Rename ssl.Purpose.{CLIENT,SERVER}_AUTH

[alex]

BPO	29810
Nosy	@tiran, @alex, @dstufft

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2017-03-14.16:17:49.536>
labels = []
title = 'Rename ssl.Purpose.{CLIENT,SERVER}_AUTH'
updated_at = <Date 2017-03-14.16:48:50.514>
user = 'https://github.com/alex'

bugs.python.org fields:

activity = <Date 2017-03-14.16:48:50.514>
actor = 'alex'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = []
creation = <Date 2017-03-14.16:17:49.536>
creator = 'alex'
dependencies = []
files = []
hgrepos = []
issue_num = 29810
keywords = []
message_count = 5.0
messages = ['289601', '289604', '289605', '289606', '289607']
nosy_count = 4.0
nosy_names = ['janssen', 'christian.heimes', 'alex', 'dstufft']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = None
url = 'https://bugs.python.org/issue29810'
versions = []

[alex]

The names are super misleading. First, they're written in a way that's the opposite of how people think about these things (CLIENT_AUTH -> server socket; SERVER_AUTH -> client socket). Second, they're misleading, you can have TLS which is *mutually* authenticated. Third, CLIENT_AUTH is very frequently used for a server socket where the client isn't authenticated (at the TLS layer) at all!

A simple fix would be to add: Purpose.{CLIENT,SERVER}_SOCKET and alias the old names to those values.

[tiran]

For 3.7 I'm planning to move to protocols instead of purpose oids (PROTOCOL_TLS_CLIENT, PROTOCOL_TLS_SERVER).

[alex]

Ah, so instead of PROTOCOL_SSLv23 using PROTOCOL_TLS_CLIENT and deprecating the Purpose bits entirely? That sounds good to me!

[tiran]

Yes, I'm planning a PEP to make the SSL module a bit more sane:

1. deprecate all protocols except for PROTOCOL_TLS_CLIENT / PROTOCOL_TLS_SERVER
2. deprecate purpose in favor of PROTOCOL_TLS_*
3. PROTOCOL_TLS_CLIENT defaults to CERT_REQUIRED, match_hostname=True

[alex]

Sounds good to me!