Issue #19422: Explicitly disallow non-SOCK_STREAM sockets in the ssl module, rather than silently let them emit clear text data.
diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
index 5b73767..ff166f5 100644
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -69,13 +69,16 @@
Takes an instance ``sock`` of :class:`socket.socket`, and returns an instance
of :class:`ssl.SSLSocket`, a subtype of :class:`socket.socket`, which wraps
- the underlying socket in an SSL context. For client-side sockets, the
- context construction is lazy; if the underlying socket isn't connected yet,
- the context construction will be performed after :meth:`connect` is called on
- the socket. For server-side sockets, if the socket has no remote peer, it is
- assumed to be a listening socket, and the server-side SSL wrapping is
- automatically performed on client connections accepted via the :meth:`accept`
- method. :func:`wrap_socket` may raise :exc:`SSLError`.
+ the underlying socket in an SSL context. ``sock`` must be a
+ :data:`~socket.SOCK_STREAM` socket; other socket types are unsupported.
+
+ For client-side sockets, the context construction is lazy; if the
+ underlying socket isn't connected yet, the context construction will be
+ performed after :meth:`connect` is called on the socket. For
+ server-side sockets, if the socket has no remote peer, it is assumed
+ to be a listening socket, and the server-side SSL wrapping is
+ automatically performed on client connections accepted via the
+ :meth:`accept` method. :func:`wrap_socket` may raise :exc:`SSLError`.
The ``keyfile`` and ``certfile`` parameters specify optional files which
contain a certificate to be used to identify the local side of the