cpython-lru_cache-weakref: Lib/ssl.py annotate

annotate Lib/ssl.py @ 87690:66c1c9f32567 default tip

Add use_weakref option to functools.lru_cache The use_weakref option makes lru_cache create weak references to the function arguments when creating the cache key, which prevents them from staying in the memory forever even after all other references to them are gone. This is a proof of concept for http://bugs.python.org/issue19859

author	Radomir Dopieralski <devel@sheep.art.pl>
date	Tue, 03 Dec 2013 16:02:48 +0100
parents	aa531135bc6b
children

rev	line source
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	1 # Wrapper module for _ssl, providing some additional facilities
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	2 # implemented in Python. Written by Bill Janssen.
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	3
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	4 """This module provides some more Pythonic support for SSL.
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	5
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	6 Object types:
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	7
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	8 SSLSocket -- subtype of socket.socket which does SSL over the socket
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	9
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	10 Exceptions:
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	11
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	12 SSLError -- exception raised for I/O errors
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	13
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	14 Functions:
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	15
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	16 cert_time_to_seconds -- convert time string used for certificate
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	17 notBefore and notAfter functions to integer
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	18 seconds past the Epoch (the time values
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	19 returned from time.time())
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	20
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	21 fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	22 by the server running on HOST at port PORT. No
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	23 validation of the certificate is performed.
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	24
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	25 Integer constants:
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	26
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	27 SSL_ERROR_ZERO_RETURN
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	28 SSL_ERROR_WANT_READ
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	29 SSL_ERROR_WANT_WRITE
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	30 SSL_ERROR_WANT_X509_LOOKUP
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	31 SSL_ERROR_SYSCALL
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	32 SSL_ERROR_SSL
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	33 SSL_ERROR_WANT_CONNECT
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	34
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	35 SSL_ERROR_EOF
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	36 SSL_ERROR_INVALID_ERROR_CODE
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	37
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	38 The following group define certificate requirements that one side is
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	39 allowing/requiring from the other side:
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	40
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	41 CERT_NONE - no certificates from the other side are required (or will
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	42 be looked at if provided)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	43 CERT_OPTIONAL - certificates are not required, but if provided will be
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	44 validated, and if validation fails, the connection will
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	45 also fail
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	46 CERT_REQUIRED - certificates are required, and will be validated, and
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	47 if validation fails, the connection will also fail
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	48
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	49 The following constants identify various SSL protocol variants:
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	50
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	51 PROTOCOL_SSLv2
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	52 PROTOCOL_SSLv3
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	53 PROTOCOL_SSLv23
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	54 PROTOCOL_TLSv1
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	55 PROTOCOL_TLSv1_1
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	56 PROTOCOL_TLSv1_2
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	57
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	58 The following constants identify various SSL alert message descriptions as per
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	59 http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	60
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	61 ALERT_DESCRIPTION_CLOSE_NOTIFY
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	62 ALERT_DESCRIPTION_UNEXPECTED_MESSAGE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	63 ALERT_DESCRIPTION_BAD_RECORD_MAC
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	64 ALERT_DESCRIPTION_RECORD_OVERFLOW
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	65 ALERT_DESCRIPTION_DECOMPRESSION_FAILURE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	66 ALERT_DESCRIPTION_HANDSHAKE_FAILURE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	67 ALERT_DESCRIPTION_BAD_CERTIFICATE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	68 ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	69 ALERT_DESCRIPTION_CERTIFICATE_REVOKED
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	70 ALERT_DESCRIPTION_CERTIFICATE_EXPIRED
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	71 ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	72 ALERT_DESCRIPTION_ILLEGAL_PARAMETER
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	73 ALERT_DESCRIPTION_UNKNOWN_CA
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	74 ALERT_DESCRIPTION_ACCESS_DENIED
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	75 ALERT_DESCRIPTION_DECODE_ERROR
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	76 ALERT_DESCRIPTION_DECRYPT_ERROR
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	77 ALERT_DESCRIPTION_PROTOCOL_VERSION
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	78 ALERT_DESCRIPTION_INSUFFICIENT_SECURITY
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	79 ALERT_DESCRIPTION_INTERNAL_ERROR
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	80 ALERT_DESCRIPTION_USER_CANCELLED
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	81 ALERT_DESCRIPTION_NO_RENEGOTIATION
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	82 ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	83 ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	84 ALERT_DESCRIPTION_UNRECOGNIZED_NAME
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	85 ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	86 ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	87 ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	88 """
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	89
45468 1d84bf5f9478 Patch #2167 from calvin: Remove unused imports Christian Heimes <christian@cheimes.de> parents: 43375 diff changeset	90 import textwrap
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	91 import re
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84068 diff changeset	92 import sys
84068 a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	93 import os
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	94 from collections import namedtuple
87406 dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	95 from enum import Enum as _Enum
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	96
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	97 import _ssl # if we can't import it, let the error propagate
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	98
60372 664173984f2d Issue #8321: Give access to OpenSSL version numbers from the `ssl` module, Antoine Pitrou <solipsis@pitrou.net> parents: 59844 diff changeset	99 from _ssl import OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_INFO, OPENSSL_VERSION
73150 2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	100 from _ssl import _SSLContext
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	101 from _ssl import (
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	102 SSLError, SSLZeroReturnError, SSLWantReadError, SSLWantWriteError,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	103 SSLSyscallError, SSLEOFError,
2c4a9c778bb3 Issue #11183: Add finer-grained exceptions to the ssl module, so that Antoine Pitrou <solipsis@pitrou.net> parents: 72101 diff changeset	104 )
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	105 from _ssl import CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
87320 83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87214 diff changeset	106 from _ssl import (VERIFY_DEFAULT, VERIFY_CRL_CHECK_LEAF, VERIFY_CRL_CHECK_CHAIN,
83805c9d1f05 Issue #8813: Add SSLContext.verify_flags to change the verification flags Christian Heimes <christian@cheimes.de> parents: 87214 diff changeset	107 VERIFY_X509_STRICT)
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	108 from _ssl import txt2obj as _txt2obj, nid2obj as _nid2obj
70328 5c716437a83a Issue #12049: Add RAND_bytes() and RAND_pseudo_bytes() functions to the ssl Victor Stinner <victor.stinner@haypocalc.com> parents: 70188 diff changeset	109 from _ssl import RAND_status, RAND_egd, RAND_add, RAND_bytes, RAND_pseudo_bytes
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	110
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	111 def _import_symbols(prefix):
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	112 for n in dir(_ssl):
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	113 if n.startswith(prefix):
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	114 globals()[n] = getattr(_ssl, n)
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	115
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	116 _import_symbols('OP_')
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	117 _import_symbols('ALERT_DESCRIPTION_')
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	118 _import_symbols('SSL_ERROR_')
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	119
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	120 from _ssl import HAS_SNI, HAS_ECDH, HAS_NPN
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	121
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	122 from _ssl import PROTOCOL_SSLv3, PROTOCOL_SSLv23, PROTOCOL_TLSv1
71255 52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 70187 diff changeset	123 from _ssl import _OPENSSL_API_VERSION
52ed0c6bb461 Issue #12440: When testing whether some bits in SSLContext.options can be Antoine Pitrou <solipsis@pitrou.net> parents: 70187 diff changeset	124
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	125
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	126 _PROTOCOL_NAMES = {
3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	127 PROTOCOL_TLSv1: "TLSv1",
3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	128 PROTOCOL_SSLv23: "SSLv23",
3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	129 PROTOCOL_SSLv3: "SSLv3",
3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	130 }
3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	131 try:
3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	132 from _ssl import PROTOCOL_SSLv2
74252 f9122975fd80 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 70001 diff changeset	133 _SSLv2_IF_EXISTS = PROTOCOL_SSLv2
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	134 except ImportError:
74252 f9122975fd80 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 70001 diff changeset	135 _SSLv2_IF_EXISTS = None
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	136 else:
3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	137 _PROTOCOL_NAMES[PROTOCOL_SSLv2] = "SSLv2"
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	138
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	139 try:
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	140 from _ssl import PROTOCOL_TLSv1_1, PROTOCOL_TLSv1_2
84442 7769c4d72806 Issue #18200: Back out usage of ModuleNotFoundError (8d28d44f3a9a) Brett Cannon <brett@python.org> parents: 84114 diff changeset	141 except ImportError:
82992 02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	142 pass
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	143 else:
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	144 _PROTOCOL_NAMES[PROTOCOL_TLSv1_1] = "TLSv1.1"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	145 _PROTOCOL_NAMES[PROTOCOL_TLSv1_2] = "TLSv1.2"
02a89bd646ca Issue #16692: The ssl module now supports TLS 1.1 and TLS 1.2. Initial patch by Michele Orrù. Antoine Pitrou <solipsis@pitrou.net> parents: 81373 diff changeset	146
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84068 diff changeset	147 if sys.platform == "win32":
87330 9adcb61ea741 Issue #17134: Finalize interface to Windows' certificate store. Cert and Christian Heimes <christian@cheimes.de> parents: 87320 diff changeset	148 from _ssl import enum_certificates, enum_crls
84071 10d325f674f5 Issue #17134: Add ssl.enum_cert_store() as interface to Windows' cert store. Christian Heimes <christian@cheimes.de> parents: 84068 diff changeset	149
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	150 from socket import getnameinfo as _getnameinfo
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	151 from socket import SHUT_RDWR as _SHUT_RDWR
69673 d3166c359714 Issue #11811: ssl.get_server_certificate() is now IPv6-compatible. Patch Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	152 from socket import socket, AF_INET, SOCK_STREAM, create_connection
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	153 import base64 # for DER-to-PEM translation
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	154 import traceback
60986 860073505aca Merged revisions 80507 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60934 diff changeset	155 import errno
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	156
80933 50d19c2fac82 Issue #16717: get rid of socket.error, replace with OSError Andrew Svetlov <andrew.svetlov@gmail.com> parents: 80347 diff changeset	157
50d19c2fac82 Issue #16717: get rid of socket.error, replace with OSError Andrew Svetlov <andrew.svetlov@gmail.com> parents: 80347 diff changeset	158 socket_error = OSError # keep that public name in module namespace
50d19c2fac82 Issue #16717: get rid of socket.error, replace with OSError Andrew Svetlov <andrew.svetlov@gmail.com> parents: 80347 diff changeset	159
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	160 if _ssl.HAS_TLS_UNIQUE:
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	161 CHANNEL_BINDING_TYPES = ['tls-unique']
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	162 else:
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	163 CHANNEL_BINDING_TYPES = []
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	164
74252 f9122975fd80 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 70001 diff changeset	165 # Disable weak or insecure ciphers by default
f9122975fd80 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 70001 diff changeset	166 # (OpenSSL's default setting is 'DEFAULT:!aNULL:!eNULL')
f9122975fd80 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 70001 diff changeset	167 _DEFAULT_CIPHERS = 'DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2'
f9122975fd80 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 70001 diff changeset	168
87422 63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	169 # restricted and more secure ciphers
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	170 # HIGH: high encryption cipher suites with key length >= 128 bits (no MD5)
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	171 # !aNULL: only authenticated cipher suites (no anonymous DH)
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	172 # !RC4: no RC4 streaming cipher, RC4 is broken
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	173 # !DSS: RSA is preferred over DSA
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	174 _RESTRICTED_CIPHERS = 'HIGH:!aNULL:!RC4:!DSS'
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	175
74252 f9122975fd80 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 70001 diff changeset	176
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	177 class CertificateError(ValueError):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	178 pass
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	179
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	180
86676 10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	181 def _dnsname_match(dn, hostname, max_wildcards=1):
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	182 """Matching according to RFC 6125, section 6.4.3
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	183
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	184 http://tools.ietf.org/html/rfc6125#section-6.4.3
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	185 """
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	186 pats = []
86676 10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	187 if not dn:
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	188 return False
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	189
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	190 leftmost, *remainder = dn.split(r'.')
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	191
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	192 wildcards = leftmost.count('*')
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	193 if wildcards > max_wildcards:
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	194 # Issue #17980: avoid denials of service by refusing more
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	195 # than one wildcard per fragment. A survery of established
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	196 # policy among SSL implementations showed it to be a
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	197 # reasonable choice.
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	198 raise CertificateError(
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	199 "too many wildcards in certificate DNS name: " + repr(dn))
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	200
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	201 # speed up common case w/o wildcards
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	202 if not wildcards:
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	203 return dn.lower() == hostname.lower()
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	204
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	205 # RFC 6125, section 6.4.3, subitem 1.
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	206 # The client SHOULD NOT attempt to match a presented identifier in which
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	207 # the wildcard character comprises a label other than the left-most label.
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	208 if leftmost == '*':
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	209 # When '*' is a fragment by itself, it matches a non-empty dotless
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	210 # fragment.
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	211 pats.append('[^.]+')
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	212 elif leftmost.startswith('xn--') or hostname.startswith('xn--'):
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	213 # RFC 6125, section 6.4.3, subitem 3.
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	214 # The client SHOULD NOT attempt to match a presented identifier
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	215 # where the wildcard character is embedded within an A-label or
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	216 # U-label of an internationalized domain name.
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	217 pats.append(re.escape(leftmost))
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	218 else:
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	219 # Otherwise, '' matches any dotless string, e.g. www
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	220 pats.append(re.escape(leftmost).replace(r'\', '[^.]'))
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	221
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	222 # add the remaining fragments, ignore any wildcards
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	223 for frag in remainder:
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	224 pats.append(re.escape(frag))
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	225
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	226 pat = re.compile(r'\A' + r'\.'.join(pats) + r'\Z', re.IGNORECASE)
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	227 return pat.match(hostname)
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	228
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	229
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	230 def match_hostname(cert, hostname):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	231 """Verify that cert (in decoded format as returned by
86676 10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	232 SSLSocket.getpeercert()) matches the hostname. RFC 2818 and RFC 6125
10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	233 rules are followed, but IP addresses are not accepted for hostname.
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	234
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	235 CertificateError is raised on failure. On success, the function
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	236 returns nothing.
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	237 """
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	238 if not cert:
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	239 raise ValueError("empty or no certificate, match_hostname needs a "
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	240 "SSL socket or SSL context with either "
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	241 "CERT_OPTIONAL or CERT_REQUIRED")
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	242 dnsnames = []
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	243 san = cert.get('subjectAltName', ())
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	244 for key, value in san:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	245 if key == 'DNS':
86676 10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	246 if _dnsname_match(value, hostname):
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	247 return
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	248 dnsnames.append(value)
69874 d4c2a99d1bad Issue #12000: When a SSL certificate has a subjectAltName without any Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	249 if not dnsnames:
d4c2a99d1bad Issue #12000: When a SSL certificate has a subjectAltName without any Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	250 # The subject is only checked when there is no dNSName entry
d4c2a99d1bad Issue #12000: When a SSL certificate has a subjectAltName without any Antoine Pitrou <solipsis@pitrou.net> parents: 68257 diff changeset	251 # in subjectAltName
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	252 for sub in cert.get('subject', ()):
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	253 for key, value in sub:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	254 # XXX according to RFC 2818, the most specific Common Name
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	255 # must be used.
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	256 if key == 'commonName':
86676 10d0edadbcdd Issue #17997: Change behavior of ``ssl.match_hostname()`` to follow RFC 6125, Georg Brandl <georg@python.org> parents: 85305 diff changeset	257 if _dnsname_match(value, hostname):
65179 4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	258 return
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	259 dnsnames.append(value)
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	260 if len(dnsnames) > 1:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	261 raise CertificateError("hostname %r "
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	262 "doesn't match either of %s"
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	263 % (hostname, ', '.join(map(repr, dnsnames))))
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	264 elif len(dnsnames) == 1:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	265 raise CertificateError("hostname %r "
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	266 "doesn't match %r"
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	267 % (hostname, dnsnames[0]))
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	268 else:
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	269 raise CertificateError("no appropriate commonName or "
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	270 "subjectAltName fields were found")
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	271
4c98eeff37e7 Issue #1589: Add ssl.match_hostname(), to help implement server identity Antoine Pitrou <solipsis@pitrou.net> parents: 64741 diff changeset	272
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	273 DefaultVerifyPaths = namedtuple("DefaultVerifyPaths",
84068 a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	274 "cafile capath openssl_cafile_env openssl_cafile openssl_capath_env "
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	275 "openssl_capath")
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	276
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	277 def get_default_verify_paths():
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	278 """Return paths to default cafile and capath.
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	279 """
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	280 parts = _ssl.get_default_verify_paths()
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	281
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	282 # environment vars shadow paths
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	283 cafile = os.environ.get(parts[0], parts[1])
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	284 capath = os.environ.get(parts[2], parts[3])
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	285
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	286 return DefaultVerifyPaths(cafile if os.path.isfile(cafile) else None,
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	287 capath if os.path.isdir(capath) else None,
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	288 *parts)
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	289
a4d31e56075d Issue #18143: Implement ssl.get_default_verify_paths() in order to debug Christian Heimes <christian@cheimes.de> parents: 83828 diff changeset	290
87214 f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	291 class _ASN1Object(namedtuple("_ASN1Object", "nid shortname longname oid")):
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	292 """ASN.1 object identifier lookup
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	293 """
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	294 __slots__ = ()
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	295
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	296 def __new__(cls, oid):
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	297 return super().__new__(cls, *_txt2obj(oid, name=False))
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	298
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	299 @classmethod
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	300 def fromnid(cls, nid):
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	301 """Create _ASN1Object from OpenSSL numeric ID
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	302 """
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	303 return super().__new__(cls, *_nid2obj(nid))
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	304
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	305 @classmethod
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	306 def fromname(cls, name):
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	307 """Create _ASN1Object from short name, long name or OID
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	308 """
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	309 return super().__new__(cls, *_txt2obj(name, name=True))
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	310
f43f65038e2a Issue #19448: Add private API to SSL module to lookup ASN.1 objects by OID, NID, short name and long name. Christian Heimes <christian@cheimes.de> parents: 86681 diff changeset	311
87406 dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	312 class Purpose(_ASN1Object, _Enum):
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	313 """SSLContext purpose flags with X509v3 Extended Key Usage objects
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	314 """
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	315 SERVER_AUTH = '1.3.6.1.5.5.7.3.1'
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	316 CLIENT_AUTH = '1.3.6.1.5.5.7.3.2'
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	317
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	318
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	319 class SSLContext(_SSLContext):
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	320 """An SSLContext holds various SSL-related configuration options and
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	321 data, such as certificates and possibly a private key."""
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	322
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	323 __slots__ = ('protocol', '__weakref__')
87406 dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	324 _windows_cert_stores = ("CA", "ROOT")
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	325
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	326 def __new__(cls, protocol, args, *kwargs):
74248 25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	327 self = _SSLContext.__new__(cls, protocol)
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	328 if protocol != _SSLv2_IF_EXISTS:
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	329 self.set_ciphers(_DEFAULT_CIPHERS)
25c2d24e1b11 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 71255 diff changeset	330 return self
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	331
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	332 def __init__(self, protocol):
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	333 self.protocol = protocol
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	334
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	335 def wrap_socket(self, sock, server_side=False,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	336 do_handshake_on_connect=True,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	337 suppress_ragged_eofs=True,
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	338 server_hostname=None):
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	339 return SSLSocket(sock=sock, server_side=server_side,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	340 do_handshake_on_connect=do_handshake_on_connect,
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	341 suppress_ragged_eofs=suppress_ragged_eofs,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	342 server_hostname=server_hostname,
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	343 _context=self)
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	344
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	345 def set_npn_protocols(self, npn_protocols):
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	346 protos = bytearray()
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	347 for protocol in npn_protocols:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	348 b = bytes(protocol, 'ascii')
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	349 if len(b) == 0 or len(b) > 255:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	350 raise SSLError('NPN protocols must be 1 to 255 in length')
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	351 protos.append(len(b))
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	352 protos.extend(b)
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	353
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	354 self._set_npn_protocols(protos)
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	355
87406 dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	356 def _load_windows_store_certs(self, storename, purpose):
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	357 certs = bytearray()
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	358 for cert, encoding, trust in enum_certificates(storename):
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	359 # CA certs are never PKCS#7 encoded
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	360 if encoding == "x509_asn":
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	361 if trust is True or purpose.oid in trust:
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	362 certs.extend(cert)
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	363 self.load_verify_locations(cadata=certs)
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	364 return certs
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	365
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	366 def load_default_certs(self, purpose=Purpose.SERVER_AUTH):
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	367 if not isinstance(purpose, _ASN1Object):
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	368 raise TypeError(purpose)
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	369 if sys.platform == "win32":
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	370 for storename in self._windows_cert_stores:
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	371 self._load_windows_store_certs(storename, purpose)
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	372 else:
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	373 self.set_default_verify_paths()
dfd33140a2b5 Issue #19292: Add SSLContext.load_default_certs() to load default root CA Christian Heimes <christian@cheimes.de> parents: 87330 diff changeset	374
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	375
87422 63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	376 def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	377 capath=None, cadata=None):
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	378 """Create a SSLContext object with default settings.
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	379
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	380 NOTE: The protocol and settings may change anytime without prior
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	381 deprecation. The values represent a fair balance between maximum
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	382 compatibility and security.
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	383 """
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	384 if not isinstance(purpose, _ASN1Object):
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	385 raise TypeError(purpose)
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	386 context = SSLContext(PROTOCOL_TLSv1)
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	387 # SSLv2 considered harmful.
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	388 context.options \|= OP_NO_SSLv2
87622 98eb88d3d94e ssl.create_default_context() sets OP_NO_COMPRESSION to prevent CRIME Christian Heimes <christian@cheimes.de> parents: 87463 diff changeset	389 # disable compression to prevent CRIME attacks (OpenSSL 1.0+)
98eb88d3d94e ssl.create_default_context() sets OP_NO_COMPRESSION to prevent CRIME Christian Heimes <christian@cheimes.de> parents: 87463 diff changeset	390 context.options \|= getattr(_ssl, "OP_NO_COMPRESSION", 0)
87422 63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	391 # disallow ciphers with known vulnerabilities
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	392 context.set_ciphers(_RESTRICTED_CIPHERS)
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	393 # verify certs and host name in client mode
87422 63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	394 if purpose == Purpose.SERVER_AUTH:
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	395 context.verify_mode = CERT_REQUIRED
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	396 context.check_hostname = True
87422 63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	397 if cafile or capath or cadata:
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	398 context.load_verify_locations(cafile, capath, cadata)
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	399 elif context.verify_mode != CERT_NONE:
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	400 # no explicit cafile, capath or cadata but the verify mode is
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	401 # CERT_OPTIONAL or CERT_REQUIRED. Let's try to load default system
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	402 # root CA certificates for the given purpose. This may fail silently.
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	403 context.load_default_certs(purpose)
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	404 return context
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	405
63df21e74c65 Issue #19689: Add ssl.create_default_context() factory function. It creates Christian Heimes <christian@cheimes.de> parents: 87406 diff changeset	406
87463 03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	407 def _create_stdlib_context(protocol=PROTOCOL_SSLv23, *, cert_reqs=None,
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	408 purpose=Purpose.SERVER_AUTH,
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	409 certfile=None, keyfile=None,
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	410 cafile=None, capath=None, cadata=None):
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	411 """Create a SSLContext object for Python stdlib modules
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	412
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	413 All Python stdlib modules shall use this function to create SSLContext
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	414 objects in order to keep common settings in one place. The configuration
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	415 is less restrict than create_default_context()'s to increase backward
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	416 compatibility.
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	417 """
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	418 if not isinstance(purpose, _ASN1Object):
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	419 raise TypeError(purpose)
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	420
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	421 context = SSLContext(protocol)
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	422 # SSLv2 considered harmful.
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	423 context.options \|= OP_NO_SSLv2
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	424
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	425 if cert_reqs is not None:
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	426 context.verify_mode = cert_reqs
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	427
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	428 if keyfile and not certfile:
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	429 raise ValueError("certfile must be specified")
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	430 if certfile or keyfile:
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	431 context.load_cert_chain(certfile, keyfile)
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	432
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	433 # load CA root certs
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	434 if cafile or capath or cadata:
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	435 context.load_verify_locations(cafile, capath, cadata)
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	436 elif context.verify_mode != CERT_NONE:
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	437 # no explicit cafile, capath or cadata but the verify mode is
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	438 # CERT_OPTIONAL or CERT_REQUIRED. Let's try to load default system
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	439 # root CA certificates for the given purpose. This may fail silently.
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	440 context.load_default_certs(purpose)
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	441
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	442 return context
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	443
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	444 class SSLSocket(socket):
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	445 """This class implements a subtype of socket.socket that wraps
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	446 the underlying OS socket in an SSL context when necessary, and
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	447 provides read and write methods over that channel."""
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	448
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	449 def __init__(self, sock=None, keyfile=None, certfile=None,
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	450 server_side=False, cert_reqs=CERT_NONE,
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	451 ssl_version=PROTOCOL_SSLv23, ca_certs=None,
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	452 do_handshake_on_connect=True,
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	453 family=AF_INET, type=SOCK_STREAM, proto=0, fileno=None,
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	454 suppress_ragged_eofs=True, npn_protocols=None, ciphers=None,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	455 server_hostname=None,
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	456 _context=None):
74252 f9122975fd80 Issue #13636: Weak ciphers are now disabled by default in the ssl module Antoine Pitrou <solipsis@pitrou.net> parents: 70001 diff changeset	457
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	458 if _context:
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	459 self._context = _context
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	460 else:
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	461 if server_side and not certfile:
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	462 raise ValueError("certfile must be specified for server-side "
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	463 "operations")
64324 84883607e21a Fix issue #9711: raise ValueError is SSLConnection constructor is invoked with keyfile and not certfile. Giampaolo Rodolà <g.rodola@gmail.com> parents: 64306 diff changeset	464 if keyfile and not certfile:
84883607e21a Fix issue #9711: raise ValueError is SSLConnection constructor is invoked with keyfile and not certfile. Giampaolo Rodolà <g.rodola@gmail.com> parents: 64306 diff changeset	465 raise ValueError("certfile must be specified")
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	466 if certfile and not keyfile:
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	467 keyfile = certfile
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	468 self._context = SSLContext(ssl_version)
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	469 self._context.verify_mode = cert_reqs
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	470 if ca_certs:
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	471 self._context.load_verify_locations(ca_certs)
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	472 if certfile:
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	473 self._context.load_cert_chain(certfile, keyfile)
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	474 if npn_protocols:
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	475 self._context.set_npn_protocols(npn_protocols)
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	476 if ciphers:
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	477 self._context.set_ciphers(ciphers)
61635 4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	478 self.keyfile = keyfile
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	479 self.certfile = certfile
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	480 self.cert_reqs = cert_reqs
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	481 self.ssl_version = ssl_version
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	482 self.ca_certs = ca_certs
4bb03cc1d421 Issue #8550: Add first class `SSLContext` objects to the ssl module. Antoine Pitrou <solipsis@pitrou.net> parents: 60992 diff changeset	483 self.ciphers = ciphers
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	484 if server_side and server_hostname:
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	485 raise ValueError("server_hostname can only be specified "
846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	486 "in client mode")
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	487 if self._context.check_hostname and not server_hostname:
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	488 if HAS_SNI:
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	489 raise ValueError("check_hostname requires server_hostname")
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	490 else:
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	491 raise ValueError("check_hostname requires server_hostname, "
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	492 "but it's not supported by your OpenSSL "
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	493 "library")
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	494 self.server_side = server_side
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	495 self.server_hostname = server_hostname
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	496 self.do_handshake_on_connect = do_handshake_on_connect
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	497 self.suppress_ragged_eofs = suppress_ragged_eofs
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	498 if sock is not None:
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	499 socket.__init__(self,
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	500 family=sock.family,
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	501 type=sock.type,
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	502 proto=sock.proto,
63856 3f8cef837f07 Issue #8524: Add a forget() method to socket objects, so as to put the Antoine Pitrou <solipsis@pitrou.net> parents: 61782 diff changeset	503 fileno=sock.fileno())
60938 0ff8adde609c Merged revisions 80456 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 59907 diff changeset	504 self.settimeout(sock.gettimeout())
63890 60076f28c023 Followup to r83869 and issue #8524: rename socket.forget() to socket.detach() Antoine Pitrou <solipsis@pitrou.net> parents: 63856 diff changeset	505 sock.detach()
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	506 elif fileno is not None:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	507 socket.__init__(self, fileno=fileno)
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	508 else:
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	509 socket.__init__(self, family=family, type=type, proto=proto)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	510
83588 e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	511 # See if we are connected
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	512 try:
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	513 self.getpeername()
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	514 except OSError as e:
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	515 if e.errno != errno.ENOTCONN:
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	516 raise
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	517 connected = False
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	518 else:
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	519 connected = True
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	520
60991 d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	521 self._closed = False
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	522 self._sslobj = None
68186 1909c12ef06c Issue #11326: Add the missing connect_ex() implementation for SSL sockets, Antoine Pitrou <solipsis@pitrou.net> parents: 65593 diff changeset	523 self._connected = connected
60991 d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	524 if connected:
d5590a987cb0 Merged revisions 80515 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60988 diff changeset	525 # create the SSL object
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	526 try:
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	527 self._sslobj = self._context._wrap_socket(self, server_side,
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	528 server_hostname)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	529 if do_handshake_on_connect:
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	530 timeout = self.gettimeout()
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	531 if timeout == 0.0:
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	532 # non-blocking
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	533 raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	534 self.do_handshake()
43056 3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	535
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	536 except (OSError, ValueError):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	537 self.close()
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	538 raise
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	539
81298 927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	540 @property
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	541 def context(self):
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	542 return self._context
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	543
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	544 @context.setter
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	545 def context(self, ctx):
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	546 self._context = ctx
927afb7bca2a Issue #8109: The ssl module now has support for server-side SNI, thanks to a :meth:`SSLContext.set_servername_callback` method. Antoine Pitrou <solipsis@pitrou.net> parents: 81131 diff changeset	547 self._sslobj.context = ctx
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	548
43882 f6cca4b2260c Disable dup() of SSLSocket. I don't think it can be made to work. Guido van Rossum <guido@python.org> parents: 43881 diff changeset	549 def dup(self):
f6cca4b2260c Disable dup() of SSLSocket. I don't think it can be made to work. Guido van Rossum <guido@python.org> parents: 43881 diff changeset	550 raise NotImplemented("Can't dup() %s instances" %
f6cca4b2260c Disable dup() of SSLSocket. I don't think it can be made to work. Guido van Rossum <guido@python.org> parents: 43881 diff changeset	551 self.__class__.__name__)
f6cca4b2260c Disable dup() of SSLSocket. I don't think it can be made to work. Guido van Rossum <guido@python.org> parents: 43881 diff changeset	552
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	553 def _checkClosed(self, msg=None):
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	554 # raise an exception here if you wish to check for spurious closes
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	555 pass
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	556
83588 e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	557 def _check_connected(self):
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	558 if not self._connected:
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	559 # getpeername() will raise ENOTCONN if the socket is really
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	560 # not connected; note that we can be connected even without
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	561 # _connected being set, e.g. if connect() first returned
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	562 # EAGAIN.
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	563 self.getpeername()
e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	564
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	565 def read(self, len=0, buffer=None):
43056 3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	566 """Read up to LEN bytes and return them.
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	567 Return zero-length string on EOF."""
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	568
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	569 self._checkClosed()
84738 eda7e86bf03c Issue #9177: Calling read() or write() now raises ValueError, not AttributeError, on a closed SSL socket. Antoine Pitrou <solipsis@pitrou.net> parents: 84442 diff changeset	570 if not self._sslobj:
eda7e86bf03c Issue #9177: Calling read() or write() now raises ValueError, not AttributeError, on a closed SSL socket. Antoine Pitrou <solipsis@pitrou.net> parents: 84442 diff changeset	571 raise ValueError("Read on closed or unwrapped SSL socket.")
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	572 try:
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60993 diff changeset	573 if buffer is not None:
988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60993 diff changeset	574 v = self._sslobj.read(len, buffer)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	575 else:
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	576 v = self._sslobj.read(len or 1024)
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	577 return v
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	578 except SSLError as x:
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	579 if x.args[0] == SSL_ERROR_EOF and self.suppress_ragged_eofs:
64404 988718e9f93d Merged revisions 84464 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 60993 diff changeset	580 if buffer is not None:
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	581 return 0
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	582 else:
19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	583 return b''
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	584 else:
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	585 raise
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	586
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	587 def write(self, data):
43056 3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	588 """Write DATA to the underlying SSL channel. Returns
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	589 number of bytes of DATA actually transmitted."""
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	590
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	591 self._checkClosed()
84738 eda7e86bf03c Issue #9177: Calling read() or write() now raises ValueError, not AttributeError, on a closed SSL socket. Antoine Pitrou <solipsis@pitrou.net> parents: 84442 diff changeset	592 if not self._sslobj:
eda7e86bf03c Issue #9177: Calling read() or write() now raises ValueError, not AttributeError, on a closed SSL socket. Antoine Pitrou <solipsis@pitrou.net> parents: 84442 diff changeset	593 raise ValueError("Write on closed or unwrapped SSL socket.")
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	594 return self._sslobj.write(data)
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	595
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	596 def getpeercert(self, binary_form=False):
43056 3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	597 """Returns a formatted version of the data in the
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	598 certificate provided by the other end of the SSL channel.
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	599 Return None if no certificate was provided, {} if a
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	600 certificate was provided, but not validated."""
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	601
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	602 self._checkClosed()
83588 e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	603 self._check_connected()
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	604 return self._sslobj.peer_certificate(binary_form)
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	605
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	606 def selected_npn_protocol(self):
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	607 self._checkClosed()
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	608 if not self._sslobj or not _ssl.HAS_NPN:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	609 return None
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	610 else:
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	611 return self._sslobj.selected_npn_protocol()
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	612
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	613 def cipher(self):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	614 self._checkClosed()
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	615 if not self._sslobj:
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	616 return None
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	617 else:
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	618 return self._sslobj.cipher()
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	619
74091 20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	620 def compression(self):
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	621 self._checkClosed()
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	622 if not self._sslobj:
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	623 return None
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	624 else:
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	625 return self._sslobj.compression()
20b52be99b5d Issue #13634: Add support for querying and disabling SSL compression. Antoine Pitrou <solipsis@pitrou.net> parents: 74084 diff changeset	626
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	627 def send(self, data, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	628 self._checkClosed()
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	629 if self._sslobj:
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	630 if flags != 0:
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	631 raise ValueError(
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	632 "non-zero flags not allowed in calls to send() on %s" %
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	633 self.__class__)
83075 660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	634 try:
660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	635 v = self._sslobj.write(data)
660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	636 except SSLError as x:
660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	637 if x.args[0] == SSL_ERROR_WANT_READ:
660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	638 return 0
660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	639 elif x.args[0] == SSL_ERROR_WANT_WRITE:
660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	640 return 0
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	641 else:
83075 660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	642 raise
660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	643 else:
660d6a4bfce9 remove uneffective 'while True' clause Giampaolo Rodola' <g.rodola@gmail.com> parents: 82992 diff changeset	644 return v
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	645 else:
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	646 return socket.send(self, data, flags)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	647
64740 7f99ac53014a Issue #9729: Fix the signature of SSLSocket.recvfrom() and Antoine Pitrou <solipsis@pitrou.net> parents: 61032 diff changeset	648 def sendto(self, data, flags_or_addr, addr=None):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	649 self._checkClosed()
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	650 if self._sslobj:
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	651 raise ValueError("sendto not allowed on instances of %s" %
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	652 self.__class__)
64740 7f99ac53014a Issue #9729: Fix the signature of SSLSocket.recvfrom() and Antoine Pitrou <solipsis@pitrou.net> parents: 61032 diff changeset	653 elif addr is None:
64743 80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	654 return socket.sendto(self, data, flags_or_addr)
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	655 else:
64743 80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	656 return socket.sendto(self, data, flags_or_addr, addr)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	657
72101 b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	658 def sendmsg(self, args, *kwargs):
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	659 # Ensure programs don't send data unencrypted if they try to
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	660 # use this method.
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	661 raise NotImplementedError("sendmsg not allowed on instances of %s" %
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	662 self.__class__)
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	663
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	664 def sendall(self, data, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	665 self._checkClosed()
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	666 if self._sslobj:
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	667 if flags != 0:
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	668 raise ValueError(
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	669 "non-zero flags not allowed in calls to sendall() on %s" %
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	670 self.__class__)
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	671 amount = len(data)
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	672 count = 0
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	673 while (count < amount):
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	674 v = self.send(data[count:])
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	675 count += v
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	676 return amount
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	677 else:
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	678 return socket.sendall(self, data, flags)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	679
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	680 def recv(self, buflen=1024, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	681 self._checkClosed()
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	682 if self._sslobj:
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	683 if flags != 0:
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	684 raise ValueError(
59908 7f435c385da2 Merged revisions 79226 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 58407 diff changeset	685 "non-zero flags not allowed in calls to recv() on %s" %
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	686 self.__class__)
59908 7f435c385da2 Merged revisions 79226 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 58407 diff changeset	687 return self.read(buflen)
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	688 else:
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	689 return socket.recv(self, buflen, flags)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	690
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	691 def recv_into(self, buffer, nbytes=None, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	692 self._checkClosed()
49089 37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	693 if buffer and (nbytes is None):
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	694 nbytes = len(buffer)
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	695 elif nbytes is None:
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	696 nbytes = 1024
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	697 if self._sslobj:
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	698 if flags != 0:
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	699 raise ValueError(
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	700 "non-zero flags not allowed in calls to recv_into() on %s" %
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	701 self.__class__)
59907 9fbe2370dc02 Merged revisions 79287,79289 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 58408 diff changeset	702 return self.read(nbytes, buffer)
49089 37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	703 else:
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	704 return socket.recv_into(self, buffer, nbytes, flags)
49089 37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	705
64740 7f99ac53014a Issue #9729: Fix the signature of SSLSocket.recvfrom() and Antoine Pitrou <solipsis@pitrou.net> parents: 61032 diff changeset	706 def recvfrom(self, buflen=1024, flags=0):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	707 self._checkClosed()
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	708 if self._sslobj:
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	709 raise ValueError("recvfrom not allowed on instances of %s" %
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	710 self.__class__)
4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	711 else:
64743 80d1c7734df2 Merged revisions 84807 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64404 diff changeset	712 return socket.recvfrom(self, buflen, flags)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	713
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	714 def recvfrom_into(self, buffer, nbytes=None, flags=0):
49090 ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	715 self._checkClosed()
49089 37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	716 if self._sslobj:
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	717 raise ValueError("recvfrom_into not allowed on instances of %s" %
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	718 self.__class__)
37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	719 else:
49090 ac3b67043361 fixes from issue 3162 for SSL module Bill Janssen <janssen@parc.com> parents: 48681 diff changeset	720 return socket.recvfrom_into(self, buffer, nbytes, flags)
49089 37b70cd4a0f0 incorporate fixes from issue 3162; SSL doc patch Bill Janssen <janssen@parc.com> parents: 48222 diff changeset	721
72101 b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	722 def recvmsg(self, args, *kwargs):
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	723 raise NotImplementedError("recvmsg not allowed on instances of %s" %
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	724 self.__class__)
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	725
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	726 def recvmsg_into(self, args, *kwargs):
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	727 raise NotImplementedError("recvmsg_into not allowed on instances of "
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	728 "%s" % self.__class__)
b06f011a3529 Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson) Nick Coghlan <ncoghlan@gmail.com> parents: 72046 diff changeset	729
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	730 def pending(self):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	731 self._checkClosed()
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	732 if self._sslobj:
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	733 return self._sslobj.pending()
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	734 else:
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	735 return 0
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	736
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	737 def shutdown(self, how):
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	738 self._checkClosed()
43400 1bac386c17cc Merged revisions 58095-58132,58136-58148,58151-58197 via svnmerge from Thomas Wouters <thomas@python.org> parents: 43095 diff changeset	739 self._sslobj = None
43095 4a07a288f5c4 Merged revisions 57620-57771 via svnmerge from Thomas Wouters <thomas@python.org> parents: 42974 diff changeset	740 socket.shutdown(self, how)
42954 27f0289b6835 Merge the trunk changes in. Breaks socket.ssl for now. Thomas Wouters <thomas@python.org> parents: diff changeset	741
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	742 def unwrap(self):
48222 79fa3e0c0988 remove duplicate close() from ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 47848 diff changeset	743 if self._sslobj:
79fa3e0c0988 remove duplicate close() from ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 47848 diff changeset	744 s = self._sslobj.shutdown()
79fa3e0c0988 remove duplicate close() from ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 47848 diff changeset	745 self._sslobj = None
79fa3e0c0988 remove duplicate close() from ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 47848 diff changeset	746 return s
79fa3e0c0988 remove duplicate close() from ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 47848 diff changeset	747 else:
79fa3e0c0988 remove duplicate close() from ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 47848 diff changeset	748 raise ValueError("No SSL wrapper around " + str(self))
79fa3e0c0988 remove duplicate close() from ssl.py; expose unwrap and add test for it Bill Janssen <janssen@parc.com> parents: 47848 diff changeset	749
43875 e20203d0331c Fix some minor style nits. (I'll leave adding __all__ and making the Guido van Rossum <guido@python.org> parents: 43869 diff changeset	750 def _real_close(self):
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	751 self._sslobj = None
44305 19f894ae864a update to fix leak in SSL code Bill Janssen <janssen@parc.com> parents: 44206 diff changeset	752 socket._real_close(self)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	753
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	754 def do_handshake(self, block=False):
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	755 """Perform a TLS/SSL handshake."""
83588 e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	756 self._check_connected()
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	757 timeout = self.gettimeout()
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	758 try:
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	759 if timeout == 0.0 and block:
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	760 self.settimeout(None)
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	761 self._sslobj.do_handshake()
44161 1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	762 finally:
1a7dfb61b4d8 most recent changes to SSL module to support non-blocking sockets properly Bill Janssen <janssen@parc.com> parents: 43882 diff changeset	763 self.settimeout(timeout)
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	764
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	765 if self.context.check_hostname:
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	766 try:
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	767 if not self.server_hostname:
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	768 raise ValueError("check_hostname needs server_hostname "
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	769 "argument")
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	770 match_hostname(self.getpeercert(), self.server_hostname)
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	771 except Exception:
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	772 self.shutdown(_SHUT_RDWR)
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	773 self.close()
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	774 raise
aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	775
70187 019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	776 def _real_connect(self, addr, connect_ex):
64306 9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	777 if self.server_side:
9297974604ff Fix issue issue9706: provides a better error handling for various SSL operations Giampaolo Rodolà <g.rodola@gmail.com> parents: 64305 diff changeset	778 raise ValueError("can't connect in server-side mode")
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	779 # Here we assume that the socket is client-side, and not
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	780 # connected at the time of the call. We connect it, then wrap it.
68047 742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	781 if self._connected:
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	782 raise ValueError("attempt to connect already-connected SSLSocket!")
65593 846c0e1342d0 Issue #5639: Add a server_hostname argument to `SSLContext.wrap_socket` Antoine Pitrou <solipsis@pitrou.net> parents: 65179 diff changeset	783 self._sslobj = self.context._wrap_socket(self, False, self.server_hostname)
68047 742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	784 try:
70187 019d8ccdf03b Issue #12065: connect_ex() on an SSL socket now returns the original errno Antoine Pitrou <solipsis@pitrou.net> parents: 69998 diff changeset	785 if connect_ex:
81128 3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	786 rc = socket.connect_ex(self, addr)
68047 742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	787 else:
81128 3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	788 rc = None
3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	789 socket.connect(self, addr)
3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	790 if not rc:
83588 e6b962fa44bb Issue #13721: SSLSocket.getpeercert() and SSLSocket.do_handshake() now raise an OSError with ENOTCONN, instead of an AttributeError, when the SSLSocket is not connected. Antoine Pitrou <solipsis@pitrou.net> parents: 83075 diff changeset	791 self._connected = True
81128 3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	792 if self.do_handshake_on_connect:
3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	793 self.do_handshake()
3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	794 return rc
87688 aa531135bc6b Issue #19509: Add SSLContext.check_hostname to match the peer's certificate Christian Heimes <christian@cheimes.de> parents: 87622 diff changeset	795 except (OSError, ValueError):
81128 3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	796 self._sslobj = None
3436769a7964 Backport Python 3.2 fix for issue #12065, and add another test for SSLSocket.connect_ex(). Antoine Pitrou <solipsis@pitrou.net> parents: 74252 diff changeset	797 raise
68047 742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	798
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	799 def connect(self, addr):
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	800 """Connects to remote ADDR, and then wraps the connection in
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	801 an SSL channel."""
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	802 self._real_connect(addr, False)
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	803
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	804 def connect_ex(self, addr):
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	805 """Connects to remote ADDR, and then wraps the connection in
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	806 an SSL channel."""
742d73a99425 Merged revisions 88664 via svnmerge from Antoine Pitrou <solipsis@pitrou.net> parents: 64740 diff changeset	807 return self._real_connect(addr, True)
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	808
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	809 def accept(self):
43056 3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	810 """Accepts a new connection from a remote client, and returns
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	811 a tuple containing that new connection wrapped with a server-side
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	812 SSL channel, and the address of the remote client."""
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	813
43008 4771639fc049 This contains a number of things: Bill Janssen <janssen@parc.com> parents: 42868 diff changeset	814 newsock, addr = socket.accept(self)
80346 f475332df9b5 Issue #16357: fix calling accept() on a SSLSocket created through SSLContext.wrap_socket(). Antoine Pitrou <solipsis@pitrou.net> parents: 74248 diff changeset	815 newsock = self.context.wrap_socket(newsock,
f475332df9b5 Issue #16357: fix calling accept() on a SSLSocket created through SSLContext.wrap_socket(). Antoine Pitrou <solipsis@pitrou.net> parents: 74248 diff changeset	816 do_handshake_on_connect=self.do_handshake_on_connect,
f475332df9b5 Issue #16357: fix calling accept() on a SSLSocket created through SSLContext.wrap_socket(). Antoine Pitrou <solipsis@pitrou.net> parents: 74248 diff changeset	817 suppress_ragged_eofs=self.suppress_ragged_eofs,
f475332df9b5 Issue #16357: fix calling accept() on a SSLSocket created through SSLContext.wrap_socket(). Antoine Pitrou <solipsis@pitrou.net> parents: 74248 diff changeset	818 server_side=True)
f475332df9b5 Issue #16357: fix calling accept() on a SSLSocket created through SSLContext.wrap_socket(). Antoine Pitrou <solipsis@pitrou.net> parents: 74248 diff changeset	819 return newsock, addr
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	820
71440 cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	821 def get_channel_binding(self, cb_type="tls-unique"):
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	822 """Get channel binding data for current connection. Raise ValueError
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	823 if the requested `cb_type` is not supported. Return bytes of the data
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	824 or None if the data is not available (e.g. before the handshake).
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	825 """
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	826 if cb_type not in CHANNEL_BINDING_TYPES:
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	827 raise ValueError("Unsupported channel binding type")
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	828 if cb_type != "tls-unique":
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	829 raise NotImplementedError(
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	830 "{0} channel binding type not implemented"
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	831 .format(cb_type))
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	832 if self._sslobj is None:
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	833 return None
cb44fef5ea1d Issue #12551: Provide a get_channel_binding() method on SSL sockets so as Antoine Pitrou <solipsis@pitrou.net> parents: 71256 diff changeset	834 return self._sslobj.tls_unique_cb()
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	835
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	836
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	837 def wrap_socket(sock, keyfile=None, certfile=None,
193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	838 server_side=False, cert_reqs=CERT_NONE,
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	839 ssl_version=PROTOCOL_SSLv23, ca_certs=None,
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	840 do_handshake_on_connect=True,
75865 2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	841 suppress_ragged_eofs=True,
2514a4e2b3ce Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library. Antoine Pitrou <solipsis@pitrou.net> parents: 75005 diff changeset	842 ciphers=None):
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	843
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	844 return SSLSocket(sock=sock, keyfile=keyfile, certfile=certfile,
43325 193020bf52dc More work on SSL support. Bill Janssen <janssen@parc.com> parents: 43056 diff changeset	845 server_side=server_side, cert_reqs=cert_reqs,
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	846 ssl_version=ssl_version, ca_certs=ca_certs,
8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	847 do_handshake_on_connect=do_handshake_on_connect,
60659 7462e752f0fa Issue #8322: Add a ciphers argument to SSL sockets, so as to change the Antoine Pitrou <solipsis@pitrou.net> parents: 60372 diff changeset	848 suppress_ragged_eofs=suppress_ragged_eofs,
7462e752f0fa Issue #8322: Add a ciphers argument to SSL sockets, so as to change the Antoine Pitrou <solipsis@pitrou.net> parents: 60372 diff changeset	849 ciphers=ciphers)
47848 8a281bfc058d various SSL fixes; issues 1251, 3162, 3212 Bill Janssen <janssen@parc.com> parents: 45468 diff changeset	850
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	851 # some utility functions
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	852
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	853 def cert_time_to_seconds(cert_time):
43056 3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	854 """Takes a date-time string in standard ASN1_print form
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	855 ("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	856 a Python time value in seconds past the epoch."""
3bf1b8b34080 Added docstrings to methods and functions. Bill Janssen <janssen@parc.com> parents: 43008 diff changeset	857
42828 08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	858 import time
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	859 return time.mktime(time.strptime(cert_time, "%b %d %H:%M:%S %Y GMT"))
08b6278aa1f4 Server-side SSL and certificate validation, by Bill Janssen. Guido van Rossum <guido@python.org> parents: diff changeset	860
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	861 PEM_HEADER = "-----BEGIN CERTIFICATE-----"
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	862 PEM_FOOTER = "-----END CERTIFICATE-----"
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	863
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	864 def DER_cert_to_PEM_cert(der_cert_bytes):
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	865 """Takes a certificate in binary DER format and returns the
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	866 PEM version of it as a string."""
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	867
43869 b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	868 f = str(base64.standard_b64encode(der_cert_bytes), 'ASCII', 'strict')
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	869 return (PEM_HEADER + '\n' +
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	870 textwrap.fill(f, 64) + '\n' +
b59825d9db8f get SSL support to work again Bill Janssen <janssen@parc.com> parents: 43400 diff changeset	871 PEM_FOOTER + '\n')
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	872
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	873 def PEM_cert_to_DER_cert(pem_cert_string):
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	874 """Takes a certificate in ASCII PEM format and returns the
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	875 DER-encoded version of it as a byte sequence"""
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	876
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	877 if not pem_cert_string.startswith(PEM_HEADER):
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	878 raise ValueError("Invalid PEM encoding; must start with %s"
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	879 % PEM_HEADER)
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	880 if not pem_cert_string.strip().endswith(PEM_FOOTER):
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	881 raise ValueError("Invalid PEM encoding; must end with %s"
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	882 % PEM_FOOTER)
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	883 d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]
54568 031b963f2bc2 More codestring -> codebytes. Georg Brandl <georg@python.org> parents: 50390 diff changeset	884 return base64.decodebytes(d.encode('ASCII', 'strict'))
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	885
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	886 def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None):
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	887 """Retrieve the certificate from the server at the specified address,
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	888 and return it as a PEM-encoded string.
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	889 If 'ca_certs' is specified, validate the server cert against it.
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	890 If 'ssl_version' is specified, use it in the connection attempt."""
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	891
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	892 host, port = addr
87463 03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	893 if ca_certs is not None:
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	894 cert_reqs = CERT_REQUIRED
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	895 else:
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	896 cert_reqs = CERT_NONE
87463 03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	897 context = _create_stdlib_context(ssl_version,
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	898 cert_reqs=cert_reqs,
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	899 cafile=ca_certs)
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	900 with create_connection(addr) as sock:
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	901 with context.wrap_socket(sock) as sslsock:
03cc1b55faae Issue #19735: Implement private function ssl._create_stdlib_context() to Christian Heimes <christian@cheimes.de> parents: 87422 diff changeset	902 dercert = sslsock.getpeercert(True)
43375 9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	903 return DER_cert_to_PEM_cert(dercert)
9041965a92f2 Add support for asyncore server-side SSL support. This requires Bill Janssen <janssen@parc.com> parents: 43325 diff changeset	904
58407 a9d518fada59 Merged revisions 77595 via svnmerge from Ezio Melotti <ezio.melotti@gmail.com> parents: 49340 diff changeset	905 def get_protocol_name(protocol_code):
70001 3c87a13980be (Merge 3.1) Issue #12012: ssl.PROTOCOL_SSLv2 becomes optional Victor Stinner <victor.stinner@haypocalc.com> parents: 68256 diff changeset	906 return _PROTOCOL_NAMES.get(protocol_code, '<unknown>')

Mercurial > cpython-lru_cache-weakref

annotate Lib/ssl.py @ 87690:66c1c9f32567 default tip