Skip to content

deprecate SSLSocket and TLSServer #10294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ohemorange merged 2 commits into from
May 15, 2025
Merged

deprecate SSLSocket and TLSServer #10294

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
037f71c
deprecate SSLSocket and TLSServer
bmw May 14, 2025
bcba37e
improve pytest.ini comment
bmw May 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions acme/src/acme/crypto_util.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,11 +100,10 @@ def __init__(
]
] = None,
) -> None:
warnings.warn("SSLSocket is deprecated and will be removed in an upcoming release",
DeprecationWarning)
self.sock = sock
self.alpn_selection = alpn_selection
if alpn_selection:
warnings.warn("alpn_selection ivar is deprecated and will be removed in an "
"upcoming certbot major version update", DeprecationWarning)
self.method = method
if not cert_selection and not certs:
raise ValueError("Neither cert_selection or certs specified.")
Expand Down Expand Up @@ -160,11 +159,15 @@ def shutdown(self, *unused_args: Any) -> bool:
# OpenSSL.SSL.Connection.shutdown doesn't accept any args
try:
return self._wrapped.shutdown()
except SSL.Error as error:
except SSL.Error as error: # pragma: no cover
# We wrap the error so we raise the same error type as sockets
# in the standard library. This is useful when this object is
# used by code which expects a standard socket such as
# socketserver in the standard library.
#
# We don't track code coverage in this "except" branch to avoid spurious CI failures
# caused by missing test coverage. These aren't worth fixing because this entire
# class has been deprecated. See https://github.com/certbot/certbot/issues/10284.
raise OSError(error)

def accept(self) -> Tuple[FakeConnection, Any]: # pylint: disable=missing-function-docstring
Expand Down
21 changes: 13 additions & 8 deletions acme/src/acme/standalone.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,9 +26,15 @@


class TLSServer(socketserver.TCPServer):
"""Generic TLS Server."""
"""Generic TLS Server

.. deprecated:: 4.1.0

"""

def __init__(self, *args: Any, **kwargs: Any) -> None:
warnings.warn("TLSServer is deprecated and will be removed in an upcoming release",
DeprecationWarning)
self.ipv6 = kwargs.pop("ipv6", False)
if self.ipv6:
self.address_family = socket.AF_INET6
Expand All @@ -41,10 +47,7 @@ def __init__(self, *args: Any, **kwargs: Any) -> None:

def _wrap_sock(self) -> None:
with warnings.catch_warnings():
warnings.filterwarnings(
'ignore',
message='alpn_selection ivar is deprecated'
)
warnings.filterwarnings('ignore', 'SSLSocket is deprecated')
self.socket = cast(socket.socket, crypto_util.SSLSocket(
self.socket, cert_selection=self._cert_selection,
alpn_selection=getattr(self, '_alpn_selection', None),
Expand Down Expand Up @@ -169,9 +172,11 @@ def __init__(self, server_address: Tuple[str, int],
# We don't need to implement a request handler here because the work
# (including logging) is being done by wrapped socket set up in the
# parent TLSServer class.
TLSServer.__init__(
self, server_address, socketserver.BaseRequestHandler, certs=certs,
ipv6=ipv6)
with warnings.catch_warnings():
warnings.filterwarnings("ignore", "TLSServer is deprecated")
TLSServer.__init__(
self, server_address, socketserver.BaseRequestHandler, certs=certs,
ipv6=ipv6)
self.challenge_certs = challenge_certs

def _cert_selection(self, connection: SSL.Connection) -> Optional[crypto_util._KeyAndCert]:
Expand Down
3 changes: 2 additions & 1 deletion certbot/CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,9 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
* acme.client.ClientNetwork now makes the "key" parameter optional.
* Deprecated `acme.challenges.TLSALPN01Response`
* Deprecated `acme.challenges.TLSALPN01`
* Deprecated ivar `alpn_selection` from `acme.crypto_util.SSLSocket`
* Deprecated parameter `alpn_protocols` from `acme.crypto_util.probe_sni`
* Deprecated `acme.crypto_util.SSLSocket`
* Deprecated `acme.standalone.TLSServer`
* Deprecated `acme.standalone.TLSALPN01Server`
* Dropped support for Python 3.9.0 and 3.9.1 for compatibility with newer
versions of the cryptography Python package. Python 3.9.2+ is still
Expand Down
10 changes: 6 additions & 4 deletions pytest.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,19 +20,21 @@
# 3) Ignore DeprecationWarning for datetime.utcfromtimestamp() triggered
# from dateutil. See https://github.com/dateutil/dateutil/issues/1314.
# 4 & 5) The pyOpenSSL X509/PKey warnings are due to TLS-ALPN-01 support.
# Resolving these warnings is being tracked by
# Resolving these warnings is being tracked by
# https://github.com/certbot/certbot/issues/10079.
# 6 - 10) Planning to remove unused TLS-ALPN support in acme.
# See https://github.com/certbot/certbot/issues/10266
# 6 - 11) Planning to remove unused TLS-ALPN support in acme.
# See https://github.com/certbot/certbot/issues/10266 and
# https://github.com/certbot/certbot/pull/10294.
filterwarnings =
error
ignore:.*rsyncdir:DeprecationWarning
ignore:'urllib3.contrib.pyopenssl:DeprecationWarning:requests_toolbelt
ignore:.*datetime.utcfromtimestamp\(\) is deprecated:DeprecationWarning:dateutil
ignore:Passing pyOpenSSL X509 objects is deprecated:DeprecationWarning
ignore:Passing pyOpenSSL PKey objects is deprecated:DeprecationWarning
ignore:alpn_selection ivar is deprecated:DeprecationWarning
ignore:alpn_protocols parameter is deprecated:DeprecationWarning
ignore:SSLSocket is deprecated:DeprecationWarning
ignore:TLSALPN01Server is deprecated:DeprecationWarning
ignore:TLSALPN01Response is deprecated:DeprecationWarning
ignore:TLSALPN01 is deprecated:DeprecationWarning
ignore:TLSServer is deprecated:DeprecationWarning