cqlsh: Make SSL protocol version configurable

Patch by Jesse Szwedko; reviewed by Tyler Hobbs for CASSANDRA-9544

CHANGES.txt

@@ -1,4 +1,6 @@
 2.1.9
+ * (cqlsh) Allow the SSL protocol version to be specified through the
+   config file or environment variables (CASSANDRA-9544)
 Merged from 2.0:
  * Scrub (recover) sstables even when -Index.db is missing, (CASSANDRA-9591)
 

pylib/cqlshlib/sslhandling.py

@@ -19,6 +19,7 @@ import sys
 import ConfigParser
 import ssl
 
+
 def ssl_settings(host, config_file, env=os.environ):
     """
     Function wcich generates SSL setting for cassandra.Cluster
@@ -51,6 +52,17 @@ def ssl_settings(host, config_file, env=os.environ):
         ssl_validate = get_option('ssl', 'validate')
     ssl_validate = ssl_validate is None or ssl_validate.lower() != 'false'
 
+    ssl_version_str = env.get('SSL_VERSION')
+    if ssl_version_str is None:
+        ssl_version_str = get_option('ssl', 'version')
+    if ssl_version_str is None:
+        ssl_version_str = "TLSv1"
+
+    ssl_version = getattr(ssl, "PROTOCOL_%s" % ssl_version_str, None)
+    if ssl_version is None:
+        sys.exit("%s is not a valid SSL protocol, please use one of SSLv23, "
+                 "TLSv1, TLSv1.1, or TLSv1.2" % (ssl_version_str,))
+
     ssl_certfile = env.get('SSL_CERTFILE')
     if ssl_certfile is None:
         ssl_certfile = get_option('certfiles', host)
@@ -73,6 +85,5 @@ def ssl_settings(host, config_file, env=os.environ):
 
     return dict(ca_certs=ssl_certfile,
                 cert_reqs=ssl.CERT_REQUIRED if ssl_validate else ssl.CERT_NONE,
-                ssl_version=ssl.PROTOCOL_TLSv1,
+                ssl_version=ssl_version,
                 keyfile=userkey, certfile=usercert)
-