neulab/docprompting-conala huggingface dataset:
ssl.cert_time_to_seconds(cert_time)  
Return the time in seconds since the Epoch, given the cert_time string representing the “notBefore” or “notAfter” date from a certificate in "%b %d %H:%M:%S %Y %Z" strptime format (C locale). Here’s an example: >>> import ssl
>>> timestamp = ssl.cert_time_to_seconds("Jan  5 09:34:43 2018 GMT")
>>> timestamp  
1515144883
>>> from datetime import datetime
>>> print(datetime.utcfromtimestamp(timestamp))  
2018-01-05 09:34:43
 “notBefore” or “notAfter” dates must use GMT (RFC 5280).  Changed in version 3.5: Interpret the input time as a time in UTC as specified by ‘GMT’ timezone in the input string. Local timezone was used previously. Return an integer (no fractions of a second in the input format)
ssl.CHANNEL_BINDING_TYPES  
List of supported TLS channel binding types. Strings in this list can be used as arguments to SSLSocket.get_channel_binding().  New in version 3.3.
ssl.create_default_context(purpose=Purpose.SERVER_AUTH, cafile=None, capath=None, cadata=None)  
Return a new SSLContext object with default settings for the given purpose. The settings are chosen by the ssl module, and usually represent a higher security level than when calling the SSLContext constructor directly. cafile, capath, cadata represent optional CA certificates to trust for certificate verification, as in SSLContext.load_verify_locations(). If all three are None, this function can choose to trust the system’s default CA certificates instead. The settings are: PROTOCOL_TLS, OP_NO_SSLv2, and OP_NO_SSLv3 with high encryption cipher suites without RC4 and without unauthenticated cipher suites. Passing SERVER_AUTH as purpose sets verify_mode to CERT_REQUIRED and either loads CA certificates (when at least one of cafile, capath or cadata is given) or uses SSLContext.load_default_certs() to load default CA certificates. When keylog_filename is supported and the environment variable SSLKEYLOGFILE is set, create_default_context() enables key logging.  Note The protocol, options, cipher and other settings may change to more restrictive values anytime without prior deprecation. The values represent a fair balance between compatibility and security. If your application needs specific settings, you should create a SSLContext and apply the settings yourself.   Note If you find that when certain older clients or servers attempt to connect with a SSLContext created by this function that they get an error stating “Protocol or cipher suite mismatch”, it may be that they only support SSL3.0 which this function excludes using the OP_NO_SSLv3. SSL3.0 is widely considered to be completely broken. If you still wish to continue to use this function but still allow SSL 3.0 connections you can re-enable them using: ctx = ssl.create_default_context(Purpose.CLIENT_AUTH)
ctx.options &= ~ssl.OP_NO_SSLv3
   New in version 3.4.   Changed in version 3.4.4: RC4 was dropped from the default cipher string.   Changed in version 3.6: ChaCha20/Poly1305 was added to the default cipher string. 3DES was dropped from the default cipher string.   Changed in version 3.8: Support for key logging to SSLKEYLOGFILE was added.
ssl.DER_cert_to_PEM_cert(DER_cert_bytes)  
Given a certificate as a DER-encoded blob of bytes, returns a PEM-encoded string version of the same certificate.
ssl.enum_certificates(store_name)  
Retrieve certificates from Windows’ system cert store. store_name may be one of CA, ROOT or MY. Windows may provide additional cert stores, too. The function returns a list of (cert_bytes, encoding_type, trust) tuples. The encoding_type specifies the encoding of cert_bytes. It is either x509_asn for X.509 ASN.1 data or pkcs_7_asn for PKCS#7 ASN.1 data. Trust specifies the purpose of the certificate as a set of OIDS or exactly True if the certificate is trustworthy for all purposes. Example: >>> ssl.enum_certificates("CA")
[(b'data...', 'x509_asn', {'1.3.6.1.5.5.7.3.1', '1.3.6.1.5.5.7.3.2'}),
 (b'data...', 'x509_asn', True)]
 Availability: Windows.  New in version 3.4.
ssl.enum_crls(store_name)  
Retrieve CRLs from Windows’ system cert store. store_name may be one of CA, ROOT or MY. Windows may provide additional cert stores, too. The function returns a list of (cert_bytes, encoding_type, trust) tuples. The encoding_type specifies the encoding of cert_bytes. It is either x509_asn for X.509 ASN.1 data or pkcs_7_asn for PKCS#7 ASN.1 data. Availability: Windows.  New in version 3.4.
ssl.get_default_verify_paths()  
Returns a named tuple with paths to OpenSSL’s default cafile and capath. The paths are the same as used by SSLContext.set_default_verify_paths(). The return value is a named tuple DefaultVerifyPaths:  
cafile - resolved path to cafile or None if the file doesn’t exist, 
capath - resolved path to capath or None if the directory doesn’t exist, 
openssl_cafile_env - OpenSSL’s environment key that points to a cafile, 
openssl_cafile - hard coded path to a cafile, 
openssl_capath_env - OpenSSL’s environment key that points to a capath, 
openssl_capath - hard coded path to a capath directory  Availability: LibreSSL ignores the environment vars openssl_cafile_env and openssl_capath_env.  New in version 3.4.
ssl.get_server_certificate(addr, ssl_version=PROTOCOL_TLS, ca_certs=None)  
Given the address addr of an SSL-protected server, as a (hostname, port-number) pair, fetches the server’s certificate, and returns it as a PEM-encoded string. If ssl_version is specified, uses that version of the SSL protocol to attempt to connect to the server. If ca_certs is specified, it should be a file containing a list of root certificates, the same format as used for the same parameter in SSLContext.wrap_socket(). The call will attempt to validate the server certificate against that set of root certificates, and will fail if the validation attempt fails.  Changed in version 3.3: This function is now IPv6-compatible.   Changed in version 3.5: The default ssl_version is changed from PROTOCOL_SSLv3 to PROTOCOL_TLS for maximum compatibility with modern servers.
ssl.HAS_ALPN  
Whether the OpenSSL library has built-in support for the Application-Layer Protocol Negotiation TLS extension as described in RFC 7301.  New in version 3.5.
ssl.HAS_ECDH  
Whether the OpenSSL library has built-in support for the Elliptic Curve-based Diffie-Hellman key exchange. This should be true unless the feature was explicitly disabled by the distributor.  New in version 3.3.
ssl.HAS_NEVER_CHECK_COMMON_NAME  
Whether the OpenSSL library has built-in support not checking subject common name and SSLContext.hostname_checks_common_name is writeable.  New in version 3.7.
ssl.HAS_NPN  
Whether the OpenSSL library has built-in support for the Next Protocol Negotiation as described in the Application Layer Protocol Negotiation. When true, you can use the SSLContext.set_npn_protocols() method to advertise which protocols you want to support.  New in version 3.3.
ssl.HAS_SNI  
Whether the OpenSSL library has built-in support for the Server Name Indication extension (as defined in RFC 6066).  New in version 3.2.
ssl.HAS_SSLv2  
Whether the OpenSSL library has built-in support for the SSL 2.0 protocol.  New in version 3.7.
ssl.HAS_SSLv3  
Whether the OpenSSL library has built-in support for the SSL 3.0 protocol.  New in version 3.7.
ssl.HAS_TLSv1  
Whether the OpenSSL library has built-in support for the TLS 1.0 protocol.  New in version 3.7.
ssl.HAS_TLSv1_1  
Whether the OpenSSL library has built-in support for the TLS 1.1 protocol.  New in version 3.7.
ssl.HAS_TLSv1_2  
Whether the OpenSSL library has built-in support for the TLS 1.2 protocol.  New in version 3.7.
ssl.HAS_TLSv1_3  
Whether the OpenSSL library has built-in support for the TLS 1.3 protocol.  New in version 3.7.
ssl.match_hostname(cert, hostname)  
Verify that cert (in decoded format as returned by SSLSocket.getpeercert()) matches the given hostname. The rules applied are those for checking the identity of HTTPS servers as outlined in RFC 2818, RFC 5280 and RFC 6125. In addition to HTTPS, this function should be suitable for checking the identity of servers in various SSL-based protocols such as FTPS, IMAPS, POPS and others. CertificateError is raised on failure. On success, the function returns nothing: >>> cert = {'subject': ((('commonName', 'example.com'),),)}
>>> ssl.match_hostname(cert, "example.com")
>>> ssl.match_hostname(cert, "example.org")
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/home/py3k/Lib/ssl.py", line 130, in match_hostname
ssl.CertificateError: hostname 'example.org' doesn't match 'example.com'
  New in version 3.2.   Changed in version 3.3.3: The function now follows RFC 6125, section 6.4.3 and does neither match multiple wildcards (e.g. *.*.com or *a*.example.org) nor a wildcard inside an internationalized domain names (IDN) fragment. IDN A-labels such as www*.xn--pthon-kva.org are still supported, but x*.python.org no longer matches xn--tda.python.org.   Changed in version 3.5: Matching of IP addresses, when present in the subjectAltName field of the certificate, is now supported.   Changed in version 3.7: The function is no longer used to TLS connections. Hostname matching is now performed by OpenSSL. Allow wildcard when it is the leftmost and the only character in that segment. Partial wildcards like www*.example.com are no longer supported.   Deprecated since version 3.7.
class ssl.MemoryBIO  
A memory buffer that can be used to pass data between Python and an SSL protocol instance.  
pending  
Return the number of bytes currently in the memory buffer. 
  
eof  
A boolean indicating whether the memory BIO is current at the end-of-file position. 
  
read(n=-1)  
Read up to n bytes from the memory buffer. If n is not specified or negative, all bytes are returned. 
  
write(buf)  
Write the bytes from buf to the memory BIO. The buf argument must be an object supporting the buffer protocol. The return value is the number of bytes written, which is always equal to the length of buf. 
  
write_eof()  
Write an EOF marker to the memory BIO. After this method has been called, it is illegal to call write(). The attribute eof will become true after all data currently in the buffer has been read.
eof  
A boolean indicating whether the memory BIO is current at the end-of-file position.
read(n=-1)  
Read up to n bytes from the memory buffer. If n is not specified or negative, all bytes are returned.
write(buf)  
Write the bytes from buf to the memory BIO. The buf argument must be an object supporting the buffer protocol. The return value is the number of bytes written, which is always equal to the length of buf.
write_eof()  
Write an EOF marker to the memory BIO. After this method has been called, it is illegal to call write(). The attribute eof will become true after all data currently in the buffer has been read.
ssl.OPENSSL_VERSION  
The version string of the OpenSSL library loaded by the interpreter: >>> ssl.OPENSSL_VERSION
'OpenSSL 1.0.2k  26 Jan 2017'
  New in version 3.2.
ssl.OPENSSL_VERSION_INFO  
A tuple of five integers representing version information about the OpenSSL library: >>> ssl.OPENSSL_VERSION_INFO
(1, 0, 2, 11, 15)
  New in version 3.2.
ssl.OPENSSL_VERSION_NUMBER  
The raw version number of the OpenSSL library, as a single integer: >>> ssl.OPENSSL_VERSION_NUMBER
268443839
>>> hex(ssl.OPENSSL_VERSION_NUMBER)
'0x100020bf'
  New in version 3.2.
ssl.OP_ALL  
Enables workarounds for various bugs present in other SSL implementations. This option is set by default. It does not necessarily set the same flags as OpenSSL’s SSL_OP_ALL constant.  New in version 3.2.
ssl.OP_CIPHER_SERVER_PREFERENCE  
Use the server’s cipher ordering preference, rather than the client’s. This option has no effect on client sockets and SSLv2 server sockets.  New in version 3.3.
ssl.OP_ENABLE_MIDDLEBOX_COMPAT  
Send dummy Change Cipher Spec (CCS) messages in TLS 1.3 handshake to make a TLS 1.3 connection look more like a TLS 1.2 connection. This option is only available with OpenSSL 1.1.1 and later.  New in version 3.8.
ssl.OP_IGNORE_UNEXPECTED_EOF  
Ignore unexpected shutdown of TLS connections. This option is only available with OpenSSL 3.0.0 and later.  New in version 3.10.
ssl.OP_NO_COMPRESSION  
Disable compression on the SSL channel. This is useful if the application protocol supports its own compression scheme. This option is only available with OpenSSL 1.0.0 and later.  New in version 3.3.
ssl.OP_NO_RENEGOTIATION  
Disable all renegotiation in TLSv1.2 and earlier. Do not send HelloRequest messages, and ignore renegotiation requests via ClientHello. This option is only available with OpenSSL 1.1.0h and later.  New in version 3.7.
ssl.OP_NO_SSLv2  
Prevents an SSLv2 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing SSLv2 as the protocol version.  New in version 3.2.   Deprecated since version 3.6: SSLv2 is deprecated
ssl.OP_NO_SSLv3  
Prevents an SSLv3 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing SSLv3 as the protocol version.  New in version 3.2.   Deprecated since version 3.6: SSLv3 is deprecated
ssl.OP_NO_TICKET  
Prevent client side from requesting a session ticket.  New in version 3.6.
ssl.OP_NO_TLSv1  
Prevents a TLSv1 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing TLSv1 as the protocol version.  New in version 3.2.   Deprecated since version 3.7: The option is deprecated since OpenSSL 1.1.0, use the new SSLContext.minimum_version and SSLContext.maximum_version instead.
ssl.OP_NO_TLSv1_1  
Prevents a TLSv1.1 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing TLSv1.1 as the protocol version. Available only with openssl version 1.0.1+.  New in version 3.4.   Deprecated since version 3.7: The option is deprecated since OpenSSL 1.1.0.
ssl.OP_NO_TLSv1_2  
Prevents a TLSv1.2 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing TLSv1.2 as the protocol version. Available only with openssl version 1.0.1+.  New in version 3.4.   Deprecated since version 3.7: The option is deprecated since OpenSSL 1.1.0.
ssl.OP_NO_TLSv1_3  
Prevents a TLSv1.3 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing TLSv1.3 as the protocol version. TLS 1.3 is available with OpenSSL 1.1.1 or later. When Python has been compiled against an older version of OpenSSL, the flag defaults to 0.  New in version 3.7.   Deprecated since version 3.7: The option is deprecated since OpenSSL 1.1.0. It was added to 2.7.15, 3.6.3 and 3.7.0 for backwards compatibility with OpenSSL 1.0.2.
ssl.OP_SINGLE_DH_USE  
Prevents re-use of the same DH key for distinct SSL sessions. This improves forward secrecy but requires more computational resources. This option only applies to server sockets.  New in version 3.3.
ssl.OP_SINGLE_ECDH_USE  
Prevents re-use of the same ECDH key for distinct SSL sessions. This improves forward secrecy but requires more computational resources. This option only applies to server sockets.  New in version 3.3.
ssl.PEM_cert_to_DER_cert(PEM_cert_string)  
Given a certificate as an ASCII PEM string, returns a DER-encoded sequence of bytes for that same certificate.
ssl.PROTOCOL_SSLv2  
Selects SSL version 2 as the channel encryption protocol. This protocol is not available if OpenSSL is compiled with the OPENSSL_NO_SSL2 flag.  Warning SSL version 2 is insecure. Its use is highly discouraged.   Deprecated since version 3.6: OpenSSL has removed support for SSLv2.
ssl.PROTOCOL_SSLv23  
Alias for PROTOCOL_TLS.  Deprecated since version 3.6: Use PROTOCOL_TLS instead.
ssl.PROTOCOL_SSLv3  
Selects SSL version 3 as the channel encryption protocol. This protocol is not be available if OpenSSL is compiled with the OPENSSL_NO_SSLv3 flag.  Warning SSL version 3 is insecure. Its use is highly discouraged.   Deprecated since version 3.6: OpenSSL has deprecated all version specific protocols. Use the default protocol PROTOCOL_TLS with flags like OP_NO_SSLv3 instead.
ssl.PROTOCOL_TLS  
Selects the highest protocol version that both the client and server support. Despite the name, this option can select both “SSL” and “TLS” protocols.  New in version 3.6.
ssl.PROTOCOL_TLSv1  
Selects TLS version 1.0 as the channel encryption protocol.  Deprecated since version 3.6: OpenSSL has deprecated all version specific protocols. Use the default protocol PROTOCOL_TLS with flags like OP_NO_SSLv3 instead.
ssl.PROTOCOL_TLSv1_1  
Selects TLS version 1.1 as the channel encryption protocol. Available only with openssl version 1.0.1+.  New in version 3.4.   Deprecated since version 3.6: OpenSSL has deprecated all version specific protocols. Use the default protocol PROTOCOL_TLS with flags like OP_NO_SSLv3 instead.
ssl.PROTOCOL_TLSv1_2  
Selects TLS version 1.2 as the channel encryption protocol. This is the most modern version, and probably the best choice for maximum protection, if both sides can speak it. Available only with openssl version 1.0.1+.  New in version 3.4.   Deprecated since version 3.6: OpenSSL has deprecated all version specific protocols. Use the default protocol PROTOCOL_TLS with flags like OP_NO_SSLv3 instead.
ssl.PROTOCOL_TLS_CLIENT  
Auto-negotiate the highest protocol version like PROTOCOL_TLS, but only support client-side SSLSocket connections. The protocol enables CERT_REQUIRED and check_hostname by default.  New in version 3.6.
ssl.PROTOCOL_TLS_SERVER  
Auto-negotiate the highest protocol version like PROTOCOL_TLS, but only support server-side SSLSocket connections.  New in version 3.6.
Purpose.CLIENT_AUTH  
Option for create_default_context() and SSLContext.load_default_certs(). This value indicates that the context may be used to authenticate Web clients (therefore, it will be used to create server-side sockets).  New in version 3.4.
Purpose.SERVER_AUTH  
Option for create_default_context() and SSLContext.load_default_certs(). This value indicates that the context may be used to authenticate Web servers (therefore, it will be used to create client-side sockets).  New in version 3.4.
ssl.RAND_add(bytes, entropy)  
Mix the given bytes into the SSL pseudo-random number generator. The parameter entropy (a float) is a lower bound on the entropy contained in string (so you can always use 0.0). See RFC 1750 for more information on sources of entropy.  Changed in version 3.5: Writable bytes-like object is now accepted.
ssl.RAND_bytes(num)  
Return num cryptographically strong pseudo-random bytes. Raises an SSLError if the PRNG has not been seeded with enough data or if the operation is not supported by the current RAND method. RAND_status() can be used to check the status of the PRNG and RAND_add() can be used to seed the PRNG. For almost all applications os.urandom() is preferable. Read the Wikipedia article, Cryptographically secure pseudorandom number generator (CSPRNG), to get the requirements of a cryptographically strong generator.  New in version 3.3.
ssl.RAND_egd(path)  
If you are running an entropy-gathering daemon (EGD) somewhere, and path is the pathname of a socket connection open to it, this will read 256 bytes of randomness from the socket, and add it to the SSL pseudo-random number generator to increase the security of generated secret keys. This is typically only necessary on systems without better sources of randomness. See http://egd.sourceforge.net/ or http://prngd.sourceforge.net/ for sources of entropy-gathering daemons. Availability: not available with LibreSSL and OpenSSL > 1.1.0.
ssl.RAND_pseudo_bytes(num)  
Return (bytes, is_cryptographic): bytes are num pseudo-random bytes, is_cryptographic is True if the bytes generated are cryptographically strong. Raises an SSLError if the operation is not supported by the current RAND method. Generated pseudo-random byte sequences will be unique if they are of sufficient length, but are not necessarily unpredictable. They can be used for non-cryptographic purposes and for certain purposes in cryptographic protocols, but usually not for key generation etc. For almost all applications os.urandom() is preferable.  New in version 3.3.   Deprecated since version 3.6: OpenSSL has deprecated ssl.RAND_pseudo_bytes(), use ssl.RAND_bytes() instead.
ssl.RAND_status()  
Return True if the SSL pseudo-random number generator has been seeded with ‘enough’ randomness, and False otherwise. You can use ssl.RAND_egd() and ssl.RAND_add() to increase the randomness of the pseudo-random number generator.
exception ssl.SSLCertVerificationError  
A subclass of SSLError raised when certificate validation has failed.  New in version 3.7.   
verify_code  
A numeric error number that denotes the verification error. 
  
verify_message  
A human readable string of the verification error.
class ssl.SSLContext(protocol=PROTOCOL_TLS)  
Create a new SSL context. You may pass protocol which must be one of the PROTOCOL_* constants defined in this module. The parameter specifies which version of the SSL protocol to use. Typically, the server chooses a particular protocol version, and the client must adapt to the server’s choice. Most of the versions are not interoperable with the other versions. If not specified, the default is PROTOCOL_TLS; it provides the most compatibility with other versions. Here’s a table showing which versions in a client (down the side) can connect to which versions in a server (along the top):  
client / server SSLv2 SSLv3 TLS 3 TLSv1 TLSv1.1 TLSv1.2  
SSLv2 yes no no 1 no no no  
SSLv3 no yes no 2 no no no  
TLS (SSLv23) 3 no 1 no 2 yes yes yes yes  
TLSv1 no no yes yes no no  
TLSv1.1 no no yes no yes no  
TLSv1.2 no no yes no no yes   Footnotes  
1(1,2)  
SSLContext disables SSLv2 with OP_NO_SSLv2 by default.  
2(1,2)  
SSLContext disables SSLv3 with OP_NO_SSLv3 by default.  
3(1,2)  
TLS 1.3 protocol will be available with PROTOCOL_TLS in OpenSSL >= 1.1.1. There is no dedicated PROTOCOL constant for just TLS 1.3.    See also create_default_context() lets the ssl module choose security settings for a given purpose.   Changed in version 3.6: The context is created with secure default values. The options OP_NO_COMPRESSION, OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE, OP_SINGLE_ECDH_USE, OP_NO_SSLv2 (except for PROTOCOL_SSLv2), and OP_NO_SSLv3 (except for PROTOCOL_SSLv3) are set by default. The initial cipher suite list contains only HIGH ciphers, no NULL ciphers and no MD5 ciphers (except for PROTOCOL_SSLv2).
SSLContext.cert_store_stats()  
Get statistics about quantities of loaded X.509 certificates, count of X.509 certificates flagged as CA certificates and certificate revocation lists as dictionary. Example for a context with one CA cert and one other cert: >>> context.cert_store_stats()
{'crl': 0, 'x509_ca': 1, 'x509': 2}
  New in version 3.4.
SSLContext.check_hostname  
Whether to match the peer cert’s hostname in SSLSocket.do_handshake(). The context’s verify_mode must be set to CERT_OPTIONAL or CERT_REQUIRED, and you must pass server_hostname to wrap_socket() in order to match the hostname. Enabling hostname checking automatically sets verify_mode from CERT_NONE to CERT_REQUIRED. It cannot be set back to CERT_NONE as long as hostname checking is enabled. The PROTOCOL_TLS_CLIENT protocol enables hostname checking by default. With other protocols, hostname checking must be enabled explicitly. Example: import socket, ssl

context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
context.verify_mode = ssl.CERT_REQUIRED
context.check_hostname = True
context.load_default_certs()

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
ssl_sock = context.wrap_socket(s, server_hostname='www.verisign.com')
ssl_sock.connect(('www.verisign.com', 443))
  New in version 3.4.   Changed in version 3.7: verify_mode is now automatically changed to CERT_REQUIRED when hostname checking is enabled and verify_mode is CERT_NONE. Previously the same operation would have failed with a ValueError.   Note This features requires OpenSSL 0.9.8f or newer.