sslutil: store OP_NO_SSL* constants in module scope

An upcoming patch will introduce a global SSLContext type so we
have a single function used to wrap sockets. Prepare for that by
introducing module level constants for disabling SSLv2 and SSLv3.

mercurial/sslutil.py

@@ -29,6 +29,13 b' from . import ('
 
 hassni = getattr(ssl, 'HAS_SNI', False)
 
+try:
+    OP_NO_SSLv2 = ssl.OP_NO_SSLv2
+    OP_NO_SSLv3 = ssl.OP_NO_SSLv3
+except AttributeError:
+    OP_NO_SSLv2 = 0x1000000
+    OP_NO_SSLv3 = 0x2000000
+
 _canloaddefaultcerts = False
 try:
     # ssl.SSLContext was added in 2.7.9 and presence indicates modern
@@ -48,7 +55,7 b' try:'
         # maintainers for us, but that breaks too many things to
         # do it in a hurry.
         sslcontext = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
-        sslcontext.options |= ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3
+        sslcontext.options |= OP_NO_SSLv2 | OP_NO_SSLv3
         if certfile is not None:
             def password():
                 f = keyfile or certfile