Add cli option --tls-version to control tls version used #1073
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Fixes #1053.
This PR adds a
--tls-version
option, parallel to the option of the vanilla mysql client.It was implemented by bypassing PyMySQL's ssl logic and creating the SSLContext ourselves.
This PR is currently a draft, as it would require raising the minimum python version to 3.7, as 3.6 has no way to force TLSv1.3.
Specifically,
SSLContext.minimum_version
was only added in 3.7.However, PyMySQL's next update will require 3.7 as well.
This could alternatively be partially implemented inside PyMySQL as well. However, it is a documented option to pass a SSLContext to PyMySQL directly, so this seemed like the easier option.
One downside is that the
_create_ssl_context
method was strongly influenced by the one in PyMySQL - does this need to be noted somewhere for copyright reasons?Checklist
changelog.md
.AUTHORS
file (or it's already there).