Fix for Python 3.6 and lack of TLSv1.1

Author: fantix

asyncpg/connect_utils.py

@@ -222,6 +222,10 @@ def _parse_hostlist(hostlist, port, *, unquote=False):
 
 
 def_parse_tls_version(tls_version):
+ifnothasattr(ssl_module, 'TLSVersion'):
+raiseValueError(
+"TLSVersion is not supported in this version of Python"
+ )
 iftls_version.startswith('SSL'):
 raiseValueError(
 f"Unsupported TLS version: {tls_version}"
@@ -552,13 +556,17 @@ def _parse_connect_dsn_and_args(*, dsn, host, port, user,
 ssl.options&=~ssl_module.OP_NO_COMPRESSION
 
 ifssl_min_protocol_versionisNone:
-ssl_min_protocol_version=os.getenv(
-'PGSSLMINPROTOCOLVERSION', 'TLSv1.2'
- )
+ssl_min_protocol_version=os.getenv('PGSSLMINPROTOCOLVERSION')
 ifssl_min_protocol_version:
 ssl.minimum_version=_parse_tls_version(
 ssl_min_protocol_version
  )
+else:
+try:
+ssl.minimum_version=_parse_tls_version('TLSv1.2')
+exceptValueError:
+# Python 3.6 does not have ssl.TLSVersion
+pass
 
 ifssl_max_protocol_versionisNone:
 ssl_max_protocol_version=os.getenv('PGSSLMAXPROTOCOLVERSION')

tests/test_connect.py

@@ -13,6 +13,7 @@
 importshutil
 importssl
 importstat
+importsys
 importtempfile
 importtextwrap
 importunittest
@@ -1340,13 +1341,13 @@ async def verify_fails(sslmode, *, host='localhost', exn_type):
 awaitverify_works('allow')
 awaitverify_works('prefer')
 awaitverify_fails('require',
-exn_type=ssl.CertificateError)
+exn_type=ssl.SSLError)
 awaitverify_fails('verify-ca',
-exn_type=ssl.CertificateError)
+exn_type=ssl.SSLError)
 awaitverify_fails('verify-ca', host='127.0.0.1',
-exn_type=ssl.CertificateError)
+exn_type=ssl.SSLError)
 awaitverify_fails('verify-full',
-exn_type=ssl.CertificateError)
+exn_type=ssl.SSLError)
 
 asyncdeftest_ssl_connection_default_context(self):
 # XXX: uvloop artifact
@@ -1410,6 +1411,9 @@ async def test_executemany_uvloop_ssl_issue_700(self):
 finally:
 awaitcon.close()
 
+@unittest.skipIf(
+sys.version_info< (3, 7), "Python < 3.7 doesn't have ssl.TLSVersion"
+ )
 asyncdeftest_tls_version(self):
 # XXX: uvloop artifact
 old_handler=self.loop.get_exception_handler()
@@ -1420,7 +1424,7 @@ async def test_tls_version(self):
 dsn='postgresql://ssl_user@localhost/postgres'
 '?sslmode=require&ssl_min_protocol_version=TLSv1.3'
  )
-withself.assertRaisesRegex(ssl.SSLError, 'protocol version'):
+withself.assertRaises(ssl.SSLError):
 awaitself.connect(
 dsn='postgresql://ssl_user@localhost/postgres'
 '?sslmode=require'