Bret McGuire created CASSPYTHON-26:
--------------------------------------
Summary: Remove ssl_options
Key: CASSPYTHON-26
URL: https://issues.apache.org/jira/browse/CASSPYTHON-26
Project: Apache Cassandra Python driver
Issue Type: Improvement
Reporter: Bret McGuire
The 3.x Python driver supports two distinct methods of configuring SSL:
* Creation of a standalone SSLContext which is then passed in to the Cluster
via the ssl_context arg
* A dict of keyword args to the SSLContext.wrap_socket() call (passed via the
ssl_options arg)
** Note that we switched to SSLContext.wrap_socket() in 3.29.0 with [this
commit|https://github.com/apache/cassandra-python-driver/commit/8ff0ba0db62512cdbd868b809ac15a16e01ef94b]
** Prior to that point we would use ssl.wrap_socket() if an SSLContext wasn't
provided
ssl.wrap_socket() was deprecated in Python 3.7 and completely removed in Python
3.12. To make things even worse the args used in ssl.wrap_socket() and
SSLContext.wrap_socket() are similar but not exactly the same. An example: the
"cert_req" argument supported in ssl_options applied directly to
ssl.wrap_socket() but doesn't have a clear equivalent in
SSLContext.wrap_socket().
We should remove ssl_options in it's entirety and require the user to configure
and supply an SSLContext in order to use SSL with their cluster. This
simplifies our API space while also steering the user towards familiar Python
structures rather than an ssl_options dict which isn't intuitive. Note that
we've had a [TODO in the
code|https://github.com/apache/cassandra-python-driver/blob/3.30.0/cassandra/cluster.py#L812-L813]
to make this change at the next major for a long time so this is hardly a new
idea.
Note that this will also entail some significant changes to the [docs on
security|https://github.com/apache/cassandra-python-driver/blob/trunk/docs/security.rst]...
although it looks like they could use some freshening up anyway.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
