv23. This version "
-                               "provides the most compatibility with other versions client side. "
-                               "Other SSL protocol versions are: SSLv2, SSLv3 and TLSv1.",
-                               type=str, choices=["SSLv23", "SSLv2", "SSLv3", "TLSv1"], default="SSLv23")
+                               "If not specified the default SSL version is taken from the default in "
+                               "the Python standard `ssl` library for the version of Python that is "
+                               "installed. Other SSL protocol versions are: SSLv2, SSLv3, SSLv23, "
+                               "TLSv1, TLSv1_1, TLSv1_2 but not all of them may be available on all "
+                               "versions of Python.",
+                               type=str,
+                               choices=["SSLv23", "SSLv2", "SSLv3", "TLSv1", "TLSv1_1", "TLSv1_2"],
+                               default=None)
 
         parser.add_argument_group(ssl_group)
 
@@ -170,14 +174,14 @@ def hub_script(timeout=0):
             else:
                 options.cert_reqs = ssl.CERT_NONE
 
-            if options.ssl_version == "SSLv2":
-                options.ssl_version = ssl.PROTOCOL_SSLv2
-            elif options.ssl_version == "SSLv3":
-                options.ssl_version = ssl.PROTOCOL_SSLv3
-            elif options.ssl_version == "TLSv1":
-                options.ssl_version = ssl.PROTOCOL_TLSv1
-            else:
-                options.ssl_version = ssl.PROTOCOL_SSLv23
+            if options.ssl_version is not None:
+                if hasattr(ssl, 'PROTOCOL_' + options.ssl_version):
+                    options.ssl_version = getattr(
+                        ssl, 'PROTOCOL_' + options.ssl_version)
+                else:
+                    raise ValueError(
+                        "SSL protocol '{0}' not supported on this version of "
+                        "Python".format(options.ssl_version))
 
         if options.loglevel in ("OFF", "ERROR", "WARNING", "DEBUG", "INFO"):
             log.setLevel(options.loglevel)

diff --git a/astropy/vo/samp/integrated_client.py b/astropy/vo/samp/integrated_client.py
index 43f3b8873d30ac3326f90d2640a97409a5837bf8..03006426f9adef83073d4b8cb6933dc9ece0eaf2 100644 (file)
--- a/astropy/vo/samp/integrated_client.py
+++ b/astropy/vo/samp/integrated_client.py
@@ -68,13 +68,13 @@ class SAMPIntegratedClient(object):
         passed from the Hub end of the connection.
 
     ssl_version : int, optional
-        Which version of the SSL protocol to use. Typically, the server chooses
-        a particular protocol version, and the client must adapt to the
-        server's choice. Most of the versions are not interoperable with the
-        other versions. If not specified the default SSL version is
-        `ssl.PROTOCOL_SSLv23`. This version provides the most compatibility
-        with other versions Hub side. Other SSL protocol versions are:
-        `ssl.PROTOCOL_SSLv2`, `ssl.PROTOCOL_SSLv3` and `ssl.PROTOCOL_TLSv1`.
+        Which version of the SSL protocol to use. Typically, the
+        server chooses a particular protocol version, and the client
+        must adapt to the server's choice. Most of the versions are
+        not interoperable with the other versions. If not specified,
+        the default SSL version is taken from the default in the
+        installed version of the Python standard `ssl` library.  See
+        the `ssl` documentation for more information.
 
     callable : bool, optional
         Whether the client can receive calls and notifications. If set to
@@ -147,14 +147,14 @@ class SAMPIntegratedClient(object):
             certificate passed from the Hub end of the connection.
 
         ssl_version : int, optional
-            Which version of the SSL protocol to use. Typically, the server
-            chooses a particular protocol version, and the client must adapt
-            to the server's choice. Most of the versions are not interoperable
-            with the other versions. If not specified the default SSL version
-            is `ssl.PROTOCOL_SSLv3`. This version provides the most
-            compatibility with other versions server side. Other SSL protocol
-            versions are: `ssl.PROTOCOL_SSLv2`, `ssl.PROTOCOL_SSLv3` and
-            `ssl.PROTOCOL_TLSv1`.
+            Which version of the SSL protocol to use. Typically, the
+            server chooses a particular protocol version, and the
+            client must adapt to the server's choice. Most of the
+            versions are not interoperable with the other versions. If
+            not specified, the default SSL version is taken from the
+            default in the installed version of the Python standard
+            `ssl` library.  See the `ssl` documentation for more
+            information.
 
         pool_size : int, optional
             The number of socket connections opened to communicate with the

diff --git a/astropy/vo/samp/ssl_utils.py b/astropy/vo/samp/ssl_utils.py
index 6b4785b8d0cb3aec9d75889742afa0625fb10342..94acc163b630d32d2496c5eb2c3f601bf6b326aa 100644 (file)
--- a/astropy/vo/samp/ssl_utils.py
+++ b/astropy/vo/samp/ssl_utils.py
@@ -32,7 +32,7 @@ if six.PY2:
 
         def __init__(self, host, port=None, key_file=None, cert_file=None,
                      cert_reqs=ssl.CERT_NONE, ca_certs=None,
-                     ssl_version=ssl.PROTOCOL_SSLv3, strict=None):
+                     ssl_version=None, strict=None):
 
             HTTPConnection.__init__(self, host, port, strict)
 
@@ -47,12 +47,18 @@ if six.PY2:
 
             sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
             sock.connect((self.host, self.port))
-            sslconn = ssl.wrap_socket(sock, server_side=False,
-                                      certfile=self.cert_file,
-                                      keyfile=self.key_file,
-                                      cert_reqs=self.cert_reqs,
-                                      ca_certs=self.ca_certs,
-                                      ssl_version=self.ssl_version)
+            # We have to explicitly not pass the ssl_version to
+            # `ssl.wrap_socket` if it's None.
+            kwargs = {
+                'server_size': False,
+                'certfile': self.cert_file,
+                'keyfile': self.key_file,
+                'cert_reqs': self.cert_reqs,
+                'ca_certs': self.ca_certs,
+            }
+            if self.ssl_version is not None:
+                kwargs['ssl_version'] = self.ssl_version
+            sslconn = ssl.wrap_socket(sock, **args)
             self.sock = sslconn
 
     class HTTPS(HTTP):
@@ -64,7 +70,7 @@ if six.PY2:
 
         def __init__(self, host='', port=None, key_file=None, cert_file=None,
                      cert_reqs=ssl.CERT_NONE, ca_certs=None,
-                     ssl_version=ssl.PROTOCOL_SSLv3):
+                     ssl_version=None):
 
             # provide a default host, pass the X509 cert info
 
@@ -97,7 +103,7 @@ class SafeTransport(xmlrpc.Transport):
 
     def __init__(self, key_file=None, cert_file=None,
                  cert_reqs=ssl.CERT_NONE, ca_certs=None,
-                 ssl_version=ssl.PROTOCOL_SSLv3, strict=None,
+                 ssl_version=None, strict=None,
                  use_datetime=0):
 
         xmlrpc.Transport.__init__(self, use_datetime)
@@ -151,10 +157,16 @@ class SecureXMLRPCServer(ThreadingXMLRPCServer):
     def get_request(self):
         # override this to wrap socket with SSL
         sock, addr = self.socket.accept()
-        sslconn = ssl.wrap_socket(sock, server_side=True,
-                                  certfile=self.cert_file,
-                                  keyfile=self.key_file,
-                                  cert_reqs=self.cert_reqs,
-                                  ca_certs=self.ca_certs,
-                                  ssl_version=self.ssl_version)
+        # We have to explicitly not pass the ssl_version to
+        # `ssl.wrap_socket` if it's None.
+        kwargs = {
+            'server_side': True,
+            'certfile': self.cert_file,
+            'keyfile': self.key_file,
+            'cert_reqs': self.cert_reqs,
+            'ca_certs': self.ca_certs
+        }
+        if self.ssl_version is not None:
+            kwargs['ssl_version'] = self.ssl_version
+        sslconn = ssl.wrap_socket(sock, **kwargs)
         return sslconn, addr