Package: aio-gnutls-transport
aio_gnutls_transport - asyncio transport over GnuTLSaio_gnutls_transportprovides a python3asyncio
transportoverGnuTLS. It aims to be adrop-in replacementfor the
native SSL transport in the stdlib (and which is based on OpenSSL).It also supportshalf-closed TLS connections, in other words you can.write_eof()on TLS streams (which is not possible with the native implementation).LicenceGNU Lesser General Public License version 2.1 or any later version (LGPLv2.1+)Requirementspython >= 3.6gnutls >= 3.5cffi >= 1.0.0Supported platformsLinuxBugsBugs shall be reportedin the gitlab project. Please mark security-critical issues asconfidential.Getting startedIn most cases, usingaio_gnutls_transportis as simple as:fromaio_gnutls_transportimportssl,GnutlsEventLoopPolicyasyncio.set_event_loop_policy(GnutlsEventLoopPolicy())aio_gnutls_transport.sslis the compatibility module to be used in place of
the nativesslmodule. It provides its ownSSLContextimplementation
for GnuTLS.GnutlsEventLoopPolicyis an asyncioevent loop
policythat installs a
wrapper around the default event loop implementation to support theSSLContextobjects created by theaio_gnutls_transport.sslmodule.Configuring TLS parametersThe security properties ofGnutlsContextare configured usingGnuTLS
priority strings.aio_gnutls_transport.DEFAULT_PRIORITYholds the default priority string set byssl.create_default_context()(its current value isSECURE:-RSA:%PROFILE_MEDIUM:%SERVER_PRECEDENCEand it will be kept to a sane
default).The priority string is configurable on a per-context basis by callingGnuTLSContext.gnutls_set_priority(). For example, to disable TLS versions
older than 1.3:ctx=ssl.create_default_context()ctx.gnutls_set_priority(aio_gnutls_transport.DEFAULT_PRIORITY+":-VERS-ALL:+VERS-TLS1.3")For any details about assembling a priority string, please refer to theGnuTLS
Manual.Contents of this packageThis packages provides:itemdescriptionnative equivalentaio_gnutls_transport.GnutlsContextGnuTLS contextssl.SSLContextaio_gnutls_transport.GnutlsErrorGnuTLS error classssl.SSLErroraio_gnutls_transport.GnutlsEventLoopPolicyan asyncio event loop policy usingGnutlsEventLoopinstead of the default event loopasyncio.DefaultEventLoopPolicyaio_gnutls_transport.GnutlsEventLoopan event loop which supports GnuTLS contextsasyncio.SelectorEventLoopaio_gnutls_transport.GnutlsObjectTLS connection state objectssl.SSLObjectaio_gnutls_transport.GnutlsHandshakeProtocolasyncio protocol implementing the TLS handshakeaio_gnutls_transport.GnutlsTransportasyncio transport over GnuTLSasyncio.sslproto._SSLProtocolTransportaio_gnutls_transport.sslthesslcompatibility modulesslCaveatsTheaio_gnutls_transport.sslcompatibility module provides only a subset of
the nativesslstdlib module.Achieving 100% compatibility is a non-goal (it would not be realistic since the
native module is tightly coupled with OpenSSL).Instead we take a minimalist and conservative approach:aio_gnutls_transportonly supports the most common features and any attempt
to use an unsupported attribute/method raisesNotImplementedError.The ssl module currently provides the following definitions:ssl.SSLContextssl.create_default_context()ssl.CERT_NONEssl.CERT_OPTIONALssl.CERT_REQUIREDssl.Purposessl.VerifyModessl.DER_cert_to_PEM_certssl.PEM_cert_to_DER_certand SSLContext supports the following attributes/methods:SSLContext.check_hostnameSSLContext.load_cert_chain()SSLContext.load_verify_locations()SSLContext.load_default_certs()SSLContext.verify_modeAlso, be aware that:Errors are reported asaio_gnutls_transport.GnutlsErroris not compatible
with the nativessl.SSLErrorclass (through they both derive fromOSError).aio_gnutls_transport.ssl.SSLContextderives fromssl.SSLContext, but they
do not share their implementation. This is necessary to enable
interoperability with 3rd-party libraries (eg: aiohttp) that enforce strict
type checking.