Raise a DeprecationWarning instead of ValueError

Author: sethmlarson

Doc/library/asyncio-eventloop.rst

@@ -545,8 +545,9 @@ Opening network connections
       *all_errors* was added.
 
    .. versionchanged:: next
-      Raises a ``ValueError`` if ``ssl.check_hostname`` is ``True``
-      and ``server_hostname`` is not supplied.
+      Raises a ``DeprecationWarning`` if ``ssl.check_hostname`` is ``True``
+      and ``server_hostname`` is not supplied. In Python 3.13 and
+      later a ``ValueError`` is raised instead.
 
    .. seealso::
 

Doc/library/asyncio-stream.rst

@@ -383,8 +383,9 @@ StreamWriter
          Added the *ssl_shutdown_timeout* parameter.
 
       .. versionchanged:: next
-         Raises a ``ValueError`` if ``sslcontext.check_hostname`` is ``True``
-         and ``server_hostname`` is not supplied.
+         Raises a ``DeprecationWarning`` if ``ssl.check_hostname`` is ``True``
+         and ``server_hostname`` is not supplied. In Python 3.13 and
+         later a ``ValueError`` is raised instead.
 
 
    .. method:: is_closing()

Doc/library/ssl.rst

@@ -1810,10 +1810,10 @@ to speed up repeated connections from the same clients.
 
    The *server_side*, *server_hostname* and *session* parameters have the
    same meaning as in :meth:`SSLContext.wrap_socket`, and are validated in
-   the same way: in particular a :exc:`ValueError` is raised when
+   the same way: in particular a :exc:`DeprecationWarning` is raised when
    :attr:`~SSLContext.check_hostname` is enabled but no *server_hostname* is
    given, since there would be no name to match the peer's certificate
-   against.
+   against. In Python 3.13 and later a ``ValueError`` is raised instead.
 
    .. versionchanged:: 3.6
       *session* argument was added.

Lib/ssl.py

@@ -373,20 +373,6 @@ def _ipaddress_match(cert_ipaddress, host_ip):
     return ip == host_ip
 
 
-def _check_sslobject_params(server_side, context=None, server_hostname=None, session=None):
-    """Raises a ValueError if SSLObject._create() parameters aren't valid.
-    """
-    if server_side:
-        if server_hostname:
-            raise ValueError("server_hostname can only be specified "
-                             "in client mode")
-        if session is not None:
-            raise ValueError("session can only be specified in "
-                             "client mode")
-    if context.check_hostname and not server_hostname:
-        raise ValueError("check_hostname requires server_hostname")
-
-
 DefaultVerifyPaths = namedtuple("DefaultVerifyPaths",
     "cafile capath openssl_cafile_env openssl_cafile openssl_capath_env "
     "openssl_capath")
@@ -817,8 +803,18 @@ def __init__(self, *args, **kwargs):
     @classmethod
     def _create(cls, incoming, outgoing, server_side=False,
                  server_hostname=None, session=None, context=None):
-        _check_sslobject_params(server_side=server_side, context=context,
-                                server_hostname=server_hostname, session=session)
+        if server_side:
+            if server_hostname:
+                raise ValueError("server_hostname can only be specified "
+                                 "in client mode")
+            if session is not None:
+                raise ValueError("session can only be specified in "
+                                 "client mode")
+        if context.check_hostname and not server_hostname:
+            warnings.warn("check_hostname requires server_hostname",
+                          category=DeprecationWarning,
+                          stacklevel=3)
+
         self = cls.__new__(cls)
         sslobj = context._wrap_bio(
             incoming, outgoing, server_side=server_side,
@@ -974,8 +970,15 @@ def _create(cls, sock, server_side=False, do_handshake_on_connect=True,
                 context=None, session=None):
         if sock.getsockopt(SOL_SOCKET, SO_TYPE) != SOCK_STREAM:
             raise NotImplementedError("only stream sockets are supported")
-        _check_sslobject_params(server_side=server_side, context=context,
-                                server_hostname=server_hostname, session=session)
+        if server_side:
+            if server_hostname:
+                raise ValueError("server_hostname can only be specified "
+                                 "in client mode")
+            if session is not None:
+                raise ValueError("session can only be specified in "
+                                 "client mode")
+        if context.check_hostname and not server_hostname:
+            raise ValueError("check_hostname requires server_hostname")
 
         sock_timeout = sock.gettimeout()
         kwargs = dict(

Lib/test/test_asyncio/test_sslproto.py

@@ -96,8 +96,8 @@ def test_check_hostname_requires_server_hostname(self, server_hostname):
         waiter = mock.Mock()
 
         # Supplying an empty server_hostname fails with check_hostname enabled.
-        with self.assertRaisesRegex(
-                ValueError,
+        with self.assertWarnsRegex(
+                UserWarning,
                 'check_hostname requires server_hostname'):
             sslproto.SSLProtocol(self.loop, app_proto, sslcontext,
                                  waiter,

Lib/test/test_ssl.py

@@ -1722,10 +1722,10 @@ def test_subclass(self):
     def test_bad_server_hostname(self):
         ctx = ssl.create_default_context()
         # Omitting the name entirely is bad too: this context checks it.
-        with self.assertRaises(ValueError):
+        with self.assertWarns(DeprecationWarning):
             ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(),
                          server_hostname=None)
-        with self.assertRaises(ValueError):
+        with self.assertRaises(DeprecationWarning):
             ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(),
                          server_hostname="")
         with self.assertRaises(ValueError):
@@ -1812,23 +1812,22 @@ def test_private_init(self):
     def test_check_hostname_requires_server_hostname(self):
         # wrap_bio() used to accept a context asking for hostname checking
         # without a name to check against, and then verify the certificate
-        # chain but never the peer's identity, with check_hostname still
-        # reporting True and nothing reporting the check had been skipped.
-        # It must refuse that call, as wrap_socket() already did.
+        # chain but never the peer's identity without a warning. Now
+        # a warning is emitted in this scenario.
         client_context, _, hostname = testing_context()
         self.assertTrue(client_context.check_hostname)
 
         for server_hostname in (None, ""):
             with self.subTest(server_hostname=server_hostname):
-                with self.assertRaisesRegex(
-                        ValueError,
+                with self.assertWarnsRegex(
+                        DeprecationWarning,
                         "check_hostname requires server_hostname"):
                     client_context.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO(),
                                             server_hostname=server_hostname)
                 # The sibling constructor refuses the very same call.
                 with socket.socket() as sock:
-                    with self.assertRaisesRegex(
-                            ValueError,
+                    with self.assertWarnsRegex(
+                        DeprecationWarning,
                             "check_hostname requires server_hostname"):
                         client_context.wrap_socket(
                             sock, server_hostname=server_hostname)