Create a SSLContext object for Python stdlib modules All Python stdlib modules shall use this function to create SSLContext objects in order to keep common settings in one place. The configuration is less restrict than create_default_context()'s to increase backward compatibili
(protocol=None, *, cert_reqs=CERT_NONE,
check_hostname=False, purpose=Purpose.SERVER_AUTH,
certfile=None, keyfile=None,
cafile=None, capath=None, cadata=None)
| 781 | return context |
| 782 | |
| 783 | def _create_unverified_context(protocol=None, *, cert_reqs=CERT_NONE, |
| 784 | check_hostname=False, purpose=Purpose.SERVER_AUTH, |
| 785 | certfile=None, keyfile=None, |
| 786 | cafile=None, capath=None, cadata=None): |
| 787 | """Create a SSLContext object for Python stdlib modules |
| 788 | |
| 789 | All Python stdlib modules shall use this function to create SSLContext |
| 790 | objects in order to keep common settings in one place. The configuration |
| 791 | is less restrict than create_default_context()'s to increase backward |
| 792 | compatibility. |
| 793 | """ |
| 794 | if not isinstance(purpose, _ASN1Object): |
| 795 | raise TypeError(purpose) |
| 796 | |
| 797 | # SSLContext sets OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_COMPRESSION, |
| 798 | # OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE and OP_SINGLE_ECDH_USE |
| 799 | # by default. |
| 800 | if purpose == Purpose.SERVER_AUTH: |
| 801 | # verify certs and host name in client mode |
| 802 | if protocol is None: |
| 803 | protocol = PROTOCOL_TLS_CLIENT |
| 804 | elif purpose == Purpose.CLIENT_AUTH: |
| 805 | if protocol is None: |
| 806 | protocol = PROTOCOL_TLS_SERVER |
| 807 | else: |
| 808 | raise ValueError(purpose) |
| 809 | |
| 810 | context = SSLContext(protocol) |
| 811 | context.check_hostname = check_hostname |
| 812 | if cert_reqs is not None: |
| 813 | context.verify_mode = cert_reqs |
| 814 | if check_hostname: |
| 815 | context.check_hostname = True |
| 816 | |
| 817 | if keyfile and not certfile: |
| 818 | raise ValueError("certfile must be specified") |
| 819 | if certfile or keyfile: |
| 820 | context.load_cert_chain(certfile, keyfile) |
| 821 | |
| 822 | # load CA root certs |
| 823 | if cafile or capath or cadata: |
| 824 | context.load_verify_locations(cafile, capath, cadata) |
| 825 | elif context.verify_mode != CERT_NONE: |
| 826 | # no explicit cafile, capath or cadata but the verify mode is |
| 827 | # CERT_OPTIONAL or CERT_REQUIRED. Let's try to load default system |
| 828 | # root CA certificates for the given purpose. This may fail silently. |
| 829 | context.load_default_certs(purpose) |
| 830 | # OpenSSL 1.1.1 keylog file |
| 831 | if hasattr(context, 'keylog_filename'): |
| 832 | keylogfile = os.environ.get('SSLKEYLOGFILE') |
| 833 | if keylogfile and not sys.flags.ignore_environment: |
| 834 | context.keylog_filename = keylogfile |
| 835 | return context |
| 836 | |
| 837 | # Used by http.client if no context is explicitly passed. |
| 838 | _create_default_https_context = create_default_context |
nothing calls this directly
no test coverage detected