]p # @ s d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z m
Z d d l Z d d l m
Z
m Z m Z d d l m Z m Z d d l m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z d d l m Z m Z d d l m Z m Z m! Z! m" Z" y d d
l m# Z# Wn e$ k
rJYn Xd d Z% e% d
e% d e% d e% d d d l m& Z& m' Z' m( Z( m) Z) d d l m* Z* e j+ d e, d d d e e- j. Z/ e- _/ d d e- j0 j1 D Z2 y
e3 Z4 Wn e5 k
r d Z4 Yn Xe j6 d k rFd d l m7 Z7 m8 Z8 d d l9 m9 Z9 m: Z: m; Z; m< Z< d d l9 m= Z= m> Z> d d l? Z? d d l@ Z@ d d lA ZA eB ZC e jD rd g ZE n g ZE d ZF d ZG Gd d! d! eH ZI d" d# d$ ZJ d% d& ZK d' d( ZL e d) d* ZM d+ d, ZN Gd- d. d. e d. d/ ZO Gd0 d1 d1 eO e ZP Gd2 d3 d3 e ZQ eP jR d4 d d5 d d6 d d7 d8 ZS e. d9 d d: d; d< eP jR d= d d> d d4 d d5 d d6 d d? d@ ZT eS ZU eT ZV GdA dB dB ZW GdC dD dD e9 ZX d d d; e e. d dE dE d dF dG ZY dH dI ZZ dJ Z[ dK Z\ dL dM Z] dN dO Z^ e. d dP dQ Z_ dR dS Z` d S)T N)
namedtuple)EnumIntEnum)OPENSSL_VERSION_NUMBEROPENSSL_VERSION_INFOOPENSSL_VERSION) _SSLContext MemoryBIO)SSLErrorSSLZeroReturnErrorSSLWantReadErrorSSLWantWriteErrorSSLSyscallError SSLEOFError) CERT_NONE
CERT_OPTIONAL
CERT_REQUIRED)txt2objnid2obj) RAND_statusRAND_add
RAND_bytesRAND_pseudo_bytes)RAND_egdc C s@ x9 t t D]+ } | j | r
t t | t | s r, sourcec C s i | ] \ } } | | q Sr! r! ).0r+ valuer! r! r"
s r0 win32)enum_certificates enum_crls)socketAF_INET SOCK_STREAMcreate_connection)
SOL_SOCKETSO_TYPEz
tls-uniquezECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:DH+CHACHA20:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!3DESzECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:DH+CHACHA20:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!DSS:!RC4:!3DESc @ s e Z d Z d S)CertificateErrorN)__name__
__module__ __qualname__r! r! r! r" r: s r: c C sA g } | s d S| j d ^ } } | j d } | | k rV t d t | | sr | j | j k S| d k r | j d nY | j d s | j d r | j t j | n" | j t j | j d d x$ | D] } | j t j | q Wt j
d d
j | d t j } | j
| S) NF.*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr: reprlowerappendr reescapereplacecompilejoin
IGNORECASEmatch) ZdnhostnameZ
max_wildcardsZpatsZleftmostZ remainderZ wildcardsZfragpatr! r! r" _dnsname_match s& "
&rO c C s t j | j } | | k S)N) ipaddress
ip_addressrstrip)Zipnamehost_ipZipr! r! r" _ipaddress_match s rT c C s | s t d y t j | } Wn t k
r? d } Yn Xg } | j d f } x | D] \ } } | d k r | d k r t | | r d S| j | q_ | d k r_ | d k r t | | r d S| j | q_ W| sHx] | j d f D]I } x@ | D]8 \ } } | d k rt | | r3d S| j | qWq Wt | d k rt d | d j t
t | f n; t | d k rt d
| | d f n t d d S)
Nztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZsubjectAltNameZDNSz
IP AddressZsubjectZ
commonNamer> z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found)
ValueErrorrP rQ getrO rE rT lenr: rJ maprC )certrM rS ZdnsnamesZsankeyr/ subr! r! r" match_hostname s>
%r\ DefaultVerifyPathszQcafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathc C s t j } t j j | d | d } t j j | d | d } t t j j | ra | n d t j j | r| | n d | S)Nr r> ) r get_default_verify_pathsosenvironrV r] pathisfileisdir)partscafilecapathr! r! r" r` ? s r` c sX e Z d Z f Z f d d Z e f d d Z e f d d Z S) _ASN1Objectc s t j | t | d d S)Nr+ F)super__new___txt2obj)clsoid) __class__r! r" rk R s z_ASN1Object.__new__c s t j | t | S)N)rj rk _nid2obj)rm Znid)ro r! r" fromnidU s z_ASN1Object.fromnidc s t j | t | d d S)Nr+ T)rj rk rl )rm r+ )ro r! r" fromname[ s z_ASN1Object.fromname)r; r< r= __slots__rk classmethodrq rr r! r! )ro r" ri M s ri znid shortname longname oidc @ s e Z d Z d Z d Z d S)Purposez1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2N)r; r< r= SERVER_AUTH CLIENT_AUTHr! r! r! r" ru b s ru c @ s e Z d Z d Z d Z e d d Z e d d Z d d
d
d d d
Z d d d d Z d d Z
d d Z d d Z e
j d d Z d S)
SSLContextprotocol __weakref__CAROOTc O s/ t j | | } | t k r+ | j t | S)N)r rk _SSLv2_IF_EXISTS set_ciphers_DEFAULT_CIPHERS)rm ry argskwargsselfr! r! r" rk p s
zSSLContext.__new__c C s
| | _ d S)N)ry )r ry r! r! r" __init__v s zSSLContext.__init__FTNc
C s+ t d | d | d | d | d | d | S)Nsock server_sidedo_handshake_on_connectsuppress_ragged_eofsserver_hostname_context) SSLSocket)r r r r r r r! r! r" wrap_sockety s
zSSLContext.wrap_socketc C s( | j | | d | d | } t | S)Nr r )Z _wrap_bio SSLObject)r ZincomingZoutgoingr r sslobjr! r! r" wrap_bio s zSSLContext.wrap_bioc C s t } xm | D]e } t | d } t | d k sI t | d k rU t d | j t | | j | q W| j | d S)Nasciir z(NPN protocols must be 1 to 255 in length) bytearraybytesrW r
rE extendZ_set_npn_protocols)r
npn_protocolsprotosry br! r! r" set_npn_protocols s
$ z SSLContext.set_npn_protocolsc C s t } xm | D]e } t | d } t | d k sI t | d k rU t d | j t | | j | q W| j | d S)Nr r r z)ALPN protocols must be 1 to 255 in length)r r rW r
rE r Z_set_alpn_protocols)r Zalpn_protocolsr ry r r! r! r" set_alpn_protocols s
$ z SSLContext.set_alpn_protocolsc C s t } yX xQ t | D]C \ } } } | d k r | d k sO | j | k r | j | q WWn t k
r t j d Yn X| r | j d | | S)NZx509_asnTz-unable to enumerate Windows certificate storecadata)r r2 rn r PermissionErrorwarningswarnload_verify_locations)r storenamepurposeZcertsrY encodingZtrustr! r! r" _load_windows_store_certs s
z$SSLContext._load_windows_store_certsc C s\ t | t s t | t j d k rN x! | j D] } | j | | q4 W| j d S)Nr1 )
isinstanceri TypeErrorsysplatform_windows_cert_storesr Zset_default_verify_paths)r r r r! r! r" load_default_certs s z SSLContext.load_default_certs)ry rz )r{ r| )r; r< r= rs r PROTOCOL_TLSrk r r r r r r ru rv r r! r! r! r" rx i s rx rg rh r c C s9 t | t s t | t t } | j t O_ | j t O_ | j t t d d O_ | t
j k r t | _
d | _ nm | t
j k r | j t t d d O_ | j t t d d O_ | j t t d d O_ | j t | s| s| r| j | | | n | j
t k r5| j | | S)NZOP_NO_COMPRESSIONr TZOP_CIPHER_SERVER_PREFERENCEZOP_SINGLE_DH_USEZOP_SINGLE_ECDH_USE)r ri r rx r options OP_NO_SSLv2 OP_NO_SSLv3r r ru rv r verify_modecheck_hostnamerw r~ _RESTRICTED_SERVER_CIPHERSr r r )r rg rh r contextr! r! r" create_default_context s&
r cert_reqsr Fr certfilekeyfilec
C s t | t s t | t | } | j t O_ | j t O_ | d k rZ | | _ | | _ | r| | r| t d | s | r | j
| | | s | s | r | j | | | n | j t k r | j
| | S)Nzcertfile must be specified)r ri r rx r r r r r rU load_cert_chainr r r )
ry r r r r r rg rh r r r! r! r" _create_unverified_context s"
r c @ s e Z d Z d d d Z e d d Z e j d d Z e d d Z e d d
Z d d d d
Z d d Z
d d d Z d d Z d d Z
d d Z d d Z d d Z d d Z d d Z d! d" Z d# d$ d% Z d& d' Z d S)(r Nc C s | | _ | p | | j _ d S)N)_sslobjowner)r r r r! r! r" r ' s zSSLObject.__init__c C s
| j j S)N)r r )r r! r! r" r , s zSSLObject.contextc C s | | j _ d S)N)r r )r ctxr! r! r" r 1 s c C s
| j j S)N)r r )r r! r! r" r 5 s zSSLObject.server_sidec C s
| j j S)N)r r )r r! r! r" r : s zSSLObject.server_hostnamei c C s: | d k r$ | j j | | } n | j j | } | S)N)r read)r rW buffervr! r! r" r @ s zSSLObject.readc C s | j j | S)N)r write)r datar! r! r" r L s zSSLObject.writeFc C s | j j | S)N)r Zpeer_certificate)r binary_formr! r! r" getpeercertT s zSSLObject.getpeercertc C s t j r | j j Sd S)N)r r& r selected_npn_protocol)r r! r! r" r ] s z SSLObject.selected_npn_protocolc C s t j r | j j Sd S)N)r r' r selected_alpn_protocol)r r! r! r" r d s z SSLObject.selected_alpn_protocolc C s
| j j S)N)r cipher)r r! r! r" r k s zSSLObject.cipherc C s
| j j S)N)r shared_ciphers)r r! r! r" r p s zSSLObject.shared_ciphersc C s
| j j S)N)r compression)r r! r! r" r v s zSSLObject.compressionc C s
| j j S)N)r pending)r r! r! r" r { s zSSLObject.pendingc C sH | j j | j j rD | j s. t d t | j | j d S)Nz-check_hostname needs server_hostname argument)r do_handshaker r r rU r\ r )r r! r! r" r s
zSSLObject.do_handshakec C s
| j j S)N)r shutdown)r r! r! r" unwrap s zSSLObject.unwrapz
tls-uniquec C sF | t k r t d | d k r9 t d j | | j j S)Nz Unsupported channel binding typez
tls-uniquez({0} channel binding type not implemented)CHANNEL_BINDING_TYPESrU NotImplementedErrorformatr Z
tls_unique_cb)r cb_typer! r! r" get_channel_binding s z SSLObject.get_channel_bindingc C s
| j j S)N)r version)r r! r! r" r s zSSLObject.version)r; r< r= r propertyr setterr r r r r r r r r r r r r r r r! r! r! r" r s$ r c sA e Z d Z d d d d e e d d e e d d d d d d d d d Z e d d Z e j
d d Z d
d Z d d d
Z d d Z
d d d d Z d d Z d d d Z d d Z d d Z d d Z d d Z d d Z d d! d" Z d d# d$ Z d% d& Z d d' d( Z d d f d) d* Z d d d+ d, Z d d d- d. Z d d d/ d0 Z d d d1 d2 Z d3 d4 Z d5 d6 Z d7 d8 Z! d9 d: Z" d; d< Z# d= d> Z$ d d? d@ Z% dA dB Z& dC dD Z' dE dF Z( dG dH Z) dI dJ dK Z* dL dM Z+ S)Nr NFTr c C s, | r | | _ n | r+ | r+ t d | rD | rD t d | rW | rW | } t | | _ | | j _ | r | j j | | r | j j | | | r | j j | | r | j j | | | _ | | _ | | _
| | _ | | _ | | _
| j t t t k r't d | r?| r?t d | j j r^| r^t d | | _ | | _ | | _ |
| _ | d k rt j | d | j d | j d | j d | j | j | j | j nA | d k rt j | d | n t j | d | d |
d | y | j! Wn@ t" k
rs} z | j# t# j$ k r[ d
} WYd d } ~ Xn Xd } d
| _% d | _& | | _' | r(ye | j j( | | | } t) | d | | _& | r| j } | d
k rt d | j* Wn% t" t f k
r'| j+ Yn Xd S)Nz5certfile must be specified for server-side operationszcertfile must be specifiedz!only stream sockets are supportedz4server_hostname can only be specified in client modez'check_hostname requires server_hostnamefamilytypeprotofilenoFTr g zHdo_handshake_on_connect should not be specified for non-blocking sockets),r rU rx r r r r r~ r r r ssl_versionca_certsciphers
getsockoptr8 r9 r6 r r r r r r r4 r r r r r
settimeout
gettimeoutdetach getpeernameOSErrorerrnoZENOTCONN_closedr
_connected _wrap_socketr r close)r r r r r r r r r r r r r r r r r r eZ connectedr timeoutr! r! r" r s
zSSLSocket.__init__c C s | j S)N)r )r r! r! r" r s zSSLSocket.contextc C s | | _ | | j _ d S)N)r r r )r r r! r! r" r s c C s t d | j j d S)NzCan't dup() %s instances)NotImplementedro r; )r r! r! r" dup s z
SSLSocket.dupc C s d S)Nr! )r msgr! r! r" _checkClosed s zSSLSocket._checkClosedc C s | j s | j d S)N)r r )r r! r! r" _check_connected s zSSLSocket._check_connectedi c C s | j | j s t d y | j j | | SWn[ t k
r } z; | j d t k r~ | j r~ | d k rw d Sd Sn WYd d } ~ Xn Xd S)Nz'Read on closed or unwrapped SSL socket.r )r r rU r r
r Z
SSL_ERROR_EOFr )r rW r xr! r! r" r s
zSSLSocket.readc C s/ | j | j s t d | j j | S)Nz(Write on closed or unwrapped SSL socket.)r r rU r )r r r! r! r" r ) s
zSSLSocket.writec C s$ | j | j | j j | S)N)r r r r )r r r! r! r" r 2 s
zSSLSocket.getpeercertc C s3 | j | j s t j r" d S| j j Sd S)N)r r r r& r )r r! r! r" r < s
z SSLSocket.selected_npn_protocolc C s3 | j | j s t j r" d S| j j Sd S)N)r r r r' r )r r! r! r" r C s
z SSLSocket.selected_alpn_protocolc C s( | j | j s d S| j j Sd S)N)r r r )r r! r! r" r J s
zSSLSocket.cipherc C s$ | j | j s d S| j j S)N)r r r )r r! r! r" r Q s
zSSLSocket.shared_ciphersc C s( | j | j s d S| j j Sd S)N)r r r )r r! r! r" r W s
zSSLSocket.compressionc C sY | j | j rB | d k r2 t d | j | j j | St j | | | Sd S)Nr z3non-zero flags not allowed in calls to send() on %s)r r rU ro r r4 send)r r flagsr! r! r" r ^ s
zSSLSocket.sendc C sb | j | j r) t d | j n5 | d k rH t j | | | St j | | | | Sd S)Nz%sendto not allowed on instances of %s)r r rU ro r4 sendto)r r Z
flags_or_addraddrr! r! r" r i s
zSSLSocket.sendtoc O s t d | j d S)Nz&sendmsg not allowed on instances of %s)r ro )r r r r! r! r" sendmsgs s zSSLSocket.sendmsgc C s | j | j r~ | d k r2 t d | j t | } d } x3 | | k ry | j | | d } | | 7} qG W| St j | | | Sd S)Nr z6non-zero flags not allowed in calls to sendall() on %s)r r rU ro rW r r4 sendall)r r r amountrB r r! r! r" r y s
zSSLSocket.sendallc s< | j d k r% t j | | | S| j | | | Sd S)N)r rj sendfile_sendfile_use_send)r fileoffsetrB )ro r! r" r s zSSLSocket.sendfilec C sV | j | j r? | d k r2 t d | j | j | St j | | | Sd S)Nr z3non-zero flags not allowed in calls to recv() on %s)r r rU ro r r4 recv)r buflenr r! r! r" r s
zSSLSocket.recvc C s | j | r+ | d k r+ t | } n | d k r= d } | j ru | d k re t d | j | j | | St j | | | | Sd S)Ni r z8non-zero flags not allowed in calls to recv_into() on %s)r rW r rU ro r r4 recv_into)r r nbytesr r! r! r" r s
zSSLSocket.recv_intoc C s@ | j | j r) t d | j n t j | | | Sd S)Nz'recvfrom not allowed on instances of %s)r r rU ro r4 recvfrom)r r r r! r! r" r s
zSSLSocket.recvfromc C sC | j | j r) t d | j n t j | | | | Sd S)Nz,recvfrom_into not allowed on instances of %s)r r rU ro r4
recvfrom_into)r r r r r! r! r" r s
zSSLSocket.recvfrom_intoc O s t d | j d S)Nz&recvmsg not allowed on instances of %s)r ro )r r r r! r! r" recvmsg s zSSLSocket.recvmsgc O s t d | j d S)Nz+recvmsg_into not allowed on instances of %s)r ro )r r r r! r! r" recvmsg_into s zSSLSocket.recvmsg_intoc C s( | j | j r | j j Sd Sd S)Nr )r r r )r r! r! r" r s
zSSLSocket.pendingc C s' | j d | _ t j | | d S)N)r r r4 r )r howr! r! r" r s
zSSLSocket.shutdownc C s? | j r% | j j } d | _ | St d t | d S)NzNo SSL wrapper around )r r rU str)r sr! r! r" r s
zSSLSocket.unwrapc C s d | _ t j | d S)N)r r4 _real_close)r r! r! r" r s zSSLSocket._real_closec C s[ | j | j } z0 | d k r8 | r8 | j d | j j Wd | j | Xd S)Ng )r r r r r )r blockr r! r! r" r s
zSSLSocket.do_handshakec C s | j r t d | j r* t d | j j | d | j } t | d | | _ y[ | rx t j | | } n d } t j
| | | s d | _ | j r | j | SWn$ t
t f k
r d | _ Yn Xd S)Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!Fr T)r rU r r r r r r r4
connect_exconnectr r r )r r r r rcr! r! r"
_real_connect s&
zSSLSocket._real_connectc C s | j | d d S)NF)r )r r r! r! r" r s zSSLSocket.connectc C s | j | d S)NT)r )r r r! r! r" r s zSSLSocket.connect_exc C sI t j | \ } } | j j | d | j d | j d d } | | f S)Nr r r T)r4 acceptr r r r )r Znewsockr r! r! r" r
s zSSLSocket.acceptz
tls-uniquec C s# | j d k r d S| j j | S)N)r r )r r r! r! r" r s z SSLSocket.get_channel_bindingc C s | j d k r d S| j j S)N)r r )r r! r! r" r s zSSLSocket.version),r; r< r= r r r5 r6 r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r! r! )ro r" r sV T
r Tc
C sC t d | d | d | d | d | d | d | d | d | d
|
S) Nr r r r r r r r r r )r )
r r r r r r r r r r r! r! r" r ) s r c
C s d d l m } d d l m } d } d } y' | j | d d j d } Wn( t k
r} t d | | f Yn< X| | d d | } | | d | f | d d Sd S)Nr )strptime)timegmJanFebMarAprMayJunJulAugSepOctNovDecz %d %H:%M:%S %Y GMTr_ r> z*time data %r does not match format "%%b%s"r^ ) r r r
r r r r r r r r r )timer Zcalendarr
indextitlerU )Z cert_timer r
ZmonthsZ time_formatZ month_numberttr! r! r" cert_time_to_seconds9 s
'
r z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----c C s? t t j | d d } t d t j | d d t d S)NASCIIstrict
@ )r base64Zstandard_b64encode
PEM_HEADERtextwrapfill
PEM_FOOTER)Zder_cert_bytesfr! r! r" DER_cert_to_PEM_certZ s r' c C s | j t s t d t | j j t sD t d t | j t t t t } t j | j d d S)Nz(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr r )
r r" rU stripendswithr% rW r! Z decodebytesencode)Zpem_cert_stringdr! r! r" PEM_cert_to_DER_certc s
#r, c
C s | \ } } | d k r! t } n t } t | d | d | } t | / } | j | } | j d } Wd QRXWd QRXt | S)Nr rg T)r r _create_stdlib_contextr7 r r r' )
r r r hostportr r r ZsslsockZdercertr! r! r" get_server_certificatep s r0 c C s t j | d S)Nz )_PROTOCOL_NAMESrV )Z
protocol_coder! r! r" get_protocol_name s r2 )arP r# rF r ra collectionsr enumr Z_Enumr _IntEnumr r r r r r r
r r r
r r r r r r rl r rp r r r r r ImportErrorr# r$ r% r& r' r( _convertr; r) r r* __members__itemsr1 ZPROTOCOL_SSLv2r} NameErrorr r2 r3 r4 r5 r6 r7 r8 r9 r! r r r Z socket_errorZHAS_TLS_UNIQUEr r r rU r: rO rT r\ r] r` ri ru rx rv r r Z _create_default_https_contextr- r r r r r" r% r' r, r0 r2 r! r! r! r" [ s . "
"
" 1 4 M/ '