diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 1bbcd7a1964ea5..19225c85ff7624 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -645,21 +645,6 @@ Constants Use :data:`PROTOCOL_TLS` instead. -.. data:: PROTOCOL_SSLv2 - - Selects SSL version 2 as the channel encryption protocol. - - This protocol is not available if OpenSSL is compiled with the - ``no-ssl2`` option. - - .. warning:: - - SSL version 2 is insecure. Its use is highly discouraged. - - .. deprecated:: 3.6 - - OpenSSL has removed support for SSLv2. - .. data:: PROTOCOL_SSLv3 Selects SSL version 3 as the channel encryption protocol. @@ -1438,11 +1423,10 @@ to speed up repeated connections from the same clients. The context is created with secure default values. The options :data:`OP_NO_COMPRESSION`, :data:`OP_CIPHER_SERVER_PREFERENCE`, :data:`OP_SINGLE_DH_USE`, :data:`OP_SINGLE_ECDH_USE`, - :data:`OP_NO_SSLv2` (except for :data:`PROTOCOL_SSLv2`), + :data:`OP_NO_SSLv2`, and :data:`OP_NO_SSLv3` (except for :data:`PROTOCOL_SSLv3`) are set by default. The initial cipher suite list contains only ``HIGH`` - ciphers, no ``NULL`` ciphers and no ``MD5`` ciphers (except for - :data:`PROTOCOL_SSLv2`). + ciphers, no ``NULL`` ciphers and no ``MD5`` ciphers. .. deprecated:: 3.10 diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index b41ce98a6d9940..b3bd000f53af9f 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -208,10 +208,6 @@ def has_tls_version(version): :param version: TLS version name or ssl.TLSVersion member :return: bool """ - if version == "SSLv2": - # never supported and not even in TLSVersion enum - return False - if isinstance(version, str): version = ssl.TLSVersion.__members__[version] @@ -3125,37 +3121,10 @@ def test_ssl_cert_verify_error(self): self.assertIn(msg, repr(e)) self.assertIn('certificate verify failed', repr(e)) - @requires_tls_version('SSLv2') - def test_protocol_sslv2(self): - """Connecting to an SSLv2 server with various client options""" - if support.verbose: - sys.stdout.write("\n") - try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True) - try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True, ssl.CERT_OPTIONAL) - try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv2, True, ssl.CERT_REQUIRED) - try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLS, False) - if has_tls_version('SSLv3'): - try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_SSLv3, False) - try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLSv1, False) - # SSLv23 client with specific SSL options - try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLS, False, - client_options=ssl.OP_NO_SSLv3) - try_protocol_combo(ssl.PROTOCOL_SSLv2, ssl.PROTOCOL_TLS, False, - client_options=ssl.OP_NO_TLSv1) - def test_PROTOCOL_TLS(self): """Connecting to an SSLv23 server with various client options""" if support.verbose: sys.stdout.write("\n") - if has_tls_version('SSLv2'): - try: - try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_SSLv2, True) - except OSError as x: - # this fails on some older versions of OpenSSL (0.9.7l, for instance) - if support.verbose: - sys.stdout.write( - " SSL2 client to SSL23 server test unexpectedly failed:\n %s\n" - % str(x)) if has_tls_version('SSLv3'): try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_SSLv3, False) try_protocol_combo(ssl.PROTOCOL_TLS, ssl.PROTOCOL_TLS, True) @@ -3193,8 +3162,6 @@ def test_protocol_sslv3(self): try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, 'SSLv3') try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_OPTIONAL) try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv3, 'SSLv3', ssl.CERT_REQUIRED) - if has_tls_version('SSLv2'): - try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_SSLv2, False) try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_TLS, False, client_options=ssl.OP_NO_SSLv3) try_protocol_combo(ssl.PROTOCOL_SSLv3, ssl.PROTOCOL_TLSv1, False) @@ -3207,8 +3174,6 @@ def test_protocol_tlsv1(self): try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, 'TLSv1') try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_OPTIONAL) try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1, 'TLSv1', ssl.CERT_REQUIRED) - if has_tls_version('SSLv2'): - try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv2, False) if has_tls_version('SSLv3'): try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_SSLv3, False) try_protocol_combo(ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLS, False, @@ -3221,8 +3186,6 @@ def test_protocol_tlsv1_1(self): if support.verbose: sys.stdout.write("\n") try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLSv1_1, 'TLSv1.1') - if has_tls_version('SSLv2'): - try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv2, False) if has_tls_version('SSLv3'): try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_SSLv3, False) try_protocol_combo(ssl.PROTOCOL_TLSv1_1, ssl.PROTOCOL_TLS, False, @@ -3241,8 +3204,6 @@ def test_protocol_tlsv1_2(self): try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLSv1_2, 'TLSv1.2', server_options=ssl.OP_NO_SSLv3|ssl.OP_NO_SSLv2, client_options=ssl.OP_NO_SSLv3|ssl.OP_NO_SSLv2,) - if has_tls_version('SSLv2'): - try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv2, False) if has_tls_version('SSLv3'): try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_SSLv3, False) try_protocol_combo(ssl.PROTOCOL_TLSv1_2, ssl.PROTOCOL_TLS, False, diff --git a/Modules/_ssl.c b/Modules/_ssl.c index f19ee6815af394..8ff15d18fb637e 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -138,9 +138,6 @@ extern const SSL_METHOD *TLSv1_2_method(void); #define INVALID_SOCKET (-1) #endif -/* OpenSSL 1.1 does not have SSL 2.0 */ -#define OPENSSL_NO_SSL2 - /* Default cipher suites */ #ifndef PY_SSL_DEFAULT_CIPHERS #define PY_SSL_DEFAULT_CIPHERS 1 @@ -5825,10 +5822,6 @@ sslmodule_init_constants(PyObject *m) #undef ADD_AD_CONSTANT /* protocol versions */ -#ifndef OPENSSL_NO_SSL2 - PyModule_AddIntConstant(m, "PROTOCOL_SSLv2", - PY_SSL_VERSION_SSL2); -#endif #ifndef OPENSSL_NO_SSL3 PyModule_AddIntConstant(m, "PROTOCOL_SSLv3", PY_SSL_VERSION_SSL3); @@ -5938,11 +5931,7 @@ sslmodule_init_constants(PyObject *m) addbool(m, "HAS_NPN", 0); addbool(m, "HAS_ALPN", 1); -#if defined(SSL2_VERSION) && !defined(OPENSSL_NO_SSL2) - addbool(m, "HAS_SSLv2", 1); -#else addbool(m, "HAS_SSLv2", 0); -#endif #if defined(SSL3_VERSION) && !defined(OPENSSL_NO_SSL3) addbool(m, "HAS_SSLv3", 1);