[THRIFT-3505] Enhance Python TSSLSocket

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 0.10.0
• Assignee: Nobuaki Sukegawa
• Reporter: Nobuaki Sukegawa
• Created: 23/Dec/15 14:26
• Updated: 06/Jan/16 02:06
• Resolved: 02/Jan/16 18:13

Description

Current TSSLSocket limits capacity of standard library ssl module by hiding functionality.
I revised initialization code rather radically but with backward compatible deprecation (and added tests).

Use SSLContext for Python 2.7.9 or later.

TLS 1.1 and 1.2 are now enabled by default when supported.

By exposing SSLContext, advanced users can now do mostly anything that can be done by Python ssl module.

Add all the relevent ssl.wrap_context options to constructor

Users on Python < 2.7.9 still can do mostly anything that standard library provides
e.g.: Client certificate validation (see test case)

As a bonus TSSLSocket and TSSLServerSocket arguments are now consistent and cleaner.
Also it no longer breaks Python 2.6.
Old signature is deprecated but still fully supported out of the box.

The patch also contains regenerated client test certs because it seems to be expired and was needed for tests.

Issue Links

• contains: THRIFT-3418 Use of ciphers in ssl.wrap_socket() breaks python 2.6 compatibility
• contains: THRIFT-1867 Python client/server should support client-side certificates.