U
e5dH� �
@ s� d Z ddlZddlZddlmZ ddlmZmZ m
Z ddl Z ddl m
Z
mZmZ ddl mZmZmZ ddl mZmZmZmZmZmZmZ ddl mZm Z dd l m Z m Z m Z m!Z! zdd
l m"Z" W n e#k
r� Y nX dd l m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z- dd l m.Z.m/Z/ e j0d
e1dd� e d� e j0de1dd� e d� e j0de1dd� e d� e j0de1dd� e d� e j0de1dd� e d� e j0de1dd� e d� e2j3 Z4e2_4dd � e2j5�6� D �Z7e8e2d d�Z9G d d � d e �Z:G d d!� d!e �Z;G d"d#� d#e �Zd&k�r"dd'l m?Z?m@Z@ dd(lAmAZAmBZBmCZCmDZD dd)lAmEZEmFZF ddlAZGddlHZHddlIZIddlJZJeKZLd*gZMeNe d+�ZOe.ZPeZQd,d-� ZRd.d/� ZSd0d1� ZTd2d3� ZUed4d5�ZVd6d7� ZWG d8d9� d9ed9d:��ZXG d;d<� d� d>e�ZZeYj[fdddd?�d@dA�Z\e3fe]dBeYj[ddddddC�dDdE�Z^e\Z_e^Z`G dFdG� dG�ZadHdI� ZbG dJdK� dKeA�ZceceZ_deaeZ_edddBe]e3ddLdLdf dMdN�ZfdOdP� ZgdQZhdRZidSdT� ZjdUdV� Zke3dfdWdX�ZldYdZ� ZmdS )[a�
This module provides some more Pythonic support for SSL.
Object types:
SSLSocket -- subtype of socket.socket which does SSL over the socket
Exceptions:
SSLError -- exception raised for I/O errors
Functions:
cert_time_to_seconds -- convert time string used for certificate
notBefore and notAfter functions to integer
seconds past the Epoch (the time values
returned from time.time())
fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
by the server running on HOST at port PORT. No
validation of the certificate is performed.
Integer constants:
SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT
SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE
The following group define certificate requirements that one side is
allowing/requiring from the other side:
CERT_NONE - no certificates from the other side are required (or will
be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
validated, and if validation fails, the connection will
also fail
CERT_REQUIRED - certificates are required, and will be validated, and
if validation fails, the connection will also fail
The following constants identify various SSL protocol variants:
PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLS
PROTOCOL_TLS_CLIENT
PROTOCOL_TLS_SERVER
PROTOCOL_TLSv1
PROTOCOL_TLSv1_1
PROTOCOL_TLSv1_2
The following constants identify various SSL alert message descriptions as per
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
ALERT_DESCRIPTION_CLOSE_NOTIFY
ALERT_DESCRIPTION_UNEXPECTED_MESSAGE
ALERT_DESCRIPTION_BAD_RECORD_MAC
ALERT_DESCRIPTION_RECORD_OVERFLOW
ALERT_DESCRIPTION_DECOMPRESSION_FAILURE
ALERT_DESCRIPTION_HANDSHAKE_FAILURE
ALERT_DESCRIPTION_BAD_CERTIFICATE
ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE
ALERT_DESCRIPTION_CERTIFICATE_REVOKED
ALERT_DESCRIPTION_CERTIFICATE_EXPIRED
ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN
ALERT_DESCRIPTION_ILLEGAL_PARAMETER
ALERT_DESCRIPTION_UNKNOWN_CA
ALERT_DESCRIPTION_ACCESS_DENIED
ALERT_DESCRIPTION_DECODE_ERROR
ALERT_DESCRIPTION_DECRYPT_ERROR
ALERT_DESCRIPTION_PROTOCOL_VERSION
ALERT_DESCRIPTION_INSUFFICIENT_SECURITY
ALERT_DESCRIPTION_INTERNAL_ERROR
ALERT_DESCRIPTION_USER_CANCELLED
ALERT_DESCRIPTION_NO_RENEGOTIATION
ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION
ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE
ALERT_DESCRIPTION_UNRECOGNIZED_NAME
ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE
ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE
ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY
� N)�
namedtuple)�Enum�IntEnum�IntFlag)�OPENSSL_VERSION_NUMBER�OPENSSL_VERSION_INFO�OPENSSL_VERSION)� _SSLContext� MemoryBIO�
SSLSession)�SSLError�SSLZeroReturnError�SSLWantReadError�SSLWantWriteError�SSLSyscallError� SSLEOFError�SSLCertVerificationError)�txt2obj�nid2obj)� RAND_status�RAND_add�
RAND_bytes�RAND_pseudo_bytes)�RAND_egd)
�HAS_SNI�HAS_ECDH�HAS_NPN�HAS_ALPN� HAS_SSLv2� HAS_SSLv3� HAS_TLSv1� HAS_TLSv1_1� HAS_TLSv1_2� HAS_TLSv1_3)�_DEFAULT_CIPHERS�_OPENSSL_API_VERSION�
_SSLMethodc C s | � d�o| dkS )NZ PROTOCOL_�PROTOCOL_SSLv23��
startswith��name� r, �/usr/lib64/python3.8/ssl.py�| � r. )�source�Optionsc C s
| � d�S )NZOP_r( r* r, r, r- r. � r/ ZAlertDescriptionc C s
| � d�S )NZALERT_DESCRIPTION_r( r* r, r, r- r. � r/ ZSSLErrorNumberc C s
| � d�S )NZ
SSL_ERROR_r( r* r, r, r- r. � r/ � VerifyFlagsc C s
| � d�S )NZVERIFY_r( r* r, r, r- r. � r/ �
VerifyModec C s
| � d�S )NZCERT_r( r* r, r, r- r. � r/ c C s i | ]\}}||�qS r, r, )�.0r+ �valuer, r, r- �
� s r6 ZPROTOCOL_SSLv2c @ s6 e Zd ZejZejZejZ ej
Z ej Z
ejZejZdS )�
TLSVersionN)�__name__�
__module__� __qualname__�_sslZPROTO_MINIMUM_SUPPORTEDZMINIMUM_SUPPORTEDZ PROTO_SSLv3�SSLv3Z PROTO_TLSv1ZTLSv1Z
PROTO_TLSv1_1ZTLSv1_1Z
PROTO_TLSv1_2ZTLSv1_2Z
PROTO_TLSv1_3ZTLSv1_3ZPROTO_MAXIMUM_SUPPORTEDZMAXIMUM_SUPPORTEDr, r, r, r- r7 � s r7 c @ s( e Zd ZdZdZdZdZdZdZdZ dS ) �_TLSContentTypez@Content types (record layer)
See RFC 8446, section B.1
� � � � � � N)
r8 r9 r: �__doc__�CHANGE_CIPHER_SPEC�ALERTZ HANDSHAKEZAPPLICATION_DATA�HEADERZINNER_CONTENT_TYPEr, r, r, r- r= � s r= c @ s� e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Z!d Z"d!Z#d"Z$d#Z%d$S )%�
_TLSAlertTypezQAlert types for TLSContentType.ALERT messages
See RFC 8466, section B.2
r �
r> r? r@ � �( �) �* �+ �, �- �. �/ �0 �1 �2 �3 �< �F �G �P �V �Z �d �m �n �o �p �q �r �s �t �x N)&r8 r9 r: rD Z CLOSE_NOTIFYZUNEXPECTED_MESSAGEZBAD_RECORD_MACZDECRYPTION_FAILEDZRECORD_OVERFLOWZDECOMPRESSION_FAILUREZHANDSHAKE_FAILUREZNO_CERTIFICATEZBAD_CERTIFICATEZUNSUPPORTED_CERTIFICATEZCERTIFICATE_REVOKEDZCERTIFICATE_EXPIREDZCERTIFICATE_UNKNOWNZILLEGAL_PARAMETERZ
UNKNOWN_CAZ
ACCESS_DENIEDZ DECODE_ERRORZ
DECRYPT_ERRORZEXPORT_RESTRICTIONZPROTOCOL_VERSIONZINSUFFICIENT_SECURITYZINTERNAL_ERRORZINAPPROPRIATE_FALLBACKZ
USER_CANCELEDZNO_RENEGOTIATIONZMISSING_EXTENSIONZUNSUPPORTED_EXTENSIONZCERTIFICATE_UNOBTAINABLEZUNRECOGNIZED_NAMEZ BAD_CERTIFICATE_STATUS_RESPONSEZBAD_CERTIFICATE_HASH_VALUEZUNKNOWN_PSK_IDENTITYZCERTIFICATE_REQUIREDZNO_APPLICATION_PROTOCOLr, r, r, r- rH � sF rH c @ sh e Zd ZdZdZdZdZdZdZdZ dZ
d Z d
Z d Z
d Zd
ZdZdZdZdZdZdZdZdZdZdZdS )�_TLSMessageTypezFMessage types (handshake protocol)
See RFC 8446, section B.3
r � � � � � � � � � �
� � � r> r? r@ rA � �C �� rC N)r8 r9 r: rD Z
HELLO_REQUESTZ CLIENT_HELLOZ SERVER_HELLOZHELLO_VERIFY_REQUESTZNEWSESSION_TICKETZEND_OF_EARLY_DATAZHELLO_RETRY_REQUESTZENCRYPTED_EXTENSIONSZ CERTIFICATEZSERVER_KEY_EXCHANGEZCERTIFICATE_REQUESTZ SERVER_DONEZCERTIFICATE_VERIFYZCLIENT_KEY_EXCHANGEZFINISHEDZCERTIFICATE_URLZCERTIFICATE_STATUSZSUPPLEMENTAL_DATAZ
KEY_UPDATEZ
NEXT_PROTOZ MESSAGE_HASHrE r, r, r, r- rg � s. rg �win32)�enum_certificates� enum_crls)�socket�AF_INET� SOCK_STREAM�create_connection)�
SOL_SOCKET�SO_TYPE�
tls-unique� HOSTFLAG_NEVER_CHECK_SUBJECTc C s� | sdS | � d�}|s&| �� |�� kS |dkrsole wildcard without additional labels are not support: {!r}.ztd ||d
f ��ntd��dS )a� Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed.
The function matches IP addresses rather than dNSNames if hostname is a
valid ipaddress string. IPv4 addresses are supported on all platforms.
IPv6 addresses are supported on platforms with IPv6 support (AF_INET6
and inet_pton).
CertificateError is raised on failure. On success, the function
returns nothing.
ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDNZsubjectAltNamer, ZDNSz
IP AddressZsubjectZ
commonNamerh z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found) r� r� �getr� �appendr� �lenr� �join�map�repr)�certr� r� ZdnsnamesZsan�keyr5 �subr, r, r- �match_hostnames sB
�
�r� �DefaultVerifyPathszQcafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathc C sd t �� } tj�| d | d �}tj�| d | d �}ttj�|�rF|ndtj�|�rX|ndf| �� S )z/Return paths to default cafile and capath.
r rh ri rj N) r; �get_default_verify_paths�os�environr� r� �path�isfile�isdir)�parts�cafile�capathr, r, r- r� � s ��r� c sD e Zd ZdZdZ� fdd�Ze� fdd��Ze� fdd��Z� Z S ) � _ASN1Objectz#ASN.1 object identifier lookup
r, c s t � j| ft|dd��� S )NFr* ��super�__new__�_txt2obj)�cls�oid�� __class__r, r- r� � s z_ASN1Object.__new__c s t � j| ft|��� S )z3Create _ASN1Object from OpenSSL numeric ID
)r� r� �_nid2obj)r� Znidr� r, r- �fromnid� s z_ASN1Object.fromnidc s t � j| ft|dd��� S )z=Create _ASN1Object from short name, long name or OID
Tr* r� )r� r+ r� r, r- �fromname� s z_ASN1Object.fromname)
r8 r9 r: rD � __slots__r� � classmethodr� r� �
__classcell__r, r, r� r- r� � s r� znid shortname longname oidc @ s e Zd ZdZdZdZdS )�PurposezDSSLContext purpose flags with X509v3 Extended Key Usage objects
z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2N)r8 r9 r: rD � SERVER_AUTHZ CLIENT_AUTHr, r, r, r- r� � s r� c s� e Zd ZdZdZdZdZefdd�Zdd� Z d2d
d �Z
d3d d
�Z dd� Z dd� Z
dd� Zdd� Zejfdd�Zeed�r�e� fdd��Zej� fdd��Ze� fd d ��Zej� fd d ��Ze� fd d ��Zej� fd!d ��Zeed"��red#d$� �Zejd%d$� �Zn ed&d$� �Ze� fd'd(��Z e j� fd)d(��Z e� fd*d+��Z e� fd,d-��Z e j� fd.d-��Z e� fd/d0��Z e j� fd1d0��Z � Z S )4�
SSLContextz|An SSLContext holds various SSL-related configuration options and
data, such as certificates and possibly a private key.)ZCAZROOTNc O s t �| |�}|S �N)r r� )r� �protocol�args�kwargs�selfr, r, r- r� � s zSSLContext.__new__c C s4 |d kr d S t |t�r&|�d��d�S |�d�S d S )NZidna�ascii)�
isinstance�str�encode�decode)r� r� r, r, r- �_encode_hostname� s
zSSLContext._encode_hostnameFTc C s | j j|||||| |d�S )N)�sock� server_side�do_handshake_on_connect�suppress_ragged_eofs�server_hostname�context�session)�sslsocket_class�_create)r� r� r� r� r� r� r� r, r, r- � wrap_socket� s �zSSLContext.wrap_socketc C s | j j|||| �|�|| d�S )N)r� r� r� r� )�sslobject_classr� r� )r� �incoming�outgoingr� r� r� r, r, r- �wrap_bio� s �zSSLContext.wrap_bioc C s` t � }|D ]F}t|d�}t|�dks0t|�dkr8td��|�t|�� |�|� q
| �|� d S )Nr� r �� z(NPN protocols must be 1 to 255 in length)� bytearray�bytesr� r r� �extendZ_set_npn_protocols)r� Z
npn_protocols�protosr� �br, r, r- �set_npn_protocols s
z SSLContext.set_npn_protocolsc s8 �d krd � _ n$t��s td��� �fdd�}|� _ d S )Nznot a callable objectc s � � |�}�| ||�S r� )r� )�sslobjZ
servernameZsslctx�r� �server_name_callbackr, r- �shim_cb s
z3SSLContext.set_servername_callback..shim_cb)Z sni_callback�callable� TypeError)r� r� r� r, r� r- �set_servername_callback s z"SSLContext.set_servername_callbackc C s` t � }|D ]F}t|d�}t|�dks0t|�dkr8td��|�t|�� |�|� q
| �|� d S )Nr� r r� z)ALPN protocols must be 1 to 255 in length)r� r� r� r r� r� Z_set_alpn_protocols)r� Zalpn_protocolsr� r� r� r, r, r- �set_alpn_protocols s
z SSLContext.set_alpn_protocolsc C sv t � }z.inner)r� r� r� r� �hasattrr� r� )r� r r� r� r r- r� � s
c s t t� j�S r� )r& r� r� r� r� r, r- r� � s zSSLContext.protocolc s t t� j�S r� )r2 r� � verify_flagsr� r� r, r- r � s zSSLContext.verify_flagsc s t tt�j�| |� d S r� )r� r� r r� r� r� r, r- r � s c s0 t � j}z
t|�W S tk
r* | Y S X d S r� )r� � verify_moder3 r� r� r� r, r- r � s
zSSLContext.verify_modec s t tt�j�| |� d S r� )r� r� r r� r� r� r, r- r � s )FTTNN)FNN)!r8 r9 r: rD r� r� r� � PROTOCOL_TLSr� r� r� r� r� r� r� r� r� r� r� r r �propertyr� �setterr� r� r; r� r� r� r r r� r, r, r� r- r� � sn �
�
&%r� )r� r� r� c C s� t | t�st| ��tt�}| tjkr0t|_d|_ |s<|s<|rL|�
|||� n|jt kr`|� | � t
|d�r�tj�d�}|r�tjjs�||_|S )z�Create a SSLContext object with default settings.
NOTE: The protocol and settings may change anytime without prior
deprecation. The values represent a fair balance between maximum
compatibility and security.
T�keylog_filename�
SSLKEYLOGFILE)r� r� r� r� r r� r� �
CERT_REQUIREDr �check_hostnamer� � CERT_NONEr� r r� r� r� r� �flags�ignore_environmentr )r� r� r� r� r� �
keylogfiler, r, r- �create_default_context� s
r F)� cert_reqsr r� �certfile�keyfiler� r� r� c C s� t |t�st|��t| �} |s$d| _|dk r2|| _|r� Z"ed?d@� �Z#� fdAdB�Z$edCdD� �Z%edEdF� �Z&� fdGdH�Z'edddIdJ��Z(� fdKdL�Z)dMdN� Z*dOdP� Z+� fdQdR�Z,ededTdU��Z-edVdW� �Z.� Z/S )f� SSLSocketz�This class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel. c O s t | jj� d���d S )NzX does not have a public constructor. Instances are returned by SSLContext.wrap_socket().r r r, r, r- r � s �zSSLSocket.__init__FTNc
s� |� tt�tkrtd��|r8|r(td��|d k r8td��|jrJ|sJtd��t|j|j |j
|� � d�}| j | f|�} t
t| �jf |� | �|�� � |�� || _|| _d| _d | _|| _|�|�| _|| _|| _z | � � W n6 t k
�r }
z|
j t j kr�� d} W 5 d }
~
X Y nX d} | | _ | �r�zH| jj!| || j| | jd�| _|�rj| �� } | d k�rbtd
��| �"� W n$ t tfk
�r� | �#� � Y nX | S ) Nz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)�family�type�proto�filenoFT�r r� � zHdo_handshake_on_connect should not be specified for non-blocking sockets)$Z
getsockoptr r� r} �NotImplementedErrorr� r �dictr< r= r> r? r� r� r; r �
settimeout�
gettimeout�detach�_context�_sessionZ_closedr r� r� r� r� r� � getpeernamer� �errnoZENOTCONN�
_connected� _wrap_socketr1 �close)
r� r� r� r� r� r� r� r� r� r� �eZ connected�timeoutr� r, r- r� � sj
� �
zSSLSocket._createc C s | j S r� )rG r� r, r, r- r� s zSSLSocket.contextc C s || _ || j_d S r� )rG r r� r r, r, r- r� s c C s | j d k r| j jS d S r� r r� r, r, r- r� s
zSSLSocket.sessionc C s || _ | jd k r|| j_d S r� )rH r r� r r, r, r- r� & s
c C s | j d k r| j jS d S r� r! r� r, r, r- r" , s
zSSLSocket.session_reusedc C s t d| jj ��d S )NzCan't dup() %s instances)rB r� r8 r� r, r, r- �dup2 s �z
SSLSocket.dupc C s d S r� r, )r� �msgr, r, r- � _checkClosed6 s zSSLSocket._checkClosedc C s | j s| �� d S r� )rK rI r� r, r, r- �_check_connected: s zSSLSocket._check_connectedr# c
C s� | � � | jdkrtd��z*|dk r4| j�||�W S | j�|�W S W nV tk
r� } z8|jd tkr�| jr�|dk r|W Y �dS W Y � dS n� W 5 d}~X Y nX dS )zORead up to LEN bytes and return them.
Return zero-length string on EOF.Nz'Read on closed or unwrapped SSL socket.r r/ )rR r r� r$ r r� Z
SSL_ERROR_EOFr� )r� r� r% �xr, r, r- r$ B s
zSSLSocket.readc C s& | � � | jdkrtd��| j�|�S )zhWrite DATA to the underlying SSL channel. Returns
number of bytes of DATA actually transmitted.Nz(Write on closed or unwrapped SSL socket.)rR r r� r' r( r, r, r- r' W s
zSSLSocket.writec C s | � � | �� | j�|�S r� )rR rS r r) r* r, r, r- r) ` s zSSLSocket.getpeercertc C s* | � � | jd kstjs d S | j�� S d S r� )rR r r; r r+ r� r, r, r- r+ f s z SSLSocket.selected_npn_protocolc C s* | � � | jd kstjs d S | j�� S d S r� )rR r r; r r, r� r, r, r- r, n s z SSLSocket.selected_alpn_protocolc C s$ | � � | jd krd S | j�� S d S r� )rR r r- r� r, r, r- r- v s
zSSLSocket.cipherc C s$ | � � | jd krd S | j�� S d S r� )rR r r. r� r, r, r- r. ~ s
zSSLSocket.shared_ciphersc C s$ | � � | jd krd S | j�� S d S r� )rR r r/ r� r, r, r- r/ � s
zSSLSocket.compressionr c sF | � � | jd k r4|dkr(td| j ��| j�|�S t� �||�S d S )Nr z3non-zero flags not allowed in calls to send() on %s)rR r r� r� r' r� �send)r� r� r
r� r, r- rU � s
�� zSSLSocket.sendc sL | � � | jd k r"td| j ��n&|d kr8t� �||�S t� �|||�S d S )Nz%sendto not allowed on instances of %s)rR r r� r� r� �sendto)r� r� Z
flags_or_addrr� r� r, r- rV � s
�zSSLSocket.sendtoc O s t d| j ��d S )Nz&sendmsg not allowed on instances of %s�rB r� r r, r, r- �sendmsg� s �zSSLSocket.sendmsgc
s� | � � | jd k r�|dkr(td| j ��d}t|��H}|�d��2}t|�}||k rn| �||d � �}||7 }qJW 5 Q R X W 5 Q R X nt� � ||�S d S )Nr z6non-zero flags not allowed in calls to sendall() on %s�B)
rR r r� r� �
memoryview�castr� rU r� �sendall)r� r� r
r� ZviewZ byte_viewZamountr& r� r, r- r\ � s
�� zSSLSocket.sendallc s, | j dk r| �|||�S t� �|||�S dS )z�Send a file, possibly by using os.sendfile() if this is a
clear-text socket. Return the total number of bytes sent.
N)r Z_sendfile_use_sendr� �sendfile)r� �file�offsetr� r� r, r- r] � s
zSSLSocket.sendfilec sD | � � | jd k r2|dkr(td| j ��| �|�S t� �||�S d S )Nr z3non-zero flags not allowed in calls to recv() on %s)rR r r� r� r$ r� �recv�r� Zbuflenr
r� r, r- r` � s
��
zSSLSocket.recvc sj | � � |r |d kr t|�}n |d kr*d}| jd k rV|dkrJtd| j ��| �||�S t� �|||�S d S )Nr# r z8non-zero flags not allowed in calls to recv_into() on %s)rR r� r r� r� r$ r� � recv_into�r� r% �nbytesr
r� r, r- rb � s
�� zSSLSocket.recv_intoc s4 | � � | jd k r"td| j ��nt� �||�S d S )Nz'recvfrom not allowed on instances of %s)rR r r� r� r� �recvfromra r� r, r- re � s
�zSSLSocket.recvfromc s6 | � � | jd k r"td| j ��nt� �|||�S d S )Nz,recvfrom_into not allowed on instances of %s)rR r r� r� r� �
recvfrom_intorc r� r, r- rf � s
�zSSLSocket.recvfrom_intoc O s t d| j ��d S )Nz&recvmsg not allowed on instances of %srW r r, r, r- �recvmsg� s �zSSLSocket.recvmsgc O s t d| j ��d S )Nz+recvmsg_into not allowed on instances of %srW r r, r, r- � recvmsg_into� s �zSSLSocket.recvmsg_intoc C s$ | � � | jd k r | j�� S dS d S )Nr )rR r r0 r� r, r, r- r0 � s
zSSLSocket.pendingc s | � � d | _t� �|� d S r� )rR r r� r2 )r� Zhowr� r, r- r2 � s zSSLSocket.shutdownc C s. | j r| j �� }d | _ |S tdt| � ��d S �NzNo SSL wrapper around )r r2 r� r� )r� �sr, r, r- r3 s
zSSLSocket.unwrapc C s$ | j r| j �� S tdt| � ��d S ri )r r7 r� r� r� r, r, r- r7 s
z&SSLSocket.verify_client_post_handshakec s d | _ t� �� d S r� )r r� � _real_closer� r� r, r- rk s zSSLSocket._real_closec C sF | � � | �� }z$|dkr(|r(| �d � | j�� W 5 | �|� X d S )NrA )rS rE rD r r1 )r� �blockrO r, r, r- r1 s
zSSLSocket.do_handshakec s� | j rtd��| js | jd k r&td��| jj| d| j| | jd�| _z@|rVt� � |�}nd }t� �
|� |s~d| _| j r~| � � |W S t
tfk
r� d | _� Y nX d S )Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!Fr@ T)r� r� rK r r� rL r� rH r� �
connect_ex�connectr� r1 r� )r� r� rm Zrcr� r, r- �
_real_connect! s0 � zSSLSocket._real_connectc C s | � |d� dS )�QConnects to remote ADDR, and then wraps the connection in
an SSL channel.FN�ro �r� r� r, r, r- rn ; s zSSLSocket.connectc C s | � |d�S )rp Trq rr r, r, r- rm @ s zSSLSocket.connect_exc s. t � �� \}}| jj|| j| jdd�}||fS )z�Accepts a new connection from a remote client, and returns
a tuple containing that new connection wrapped with a server-side
SSL channel, and the address of the remote client.T)r� r� r� )r� �acceptr� r� r� r� )r� Znewsockr� r� r, r- rs E s �zSSLSocket.acceptr� c C s4 | j d k r| j �|�S |tkr,td�|���d S d S )Nz({0} channel binding type not implemented)r r4 �CHANNEL_BINDING_TYPESr� r� r5 r, r, r- r4 Q s
�z SSLSocket.get_channel_bindingc C s | j d k r| j �� S d S d S r� r6 r� r, r, r- r� \ s
zSSLSocket.version)FTTNNN)N)r# N)F)r )N)r )r N)r# r )Nr )r# r )Nr )F)r� )0r8 r9 r: rD r r� r� r r: r� r r� r" rP rR rS r$ r' r) r+ r, r- r. r/ rU rV rX r\ r] r` rb re rf rg rh r0 r2 r3 r7 rk r1 ro rn rm rs r4 r� r� r, r, r� r- r; � s� �>
r; Tc
C sl |r|st d��|r |s t d��t|�}
||
_|r<|
�|� |rL|
�||� | rZ|
�| � |
j| |||d�S )Nz5certfile must be specified for server-side operationsr )r� r� r� r� )r� r� r r� r Z set_ciphersr� ) r� r r r� r � ssl_version�ca_certsr� r� Zciphersr� r, r, r- r� i s$
�r� c C s� ddl m} ddlm} d}d}z |�| dd� �� �d }W n$ tk
rb td | |f ��Y n0X || dd� |�}||d |f|d
d � �S dS ) a� Return the time in seconds since the Epoch, given the timestring
representing the "notBefore" or "notAfter" date from a certificate
in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale).
"notBefore" or "notAfter" dates must use UTC (RFC 5280).
Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
UTC should be specified as GMT (see ASN1_TIME_print())
r )�strptime)�timegm) ZJanZFebZMarZAprZMayZJunZJulZAugZSepZOctZNovZDecz %d %H:%M:%S %Y GMTNrj rh z*time data %r does not match format "%%b%s"ri rm )�timerw Zcalendarrx �index�titler� )Z cert_timerw rx ZmonthsZ time_formatZ month_numberZttr, r, r- �cert_time_to_seconds� s
� r| z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----c sR t t�| �dd�� tg}|� fdd�tdt� �d�D �7 }|�td � d�|�S )z[Takes a certificate in binary DER format and returns the
PEM version of it as a string.�ASCII�strictc s g | ]}� ||d � �qS )�@ r, )r4 �i��fr, r- �
� s z(DER_cert_to_PEM_cert..r r �
) r� �base64Zstandard_b64encode�
PEM_HEADER�ranger� r� �
PEM_FOOTERr� )Zder_cert_bytesZssr, r� r- �DER_cert_to_PEM_cert� s
"r� c C s\ | � t�stdt ��| �� �t�s0tdt ��| �� tt�tt� � }t�|� dd��S )zhTakes a certificate in ASCII PEM format and returns the
DER-encoded version of it as a byte sequencez(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr} r~ )
r) r� r� �strip�endswithr� r� r� Z decodebytesr� )Zpem_cert_string�dr, r, r- �PEM_cert_to_DER_cert� s
��r� c
C sd | \}}|dk rt }nt}t|||d�}t| ��&}|�|��}|�d�} W 5 Q R X W 5 Q R X t| �S )z�Retrieve the certificate from the server at the specified address,
and return it as a PEM-encoded string.
If 'ca_certs' is specified, validate the server cert against it.
If 'ssl_version' is specified, use it in the connection attempt.N)r r� T)r
r �_create_stdlib_contextr~ r� r) r� )
r� ru rv ZhostZportr r� r� ZsslsockZdercertr, r, r- �get_server_certificate� s �
r� c C s t �| d�S )Nz )�_PROTOCOL_NAMESr� )Z
protocol_coder, r, r- �get_protocol_name� s r� )nrD r� r� � collectionsr �enumr Z_Enumr Z_IntEnumr Z_IntFlagr; r r r r r
r r r
r r r r r r r� r r� r r r r r � ImportErrorr r r r r r r r! r" r# r$ r% � _convert_r8 r& r r' � __members__�itemsr� r8 Z_SSLv2_IF_EXISTSr7 r= rH rg r� ry rz r{ r| r} r~ r r� r� r� rJ r� r� Z socket_errorrt r ZHAS_NEVER_CHECK_COMMON_NAMEZ_RESTRICTED_SERVER_CIPHERSr� r� r� r� r� r� r� r� r� r� r� r r r Z _create_default_https_contextr� r r: r; r� r� r� r| r� r� r� r� r� r� r, r, r, r- � s� Y $0 � � � � � �
)
1# 9� z � # � / �