B
U&2>
@ s d Z ddlZddlZddlmZ ddlmZmZ m
Z ddl Z ddl m
Z
mZmZ ddl mZmZmZ ddl mZmZmZmZmZmZmZ ddl mZm Z dd l m Z m Z m Z m!Z! ydd
l m"Z" W n e#k
r Y nX dd l m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- dd l m.Z.m/Z/ e j0d
e1dd e d e j0de1dd e d e j0de1dd e d e j0de1dd e d e j0de1dd e d e j0de1dd e d e2j3 Z4e2_4dd e2j56 D Z7e8e2d dZ9G d d d e Z:ej;d krdd!l mm>Z>m?Z?m@Z@mAZA dd#l>mBZBmCZC ddl>ZDddlEZEddlFZFddlGZGeHZId$gZJeKe d%ZLe.ZMeZNd&d' ZOd(d) ZPd*d+ ZQd,d- ZRed.d/ZSd0d1 ZTG d2d3 d3ed3d4ZUG d5d6 d6eUeZVG d7d8 d8eZWeVjXfdddd9d:d;ZYe3feZdd?Z[eYZ\e[Z]G d@dA dAZ^dBdC Z_G dDdE dEe>Z`e`eW_ae^eW_bddd| r, )sourceOptionsc C s
| dS )NZOP_)r( )r) r* r* r+ r, r- ZAlertDescriptionc C s
| dS )NZALERT_DESCRIPTION_)r( )r) r* r* r+ r, r- ZSSLErrorNumberc C s
| dS )NZ
SSL_ERROR_)r( )r) r* r* r+ r, r- VerifyFlagsc C s
| dS )NZVERIFY_)r( )r) r* r* r+ r, r-
VerifyModec C s
| dS )NZCERT_)r( )r) r* r* r+ r, r- c C s i | ]\}}||qS r* r* ).0r) valuer* r* r+
s r4 ZPROTOCOL_SSLv2c @ s6 e Zd ZejZejZejZ ej
Z ej Z
ejZejZdS )
TLSVersionN)__name__
__module__ __qualname___sslZPROTO_MINIMUM_SUPPORTEDZMINIMUM_SUPPORTEDZ PROTO_SSLv3SSLv3Z PROTO_TLSv1ZTLSv1Z
PROTO_TLSv1_1ZTLSv1_1Z
PROTO_TLSv1_2ZTLSv1_2Z
PROTO_TLSv1_3ZTLSv1_3ZPROTO_MAXIMUM_SUPPORTEDZMAXIMUM_SUPPORTEDr* r* r* r+ r5 s r5 win32)enum_certificates enum_crls)socketAF_INET SOCK_STREAMcreate_connection)
SOL_SOCKETSO_TYPEz
tls-unique HOSTFLAG_NEVER_CHECK_SUBJECTc C s | sdS | d}|s&| | kS |dkrsole wildcard without additional labels are not support: {!r}.z
rb DefaultVerifyPathszQcafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathc C sd t } tj| d | d }tj| d | d }ttj|rF|ndtj|rX|ndf| S )z/Return paths to default cafile and capath.
r rF N) r9 get_default_verify_pathsosenvironrY rc pathisfileisdir)partscafilecapathr* r* r+ rf \ s rf c sD e Zd ZdZdZ fddZe fddZe fddZ Z S ) _ASN1Objectz#ASN.1 object identifier lookup
r* c s t j| ft|dd S )NF)r) )super__new___txt2obj)clsoid) __class__r* r+ rq o s z_ASN1Object.__new__c s t j| ft| S )z3Create _ASN1Object from OpenSSL numeric ID
)rp rq _nid2obj)rs Znid)ru r* r+ fromnidr s z_ASN1Object.fromnidc s t j| ft|dd S )z=Create _ASN1Object from short name, long name or OID
T)r) )rp rq rr )rs r) )ru r* r+ fromnamex s z_ASN1Object.fromname)
r6 r7 r8 __doc__ __slots__rq classmethodrw rx
__classcell__r* r* )ru r+ ro j s
ro znid shortname longname oidc @ s e Zd ZdZdZdZdS )PurposezDSSLContext purpose flags with X509v3 Extended Key Usage objects
z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2N)r6 r7 r8 ry SERVER_AUTHZ CLIENT_AUTHr* r* r* r+ r} s r} c sn e Zd ZdZdZdZdZefddZdd Z d/d
d Z
d0d d
Z dd Z dd Z
dd Zdd ZejfddZeedre fddZej fddZe fd d Zej fd d Ze fd d Zej fd!d Zeed"red#d$ Zejd%d$ Zn ed&d$ Ze fd'd(Z e fd)d*Z e j fd+d*Z e fd,d-Z e j fd.d-Z Z S )1
SSLContextz|An SSLContext holds various SSL-related configuration options and
data, such as certificates and possibly a private key.)ZCAZROOTNc O s t | |}|S )N)r rq )rs protocolargskwargsselfr* r* r+ rq s zSSLContext.__new__c C s4 |d kr d S t |tr&|ddS |dS d S )NZidnaascii)
isinstancestrencodedecode)r rM r* r* r+ _encode_hostname s
zSSLContext._encode_hostnameFTc C s | j j|||||| |dS )N)sock server_sidedo_handshake_on_connectsuppress_ragged_eofsserver_hostnamecontextsession)sslsocket_class_create)r r r r r r r r* r* r+ wrap_socket s zSSLContext.wrap_socketc C s | j j|||| ||| dS )N)r r r r )sslobject_classr r )r incomingoutgoingr r r r* r* r+ wrap_bio s zSSLContext.wrap_bioc C sd t }xN|D ]F}t|d}t|dks2t|dkr:td|t| || q W | | d S )Nr r z(NPN protocols must be 1 to 255 in length) bytearraybytesr[ r rZ extendZ_set_npn_protocols)r Z
npn_protocolsprotosr br* r* r+ set_npn_protocols s
z SSLContext.set_npn_protocolsc s8 d krd _ n$ts td fdd}| _ d S )Nznot a callable objectc s |}| ||S )N)r )sslobjZ
servernameZsslctx)r server_name_callbackr* r+ shim_cb s
z3SSLContext.set_servername_callback..shim_cb)Z sni_callbackcallable TypeError)r r r r* )r r r+ set_servername_callback s z"SSLContext.set_servername_callbackc C sd t }xN|D ]F}t|d}t|dks2t|dkr:td|t| || q W | | d S )Nr r r z)ALPN protocols must be 1 to 255 in length)r r r[ r rZ r Z_set_alpn_protocols)r Zalpn_protocolsr r r r* r* r+ set_alpn_protocols s
z SSLContext.set_alpn_protocolsc C sz t }y@x:t|D ].\}}}|dkr|dks6|j|kr|| qW W n tk
rd td Y nX |rv| j|d |S )NZx509_asnTz-unable to enumerate Windows certificate store)cadata)r r< rt r PermissionErrorwarningswarnload_verify_locations)r storenamepurposeZcertsr_ encodingZtrustr* r* r+ _load_windows_store_certs s z$SSLContext._load_windows_store_certsc C sD t |tst|tjdkr8x| jD ]}| || q$W | d S )Nr; )r ro r sysplatform_windows_cert_storesr Zset_default_verify_paths)r r r r* r* r+ load_default_certs s
z SSLContext.load_default_certsminimum_versionc s t t jS )N)r5 rp r )r )ru r* r+ r s zSSLContext.minimum_versionc s4 |t jkr | jtj M _tttj| | d S )N) r5 r: optionsr/ Z OP_NO_SSLv3rp r r __set__)r r3 )ru r* r+ r s
c s t t jS )N)r5 rp maximum_version)r )ru r* r+ r s zSSLContext.maximum_versionc s t ttj| | d S )N)rp r r r )r r3 )ru r* r+ r s c s t t jS )N)r/ rp r )r )ru r* r+ r s zSSLContext.optionsc s t ttj| | d S )N)rp r r r )r r3 )ru r* r+ r s rD c C s | j tj@ }|tjkS )N) _host_flagsr9 rD )r Zncsr* r* r+ hostname_checks_common_name s z&SSLContext.hostname_checks_common_namec C s, |r| j tj M _ n| j tjO _ d S )N)r r9 rD )r r3 r* r* r+ r s c C s dS )NTr* )r r* r* r+ r s c s t t jS )N)r& rp r )r )ru r* r+ r s zSSLContext.protocolc s t t jS )N)r0 rp verify_flags)r )ru r* r+ r s zSSLContext.verify_flagsc s t ttj| | d S )N)rp r r r )r r3 )ru r* r+ r ! s c s* t j}yt|S tk
r$ |S X d S )N)rp verify_moder1 rR )r r3 )ru r* r+ r % s
zSSLContext.verify_modec s t ttj| | d S )N)rp r r r )r r3 )ru r* r+ r - s )FTTNN)FNN) r6 r7 r8 ry r r r PROTOCOL_TLSrq r r r r r r r r} r~ r hasattrr propertyr setterr r r9 r r r r r| r* r* )ru r+ r sB
r )rm rn r c C sd t | tst| tt}| tjkr0t|_d|_ |s<|s<|rL|
||| n|jt kr`| | |S )zCreate a SSLContext object with default settings.
NOTE: The protocol and settings may change anytime without prior
deprecation. The values represent a fair balance between maximum
compatibility and security.
T)
r ro r r r r} r~
CERT_REQUIREDr check_hostnamer CERT_NONEr )r rm rn r r r* r* r+ create_default_context2 s
r F) cert_reqsr r certfilekeyfilerm rn r c
C s t |tst|t| } |s$d| _|dk r2|| _|r Z"ed?d@ Z# fdAdBZ$edCdD Z%edEdF Z& fdGdHZ'edddIdJZ( fdKdLZ)dMdN Z*dOdP Z+ fdQdRZ,ededTdUZ-edVdW Z. Z/S )f SSLSocketzThis class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel. c O s t | jj dd S )NzX does not have a public constructor. Instances are returned by SSLContext.wrap_socket().)r ru r6 )r r r r* r* r+ r & s zSSLSocket.__init__FTNc
s | tttkrtd|r8|r(td|d k r8td|jrJ|sJtdt|j|j |j
| d}| j | f|} t
t| jf | | | | || _|| _d| _d | _|| _||| _|| _|| _y | W n6 t k
r }
z|
j t j kr d} W d d }
~
X Y nX d} | | _ | ryH| jj!| || j| | jd| _|rj| } | d krbtd
| " W n$ t tfk
r | # Y nX | S ) Nz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)familytypeprotofilenoFT)r r g zHdo_handshake_on_connect should not be specified for non-blocking sockets)$Z
getsockoptrB rC r@ NotImplementedErrorrR r dictr r r r rq rp r r
settimeout
gettimeoutdetach_context_sessionZ_closedr r r r r r getpeernamerQ errnoZENOTCONN
_connected _wrap_socketr close)
rs r r r r r r r r r eZ connectedtimeout)ru r* r+ r - s\
zSSLSocket._createc C s | j S )N)r )r r* r* r+ r l s zSSLSocket.contextc C s || _ || j_d S )N)r r r )r r r* r* r+ r q s c C s | j d k r| j jS d S )N)r r )r r* r* r+ r v s
zSSLSocket.sessionc C s || _ | jd k r|| j_d S )N)r r r )r r r* r* r+ r | s
c C s | j d k r| j jS d S )N)r r )r r* r* r+ r s
zSSLSocket.session_reusedc C s t d| jj d S )NzCan't dup() %s instances)r ru r6 )r r* r* r+ dup s z
SSLSocket.dupc C s d S )Nr* )r msgr* r* r+ _checkClosed s zSSLSocket._checkClosedc C s | j s| d S )N)r r )r r* r* r+ _check_connected s zSSLSocket._check_connected c
C s | | jdkrtdy&|dk r2| j||S | j|S W nJ tk
r } z,|jd tkrx| jrx|dk rrdS dS n W dd}~X Y nX dS )zORead up to LEN bytes and return them.
Return zero-length string on EOF.Nz'Read on closed or unwrapped SSL socket.r r- )r r rR r r r Z
SSL_ERROR_EOFr )r r[ r xr* r* r+ r s
zSSLSocket.readc C s& | | jdkrtd| j|S )zhWrite DATA to the underlying SSL channel. Returns
number of bytes of DATA actually transmitted.Nz(Write on closed or unwrapped SSL socket.)r r rR r )r r r* r* r+ r s
zSSLSocket.writec C s | | | j|S )N)r r r r )r r r* r* r+ r s zSSLSocket.getpeercertc C s* | | jd kstjs d S | j S d S )N)r r r9 r r )r r* r* r+ r s z SSLSocket.selected_npn_protocolc C s* | | jd kstjs d S | j S d S )N)r r r9 r r )r r* r* r+ r s z SSLSocket.selected_alpn_protocolc C s$ | | jd krd S | j S d S )N)r r r )r r* r* r+ r s
zSSLSocket.cipherc C s$ | | jd krd S | j S d S )N)r r r )r r* r* r+ r s
zSSLSocket.shared_ciphersc C s$ | | jd krd S | j S d S )N)r r r )r r* r* r+ r s
zSSLSocket.compressionr c sF | | jd k r4|dkr(td| j | j|S t ||S d S )Nr z3non-zero flags not allowed in calls to send() on %s)r r rR ru r rp send)r r flags)ru r* r+ r s
zSSLSocket.sendc sL | | jd k r"td| j n&|d kr8t ||S t |||S d S )Nz%sendto not allowed on instances of %s)r r rR ru rp sendto)r r Z
flags_or_addrrT )ru r* r+ r s
zSSLSocket.sendtoc O s t d| j d S )Nz&sendmsg not allowed on instances of %s)r ru )r r r r* r* r+ sendmsg s zSSLSocket.sendmsgc
s | | jd k r|dkr(td| j d}t|L}|d6}t|}x&||k rp| ||d }||7 }qLW W d Q R X W d Q R X nt ||S d S )Nr z6non-zero flags not allowed in calls to sendall() on %sB)
r r rR ru
memoryviewcastr[ r rp sendall)r r r rH ZviewZ byte_viewZamountr )ru r* r+ r s
"zSSLSocket.sendallc s, | j dk r| |||S t |||S dS )zSend a file, possibly by using os.sendfile() if this is a
clear-text socket. Return the total number of bytes sent.
N)r Z_sendfile_use_sendrp sendfile)r fileoffsetrH )ru r* r+ r s
zSSLSocket.sendfilec sD | | jd k r2|dkr(td| j | |S t ||S d S )Nr z3non-zero flags not allowed in calls to recv() on %s)r r rR ru r rp recv)r buflenr )ru r* r+ r s
zSSLSocket.recvc sj | |r |d kr t|}n |d kr*d}| jd k rV|dkrJtd| j | ||S t |||S d S )Ni r z8non-zero flags not allowed in calls to recv_into() on %s)r r[ r rR ru r rp recv_into)r r nbytesr )ru r* r+ r
$ s
zSSLSocket.recv_intoc s4 | | jd k r"td| j nt ||S d S )Nz'recvfrom not allowed on instances of %s)r r rR ru rp recvfrom)r r r )ru r* r+ r 3 s
zSSLSocket.recvfromc s6 | | jd k r"td| j nt |||S d S )Nz,recvfrom_into not allowed on instances of %s)r r rR ru rp
recvfrom_into)r r r r )ru r* r+ r ; s
zSSLSocket.recvfrom_intoc O s t d| j d S )Nz&recvmsg not allowed on instances of %s)r ru )r r r r* r* r+ recvmsgC s zSSLSocket.recvmsgc O s t d| j d S )Nz+recvmsg_into not allowed on instances of %s)r ru )r r r r* r* r+ recvmsg_intoG s zSSLSocket.recvmsg_intoc C s$ | | jd k r | j S dS d S )Nr )r r r )r r* r* r+ r K s
zSSLSocket.pendingc s | d | _t | d S )N)r r rp r )r Zhow)ru r* r+ r S s zSSLSocket.shutdownc C s. | j r| j }d | _ |S tdt| d S )NzNo SSL wrapper around )r r rR r )r sr* r* r+ r X s
zSSLSocket.unwrapc C s$ | j r| j S tdt| d S )NzNo SSL wrapper around )r r rR r )r r* r* r+ r a s
z&SSLSocket.verify_client_post_handshakec s d | _ t d S )N)r rp _real_close)r )ru r* r+ r h s zSSLSocket._real_closec C sF | | }z$|dkr(|r(| d | j W d | | X d S )Ng )r r r r r )r blockr r* r* r+ r l s
zSSLSocket.do_handshakec s | j rtd| js | jd k r&td| jj| d| j| | jd| _y>|rVt |}nd }t
| |s~d| _| j r~| |S t
tfk
r d | _ Y nX d S )Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!F)r r T)r rR r r r r r r rp
connect_exconnectr r rQ )r rT r Zrc)ru r* r+
_real_connectw s( zSSLSocket._real_connectc C s | |d dS )zQConnects to remote ADDR, and then wraps the connection in
an SSL channel.FN)r )r rT r* r* r+ r s zSSLSocket.connectc C s | |dS )zQConnects to remote ADDR, and then wraps the connection in
an SSL channel.T)r )r rT r* r* r+ r s zSSLSocket.connect_exc s. t \}}| jj|| j| jdd}||fS )zAccepts a new connection from a remote client, and returns
a tuple containing that new connection wrapped with a server-side
SSL channel, and the address of the remote client.T)r r r )rp acceptr r r r )r ZnewsockrT )ru r* r+ r s zSSLSocket.accept
tls-uniquec C s4 | j d k r| j |S |tkr,td|d S d S )Nz({0} channel binding type not implemented)r r CHANNEL_BINDING_TYPESrR rK )r r r* r* r+ r s
z SSLSocket.get_channel_bindingc C s | j d k r| j S d S d S )N)r r )r r* r* r+ r s
zSSLSocket.version)FTTNNN)N)r N)F)r )N)r )r N)r r )Nr )r r )Nr )F)r )0r6 r7 r8 ry r r{ r r r r r r r r r r r r r r r r r r r r r r r r r
r r r r r r r r r r r r r r r r r| r* r* )ru r+ r ! sf <
r Tc
C sl |r|st d|r |s t dt|}
||
_|r<|
| |rL|
|| | rZ|
| |
j| |||dS )Nz5certfile must be specified for server-side operationszcertfile must be specified)r r r r )rR r r r r Z set_ciphersr ) r r r r r ssl_versionca_certsr r Zciphersr r* r* r+ r s
r c C s ddl m} ddlm} d}d}y || dd d }W n$ tk
rb td | |f Y n0X || dd |}||d |f|d
d S dS ) a Return the time in seconds since the Epoch, given the timestring
representing the "notBefore" or "notAfter" date from a certificate
in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale).
"notBefore" or "notAfter" dates must use UTC (RFC 5280).
Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
UTC should be specified as GMT (see ASN1_TIME_print())
r )strptime)timegm) ZJanZFebZMarZAprZMayZJunZJulZAugZSepZOctZNovZDecz %d %H:%M:%S %Y GMTNre rF z*time data %r does not match format "%%b%s"rd )Ztimer Zcalendarr indextitlerR )Z cert_timer r ZmonthsZ time_formatZ month_numberZttr* r* r+ cert_time_to_seconds s
r# z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----c sR t t| dd tg}| fddtdt dD 7 }|td d|S )z[Takes a certificate in binary DER format and returns the
PEM version of it as a string.ASCIIstrictc s g | ]} ||d qS )@ r* )r2 i)fr* r+
s z(DER_cert_to_PEM_cert..r r&
) r base64Zstandard_b64encode
PEM_HEADERranger[ rZ
PEM_FOOTERr\ )Zder_cert_bytesZssr* )r( r+ DER_cert_to_PEM_cert s
"r/ c C s\ | tstdt | ts0tdt | tttt }t| ddS )zhTakes a certificate in ASCII PEM format and returns the
DER-encoded version of it as a byte sequencez(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr$ r% )
r( r, rR stripendswithr. r[ r+ Z decodebytesr )Zpem_cert_stringdr* r* r+ PEM_cert_to_DER_cert s
r3 c
C sd | \}}|dk rt }nt}t|||d}t| &}||}|d} W dQ R X W dQ R X t| S )zRetrieve the certificate from the server at the specified address,
and return it as a PEM-encoded string.
If 'ca_certs' is specified, validate the server cert against it.
If 'ssl_version' is specified, use it in the connection attempt.N)r rm T)r r _create_stdlib_contextrA r r r/ )
rT r r ZhostZportr r r ZsslsockZdercertr* r* r+ get_server_certificate s
r5 c C s t | dS )Nz )_PROTOCOL_NAMESrY )Z
protocol_coder* r* r+ get_protocol_name& s r7 )kry r rg collectionsr enumr Z_Enumr Z_IntEnumr Z_IntFlagr9 r r r r r
r r r
r r r r r r rr r rv r r r r r ImportErrorr r r r r r r r! r" r# r$ r% _convertr6 r& r r' __members__itemsr6 r Z_SSLv2_IF_EXISTSr5 r r< r= r> r? r@ rA rB rC rP r+ r r rQ Z socket_errorr r ZHAS_NEVER_CHECK_COMMON_NAMEZ_RESTRICTED_SERVER_CIPHERSrJ rO rU rX rb rc rf ro r} r r~ r r r Z _create_default_https_contextr4 r r r r r r r# r, r. r/ r3 r5 r7 r* r* r* r+ [ s $0
1# 9 - (