Gitiles
Code Review Sign In
gerrit-public.fairphone.software / platform / external / python / pyopenssl / b51bda3df396de582f9a275eb04e1ce54df9705f / . / doc / html / openssl-ssl.html
blob: a607e4141848d0f0fa8be0b2b80263f788d83403 [file] [log] [blame]
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]1<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
2<html>
3<head>
4<title>3.3 SSL -- An interface to the SSL-specific parts of OpenSSL </title>
5<META NAME="description" CONTENT="3.3 SSL -- An interface to the SSL-specific parts of OpenSSL ">
6<META NAME="keywords" CONTENT="pyOpenSSL">
7<META NAME="resource-type" CONTENT="document">
8<META NAME="distribution" CONTENT="global">
9<link rel="STYLESHEET" href="pyOpenSSL.css">
10<LINK REL="previous" href="openssl-rand.html">
11<LINK REL="up" href="openssl.html">
12<LINK REL="next" href="openssl-context.html">
13</head>
14<body>
15<DIV CLASS="navigation">
16<table align="center" width="100%" cellpadding="0" cellspacing="2">
17<tr>
18<td><A href="openssl-rand.html"><img src="previous.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]19 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]20 alt="Previous Page" width="32"></A></td>
21<td><A href="openssl.html"><img src="up.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]22 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]23 alt="Up One Level" width="32"></A></td>
24<td><A href="openssl-context.html"><img src="next.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]25 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]26 alt="Next Page" width="32"></A></td>
27<td align="center" width="100%">Python OpenSSL Manual</td>
28<td><A href="contents.html"><img src="contents.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]29 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]30 alt="Contents" width="32"></A></td>
31<td><img src="blank.gif"
32 border="0" height="32"
33 alt="" width="32"></td>
34<td><img src="blank.gif"
35 border="0" height="32"
36 alt="" width="32"></td>
37</tr></table>
38<b class="navlabel">Previous:</b> <a class="sectref" href="openssl-rand.html">3.2 rand </A>
39<b class="navlabel">Up:</b> <a class="sectref" href="openssl.html">3 OpenSSL </A>
40<b class="navlabel">Next:</b> <a class="sectref" href="openssl-context.html">3.3.1 Context objects</A>
41<br><hr>
42</DIV>
43<!--End of Navigation Panel-->
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]44
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]45<H2><A NAME="SECTION000430000000000000000">&nbsp;</A>
46<BR>
473.3 <tt class="module">SSL</tt> -- An interface to the SSL-specific parts of OpenSSL
48</H2>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]49
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]50<P>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]51
52
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]53<P>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]54This module handles things specific to SSL. There are two objects defined:
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]55Context, Connection.
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]56
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]57<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]58<dl><dt><b><a name='l2h-128'><tt>SSLv2_METHOD</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]59<dd>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]60<dt><b><a name='l2h-142'><tt>SSLv3_METHOD</tt></a></b><dd>
61<dt><b><a name='l2h-143'><tt>SSLv23_METHOD</tt></a></b><dd>
62<dt><b><a name='l2h-144'><tt>TLSv1_METHOD</tt></a></b><dd>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]63These constants represent the different SSL methods to use when creating a
64context object.
65</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]66
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]67<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]68<dl><dt><b><a name='l2h-129'><tt>VERIFY_NONE</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]69<dd>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]70<dt><b><a name='l2h-145'><tt>VERIFY_PEER</tt></a></b><dd>
71<dt><b><a name='l2h-146'><tt>VERIFY_FAIL_IF_NO_PEER_CERT</tt></a></b><dd>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]72These constants represent the verification mode used by the Context
73object's <tt class="method">set_verify</tt> method.
74</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]75
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]76<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]77<dl><dt><b><a name='l2h-130'><tt>FILETYPE_PEM</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]78<dd>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]79<dt><b><a name='l2h-147'><tt>FILETYPE_ASN1</tt></a></b><dd>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]80File type constants used with the <tt class="method">use_certificate_file</tt> and
81<tt class="method">use_privatekey_file</tt> methods of Context objects.
82</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]83
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]84<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]85<dl><dt><b><a name='l2h-131'><tt>OP_SINGLE_DH_USE</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]86<dd>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]87<dt><b><a name='l2h-148'><tt>OP_EPHEMERAL_RSA</tt></a></b><dd>
88<dt><b><a name='l2h-149'><tt>OP_NO_SSLv2</tt></a></b><dd>
89<dt><b><a name='l2h-150'><tt>OP_NO_SSLv3</tt></a></b><dd>
90<dt><b><a name='l2h-151'><tt>OP_NO_TLSv1</tt></a></b><dd>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]91Constants used with <tt class="method">set_options</tt> of Context objects.
92<tt class="constant">OP_SINGLE_DH_USE</tt> means to always create a new key when using ephemeral
93Diffie-Hellman. <tt class="constant">OP_EPHEMERAL_RSA</tt> means to always use ephemeral RSA keys
94when doing RSA operations. <tt class="constant">OP_NO_SSLv2</tt>, <tt class="constant">OP_NO_SSLv3</tt> and
95<tt class="constant">OP_NO_TLSv1</tt> means to disable those specific protocols. This is
96interesting if you're using e.g. <tt class="constant">SSLv23_METHOD</tt> to get an SSLv2-compatible
97handshake, but don't want to use SSLv2.
98</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]99
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]100<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]101<dl><dt><b><a name='l2h-132'><tt>ContextType</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]102<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]103See <tt class="class">Context</tt>.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]104</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]105
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]106<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]107<dl><dt><b>class <a name='l2h-133'><tt class='class'>Context</tt></a></b>(<var>method</var>)
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]108<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]109A class representing SSL contexts. Contexts define the parameters of one or
110more SSL connections.
111
112<P>
113<var>method</var> should be <tt class="constant">SSLv2_METHOD</tt>, <tt class="constant">SSLv3_METHOD</tt>,
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]114<tt class="constant">SSLv23_METHOD</tt> or <tt class="constant">TLSv1_METHOD</tt>.
115</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]116
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]117<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]118<dl><dt><b><a name='l2h-134'><tt>ConnectionType</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]119<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]120See <tt class="class">Connection</tt>.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]121</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]122
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]123<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]124<dl><dt><b>class <a name='l2h-135'><tt class='class'>Connection</tt></a></b>(<var>context, socket</var>)
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]125<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]126A class representing SSL connections.
127
128<P>
129<var>context</var> should be an instance of <tt class="class">Context</tt> and <var>socket</var>
130should be a socket <A NAME="tex2html4"
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]131 HREF="#foot1231"><SUP>3</SUP></A> object. <var>socket</var> may be
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]132<var>None</var>; in this case, the Connection is created with a memory BIO: see
133the <tt class="method">bio_read</tt>, <tt class="method">bio_write</tt>, and <tt class="method">bio_shutdown</tt>
134methods.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]135</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]136
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]137<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]138<dl><dt><b>exception <a name='l2h-136'><tt class='exception'>Error</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]139<dd>
140This exception is used as a base class for the other SSL-related
141exceptions, but may also be raised directly.
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]142
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]143<P>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]144Whenever this exception is raised directly, it has a list of error messages
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]145from the OpenSSL error queue, where each item is a tuple <code>(<var>lib</var>,
146<var>function</var>, <var>reason</var>)</code>. Here <var>lib</var>, <var>function</var> and <var>reason</var>
147are all strings, describing where and what the problem is. See <span class='manpage'><i>err</i>(3)</span>
148for more information.
149</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]150
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]151<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]152<dl><dt><b>exception <a name='l2h-137'><tt class='exception'>ZeroReturnError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]153<dd>
154This exception matches the error return code <code>SSL_ERROR_ZERO_RETURN</code>, and
155is raised when the SSL Connection has been closed. In SSL 3.0 and TLS 1.0, this
156only occurs if a closure alert has occurred in the protocol, i.e. the
157connection has been closed cleanly. Note that this does not necessarily
158mean that the transport layer (e.g. a socket) has been closed.
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]159
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]160<P>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]161It may seem a little strange that this is an exception, but it does match an
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]162<code>SSL_ERROR</code> code, and is very convenient.
163</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]164
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]165<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]166<dl><dt><b>exception <a name='l2h-138'><tt class='exception'>WantReadError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]167<dd>
168The operation did not complete; the same I/O method should be called again
169later, with the same arguments. Any I/O method can lead to this since new
170handshakes can occur at any time.
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]171
172<P>
173The wanted read is for <i>dirty</i> data sent over the network, not the
174<i>clean</i> data inside the tunnel. For a socket based SSL connection,
175<i>read</i> means data coming at us over the network. Until that read
176succeeds, the attempted <tt class="method">OpenSSL.SSL.Connection.recv</tt>,
177<tt class="method">OpenSSL.SSL.Connection.send</tt>, or
178<tt class="method">OpenSSL.SSL.Connection.do_handshake</tt> is prevented or incomplete. You
179probably want to <tt class="method">select()</tt> on the socket before trying again.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]180</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]181
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]182<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]183<dl><dt><b>exception <a name='l2h-139'><tt class='exception'>WantWriteError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]184<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]185See <tt class="exception">WantReadError</tt>. The socket send buffer may be too full to
186write more data.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]187</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]188
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]189<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]190<dl><dt><b>exception <a name='l2h-140'><tt class='exception'>WantX509LookupError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]191<dd>
192The operation did not complete because an application callback has asked to be
193called again. The I/O method should be called again later, with the same
194arguments. Note: This won't occur in this version, as there are no such
195callbacks in this version.
196</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]197
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]198<P>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]199<dl><dt><b>exception <a name='l2h-141'><tt class='exception'>SysCallError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]200<dd>
201The <tt class="exception">SysCallError</tt> occurs when there's an I/O error and OpenSSL's
202error queue does not contain any information. This can mean two things: An
203error in the transport protocol, or an end of file that violates the protocol.
204The parameter to the exception is always a pair <code>(<var>errnum</var>,
205<var>errstr</var>)</code>.
206</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500[diff] [blame]207
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]208<P>
209<BR><HR><H4>Footnotes</H4>
210<DL>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]211<DT><A NAME="foot1231">... socket</A><A
Jean-Paul Calderonef1b839d2008-09-01 12:06:06 -0400[diff] [blame]212 href="openssl-ssl.html#tex2html4"><SUP>3</SUP></A></DT>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]213<DD>Actually, all that is required is an object
214that <i>behaves</i> like a socket, you could even use files, even though
215it'd be tricky to get the handshakes right!
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]216
217</DD>
218</DL>
219<p><hr>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]220<!--Table of Child-Links-->
221<A NAME="CHILD_LINKS"><STRONG>Subsections</STRONG></A>
222
223<UL CLASS="ChildLinks">
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]224<LI><A NAME="tex2html303"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]225 href="openssl-context.html">3.3.1 Context objects </A>
Jean-Paul Calderone78caacc2011-04-07 15:41:56 -0400[diff] [blame]226<LI><A NAME="tex2html304"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]227 href="openssl-connection.html">3.3.2 Connection objects </A>
228</UL>
229<!--End of Table of Child-Links-->
230
231<DIV CLASS="navigation">
232<p><hr>
233<table align="center" width="100%" cellpadding="0" cellspacing="2">
234<tr>
235<td><A href="openssl-rand.html"><img src="previous.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]236 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]237 alt="Previous Page" width="32"></A></td>
238<td><A href="openssl.html"><img src="up.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]239 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]240 alt="Up One Level" width="32"></A></td>
241<td><A href="openssl-context.html"><img src="next.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]242 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]243 alt="Next Page" width="32"></A></td>
244<td align="center" width="100%">Python OpenSSL Manual</td>
245<td><A href="contents.html"><img src="contents.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500[diff] [blame]246 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]247 alt="Contents" width="32"></A></td>
248<td><img src="blank.gif"
249 border="0" height="32"
250 alt="" width="32"></td>
251<td><img src="blank.gif"
252 border="0" height="32"
253 alt="" width="32"></td>
254</tr></table>
255<b class="navlabel">Previous:</b> <a class="sectref" href="openssl-rand.html">3.2 rand </A>
256<b class="navlabel">Up:</b> <a class="sectref" href="openssl.html">3 OpenSSL </A>
257<b class="navlabel">Next:</b> <a class="sectref" href="openssl-context.html">3.3.1 Context objects</A>
258<hr>
Jean-Paul Calderone26ebc9e2011-04-11 19:57:10 -0400[diff] [blame]259<span class="release-info">Release 0.12.</span>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500[diff] [blame]260</DIV>
261<!--End of Navigation Panel-->
262
263</BODY>
264</HTML>