blob: bd0c5b74e152578291133baebd255ebdfffa06e7 [file] [log] [blame]
Jean-Paul Calderone897bc252008-02-18 20:50:23 -05001<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
2<html>
3<head>
4<title>3.3 SSL -- An interface to the SSL-specific parts of OpenSSL </title>
5<META NAME="description" CONTENT="3.3 SSL -- An interface to the SSL-specific parts of OpenSSL ">
6<META NAME="keywords" CONTENT="pyOpenSSL">
7<META NAME="resource-type" CONTENT="document">
8<META NAME="distribution" CONTENT="global">
9<link rel="STYLESHEET" href="pyOpenSSL.css">
10<LINK REL="previous" href="openssl-rand.html">
11<LINK REL="up" href="openssl.html">
12<LINK REL="next" href="openssl-context.html">
13</head>
14<body>
15<DIV CLASS="navigation">
16<table align="center" width="100%" cellpadding="0" cellspacing="2">
17<tr>
18<td><A href="openssl-rand.html"><img src="previous.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -050019 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050020 alt="Previous Page" width="32"></A></td>
21<td><A href="openssl.html"><img src="up.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -050022 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050023 alt="Up One Level" width="32"></A></td>
24<td><A href="openssl-context.html"><img src="next.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -050025 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050026 alt="Next Page" width="32"></A></td>
27<td align="center" width="100%">Python OpenSSL Manual</td>
28<td><A href="contents.html"><img src="contents.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -050029 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050030 alt="Contents" width="32"></A></td>
31<td><img src="blank.gif"
32 border="0" height="32"
33 alt="" width="32"></td>
34<td><img src="blank.gif"
35 border="0" height="32"
36 alt="" width="32"></td>
37</tr></table>
38<b class="navlabel">Previous:</b> <a class="sectref" href="openssl-rand.html">3.2 rand </A>
39<b class="navlabel">Up:</b> <a class="sectref" href="openssl.html">3 OpenSSL </A>
40<b class="navlabel">Next:</b> <a class="sectref" href="openssl-context.html">3.3.1 Context objects</A>
41<br><hr>
42</DIV>
43<!--End of Navigation Panel-->
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -050044
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050045<H2><A NAME="SECTION000430000000000000000">&nbsp;</A>
46<BR>
473.3 <tt class="module">SSL</tt> -- An interface to the SSL-specific parts of OpenSSL
48</H2>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -050049
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050050<P>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -050051
52
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050053<P>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -050054This module handles things specific to SSL. There are two objects defined:
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050055Context, Connection.
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -050056
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050057<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -040058<dl><dt><b><a name='l2h-129'><tt>SSLv2_METHOD</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050059<dd>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -040060<dt><b><a name='l2h-146'><tt>SSLv3_METHOD</tt></a></b><dd>
61<dt><b><a name='l2h-147'><tt>SSLv23_METHOD</tt></a></b><dd>
62<dt><b><a name='l2h-148'><tt>TLSv1_METHOD</tt></a></b><dd>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050063These constants represent the different SSL methods to use when creating a
64context object.
65</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -050066
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050067<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -040068<dl><dt><b><a name='l2h-130'><tt>VERIFY_NONE</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050069<dd>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -040070<dt><b><a name='l2h-149'><tt>VERIFY_PEER</tt></a></b><dd>
71<dt><b><a name='l2h-150'><tt>VERIFY_FAIL_IF_NO_PEER_CERT</tt></a></b><dd>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050072These constants represent the verification mode used by the Context
73object's <tt class="method">set_verify</tt> method.
74</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -050075
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050076<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -040077<dl><dt><b><a name='l2h-131'><tt>FILETYPE_PEM</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050078<dd>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -040079<dt><b><a name='l2h-151'><tt>FILETYPE_ASN1</tt></a></b><dd>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050080File type constants used with the <tt class="method">use_certificate_file</tt> and
81<tt class="method">use_privatekey_file</tt> methods of Context objects.
82</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -050083
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050084<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -040085<dl><dt><b><a name='l2h-132'><tt>OP_SINGLE_DH_USE</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050086<dd>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -040087<dt><b><a name='l2h-152'><tt>OP_EPHEMERAL_RSA</tt></a></b><dd>
88<dt><b><a name='l2h-153'><tt>OP_NO_SSLv2</tt></a></b><dd>
89<dt><b><a name='l2h-154'><tt>OP_NO_SSLv3</tt></a></b><dd>
90<dt><b><a name='l2h-155'><tt>OP_NO_TLSv1</tt></a></b><dd>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -050091Constants used with <tt class="method">set_options</tt> of Context objects.
92<tt class="constant">OP_SINGLE_DH_USE</tt> means to always create a new key when using ephemeral
93Diffie-Hellman. <tt class="constant">OP_EPHEMERAL_RSA</tt> means to always use ephemeral RSA keys
94when doing RSA operations. <tt class="constant">OP_NO_SSLv2</tt>, <tt class="constant">OP_NO_SSLv3</tt> and
95<tt class="constant">OP_NO_TLSv1</tt> means to disable those specific protocols. This is
96interesting if you're using e.g. <tt class="constant">SSLv23_METHOD</tt> to get an SSLv2-compatible
97handshake, but don't want to use SSLv2.
98</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -050099
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500100<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400101<dl><dt><b><a name='l2h-133'><tt>SSLEAY_VERSION</tt></a></b>
102<dd>
103<dt><b><a name='l2h-156'><tt>SSLEAY_CFLAGS</tt></a></b><dd>
104<dt><b><a name='l2h-157'><tt>SSLEAY_BUILT_ON</tt></a></b><dd>
105<dt><b><a name='l2h-158'><tt>SSLEAY_PLATFORM</tt></a></b><dd>
106<dt><b><a name='l2h-159'><tt>SSLEAY_DIR</tt></a></b><dd>
107Constants used with <tt class="method">SSLeay_version</tt> to specify what OpenSSL version
108information to retrieve. See the man page for the <tt class="function">SSLeay_version</tt> C
109API for details.
110</dl>
111
112<P>
113<dl><dt><b><a name='l2h-134'><tt>OPENSSL_VERSION_NUMBER</tt></a></b>
114<dd>
115An integer giving the version number of the OpenSSL library used to build this
116version of pyOpenSSL. See the man page for the <tt class="function">SSLeay_version</tt> C API
117for details.
118</dl>
119
120<P>
121<dl><dt><b><a name='l2h-135'><tt class='function'>SSLeay_version</tt></a></b>(<var>type</var>)
122<dd>
123Retrieve a string describing some aspect of the underlying OpenSSL version. The
124type passed in should be one of the <tt class="constant">SSLEAY_*</tt> constants defined in
125this module.
126</dl>
127
128<P>
129<dl><dt><b><a name='l2h-136'><tt>ContextType</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500130<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500131See <tt class="class">Context</tt>.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500132</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500133
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500134<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400135<dl><dt><b>class <a name='l2h-137'><tt class='class'>Context</tt></a></b>(<var>method</var>)
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500136<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500137A class representing SSL contexts. Contexts define the parameters of one or
138more SSL connections.
139
140<P>
141<var>method</var> should be <tt class="constant">SSLv2_METHOD</tt>, <tt class="constant">SSLv3_METHOD</tt>,
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500142<tt class="constant">SSLv23_METHOD</tt> or <tt class="constant">TLSv1_METHOD</tt>.
143</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500144
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500145<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400146<dl><dt><b><a name='l2h-138'><tt>ConnectionType</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500147<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500148See <tt class="class">Connection</tt>.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500149</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500150
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500151<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400152<dl><dt><b>class <a name='l2h-139'><tt class='class'>Connection</tt></a></b>(<var>context, socket</var>)
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500153<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500154A class representing SSL connections.
155
156<P>
157<var>context</var> should be an instance of <tt class="class">Context</tt> and <var>socket</var>
158should be a socket <A NAME="tex2html4"
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400159 HREF="#foot1276"><SUP>3</SUP></A> object. <var>socket</var> may be
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500160<var>None</var>; in this case, the Connection is created with a memory BIO: see
161the <tt class="method">bio_read</tt>, <tt class="method">bio_write</tt>, and <tt class="method">bio_shutdown</tt>
162methods.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500163</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500164
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500165<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400166<dl><dt><b>exception <a name='l2h-140'><tt class='exception'>Error</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500167<dd>
168This exception is used as a base class for the other SSL-related
169exceptions, but may also be raised directly.
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500170
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500171<P>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500172Whenever this exception is raised directly, it has a list of error messages
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500173from the OpenSSL error queue, where each item is a tuple <code>(<var>lib</var>,
174<var>function</var>, <var>reason</var>)</code>. Here <var>lib</var>, <var>function</var> and <var>reason</var>
175are all strings, describing where and what the problem is. See <span class='manpage'><i>err</i>(3)</span>
176for more information.
177</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500178
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500179<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400180<dl><dt><b>exception <a name='l2h-141'><tt class='exception'>ZeroReturnError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500181<dd>
182This exception matches the error return code <code>SSL_ERROR_ZERO_RETURN</code>, and
183is raised when the SSL Connection has been closed. In SSL 3.0 and TLS 1.0, this
184only occurs if a closure alert has occurred in the protocol, i.e. the
185connection has been closed cleanly. Note that this does not necessarily
186mean that the transport layer (e.g. a socket) has been closed.
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500187
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500188<P>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500189It may seem a little strange that this is an exception, but it does match an
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500190<code>SSL_ERROR</code> code, and is very convenient.
191</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500192
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500193<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400194<dl><dt><b>exception <a name='l2h-142'><tt class='exception'>WantReadError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500195<dd>
196The operation did not complete; the same I/O method should be called again
197later, with the same arguments. Any I/O method can lead to this since new
198handshakes can occur at any time.
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500199
200<P>
201The wanted read is for <i>dirty</i> data sent over the network, not the
202<i>clean</i> data inside the tunnel. For a socket based SSL connection,
203<i>read</i> means data coming at us over the network. Until that read
204succeeds, the attempted <tt class="method">OpenSSL.SSL.Connection.recv</tt>,
205<tt class="method">OpenSSL.SSL.Connection.send</tt>, or
206<tt class="method">OpenSSL.SSL.Connection.do_handshake</tt> is prevented or incomplete. You
207probably want to <tt class="method">select()</tt> on the socket before trying again.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500208</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500209
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500210<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400211<dl><dt><b>exception <a name='l2h-143'><tt class='exception'>WantWriteError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500212<dd>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500213See <tt class="exception">WantReadError</tt>. The socket send buffer may be too full to
214write more data.
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500215</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500216
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500217<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400218<dl><dt><b>exception <a name='l2h-144'><tt class='exception'>WantX509LookupError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500219<dd>
220The operation did not complete because an application callback has asked to be
221called again. The I/O method should be called again later, with the same
222arguments. Note: This won't occur in this version, as there are no such
223callbacks in this version.
224</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500225
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500226<P>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400227<dl><dt><b>exception <a name='l2h-145'><tt class='exception'>SysCallError</tt></a></b>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500228<dd>
229The <tt class="exception">SysCallError</tt> occurs when there's an I/O error and OpenSSL's
230error queue does not contain any information. This can mean two things: An
231error in the transport protocol, or an end of file that violates the protocol.
232The parameter to the exception is always a pair <code>(<var>errnum</var>,
233<var>errstr</var>)</code>.
234</dl>
Jean-Paul Calderone2aa2b332008-03-06 21:43:14 -0500235
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500236<P>
237<BR><HR><H4>Footnotes</H4>
238<DL>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400239<DT><A NAME="foot1276">... socket</A><A
Jean-Paul Calderonef1b839d2008-09-01 12:06:06 -0400240 href="openssl-ssl.html#tex2html4"><SUP>3</SUP></A></DT>
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500241<DD>Actually, all that is required is an object
242that <i>behaves</i> like a socket, you could even use files, even though
243it'd be tricky to get the handshakes right!
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500244
245</DD>
246</DL>
247<p><hr>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500248<!--Table of Child-Links-->
249<A NAME="CHILD_LINKS"><STRONG>Subsections</STRONG></A>
250
251<UL CLASS="ChildLinks">
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400252<LI><A NAME="tex2html289"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500253 href="openssl-context.html">3.3.1 Context objects </A>
Jean-Paul Calderone7fd9c562011-08-14 18:19:17 -0400254<LI><A NAME="tex2html290"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500255 href="openssl-connection.html">3.3.2 Connection objects </A>
256</UL>
257<!--End of Table of Child-Links-->
258
259<DIV CLASS="navigation">
260<p><hr>
261<table align="center" width="100%" cellpadding="0" cellspacing="2">
262<tr>
263<td><A href="openssl-rand.html"><img src="previous.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500264 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500265 alt="Previous Page" width="32"></A></td>
266<td><A href="openssl.html"><img src="up.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500267 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500268 alt="Up One Level" width="32"></A></td>
269<td><A href="openssl-context.html"><img src="next.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500270 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500271 alt="Next Page" width="32"></A></td>
272<td align="center" width="100%">Python OpenSSL Manual</td>
273<td><A href="contents.html"><img src="contents.gif"
Jean-Paul Calderone215d51b2009-11-13 09:19:21 -0500274 border="0" height="32"
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500275 alt="Contents" width="32"></A></td>
276<td><img src="blank.gif"
277 border="0" height="32"
278 alt="" width="32"></td>
279<td><img src="blank.gif"
280 border="0" height="32"
281 alt="" width="32"></td>
282</tr></table>
283<b class="navlabel">Previous:</b> <a class="sectref" href="openssl-rand.html">3.2 rand </A>
284<b class="navlabel">Up:</b> <a class="sectref" href="openssl.html">3 OpenSSL </A>
285<b class="navlabel">Next:</b> <a class="sectref" href="openssl-context.html">3.3.1 Context objects</A>
286<hr>
Jean-Paul Calderoneb557e982011-09-02 11:35:12 -0400287<span class="release-info">Release 0.13.</span>
Jean-Paul Calderone897bc252008-02-18 20:50:23 -0500288</DIV>
289<!--End of Navigation Panel-->
290
291</BODY>
292</HTML>