U
f&K @ sL U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
ddl m Z m
Z
ddlmZmZ dZdZdZdZd gZejeeeeef Zd
d d D Zd
ddddddZd
dd
ddddddZ ej rd dl m Z d dlm Z ddl!mZ" G dd d e dd Z#i Z$d e%d < zd dl Z d d l m&Z&mZm'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.mZm/Z/ e+Z0ere e)e*ej1j2ej3ej1j2d!krej4ndsdZd"D ]BZ5z e6e/e5e$e6e d#e5 < W n e7k
r Y qY nX qddl!mZ W n2 e8k
r& d$Z'd%Z(d&Z-d'Z.d Z0Z+d(Z,Y nX ej9d e:df Z;d)d
d*d+d,d-ZdQd5d5d5d6d5d5d7d8d9d:Z?ej@dRdd?d@dAdBdCZAej@dSdddDdAdEdCZAdTdddDdAdFdCZAdGddHdIdJZBd
ddKdLdMZCdUd s r )) md5)( sha1)@ sha256str_TYPE_VERSION_INFOz_TYPE_VERSION_INFO | Nonebool)implementation_name version_infopypy_version_inforeturnc C s\ | dkr|dkS | dkrT|dd }|d }|dkr<|dkpR|dkrL|d kpR|d
kS d S dS ) a Return True for CPython 3.8.9+, 3.9.3+ or 3.10+ and PyPy 7.3.8+ where
setting SSLContext.hostname_checks_common_name to False works.
Outside of CPython and PyPy we don't know which implementations work
or not so we conservatively use our hostname matching as we know that works
on all implementations.
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
https://foss.heptapod.net/pypy/pypy/-/issues/3539
pypy) cpythonNr )r" r# )r" r% r" )r"
Fr )r r r Z major_minormicror r r _is_bpo_43522_fixed s r( int)openssl_versionopenssl_version_numberr r r r c C s& | d}|dk}|o$|p$t|||S )NzOpenSSL i)
startswithr( )r* r+ r r r Z
is_opensslZ is_openssl_issue_14579_fixedr r r (_is_has_never_check_common_name_reliable< s
r- )
VerifyMode) TypedDict) SSLTransportc @ s& e Zd ZU ded< ded< ded< dS )_TYPE_PEER_CERT_RET_DICTztuple[tuple[str, str], ...]subjectAltNamez'tuple[tuple[tuple[str, str], ...], ...]subjectr Z serialNumberN)__name__
__module__ __qualname____annotations__r r r r r1 X s
r1 )totalzdict[int, int]_SSL_VERSION_TO_TLS_VERSION)
CERT_REQUIREDHAS_NEVER_CHECK_COMMON_NAMEOP_NO_COMPRESSION OP_NO_TICKETOPENSSL_VERSIONOPENSSL_VERSION_NUMBER PROTOCOL_TLSPROTOCOL_TLS_CLIENT OP_NO_SSLv2 OP_NO_SSLv3
SSLContext
TLSVersionr )TLSv1TLSv1_1TLSv1_2 PROTOCOL_i i @ i i z bytes | NoneNone)cert fingerprintr c C s | dkrt d|dd }t|}|tkr>t d| t|}|dkr^t d| t| }|| }t
||st d| d| d dS )
z
Checks if given fingerprint matches the supplied certificate.
:param cert:
Certificate as bytes object.
:param fingerprint:
Fingerprint as string of hexdigits, can be interspersed by colons.
Nz No certificate for the peer.: z Fingerprint of invalid length: zAHash function implementation unavailable for fingerprint length: z&Fingerprints did not match. Expected "z", got "") r replacelowerlen HASHFUNC_MAPgetr encodedigesthmaccompare_digesthex)rL rM
digest_lengthhashfuncfingerprint_bytes cert_digestr r r assert_fingerprint s"
r_ zNone | int | strr. ) candidater c C s@ | dkr t S t| tr r? r@ rA rB rC rE PROTOCOL_SSLv23implementationnamer r attrr r ImportErrorUnionr Z_TYPE_PEER_CERT_RETr_ rf ri r overloadr r r r r r r r s 8
" , , *J