Skip to content

Commit 8331eca

Browse files
aboudreaultaboudreault
committed
Update security documentation and examples to use PROTOCOL_TLS
1 parent 61400e8 commit 8331eca

5 files changed

Lines changed: 24 additions & 23 deletions

File tree

‎CHANGELOG.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ Bug Fixes
1515
Others
1616
------
1717
* Drop Python 3.4 support (PYTHON-1220)
18+
* Update security documentation and examples to use PROTOCOL_TLS (PYTHON-1264)
1819

1920
3.24.0
2021
======

‎cassandra/cluster.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -785,7 +785,7 @@ def default_retry_policy(self, policy):
785785
786786
By default, a ``ca_certs`` value should be supplied (the value should be
787787
a string pointing to the location of the CA certs file), and you probably
788-
want to specify ``ssl_version`` as ``ssl.PROTOCOL_TLSv1`` to match
788+
want to specify ``ssl_version`` as ``ssl.PROTOCOL_TLS`` to match
789789
Cassandra's default protocol.
790790
791791
.. versionchanged:: 3.3.0

‎docs/security.rst‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -119,9 +119,9 @@ The driver configuration:
119119
.. code-block:: python
120120
121121
from cassandra.cluster import Cluster, Session
122-
from ssl import SSLContext, PROTOCOL_TLSv1
122+
from ssl import SSLContext, PROTOCOL_TLS
123123
124-
ssl_context = SSLContext(PROTOCOL_TLSv1)
124+
ssl_context = SSLContext(PROTOCOL_TLS)
125125
126126
cluster = Cluster(['127.0.0.1'], ssl_context=ssl_context)
127127
session = cluster.connect()
@@ -147,9 +147,9 @@ to `CERT_REQUIRED`. Otherwise, the loaded verify certificate will have no effect
147147
.. code-block:: python
148148
149149
from cassandra.cluster import Cluster, Session
150-
from ssl import SSLContext, PROTOCOL_TLSv1, CERT_REQUIRED
150+
from ssl import SSLContext, PROTOCOL_TLS, CERT_REQUIRED
151151
152-
ssl_context = SSLContext(PROTOCOL_TLSv1)
152+
ssl_context = SSLContext(PROTOCOL_TLS)
153153
ssl_context.load_verify_locations('/path/to/rootca.crt')
154154
ssl_context.verify_mode = CERT_REQUIRED
155155
@@ -161,9 +161,9 @@ Additionally, you can also force the driver to verify the `hostname` of the serv
161161
.. code-block:: python
162162
163163
from cassandra.cluster import Cluster, Session
164-
from ssl import SSLContext, PROTOCOL_TLSv1, CERT_REQUIRED
164+
from ssl import SSLContext, PROTOCOL_TLS, CERT_REQUIRED
165165
166-
ssl_context = SSLContext(PROTOCOL_TLSv1)
166+
ssl_context = SSLContext(PROTOCOL_TLS)
167167
ssl_context.load_verify_locations('/path/to/rootca.crt')
168168
ssl_context.verify_mode = CERT_REQUIRED
169169
ssl_context.check_hostname = True
@@ -228,9 +228,9 @@ Finally, you can use that configuration with the following driver code:
228228
.. code-block:: python
229229
230230
from cassandra.cluster import Cluster, Session
231-
from ssl import SSLContext, PROTOCOL_TLSv1
231+
from ssl import SSLContext, PROTOCOL_TLS
232232
233-
ssl_context = SSLContext(PROTOCOL_TLSv1)
233+
ssl_context = SSLContext(PROTOCOL_TLS)
234234
ssl_context.load_cert_chain(
235235
certfile='/path/to/client.crt_signed',
236236
keyfile='/path/to/client.key')
@@ -251,9 +251,9 @@ The following driver code specifies that the connection should use two-way verif
251251
.. code-block:: python
252252
253253
from cassandra.cluster import Cluster, Session
254-
from ssl import SSLContext, PROTOCOL_TLSv1, CERT_REQUIRED
254+
from ssl import SSLContext, PROTOCOL_TLS, CERT_REQUIRED
255255
256-
ssl_context = SSLContext(PROTOCOL_TLSv1)
256+
ssl_context = SSLContext(PROTOCOL_TLS)
257257
ssl_context.load_verify_locations('/path/to/rootca.crt')
258258
ssl_context.verify_mode = CERT_REQUIRED
259259
ssl_context.load_cert_chain(
@@ -275,7 +275,7 @@ for more details about ``SSLContext`` configuration.
275275
from cassandra.cluster import Cluster
276276
from cassandra.io.twistedreactor import TwistedConnection
277277
278-
ssl_context = SSL.Context(SSL.TLSv1_METHOD)
278+
ssl_context = SSL.Context(SSL.TLSv1_2_METHOD)
279279
ssl_context.set_verify(SSL.VERIFY_PEER, callback=lambda _1, _2, _3, _4, ok: ok)
280280
ssl_context.use_certificate_file('/path/to/client.crt_signed')
281281
ssl_context.use_privatekey_file('/path/to/client.key')
@@ -303,19 +303,19 @@ deprecated in the next major release.
303303
304304
By default, a ``ca_certs`` value should be supplied (the value should be
305305
a string pointing to the location of the CA certs file), and you probably
306-
want to specify ``ssl_version`` as ``ssl.PROTOCOL_TLSv1`` to match
306+
want to specify ``ssl_version`` as ``ssl.PROTOCOL_TLS`` to match
307307
Cassandra's default protocol.
308308
309309
For example:
310310
311311
.. code-block:: python
312312
313313
from cassandra.cluster import Cluster
314-
from ssl import PROTOCOL_TLSv1, CERT_REQUIRED
314+
from ssl import PROTOCOL_TLS, CERT_REQUIRED
315315
316316
ssl_opts = {
317317
'ca_certs': '/path/to/my/ca.certs',
318-
'ssl_version': PROTOCOL_TLSv1,
318+
'ssl_version': PROTOCOL_TLS,
319319
'cert_reqs': CERT_REQUIRED # Certificates are required and validated
320320
}
321321
cluster = Cluster(ssl_options=ssl_opts)

‎tests/integration/cloud/test_cloud.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
import unittest # noqa
2525

2626
import six
27-
from ssl import SSLContext, PROTOCOL_TLSv1
27+
from ssl import SSLContext, PROTOCOL_TLS
2828

2929
from cassandra import DriverException, ConsistencyLevel, InvalidRequest
3030
from cassandra.cluster import NoHostAvailable, ExecutionProfile, Cluster, _execution_profile_to_string
@@ -92,7 +92,7 @@ def test_support_overriding_auth_provider(self):
9292

9393
def test_error_overriding_ssl_context(self):
9494
with self.assertRaises(ValueError) as cm:
95-
self.connect(self.creds, ssl_context=SSLContext(PROTOCOL_TLSv1))
95+
self.connect(self.creds, ssl_context=SSLContext(PROTOCOL_TLS))
9696

9797
self.assertIn('cannot be specified with a cloud configuration', str(cm.exception))
9898

‎tests/integration/long/test_ssl.py‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,11 @@
5454
USES_PYOPENSSL = "twisted" in EVENT_LOOP_MANAGER or "eventlet" in EVENT_LOOP_MANAGER
5555
if "twisted" in EVENT_LOOP_MANAGER:
5656
import OpenSSL
57-
ssl_version = OpenSSL.SSL.TLSv1_METHOD
57+
ssl_version = OpenSSL.SSL.TLSv1_2_METHOD
5858
verify_certs = {'cert_reqs': SSL.VERIFY_PEER,
5959
'check_hostname': True}
6060
else:
61-
ssl_version = ssl.PROTOCOL_TLSv1
61+
ssl_version = ssl.PROTOCOL_TLS
6262
verify_certs = {'cert_reqs': ssl.CERT_REQUIRED,
6363
'check_hostname': True}
6464

@@ -404,7 +404,7 @@ def test_can_connect_with_sslcontext_certificate(self):
404404
@test_category connection:ssl
405405
"""
406406
if USES_PYOPENSSL:
407-
ssl_context = SSL.Context(SSL.TLSv1_METHOD)
407+
ssl_context = SSL.Context(SSL.TLSv1_2_METHOD)
408408
ssl_context.load_verify_locations(CLIENT_CA_CERTS)
409409
else:
410410
ssl_context = ssl.SSLContext(ssl_version)
@@ -428,7 +428,7 @@ def test_can_connect_with_ssl_client_auth_password_private_key(self):
428428
ssl_options = {}
429429

430430
if USES_PYOPENSSL:
431-
ssl_context = SSL.Context(SSL.TLSv1_METHOD)
431+
ssl_context = SSL.Context(SSL.TLSv1_2_METHOD)
432432
ssl_context.use_certificate_file(abs_driver_certfile)
433433
with open(abs_driver_keyfile) as keyfile:
434434
key = crypto.load_privatekey(crypto.FILETYPE_PEM, keyfile.read(), b'cassandra')
@@ -449,7 +449,7 @@ def test_can_connect_with_ssl_context_ca_host_match(self):
449449
"""
450450
ssl_options = {}
451451
if USES_PYOPENSSL:
452-
ssl_context = SSL.Context(SSL.TLSv1_METHOD)
452+
ssl_context = SSL.Context(SSL.TLSv1_2_METHOD)
453453
ssl_context.use_certificate_file(DRIVER_CERTFILE)
454454
with open(DRIVER_KEYFILE_ENCRYPTED) as keyfile:
455455
key = crypto.load_privatekey(crypto.FILETYPE_PEM, keyfile.read(), b'cassandra')
@@ -472,7 +472,7 @@ def test_can_connect_with_ssl_context_ca_host_match(self):
472472
def test_cannot_connect_ssl_context_with_invalid_hostname(self):
473473
ssl_options = {}
474474
if USES_PYOPENSSL:
475-
ssl_context = SSL.Context(SSL.TLSv1_METHOD)
475+
ssl_context = SSL.Context(SSL.TLSv1_2_METHOD)
476476
ssl_context.use_certificate_file(DRIVER_CERTFILE)
477477
with open(DRIVER_KEYFILE_ENCRYPTED) as keyfile:
478478
key = crypto.load_privatekey(crypto.FILETYPE_PEM, keyfile.read(), b"cassandra")

0 commit comments

Comments
 (0)