expose SSL socket protocol version

[pitrou]

BPO	20421
Nosy	@pitrou, @giampaolo, @tiran, @benjaminp, @alex, @ethanfurman, @dstufft
Files	ssl_version.patch ssl_version2.patch backport-version.diff

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2014-09-04.19:02:06.638>
created_at = <Date 2014-01-28.16:36:54.341>
labels = ['type-feature', 'library']
title = 'expose SSL socket protocol version'
updated_at = <Date 2014-09-04.20:33:36.215>
user = 'https://github.com/pitrou'

bugs.python.org fields:

activity = <Date 2014-09-04.20:33:36.215>
actor = 'python-dev'
assignee = 'none'
closed = True
closed_date = <Date 2014-09-04.19:02:06.638>
closer = 'pitrou'
components = ['Library (Lib)']
creation = <Date 2014-01-28.16:36:54.341>
creator = 'pitrou'
dependencies = []
files = ['36440', '36509', '36536']
hgrepos = []
issue_num = 20421
keywords = ['patch']
message_count = 14.0
messages = ['209564', '214621', '214864', '216543', '216792', '216793', '225726', '226146', '226370', '226371', '226375', '226376', '226377', '226379']
nosy_count = 10.0
nosy_names = ['geertj', 'janssen', 'pitrou', 'giampaolo.rodola', 'christian.heimes', 'benjamin.peterson', 'alex', 'ethan.furman', 'python-dev', 'dstufft']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue20421'
versions = ['Python 3.5']

[pitrou]

SSL sockets should provide a way to query the current protocol version (e.g. "TLSv1.2"). OpenSSL makes it easy through SSL_get_version().

Open question is whether we return the string returned by SSL_get_version(), or we convert it to one of the constants ssl.PROTOCOL_XXX.

[pitrou]

(slightly related: should ssl.PROTOCOL_xxx constants become enum members?)

[pitrou]

We could actually use the undocumented "int SSL_version(const SSL *s)" and convert the return value to one of our favourite protocol constants.

[ethanfurman]

Sounds good to me.

[pitrou]

Ok, it came to me that converting to one of the PROTOCOL* constants can fail in the following case: Python is linked with an OpenSSL that supports a more recent protocol version than the ssl module is aware of. SSL_get_version() can then return a protocol (e.g. "TLSv1.3") that we don't know about, and have no way of converting to an existing constant.

So perhaps we should really simply return the same string as OpenSSL?

[giampaolo]

Debatable. Maybe I'm +0.1 for returning the plain string. IMO when it comes to stdlib modules, enums are only really useful for converting integer constants.

[pitrou]

Here is a patch. Doc updates still missing.

[pitrou]

Updated patch with doc.

[python-dev]

New changeset 648685f8d5e9 by Antoine Pitrou in branch 'default':
Issue bpo-20421: Add a .version() method to SSL sockets exposing the actual protocol version in use.
http://hg.python.org/cpython/rev/648685f8d5e9

[pitrou]

Pushed to default.

[alex]

Should this be backported to 2.7.9?

[pitrou]

It's as you want, now. I don't think this is really important, though.

[alex]

Attached patch backports it (only change is the use of closing() and resolving the conflict in Misc/NEWS). I'll leave it up to benjamin whether he wants to commit (input from others welcome). My view is to prefer backporting stuff since it helps keep the diff small.

[python-dev]

New changeset 16c86a6bdbe2 by Alex Gaynor in branch '2.7':
Issue bpo-20421: Add a .version() method to SSL sockets exposing the actual protocol version in use.
http://hg.python.org/cpython/rev/16c86a6bdbe2