3
�L�j�� � @ sl d dl Z d dlZd dlZd dlZd dlZd dlmZ d dlmZ m
Z m Z
d dlZd dlmZmZmZ d dlmZmZmZ d dlmZmZmZmZmZmZ d dlmZ m Z d dlm Z m Z m!Z!m"Z" yd d lm#Z# W n e$k
r� Y nX d d
lm%Z%m&Z&m'Z'm(Z(m)Z) d d lm*Z* d d lm+Z+ e j,d
e-dd� ed� e
j,de-dd� ed� e j,de-dd� ed� e j,de-dd� ed� e
j,de-dd� ed� e j,de-dd� ed� e.j/ Z0e._0dd � e.j1j2� D �Z3e4e.d d�Z5ej6d k�r�d d lm7Z7m8Z8 d d l9m9Z9m:Z:m;Z;mZ> d dl?Z?d dl@Z@d dlAZAeBZCejD�r:d"gZEng ZEe*ZFG d#d$� d$eG�ZHdQd&d'�ZId(d)� ZJd*d+� ZKed,d-�ZLd.d/� ZMG d0d1� d1ed1d2��ZNG d3d4� d4eNe �ZOG d5d6� d6e�ZPeOjQfdddd7�d8d9�ZRe/feSd:eOjQdddddd;�dd?� d?�ZWG d@dA� dAe9�ZXddd:eSe/ddBdBdf dCdD�ZYdEdF� ZZdGZ[dHZ\dIdJ� Z]dKdL� Z^e/dfdMdN�Z_dOdP� Z`dS )R� N)�
namedtuple)�Enum�IntEnum�IntFlag)�OPENSSL_VERSION_NUMBER�OPENSSL_VERSION_INFO�OPENSSL_VERSION)� _SSLContext� MemoryBIO�
SSLSession)�SSLError�SSLZeroReturnError�SSLWantReadError�SSLWantWriteError�SSLSyscallError� SSLEOFError)�txt2obj�nid2obj)� RAND_status�RAND_add�
RAND_bytes�RAND_pseudo_bytes)�RAND_egd)�HAS_SNI�HAS_ECDH�HAS_NPN�HAS_ALPN� HAS_TLSv1_3)�_DEFAULT_CIPHERS)�_OPENSSL_API_VERSION�
_SSLMethodc C s | j d�o| dkS )NZ PROTOCOL_�PROTOCOL_SSLv23)�
startswith)�name� r$ �/usr/lib64/python3.6/ssl.py�} s r& )�source�Optionsc C s
| j d�S )NZOP_)r" )r# r$ r$ r% r& � s ZAlertDescriptionc C s
| j d�S )NZALERT_DESCRIPTION_)r" )r# r$ r$ r% r& � s ZSSLErrorNumberc C s
| j d�S )NZ
SSL_ERROR_)r" )r# r$ r$ r% r& � s � VerifyFlagsc C s
| j d�S )NZVERIFY_)r" )r# r$ r$ r% r& � s �
VerifyModec C s
| j d�S )NZCERT_)r" )r# r$ r$ r% r& � s c C s i | ]\}}||�qS r$ r$ )�.0r# �valuer$ r$ r% �
� s r- ZPROTOCOL_SSLv2�win32)�enum_certificates� enum_crls)�socket�AF_INET� SOCK_STREAM�create_connection)�
SOL_SOCKET�SO_TYPEz
tls-uniquec @ s e Zd ZdS )�CertificateErrorN)�__name__�
__module__� __qualname__r$ r$ r$ r% r7 � s r7 � c C s� g }| s dS | j d�^}}|jd�}||kr|jd�sx|jd�r�|jtj|�� n|jtj|�j dd�� x |D ]}|jtj|�� q�W tj
d d
j |� d tj �}|j
|�S ) NF�.�*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)�split�countr7 �repr�lower�appendr" �re�escape�replace�compile�join�
IGNORECASE�match) Zdn�hostnameZ
max_wildcardsZpatsZleftmostZ remainderZ wildcardsZfragZpatr$ r$ r% �_dnsname_match� s&
rK c C s t j| j� �}||kS )N)� ipaddress�
ip_address�rstrip)Zipname�host_ipZipr$ r$ r% �_ipaddress_match� s rP c C sP | s t d��ytj|�}W n t k
r2 d }Y nX g }| jdf �}xb|D ]Z\}}|dkr||d krpt||�rpd S |j|� qJ|dkrJ|d k r�t||�r�d S |j|� qJW |s�xF| jdf �D ]6}x0|D ](\}}|dkr�t||�r�d S |j|� q�W q�W t|�dk�r td|d j t
t |��f ��n,t|�dk�rDtd
||d f ��ntd ��d S )
Nztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZsubjectAltNameZDNSz
IP AddressZsubjectZ
commonNamer; z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found) �
ValueErrorrL rM �getrK rB rP �lenr7 rG �mapr@ )�certrJ rO ZdnsnamesZsan�keyr, �subr$ r$ r% �match_hostname� s>
rX �DefaultVerifyPathszQcafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathc C sd t j� } tjj| d | d �}tjj| d | d �}ttjj|�rF|nd tjj|�rX|nd f| �� S )Nr r; � � ) �_ssl�get_default_verify_paths�os�environrR rY �path�isfile�isdir)�parts�cafile�capathr$ r$ r% r] - s r] c s@ e Zd Zf Z� fdd�Ze� fdd��Ze� fdd��Z� ZS )� _ASN1Objectc s t � j| ft|dd��� S )NF)r# )�super�__new__�_txt2obj)�cls�oid)� __class__r$ r% rh @ s z_ASN1Object.__new__c s t � j| ft|��� S )N)rg rh �_nid2obj)rj Znid)rl r$ r% �fromnidC s z_ASN1Object.fromnidc s t � j| ft|dd��� S )NT)r# )rg rh ri )rj r# )rl r$ r% �fromnameI s z_ASN1Object.fromname) r8 r9 r: � __slots__rh � classmethodrn ro �
__classcell__r$ r$ )rl r% rf ; s rf znid shortname longname oidc @ s e Zd ZdZdZdS )�Purposez1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2N)r8 r9 r: � SERVER_AUTHZ CLIENT_AUTHr$ r$ r$ r% rs P s rs c s� e Zd Zd!Zd"Zefdd�Zefdd�Zd#d d
�Zd$dd�Z dd� Z
dd� Z dd� Z e
jfdd�Ze� fdd��Zej� fdd��Ze� fdd ��Zej� fd d ��Ze� fd d ��Zej� fd d ��Z� ZS )%�
SSLContext�protocol� __weakref__�CA�ROOTc O s t j| |�}|S )N)r rh )rj rv �args�kwargs�selfr$ r$ r% rh ^ s zSSLContext.__new__c C s
|| _ d S )N)rv )r| rv r$ r$ r% �__init__b s zSSLContext.__init__FTNc C s t |||||| |d�S )N)�sock� server_side�do_handshake_on_connect�suppress_ragged_eofs�server_hostname�_context�_session)� SSLSocket)r| r~ r r� r� r� �sessionr$ r$ r% � wrap_sockete s
zSSLContext.wrap_socketc C sR |r |rt d��|d k r t d��| jr4| r4t d��| j||||d�}t||d�S )Nz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)r r� )r� )rQ �check_hostnameZ _wrap_bio� SSLObject)r| ZincomingZoutgoingr r� r� �sslobjr$ r$ r% �wrap_bioo s
zSSLContext.wrap_bioc C sd t � }xN|D ]F}t|d�}t|�dks2t|�dkr:td��|jt|�� |j|� q W | j|� d S )N�asciir �� z(NPN protocols must be 1 to 255 in length)� bytearray�bytesrS r rB �extendZ_set_npn_protocols)r| �
npn_protocols�protosrv �br$ r$ r% �set_npn_protocols~ s
z SSLContext.set_npn_protocolsc C sd t � }xN|D ]F}t|d�}t|�dks2t|�dkr:td��|jt|�� |j|� q W | j|� d S )Nr� r r� z)ALPN protocols must be 1 to 255 in length)r� r� rS r rB r� Z_set_alpn_protocols)r| Zalpn_protocolsr� rv r� r$ r$ r% �set_alpn_protocols� s
z SSLContext.set_alpn_protocolsc C sz t � }y@x:t|�D ].\}}}|dkr|dks6|j|kr|j|� qW W n tk
rd tjd� Y nX |rv| j|d� |S )NZx509_asnTz-unable to enumerate Windows certificate store)�cadata)r� r/ rk r� �PermissionError�warnings�warn�load_verify_locations)r| � storename�purposeZcertsrU �encodingZtrustr$ r$ r% �_load_windows_store_certs� s z$SSLContext._load_windows_store_certsc C sD t |t�st|��tjdkr8x| jD ]}| j||� q$W | j� d S )Nr. )�
isinstancerf � TypeError�sys�platform�_windows_cert_storesr� Zset_default_verify_paths)r| r� r� r$ r$ r% �load_default_certs� s
z SSLContext.load_default_certsc s t t� j�S )N)r( rg �options)r| )rl r$ r% r� � s zSSLContext.optionsc s t tt�jj| |� d S )N)rg ru r� �__set__)r| r, )rl r$ r% r� � s c s t t� j�S )N)r) rg � verify_flags)r| )rl r$ r% r� � s zSSLContext.verify_flagsc s t tt�jj| |� d S )N)rg ru r� r� )r| r, )rl r$ r% r� � s c s* t � j}yt|�S tk
r$ |S X d S )N)rg � verify_moder* rQ )r| r, )rl r$ r% r� � s
zSSLContext.verify_modec s t tt�jj| |� d S )N)rg ru r� r� )r| r, )rl r$ r% r� � s )rv rw )rx ry )FTTNN)FNN)r8 r9 r: rp r� � PROTOCOL_TLSrh r} r� r� r� r� r� rs rt r� �propertyr� �setterr� r� rr r$ r$ )rl r% ru W s(
ru )rd re r� c C sd t | t�st| ��tt�}| tjkr0t|_d|_ |s<|s<|rL|j
|||� n|jt kr`|j | � |S )NT)
r� rf r� ru r� rs rt �
CERT_REQUIREDr� r� r� � CERT_NONEr� )r� rd re r� �contextr$ r$ r% �create_default_context� s
r� F)� cert_reqsr� r� �certfile�keyfilerd re r� c
C s� t |t�st|��t| �} |s$d| _|d k r2|| _|rd?� Z$d@dA� Z%dBdC� Z&dDdE� Z'd`dFdG�Z(dHdI� Z)dJdK� Z*dLdM� Z+dNdO� Z,dadQdR�Z-dSdT� Z.� Z/S )br� NFTr c 6 C s: d | _ |r|| _n�|r$| r$td��|r6| r6td��|rD| rD|}t|�| _|| j_|rf| jj|� |rx| jj||� |r�| jj|� |r�| jj|� || _ || _
|| _ || _ || _
|| _|jtt�tkr�td��|r�|r�td��|d k r�td��| jj�r| �rtd��|| _|| _|| _|| _|
| _|d k �rftj| |j |j |j |j � d� |j � }|j!� n,| d k �r�tj| | d� ntj| | |
| d � y | j"� W n� t#k
�r� } z�|j$t$j%k�r d
}| j � d k}| j&d
� y| j'd �}W n> t#k
�r( } z |j$t$j%t$j(fk�r� d
}W Y d d }~X nX | j&|� |�r�d}t)|j$|�}||_*d |_+y | j,� W n t#k
�rx Y nX z|�W d d }X W Y d d }~X nX d}| j-|� d
| _.d | _ || _/|�r6yN| jj0| ||�}t1|| | jd�| _ |�r| j � }|dk�rtd��| j2� W n$ t#tfk
�r4 | j,� � Y nX d S )Nz5certfile must be specified for server-side operationszcertfile must be specifiedz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)�family�type�proto�fileno)r� )r� r� r� Fr r; � z5Closed before TLS handshake with data in recv buffer.T)r� r� g zHdo_handshake_on_connect should not be specified for non-blocking sockets)3r� r� rQ ru r� r� r� r� Z set_ciphersr� r� r� � ssl_version�ca_certs�ciphersZ
getsockoptr5 r6 r3 r� r� r� r r� r� r� r1 r} r� r� r� r� �
gettimeout�detach� getpeername�OSError�errnoZENOTCONNZ setblocking�recvZEINVALr �reasonZlibrary�close�
settimeoutZ_closed�
_connected� _wrap_socketr� r� ) r| r~ r� r� r r� r� r� r� r� r� r� r� r� r� r� r� r� r� Z sock_timeout�eZ connectedZblockingZnotconn_pre_handshake_datar� Z notconn_pre_handshake_data_errorr� �timeoutr$ r$ r% r} � s�
zSSLSocket.__init__c C s | j S )N)r� )r| r$ r$ r% r� 9 s zSSLSocket.contextc C s || _ || j_d S )N)r� r� r� )r| r� r$ r$ r% r� = s c C s | j d k r| j jS d S )N)r� r� )r| r$ r$ r% r� B s
zSSLSocket.sessionc C s || _ | jd k r|| j_d S )N)r� r� r� )r| r� r$ r$ r% r� H s
c C s | j d k r| j jS d S )N)r� r� )r| r$ r$ r% r� N s
zSSLSocket.session_reusedc C s t d| jj ��d S )NzCan't dup() %s instances)r� rl r8 )r| r$ r$ r% �dupT s z
SSLSocket.dupc C s d S )Nr$ )r| �msgr$ r$ r% � _checkClosedX s zSSLSocket._checkClosedc C s | j s| j� d S )N)r� r� )r| r$ r$ r% �_check_connected\ s zSSLSocket._check_connected� c C st | j � | jstd��y| jj||�S tk
rn } z.|jd tkr\| jr\|d k rVdS dS n� W Y d d }~X nX d S )Nz'Read on closed or unwrapped SSL socket.r r� )r� r� rQ r� r rz Z
SSL_ERROR_EOFr� )r| rS r� �xr$ r$ r% r� d s zSSLSocket.readc C s" | j � | jstd��| jj|�S )Nz(Write on closed or unwrapped SSL socket.)r� r� rQ r� )r| r� r$ r$ r% r� v s zSSLSocket.writec C s | j � | j� | jj|�S )N)r� r� r� r� )r| r� r$ r$ r% r� s zSSLSocket.getpeercertc C s* | j � | j stj r d S | jj� S d S )N)r� r� r\ r r� )r| r$ r$ r% r� � s z SSLSocket.selected_npn_protocolc C s* | j � | j stj r d S | jj� S d S )N)r� r� r\ r r� )r| r$ r$ r% r� � s z SSLSocket.selected_alpn_protocolc C s | j � | jsd S | jj� S d S )N)r� r� r� )r| r$ r$ r% r� � s zSSLSocket.cipherc C s | j � | jsd S | jj� S )N)r� r� r� )r| r$ r$ r% r� � s zSSLSocket.shared_ciphersc C s | j � | jsd S | jj� S d S )N)r� r� r� )r| r$ r$ r% r� � s zSSLSocket.compressionc C sB | j � | jr0|dkr$td| j ��| jj|�S tj| ||�S d S )Nr z3non-zero flags not allowed in calls to send() on %s)r� r� rQ rl r� r1 �send)r| r� �flagsr$ r$ r% r� � s
zSSLSocket.sendc C sH | j � | jr td| j ��n&|d kr4tj| ||�S tj| |||�S d S )Nz%sendto not allowed on instances of %s)r� r� rQ rl r1 �sendto)r| r� Z
flags_or_addr�addrr$ r$ r% r� � s zSSLSocket.sendtoc O s t d| j ��d S )Nz&sendmsg not allowed on instances of %s)r� rl )r| rz r{ r$ r$ r% �sendmsg� s zSSLSocket.sendmsgc C s� | j � | jr�|dkr$td| j ��d}t|��L}|jd��6}t|�}x&||k rl| j||d � �}||7 }qHW W d Q R X W d Q R X ntj | ||�S d S )Nr z6non-zero flags not allowed in calls to sendall() on %s�B)
r� r� rQ rl �
memoryview�castrS r� r1 �sendall)r| r� r� r? ZviewZ byte_viewZamountr� r$ r$ r% r� � s
"zSSLSocket.sendallc s, | j d krt� j|||�S | j|||�S d S )N)r� rg �sendfileZ_sendfile_use_send)r| �file�offsetr? )rl r$ r% r� � s
zSSLSocket.sendfilec C s@ | j � | jr.|dkr$td| j ��| j|�S tj| ||�S d S )Nr z3non-zero flags not allowed in calls to recv() on %s)r� r� rQ rl r� r1 r� )r| �buflenr� r$ r$ r% r� � s
zSSLSocket.recvc C sf | j � |r |d kr t|�}n |d kr*d}| jrR|dkrFtd| j ��| j||�S tj| |||�S d S )Ni r z8non-zero flags not allowed in calls to recv_into() on %s)r� rS r� rQ rl r� r1 � recv_into)r| r� �nbytesr� r$ r$ r% r� � s
zSSLSocket.recv_intoc C s0 | j � | jr td| j ��ntj| ||�S d S )Nz'recvfrom not allowed on instances of %s)r� r� rQ rl r1 �recvfrom)r| r� r� r$ r$ r% r� � s
zSSLSocket.recvfromc C s2 | j � | jr td| j ��ntj| |||�S d S )Nz,recvfrom_into not allowed on instances of %s)r� r� rQ rl r1 �
recvfrom_into)r| r� r� r� r$ r$ r% r� s
zSSLSocket.recvfrom_intoc O s t d| j ��d S )Nz&recvmsg not allowed on instances of %s)r� rl )r| rz r{ r$ r$ r% �recvmsg
s zSSLSocket.recvmsgc O s t d| j ��d S )Nz+recvmsg_into not allowed on instances of %s)r� rl )r| rz r{ r$ r$ r% � recvmsg_into s zSSLSocket.recvmsg_intoc C s | j � | jr| jj� S dS d S )Nr )r� r� r� )r| r$ r$ r% r� s
zSSLSocket.pendingc C s | j � d | _tj| |� d S )N)r� r� r1 r� )r| Zhowr$ r$ r% r� s zSSLSocket.shutdownc C s. | j r| j j� }d | _ |S tdt| � ��d S )NzNo SSL wrapper around )r� r� rQ �str)r| �sr$ r$ r% r� s
zSSLSocket.unwrapc C s$ | j r| j j� S tdt| � ��d S )NzNo SSL wrapper around )r� r� rQ r )r| r$ r$ r% r� & s
z&SSLSocket.verify_client_post_handshakec C s d | _ tj| � d S )N)r� r1 � _real_close)r| r$ r$ r% r , s zSSLSocket._real_closec C sF | j � | j� }z$|dkr(|r(| jd � | jj� W d | j|� X d S )Ng )r� r� r� r� r� )r| �blockr� r$ r$ r% r� 0 s
zSSLSocket.do_handshakec C s� | j rtd��| jr td��| jj| d| j�}t|| | jd�| _y>|rTt j
| |�}nd }t j | |� |s|d| _| j r|| j
� |S ttfk
r� d | _� Y nX d S )Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!F)r� r� T)r rQ r� r� r� r� r� r� r� r1 �
connect_ex�connectr� r� r� )r| r� r r� Zrcr$ r$ r% �
_real_connect; s( zSSLSocket._real_connectc C s | j |d� d S )NF)r )r| r� r$ r$ r% r T s zSSLSocket.connectc C s | j |d�S )NT)r )r| r� r$ r$ r% r Y s zSSLSocket.connect_exc C s. t j| �\}}| jj|| j| jdd�}||fS )NT)r� r� r )r1 �acceptr� r� r� r� )r| Znewsockr� r$ r$ r% r ^ s zSSLSocket.accept�
tls-uniquec C s | j d krd S | j j|�S )N)r� r� )r| r� r$ r$ r% r� j s
z SSLSocket.get_channel_bindingc C s | j d krd S | j j� S )N)r� r� )r| r$ r$ r% r� s s
zSSLSocket.version)N)r� N)F)r )N)r )r N)r� r )Nr )r� r )Nr )F)r )0r8 r9 r: r� r� r2 r3 r} r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r r r r r� r� rr r$ r$ )rl r% r� � s^ |
r� Tc
C s t | ||||||||| d�
S )N)
r~ r� r� r r� r� r� r� r� r� )r� )
r~ r� r� r r� r� r� r� r� r� r$ r$ r% r� } s r� c
C s� ddl m} ddlm} d}d}y |j| d d� j� �d }W n$ tk
rb td| |f ��Y n0X || dd � |�}||d |f|dd� �S d S )Nr )�strptime)�timegm�Jan�Feb�Mar�Apr�May�Jun�Jul�Aug�Sep�Oct�Nov�Decz %d %H:%M:%S %Y GMTr[ r; z*time data %r does not match format "%%b%s"rZ � ) r r r
r r r r r r r r r )Ztimer Zcalendarr
�index�titlerQ )Z cert_timer r
ZmonthsZ time_formatZ month_numberZttr$ r$ r% �cert_time_to_seconds� s
r z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----c C s2 t tj| �dd�}td tj|d� d t d S )N�ASCII�strict�
�@ )r �base64Zstandard_b64encode�
PEM_HEADER�textwrapZfill�
PEM_FOOTER)Zder_cert_bytes�fr$ r$ r% �DER_cert_to_PEM_cert� s r$ c C s\ | j t�stdt ��| j� jt�s0tdt ��| j� tt�tt� � }tj|j dd��S )Nz(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr r )
r" r rQ �strip�endswithr" rS r Z decodebytes�encode)Zpem_cert_string�dr$ r$ r% �PEM_cert_to_DER_cert� s
r) c
C sd | \}}|d k rt }nt}t|||d�}t| ��&}|j|��}|jd�} W d Q R X W d Q R X t| �S )N)r� rd T)r� r� �_create_stdlib_contextr4 r� r� r$ )
r� r� r� �hostZportr� r� r~ ZsslsockZdercertr$ r$ r% �get_server_certificate� s
r, c C s t j| d�S )Nz )�_PROTOCOL_NAMESrR )Z
protocol_coder$ r$ r% �get_protocol_name� s r. )r; )arL r! rC r� r^ � collectionsr �enumr Z_Enumr Z_IntEnumr Z_IntFlagr\ r r r r r
r r r
r r r r r ri r rm r r r r r � ImportErrorr r r r r r r �_convertr8 r r� r! � __members__�itemsr- �getattrZ_SSLv2_IF_EXISTSr� r/ r0 r1 r2 r3 r4 r5 r6 r r� r� r� Z socket_errorZHAS_TLS_UNIQUEr� Z_RESTRICTED_SERVER_CIPHERSrQ r7 rK rP rX rY r] rf rs ru rt r� r� r� Z _create_default_https_contextr* r� r� r� r r r" r$ r) r, r. r$ r$ r$ r% �] s�
1 4p ( O