[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[Roundup Robot]

Roundup Robot added the comment:

New changeset 98ee845a139a by Benjamin Peterson in branch '2.7':
make SSLv23 the default version in ftplib (closes #23111)
https://hg.python.org/cpython/rev/98ee845a139a

--
resolution:  -> fixed
stage:  -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[Arfrever Frehtes Taifersar Arahesis]

Arfrever Frehtes Taifersar Arahesis added the comment:

I think that this fix should be applied also in 2.7 branch.

--
nosy: +Arfrever, benjamin.peterson
resolution: fixed -> 
stage: resolved -> 
status: closed -> open
versions: +Python 2.7, Python 3.4

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[Roundup Robot]

Roundup Robot added the comment:

New changeset 29689050ec78 by Benjamin Peterson in branch '3.4':
update docs for #23111
https://hg.python.org/cpython/rev/29689050ec78

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[Roundup Robot]

Roundup Robot added the comment:

New changeset 414c450e8406 by Benjamin Peterson in branch '3.4':
make PROTOCOL_SSLv23 the default protocol version for ftplib (closes #23111)
https://hg.python.org/cpython/rev/414c450e8406

New changeset 33603f7949c5 by Benjamin Peterson in branch 'default':
merge 3.4 (#23111)
https://hg.python.org/cpython/rev/33603f7949c5

--
nosy: +python-dev
resolution:  -> fixed
stage:  -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[varde]

varde added the comment:

I know that, but it seems pretty unusual. And I would never had guessed from 
the documentation, I had to read the source.
My point is that it should be easier to just connect to a TLSv1.2 server: the 
documentation should mention the fact that ssl_version is a class attribute or 
it should be set to something more compatible like ssl.PROTOCOL_SSLv23.
I'm not sure about the implications of the latter.
I'm not saying that this is a serious bug, but I'm used to Python providing us 
with something that works (more or less) out of the box.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[Giampaolo Rodola']

Giampaolo Rodola' added the comment:

ssl_version is a class attribute so you can simply set that before 
instantiating FTP_TLS class:

>>> import ftplib
>>> ftplib.FTP_TLS.ssl_version = ...
>>> client = ftplib.FTP_TLS(...)
>>> ...

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[varde]

varde added the comment:

Well, because the ssl_version parameter should have a purpose. If it doesn't, 
the least we could do is remove it from the docs.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[Antoine Pitrou]

Antoine Pitrou added the comment:

> The only way to establish a successful connection is to pass a custom SSL 
> context to the constructor.

Why don't you do just that?

--
nosy: +giampaolo.rodola, pitrou
versions: +Python 3.5 -Python 2.7, Python 3.2, Python 3.3, Python 3.4

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue23111] ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or TLSv1.2

[varde]

New submission from varde:

When trying to connect to a server which only supports TLS version 1.1 or 1.2, 
the following error is raised:
ssl.SSLError: [SSL: WRONG_VERSION_NUMBER] wrong version number (_ssl.c:598)
For some reason, the SSL version is set to ssl.PROTOCOL_TLSv1 before 
initialisation and an SSL context is created in __init__, making any subsequent 
change to ssl_version useless.
The only way to establish a successful connection is to pass a custom SSL 
context to the constructor.
I think ssl_version should be settable at construction time before the context 
is created.
I'm not sure exposing ssl_version is useful either, the documentation mentions 
it but it has no use after initialisation.

The following lines should also be changed:
if self.ssl_version == ssl.PROTOCOL_TLSv1:
resp = self.voidcmd('AUTH TLS')

--
components: Library (Lib)
messages: 233087
nosy: varde
priority: normal
severity: normal
status: open
title: ftplib.FTP_TLS's default constructor does not work with TLSv1.1 or 
TLSv1.2
type: behavior
versions: Python 2.7, Python 3.2, Python 3.3, Python 3.4

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com