o
aiC @ s d dl mZ d dlZd dlZd dlZd dlZd dlmZmZ d dl m
Z
m Z m Z ddl
mZmZmZmZ ddlmZ dd lmZmZ dZdZd
Zd
Zd
Zd gZ e
e e d Z d
d Z e ede Z zd dl!Z!d dl!m"Z"m#Z# W n e$yv Y nw zd dl!mZ W n e$y Y nw zddl%mZ W n e$y Y nw z
d dl!m&Z& e&Z'W n! e$y z
d dl!m'Z& e&Z'W n
e$y d Z'Z&Y nw Y nw zd dl!m(Z( W n e$y e&Z(Y nw z d dl!m)Z)m*Z*m+Z+ W n e$y d\Z*Z+dZ)Y nw zd dl!m,Z, W n e$y dZ,Y nw d-g d Z.zd d l!mZ W n e$y- G d d d e/ZY nw d d! Z0d"d# Z1d$d% Z2 d0d&d'Z3
d1d(d)Z4d*d+ Z5d,d- Z6d2d.d/Z7dS )3 )absolute_importN)hexlify unhexlify)md5sha1sha256 )InsecurePlatformWarningProxySchemeUnsupportedSNIMissingWarningSSLError)six )BRACELESS_IPV6_ADDRZ_REIPV4_REFzhttp/1.1) ( @ c C sD t t| t| }tt| t|D ]
\}}|||A O }q|dkS )z
Compare two digests of equal length in constant time.
The digests must be of type str/bytes.
Returns True if the digests match, and False otherwise.
r )abslenzip bytearray)abresultleftright r /builddir/build/BUILDROOT/alt-python310-pip-21.3.1-5.el8.x86_64/opt/alt/python310/lib/python3.10/site-packages/pip/_vendor/urllib3/util/ssl_.py _const_compare_digest_backport s r compare_digest)
CERT_REQUIRED wrap_socket)HAS_SNI) SSLTransport) PROTOCOL_TLS)PROTOCOL_SSLv23)PROTOCOL_TLS_CLIENT)OP_NO_COMPRESSION OP_NO_SSLv2 OP_NO_SSLv3)i i i ) OP_NO_TICKETi @ :)z ECDHE+AESGCMzECDHE+CHACHA20z
DHE+AESGCMz DHE+CHACHA20z ECDH+AESGCMz DH+AESGCMzECDH+AESzDH+AESz
RSA+AESGCMzRSA+AESz!aNULLz!eNULLz!MD5z!DSS)
SSLContextc @ s8 e Zd Zdd Zdd Zd
ddZdd Zdd d ZdS )r- c C s6 || _ d| _tj| _d | _d| _d | _d | _d | _ d S )NFr )
protocolcheck_hostnamessl CERT_NONE verify_modeca_certsoptionscertfilekeyfileciphers)selfZprotocol_versionr r r __init__ s
zSSLContext.__init__c C s || _ || _d S N)r5 r6 )r8 r5 r6 r r r load_cert_chain s
zSSLContext.load_cert_chainNc C s* || _ |d ur td|d urtdd S )Nz-CA directories not supported in older Pythonsz&CA data not supported in older Pythons)r3 r )r8 cafilecapathcadatar r r load_verify_locations s z SSLContext.load_verify_locationsc C s
|| _ d S r: r7 )r8 Z cipher_suiter r r set_ciphers s
zSSLContext.set_ciphersFc C s> t dt | j| j| j| j| j|d}t|fd| j i|S )Na2 A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. You can upgrade to a newer version of Python to solve this. For more information, see https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings)r6 r5 r3 cert_reqs ssl_version server_sider7 )
warningswarnr r6 r5 r3 r2 r. r" r7 )r8 socketserver_hostnamerD kwargsr r r r" s
zSSLContext.wrap_socket)NNN)NF)__name__
__module__ __qualname__r9 r; r? rA r" r r r r r- s
r- c C sn | dd }t|}t|}|std|t| }|| }t
||s5td|t |dS )z
Checks if given fingerprint matches the supplied certificate.
:param cert:
Certificate as bytes object.
:param fingerprint:
Fingerprint as string of hexdigits, can be interspersed by colons.
r, z"Fingerprint of invalid length: {0}z6Fingerprints did not match. Expected "{0}", got "{1}".N) replacelowerr HASHFUNC_MAPgetr formatr encodedigest_const_compare_digestr )cert fingerprint
digest_lengthhashfuncfingerprint_bytes cert_digestr r r assert_fingerprint s
r\ c C @ | du rt S t| tr tt| d}|du r ttd| }|S | S )a
Resolves the argument to a numeric constant, which can be passed to
the wrap_socket function/method from the ssl module.
Defaults to :data:`ssl.CERT_REQUIRED`.
If given a string it is assumed to be the name of the constant in the
:mod:`ssl` module or its abbreviation.
(So you can specify `REQUIRED` instead of `CERT_REQUIRED`.
If it's neither `None` nor a string we assume it is already the numeric
constant which can directly be passed to wrap_socket.
NCERT_)r!
isinstancestrgetattrr0 candidateresr r r resolve_cert_reqs s
re c C r] )z
like resolve_cert_reqs
N PROTOCOL_)r% r_ r` ra r0 rb r r r resolve_ssl_version s
rg c s | r| t krt} t| |pt |du rtjn|}|du r2d}|tO }|tO }|t O }|t
O } j |O _ |tjksCt j
dkrNt dddurNd _ fdd}|tjkr`| _| n| | _t drvtjd }|rv| _ S )
a All arguments have the same meaning as ``ssl_wrap_socket``.
By default, this function does a lot of the same work that
``ssl.create_default_context`` does on Python 3.4+. It:
- Disables SSLv2, SSLv3, and compression
- Sets a restricted set of server ciphers
If you wish to enable SSLv3, you can do::
from pip._vendor.urllib3.util import ssl_
context = ssl_.create_urllib3_context()
context.options &= ~ssl_.OP_NO_SSLv3
You can do the same to enable compression (substituting ``COMPRESSION``
for ``SSLv3`` in the last line above).
:param ssl_version:
The desired protocol version to use. This will default to
PROTOCOL_SSLv23 which will negotiate the highest protocol that both
the server and your installation of OpenSSL support.
:param cert_reqs:
Whether to require the certificate verification. This defaults to
``ssl.CERT_REQUIRED``.
:param options:
Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2``,
``ssl.OP_NO_SSLv3``, ``ssl.OP_NO_COMPRESSION``, and ``ssl.OP_NO_TICKET``.
:param ciphers:
Which cipher suites to allow the server to select.
:returns:
Constructed SSLContext object with specified options
:rtype: SSLContext
Nr ) post_handshake_authTc s t dd d ur
d _d S d S )Nr/ F)ra r/ r contextr r disable_check_hostnameE s
z6create_urllib3_context..disable_check_hostnamekeylog_filename
SSLKEYLOGFILE)r% r' r- rA DEFAULT_CIPHERSr0 r! r) r* r( r+ r4 sys version_infora rk r2 hasattrosenvironrQ ro )rC rB r4 r7 rn
sslkeylogfiler rl r create_urllib3_context s: %
rx c
C sB |}
|
du r
t |||d}
|s| s| r/z |
|| | W n ttfy. } zt|d}~ww |du r s
3
k
f