diff -N -u -r python-nss-0.14.0/doc/ChangeLog python-nss-0.14.1/doc/ChangeLog

--- python-nss-0.14.0/doc/ChangeLog	2013-05-02 17:29:27.000000000 -0400

+++ python-nss-0.14.1/doc/ChangeLog	2013-10-09 09:35:29.000000000 -0400

@@ -1,5 +1,37 @@

-2013-04-24  John Dennis  <jdennis@redhat.com> 0.14.0

-  External Changes

+2013-10-09  John Dennis  <jdennis@redhat.com> 0.14.1

+

+  Modifications only to tests and examples.

+

+  * Fix bug in ssl_example.py and test_client_server.py where complete

+    data was not read from socket. The Beast CVE fix in NSS causes

+    only one octet to be sent in the first socket packet and then the

+    remaining data is sent normally, this is known as 1/n-1 record

+    splitting. The example and test SSL code sent short messages and

+    then did a sock.recv(1024). We had always received the entire

+    message in one sock.recv() call because it was so short. But

+    sock.recv() does not guarantee how much data will be received,

+    thus this was a coding mistake. The solution is straight forward,

+    use newlines as a record separator and call sock.readline()

+    instead of sock.recv(). sock.readline() calls sock.recv()

+    internally until a complete line is read or the socket is closed.

+

+  * Rewrite setup_certs.py, it was written like an expect script

+    reacting to prompts read from a pseudo terminal but it was fragile

+    and would hang on some systems. New version uses temporary

+    password file and writes hardcoded responses to the stdin of

+    certuil and modutil.

+

+  * setup_certs now creates a new sql sytle NSS database (sql:pki)

+

+  * All tests and examples now load the sql:pki database. Command line

+    arg and variable changed from dbdir to db_name to reflect the

+    database specification is no longer just a directory.

+

+  * All command line process in test and examples now uses modern

+    argparse module instead of deprecated getopt and optparse. Some

+    command line args were tweaked.

+

+2013-04-24 John Dennis <jdennis@redhat.com> 0.14.0 External Changes

   ----------------

   The primary enhancements in this version is support of certifcate

diff -N -u -r python-nss-0.14.0/doc/examples/cert_dump.py python-nss-0.14.1/doc/examples/cert_dump.py

--- python-nss-0.14.0/doc/examples/cert_dump.py	2013-04-23 13:36:53.000000000 -0400

+++ python-nss-0.14.1/doc/examples/cert_dump.py	2013-10-08 12:59:24.000000000 -0400

@@ -18,10 +18,10 @@

 components of a cert.

 '''

+import argparse

+import getpass

 import os

 import sys

-import getopt

-import getpass

 from nss.error import NSPRError

 import nss.io as io

@@ -93,57 +93,34 @@

 # -----------------------------------------------------------------------------

-usage_str = '''

--p --pem        read the certifcate in PEM ascii format (default)

--d --der        read the certifcate in DER binary format

--P --print-cert print the cert using the internal rendering code

-'''

-

-def usage():

-    print usage_str

-

-try:

-    opts, args = getopt.getopt(sys.argv[1:], "hpdP",

-                               ["help", "pem", "der", "print-cert"])

-except getopt.GetoptError:

-    # print help information and exit:

-    usage()

-    sys.exit(2)

-

-

-filename = 'cert.der'

-is_pem_format = True

-print_cert = False

-

-for o, a in opts:

-    if o in ("-H", "--help"):

-        usage()

-        sys.exit()

-    elif o in ("-p", "--pem"):

-        is_pem_format = True

-    elif o in ("-d", "--der"):

-        is_pem_format = False

-    elif o in ("-P", "--print-cert"):

-        print_cert = True

-

-

-filename = sys.argv[1]

+parser = argparse.ArgumentParser(description='cert formatting example',

+                                 formatter_class=argparse.ArgumentDefaultsHelpFormatter)

+parser.add_argument('-f', '--cert-format', choices=['pem', 'der'],

+                    help='format of input cert')

+parser.add_argument('-p', '--print-cert', action='store_true',

+                    help='print the cert using the internal rendering code')

+parser.add_argument('cert_file', nargs=1,

+                    help='input cert file to process')

+

+parser.set_defaults(cert_format='pem',

+                    print_cert=False

+                    )

+options = parser.parse_args()

 # Perform basic configuration and setup

 nss.nss_init_nodb()

-if len(args):

-    filename = args[0]

+filename = options.cert_file[0]

 print "certificate filename=%s" % (filename)

 # Read the certificate as DER encoded data

-si = nss.read_der_from_file(filename, is_pem_format)

+si = nss.read_der_from_file(filename, options.cert_format == 'pem')

 # Parse the DER encoded data returning a Certificate object

 cert = nss.Certificate(si)

 # Useful for comparing the internal cert rendering to what this script generates.

-if print_cert:

+if options.print_cert:

     print cert

 # Get the extension list from the certificate

diff -N -u -r python-nss-0.14.0/doc/examples/httplib_example.py python-nss-0.14.1/doc/examples/httplib_example.py

--- python-nss-0.14.0/doc/examples/httplib_example.py	2013-04-15 13:05:46.000000000 -0400

+++ python-nss-0.14.1/doc/examples/httplib_example.py	2013-10-08 13:04:03.000000000 -0400

@@ -4,13 +4,13 @@

 # License, v. 2.0. If a copy of the MPL was not distributed with this

 # file, You can obtain one at http://mozilla.org/MPL/2.0/.

-import sys

+import argparse

 import errno

-import getopt

-import urlparse

-import httplib

 import getpass

+import httplib

 import logging

+import sys

+import urlparse

 from nss.error import NSPRError

 import nss.io as io

@@ -19,14 +19,6 @@

 #------------------------------------------------------------------------------

-httplib_debug_level = 0

-logging_debug_level = logging.INFO

-certdir = 'pki'

-password = ''

-nickname = ''

-url = 'https://sourceforge.net/projects/python'

-use_ssl = True

-use_connection_class = True

 timeout_secs = 3

 #------------------------------------------------------------------------------

@@ -94,28 +86,6 @@

     logging.debug('cert valid %s for "%s"', cert_is_valid,  cert.subject)

     return cert_is_valid

-def client_auth_data_callback(ca_names, chosen_nickname, password, certdb):

-    cert = None

-    if chosen_nickname:

-        try:

-            cert = nss.find_cert_from_nickname(chosen_nickname, password)

-            priv_key = nss.find_key_by_any_cert(cert, password)

-            return cert, priv_key

-        except NSPRError:

-            return False

-    else:

-        nicknames = nss.get_cert_nicknames(certdb, nss.SEC_CERT_NICKNAMES_USER)

-        for nickname in nicknames:

-            try:

-                cert = nss.find_cert_from_nickname(nickname, password)

-                if cert.check_valid_times():

-                    if cert.has_signer_in_ca_names(ca_names):

-                        priv_key = nss.find_key_by_any_cert(cert, password)

-                        return cert, priv_key

-            except NSPRError:

-                return False

-        return False

-

 def password_callback(slot, retry, password):

     if not retry and password: return password

     return getpass.getpass("Enter password for %s: " % slot.token_name);

@@ -136,7 +106,7 @@

         if not dbdir:

             raise RuntimeError("dbdir is required")

-        logging.debug('%s init %s', self.__class__.__name__, host)

+        logging.debug('%s init host=%s dbdir=%s', self.__class__.__name__, host, dbdir)

         if not nss.nss_is_initialized(): nss.nss_init(dbdir)

         self.sock = None

         ssl.set_domestic_policy()

@@ -231,33 +201,46 @@

 #------------------------------------------------------------------------------

-opts, args = getopt.getopt(sys.argv[1:],

-                           'Dd:n:w:sScC',

-                           ['debuglevel','certdir=','nickname=','password=',

-                            'use-ssl', 'no-ssl', 'use-connection-class', 'no-connection-class'])

-for o, a in opts:

-    if o in('-D', '--httplib_debug_level'):

-        httplib_debug_level = httplib_debug_level + 1

-    elif o in ("-d", "--certdir"):

-        certdir = a

-    elif o in ("-n", "--nickname"):

-        nickname = a

-    elif o in ("-w", "--password"):

-        password = a

-    elif o in ("-s", "--use-ssl"):

-        use_ssl = True

-    elif o in ("-S", "--no-ssl"):

-        use_ssl = False

-    elif o in ("-c", "--use-connection-class"):

-        use_connection_class = True

-    elif o in ("-C", "--no-connection-class"):

-        use_connection_class = False

+parser = argparse.ArgumentParser(description='httplib example')

-if len(args) > 0:

-    url = args[0]

+parser.add_argument('-d', '--db-name',

+                    help='NSS database name (e.g. "sql:pki")')

+parser.add_argument('--db-passwd',

+                    help='NSS database password')

-if httplib_debug_level > 0:

+parser.add_argument('-s', '--ssl', dest='use_ssl', action='store_true',

+                    help='use SSL connection')

+

+parser.add_argument('-S', '--no-ssl', dest='use_ssl', action='store_false',

+                    help='do not use SSL connection')

+

+parser.add_argument('-c', '--connection-class', dest='use_connection_class', action='store_true',

+                    help='use connection class')

+

+parser.add_argument('-C', '--no-connection-class', dest='use_connection_class', action='store_false',

+                    help='do not use connection class')

+

+parser.add_argument('-D', '--httplib-debug-level', action='count',

+                    help='httplib debug level')

+

+parser.add_argument('url', nargs=1,

+                    help='URL to open (e.g. "https://sourceforge.net/projects/python"')

+

+parser.set_defaults(db_name = 'sql:pki',

+                    db_passwd = 'db_passwd',

+                    httplib_debug_level = 0,

+                    use_ssl = True,

+                    use_connection_class = True,

+                    )

+

+options = parser.parse_args()

+

+

+url = options.url[0]

+

+logging_debug_level = logging.INFO

+if options.httplib_debug_level > 0:

     logging_debug_level = logging.DEBUG

 else:

     logging_debug_level = logging.INFO

@@ -269,7 +252,7 @@

 # Perform basic configuration and setup

 url_components = urlparse.urlsplit(url)

-if use_ssl:

+if options.use_ssl:

     url_components.schema = 'https'

 else:

     url_components.schema = 'http'

@@ -280,14 +263,14 @@

     print "ERROR: bad url \"%s\"" % (url)

     sys.exit(1)

-if use_connection_class:

-    if use_ssl:

+if options.use_connection_class:

+    if options.use_ssl:

         logging.info("Start (using NSSConnection class) %s", url)

-        conn = NSSConnection(url_components.netloc, 443, dbdir="/etc/pki/nssdb")

+        conn = NSSConnection(url_components.netloc, 443, dbdir=options.db_name)

     else:

         logging.info("Start (using NSPRConnection class) %s", url)

         conn = NSPRConnection(url_components.netloc, 80)

-    conn.set_debuglevel(httplib_debug_level)

+    conn.set_debuglevel(options.httplib_debug_level)

     conn.connect()

     conn.request("GET", "/")

     response = conn.getresponse()

@@ -302,13 +285,13 @@

     print data

     conn.close()

 else:

-    if use_ssl:

+    if options.use_ssl:

         logging.info("Start (using NSSHTTPS class) %s", url)

-        h = NSSHTTPS(url_components.netloc, 443, dbdir="/etc/pki/nssdb")

+        h = NSSHTTPS(url_components.netloc, 443, dbdir=options.db_name)

     else:

         logging.info("Start (using NSPRHTTP class) %s", url)

         h = NSPRHTTP(url_components.netloc, 80)

-    h.set_debuglevel(httplib_debug_level)

+    h.set_debuglevel(options.httplib_debug_level)

     h.connect()

     h.putrequest('GET', '/')

     h.endheaders()

diff -N -u -r python-nss-0.14.0/doc/examples/ssl_example.py python-nss-0.14.1/doc/examples/ssl_example.py

--- python-nss-0.14.0/doc/examples/ssl_example.py	2013-04-15 13:05:46.000000000 -0400

+++ python-nss-0.14.1/doc/examples/ssl_example.py	2013-10-09 00:07:54.000000000 -0400

@@ -7,10 +7,10 @@

 import warnings

 warnings.simplefilter( "always", DeprecationWarning)

+import argparse

+import getpass

 import os

 import sys

-import getopt

-import getpass

 from nss.error import NSPRError

 import nss.io as io

@@ -24,19 +24,7 @@

 REQUEST_CLIENT_CERT_ALWAYS = 3

 REQUIRE_CLIENT_CERT_ALWAYS = 4

-# command line parameters, default them to something reasonable

-client = False

-server = False

-password = 'db_passwd'

-use_ssl = True

-client_cert_action = NO_CLIENT_CERT

-certdir = 'pki'

-hostname = os.uname()[1]

-server_nickname = 'test_server'

-client_nickname = 'test_user'

-port = 1234

 timeout_secs = 3

-family = io.PR_AF_UNSPEC

 # -----------------------------------------------------------------------------

 # Utility Functions

@@ -63,7 +51,7 @@

     if pin_args is None:

         pin_args = ()

-    print "cert:\n%s" % cert

+    print "peer cert:\n%s" % cert

     # Define how the cert is being used based upon the is_server flag.  This may

     # seem backwards, but isn't. If we're a server we're trying to validate a

@@ -149,30 +137,30 @@

     valid_addr = False

     # Get the IP Address of our server

     try:

-        addr_info = io.AddrInfo(hostname)

+        addr_info = io.AddrInfo(options.hostname)

     except Exception, e:

-        print "could not resolve host address \"%s\"" % hostname

+        print "could not resolve host address \"%s\"" % options.hostname

         return

     for net_addr in addr_info:

-        if family != io.PR_AF_UNSPEC:

-            if net_addr.family != family: continue

-        net_addr.port = port

+        if options.family != io.PR_AF_UNSPEC:

+            if net_addr.family != options.family: continue

+        net_addr.port = options.port

-        if use_ssl:

+        if options.use_ssl:

             sock = ssl.SSLSocket(net_addr.family)

             # Set client SSL socket options

             sock.set_ssl_option(ssl.SSL_SECURITY, True)

             sock.set_ssl_option(ssl.SSL_HANDSHAKE_AS_CLIENT, True)

-            sock.set_hostname(hostname)

+            sock.set_hostname(options.hostname)

             # Provide a callback which notifies us when the SSL handshake is complete

             sock.set_handshake_callback(handshake_callback)

             # Provide a callback to supply our client certificate info

-            sock.set_client_auth_data_callback(client_auth_data_callback, client_nickname,

-                                               password, nss.get_default_certdb())

+            sock.set_client_auth_data_callback(client_auth_data_callback, options.client_nickname,

+                                               options.password, nss.get_default_certdb())

             # Provide a callback to verify the servers certificate

             sock.set_auth_certificate_callback(auth_certificate_callback,

@@ -192,17 +180,18 @@

     if not valid_addr:

         print "Could not establish valid address for \"%s\" in family %s" % \

-        (hostname, io.addr_family_name(family))

+        (options.hostname, io.addr_family_name(options.family))

         return

     # Talk to the server

     try:

-        sock.send("Hello")

-        buf = sock.recv(1024)

+        sock.send('Hello' + '\n') # newline is protocol record separator

+        buf = sock.readline()

         if not buf:

             print "client lost connection"

             sock.close()

             return

+        buf = buf.rstrip()        # remove newline record separator

         print "client received: %s" % (buf)

     except Exception, e:

         print e.strerror

@@ -221,7 +210,7 @@

     try:

         sock.close()

-        if use_ssl:

+        if options.use_ssl:

             ssl.clear_session_cache()

     except Exception, e:

         print e

@@ -231,36 +220,34 @@

 # -----------------------------------------------------------------------------

 def Server():

-    global family

-

-    # Perform basic SSL server configuration

-    ssl.set_default_cipher_pref(ssl.SSL_RSA_WITH_NULL_MD5, True)

-    ssl.config_server_session_id_cache()

-

-    # Get our certificate and private key

-    server_cert = nss.find_cert_from_nickname(server_nickname, password)

-    priv_key = nss.find_key_by_any_cert(server_cert, password)

-    server_cert_kea = server_cert.find_kea_type();

-

-    print "server cert:\n%s" % server_cert

-

     # Setup an IP Address to listen on any of our interfaces

-    if family == io.PR_AF_UNSPEC:

-        family = io.PR_AF_INET

-    net_addr = io.NetworkAddress(io.PR_IpAddrAny, port, family)

+    if options.family == io.PR_AF_UNSPEC:

+        options.family = io.PR_AF_INET

+    net_addr = io.NetworkAddress(io.PR_IpAddrAny, options.port, options.family)

+

+    if options.use_ssl:

+        # Perform basic SSL server configuration

+        ssl.set_default_cipher_pref(ssl.SSL_RSA_WITH_NULL_MD5, True)

+        ssl.config_server_session_id_cache()

+

+        # Get our certificate and private key

+        server_cert = nss.find_cert_from_nickname(options.server_nickname, options.password)

+        priv_key = nss.find_key_by_any_cert(server_cert, options.password)

+        server_cert_kea = server_cert.find_kea_type();

+

+        print "server cert:\n%s" % server_cert

-    if use_ssl:

         sock = ssl.SSLSocket(net_addr.family)

         # Set server SSL socket options

-        sock.set_pkcs11_pin_arg(password)

+        sock.set_pkcs11_pin_arg(options.password)

         sock.set_ssl_option(ssl.SSL_SECURITY, True)

         sock.set_ssl_option(ssl.SSL_HANDSHAKE_AS_SERVER, True)

         # If we're doing client authentication then set it up

-        if client_cert_action >= REQUEST_CLIENT_CERT_ONCE:

+        if options.client_cert_action >= REQUEST_CLIENT_CERT_ONCE:

             sock.set_ssl_option(ssl.SSL_REQUEST_CERTIFICATE, True)

-        if client_cert_action == REQUIRE_CLIENT_CERT_ONCE:

+        if options.client_cert_action == REQUIRE_CLIENT_CERT_ONCE:

             sock.set_ssl_option(ssl.SSL_REQUIRE_CERTIFICATE, True)

         sock.set_auth_certificate_callback(auth_certificate_callback, nss.get_default_certdb())

@@ -278,7 +265,7 @@

     while True:

         # Accept a connection from a client

         client_sock, client_addr = sock.accept()

-        if use_ssl:

+        if options.use_ssl:

             client_sock.set_handshake_callback(handshake_callback)

         print "client connect from: %s" % (client_addr)

@@ -286,14 +273,15 @@

         while True:

             try:

                 # Handle the client connection

-                buf = client_sock.recv(1024)

+                buf = client_sock.readline()

                 if not buf:

                     print "server lost lost connection to %s" % (client_addr)

                     break

+                buf = buf.rstrip()                 # remove newline record separator

                 print "server received: %s" % (buf)

-                client_sock.send("Goodbye")

+                client_sock.send('Goodbye' + '\n') # newline is protocol record separator

                 try:

                     client_sock.shutdown(io.PR_SHUTDOWN_RCV)

                     client_sock.close()

@@ -308,7 +296,7 @@

     try:

         sock.shutdown()

         sock.close()

-        if use_ssl:

+        if options.use_ssl:

             ssl.shutdown_server_session_id_cache()

     except Exception, e:

         print e

@@ -316,141 +304,121 @@

 # -----------------------------------------------------------------------------

-usage_str = '''

--C --client     run as the client (default: %(client)s)

--S --server     run as the server (default: %(server)s)

--d --certdir    certificate directory (default: %(certdir)s)

--h --hostname   host to connect to (default: %(hostname)s)

--f --family     may be inet|inet6|unspec (default: %(family)s)

-                if unspec client tries all addresses returned by AddrInfo

-                          server binds to IPv4 "any" wildcard address

-                if inet   client tries IPv4 addresses returned by AddrInfo

-                          server binds to IPv4 "any" wildcard address

-                if inet6  client tries IPv6 addresses returned by AddrInfo

-                          server binds to IPv6 "any" wildcard address

--4 --inet       set family to inet (see family)

--6 --inet6      set family to inet6 (see family)

--n --server_nickname server certificate nickname (default: %(server_nickname)s)

--N --client_nickname client certificate nickname (default: %(client_nickname)s)

--w --password   certificate database password (default: %(password)s)

--p --port       host port (default: %(port)s)

--e --encrypt    use SSL (default) (default: %(encrypt)s)

--E --noencrypt  don't use SSL (default: %(noencrypt)s)

--f --require_cert_once (default: %(require_cert_once)s)

--F --require_cert_always (default: %(require_cert_always)s)

--r --request_cert_once (default: %(request_cert_once)s)

--R --request_cert_always (default: %(request_cert_always)s)

--H --help

-''' % {

-       'client'              : client,

-       'server'              : server,

-       'certdir'             : certdir,

-       'hostname'            : hostname,

-       'family'              : io.addr_family_name(family),

-       'server_nickname'     : server_nickname,

-       'client_nickname'     : client_nickname,

-       'password'            : password,

-       'port'                : port,

-       'encrypt'             : use_ssl is True,

-       'noencrypt'           : use_ssl is False,

-       'require_cert_once'   : client_cert_action == REQUIRE_CLIENT_CERT_ONCE,

-       'require_cert_always' : client_cert_action == REQUIRE_CLIENT_CERT_ALWAYS,

-       'request_cert_once'   : client_cert_action == REQUEST_CLIENT_CERT_ONCE,

-       'request_cert_always' : client_cert_action == REQUEST_CLIENT_CERT_ALWAYS,

-       }

-

-def usage():

-    print usage_str

-

-try:

-    opts, args = getopt.getopt(sys.argv[1:], "Hd:h:f:46n:N:w:p:CSeE",

-                               ["help", "certdir=", "hostname=",

-                                "family", "inet", "inet6",

-                                "server_nickname=", "client_nickname=",

-                                "password=", "port=",

-                                "client", "server", "encrypt", "noencrypt",

-                                "require_cert_once", "require_cert_always",

-                                "request_cert_once", "request_cert_always",

-                                ])

-except getopt.GetoptError:

-    # print help information and exit:

-    usage()

-    sys.exit(2)

-

-

-for o, a in opts:

-    if o in ("-d", "--certdir"):

-        certdir = a

-    elif o in ("-h", "--hostname"):

-        hostname = a

-    elif o in ("-f", "--family"):

-        if a == "inet":

+class FamilyArgAction(argparse.Action):

+    def __call__(self, parser, namespace, values, option_string=None):

+        value = values[0]

+        if value == "inet":

             family = io.PR_AF_INET

-        elif a == "inet6":

+        elif value == "inet6":

             family = io.PR_AF_INET6

-        elif a == "unspec":

+        elif value == "unspec":

             family = io.PR_AF_UNSPEC

         else:

-            print "unknown address family (%s)" % (a)

-            usage()

-            sys.exit()

-    elif o in ("-4", "--inet"):

-        family = io.PR_AF_INET

-    elif o in ("-6", "--inet6"):

-        family = io.PR_AF_INET6

-    elif o in ("-n", "--server_nickname"):

-        server_nickname = a

-    elif o in ("-N", "--client_nickname"):

-        client_nickname = a

-    elif o in ("-w", "--password"):

-        password = a

-    elif o in ("-p", "--port"):

-        port = int(a)

-    elif o in ("-C", "--client"):

-        client = True

-    elif o in ("-S", "--server"):

-        server = True

-    elif o in ("-e", "--encrypt"):

-        use_ssl = True

-    elif o in ("-E", "--noencrypt"):

-        use_ssl = False

-    elif o in ("--require_cert_once"):

-        client_cert_action = REQUIRE_CLIENT_CERT_ONCE

-    elif o in ("--require_cert_always"):

-        client_cert_action = REQUIRE_CLIENT_CERT_ALWAYS

-    elif o in ("--request_cert_once"):

-        client_cert_action = REQUEST_CLIENT_CERT_ONCE

-    elif o in ("--request_cert_always"):

-        client_cert_action = REQUEST_CLIENT_CERT_ALWAYS

-    elif o in ("-H", "--help"):

-        usage()

-        sys.exit()

-    else:

-        usage()

-        sys.exit()

+            raise argparse.ArgumentError(self, "unknown address family (%s)" % (value))

+        setattr(namespace, self.dest, family)

+

+parser = argparse.ArgumentParser(description='SSL example')

+

+parser.add_argument('-C', '--client', action='store_true',

+                    help='run as the client')

+

+parser.add_argument('-S', '--server', action='store_true',

+                    help='run as the server')

+

+parser.add_argument('-d', '--db-name',

+                    help='NSS database name (e.g. "sql:pki")')

+

+parser.add_argument('-H', '--hostname',

+                    help='host to connect to')

+

+parser.add_argument('-f', '--family',

+                    choices=['unspec', 'inet', 'inet6'],

+                    dest='family', action=FamilyArgAction, nargs=1,

+                    help='''

+                      If unspec client tries all addresses returned by AddrInfo,

+                      server binds to IPv4 "any" wildcard address.

+

+                      If inet client tries IPv4 addresses returned by AddrInfo,

+                      server binds to IPv4 "any" wildcard address.

+

+                      If inet6 client tries IPv6 addresses returned by AddrInfo,

+                      server binds to IPv6 "any" wildcard address''')

-if client and server:

+parser.add_argument('-4', '--inet',

+                    dest='family', action='store_const', const=io.PR_AF_INET,

+                    help='set family to inet (see family)')

+

+parser.add_argument('-6', '--inet6',

+                    dest='family', action='store_const', const=io.PR_AF_INET6,

+                    help='set family to inet6 (see family)')

+

+parser.add_argument('-n', '--server-nickname',

+                    help='server certificate nickname')

+

+parser.add_argument('-N', '--client-nickname',

+                    help='client certificate nickname')

+

+parser.add_argument('-w', '--password',

+                    help='certificate database password')

+

+parser.add_argument('-p', '--port', type=int,

+                    help='host port')

+

+parser.add_argument('-e', '--encrypt', dest='use_ssl', action='store_true',

+                    help='use SSL connection')

+

+parser.add_argument('-E', '--no-encrypt', dest='use_ssl', action='store_false',

+                    help='do not use SSL connection')

+

+parser.add_argument('--require-cert-once', dest='client_cert_action',

+                    action='store_const', const=REQUIRE_CLIENT_CERT_ONCE)

+

+parser.add_argument('--require-cert-always', dest='client_cert_action',

+                    action='store_const', const=REQUIRE_CLIENT_CERT_ALWAYS)

+

+parser.add_argument('--request-cert-once', dest='client_cert_action',

+                    action='store_const', const=REQUEST_CLIENT_CERT_ONCE)

+

+parser.add_argument('--request-cert-always', dest='client_cert_action',