ELF > `L @ 0 @ 8 @
! ! 0 0 0! 0! $ $ Ptd D D D Qtd GNU | 3z y @y | ~
|CEqX E : a ? J / D & P + M # y ; 3 * Y " & N l ( ] } l f \ w j P < s ` c ~ . : U 8 y q B B K L i P 4/ X ! E 0! L 0! E __gmon_start__ _init _fini __cxa_finalize _Jv_RegisterClasses _Py_ZeroStruct _Py_TrueStruct PyInt_FromLong PyString_FromString PyDict_GetItem PyExc_MemoryError PyErr_SetString PyExc_KeyError PyErr_Format PyExc_ValueError PyTuple_New PyTuple_SetItem _PyArg_ParseTupleAndKeywords_SizeT PyList_New PyString_FromFormat PyList_Append PyString_AsString PySequence_Size PySequence_GetItem SSL_GetChannelInfo __stack_chk_fail SSL_GetCipherSuiteInfo SSL_GetNegotiatedHostInfo PyString_FromStringAndSize SECITEM_FreeItem _Py_NoneStruct SSL_VersionRangeGet _PyArg_ParseTuple_SizeT PyExc_TypeError _PyObject_CallMethod_SizeT PyInt_AsLong SSL_VersionRangeSet SSL_ImportFD PR_ImportTCPSocket PyEval_SaveThread PR_GetSockName PyEval_RestoreThread PR_Close SSL_ReHandshakeWithTimeout SSL_ReHandshake SSL_ForceHandshakeWithTimeout SSL_ForceHandshake SSL_ResetHandshake SSL_CertDBHandleSet SSL_RevealURL PR_Free SSL_SetURL SSL_CipherPrefGet SSL_CipherPrefSet SSL_SetSockPeerID SSL_GetSessionID SSL_SecurityStatus _Py_BuildValue_SizeT SSL_DataPending SSL_InvalidateSession SSL_RevealCert SSL_PeerCertificate SSL_ConfigSecureServer SSL_RevealPinArg SSL_SetPKCS11PinArg PyTuple_Size PyTuple_GetItem PyCallable_Check PyTuple_GetSlice SSL_HandshakeCallback PyGILState_Ensure PyObject_CallObject PyGILState_Release PySys_WriteStderr PyErr_Print SSL_GetClientAuthDataHook PyBool_Type PyType_IsSubtype SSL_AuthCertificateHook PyBool_FromLong PyObject_IsTrue PR_Accept SSL_OptionGet SSL_OptionSet SSL_VersionRangeSetDefault SSL_VersionRangeGetDefault SSL_VersionRangeGetSupported NSS_SetFrancePolicy NSS_SetExportPolicy NSS_SetDomesticPolicy SSL_ShutdownServerSessionIDCache SSL_ClearSessionCache SSL_SetMaxServerCacheLocks SSL_GetMaxServerCacheLocks SSL_ConfigServerSessionIDCacheWithOpt PyUnicodeUCS4_AsUTF8String SSL_ConfigMPServerSIDCache SSL_ConfigServerSessionIDCache SSL_CipherPolicyGet SSL_CipherPolicySet SSL_CipherPrefGetDefault SSL_CipherPrefSetDefault SSL_OptionGetDefault SSL_OptionSetDefault initssl PyImport_ImportModule PyObject_GetAttrString PyCObject_Type PyCObject_AsVoidPtr Py_InitModule4_64 PyType_Ready rindex PyModule_AddObject PyCObject_FromVoidPtr SSL_NumImplementedCiphers SSL_ImplementedCiphers PyDict_New PyModule_GetDict PyDict_GetItemString PyModule_GetName PyExc_SystemError PyModule_AddIntConstant libnspr4.so libssl3.so libpython2.6.so.1.0 libpthread.so.0 libc.so.6 _edata __bss_start _end GLIBC_2.4 GLIBC_2.2.5 NSS_3.4 NSS_3.12.6 NSS_3.11.4 NSS_3.14 NSS_3.7.4 NSS_3.2 ; 0 ii
] ui g D& s }d { |d td K& B& (! (! ! : ! P 0! @ ! 8! N @! O h! `! p! ! x! ! ! s ! M ! (! 8! ! @! H! p X! !! `! h! x! "! ! ! ! %! ! ! ! &! ! ! ! `)! ! ! ! *! ! L ! ! 2! ! ` (! 8! 7! @! g H! Ў X! >! `! h! p x! ?! ! ! P ! A! ! ! 0 ! C! ! ! ! D! ! ! ! D! ! ! p ! E! ! (! Z 8! F! @! , H! Y X! I! `! h! @r x! K! ! H ! ! @O! ! ! P ! R! !
! p ! U! ! ! n ! X! ! ! n ! X! ! > (! r 8! Y! x! ( ! Q ! `Q ! Z! H! ! P! @! X! ! ! Y ! pQ ! C 0! R ! R ! [! ! ! ! ! ! `! (! PY 8! R ! ! ! Z ! Z ! Z ! ` ! ! ! ! j ! v ! ! (! ` @! H! ` `! h! ` ! ! ` ! ! ! ! ! ! ! ! ! ! ! ! (! 0! 8! `! x h! x! `[! ! f ! ! ! ! Z ! ! ! ! " ! ! ! ! @ ! p ! ! ! ^ ! ~ ! ! ! u (! ~ 8! ! @! H! } X! ! `! ( h! 0} x! ! ! ! | ! ! ! ! | ! ! ! ! p| ! ! ! ! P| ! @! ! ! { ! `! ! (! { 8! ! @!
H! z X! ! `! h! Pz x! ! ! ! y ! @! ! ! Py ! @! ! ! x ! ! ! ! @x ! ! ! ! w ! ! ! (! w 8! @! @! H! v X! ! `! h! u x! ! ! p ! 0u ! ! ! [ ! t ! ! ! ! q ! ! ! ! n ! ! ! ! g ! ! ! 5 (! m 8! ! @! I H! h X! ! `! f h! M x! ! ! } ! M ! ! ! H ! `Z ! ! ! v ! @Q ! ! ! (! S 8! H! P! T `! p! x! S ! h ! ! T ! ! ! S ! ! ! S ! . ! H ! S (! 8! Y @! S P! `! o h! pS x! ! ! `S ! ! ! PS ! 8 ! ! @S ! X ! ! S ! x (! 0! 0S @! P! X! P h! x! ! P ! ! ! Q ! ! H ! a ! ! ! v (! `R 8! ! `! > h! S x! !
! W ! h ! " ! W ! ! 8 ! S ! ! O ! S ! (! 0! R @! P! f X! R h! t x! ! R ! ! ! Q ! ( ! ! Q ! h ! ! Q ! ! ! Q 0! @! H! R X! 0 h!
p! R ! p ! ! R ! ! 1 ! S ! ! ! 0R ! ! ! ! ! ! ! ! (! 0! ) 8! . @! / H! 6 P! O X! Y `! l ! ! ! ! ! ! !
! !
! ! ! ! ! ! ! ! ! ! ! ! (! 0! 8! ! @! " H! # P! $ X! % `! & h! ' p! ( x! ) ! * ! + ! , ! - ! 0 ! 1 ! 2 ! 3 ! 4 ! 5 ! 7 ! 8 ! 9 ! : ! ; ! < ! = ! > ! ? ! @ ! A (! B 0! C 8! D @! E H! F P! G X! H `! I h! J p! K x! L ! M ! N ! P ! Q ! R ! S ! T ! U ! V ! W ! X ! Z ! [ ! \ ! ] ! ^ ! _ ! ` ! a ! b ! c (! d 0! e 8! f @! g H! h P! i X! j `! k h! m p! n x! o ! p ! q ! r ! s ! t ! u ! v ! w ! x H R H5 % @ % h % h % h % h % h % h % h %z h p%r h `%j h P%b h
@%Z h 0%R h %J h
%B h %: h %2 h %* h %" h % h % h %
h % h % h p% h `% h P% h @% h 0% h % h % h % h % h % h! % h" % h# % h$ % h% % h& %z h' p%r h( `%j h) P%b h* @%Z h+ 0%R h, %J h- %B h. %: h/ %2 h0 %* h1 %" h2 % h3 % h4 %
h5 % h6 % h7 p% h8 `% h9 P% h: @% h; 0% h< % h= % h> % h? % h@ % hA % hB % hC % hD % hE % hF %z hG p%r hH `%j hI P%b hJ @%Z hK 0%R hL %J hM %B hN %: hO %2 hP %* hQ %" hR % hS % hT %
hU % hV % hW p% hX `% hY P% hZ @% h[ 0% h\ % h] % h^ % h_ % h` % ha % hb % hc % hd % he % hf %z hg p%r hh ` HH HtHÐU=! HATSubH= t H= H k L%\ H! L)HHH9s D HHm! AHb! H9rN! [A\f H= UHtH HtH= @ ÐH\$Hl$1Ld$HHH=/! 1_! HItHHI! LH $Hl$Ld$Hff. HH! HHH= H5! 1 D HH! 8 Ht8H@H H@P H@X H@` H@h H@p H@x Hffff. H\$Hl$HLd$HHHHIHt
HՅ H{PHt
LՅ H{XHt LՅu~H{`Ht LՅulH{hHt LՅuZH{pHt LՅuHH{xHt LՅu6HCLHHHl$H $Ld$H H H H $Hl$Ld$H D SHHHHtHCH HHHH@ H{PHtHCP HHHH H{XHtHCX HHHH H{`HtHC` HHHH H{hHtHCh HHHHttH{pHtHCp HHHHtDH{xHt HCx HHHHuHGP0HCH[H H D HGP0 HGP0f D HGP0O HGP0 HGP0 HGP0ff. SHwHCH[H H@0fGfuH3 H f D Hq H fff. GfuH H f D HA H fff. GfuH H f D H H fff. HH! HHH= H5! 1 D HH10 Hfff. HGH@ 1Hĩ! f H! ffffff. $1H! f$ H! ffffff. 1Hd! f HQ! ffffff. HG0H( HD$G,HD$ƨ! H(f HH֨! HHH= H5٧! 1 D HH10 Hfff. HGH@ Xp ` P ? / d ` P N L H 8 ( HPO HX? H@/ H0 H H Hl$Ld$IH\$HHHtUH=.! HFHHt^HE HHHE t HHHl$H $Ld$H HEHP0 @ H H52q 1H88f D HE HHHE u
HEHP0HN H5o LH81J|ffff. Hl$Ld$IH\$H HHtUH=^! HfHHt^HE HHHE t HHHl$H $Ld$H HEHP0 @ H H5Rp 1H8Xf D HE HHHE u
HEHP0Hn H5 LH81j|ffff. Ht'H H5 H8131H @ v+H H5S H811H D H Hc H D t> tpH H5J H811HÐ uf D H f f f H H' G fff. G fff. HtOt:t%H H5e H811H @ H H Hffffff. H\$Hl$Ld$Ll$IH( HHtFA<$UHItUA|$@HHt@L1HH HHHl$H\$Ld$Ll$ H( HHHHt1HCH1P0 Hl$Ld$IH\$HHHtUH=! HHHt^HE HHHE t HHHl$H $Ld$H HEHP0 @ HI H5l 1H8f D HE HHHE u
HEHP0H H5 LH81|ffff. HHH
! HLD$Hl 1HfHHH
b! HLD$Hml 1HfHHH
! HLL$ H[l 1ID$ 1t
t$ H<$LH H(HH
r! HD$HLL$H LD$ D$ H$1.1tT$t$|$ H( H\$Hl$HLd$Ll$H8HLD$ HH
! Hk 1D$ u!1HH\$Hl$ Ld$(Ll$0H8 1HHtSHsH=ok 1;HI HH5\k |$ ;! HI HH I$HHI$ S(Hs H=k 1HI |$ HH5j ϟ! HI[ HHX( I$HHI$ S8Hs0H=j 1fHI. |$ HH5j c! HI HH I$HHI$l SHHs@H=.j 1HI |$ HH5Ej ! HI HHP I$HHI$ {L|$ IHH5 j ! HI HH) MtI$HHI$ {PN|$ IHH5i D! HI+ HH5 MtI$HHI$x {N|$ IHH5di ! HI HHq MtI$HHI$, S`HsXH=h 1zHIB |$ HH5i w! HI HH I$HHI$ {d*|$ IHH5h ! HI HH MtI$HHI$ CfHh H=sh HE|$ IHH5dh ! HI HH; MtI$HHI$& CfHh H=h HE.|$ IHH5g D! HI+ HH5 MtI$HHI$ CfHg H=g HE|$ IHH5g ֛! HH HH_ MI$HHI$ID$LP0IE HHIE uIELP0 D I$HHI$u ID$LP0HE HHHE HEH1P0HHHHu
HCHP0Muf D ID$LP0IE HHIE uIELP0ID$LP0(ID$LP0ID$LP0ID$LP0,ID$LP0xID$LP0ID$LP0 ID$LP0lID$LP0ID$LP0(ff. H\$Hl$HLd$Ll$HLt$L|$HHHLD$ H
9! Hd 1D$ u/1HH\$Hl$ Ld$(Ll$0Lt$8L|$@HH 1HHtC HI HsH=+e H@H12HII HH5e |$ 2! HI HH IE HHIE I$HHI$\ {HI DkHgH=c H1DHI HH5c |$ ! HIo HH IE HHIE # I$HHI$ {2H5 d IH|$ +! HI HHV MtIE HHIE { H5c IH|$ ӗ! HI- HH\ MtIE HHIE { 1! HI HH5mc |$ o! HI HH2 IE HHIE T {$1X! HIH HH5 c |$ ! HIo HH IE HHIE {(1! HI HH5b |$ ! HI HH:t IE HHIE SXHsPH=|a 1HHI HH5ub |$ H! HI HH IE HHIE Z s,H{0H
T SH dH%( H$ 1HT$ H1u(H$ dH3%( HĘ [] |$ HHt_1H-HHtqHt$HHuDH$t$HoHuf. H 1i11! YH11! 11z! H1+fffff. U1SHHH5,S HHT$ HL$D$,1u H[] D H{T$Hŋt$ _u#HCH H H[]f H 11ƅ! H[] H\$Hl$H(HT$ HHH5R 11uH\$Hl$ H(f3H{t$ H#u'HH H H\$Hl$ H( D H11&! H\$Hl$ H(ffffff. U1SHHH5R HHT$ D$ 1uH[]f. H{t$ Hu HHh H H[] D H11~! H[]ffffff. H\$Hl$HHH}Hu*HH H H\$Hl$H H`H ! H\$1Hl$1Hffff. U1SHHH5P HHT$ D$ 1uH[]f. cH{t$ Hu HHH H H[] D H11^! H[]ffffff. SHH1 H H5! HDŽ$ HH$ HH5CP H11uHĠ [f. H$ H{HpcuH H HĠ [ 11! @ H\$Hl$HHAHHt)HHHHH\$Hl$H @ HY! H\$1Hl$1Hffff. SHHH5vO 1HHT$HD$ 1u H[ H{Ht$uH H H[ D 11! @ SHHH5O 1HHT$ 1u
H[ @ H{t$ HT$u2D$uHۗ H H[ÐH H H[ 11F! fff. SHHH5N 1HHT$ HL$1u
H[ H{T$t$ uH H H[f11! @ SHHH5:N 11u[ÐH{1 uHZ H [ @ [11H|! fH\$Hl$HHHHt1 H! HHž HH\$Hl$HÐH!! H\$1Hl$1H D SH@HD$( HD$ HD$HD$ HHL$8HT$(Ht$D[H[]A\A]A^A_ IELP0,IELP0HCHP0 H; t D H=X 1hH=qW 1PHYu! H=W Hp1o-H=vV 1WH=cV 1D,H=V 11Lffffff. H\$Hl$HLd$Ll$IH8HR1LIHH Hq LL H{HHE HkHHtHHHHt`H{PHCPHtHHHHt\H{H5 H)uUH H H\$Hl$ Ld$(Ll$0H8f HWHD$R0HD$ D HGP0 Hyt! H\$1Hl$ Ld$(1Ll$0H8 H H5A H81q HɊ H5V H81Q AWAVA AUATIUSHHL$ H{PAHt LpLHI< sLgH 1HLHc豾 HLHc|$ 藾 HLI~6A 1H{PHcH LDeHLMcM9H{HLHHtkH_IE HHIE tAHtHHHHu
HCHP0DýH[]A\A]A^A_f. IELP0H=U 1;VH=U 1#tH=?U 1
H\$Hl$HLd$Ll$H HLD$ HdH%( H$ 1H
}d! H? D$ uE1H$ dH3%( H$ H$ L$ L$ Hĸ @ 蓾Hl$H{T$ IHHI LHp! HHusL/HHt6H=Q? HH1HGHHHHu
HCHP0HE HHHE HEHP01 Lh11q! Tfff. SHHH5> 1HHT$ ڻ1u
H[ @ H{t$ HT$uHc|$XH[f. 11p! H[SHHH5g> 1HHT$ HL$e1u
H[ H{T$t$ uH H H[f11 p! @ HXHH
b! HD$HLL$0LD$8HIS HD$8 H$1HD$0 HD$ 諿u1HX H|$8HT$(H5S< uH|$0HT$ H5=< uHD$(|$Ht$@fD$@HD$ fD$Bbu
H H 11Go! ffff. SHH
a! HHR 1H LL$ LD$HD$ D$ ݾ1u
H [ H\$|$H觽ut$ HH [f 11n! H [SHH
Ua! HH;R 1H LL$ LD$HD$ D$ M1u
H [ H\$|$HWut$ H_H [f 11 n! H [HuH̄ H H Hm! 11Hffffff. HuH H H Hm! 11Hffffff. H迼uHL H H Hqm! 11Hffffff. H H H H HH H H HHH5 ; HT$ 11uHf |$ 蟽uH H H 11l! @ H迼HTfff. UHH
_! HHSP SHhH-? HD$8LL$XLD$\D$\ D$X HD$ HD$@D$T D$P D$L HD$HD$LHl$@HD$8 HD$HD$PHD$HD$TH$11t|H\$@HSH upH9 11HL$81Ht 1H;
v DL$TDD$XL$\t$L|$P$-tAHtHHHHtU11{k! Hh[] @ tYHH轵HHtHHHHt$HE HhH[] D HCHP0 @ HCHP0 @ HH H HRH5N H81蔶1b D UHH
%^! HHN SH8H HD$LL$(LD$,D$, D$( HD$HD$$D$$ H\$H$1V1tYHl$HUH uOH9 11T$$t$(|$,詸tMHtHE HHHE t_11j! H8[]f D taHE HTH HtHE HHHE t"HHH8[] @ HEHP0 @ HEHP0 @ H船H H! HRH5~M H81$1X D UHH
\! HHM SH8H HD$LL$(LD$,D$, D$( HD$HD$$D$$ H\$H$11tYHl$HUH uOH9 11T$$t$(|$,9tMHtHE HHHE t_11h! H8[]f D taHE HH HtHE HHHE t"HHH8[] @ HEHP0 @ HEHP0 @ HH H~ HRH5L H81贳1X D HHH56 HT$ 11uHf |$ Ht$Zu.T$uH~ H Hf D HI~ H H11~g! @ HHH55 HT$ HL$1Y1u H @ t$|$ ˷uH} H H 11g! fff. HHH5?5 HT$ 11uHf |$ Ht$誵u.L$uH } H Hf D HY} H H11f! @ HHH54 HT$ HL$1i1u H @ t$|$ uH} H H 11&f! fff. HHH54 HT$ 11uHf |$ Ht$JuHc|$|H 11e! Hf HHH5-4 HT$ HL$1艰1u H @ t$|$ 軰uH(| H H 11Fe! fff. H=3 H\$Hl$Ld$Ll$Lt$H(HH H53 HHHu L%{ L9`O HH> HHd! HPHd! HPHd! HPHd! H@ Hd! HE HHHE HHHHu
HCHP0H=; VHH H52 H+HH L9` HMH HH"c! HPH c! HPH c! HPHc! H@ Hc! HE HHHE HHHHv H=Q; 課HH> H5N2 HHHn L9`Q H衰H@ Hb! Hƹ HHHHHH HE HHHE u
HEHP0HFb! Ho} H5N! H=: 1A HM! 蕭HH 1HHa! r H H=L! rZ H=L! . HL! qHL! HpHάH=_Q! 2 H=cQ! . H>Q! 1H2Q! HpH莬H=R! H=R! . HR! HR! HpHNH=T! 1H50 HH. Hx D AHH`! b EEt@L-rx 1 LcC|u GH=p`! HLŰD9|HY`! H500 HH觫HH@`! HIH0`! 1L`! H5/ H`! 1L
_! L_! H5/ H`! 1L
_! L_! H5/ Hj`! Z 1L
_! L_! H5/ H=`! - 1L
t_! Le_! H5/ H`! 1L
G_! L8_! H5/ H_! ΰHH _! 蹰HIH _! 1L^! H5e/ H_! 1L
^! L^! H5=/ Hc_! S 1L
^! L^! H5/ H6_! & 1L
}^! Ln^! H5. H _! 1L
P^! LA^! H5. H^! 1L
#^! L^! H5. H^! HH H5. HoHm H讬H
}. HH=u H56C H $Hl$Ld$Ll$H8Lt$ 1H(@ HE HHHE HHHH H $Hl$Ld$Ll$Lt$ H( HCHP0{f HHHH HE HHHE uHEHH@0Y HEHP0ff HEHP0VHEHP0HCHP0iHCHH@0H $Hl$Ld$Ll$Lt$ H( HCHP0TH5+- 1HH(Ht(H5- HīHtSHH
, THHHs H5, H $Hl$Ld$Ll$H8Lt$ 1H(錨H5, Hh`H蘩HtH5, H4HtHwH
, H5, HHGHCH5j, HߪHtH"H
N, oH5B, H§HHH5 , H芪HtHͩH
, H5+ HmeH蝨HH5+ H5HtHxH
+ H5+ HHHHDH5+ HHtH#H
+ pH5}+ HæHHH5h+ H苩HtHΨH
L+ H5@+ HnfH螧HH5#+ H6HtHyH
+ H5* HHIHEH5* HHtH$H
* qH5* HĥHHH5* H茨HtHϧH
z* H5n*
HogH蟦HH5Y* H7HtHzH
=* H51* HHJHFH5* HHtH%H
) rH5) HŤHHH5) H荧HtHЦH
) H5)
HphH蠥HH5) H8HtH{H
t) H5h) HHKHGH5R) HHtH&H
6) sH5*) HƣHHH5) H莦HtHѥH
( H5( HqiH衤HH5( H9HtH|H
( H5( H HLHHH5( HHtH'H
g( tH5[( 1HʢHHH5A( H蒥HtHդH
%( "H5( HumH襣HH5' H=HtH耤H
' H5' H HPHLH5' HHtH+H
' xH5' 1HΡHHH5r' H薤HtH٣H
V' &H5J' HyqH詢HH50' HAHtH脣H
' H5' H$ HTHPH5& HHtH/H
& |H5& HϠHHH5& H藣HtHڢH
& 'H5& HH{sH諡HH5}& HCHtH膢H
a& H5U& 1H)!HYHUH5C& HHtH4H
'& H5& HԟHH H5
& H蜢HtHߡH
% ,H5% HwH诠HH5% HGHtH芡H
% H5% H*"HZHVH5
8 HHtH5H
7 H57 H՞HHH5>% H蝡HtHH
"% -H5% H耞xH谟HH57 HHHtH苠H
l7 H5`7 H+#H[HWH5$ HHtH6H
$ H5$ H֝HHH5x$ H螠HtHH
\$ .H5P$ H聝yH豞HH56 HIHtH茟H
6 H56 H,$H\HXH5# HHtH7H
# H5# HלHHH5/6 H蟟HtHH
6 /H56 H肜zH貝HH5W# HJHtH荞H
;# H5/# H-%H]HYH55 HHtH8H
5 H55 H؛HHH5" H蠞HtHH
" 0H5" H胛{H賜HH5" HKHtH莝H
u" H5i" H.&H^HZH54 HHtH9H
4 H54 H̟ٚHH*N! 跟HIHN! 11LN! H5! HN! 1L
M! LM! H5! HdN! T1L
M! LM! H5! H7N! '1L
M! LM! H53 H
N! 1L
aM! LRM! H5k! HM! 1L
4M! L%M! H5W! HM! 1L
M! LL! H53 HM! s1L
L! LL! H5! HVM! F1L
L! LL! H5b3 H)M! 1L
L! LqL! H5 HL! 1L
SL! LDL!
H5 HL! 1L
&L! LL! H53 HL! 1L
K! LK! H5 HuL! e1L
K! LK!
H52 HHL! 81L
K! LK! H52 HL! 1L
rK! LcK! H5 HK! 1L
EK! L6K! H52 HK! 1L
K! L K! H52 HK! 1L
J! LJ! H5 HgK! W1L
J! LJ! H5c2 H:K! *1L
J! LJ! H5^2 H
K! 1L
dJ! LUJ! H5F HJ! 1L
7J! L(J! H5,2 HJ! 1L
J! LI! H5 HJ! v1L
I! LI! H51 HYJ! I1L
I! LI! H5 H,J! 1L
I! LtI! H51 HI! 1L
VI! LGI! H51 HI! 1L
)I! LI! 4 H51 HI! 1L
H! LH! : H51 HxI! h1L
H! LH! F H51 HKI! ;1L
H! LH! H51 H I! 11L
sH! LdH! H5 HH! 1L
KH! L! L>! c H5- Hv?! f1L
>! L>! e H5- HI?! 91L
>! L>! f H5 H ?! 1L
s>! Ld>! g H5- H>! 1L
F>! L7>! k H5{- H>! 1L
>! L
>! H5v- H>! 1L
=! L=! H5q- Hh>! X1L
=! L=! H5l- H;>! +1L
=! L=! H5g- H>! 1L
e=! LV=! H5b- H=! 1L
8=! L)=! H5]- H=! 1L
=! L;! .1L
:! L:! H5b, H;! 1L
h:! LY:!
H5], H:! 1L
;:! L,:! H5 H:! 1L
:! L9! H5 H:! z1L
9! L9!
H5+ H]:! M1L
9! L9! H5+ H0:! 1L
9! Lx9! H5+ H:! 1L
Z9! LK9! H5 H9! 1L
-9! L 9! H5+ H9! 1L
9! L8! H5+ H|9! l1L
8! L8! H5+ HO9! ?1L
8! L8! H5+ H"9! 1L
y8! Lj8! H5Q H8! 1L
L8! L=8! H5y+ H8! 1L
8! L8! H5l+ H8! 1L
7! L7! H5g+ Hn8! ^1L
7! L7! H5b+ HA8! 11L
7! L7! # H5]+ H8! 1L
k7! L\7! ' H5X+ H7! 1L
>7! L/7! + H5S+ H7! 1L
7! L7! - H5N+ H7! }1L
6! L6! / H5I+ H`7! P1L
6! L6! 1 H5D+ H37! #1L
6! L{6! H5?+ H7! 1L
]6! LN6! H5:+ H6! 1L
06! L!6! H55+ H6! 1L
6! L5! H5
H6! o1L
5! L5! H5
HR6! B1L
5! L5! H5
H%6! 1L
|5! Lm5! H5
H5! L
Q5! LB5! HH5! H $1Hl$Ld$ Ll$Lt$ H5
H(UHSHH`J HtH SJ HHHuH[ÐH识H unable to create object O|i:SSLChannelInformation O|i:SSLCipherSuiteInformation k|i:ssl_library_version_name |i:format_lines %s (0x%x) Cipher Suite Auth Algorithm Key Exchange Type Symmetric Cipher Effective Symmetric Key Bits Symmetric Key Space MAC Algorithm MAC Bits False True FIPS Exportable Nonstandard %d.%d (%s) Auth Key Bits Key Exchange Key Bits Creation Time Last Access Time Expiration Time Compression Method : Session ID SSL Protocol Version %d-bit %s MAC Auth Key Exchange Compression |i:get_ssl_version_range k:ssl_cipher_suite_name I:get_cipher_suite_info lower OO:set_ssl_version_range min max S:ssl_cipher_suite_from_name i:import_tcp_socket iI:rehandshake_timeout i:rehandshake I:force_handshake_timeout i:reset_handshake O!:set_certificate_db s:set_hostname i:get_cipher_pref ii:set_cipher_pref s:set_sock_peer_id isiiss O!O!i:config_secure_server callback must be callable |I:accept NN i:get_ssl_option ii:set_ssl_option I:set_max_server_cache_locks i:get_cipher_policy ii:set_cipher_policy i:get_default_cipher_pref ii:set_default_cipher_pref i:get_ssl_default_option ii:set_ssl_default_option nss.error _C_API ssl_implemented_ciphers SSL_LIBRARY_VERSION_2 SSL_LIBRARY_VERSION_3_0 SSL_LIBRARY_VERSION_TLS_1_0 SSL_LIBRARY_VERSION_TLS_1_1 SSL_LIBRARY_VERSION_TLS_1_2 SSL_LIBRARY_VERSION_TLS_1_3 ssl2 ssl3 tls1.0 tls1.1 tls1.2 tls1.3 module '%s' has no __dict__ ssl_variant_stream SSL_VARIANT_STREAM ssl_variant_datagram SSL_VARIANT_DATAGRAM SSL_SECURITY SSL_SOCKS SSL_REQUEST_CERTIFICATE SSL_HANDSHAKE_AS_CLIENT SSL_HANDSHAKE_AS_SERVER SSL_ENABLE_SSL2 SSL_ENABLE_SSL3 SSL_NO_CACHE SSL_REQUIRE_CERTIFICATE SSL_ENABLE_FDX SSL_V2_COMPATIBLE_HELLO SSL_ENABLE_TLS SSL_ROLLBACK_DETECTION SSL_NO_STEP_DOWN SSL_BYPASS_PKCS11 SSL_NO_LOCKS SSL_NOT_ALLOWED SSL_ALLOWED SSL_RESTRICTED SSL_REQUIRE_NEVER SSL_REQUIRE_ALWAYS SSL_REQUIRE_FIRST_HANDSHAKE SSL_REQUIRE_NO_ERROR SSL_SECURITY_STATUS_NOOPT SSL_SECURITY_STATUS_OFF SSL_SECURITY_STATUS_ON_HIGH SSL_SECURITY_STATUS_ON_LOW SSL_CK_RC4_128_WITH_MD5 SSL_CK_RC2_128_CBC_WITH_MD5 SSL_CK_IDEA_128_CBC_WITH_MD5 SSL_CK_DES_64_CBC_WITH_MD5 SSL_EN_RC4_128_WITH_MD5 SSL_EN_RC2_128_CBC_WITH_MD5 SSL_EN_IDEA_128_CBC_WITH_MD5 SSL_EN_DES_64_CBC_WITH_MD5 SSL_NULL_WITH_NULL_NULL SSL_RSA_WITH_NULL_MD5 SSL_RSA_WITH_NULL_SHA SSL_RSA_WITH_RC4_128_MD5 SSL_RSA_WITH_RC4_128_SHA SSL_RSA_WITH_IDEA_CBC_SHA SSL_RSA_WITH_DES_CBC_SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA SSL_DH_DSS_WITH_DES_CBC_SHA SSL_DH_RSA_WITH_DES_CBC_SHA SSL_DHE_DSS_WITH_DES_CBC_SHA SSL_DHE_RSA_WITH_DES_CBC_SHA SSL_DH_ANON_WITH_RC4_128_MD5 SSL_DH_ANON_WITH_DES_CBC_SHA TLS_NULL_WITH_NULL_NULL TLS_RSA_WITH_NULL_MD5 TLS_RSA_WITH_NULL_SHA TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_IDEA_CBC_SHA TLS_RSA_WITH_DES_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_DH_DSS_WITH_DES_CBC_SHA TLS_DH_RSA_WITH_DES_CBC_SHA TLS_DHE_DSS_WITH_DES_CBC_SHA TLS_DHE_RSA_WITH_DES_CBC_SHA TLS_DH_anon_WITH_RC4_128_MD5 TLS_DH_anon_WITH_DES_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_NULL_SHA256 TLS_DHE_DSS_WITH_RC4_128_SHA TLS_RSA_WITH_SEED_CBC_SHA TLS_FALLBACK_SCSV TLS_ECDH_ECDSA_WITH_NULL_SHA TLS_ECDHE_ECDSA_WITH_NULL_SHA TLS_ECDH_RSA_WITH_NULL_SHA TLS_ECDH_RSA_WITH_RC4_128_SHA TLS_ECDHE_RSA_WITH_NULL_SHA TLS_ECDH_anon_WITH_NULL_SHA SSL_RSA_FIPS_WITH_DES_CBC_SHA SRTP_AES128_CM_HMAC_SHA1_80 SRTP_AES128_CM_HMAC_SHA1_32 SRTP_NULL_HMAC_SHA1_80 SRTP_NULL_HMAC_SHA1_32 nss.io nss.nss nss.ssl nss.ssl.SSLSocket config_mp_server_sid_cache get_max_server_cache_locks clear_session_cache set_domestic_policy set_export_policy set_france_policy ssl_library_version_from_name get_default_ssl_version_range set_default_ssl_version_range nss.ssl.SSLCipherSuiteInfo nss.ssl.SSLChannelInfo level repr_kind min_version max_version protocol_variant ssl_library_version max_cache_entries max_cert_cache_entries max_server_name_cache_entries ssl2_timeout ssl3_timeout directory enable_mp_cache set_auth_certificate_callback set_client_auth_data_callback set_handshake_callback set_pkcs11_pin_arg get_pkcs11_pin_arg get_peer_certificate get_certificate invalidate_session data_pending get_security_status get_session_id get_hostname force_handshake get_ssl_channel_info get_negotiated_host connection_info_format_lines connection_info_format connection_info_str cipher_suite Returns the cipher suite enum Returns the cipher suite name auth_algorithm auth_algorithm_name kea_type Returns the kea type enum kea_type_name Returns the kea type name symmetric_cipher symmetric_cipher_name symmetric_key_bits symmetric_key_space effective_key_bits mac_algorithm mac_algorithm_name mac_bits Returns the mac bits is_fips is_exportable is_nonstandard protocol_version_str protocol_version_enum major_protocol_version minor_protocol_version auth_key_bits Returns the auth key bits kea_key_bits Returns the kea key bits creation_time creation_time_utc last_access_time last_access_time_utc expiration_time expiration_time_utc compression_method compression_method_name SSL Library Version name not found: %lu Verson %d.%d has unkown minor version Verson %d.%d has unkown major version Unsupported representation kind (%d) cipher suite name not found: %lu II|i:get_ssl_version_from_major_minor ssl library version name must be a string, not %.200s ssl_library_version name not found: %s ssl library %s version value be an integer or string, not %.200s S:ssl_library_version_from_name cipher suite name must be a string, not %.200s cipher suite name not found: %s set_handshake_callback: missing callback argument SSLSocket.handshake_callback: out of memory
exception in SSLSocket.handshake_callback
set_client_auth_data_callback: missing callback argument SSLSocket.client_auth_data_callback: out of memory
exception in SSLSocket.client_auth_data_callback
SSLSocket.client_auth_data_callback: 1st return value must be %s or None
SSLSocket.client_auth_data_callback: expected 2nd return value
SSLSocket.client_auth_data_callback: 2nd return value must be %s or None
SSLSocket.client_auth_data_callback: unexpected return value, must be False or the tuple (None) or the tuple (cert, priv_key)
set_auth_certificate_callback: missing callback argument SSLSocket.auth_certificate_func: out of memory
SSLSocket.auth_certificate_func: cannot create socket object
exception in SSLSocket.auth_certificate_func
OO|k:set_default_ssl_version_range |ki:get_default_ssl_version_range |ki:get_supported_ssl_version_range |iiiIIO:config_server_session_id_cache_with_opt directory must be string or None, not %.200s |iIIO:config_mp_server_sid_cache |iIIO:config_server_session_id_cache module '%s' already contains %s SSL_CK_RC4_128_EXPORT40_WITH_MD5 SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 SSL_CK_DES_192_EDE3_CBC_WITH_MD5 SSL_EN_RC4_128_EXPORT40_WITH_MD5 SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5 SSL_EN_DES_192_EDE3_CBC_WITH_MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 SSL_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DH_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_DH_DSS_WITH_3DES_EDE_CBC_SHA SSL_DH_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DH_RSA_WITH_3DES_EDE_CBC_SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA SSL_DH_ANON_EXPORT_WITH_DES40_CBC_SHA SSL_DH_ANON_WITH_3DES_EDE_CBC_SHA SSL_DH_ANON_EXPORT_WITH_RC4_40_MD5 TLS_DH_ANON_WITH_AES_128_CBC_SHA TLS_DH_ANON_WITH_AES_256_CBC_SHA TLS_DH_ANON_WITH_CAMELLIA_128_CBC_SHA TLS_DH_ANON_WITH_CAMELLIA_256_CBC_SHA TLS_RSA_EXPORT_WITH_RC4_40_MD5 TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5 TLS_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DH_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA TLS_DH_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA TLS_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DH_anon_EXPORT_WITH_RC4_40_MD5 TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA TLS_DH_anon_WITH_3DES_EDE_CBC_SHA SSL_FORTEZZA_DMS_WITH_NULL_SHA SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA SSL_FORTEZZA_DMS_WITH_RC4_128_SHA TLS_DH_DSS_WITH_AES_128_CBC_SHA TLS_DH_RSA_WITH_AES_128_CBC_SHA TLS_DHE_DSS_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DH_anon_WITH_AES_128_CBC_SHA TLS_DH_DSS_WITH_AES_256_CBC_SHA TLS_DH_RSA_WITH_AES_256_CBC_SHA TLS_DHE_DSS_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_DH_anon_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA256 TLS_RSA_WITH_CAMELLIA_128_CBC_SHA TLS_DH_DSS_WITH_CAMELLIA_128_CBC_SHA TLS_DH_RSA_WITH_CAMELLIA_128_CBC_SHA TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA TLS_DH_anon_WITH_CAMELLIA_128_CBC_SHA TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA TLS_RSA_EXPORT1024_WITH_RC4_56_SHA TLS_DHE_DSS_EXPORT1024_WITH_DES_CBC_SHA TLS_DHE_DSS_EXPORT1024_WITH_RC4_56_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 TLS_RSA_WITH_CAMELLIA_256_CBC_SHA TLS_DH_DSS_WITH_CAMELLIA_256_CBC_SHA TLS_DH_RSA_WITH_CAMELLIA_256_CBC_SHA TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA TLS_DH_anon_WITH_CAMELLIA_256_CBC_SHA TLS_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 TLS_EMPTY_RENEGOTIATION_INFO_SCSV TLS_ECDH_ECDSA_WITH_RC4_128_SHA TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDHE_ECDSA_WITH_RC4_128_SHA TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA TLS_ECDH_RSA_WITH_AES_128_CBC_SHA TLS_ECDH_RSA_WITH_AES_256_CBC_SHA TLS_ECDHE_RSA_WITH_RC4_128_SHA TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA TLS_ECDH_anon_WITH_RC4_128_SHA TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA TLS_ECDH_anon_WITH_AES_128_CBC_SHA TLS_ECDH_anon_WITH_AES_256_CBC_SHA TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 SSL_RSA_OLDFIPS_WITH_3DES_EDE_CBC_SHA SSL_RSA_OLDFIPS_WITH_DES_CBC_SHA SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA config_server_session_id_cache shutdown_server_session_id_cache get_ssl_version_from_major_minor get_supported_ssl_version_range Returns the auth algorithm enum Returns the auth algorithm name Returns the symmetric cipher enum Returns the symmetric cipher name Returns the symmetric key bits Returns the symmetric key space Returns the effective key bits Returns the mac algorithm enum Returns the mac algorithm name Returns True if FIPS, False otherwise Returns True if exportable, False otherwise Returns True if nonstandard, False otherwise Returns the protocol version, major in octet[1], minor in octet[0] Returns the protocol version as a descriptive string Returns the protocol version as an enumerated constant Returns the major protocol version Returns the minor protocol version Returns creation time as a DateTime object in local time zone Returns creation time as a DateTime object in UTC time zone Returns last access time as a DateTime object in local time zone Returns last access time as a DateTime object in UTC time zone Returns expiration time as a DateTime object in local time zone Returns expiration time as a DateTime object in UTC time zone Returns the compression method enum Returns the compression method name Returns the session ID as a SecItem object aa`a(aa; { W LX lX4 |XL Xd Y L[ l[ [ [ [ \, ,\D L\\ \\t l\ \ \ \ \ \ ] <]4 L]L l]d |]| ] ] ] ] ] ] ]$ ]< ^T ^l ,^ <^ L^ \^ l^ |^ ^ ^, ^D ^\ ^t ^ _ ` a a, aD lbt ,c d F NF ^F nF ~F F F F F F F F F G G .G >G NG ^G nG ~G G G G G G G G G H H .H >H NH ^H nH ~H H H H H H H H H I I .I >I NI ^I nI ~I I I I I I I I I J J .J >J NJ ^J nJ ~J J J J J J J J J K K .K >K NK ^K nK ~K K K K K K K K K L L .L >L NL This module implements the SSL functionality in NSS
SSL Version Range API
=====================
This API should be used to control SSL 3.0 & TLS support instead of
the older `SSLSocket.set_ssl_option()` API; however,
`SSLSocket.set_ssl_option()` API MUST still be used to control SSL 2.0
support. In this version of libssl, SSL 3.0 and TLS 1.0 are enabled by
default. Future versions of libssl may change which versions of the
protocol are enabled by default.
The protocol_variant enums (SSL_VARIANT_STREAM, SSL_VARIANT_DATAGRAM)
indicates whether the protocol is of type stream or datagram. This
must be provided to the functions that do not take an fd. Functions
which take an fd will get the variant from the fd.
Using the new version range API in conjunction with the older
`SSLSocket.set_ssl_option()` API for controlling the enabled protocol
versions may cause unexpected results. Going forward, we guarantee
only the following:
``SSLSocket.get_ssl_option(ssl.SSL_ENABLE_TLS)`` will return True if
*ANY* versions of TLS are enabled.
``SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, False)`` will disable
*ALL* versions of TLS, including TLS 1.0 and later.
The above two properties provide compatibility for applications that
use `SSLSocket.set_ssl_option()` to implement the insecure fallback
from TLS 1.x to SSL 3.0.
``SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True)`` will enable TLS
1.0, and may also enable some later versions of TLS, if it is
necessary to do so in order to keep the set of enabled versions
contiguous. For example, if TLS 1.2 is enabled, then after
``SSLSocket.set_ssl_option(ss.SSL_ENABLE_TLS, True)``, TLS 1.0, TLS
1.1, and TLS 1.2 will be enabled, and the call will have no effect on
whether SSL 3.0 is enabled. If no later versions of TLS are enabled at
the time ``SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True)`` is
called, then no later versions of TLS will be enabled by the call.
``SSLSocket.set_ssl_option(ssl.SSL_ENABLE_SSL3, False)`` will disable
SSL 3.0, and will not change the set of TLS versions that are enabled.
``SSLSocket.set_ssl_option(ssl.SSL_ENABLE_SSL3, True)`` will enable SSL
3.0, and may also enable some versions of TLS if TLS 1.1 or later is
enabled at the time of the call, the same way
``SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True)`` works, in order
to keep the set of enabled versions contiguous.
SSLSocket(family=PR_AF_INET, type=PR_DESC_SOCKET_TCP)
:Parameters:
family : integer
one of:
- PR_AF_INET
- PR_AF_INET6
- PR_AF_LOCAL
type : integer
one of:
- PR_DESC_SOCKET_TCP
- PR_DESC_SOCKET_UDP
Create a new NSPR SSL socket:
set_ssl_default_option(option, value)
Changes the default value of a specified SSL option for all
subsequently opened sockets as long as the current application program
is running. Refer to the documentation for `SSLSocket.set_ssl_option()`
for an explanation of the possible values.
get_ssl_default_option(value)
Gets the default value of a specified SSL option for all
subsequently opened sockets as long as the current application program
is running. Refer to the documentation for `SSLSocket.set_ssl_option()`
for an explanation of the possible values.
set_cipher_pref(cipher, enabled)
:Parameters:
cipher : integer
The cipher suite enumeration (e.g. SSL_RSA_WITH_NULL_MD5, etc.)
enabled : bool
Boolean value
Sets the application default preference for the specified SSL2, SSL3,
or TLS cipher. A cipher suite is used only if the policy allows it and
the preference for it is set to True.
This function must be called once for each cipher you want to enable
or disable by default.
Note, which cipher suites are permitted or disallowed are modified by
previous calls to one or more of the SSL Export Policy Functions.
get_default_cipher_pref(cipher) -> enabled
:Parameters:
cipher : integer
The cipher suite enumeration (e.g. SSL_RSA_WITH_NULL_MD5, etc.)
Returns the application default preference for the specified SSL2,
SSL3, or TLS cipher.
set_cipher_pref(cipher, enabled)
:Parameters:
cipher : integer
The cipher suite enumeration (e.g. SSL_RSA_WITH_NULL_MD5, etc.)
enabled : bool
Boolean value
Tells the SSL library that the specified cipher suite is allowed by
the application's export license, or is not allowed by the
application's export license, or is allowed to be used only with a
Step-Up certificate. It overrides the factory default policy for that
cipher suite. The default policy for all cipher suites is
SSL_NOT_ALLOWED, meaning that the application's export license does
not approve the use of this cipher suite. A U.S.domestic version of a
product typically sets all cipher suites to SSL_ALLOWED. This setting
is used to separate export and domestic versions of a product, and is
not intended to express user cipher preferences.
get_cipher_policy(cipher) -> policy
:Parameters:
cipher : integer
The cipher suite enumeration (e.g. SSL_RSA_WITH_NULL_MD5, etc.)
Returns the cipher policy. config_server_session_id_cache(max_cache_entries=0, ssl2_timeout=0, ssl3_timeout=0, directory=None)
:Parameters:
max_cache_entries : integer
The maximum number of entries in the cache. If ZERO the server
default value is used (10,000).
ssl2_timeout : integer
The lifetime in seconds of an SSL2 session. The minimum timeout
value is 5 seconds and the maximum is 24 hours. Values outside
this range are replaced by the server default value (100 seconds).
ssl3_timeout : integer
The lifetime in seconds of an SSL3 session. The minimum timeout
value is 5 seconds and the maximum is 24 hours. Values outside
this range are replaced by the server default value (24 hours).
directory : string
A string specifying the pathname of the directory that will
contain the session cache. If None the server default value is
used (/tmp (Unix) or \temp (NT)).
If you are writing an application which will use SSL sockets to
handshake as a server, you must call config_server_session_id_cache()
to configure the session caches for server sessions.
If your server application uses multiple processes (instead of or in
addition to multiple threads), use `ssl.config_mp_server_sid_cache()`
instead. You must use one of these functions to create a server
cache.
This function creates two caches: the server session ID cache (also
called the server session cache, or server cache), and the client-auth
certificate cache (also called the client cert cache, or client auth
cache). Both caches are used only for sessions where the program will
handshakes as a server. The client-auth certificate cache is used to
remember the certificates previously presented by clients for client
certificate authentication.
A zero value or a value that is out of range for any of the parameters
causes the server default value to be used in the server cache. Note,
this function only affects the server cache, not the client cache.
config_mp_server_sid_cache(max_cache_entries=0, ssl2_timeout=0, ssl3_timeout=0, directory=None)
:Parameters:
max_cache_entries : integer
The maximum number of entries in the cache. If ZERO the server
default value is used (10,000).
ssl2_timeout : integer
The lifetime in seconds of an SSL2 session. The minimum timeout
value is 5 seconds and the maximum is 24 hours. Values outside
this range are replaced by the server default value (100 seconds).
ssl3_timeout : integer
The lifetime in seconds of an SSL3 session. The minimum timeout
value is 5 seconds and the maximum is 24 hours. Values outside
this range are replaced by the server default value (24 hours).
directory : string
A string specifying the pathname of the directory that will
contain the session cache. If None the server default value is
used (/tmp (Unix) or \temp (NT)).
This function sets up a Server Session ID (SID) cache that is safe for
access by multiple processes on the same system.
Like `ssl.config_server_session_id_cache()`, with one important
difference. If the application will run multiple processes (as
opposed to, or in addition to multiple threads), then it must call
this function, instead of calling
`ssl.config_server_session_id_cache()`. This has nothing to do with
the number of processors, only processes.
config_server_session_id_cache_with_opt(max_cache_entries=0, max_cert_cache_entries=0, max_server_name_cache_entries=0, ssl2_timeout=0, ssl3_timeout=0, directory=None, enable_mp_cache=False)
:Parameters:
max_cache_entries : integer
The maximum number of entries in the cache. If ZERO the server
default value is used (10,000).
max_cert_cache_entries : integer
The maximum number of entries in the cert cache. If ZERO the server
default value is used (10,000).
max_server_name_cache_entries : integer
The maximum number of entries in the server name cache. If ZERO the server
default value is used (10,000).
ssl2_timeout : integer
The lifetime in seconds of an SSL2 session. The minimum timeout
value is 5 seconds and the maximum is 24 hours. Values outside
this range are replaced by the server default value (100 seconds).
ssl3_timeout : integer
The lifetime in seconds of an SSL3 session. The minimum timeout
value is 5 seconds and the maximum is 24 hours. Values outside
this range are replaced by the server default value (24 hours).
directory : string
A string specifying the pathname of the directory that will
contain the session cache. If None the server default value is
used (/tmp (Unix) or \temp (NT)).
enable_mp_cache : bool
If True enable the multi-process cache.
Configure a secure server's session-id cache. Depends on value of
enable_mp_cache, configures multi-proc or single proc cache.
A zero value or a value that is out of range for any of the parameters
causes the server default value to be used in the server cache. Note,
this function only affects the server cache, not the client cache.
get_max_server_cache_locks() -> int
Get the configured maximum number of mutexes used for the server's
store of SSL sessions. This value is used by the server session ID
cache initialization functions.
set_max_server_cache_locks(max_locks)
:Parameters:
max_locks : int
Maximum number of locks
Set the configured maximum number of mutexes used for the server's
store of SSL sessions. This value is used by the server session ID
cache initialization functions. Note that on some platforms, these
mutexes are actually implemented with POSIX semaphores, or with
unnamed pipes. The default value varies by platform. An attempt to
set a too-low maximum will return an error and the configured value
will not be changed.
clear_session_cache()
You must call ssl.clear_session_cache() after you use one of the SSL
Export Policy Functions to change cipher suite policy settings or use
ssl.set_default_cipher_pref() to enable or disable any cipher
suite. Otherwise, the old settings remain in the session cache and
will be used instead of the new settings. This function clears only
the client cache. The client cache is not configurable. It is located
in RAM (not on disk).
shutdown_server_session_id_cache()
set_domestic_policy()
Configures cipher suites to conform with current U.S. export
regulations related to domestic software products with encryption
features.
set_export_policy()
Configures the SSL cipher suites to conform with current U.S. export
regulations related to international software products with encryption
features.
set_france_policy()
Configures the SSL cipher suites to conform with French import
regulations related to software products with encryption features.
get_ssl_version_from_major_minor(major, minor, repr_kind=AsString) -> Object
:Parameters:
major : int
The major version number.
minor : int
The minor version number.
repr_kind : RepresentationKind constant
Specifies what format the return value will be in.
May be one of:
AsEnum
The enumerated constant as an integer value.
AsEnumName
The name of the enumerated constant as a string.
AsString
A short friendly name for the enumerated constant.
Given the major and minor SSL protocol versions return the SSL version
it's according to repr_kind
Example:
get_ssl_version_from_major_minor(3, 1, nss.AsString) -> 'tls1.0'
ssl_library_version_name(ssl_library_version, repr_kind=AsEnumName) -> string
:Parameters:
ssl_library_version : int
SSL_LIBRARY_VERSION constant
repr_kind : RepresentationKind constant
Specifies what format the contents of the returned tuple will be in.
May be one of:
AsEnum
The enumerated constant as an integer value.
AsEnumName
The name of the enumerated constant as a string.
AsString
A short friendly name for the enumerated constant.
Given a SSL_LIBRARY_VERSION constant
return it's according to repr_kind
ssl_library_version_from_name(name) -> int
:Parameters:
name : string
name of SSL_LIBRARY_VERSION
Given the name of a SSL_LIBRARY_VERSION
return it's integer constant
The string comparison is case insensitive.
In addition to the names of the SSL_LIBRARY_VERSION constants
the following aliases are recognized:
+--------+-----------------------------+
| Alias | Constant |
+========+=============================+
| ssl2 | SSL_LIBRARY_VERSION_2 |
+--------+-----------------------------+
| ssl3 | SSL_LIBRARY_VERSION_3_0 |
+--------+-----------------------------+
| tls1.0 | SSL_LIBRARY_VERSION_TLS_1_0 |
+--------+-----------------------------+
| tls1.1 | SSL_LIBRARY_VERSION_TLS_1_1 |
+--------+-----------------------------+
| tls1.2 | SSL_LIBRARY_VERSION_TLS_1_2 |
+--------+-----------------------------+
| tls1.3 | SSL_LIBRARY_VERSION_TLS_1_3 |
+--------+-----------------------------+
get_supported_ssl_version_range(protocol_variant=SSL_VARIANT_STREAM, repr_kind=AsEnum) -> (min_version, max_version)
:Parameters:
protocol_variant : int
One of: SSL_VARIANT_STREAM or SSL_VARIANT_DATAGRAM
enumerated constants
repr_kind : RepresentationKind constant
Specifies what format the contents of the returned tuple will be in.
May be one of:
AsEnum
The enumerated constant as an integer value.
AsEnumName
The name of the enumerated constant as a string.
AsString
A short friendly name for the enumerated constant.
Returns the range of SSL3/TLS versions supported for the
given protocol variant by the version of libssl linked-to at runtime.
The result is a tuple of enumerations (min_version, max_version).
get_default_ssl_version_range(protocol_variant=SSL_VARIANT_STREAM, repr_kind=AsEnum) -> (min_version, max_version)
:Parameters:
protocol_variant : int
One of: SSL_VARIANT_STREAM or SSL_VARIANT_DATAGRAM
enumerated constants
repr_kind : RepresentationKind constant
Specifies what format the contents of the returned tuple will be in.
May be one of:
AsEnum
The enumerated constant as an integer value.
AsEnumName
The name of the enumerated constant as a string.
AsString
A short friendly name for the enumerated constant.
Returns the range of SSL3/TLS versions enabled by default for the given
protocol variant.
The result is a tuple of enumerations (min_version, max_version).
set_default_ssl_version_range(min_version, max_version, protocol_variant=SSL_VARIANT_STREAM)
:Parameters:
min_version : int or string
Either a SSL_LIBRARY_VERSION_* enumerated constant or it's
string equivalent, see `ssl_library_version_from_name()`
max_version : int or string
Either a SSL_LIBRARY_VERSION_* enumerated constant or it's
string equivalent, see `ssl_library_version_from_name()`
protocol_variant : int
One of: SSL_VARIANT_STREAM or SSL_VARIANT_DATAGRAM
enumerated constants
Sets the range of SSL3/TLS versions enabled by default for the given
protocol variant.
get_cipher_suite_info(suite) -> SSLCipherSuiteInfo
:Parameters:
suite : int
a cipher suite enumerated constant
Returns a `ssl.SSLCipherSuiteInfo`.
ssl_cipher_suite_name(cipher) -> string
:Parameters:
cipher : int
SSL cipher enumerated constant
Given an enumerated SSL Cipher constant
return it's name as a string
ssl_cipher_suite_from_name(name) -> int
:Parameters:
name : string
name of SSL cipher enumerated constant
Given the name of a SSL cipher constant
return it's integer constant
The string comparison is case insensitive.
SSLCipherSuiteInformation(obj)
An object representing SSLCipherSuiteInformation.
SSLChannelInformation(obj)
An object representing SSLChannelInformation.
set_ssl_option(option, value)
Sets a single configuration parameter on this socket. Call once for
each parameter you want to change. The configuration parameters are
listed below.
SSL_SECURITY (default=True)
Enables use of security protocol. *WARNING: If you turn this option
off, the session will not be an SSL session and will not have
certificate-based authentication, tamper detection, or encryption.*
SSL_REQUEST_CERTIFICATE: (default=False)
Is a server option that requests a client to authenticate itself.
SSL_REQUIRE_CERTIFICATE: (default=SSL_REQUIRE_FIRST_HANDSHAKE)
Is a server option that requires a client to authenticate itself (only
if SSL_REQUEST_CERTIFICATE is also on). If client does not provide
certificate, the connection terminates.
SSL_HANDSHAKE_AS_CLIENT: (default=False)
Controls the behavior of `SSLSocket.accept()`,. If this option is off,
the `SSLSocket.accept()` configures the SSL socket to handshake as a
server. If it is on, then `SSLSocket.accept()` configures the SSL socket
to handshake as a client, even though it accepted the connection as a
TCP server.
SSL_HANDSHAKE_AS_SERVER: (default=False)
Controls the behavior of `SSLSocket.connect()`. If this option is off,
then `SSLSocket.connect()` configures the SSL socket to handshake as a
client. If it is on, then `SSLSocket.connect()` configures the SSL
socket to handshake as a server, even though it connected as a TCP
client.
SSL_ENABLE_FDX: (default=False)
Tells the SSL library whether the application will have two threads,
one reading and one writing, or just one thread doing reads and writes
alternately. The factory setting for this option (which is the
default, unless the application changes the default) is off, which
means that the application will not do simultaneous reads and
writes. An application that needs to do simultaneous reads and writes
should set this to True.
In NSS 2.8, the SSL_ENABLE_FDX option only affects the behavior of
nonblocking SSL sockets. See the description below for more
information on this option.
SSL_ENABLE_SSL3: (default=True)
Enables the application to communicate with SSL v3. If you turn this
option off, an attempt to establish a connection with a peer that
understands only SSL v3 will fail. [1]_
SSL_ENABLE_SSL2: (default=True)
Enables the application to communicate with SSL v2. If you turn this
option off, an attempt to establish a connection with a peer that
understands only SSL v2 will fail. [1]_
SSL_ENABLE_TLS: (default=True)
Is a peer of the SSL_ENABLE_SSL2 and SSL_ENABLE_SSL3 options. The IETF
standard Transport Layer Security (TLS) protocol, RFC 2246, is a
modified version of SSL3. It uses the SSL version number 3.1,
appearing to be a 'minor' revision of SSL3.0. NSS 2.8 supports TLS in
addition to SSL2 and SSL3. You can think of it as 'SSL_ENABLE_SSL3.1.'
See the description below for more information about this option. [1]_
SSL_V2_COMPATIBLE_HELLO: (default=True)
Tells the SSL library whether or not to send SSL3 client hello
messages in SSL2-compatible format. If set to True, it will;
otherwise, it will not. See the description below for more information
on this option.
SSL_NO_CACHE: (default=False)
Disallows use of the session cache. Factory setting is off. If you
turn this option on, this socket will be unable to resume a session
begun by another socket. When this socket's session is finished, no
other socket will be able to resume the session begun by this socket.
SSL_ROLLBACK_DETECTION: (default=True)
Disables detection of a rollback attack. Factory setting is on. You
must turn this option off to interoperate with TLS clients ( such as
certain versions of Microsoft Internet Explorer) that do not conform
to the TLS specification regarding rollback attacks. Important:
turning this option off means that your code will not comply with the
TLS 3.1 and SSL 3.0 specifications regarding rollback attack and will
therefore be vulnerable to this form of attack.
Keep the following in mind when deciding on the operating parameters
you want to use with a particular socket.
Turning on SSL_REQUIRE_CERTIFICATE will have no effect unless
SSL_REQUEST_CERTIFICATE is also turned on. If you enable
SSL_REQUEST_CERTIFICATE, then you should explicitly enable or disable
SSL_REQUIRE_CERTIFICATE rather than allowing it to default. Enabling
the SSL_REQUIRE_CERTIFICATE option is not recommended. If the client
has no certificate and this option is enabled, the client's connection
terminates with an error. The user is likely to think something is
wrong with either the client or the server, and is unlikely to realize
that the problem is the lack of a certificate. It is better to allow
the SSL handshake to complete and then return an error message to the
client that informs the user of the need for a certificate.
The SSL protocol is defined to be able to handle simultaneous two-way
communication between applications at each end of an SSL
connection. Two-way simultaneous communication is also known as'Full
Duplex', abbreviated FDX. However, most application protocols that use
SSL are not two-way simultaneous, but two-way alternate, also known as
'Half Dupled'; that is, each end takes turns sending, and each end is
either sending, or receiving, but not both at the same time. For an
application to do full duplex, it would have two threads sharing the
socket; one doing all the reading and the other doing all the writing.
The SSL_ENABLE_FDX option tells the SSL library whether the
application will have two threads, one reading and one writing, or
just one thread doing reads and writes alternately.
If an SSL3 client hello message is sent to a server that only
understands SSL2 and not SSL3, then the server will interpret the SSL3
client hello as a very large message, and the connection will usually
seem to 'hang' while the SSL2 server expects more data that will never
arrive. For this reason, the SSL3 spec allows SSL3 client hellos to be
sent in SSL2 format, and it recommends that SSL3 servers all accept
SSL3 client hellos in SSL2 format. When an SSL2-only server receives
an SSL3 client hello in SSL2 format, it can (and probably will)
negotiate the protocol version correctly, not causing a 'hang'.
Some applications may wish to force SSL3 client hellos to be sent in
SSL3 format, not in SSL2-compatible format. They might wish to do this
if they knew, somehow, that the server does not understand
SSL2-compatible client hello messages.
SSL_V2_COMPATIBLE_HELLO tells the SSL library whether or not to send
SSL3 client hello messages in SSL2-compatible format. Note that
calling `SSLSocket.set_ssl_option()` to set SSL_V2_COMPATIBLE_HELLO to
False implicitly also sets the SSL_ENABLE_SSL2 option to False for
that SSL socket. Calling SSL_EnableDefault to change the application
default setting for SSL_V2_COMPATIBLE_HELLO to False implicitly also
sets the default value for SSL_ENABLE_SSL2 option to False for that
application.
The options SSL_ENABLE_SSL2, SSL_ENABLE_SSL3, and SSL_ENABLE_TLS can
each be set to True or False independently of each other. NSS 2.8 and
later versions will negotiate the highest protocol version with the
peer application from among the set of protocols that are commonly
enabled in both applications. [1]_
Note that SSL3 and TLS share the same set of cipher suites. When both
SSL3 and TLS are enabled, all SSL3/TLS cipher suites that are enabled
are enabled for both SSL3 and TLS.
When an application imports a socket into SSL after the TCP connection
on that socket has already been established, it must call
`SSLSocket.reset_handshake()` to indicate whether the socket is for a
client or server. At first glance this may seem unnecessary, since
`SSLSocket.set_ssl_option()` can set SSL_HANDSHAKE_AS_CLIENT or
SSL_HANDSHAKE_AS_SERVER. However, these settings control the behavior
of `SSLSocket.connect()` and `SSLSocket.accept()` only; if you don't call
one of those functions after importing a non-SSL socket with
SSL_Import (as in the case of an already established TCP connection),
SSL still needs to know whether the application is functioning as a
client or server.
If a socket file descriptor is imported as an SSL socket before it is
connected, it is implicitly configured to handshake as a client or
handshake as a server when the connection is made. If the application
calls `SSLSocket.connect()` (connecting as a TCP client), then the SSL
socket is (by default) configured to handshake as an SSL client. If
the application calls `SSLSocket.accept()` (connecting the socket as a
TCP server) then the SSL socket is (by default) configured to
handshake as an SSL server. SSL_HANDSHAKE_AS_CLIENT and
SSL_HANDSHAKE_AS_SERVER control this implicit configuration. Both
SSL_HANDSHAKE_AS_CLIENT and SSL_HANDSHAKE_AS_SERVER are initially set
to off--that is, the process default for both values is False when the
process begins. The process default can be changed from the initial
values by using SSL_EnableDefault, and the value for a particular
socket can be changed by using `SSLSocket.set_ssl_option()`.
If a socket that is already connected gets imported into SSL after it
has been connected (that is, after `SSLSocket.accept()` or
`SSLSocket.connect()` has returned), then no implicit SSL handshake
configuration as a client or server will have been done by
`SSLSocket.connect()` or `SSLSocket.accept()` on that socket. In this
case, a call to `SSLSocket.reset_handshake()` is required to explicitly
configure the socket to handshake as a client or as a server. If
`SSLSocket.reset_handshake()` is not called to explicitly configure the
socket handshake, a crash is likely to occur when the first I/O
operation is done on the socket after it is imported into SSL.
.. [1] See the "SSL Version Range API" section in the module
documentation for updated recomendations on protocol selection.
get_ssl_option(value) -> value
:Parameters:
value : integer
a constant value identifying which option to query
Retrieves the value of a specified SSL option. Refer to the
documentation for `SSLSocket.set_ssl_option()` for an explanation of the
possible values.
accept(timeout=PR_INTERVAL_NO_TIMEOUT) -> (Socket, NetworkAddress)
:Parameters:
timeout : integer
optional timeout value expressed as a NSPR interval
The socket is a rendezvous socket that has been bound to an address
with Socket.bind() and is listening for connections after a call to
Socket.listen(). Socket.accept() accepts the first connection from the
queue of pending connections and creates a new socket for the newly
accepted connection. The rendezvous socket can still be used to accept
more connections.
Socket.accept() blocks the calling thread until either a new
connection is successfully accepted or an error occurs. If the timeout
parameter is not PR_INTERVAL_NO_TIMEOUT and no pending connection can
be accepted before the time limit, Socket.accept() raises a
nss.error.NSPRError exception with the error code PR_IO_TIMEOUT_ERROR.
Socket.accept() returns a tuple containing a new Socket object and
Networkaddress object for the peer.
set_auth_certificate_callback(callback, [user_data1, ...])
:Parameters:
callback : function pointer
callback to invoke
user_dataN:
zero or more caller supplied parameters which will be passed to the callback
The callback has the following signature::
callback(socket, check_sig, is_server, [user_data1, ...]) -> bool
socket
the SSLSocket object
check_sig
boolean, True means signatures are to be checked and the
certificate chain is to be validated. False means they are not
to be checked. (The value is normally True.)
is_server
boolean, True means the callback function should evaluate the
certificate as a server does, treating the remote end as a
client. False means the callback function should evaluate the
certificate as a client does, treating the remote end as a server.
user_dataN
zero or more caller supplied optional parameters
The callback function should return True if authentication is
successful, False otherwise. If authentication is not successful the
callback should indicate the reason for the failure (if possible) by
calling nss.set_error() with the appropriate error code.
The callback function obtains the certificate to be authenticated by
calling ssl.get_peer_certificate(). If is_server is false, the
callback should also check that the domain name in the remote server's
certificate matches the desired domain name specified in a previous
call to ssl.set_hostname(). To obtain that domain name, the callback calls
ssl.get_hostname().
The callback may need to call one or more PK11 functions to obtain the
services of a PKCS 11 module. Some of the PK11 functions require a
PIN argument (see ssl.set_pkcs11_pin_arg() for details). To obtain the
value that was set with ssl.set_pkcs11_pin_arg(), the callback calls
ssl.get_pkcs11_pin_arg().
If the callback returns False, the SSL connection is terminated
immediately unless the application has supplied a bad-certificate
callback function by having previously called
ssl.set_bad_cert_callback(). A bad-certificate callback function gives
the application the opportunity to choose to accept the certificate as
authentic and authorized even though it failed the check performed by
the certificate authentication callback function.
Example::
def auth_certificate_callback(sock, check_sig, is_server, certdb):
cert_is_valid = False
cert = sock.get_peer_certificate()
pin_args = sock.get_pkcs11_pin_arg()
if pin_args is None:
pin_args = ()
# Define how the cert is being used based upon the is_server flag. This may
# seem backwards, but isn't. If we're a server we're trying to validate a
# client cert. If we're a client we're trying to validate a server cert.
if is_server:
intended_usage = nss.certificateUsageSSLClient
else:
intended_usage = nss.certificateUsageSSLServer
try:
# If the cert fails validation it will raise an exception, the errno attribute
# will be set to the error code matching the reason why the validation failed
# and the strerror attribute will contain a string describing the reason.
approved_usage = cert.verify_now(certdb, check_sig, intended_usage, *pin_args)
except Exception, e:
cert_is_valid = False
return cert_is_valid
# Is the intended usage a proper subset of the approved usage
if approved_usage & intended_usage:
cert_is_valid = True
else:
cert_is_valid = False
# If this is a server, we're finished
if is_server or not cert_is_valid:
return cert_is_valid
# Certificate is OK. Since this is the client side of an SSL
# connection, we need to verify that the name field in the cert
# matches the desired hostname. This is our defense against
# man-in-the-middle attacks.
hostname = sock.get_hostname()
try:
# If the cert fails validation it will raise an exception
cert_is_valid = cert.verify_hostname(hostname)
except Exception, e:
cert_is_valid = False
return cert_is_valid
return cert_is_valid
set_client_auth_data_callback(callback, [user_data1, ...])
:Parameters:
callback : function pointer
callback to invoke
user_dataN:
zero or more caller supplied parameters which will be passed to the callback
The callback has the following signature::
callback(ca_names, [user_data1, ...]) -> (Certificate, PrivateKey)
ca_names
Sequence of CA distinguished names that the server accepts. Each
item in the sequence must be a SecItem object containing a
distinguished name.
user_dataN
zero or more caller supplied optional parameters
The callback returns Certificate and PrivateKey if successful,
or None if the callback failed.
Defines a callback function for SSL to use in a client application
when a server asks for client authentication information. This
callback function is required if your client application is going to
support client authentication.
The callback function set with `SSLSocket.set_client_auth_data_callback()`
is used to get information from a client application when
authentication is requested by the server. The callback function
retrieves the client's private key and certificate. SSL provides an
implementation of this callback function; see NSS_GetClientAuthData
for details. Unlike SSL_AuthCertificate, NSS_GetClientAuthData is not
a default callback function. You must set it explicitly with
`SSLSocket.set_client_auth_data_callback()` if you want to use it.
Example::
def client_auth_data_callback(ca_names, chosen_nickname, password, certdb):
cert = None
if chosen_nickname:
try:
cert = nss.find_cert_from_nickname(chosen_nickname, password)
priv_key = nss.find_key_by_any_cert(cert, password)
return cert, priv_key
except NSPRError, e:
return False
else:
nicknames = nss.get_cert_nicknames(certdb, nss.SEC_CERT_NICKNAMES_USER)
for nickname in nicknames:
try:
cert = nss.find_cert_from_nickname(nickname, password)
if cert.check_valid_times():
if cert.has_signer_in_ca_names(ca_names):
priv_key = nss.find_key_by_any_cert(cert, password)
return cert, priv_key
except NSPRError, e:
pass
return False
sock = ssl.SSLSocket(net_addr.family)
sock.set_client_auth_data_callback(client_auth_data_callback, nickname, password, nss.get_default_certdb())
set_handshake_callback(callback, [user_data1, ...])
:Parameters:
callback : function pointer
callback to invoke
user_dataN:
zero or more caller supplied parameters which will be passed to the callback
The callback has the following signature::
callback(socket, [user_data1, ...])
socket
the SSL socket the handshake has completed on
user_dataN
zero or more caller supplied optional parameters
Sets up a callback function used by SSL to inform either a client
application or a server application when the handshake is completed.
Example::
def handshake_callback(sock):
print 'handshake complete, peer = %s' % (sock.get_peer_name())
sock = ssl.SSLSocket(net_addr.family)
sock.set_handshake_callback(handshake_callback)
set_pkcs11_pin_arg([user_dataN, ...])
:Parameters:
user_dataN : object ...
zero or more caller supplied parameters which will be passed
to the pk11.password_callback()
get_pkcs11_pin_arg()
Returns a tuple of arguments or None if not previously set with
`SSLSocket.set_pkcs11_pin_arg()`
config_secure_server(cert, key, kea)
:Parameters:
cert : Certificate object
Server's certificate as a Certificate object
key : PrivateKey object
Server's private key as a PrivateKey object
kea : integer
Key exchange type (e.g. ssl_kea_rsa, ssl_kea_dh, etc.)
Configures a listen socket with the information needed to handshake as
an SSL server. `SSLSocket.config_secure_server()` requires the
certificate for the server and the server's private key.
get_peer_certificate() -> Certficate
`SSLSocket.get_peer_certificate()` is used by certificate
authentication and bad-certificate callback functions to obtain the
certificate under scrutiny. If the client calls
`SSLSocket.get_peer_certificate()`, it always returns the server's
certificate. If the server calls `SSLSocket.get_peer_certificate()`, it
may return None if client authentication is not enabled or if the
client had no certificate when asked.
get_certificate() -> Certficate
Returns the certificate associated with the socket or
None if not previously set.
invalidate_session()
After you call SSLSSocket.invalidate_session(), the existing
connection using the session can continue, but no new connections can
resume this SSL session.
data_pending()
Returns the number of bytes waiting in internal SSL buffers to be read
by the local application from the SSL socket.
If SSL_SECURITY has not been enabled with a call to
`ssl.set_ssl_default_option()` or `SSLSocket.set_ssl_option()`, the
function returns zero.
get_security_status() -> on, cipher, key_size, secret_key_size, issuer, subject
Gets information about the security parameters of the current connection.
Returns the tuple (on, cipher, key_size, secret_key_size, issuer, subject)
The interpretation of each value is:
on
An integer, will be one of these values:
- SSL_SECURITY_STATUS_OFF
- SSL_SECURITY_STATUS_ON_HIGH
- SSL_SECURITY_STATUS_ON_LOW
cipher
A string specifying the name of the cipher.
- For SSL v2, the string is one of the following:
- RC4
- RC4-Export
- RC2-CBC
- RC2-CBC-Export
- DES-CBC,
- DES-EDE3-CBC
- For SSL v3, the string is one of the following:
- RC4
- RC4-40
- RC2-CBC
- RC2-CBC-40
- DES-CBC
- 3DES-EDE-CBC
- DES-CBC-40
keySize
An integer, the session key size used, in bits.
secret_key_size
An integer. indicates the size, in bits, of the secret portion of
the session key used (also known as the 'effective key size'). The
secret key size is never greater than the session key size.
issuer
A string specifying the DN of the issuer of the certificate at
the other end of the connection, in RFC1485 format. If no
certificate is supplied, the string is 'no certificate'
subject
A string specifying the distinguished name of the certificate at
the other end of the connection, in RFC1485 format. If no
certificate is supplied, the string is 'no certificate'
get_session_id() -> id
Returns the SSL session ID as a SecItem.
set_sock_peer_id(id)
:Parameters:
id : integer
An ID number assigned by the application to keep track of the SSL
session associated with the peer.
Associates a peer ID with a socket to facilitate looking up the SSL
session when it is tunneling through a proxy.
SSL peers frequently reconnect after a relatively short time has
passed. To avoid the overhead of repeating the full SSL handshake in
situations like this, the SSL protocol supports the use of a session
cache, which retains information about each connection for some
predetermined length of time.
For example, a client session cache includes the hostname and port
number of each server the client connects with, plus additional
information such as the master secret generated during the SSL
handshake. For a direct connection with a server, the hostname and
port number are sufficient for the client to identify the server as
one for which it has an entry in its session cache. However, the
situation is more complicated if the client is on an intranet and is
connecting to a server on the Internet through a proxy. In this case,
the client first connects to the proxy, and the client and proxy
exchange messages specified by the proxy protocol that allow the
proxy, in turn, to connect to the requested server on behalf of the
client. This arrangement is known as SSL tunneling.
Client session cache entries for SSL connections that tunnel through a
particular proxy all have the same hostname and port number--that is,
the hostname and port number of the proxy. To determine whether a
particular server with which the client is attempting to connect has
an entry in the session cache, the session cache needs some additional
information that identifies that server. This additional identifying
information is known as a peer ID. The peer ID is associated with a
socket, and must be set before the SSL handshake occurs--that is,
before the SSL handshake is initiated by a call to a function such as
`SSLSocket.read()` or `SSLSocket.force_handshake()`. To set the peer ID,
you use `SSLSocket.set_sock_peer_id()`.
In summary, SSL uses three pieces of information to identify a
server's entry in the client session cache: the hostname, port number,
and peer ID. In the case of a client that is tunneling through a
proxy, the hostname and port number identify the proxy, and the peer
ID identifies the desired server. It is recommended that the client
set the peer ID to a string that consists of the server's hostname and
port number, like this:'www.hostname.com:387'. This convention
guarantees that each server has a unique entry in the client session
cache.
set_cipher_pref(cipher, enabled)
:Parameters:
cipher : integer
The cipher suite enumeration (e.g. SSL_RSA_WITH_NULL_MD5, etc.)
enabled : bool or int
True enables, False disables
Sets preference for the specified SSL2, SSL3, or TLS cipher on the
socket. A cipher suite is used only if the policy allows it and the
preference for it is set to True.
This function must be called once for each cipher you want to enable
or disable by default.
Note, which cipher suites are permitted or disallowed are modified by
previous calls to one or more of the SSL Export Policy Functions.
get_cipher_pref(cipher) -> enabled
:Parameters:
cipher : integer
The cipher suite enumeration (e.g. SSL_RSA_WITH_NULL_MD5, etc.)
Returns the preference for the specified SSL2, SSL3, or TLS cipher on
the socket.
set_hostname(url)
:Parameters:
url : string
A string specifying the desired server's domain name.
The client application's certificate authentication callback function
needs to compare the domain name in the server's certificate against
the domain name of the server the client was attempting to
contact. This step is vital because it is the client's only protection
against a man-in-the-middle attack. The client application uses
`SSLSocket.set_hostname()` to set the domain name of the desired server
before performing the first SSL handshake. The client application's
certificate authentication callback function gets this string by
calling `SSLSocket.get_hostname()`.
get_hostname()
`SSLSocket.get_hostname()` is used by certificate authentication callback
function to obtain the domain name of the desired SSL server for the
purpose of comparing it with the domain name in the certificate
presented by the server actually contacted.
set_certificate_db(certdb)
:Parameters:
certdb : CertDB object
The certification database as a CertDB object
Sets the Certificate Database on a specific SSLSocket.
reset_handshake(as_server)
:Parameters:
as_server : bool
- True means the socket will attempt
to handshake as a server the next time it tries, and
- False means the socket will attempt to handshake as
a client the next time it tries.
Calling `SSLSocket.reset_handshake()` causes the SSL handshake protocol
to start from the beginning on the next I/O operation. That is, the
handshake starts with no cipher suite already in use, just as it does
on the first handshake on a new socket. When an application imports a
socket into SSL after the TCP connection on that socket has already
been established, it must call `SSLSocket.reset_handshake()` to
determine whether SSL should behave like an SSL client or an SSL
server. Note that this step would not be necessary if the socket
weren't already connected. For an SSL socket that is configured before
it is connected, SSL figures this out when the application calls
`SSLSocket.connect()` or `SSLSocket.accept()`. If the socket is already
connected before SSL gets involved, you must provide this extra hint.
force_handshake()
Drives a handshake for a specified SSLSocket to completion on a
socket that has already been prepared to do a handshake or is in the
middle of doing a handshake.
When you are forcing the initial handshake on a blocking socket, this
function returns when the handshake is complete. For subsequent
handshakes, the function can return either because the handshake is
complete, or because application data has been received on the
connection that must be processed (that is, the application must read
it) before the handshake can continue. You can use
`SSLSocket.force_handshake()` when a handshake is desired but neither
end has anything to say immediately. This occurs, for example, when an
HTTPS server has received a request and determines that before it can
answer the request, it needs to request an authentication certificate
from the client. At the HTTP protocol level, nothing more is being
said (that is, no HTTP request or response is being sent), so the
server uses `SSLSocket.force_handshake()` to make the handshake
occur. `SSLSocket.force_handshake()` does not prepare a socket to do a
handshake by itself. The following functions prepare a socket to do a
handshake:
* `SSLSocket.connect()`
* `SSLSocket.accept()`
* `SSLSocket.rehandshake()`
(after the first handshake is finished)
* SSLSocket.reset_handshake
(for sockets that were connected or accepted prior to being imported)
A call to `SSLSocket.force_handshake()` will almost always be preceded
by one of those functions. In versions prior to NSS 1.2, you cannot
force a subsequent handshake. If you use this function after the
initial handshake, it returns immediately without forcing a handshake.
force_handshake_timeout(timeout)
:Parameters:
timeout : integer
timeout value expressed as a NSPR interval
See the documentation for `SSLSocket.force_handshake()`. This function
adds a timeout interval.
rehandshake(flush_cache)
:Parameters:
flush_cache : bool
- If flush_cache is True, the SSL3 cache entry will be flushed
first, ensuring that a full SSL handshake from scratch will
occur.
- If flush_cache is False, and an SSL connection is established, it
will do the much faster session restart handshake. This will
regenerate the symmetric session keys without doing another
private key operation.
Causes SSL to begin a new SSL 3.0 handshake on a connection that has
already completed one handshake.
If flush_cache is True, the `SSLSocket.rehandshake()` function
invalidates the current SSL session associated with the specified
SSLSocket from the session cache and starts another full SSL 3.0
handshake. It is for use with SSL 3.0 only. You can call this function
to redo the handshake if you have changed one of the socket's
configuration parameters (for example, if you are going to request
client authentication). Setting flush_cache to False can be useful,
for example, if you are using export ciphers and want to keep changing
the symmetric keys to foil potential
attackers. `SSLSocket.rehandshake()` only initiates the new handshake by
sending the first message of that handshake. To drive the new
handshake to completion, you must either call
`SSLSocket.force_handshake()` or do another I/O operation (read or
write) on the socket. A call to `SSLSocket.rehandshake()` is typically
followed by a call to `SSLSocket.force_handshake()`.
rehandshake_timeout(flush_cache, timeout)
:Parameters:
flush_cache : bool
cache flush flag
timeout : integer
timeout value expressed as a NSPR interval
See the documentation for `SSLSocket.rehandshake()`. This function
adds a timeout interval.
import_tcp_socket(osfd) -> Socket
:Parameters:
osfd : integer
file descriptor of the SOCK_STREAM socket to import
Returns a Socket object that uses the specified socket file descriptor for
communication.
set_ssl_version_range(min_version, max_version)
:Parameters:
min_version : int or string
Either a SSL_LIBRARY_VERSION_* enumerated constant or it's
string equivalent, see `ssl_library_version_from_name()`
max_version : int or string
Either a SSL_LIBRARY_VERSION_* enumerated constant or it's
string equivalent, see `ssl_library_version_from_name()`
Sets the range of enabled SSL3/TLS versions for this socket.
get_ssl_version_range(repr_kind=AsEnum) -> (min_version, max_version)
:Parameters:
repr_kind : RepresentationKind constant
Specifies what format the contents of the returned tuple will be in.
May be one of:
AsEnum
The enumerated constant as an integer value.
AsEnumName
The name of the enumerated constant as a string.
AsString
A short friendly name for the enumerated constant.
Returns the range of SSL3/TLS versions enabled for the socket.
The result is a tuple whose contents are dictated by repr_kind.
get_ssl_channel_info() -> SSLChannelInfo
Returns a `ssl.SSLChannelInfo` describing the parameters of the connection.
get_negotiated_host() -> string
Returns SNI negotiated host name.
format_lines(level=0) -> [(level, string),...]
:Parameters:
level : integer
Initial indentation level, all subsequent indents are relative
to this starting level.
Formats the object into a sequence of lines with indent level
information. The return value is a list where each list item is a
tuple. The first item in the tuple is an integer
representing the indentation level for that line. Any remaining items
in the tuple are strings to be output on that line.
The output of this function can be formatted into a single string by
calling `nss.nss.indented_format()`, e.g.:
print indented_format(obj.format_lines())
The reason this function returns a tuple as opposed to an single
indented string is to support other text formatting systems such as
GUI's with indentation controls. See `nss.nss.indented_format()` for a
complete explanation.
format(level=0, indent=' ') -> string)
:Parameters:
level : integer
Initial indentation level, all subsequent indents are relative
to this starting level.
indent : string
string replicated once for each indent level then prepended to output line
This is equivalent to:
indented_format(obj.format_lines()) on an object providing a format_lines() method.
connection_info_str() -> str
Returns a string describing the properties of the SSL connection.
: P E @ ! N O `! ! ! s M ! p !! "! %! &! `)! *! L 2! ` 7! g Ў >! p ?! P A! 0 C! D! D! p E! Z F! , Y I! @r K! H @O! P R!
p U! n X! n X! > r Y! ( p Q `Q Z! ! @! ! Y pQ C ` R R [! ! ! `! PY R ! Z Z Z ` j v ` ` ` ` x `[! f ! Z ! " ! @ p ! ^ ~ ! u ~ ! } ! ( 0} ! | ! | ! p| ! P| @! { `! { !
z ! Pz ! y @! Py @! x ! @x ! w ! w @! v ! u ! p 0u ! [ t ! ! q ! n ! g ! 5 m ! I h ! f M ! } M ! H `Z ! v @Q ! S T S h T S S . H S Y S o pS `S PS 8 @S X S x 0S P P Q H a ! v `R ! > S
W h " W 8 S O S R f R t R Q ( Q h Q Q R 0
R p R 1 S 0R ssl.so.debug =(f .shstrtab .note.gnu.build-id .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt .init .text .fini .rodata .eh_frame_hdr .eh_frame .ctors .dtors .jcr .data.rel.ro .dynamic .got .got.plt .data .bss .gnu_debuglink $ o < ( 0
8 o E o T 0 0 " ^ ; ;
h E E c E E n `L `L hy t z l/ D D ( ( \ ! ! ! (! ( 0! 0 ! x h! h ` ! P @! 0 h 0 D