(cherry picked from commit af8d6b90)

(cherry picked from commit e3b2b4b8)

* bpo-29136: Add TLS 1.3 support

TLS 1.3 introduces a new, distinct set of cipher suites. The TLS 1.3
cipher suites don't overlap with cipher suites from TLS 1.2 and earlier.
Since Python sets its own set of permitted ciphers, TLS 1.3 handshake
will fail as soon as OpenSSL 1.1.1 is released. Let's enable the common
AES-GCM and ChaCha20 suites.

Additionally the flag OP_NO_TLSv1_3 is added. It defaults to 0 (no op) with
OpenSSL prior to 1.1.1. This allows applications to opt-out from TLS 1.3
now.

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit cb5b68ab)

[3.6] bpo-30640: Fix undefined behavior in _PyFunction_FastCallDict() and PyEval_EvalCodeEx() (GH-2919) (#2964)

k + 1 was calculated with k = NULL..
(cherry picked from commit c6ea8974)

Rather than requiring the path to blurb and/or sphinx-build to be specified to the make rule, enhance the Doc/Makefile to look for each first in a virtual environment created by make venv and, if not found, look on the normal process PATH. This allows the Doc/Makefile to take advantage of an installed spinx-build or blurb and, thus, do the right thing most of the time. Also, make the directory for the venv be configurable and document the `make venv` target.
(cherry picked from commit 590665c3)

* bpo-27340: Use memoryview in SSLSocket.sendall()

SSLSocket.sendall() now uses memoryview to create slices of data. This fix
support for all bytes-like object. It is also more efficient and avoids
costly copies.
Signed-off-by: Christian Heimes <christian@python.org>

* Cast view to bytes, fix typo

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 888bbdc1)

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 17c9ac92)

To match the documentation updates already made.
Also renames the local variable used within to match
what it actually holds.
(cherry picked from commit 2eb0cb47)

* Fix ZeroMQSocketListener and ZeroMQSocketHandler examples

* Use send_json and recv_json to simplify pyzmq interfacing

* Add News entry
(cherry picked from commit 586c0502)

Also provide a solution if the user wants to keep multiple blank lines.
(cherry picked from commit 397c467c)

(cherry picked from commit a853a8ba)

Use base class rather than metaclass in examples.
(cherry picked from commit 122e88a8)

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit d3b9f97e)

The `subprocess.getstatusoutput` API was inadvertently changed
in Python 3.3.4.  Document the change, it is too late to undo the
API change now as it has shipped in many stable releases.
(cherry picked from commit 738b7d97)

For f-string ast nodes, fix the line and columns so that tools such as flake8 can identify them correctly.
(cherry picked from commit e7c566ca)

(cherry picked from commit 1ba9469e)

Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit ad0ffa03)

(cherry picked from commit 8204b903)

[3.6] bpo-31340: Change to building with MSVC v141 (included with Visual Studio 2017) (GH-3311) (#3386)

Update old devguide links from https://docs.python.org/devguide to https://devguide.python.org
(cherry picked from commit 384899df)

Avoid concatenating bytes with str in the typically rare subprocess error path (exec failed). Includes a mock based unittest to exercise the codepath.
(cherry picked from commit 3fc499bc)

One test case of test_xmlrpc uses HTTPServer with a subclass of
BaseHTTPRequestHandler. The BaseRequestHandler class logs to
sys.stderr by default. Override log_message() to not clobber
test output.
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 3463ee39)

SSLObject.version() now correctly returns None when handshake over BIO has
not been performed yet.
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 68771116)

_PyUnicode_FromId() can return NULL: replace Py_INCREF() with
Py_XINCREF().

Fix coverity report: CID 1417269.
(cherry picked from commit af46eb8d)

* call remove_done_callback in finally section

* Optimize get_event_loop and _get_running_loop

* rename _loop_pid as loop_pid and add blurb news

* rename _loop_pid as loop_pid and add blurb news

* add back _RunningLoop

* Update 2017-09-05-10-30-48.bpo-31350.dXJ-7N.rst

* Update 2017-09-05-10-30-48.bpo-31350.dXJ-7N.rst
(cherry picked from commit 80bbe6a7)

* fixed OrderedDict.__init__ docstring re PEP 468

* tightened comment and mirrored to C impl

* added space after period per marco-buttu

* preserved substituted for stable

* drop references to Python 3.6 and PEP 468
(cherry picked from commit faa57cbe)

In case PROTOCOL_TLS_SERVER is used for both client context and server
context, the test thread dies with OSError. Catch OSError to avoid
traceback on sys.stderr
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 305e56c2)

(cherry picked from commit f801322e)

(cherry picked from commit 60dbed18)

(cherry picked from commit 1de4705d)

* bpo-31170: Update libexpat from 2.2.3 to 2.2.4

Fix copying of partial characters for UTF-8 input (libexpat bug 115):
https://github.com/libexpat/libexpat/issues/115

* Add NEWS entry.

(cherry picked from commit 759e30ec)

Running under coverage sometimes causes 'in comparison' to be added to the end of the RecursionError message, which is acceptable.

Patched by Maria Mckinley

(cherry picked from commit 3480ef9d)

Drop handshake_done and peer_cert members from PySSLSocket struct. The
peer certificate can be acquired from *SSL directly.
SSL_get_peer_certificate() does not trigger any network activity.
Instead of manually tracking the handshake state, simply use
SSL_is_init_finished().

In combination these changes fix auto-handshake for non-blocking
MemoryBIO connections.

Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 66dc33b6)

(cherry picked from commit e503ca52)

The ssl and hashlib modules now call OPENSSL_add_all_algorithms_noconf() on
OpenSSL < 1.1.0. The function detects CPU features and enables optimizations
on some CPU architectures such as POWER8. Patch is based on research from
Gustavo Serra Scalet.
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit c941e623)