Python socket.ssl() Examples

def starttls(self, keyfile = None, certfile = None):
        """Puts the connection to the SMTP server into TLS mode.

        If the server supports TLS, this will encrypt the rest of the SMTP
        session. If you provide the keyfile and certfile parameters,
        the identity of the SMTP server and client can be checked. This,
        however, depends on whether the socket module really checks the
        certificates.
        """
        (resp, reply) = self.docmd("STARTTLS")
        if resp == 220:
            sslobj = socket.ssl(self.sock, keyfile, certfile)
            self.sock = SSLFakeSocket(self.sock, sslobj)
            self.file = SSLFakeFile(sslobj)
            # RFC 3207:
            # The client MUST discard any knowledge obtained from
            # the server, such as the list of SMTP service extensions,
            # which was not obtained from the TLS negotiation itself.
            self.helo_resp = None
            self.ehlo_resp = None
            self.esmtp_features = {}
            self.does_esmtp = 0
        return (resp, reply) 

def startSSL(self, sock):
        """If needed, start SSL on the proxy or endpoint connection."""
        if not self.doSSL:
            return sock
        if self.caCerts:
            # If cert checking is requested use m2crypto
            if SSL:
                return startSSLWithChecker(sock, self.caCerts, self.commonName)
            else:
                warnings.warn("m2crypto is not installed; server certificates "
                        "will not be validated!")
        try:
            # Python >= 2.6
            import ssl
            return ssl.SSLSocket(sock)
        except ImportError:
            # Python < 2.6
            sslSock = socket.ssl(sock, None, None)
            return httplib.FakeSocket(sock, sslSock) 

def _ssl_wrap_socket(sock, key_file, cert_file, disable_validation,
                     ca_certs, ssl_version, hostname):
    if disable_validation:
        cert_reqs = ssl.CERT_NONE
    else:
        cert_reqs = ssl.CERT_REQUIRED
    if ssl_version is None:
        ssl_version = ssl.PROTOCOL_SSLv23

    if hasattr(ssl, 'SSLContext'):  # Python 2.7.9
        context = ssl.SSLContext(ssl_version)
        context.verify_mode = cert_reqs
        context.check_hostname = (cert_reqs != ssl.CERT_NONE)
        if cert_file:
            context.load_cert_chain(cert_file, key_file)
        if ca_certs:
            context.load_verify_locations(ca_certs)
        return context.wrap_socket(sock, server_hostname=hostname)
    else:
        return ssl.wrap_socket(sock, keyfile=key_file, certfile=cert_file,
                               cert_reqs=cert_reqs, ca_certs=ca_certs,
                               ssl_version=ssl_version) 

def __init__(self, conn, host, port):
      SocketTransport.__init__(self, conn, host, port)
      # Bug (QPID-4337): this is the "old" version of python SSL.
      # The private key is required. If a certificate is given, but no
      # keyfile, assume the key is contained in the certificate
      ssl_keyfile = conn.ssl_keyfile
      ssl_certfile = conn.ssl_certfile
      if ssl_certfile and not ssl_keyfile:
        ssl_keyfile = ssl_certfile

      # this version of SSL does NOT perform certificate validation.  If the
      # connection has been configured with CA certs (via ssl_trustfile), then
      # the application expects the certificate to be validated against the
      # supplied CA certs. Since this version cannot validate, the peer cannot
      # be trusted.
      if conn.ssl_trustfile:
        raise socket.error("This version of Python does not support verification of the peer's certificate.")

      self.ssl = ssl(self.socket, keyfile=ssl_keyfile, certfile=ssl_certfile)
      self.socket.setblocking(1) 

def _ssl_wrap_socket(sock, key_file, cert_file, disable_validation,
                     ca_certs, ssl_version, hostname):
    if disable_validation:
        cert_reqs = ssl.CERT_NONE
    else:
        cert_reqs = ssl.CERT_REQUIRED
    if ssl_version is None:
        ssl_version = ssl.PROTOCOL_SSLv23

    if hasattr(ssl, 'SSLContext'):  # Python 2.7.9
        context = ssl.SSLContext(ssl_version)
        context.verify_mode = cert_reqs
        context.check_hostname = (cert_reqs != ssl.CERT_NONE)
        if cert_file:
            context.load_cert_chain(cert_file, key_file)
        if ca_certs:
            context.load_verify_locations(ca_certs)
        return context.wrap_socket(sock, server_hostname=hostname)
    else:
        return ssl.wrap_socket(sock, keyfile=key_file, certfile=cert_file,
                               cert_reqs=cert_reqs, ca_certs=ca_certs,
                               ssl_version=ssl_version) 

def _ssl_wrap_socket(sock, key_file, cert_file,
                         disable_validation, ca_certs):
        if disable_validation:
            cert_reqs = ssl.CERT_NONE
        else:
            cert_reqs = ssl.CERT_REQUIRED
        # We should be specifying SSL version 3 or TLS v1, but the ssl module
        # doesn't expose the necessary knobs. So we need to go with the default
        # of SSLv23.
        return ssl.wrap_socket(sock, keyfile=key_file, certfile=cert_file,
                               cert_reqs=cert_reqs, ca_certs=ca_certs) 

def request(self, operation, url, data=None, headers=None, 
      url_params=None):
    if isinstance(url, (str, unicode)):
      if url.startswith('http:') and self.ssl:
        # Force all requests to be https if self.ssl is True.
        url = atom.url.parse_url('https:' + url[5:])
      elif not url.startswith('http') and self.ssl: 
        url = atom.url.parse_url('https://%s%s' % (self.server, url))
      elif not url.startswith('http'):
        url = atom.url.parse_url('http://%s%s' % (self.server, url))
      else:
        url = atom.url.parse_url(url)

    if url_params:
      for name, value in url_params.iteritems():
        url.params[name] = value

    all_headers = self.additional_headers.copy()
    if headers:
      all_headers.update(headers)

    # If the list of headers does not include a Content-Length, attempt to
    # calculate it based on the data object.
    if data and 'Content-Length' not in all_headers:
      content_length = CalculateDataLength(data)
      if content_length:
        all_headers['Content-Length'] = str(content_length)

    # Find an Authorization token for this URL if one is available.
    if self.override_token:
      auth_token = self.override_token
    else:
      auth_token = self.token_store.find_token(url)
    return auth_token.perform_request(self.http_client, operation, url, 
        data=data, headers=all_headers)

  # CRUD operations 

def request(self, operation, url, data=None, headers=None, 
      url_params=None):
    if isinstance(url, (str, unicode)):
      if url.startswith('http:') and self.ssl:
        # Force all requests to be https if self.ssl is True.
        url = atom.url.parse_url('https:' + url[5:])
      elif not url.startswith('http') and self.ssl: 
        url = atom.url.parse_url('https://%s%s' % (self.server, url))
      elif not url.startswith('http'):
        url = atom.url.parse_url('http://%s%s' % (self.server, url))
      else:
        url = atom.url.parse_url(url)

    if url_params:
      for name, value in url_params.iteritems():
        url.params[name] = value

    all_headers = self.additional_headers.copy()
    if headers:
      all_headers.update(headers)

    # If the list of headers does not include a Content-Length, attempt to
    # calculate it based on the data object.
    if data and 'Content-Length' not in all_headers:
      content_length = CalculateDataLength(data)
      if content_length:
        all_headers['Content-Length'] = str(content_length)

    # Find an Authorization token for this URL if one is available.
    if self.override_token:
      auth_token = self.override_token
    else:
      auth_token = self.token_store.find_token(url)
    return auth_token.perform_request(self.http_client, operation, url, 
        data=data, headers=all_headers)

  # CRUD operations 

def ProcessUrl(service, url, for_proxy=False):
  """Processes a passed URL.  If the URL does not begin with https?, then
  the default value for server is used

  This method is deprecated, use atom.url.parse_url instead.
  """
  if not isinstance(url, atom.url.Url):
    url = atom.url.parse_url(url)

  server = url.host
  ssl = False
  port = 80

  if not server:
    if hasattr(service, 'server'):
      server = service.server
    else:
      server = service
    if not url.protocol and hasattr(service, 'ssl'):
      ssl = service.ssl
    if hasattr(service, 'port'):
      port = service.port
  else:
    if url.protocol == 'https':
      ssl = True
    elif url.protocol == 'http':
      ssl = False
    if url.port:
      port = int(url.port)
    elif port == 80 and ssl:
      port = 443

  return (server, port, ssl, url.get_request_uri()) 

def _ssl_wrap_socket(sock, key_file, cert_file,
                         disable_validation, ca_certs):
        if not disable_validation:
            raise CertificateValidationUnsupported(
                    "SSL certificate validation is not supported without "
                    "the ssl module installed. To avoid this error, install "
                    "the ssl module, or explicity disable validation.")
        ssl_sock = socket.ssl(sock, key_file, cert_file)
        return httplib.FakeSocket(sock, ssl_sock) 

def __init__(self, host, connect_timeout, ssl):
        if isinstance(ssl, dict):
            self.sslopts = ssl

        self.sslobj = None

        super(SSLTransport, self).__init__(host, connect_timeout) 

def _setup_transport(self):
        """
        Wrap the socket in an SSL object, either the
        new Python 2.6 version, or the older Python 2.5 and
        lower version.

        """
        if HAVE_PY26_SSL:
            if hasattr(self, 'sslopts'):
                self.sslobj = ssl.wrap_socket(self.sock, **self.sslopts)
            else:
                self.sslobj = ssl.wrap_socket(self.sock)
            self.sslobj.do_handshake()
        else:
            self.sslobj = socket.ssl(self.sock) 

def create_transport(host, connect_timeout, ssl=False):
    """
    Given a few parameters from the Connection constructor,
    select and create a subclass of _AbstractTransport.

    """
    if ssl:
        return SSLTransport(host, connect_timeout, ssl)
    else:
        return TCPTransport(host, connect_timeout) 

def request(self, operation, url, data=None, headers=None,
                url_params=None):
        if isinstance(url, str):
            if url.startswith('http:') and self.ssl:
                # Force all requests to be https if self.ssl is True.
                url = atom.url.parse_url('https:' + url[5:])
            elif not url.startswith('http') and self.ssl:
                url = atom.url.parse_url('https://%s%s' % (self.server, url))
            elif not url.startswith('http'):
                url = atom.url.parse_url('http://%s%s' % (self.server, url))
            else:
                url = atom.url.parse_url(url)

        if url_params:
            for name, value in url_params.items():
                url.params[name] = value

        all_headers = self.additional_headers.copy()
        if headers:
            all_headers.update(headers)

        # If the list of headers does not include a Content-Length, attempt to
        # calculate it based on the data object.
        if data and 'Content-Length' not in all_headers:
            content_length = CalculateDataLength(data)
            if content_length:
                all_headers['Content-Length'] = str(content_length)

        # Find an Authorization token for this URL if one is available.
        if self.override_token:
            auth_token = self.override_token
        else:
            auth_token = self.token_store.find_token(url)
        return auth_token.perform_request(self.http_client, operation, url,
                                          data=data, headers=all_headers) 

def ProcessUrl(service, url, for_proxy=False):
    """Processes a passed URL.  If the URL does not begin with https?, then
    the default value for server is used

    This method is deprecated, use atom.url.parse_url instead.
    """
    if not isinstance(url, atom.url.Url):
        url = atom.url.parse_url(url)

    server = url.host
    ssl = False
    port = 80

    if not server:
        if hasattr(service, 'server'):
            server = service.server
        else:
            server = service
        if not url.protocol and hasattr(service, 'ssl'):
            ssl = service.ssl
        if hasattr(service, 'port'):
            port = service.port
    else:
        if url.protocol == 'https':
            ssl = True
        elif url.protocol == 'http':
            ssl = False
        if url.port:
            port = int(url.port)
        elif port == 80 and ssl:
            port = 443

    return (server, port, ssl, url.get_request_uri()) 

def _ssl_wrap_socket(sock, key_file, cert_file,
                         disable_validation, ca_certs):
        if disable_validation:
            cert_reqs = ssl.CERT_NONE
        else:
            cert_reqs = ssl.CERT_REQUIRED
        # We should be specifying SSL version 3 or TLS v1, but the ssl module
        # doesn't expose the necessary knobs. So we need to go with the default
        # of SSLv23.
        return ssl.wrap_socket(sock, keyfile=key_file, certfile=cert_file,
                               cert_reqs=cert_reqs, ca_certs=ca_certs) 

def connect(self):
        ProxyHTTPConnection.connect(self)

        # Make the sock ssl-aware
        ssl = socket.ssl(self.sock, self.key_file, self.cert_file)
        self.sock = httplib.FakeSocket(self.sock, ssl) 

def send(self, data):
        """Send data to remote."""
        # NB: socket.ssl needs a "sendall" method to match socket objects.
        bytes = len(data)
        while bytes > 0:
            sent = self.sslobj.write(data)
            if sent == bytes:
                break    # avoid copy
            data = data[sent:]
            bytes = bytes - sent 

def ProcessUrl(service, url, for_proxy=False):
  """Processes a passed URL.  If the URL does not begin with https?, then
  the default value for server is used

  This method is deprecated, use atom.url.parse_url instead.
  """
  if not isinstance(url, atom.url.Url):
    url = atom.url.parse_url(url)

  server = url.host
  ssl = False
  port = 80

  if not server:
    if hasattr(service, 'server'):
      server = service.server
    else:
      server = service
    if not url.protocol and hasattr(service, 'ssl'):
      ssl = service.ssl
    if hasattr(service, 'port'):
      port = service.port
  else:
    if url.protocol == 'https':
      ssl = True
    elif url.protocol == 'http':
      ssl = False
    if url.port:
      port = int(url.port)
    elif port == 80 and ssl:
      port = 443

  return (server, port, ssl, url.get_request_uri()) 

def request(self, operation, url, data=None, headers=None, 
      url_params=None):
    if isinstance(url, str):
      if url.startswith('http:') and self.ssl:
        # Force all requests to be https if self.ssl is True.
        url = atom.url.parse_url('https:' + url[5:])
      elif not url.startswith('http') and self.ssl: 
        url = atom.url.parse_url('https://%s%s' % (self.server, url))
      elif not url.startswith('http'):
        url = atom.url.parse_url('http://%s%s' % (self.server, url))
      else:
        url = atom.url.parse_url(url)

    if url_params:
      for name, value in url_params.items():
        url.params[name] = value

    all_headers = self.additional_headers.copy()
    if headers:
      all_headers.update(headers)

    # If the list of headers does not include a Content-Length, attempt to
    # calculate it based on the data object.
    if data and 'Content-Length' not in all_headers:
      content_length = CalculateDataLength(data)
      if content_length:
        all_headers['Content-Length'] = str(content_length)

    # Find an Authorization token for this URL if one is available.
    if self.override_token:
      auth_token = self.override_token
    else:
      auth_token = self.token_store.find_token(url)
    return auth_token.perform_request(self.http_client, operation, url, 
        data=data, headers=all_headers) 

def connect(self):
        sock = TimeoutSocket(self.timeout)
        sock.connect((self.host, self.port))
        realsock = getattr(sock.sock, '_sock', sock.sock)
        ssl = socket.ssl(realsock, self.key_file, self.cert_file)
        self.sock = httplib.FakeSocket(sock, ssl) 

def _ssl_wrap_socket(sock, key_file, cert_file,
                         disable_validation, ca_certs):
        if not disable_validation:
            raise CertificateValidationUnsupported(
                    "SSL certificate validation is not supported without "
                    "the ssl module installed. To avoid this error, install "
                    "the ssl module, or explicity disable validation.")
        ssl_sock = socket.ssl(sock, key_file, cert_file)
        return httplib.FakeSocket(sock, ssl_sock) 

def _ssl_wrap_socket(sock, key_file, cert_file,
                         disable_validation, ca_certs):
        if disable_validation:
            cert_reqs = ssl.CERT_NONE
        else:
            cert_reqs = ssl.CERT_REQUIRED
        # We should be specifying SSL version 3 or TLS v1, but the ssl module
        # doesn't expose the necessary knobs. So we need to go with the default
        # of SSLv23.
        return ssl.wrap_socket(sock, keyfile=key_file, certfile=cert_file,
                               cert_reqs=cert_reqs, ca_certs=ca_certs) 

def _ssl_wrap_socket_unsupported(
    sock, key_file, cert_file, disable_validation, ca_certs, ssl_version, hostname
):
    if not disable_validation:
        raise CertificateValidationUnsupported(
            "SSL certificate validation is not supported without "
            "the ssl module installed. To avoid this error, install "
            "the ssl module, or explicity disable validation."
        )
    ssl_sock = socket.ssl(sock, key_file, cert_file)
    return httplib.FakeSocket(sock, ssl_sock) 

def _ssl_wrap_socket(
    sock, key_file, cert_file, disable_validation, ca_certs, ssl_version, hostname
):
    if disable_validation:
        cert_reqs = ssl.CERT_NONE
    else:
        cert_reqs = ssl.CERT_REQUIRED
    if ssl_version is None:
        ssl_version = ssl.PROTOCOL_SSLv23

    if hasattr(ssl, "SSLContext"):  # Python 2.7.9
        context = ssl.SSLContext(ssl_version)
        context.verify_mode = cert_reqs
        context.check_hostname = cert_reqs != ssl.CERT_NONE
        if cert_file:
            context.load_cert_chain(cert_file, key_file)
        if ca_certs:
            context.load_verify_locations(ca_certs)
        return context.wrap_socket(sock, server_hostname=hostname)
    else:
        return ssl.wrap_socket(
            sock,
            keyfile=key_file,
            certfile=cert_file,
            cert_reqs=cert_reqs,
            ca_certs=ca_certs,
            ssl_version=ssl_version,
        ) 

def _ssl_wrap_socket(
    sock, key_file, cert_file, disable_validation, ca_certs, ssl_version, hostname
):
    if disable_validation:
        cert_reqs = ssl.CERT_NONE
    else:
        cert_reqs = ssl.CERT_REQUIRED
    if ssl_version is None:
        ssl_version = ssl.PROTOCOL_SSLv23

    if hasattr(ssl, "SSLContext"):  # Python 2.7.9
        context = ssl.SSLContext(ssl_version)
        context.verify_mode = cert_reqs
        context.check_hostname = cert_reqs != ssl.CERT_NONE
        if cert_file:
            context.load_cert_chain(cert_file, key_file)
        if ca_certs:
            context.load_verify_locations(ca_certs)
        return context.wrap_socket(sock, server_hostname=hostname)
    else:
        return ssl.wrap_socket(
            sock,
            keyfile=key_file,
            certfile=cert_file,
            cert_reqs=cert_reqs,
            ca_certs=ca_certs,
            ssl_version=ssl_version,
        ) 

def _ssl_wrap_socket_unsupported(
    sock, key_file, cert_file, disable_validation, ca_certs, ssl_version, hostname
):
    if not disable_validation:
        raise CertificateValidationUnsupported(
            "SSL certificate validation is not supported without "
            "the ssl module installed. To avoid this error, install "
            "the ssl module, or explicity disable validation."
        )
    ssl_sock = socket.ssl(sock, key_file, cert_file)
    return httplib.FakeSocket(sock, ssl_sock) 

def _ssl_wrap_socket(
    sock, key_file, cert_file, disable_validation, ca_certs, ssl_version, hostname
):
    if disable_validation:
        cert_reqs = ssl.CERT_NONE
    else:
        cert_reqs = ssl.CERT_REQUIRED
    if ssl_version is None:
        ssl_version = ssl.PROTOCOL_SSLv23

    if hasattr(ssl, "SSLContext"):  # Python 2.7.9
        context = ssl.SSLContext(ssl_version)
        context.verify_mode = cert_reqs
        context.check_hostname = cert_reqs != ssl.CERT_NONE
        if cert_file:
            context.load_cert_chain(cert_file, key_file)
        if ca_certs:
            context.load_verify_locations(ca_certs)
        return context.wrap_socket(sock, server_hostname=hostname)
    else:
        return ssl.wrap_socket(
            sock,
            keyfile=key_file,
            certfile=cert_file,
            cert_reqs=cert_reqs,
            ca_certs=ca_certs,
            ssl_version=ssl_version,
        ) 

def _ssl_wrap_socket_unsupported(
    sock, key_file, cert_file, disable_validation, ca_certs, ssl_version, hostname
):
    if not disable_validation:
        raise CertificateValidationUnsupported(
            "SSL certificate validation is not supported without "
            "the ssl module installed. To avoid this error, install "
            "the ssl module, or explicity disable validation."
        )
    ssl_sock = socket.ssl(sock, key_file, cert_file)
    return httplib.FakeSocket(sock, ssl_sock) 

def _ssl_wrap_socket(
    sock, key_file, cert_file, disable_validation, ca_certs, ssl_version, hostname
):
    if disable_validation:
        cert_reqs = ssl.CERT_NONE
    else:
        cert_reqs = ssl.CERT_REQUIRED
    if ssl_version is None:
        ssl_version = ssl.PROTOCOL_SSLv23

    if hasattr(ssl, "SSLContext"):  # Python 2.7.9
        context = ssl.SSLContext(ssl_version)
        context.verify_mode = cert_reqs
        context.check_hostname = cert_reqs != ssl.CERT_NONE
        if cert_file:
            context.load_cert_chain(cert_file, key_file)
        if ca_certs:
            context.load_verify_locations(ca_certs)
        return context.wrap_socket(sock, server_hostname=hostname)
    else:
        return ssl.wrap_socket(
            sock,
            keyfile=key_file,
            certfile=cert_file,
            cert_reqs=cert_reqs,
            ca_certs=ca_certs,
            ssl_version=ssl_version,
        )