[CASSANDRA-17365] Remove deprecated version specific TLS in CQLSH

• Type: Task
• Status: Resolved
• Priority: Normal
• Resolution: Fixed
• Fix Version/s: 4.1-alpha1, 4.1
• Component/s: CQL/Interpreter
• Change Category: Operability
• Complexity: Normal
• Platform: All
• Impacts: Security

Source Control Link

https://github.com/apache/cassandra/commit/9711cd33c4d0d4a69279c8a79d8a8460accf1f12

Test and Documentation Plan

This follows a similar change to the Cassandra python driver.

• ran successful ssl connections to Cassandra
• ran successful pytest 

• Assignee: Brad Schoening
• Reporter: Brad Schoening

Authors

Brad Schoening

Reviewers

Brandon Williams, Stefan Miklosovic

• Created: 09/Feb/22 01:40
• Updated: 27/May/22 19:25
• Resolved: 06/Apr/22 12:03

Description

According to https://docs.python.org/3/library/ssl.html use of explicit TLS versions v1, v1_1 and v1_2 has been deprecated in Python 3.6+ in favor of auto-negotiation of the highest protocol version that both the client and server support.

• ssl.PROTOCOL_TLSv1
• ssl.PROTOCOL_TLSv1_1
• ssl.PROTOCOL_TLSv1_2

The above are deprecated since version 3.6: OpenSSL has deprecated all version specific protocols.

This affects cqlshlib/sslhandling.py and cqlshlib/test/test_sslhandling.py. And also config files test/config/

{sslhandling.config, sslhandling_invalid.config}

 

"NSA recommends that only TLS 1.2 or TLS 1.3 be used; and that SSL 2.0, SSL 3.0, TLS 1.0, and TLS 1.1 not be used"

https://media.defense.gov/2021/Jan/05/2002560140/-1/-1/0/ELIMINATING_OBSOLETE_TLS_UOO197443-20.PDF

The DataStax driver has addressed this in 3.25 with this update:

Update security documentation and examples to use PROTOCOL_TLS (PYTHON-1264)

https://datastax-oss.atlassian.net/browse/PYTHON-1264

https://github.com/datastax/python-driver/commit/8331eca6cc96d8bd3af2e37bc64693747515c2b6

This change will also remove the unit test class test_sslhandling.py which only tested version lookups and nothing else with ssl.