This contains a number of things:

1) Improve the documentation of the SSL module, with a fuller
   explanation of certificate usage, another reference, proper
   formatting of this and that.

2) Fix Windows bug in ssl.py, and general bug in sslsocket.close().
   Remove some unused code from ssl.py.  Allow accept() to be called on
   sslsocket sockets.

3) Use try-except-else in import of ssl in socket.py.  Deprecate use of
   socket.ssl().

4) Remove use of socket.ssl() in every library module, except for
   test_socket_ssl.py and test_ssl.py.

1 files changed, 74 insertions, 125 deletions

diff --git a/Lib/ssl.py b/Lib/ssl.py
index 99f625747e..6ec6af181b 100644
--- a/Lib/ssl.py
+++ b/Lib/ssl.py
@@ -58,55 +58,47 @@ PROTOCOL_TLSv1
 import os, sys
 
 import _ssl             # if we can't import it, let the error propagate
-from socket import socket
 from _ssl import sslerror
 from _ssl import CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
 from _ssl import PROTOCOL_SSLv2, PROTOCOL_SSLv3, PROTOCOL_SSLv23, PROTOCOL_TLSv1
+from _ssl import \
+     SSL_ERROR_ZERO_RETURN, \
+     SSL_ERROR_WANT_READ, \
+     SSL_ERROR_WANT_WRITE, \
+     SSL_ERROR_WANT_X509_LOOKUP, \
+     SSL_ERROR_SYSCALL, \
+     SSL_ERROR_SSL, \
+     SSL_ERROR_WANT_CONNECT, \
+     SSL_ERROR_EOF, \
+     SSL_ERROR_INVALID_ERROR_CODE
+
+from socket import socket
+from socket import getnameinfo as _getnameinfo
 
-# Root certs:
-#
-# The "ca_certs" argument to sslsocket() expects a file containing one or more
-# certificates that are roots of various certificate signing chains.  This file
-# contains the certificates in PEM format (RFC ) where each certificate is
-# encoded in base64 encoding and surrounded with a header and footer:
-# -----BEGIN CERTIFICATE-----
-# ... (CA certificate in base64 encoding) ...
-# -----END CERTIFICATE-----
-# The various certificates in the file are just concatenated together:
-# -----BEGIN CERTIFICATE-----
-# ... (CA certificate in base64 encoding) ...
-# -----END CERTIFICATE-----
-# -----BEGIN CERTIFICATE-----
-# ... (a second CA certificate in base64 encoding) ...
-# -----END CERTIFICATE-----
-#
-# Some "standard" root certificates are available at
-#
-# http://www.thawte.com/roots/  (for Thawte roots)
-# http://www.verisign.com/support/roots.html  (for Verisign)
 
 class sslsocket (socket):
 
+    """This class implements a subtype of socket.socket that wraps
+    the underlying OS socket in an SSL context when necessary, and
+    provides read and write methods over that channel."""
+
     def __init__(self, sock, keyfile=None, certfile=None,
                  server_side=False, cert_reqs=CERT_NONE,
                  ssl_version=PROTOCOL_SSLv23, ca_certs=None):
         socket.__init__(self, _sock=sock._sock)
         if certfile and not keyfile:
             keyfile = certfile
-        if server_side:
-            self._sslobj = _ssl.sslwrap(self._sock, 1, keyfile, certfile,
-                                        cert_reqs, ssl_version, ca_certs)
+        # see if it's connected
+        try:
+            socket.getpeername(self)
+        except:
+            # no, no connection yet
+            self._sslobj = None
         else:
-            # see if it's connected
-            try:
-                socket.getpeername(self)
-            except:
-                # no, no connection yet
-                self._sslobj = None
-            else:
-                # yes, create the SSL object
-                self._sslobj = _ssl.sslwrap(self._sock, 0, keyfile, certfile,
-                                            cert_reqs, ssl_version, ca_certs)
+            # yes, create the SSL object
+            self._sslobj = _ssl.sslwrap(self._sock, server_side,
+                                        keyfile, certfile,
+                                        cert_reqs, ssl_version, ca_certs)
         self.keyfile = keyfile
         self.certfile = certfile
         self.cert_reqs = cert_reqs
@@ -123,59 +115,77 @@ class sslsocket (socket):
         return self._sslobj.peer_certificate()
 
     def send (self, data, flags=0):
-        if flags != 0:
-            raise ValueError(
-                "non-zero flags not allowed in calls to send() on %s" %
-                self.__class__)
-        return self._sslobj.write(data)
+        if self._sslobj:
+            if flags != 0:
+                raise ValueError(
+                    "non-zero flags not allowed in calls to send() on %s" %
+                    self.__class__)
+            return self._sslobj.write(data)
+        else:
+            return socket.send(self, data, flags)
 
     def send_to (self, data, addr, flags=0):
-        raise ValueError("send_to not allowed on instances of %s" %
-                         self.__class__)
+        if self._sslobj:
+            raise ValueError("send_to not allowed on instances of %s" %
+                             self.__class__)
+        else:
+            return socket.send_to(self, data, addr, flags)
 
     def sendall (self, data, flags=0):
-        if flags != 0:
-            raise ValueError(
-                "non-zero flags not allowed in calls to sendall() on %s" %
-                self.__class__)
-        return self._sslobj.write(data)
+        if self._sslobj:
+            if flags != 0:
+                raise ValueError(
+                    "non-zero flags not allowed in calls to sendall() on %s" %
+                    self.__class__)
+            return self._sslobj.write(data)
+        else:
+            return socket.sendall(self, data, flags)
 
     def recv (self, buflen=1024, flags=0):
-        if flags != 0:
-            raise ValueError(
-                "non-zero flags not allowed in calls to sendall() on %s" %
-                self.__class__)
-        return self._sslobj.read(data, buflen)
+        if self._sslobj:
+            if flags != 0:
+                raise ValueError(
+                    "non-zero flags not allowed in calls to sendall() on %s" %
+                    self.__class__)
+            return self._sslobj.read(data, buflen)
+        else:
+            return socket.recv(self, buflen, flags)
 
     def recv_from (self, addr, buflen=1024, flags=0):
-        raise ValueError("recv_from not allowed on instances of %s" %
-                         self.__class__)
+        if self._sslobj:
+            raise ValueError("recv_from not allowed on instances of %s" %
+                             self.__class__)
+        else:
+            return socket.recv_from(self, addr, buflen, flags)
 
-    def shutdown(self):
+    def ssl_shutdown(self):
         if self._sslobj:
             self._sslobj.shutdown()
             self._sslobj = None
-        else:
-            socket.shutdown(self)
+
+    def shutdown(self, how):
+        self.ssl_shutdown()
+        socket.shutdown(self, how)
 
     def close(self):
-        if self._sslobj:
-            self.shutdown()
-        else:
-            socket.close(self)
+        self.ssl_shutdown()
+        socket.close(self)
 
     def connect(self, addr):
         # Here we assume that the socket is client-side, and not
         # connected at the time of the call.  We connect it, then wrap it.
-        if self._sslobj or (self.getsockname()[1] != 0):
+        if self._sslobj:
             raise ValueError("attempt to connect already-connected sslsocket!")
         socket.connect(self, addr)
-        self._sslobj = _ssl.sslwrap(self._sock, 0, self.keyfile, self.certfile,
+        self._sslobj = _ssl.sslwrap(self._sock, False, self.keyfile, self.certfile,
                                     self.cert_reqs, self.ssl_version,
                                     self.ca_certs)
 
     def accept(self):
-        raise ValueError("accept() not supported on an sslsocket")
+        newsock, addr = socket.accept(self)
+        return (sslsocket(newsock, True, self.keyfile, self.certfile,
+                         self.cert_reqs, self.ssl_version,
+                         self.ca_certs), addr)
 
 
 # some utility functions
@@ -190,64 +200,3 @@ def sslwrap_simple (sock, keyfile=None, certfile=None):
 
     return _ssl.sslwrap(sock._sock, 0, keyfile, certfile, CERT_NONE,
                         PROTOCOL_SSLv23, None)
-
-# fetch the certificate that the server is providing in PEM form
-
-def fetch_server_certificate (host, port):
-
-    import re, tempfile, os
-
-    def subproc(cmd):
-        from subprocess import Popen, PIPE, STDOUT
-        proc = Popen(cmd, stdout=PIPE, stderr=STDOUT, shell=True)
-        status = proc.wait()
-        output = proc.stdout.read()
-        return status, output
-
-    def strip_to_x509_cert(certfile_contents, outfile=None):
-        m = re.search(r"^([-]+BEGIN CERTIFICATE[-]+[\r]*\n"
-                      r".*[\r]*^[-]+END CERTIFICATE[-]+)$",
-                      certfile_contents, re.MULTILINE | re.DOTALL)
-        if not m:
-            return None
-        else:
-            tn = tempfile.mktemp()
-            fp = open(tn, "w")
-            fp.write(m.group(1) + "\n")
-            fp.close()
-            try:
-                tn2 = (outfile or tempfile.mktemp())
-                status, output = subproc(r'openssl x509 -in "%s" -out "%s"' %
-                                         (tn, tn2))
-                if status != 0:
-                    raise OperationError(status, tsig, output)
-                fp = open(tn2, 'rb')
-                data = fp.read()
-                fp.close()
-                os.unlink(tn2)
-                return data
-            finally:
-                os.unlink(tn)
-
-    if sys.platform.startswith("win"):
-        tfile = tempfile.mktemp()
-        fp = open(tfile, "w")
-        fp.write("quit\n")
-        fp.close()
-        try:
-            status, output = subproc(
-                'openssl s_client -connect "%s:%s" -showcerts < "%s"' %
-                (host, port, tfile))
-        finally:
-            os.unlink(tfile)
-    else:
-        status, output = subproc(
-            'openssl s_client -connect "%s:%s" -showcerts < /dev/null' %
-            (host, port))
-    if status != 0:
-        raise OSError(status)
-    certtext = strip_to_x509_cert(output)
-    if not certtext:
-        raise ValueError("Invalid response received from server at %s:%s" %
-                         (host, port))
-    return certtext