cpython-lru_cache-weakref: Lib/ssl.py annotate

annotate Lib/ssl.py @ 79691:05c8928362ee

Merge __next__ method link fixes with 3.3.

author	Ezio Melotti <ezio.melotti@gmail.com>
date	Fri, 12 Oct 2012 13:46:37 +0300
parents	2514a4e2b3ce
children	9510a9641c80

rev	line source
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	1 # Wrapper module for _ssl, providing some additional facilities
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	2 # implemented in Python. Written by Bill Janssen.
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	3
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	4 """This module provides some more Pythonic support for SSL.
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	5
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	6 Object types:
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	7
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	8 SSLSocket -- subtype of socket.socket which does SSL over the socket
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	9
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	10 Exceptions:
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	11
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	12 SSLError -- exception raised for I/O errors
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	13
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	14 Functions:
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	15
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	16 cert_time_to_seconds -- convert time string used for certificate
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	17 notBefore and notAfter functions to integer
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	18 seconds past the Epoch (the time values
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	19 returned from time.time())
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	20
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	21 fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	22 by the server running on HOST at port PORT. No
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	23 validation of the certificate is performed.
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	24
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	25 Integer constants:
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	26
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	27 SSL_ERROR_ZERO_RETURN
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	28 SSL_ERROR_WANT_READ
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	29 SSL_ERROR_WANT_WRITE
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	30 SSL_ERROR_WANT_X509_LOOKUP
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	31 SSL_ERROR_SYSCALL
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	32 SSL_ERROR_SSL
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	33 SSL_ERROR_WANT_CONNECT
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	34
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	35 SSL_ERROR_EOF
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	36 SSL_ERROR_INVALID_ERROR_CODE
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	37
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	38 The following group define certificate requirements that one side is
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	39 allowing/requiring from the other side:
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	40
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	41 CERT_NONE - no certificates from the other side are required (or will
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	42 be looked at if provided)
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	43 CERT_OPTIONAL - certificates are not required, but if provided will be
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	44 validated, and if validation fails, the connection will
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	45 also fail
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	46 CERT_REQUIRED - certificates are required, and will be validated, and
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	47 if validation fails, the connection will also fail
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	48
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	49 The following constants identify various SSL protocol variants:
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	50
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	51 PROTOCOL_SSLv2
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	52 PROTOCOL_SSLv3
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	53 PROTOCOL_SSLv23
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	54 PROTOCOL_TLSv1
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	55 """
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	56
45471 7dd2c1746267 Merged revisions 60990-61002 via svnmerge from Christian Heimes <christian@cheimes.de> parents: 44305 diff changeset	57 import textwrap
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	58 import re
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	59
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	60 import _ssl # if we can't import it, let the error propagate
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	61
60373 9e5e9d8fa847 Merged revisions 79812 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 59906 diff changeset	62 from _ssl import OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_INFO, OPENSSL_VERSION
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	63 from _ssl import _SSLContext
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	64 from _ssl import (
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	65 SSLError, SSLZeroReturnError, SSLWantReadError, SSLWantWriteError,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	66 SSLSyscallError, SSLEOFError,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	67 )
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	68 from _ssl import CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
74075 c706f76c9ea8 Issue #13635: Add ssl.OP_CIPHER_SERVER_PREFERENCE, so that SSL servers Antoine Pitrou <solipsis@pitrou.net> parents: 73150 diff changeset	69 from _ssl import (
c706f76c9ea8 Issue #13635: Add ssl.OP_CIPHER_SERVER_PREFERENCE, so that SSL servers Antoine Pitrou <solipsis@pitrou.net> parents: 73150 diff changeset	70 OP_ALL, OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_TLSv1,
75005 06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74249 diff changeset	71 OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE
74075 c706f76c9ea8 Issue #13635: Add ssl.OP_CIPHER_SERVER_PREFERENCE, so that SSL servers Antoine Pitrou <solipsis@pitrou.net> parents: 73150 diff changeset	72 )
74091 20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	73 try:
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	74 from _ssl import OP_NO_COMPRESSION
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	75 except ImportError:
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	76 pass
75005 06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74249 diff changeset	77 try:
06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74249 diff changeset	78 from _ssl import OP_SINGLE_ECDH_USE
06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74249 diff changeset	79 except ImportError:
06ed9b3f02af Try to really fix compilation failures of the _ssl module under very old OpenSSLs. Antoine Pitrou <solipsis@pitrou.net> parents: 74249 diff changeset	80 pass
70328 5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 70188 diff changeset	81 from _ssl import RAND_status, RAND_egd, RAND_add, RAND_bytes, RAND_pseudo_bytes
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	82 from _ssl import (
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	83 SSL_ERROR_ZERO_RETURN,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	84 SSL_ERROR_WANT_READ,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	85 SSL_ERROR_WANT_WRITE,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	86 SSL_ERROR_WANT_X509_LOOKUP,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	87 SSL_ERROR_SYSCALL,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	88 SSL_ERROR_SSL,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	89 SSL_ERROR_WANT_CONNECT,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	90 SSL_ERROR_EOF,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	91 SSL_ERROR_INVALID_ERROR_CODE,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	92 )
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	93 from _ssl import HAS_SNI, HAS_ECDH, HAS_NPN
69945 5296c3e2f166 Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 69875 diff changeset	94 from _ssl import (PROTOCOL_SSLv3, PROTOCOL_SSLv23,
5296c3e2f166 Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 69875 diff changeset	95 PROTOCOL_TLSv1)
71255 52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 70187 diff changeset	96 from _ssl import _OPENSSL_API_VERSION
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 70187 diff changeset	97
69997 b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	98 _PROTOCOL_NAMES = {
b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	99 PROTOCOL_TLSv1: "TLSv1",
b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	100 PROTOCOL_SSLv23: "SSLv23",
b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	101 PROTOCOL_SSLv3: "SSLv3",
b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	102 }
b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	103 try:
b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	104 from _ssl import PROTOCOL_SSLv2
74248 25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	105 _SSLv2_IF_EXISTS = PROTOCOL_SSLv2
69997 b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	106 except ImportError:
74248 25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	107 _SSLv2_IF_EXISTS = None
69997 b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	108 else:
b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	109 _PROTOCOL_NAMES[PROTOCOL_SSLv2] = "SSLv2"
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	110
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	111 from socket import getnameinfo as _getnameinfo
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	112 from socket import error as socket_error
69673 d3166c359714 Issue #11811: ssl.get_server_certificate() is now IPv6-compatible. Patch Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	113 from socket import socket, AF_INET, SOCK_STREAM, create_connection
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	114 import base64 # for DER-to-PEM translation
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	115 import traceback
60988 b877d2d04c14 Merged revisions 80509 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60938 diff changeset	116 import errno
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	117
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	118 if _ssl.HAS_TLS_UNIQUE:
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	119 CHANNEL_BINDING_TYPES = ['tls-unique']
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	120 else:
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	121 CHANNEL_BINDING_TYPES = []
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	122
74248 25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	123 # Disable weak or insecure ciphers by default
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	124 # (OpenSSL's default setting is 'DEFAULT:!aNULL:!eNULL')
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	125 _DEFAULT_CIPHERS = 'DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2'
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	126
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	127
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	128 class CertificateError(ValueError):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	129 pass
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	130
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	131
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	132 def _dnsname_to_pat(dn):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	133 pats = []
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	134 for frag in dn.split(r'.'):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	135 if frag == '*':
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	136 # When '*' is a fragment by itself, it matches a non-empty dotless
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	137 # fragment.
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	138 pats.append('[^.]+')
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	139 else:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	140 # Otherwise, '*' matches any dotless fragment.
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	141 frag = re.escape(frag)
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	142 pats.append(frag.replace(r'\', '[^.]'))
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	143 return re.compile(r'\A' + r'\.'.join(pats) + r'\Z', re.IGNORECASE)
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	144
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	145
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	146 def match_hostname(cert, hostname):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	147 """Verify that cert (in decoded format as returned by
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	148 SSLSocket.getpeercert()) matches the hostname. RFC 2818 rules
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	149 are mostly followed, but IP addresses are not accepted for hostname.
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	150
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	151 CertificateError is raised on failure. On success, the function
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	152 returns nothing.
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	153 """
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	154 if not cert:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	155 raise ValueError("empty or no certificate")
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	156 dnsnames = []
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	157 san = cert.get('subjectAltName', ())
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	158 for key, value in san:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	159 if key == 'DNS':
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	160 if _dnsname_to_pat(value).match(hostname):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	161 return
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	162 dnsnames.append(value)
69874 d4c2a99d1bad Issue #12000: When a SSL certificate has a subjectAltName without any Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	163 if not dnsnames:
d4c2a99d1bad Issue #12000: When a SSL certificate has a subjectAltName without any Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	164 # The subject is only checked when there is no dNSName entry
d4c2a99d1bad Issue #12000: When a SSL certificate has a subjectAltName without any Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	165 # in subjectAltName
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	166 for sub in cert.get('subject', ()):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	167 for key, value in sub:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	168 # XXX according to RFC 2818, the most specific Common Name
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	169 # must be used.
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	170 if key == 'commonName':
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	171 if _dnsname_to_pat(value).match(hostname):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	172 return
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	173 dnsnames.append(value)
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	174 if len(dnsnames) > 1:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	175 raise CertificateError("hostname %r "
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	176 "doesn't match either of %s"
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	177 % (hostname, ', '.join(map(repr, dnsnames))))
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	178 elif len(dnsnames) == 1:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	179 raise CertificateError("hostname %r "
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	180 "doesn't match %r"
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	181 % (hostname, dnsnames[0]))
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	182 else:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	183 raise CertificateError("no appropriate commonName or "
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	184 "subjectAltName fields were found")
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	185
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	186
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	187 class SSLContext(_SSLContext):
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	188 """An SSLContext holds various SSL-related configuration options and
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	189 data, such as certificates and possibly a private key."""
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	190
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	191 __slots__ = ('protocol',)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	192
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	193 def __new__(cls, protocol, args, *kwargs):
74248 25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	194 self = _SSLContext.__new__(cls, protocol)
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	195 if protocol != _SSLv2_IF_EXISTS:
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	196 self.set_ciphers(_DEFAULT_CIPHERS)
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	197 return self
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	198
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	199 def __init__(self, protocol):
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	200 self.protocol = protocol
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	201
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	202 def wrap_socket(self, sock, server_side=False,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	203 do_handshake_on_connect=True,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	204 suppress_ragged_eofs=True,
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	205 server_hostname=None):
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	206 return SSLSocket(sock=sock, server_side=server_side,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	207 do_handshake_on_connect=do_handshake_on_connect,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	208 suppress_ragged_eofs=suppress_ragged_eofs,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	209 server_hostname=server_hostname,
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	210 _context=self)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	211
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	212 def set_npn_protocols(self, npn_protocols):
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	213 protos = bytearray()
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	214 for protocol in npn_protocols:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	215 b = bytes(protocol, 'ascii')
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	216 if len(b) == 0 or len(b) > 255:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	217 raise SSLError('NPN protocols must be 1 to 255 in length')
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	218 protos.append(len(b))
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	219 protos.extend(b)
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	220
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	221 self._set_npn_protocols(protos)
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	222
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	223
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	224 class SSLSocket(socket):
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	225 """This class implements a subtype of socket.socket that wraps
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	226 the underlying OS socket in an SSL context when necessary, and
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	227 provides read and write methods over that channel."""
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	228
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	229 def __init__(self, sock=None, keyfile=None, certfile=None,
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	230 server_side=False, cert_reqs=CERT_NONE,
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	231 ssl_version=PROTOCOL_SSLv23, ca_certs=None,
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	232 do_handshake_on_connect=True,
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	233 family=AF_INET, type=SOCK_STREAM, proto=0, fileno=None,
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	234 suppress_ragged_eofs=True, npn_protocols=None, ciphers=None,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	235 server_hostname=None,
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	236 _context=None):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	237
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	238 if _context:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	239 self.context = _context
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	240 else:
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	241 if server_side and not certfile:
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	242 raise ValueError("certfile must be specified for server-side "
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	243 "operations")
64324 84883607e21a Fix issue #9711: raise ValueError is SSLConnection constructor is invoked with keyfile and not certfile. Giampaolo Rodolà <g.rodola@gmail.com> parents: 64306 diff changeset	244 if keyfile and not certfile:
84883607e21a Fix issue #9711: raise ValueError is SSLConnection constructor is invoked with keyfile and not certfile. Giampaolo Rodolà <g.rodola@gmail.com> parents: 64306 diff changeset	245 raise ValueError("certfile must be specified")
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	246 if certfile and not keyfile:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	247 keyfile = certfile
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	248 self.context = SSLContext(ssl_version)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	249 self.context.verify_mode = cert_reqs
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	250 if ca_certs:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	251 self.context.load_verify_locations(ca_certs)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	252 if certfile:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	253 self.context.load_cert_chain(certfile, keyfile)
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	254 if npn_protocols:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	255 self.context.set_npn_protocols(npn_protocols)
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	256 if ciphers:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	257 self.context.set_ciphers(ciphers)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	258 self.keyfile = keyfile
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	259 self.certfile = certfile
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	260 self.cert_reqs = cert_reqs
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	261 self.ssl_version = ssl_version
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	262 self.ca_certs = ca_certs
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	263 self.ciphers = ciphers
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	264 if server_side and server_hostname:
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	265 raise ValueError("server_hostname can only be specified "
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	266 "in client mode")
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	267 self.server_side = server_side
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	268 self.server_hostname = server_hostname
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	269 self.do_handshake_on_connect = do_handshake_on_connect
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	270 self.suppress_ragged_eofs = suppress_ragged_eofs
60991 d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	271 connected = False
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	272 if sock is not None:
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	273 socket.__init__(self,
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	274 family=sock.family,
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	275 type=sock.type,
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	276 proto=sock.proto,
63856 3f8cef837f07 Issue #8524: Add a forget() method to socket objects, so as to put the Antoine Pitrou <solipsis@pitrou.net> parents: 61782 diff changeset	277 fileno=sock.fileno())
60938 0ff8adde609c Merged revisions 80456 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 59907 diff changeset	278 self.settimeout(sock.gettimeout())
60991 d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	279 # see if it's connected
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	280 try:
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	281 sock.getpeername()
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	282 except socket_error as e:
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	283 if e.errno != errno.ENOTCONN:
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	284 raise
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	285 else:
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	286 connected = True
63890 60076f28c023 Followup to r83869 and issue #8524: rename socket.forget() to socket.detach() Antoine Pitrou <solipsis@pitrou.net> parents: 63856 diff changeset	287 sock.detach()
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	288 elif fileno is not None:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	289 socket.__init__(self, fileno=fileno)
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	290 else:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	291 socket.__init__(self, family=family, type=type, proto=proto)
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	292
60991 d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	293 self._closed = False
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	294 self._sslobj = None
68186 1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	295 self._connected = connected
60991 d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	296 if connected:
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	297 # create the SSL object
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	298 try:
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	299 self._sslobj = self.context._wrap_socket(self, server_side,
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	300 server_hostname)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	301 if do_handshake_on_connect:
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	302 timeout = self.gettimeout()
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	303 if timeout == 0.0:
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	304 # non-blocking
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	305 raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	306 self.do_handshake()
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	307
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	308 except socket_error as x:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	309 self.close()
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	310 raise x
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	311
43882 f6cca4b2260c Disable dup() of SSLSocket. I don't think it can be made to work. Guido van Rossum <guido@python.org> parents: 43881 diff changeset	312 def dup(self):
f6cca4b2260c Disable dup() of SSLSocket. I don't think it can be made to work. Guido van Rossum <guido@python.org> parents: 43881 diff changeset	313 raise NotImplemented("Can't dup() %s instances" %
f6cca4b2260c Disable dup() of SSLSocket. I don't think it can be made to work. Guido van Rossum <guido@python.org> parents: 43881 diff changeset	314 self.__class__.__name__)
f6cca4b2260c Disable dup() of SSLSocket. I don't think it can be made to work. Guido van Rossum <guido@python.org> parents: 43881 diff changeset	315
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	316 def _checkClosed(self, msg=None):
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	317 # raise an exception here if you wish to check for spurious closes
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	318 pass
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	319
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	320 def read(self, len=0, buffer=None):
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	321 """Read up to LEN bytes and return them.
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	322 Return zero-length string on EOF."""
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	323
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	324 self._checkClosed()
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	325 try:
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60993 diff changeset	326 if buffer is not None:
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60993 diff changeset	327 v = self._sslobj.read(len, buffer)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	328 else:
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	329 v = self._sslobj.read(len or 1024)
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	330 return v
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	331 except SSLError as x:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	332 if x.args[0] == SSL_ERROR_EOF and self.suppress_ragged_eofs:
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60993 diff changeset	333 if buffer is not None:
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	334 return 0
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	335 else:
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	336 return b''
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	337 else:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	338 raise
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	339
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	340 def write(self, data):
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	341 """Write DATA to the underlying SSL channel. Returns
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	342 number of bytes of DATA actually transmitted."""
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	343
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	344 self._checkClosed()
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	345 return self._sslobj.write(data)
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	346
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	347 def getpeercert(self, binary_form=False):
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	348 """Returns a formatted version of the data in the
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	349 certificate provided by the other end of the SSL channel.
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	350 Return None if no certificate was provided, {} if a
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	351 certificate was provided, but not validated."""
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	352
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	353 self._checkClosed()
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	354 return self._sslobj.peer_certificate(binary_form)
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	355
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	356 def selected_npn_protocol(self):
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	357 self._checkClosed()
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	358 if not self._sslobj or not _ssl.HAS_NPN:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	359 return None
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	360 else:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	361 return self._sslobj.selected_npn_protocol()
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	362
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	363 def cipher(self):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	364 self._checkClosed()
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	365 if not self._sslobj:
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	366 return None
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	367 else:
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	368 return self._sslobj.cipher()
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	369
74091 20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	370 def compression(self):
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	371 self._checkClosed()
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	372 if not self._sslobj:
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	373 return None
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	374 else:
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	375 return self._sslobj.compression()
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	376
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	377 def send(self, data, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	378 self._checkClosed()
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	379 if self._sslobj:
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	380 if flags != 0:
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	381 raise ValueError(
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	382 "non-zero flags not allowed in calls to send() on %s" %
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	383 self.__class__)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	384 while True:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	385 try:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	386 v = self._sslobj.write(data)
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	387 except SSLError as x:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	388 if x.args[0] == SSL_ERROR_WANT_READ:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	389 return 0
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	390 elif x.args[0] == SSL_ERROR_WANT_WRITE:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	391 return 0
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	392 else:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	393 raise
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	394 else:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	395 return v
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	396 else:
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	397 return socket.send(self, data, flags)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	398
64743 80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	399 def sendto(self, data, flags_or_addr, addr=None):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	400 self._checkClosed()
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	401 if self._sslobj:
48383 f5f70f20b678 fix bad method names in ssl module (and typo in ssl doc) Bill Janssen <janssen@parc.com> parents: 45471 diff changeset	402 raise ValueError("sendto not allowed on instances of %s" %
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	403 self.__class__)
64743 80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	404 elif addr is None:
80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	405 return socket.sendto(self, data, flags_or_addr)
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	406 else:
64743 80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	407 return socket.sendto(self, data, flags_or_addr, addr)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	408
72101 b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	409 def sendmsg(self, args, *kwargs):
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	410 # Ensure programs don't send data unencrypted if they try to
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	411 # use this method.
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	412 raise NotImplementedError("sendmsg not allowed on instances of %s" %
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	413 self.__class__)
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	414
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	415 def sendall(self, data, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	416 self._checkClosed()
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	417 if self._sslobj:
64305 9cba99068c54 Raise ValuError if non-zero flag argument is provided for sendall() method for conformity with send(), recv() and recv_into() Giampaolo Rodolà <g.rodola@gmail.com> parents: 63890 diff changeset	418 if flags != 0:
9cba99068c54 Raise ValuError if non-zero flag argument is provided for sendall() method for conformity with send(), recv() and recv_into() Giampaolo Rodolà <g.rodola@gmail.com> parents: 63890 diff changeset	419 raise ValueError(
9cba99068c54 Raise ValuError if non-zero flag argument is provided for sendall() method for conformity with send(), recv() and recv_into() Giampaolo Rodolà <g.rodola@gmail.com> parents: 63890 diff changeset	420 "non-zero flags not allowed in calls to sendall() on %s" %
9cba99068c54 Raise ValuError if non-zero flag argument is provided for sendall() method for conformity with send(), recv() and recv_into() Giampaolo Rodolà <g.rodola@gmail.com> parents: 63890 diff changeset	421 self.__class__)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	422 amount = len(data)
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	423 count = 0
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	424 while (count < amount):
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	425 v = self.send(data[count:])
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	426 count += v
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	427 return amount
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	428 else:
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	429 return socket.sendall(self, data, flags)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	430
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	431 def recv(self, buflen=1024, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	432 self._checkClosed()
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	433 if self._sslobj:
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	434 if flags != 0:
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	435 raise ValueError(
59907 9fbe2370dc02 Merged revisions 79287,79289 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 58408 diff changeset	436 "non-zero flags not allowed in calls to recv() on %s" %
9fbe2370dc02 Merged revisions 79287,79289 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 58408 diff changeset	437 self.__class__)
9fbe2370dc02 Merged revisions 79287,79289 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 58408 diff changeset	438 return self.read(buflen)
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	439 else:
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	440 return socket.recv(self, buflen, flags)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	441
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	442 def recv_into(self, buffer, nbytes=None, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	443 self._checkClosed()
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	444 if buffer and (nbytes is None):
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	445 nbytes = len(buffer)
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	446 elif nbytes is None:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	447 nbytes = 1024
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	448 if self._sslobj:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	449 if flags != 0:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	450 raise ValueError(
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	451 "non-zero flags not allowed in calls to recv_into() on %s" %
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	452 self.__class__)
59907 9fbe2370dc02 Merged revisions 79287,79289 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 58408 diff changeset	453 return self.read(nbytes, buffer)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	454 else:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	455 return socket.recv_into(self, buffer, nbytes, flags)
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	456
64743 80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	457 def recvfrom(self, buflen=1024, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	458 self._checkClosed()
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	459 if self._sslobj:
48383 f5f70f20b678 fix bad method names in ssl module (and typo in ssl doc) Bill Janssen <janssen@parc.com> parents: 45471 diff changeset	460 raise ValueError("recvfrom not allowed on instances of %s" %
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	461 self.__class__)
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	462 else:
64743 80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	463 return socket.recvfrom(self, buflen, flags)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	464
49090 ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	465 def recvfrom_into(self, buffer, nbytes=None, flags=0):
ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	466 self._checkClosed()
ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	467 if self._sslobj:
ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	468 raise ValueError("recvfrom_into not allowed on instances of %s" %
ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	469 self.__class__)
ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	470 else:
ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	471 return socket.recvfrom_into(self, buffer, nbytes, flags)
ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	472
72101 b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	473 def recvmsg(self, args, *kwargs):
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	474 raise NotImplementedError("recvmsg not allowed on instances of %s" %
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	475 self.__class__)
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	476
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	477 def recvmsg_into(self, args, *kwargs):
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	478 raise NotImplementedError("recvmsg_into not allowed on instances of "
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	479 "%s" % self.__class__)
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	480
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	481 def pending(self):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	482 self._checkClosed()
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	483 if self._sslobj:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	484 return self._sslobj.pending()
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	485 else:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	486 return 0
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	487
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	488 def shutdown(self, how):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	489 self._checkClosed()
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	490 self._sslobj = None
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	491 socket.shutdown(self, how)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	492
58408 121deed5968e Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 54568 diff changeset	493 def unwrap(self):
48681 3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48383 diff changeset	494 if self._sslobj:
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48383 diff changeset	495 s = self._sslobj.shutdown()
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48383 diff changeset	496 self._sslobj = None
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48383 diff changeset	497 return s
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48383 diff changeset	498 else:
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48383 diff changeset	499 raise ValueError("No SSL wrapper around " + str(self))
3c8ef3466923 clean up ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 48383 diff changeset	500
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	501 def _real_close(self):
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	502 self._sslobj = None
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	503 # self._closed = True
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	504 socket._real_close(self)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	505
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	506 def do_handshake(self, block=False):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	507 """Perform a TLS/SSL handshake."""
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	508
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	509 timeout = self.gettimeout()
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	510 try:
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	511 if timeout == 0.0 and block:
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	512 self.settimeout(None)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	513 self._sslobj.do_handshake()
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	514 finally:
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	515 self.settimeout(timeout)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	516
70187 019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	517 def _real_connect(self, addr, connect_ex):
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	518 if self.server_side:
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	519 raise ValueError("can't connect in server-side mode")
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	520 # Here we assume that the socket is client-side, and not
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	521 # connected at the time of the call. We connect it, then wrap it.
68186 1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	522 if self._connected:
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	523 raise ValueError("attempt to connect already-connected SSLSocket!")
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	524 self._sslobj = self.context._wrap_socket(self, False, self.server_hostname)
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	525 try:
70187 019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	526 if connect_ex:
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	527 rc = socket.connect_ex(self, addr)
68186 1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	528 else:
70187 019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	529 rc = None
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	530 socket.connect(self, addr)
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	531 if not rc:
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	532 if self.do_handshake_on_connect:
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	533 self.do_handshake()
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	534 self._connected = True
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	535 return rc
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	536 except socket_error:
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	537 self._sslobj = None
019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	538 raise
68186 1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	539
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	540 def connect(self, addr):
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	541 """Connects to remote ADDR, and then wraps the connection in
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	542 an SSL channel."""
68186 1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	543 self._real_connect(addr, False)
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	544
68186 1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	545 def connect_ex(self, addr):
1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	546 """Connects to remote ADDR, and then wraps the connection in
1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	547 an SSL channel."""
1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	548 return self._real_connect(addr, True)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	549
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	550 def accept(self):
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	551 """Accepts a new connection from a remote client, and returns
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	552 a tuple containing that new connection wrapped with a server-side
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	553 SSL channel, and the address of the remote client."""
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	554
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	555 newsock, addr = socket.accept(self)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	556 return (SSLSocket(sock=newsock,
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	557 keyfile=self.keyfile, certfile=self.certfile,
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	558 server_side=True,
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	559 cert_reqs=self.cert_reqs,
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	560 ssl_version=self.ssl_version,
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	561 ca_certs=self.ca_certs,
60662 e5f6de18b715 Merged revisions 80151 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60373 diff changeset	562 ciphers=self.ciphers,
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	563 do_handshake_on_connect=
e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	564 self.do_handshake_on_connect),
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	565 addr)
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	566
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	567 def get_channel_binding(self, cb_type="tls-unique"):
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	568 """Get channel binding data for current connection. Raise ValueError
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	569 if the requested `cb_type` is not supported. Return bytes of the data
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	570 or None if the data is not available (e.g. before the handshake).
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	571 """
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	572 if cb_type not in CHANNEL_BINDING_TYPES:
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	573 raise ValueError("Unsupported channel binding type")
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	574 if cb_type != "tls-unique":
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	575 raise NotImplementedError(
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	576 "{0} channel binding type not implemented"
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	577 .format(cb_type))
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	578 if self._sslobj is None:
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	579 return None
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	580 return self._sslobj.tls_unique_cb()
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	581
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	582 def __del__(self):
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	583 # sys.stderr.write("__del__ on %s\n" % repr(self))
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	584 self._real_close()
44206 ce280a04f55e Reverting revision 59394. We'll sort this out later. Guido van Rossum <guido@python.org> parents: 44205 diff changeset	585
ce280a04f55e Reverting revision 59394. We'll sort this out later. Guido van Rossum <guido@python.org> parents: 44205 diff changeset	586
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	587 def wrap_socket(sock, keyfile=None, certfile=None,
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	588 server_side=False, cert_reqs=CERT_NONE,
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	589 ssl_version=PROTOCOL_SSLv23, ca_certs=None,
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	590 do_handshake_on_connect=True,
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	591 suppress_ragged_eofs=True,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	592 ciphers=None):
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	593
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	594 return SSLSocket(sock=sock, keyfile=keyfile, certfile=certfile,
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	595 server_side=server_side, cert_reqs=cert_reqs,
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	596 ssl_version=ssl_version, ca_certs=ca_certs,
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	597 do_handshake_on_connect=do_handshake_on_connect,
60662 e5f6de18b715 Merged revisions 80151 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60373 diff changeset	598 suppress_ragged_eofs=suppress_ragged_eofs,
e5f6de18b715 Merged revisions 80151 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60373 diff changeset	599 ciphers=ciphers)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	600
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	601 # some utility functions
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	602
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	603 def cert_time_to_seconds(cert_time):
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	604 """Takes a date-time string in standard ASN1_print form
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	605 ("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	606 a Python time value in seconds past the epoch."""
4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	607
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	608 import time
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	609 return time.mktime(time.strptime(cert_time, "%b %d %H:%M:%S %Y GMT"))
27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	610
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	611 PEM_HEADER = "-----BEGIN CERTIFICATE-----"
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	612 PEM_FOOTER = "-----END CERTIFICATE-----"
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	613
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	614 def DER_cert_to_PEM_cert(der_cert_bytes):
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	615 """Takes a certificate in binary DER format and returns the
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	616 PEM version of it as a string."""
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	617
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	618 f = str(base64.standard_b64encode(der_cert_bytes), 'ASCII', 'strict')
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	619 return (PEM_HEADER + '\n' +
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	620 textwrap.fill(f, 64) + '\n' +
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	621 PEM_FOOTER + '\n')
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	622
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	623 def PEM_cert_to_DER_cert(pem_cert_string):
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	624 """Takes a certificate in ASCII PEM format and returns the
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	625 DER-encoded version of it as a byte sequence"""
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	626
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	627 if not pem_cert_string.startswith(PEM_HEADER):
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	628 raise ValueError("Invalid PEM encoding; must start with %s"
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	629 % PEM_HEADER)
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	630 if not pem_cert_string.strip().endswith(PEM_FOOTER):
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	631 raise ValueError("Invalid PEM encoding; must end with %s"
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	632 % PEM_FOOTER)
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	633 d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]
54568 031b963f2bc2 More codestring -> codebytes. Georg Brandl <georg@python.org> parents: 50390 diff changeset	634 return base64.decodebytes(d.encode('ASCII', 'strict'))
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	635
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	636 def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None):
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	637 """Retrieve the certificate from the server at the specified address,
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	638 and return it as a PEM-encoded string.
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	639 If 'ca_certs' is specified, validate the server cert against it.
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	640 If 'ssl_version' is specified, use it in the connection attempt."""
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	641
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	642 host, port = addr
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	643 if (ca_certs is not None):
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	644 cert_reqs = CERT_REQUIRED
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	645 else:
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	646 cert_reqs = CERT_NONE
69673 d3166c359714 Issue #11811: ssl.get_server_certificate() is now IPv6-compatible. Patch Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	647 s = create_connection(addr)
d3166c359714 Issue #11811: ssl.get_server_certificate() is now IPv6-compatible. Patch Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	648 s = wrap_socket(s, ssl_version=ssl_version,
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	649 cert_reqs=cert_reqs, ca_certs=ca_certs)
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	650 dercert = s.getpeercert(True)
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	651 s.close()
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	652 return DER_cert_to_PEM_cert(dercert)
1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	653
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	654 def get_protocol_name(protocol_code):
69997 b7abf0590e1c Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 64743 diff changeset	655 return _PROTOCOL_NAMES.get(protocol_code, '<unknown>')

Mercurial > cpython-lru_cache-weakref

annotate Lib/ssl.py @ 79691:05c8928362ee