summaryrefslogtreecommitdiff
path: root/docs/library/ussl.rst
diff options
context:
space:
mode:
authorScott Shawcroft <scott.shawcroft@gmail.com>2017-06-20 10:56:05 -0700
committerScott Shawcroft <scott.shawcroft@gmail.com>2017-06-20 10:56:05 -0700
commit30ee7019ca651bce1fe966c1089fe977d51dc92b (patch)
tree0114b6f744dd175b7722dd8edcbe24f4ee84bb45 /docs/library/ussl.rst
parent97fcdfbd08c922efd7470d6482d7c7c703ffc0ae (diff)
parent869cdcfdfc860b1177baf9b0f8818915ba54f3f5 (diff)
Merge tag 'v1.9.1'2.0.0-alpha.0
Fixes for stmhal USB mass storage, lwIP bindings and VFS regressions This release provides an important fix for the USB mass storage device in the stmhal port by implementing the SCSI SYNCHRONIZE_CACHE command, which is now require by some Operating Systems. There are also fixes for the lwIP bindings to improve non-blocking sockets and error codes. The VFS has some regressions fixed including the ability to statvfs the root. All changes are listed below. py core: - modbuiltins: add core-provided version of input() function - objstr: catch case of negative "maxsplit" arg to str.rsplit() - persistentcode: allow to compile with complex numbers disabled - objstr: allow to compile with obj-repr D, and unicode disabled - modsys: allow to compile with obj-repr D and PY_ATTRTUPLE disabled - provide mp_decode_uint_skip() to help reduce stack usage - makeqstrdefs.py: make script run correctly with Python 2.6 - objstringio: if created from immutable object, follow copy on write policy extmod: - modlwip: connect: for non-blocking mode, return EINPROGRESS - modlwip: fix error codes for duplicate calls to connect() - modlwip: accept: fix error code for non-blocking mode - vfs: allow to statvfs the root directory - vfs: allow "buffering" and "encoding" args to VFS's open() - modframebuf: fix signed/unsigned comparison pendantic warning lib: - libm: use isfinite instead of finitef, for C99 compatibility - utils/interrupt_char: remove support for KBD_EXCEPTION disabled tests: - basics/string_rsplit: add tests for negative "maxsplit" argument - float: convert "sys.exit()" to "raise SystemExit" - float/builtin_float_minmax: PEP8 fixes - basics: convert "sys.exit()" to "raise SystemExit" - convert remaining "sys.exit()" to "raise SystemExit" unix port: - convert to use core-provided version of built-in import() - Makefile: replace references to make with $(MAKE) windows port: - convert to use core-provided version of built-in import() qemu-arm port: - Makefile: adjust object-file lists to get correct dependencies - enable micropython.mem_*() functions to allow more tests stmhal port: - boards: enable DAC for NUCLEO_F767ZI board - add support for NUCLEO_F446RE board - pass USB handler as parameter to allow more than one USB handler - usb: use local USB handler variable in Start-of-Frame handler - usb: make state for USB device private to top-level USB driver - usbdev: for MSC implement SCSI SYNCHRONIZE_CACHE command - convert from using stmhal's input() to core provided version cc3200 port: - convert from using stmhal's input() to core provided version teensy port: - convert from using stmhal's input() to core provided version esp8266 port: - Makefile: replace references to make with $(MAKE) - Makefile: add clean-modules target - convert from using stmhal's input() to core provided version zephyr port: - modusocket: getaddrinfo: Fix mp_obj_len() usage - define MICROPY_PY_SYS_PLATFORM (to "zephyr") - machine_pin: use native Zephyr types for Zephyr API calls docs: - machine.Pin: remove out_value() method - machine.Pin: add on() and off() methods - esp8266: consistently replace Pin.high/low methods with .on/off - esp8266/quickref: polish Pin.on()/off() examples - network: move confusingly-named cc3200 Server class to its reference - uos: deconditionalize, remove minor port-specific details - uos: move cc3200 port legacy VFS mounting functions to its ref doc - machine: sort machine classes in logical order, not alphabetically - network: first step to describe standard network class interface examples: - embedding: use core-provided KeyboardInterrupt object
Diffstat (limited to 'docs/library/ussl.rst')
-rw-r--r--docs/library/ussl.rst100
1 files changed, 30 insertions, 70 deletions
diff --git a/docs/library/ussl.rst b/docs/library/ussl.rst
index 5371ed129..36f6d65a4 100644
--- a/docs/library/ussl.rst
+++ b/docs/library/ussl.rst
@@ -1,86 +1,46 @@
-:mod:`ussl` -- ssl module
-===============================
+:mod:`ussl` -- SSL/TLS module
+=============================
.. module:: ussl
:synopsis: TLS/SSL wrapper for socket objects
-This module provides access to Transport Layer Security (often known as
-“Secure Sockets Layer”) encryption and peer authentication facilities for
-network sockets, both client-side and server-side.
+This module provides access to Transport Layer Security (previously and
+widely known as “Secure Sockets Layer”) encryption and peer authentication
+facilities for network sockets, both client-side and server-side.
-.. only:: not port_wipy
+Functions
+---------
- Functions
- ---------
+.. function:: ssl.wrap_socket(sock, server_side=False, keyfile=None, certfile=None, cert_reqs=CERT_NONE, ca_certs=None)
- .. function:: ssl.wrap_socket(sock, server_side=False)
+ Takes a stream `sock` (usually usocket.socket instance of ``SOCK_STREAM`` type),
+ and returns an instance of ssl.SSLSocket, which wraps the underlying stream in
+ an SSL context. Returned object has the usual stream interface methods like
+ `read()`, `write()`, etc. In MicroPython, the returned object does not expose
+ socket interface and methods like `recv()`, `send()`. In particular, a
+ server-side SSL socket should be created from a normal socket returned from
+ `accept()` on a non-SSL listening server socket.
- Takes a stream `sock` (usually usocket.socket instance of ``SOCK_STREAM`` type),
- and returns an instance of ssl.SSLSocket, which wraps the underlying stream in
- an SSL context. Returned object has the usual stream interface methods like
- `read()`, `write()`, etc. In MicroPython, the returned object does not expose
- socket interface and methods like `recv()`, `send()`. In particular, a
- server-side SSL socket should be created from a normal socket returned from
- `accept()` on a non-SSL listening server socket.
+ Depending on the underlying module implementation for a particular board,
+ some or all keyword arguments above may be not supported.
- .. warning::
+.. warning::
- Currently, this function does NOT validate server certificates, which makes
- an SSL connection established prone to man-in-the-middle attacks.
+ Some implementations of ``ssl`` module do NOT validate server certificates,
+ which makes an SSL connection established prone to man-in-the-middle attacks.
+Exceptions
+----------
-.. only:: port_wipy
+.. data:: ssl.SSLError
- Functions
- ---------
+ This exception does NOT exist. Instead its base class, OSError, is used.
- .. function:: ssl.wrap_socket(sock, keyfile=None, certfile=None, server_side=False, cert_reqs=CERT_NONE, ca_certs=None)
+Constants
+---------
- Takes an instance sock of socket.socket, and returns an instance of ssl.SSLSocket, a subtype of
- ``socket.socket``, which wraps the underlying socket in an SSL context. sock must be a ``SOCK_STREAM``
- socket and protocol number ``socket.IPPROTO_SEC``; other socket types are unsupported. Example::
+.. data:: ssl.CERT_NONE
+ ssl.CERT_OPTIONAL
+ ssl.CERT_REQUIRED
- import socket
- import ssl
- s = socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_SEC)
- ss = ssl.wrap_socket(s)
- ss.connect(socket.getaddrinfo('www.google.com', 443)[0][-1])
-
- Certificates must be used in order to validate the other side of the connection, and also to
- authenticate ourselves with the other end. Such certificates must be stored as files using the
- FTP server, and they must be placed in specific paths with specific names.
-
- - The certificate to validate the other side goes in: **'/flash/cert/ca.pem'**
- - The certificate to authenticate ourselves goes in: **'/flash/cert/cert.pem'**
- - The key for our own certificate goes in: **'/flash/cert/private.key'**
-
- .. note::
-
- When these files are stored, they are placed inside the internal **hidden** file system
- (just like firmware updates), and therefore they are never visible.
-
- For instance to connect to the Blynk servers using certificates, take the file ``ca.pem`` located
- in the `blynk examples folder <https://github.com/wipy/wipy/tree/master/examples/blynk>`_
- and put it in '/flash/cert/'. Then do::
-
- import socket
- import ssl
- s = socket.socket(socket.AF_INET, socket.SOCK_STREAM, socket.IPPROTO_SEC)
- ss = ssl.wrap_socket(s, cert_reqs=ssl.CERT_REQUIRED, ca_certs='/flash/cert/ca.pem')
- ss.connect(socket.getaddrinfo('cloud.blynk.cc', 8441)[0][-1])
-
- SSL sockets inherit all methods and from the standard sockets, see the :mod:`usocket` module.
-
- Exceptions
- ----------
-
- .. data:: ssl.SSLError
-
- Constants
- ---------
-
- .. data:: ssl.CERT_NONE
- .. data:: ssl.CERT_OPTIONAL
- .. data:: ssl.CERT_REQUIRED
-
- supported values in ``cert_reqs``
+ Supported values for `cert_reqs` parameter.