a �DOg2�� @s�ddlZddlZddlmZddlmZmZm Z ddl Z ddl m Z m Z mZddl mZmZmZddl mZmZmZmZmZmZmZddl mZmZddl mZmZmZm Z zdd l m!Z!Wne"y�Yn0dd l m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,dd l m-Z-m.Z.ej/d e0d d�e d�e j/de0dd�e d�ej/de0dd�e d�ej/de0dd�e d�e j/de0dd�e d�ej/de0dd�e d�e1j2Z3e1_3dd�e1j4�5�D�Z6e7e1dd�Z8Gdd�de�Z9Gdd �d e�Z:Gd!d"�d"e�Z;Gd#d$�d$e�ZZ>m?Z?dd'l@m@Z@mAZAmBZBdd(l@mCZCmDZDddl@ZEddlFZFddlGZGddlHZHeIZJd)gZKeLe d*�ZMe-ZNeZOd+d,�ZPd-d.�ZQd/d0�ZRd1d2�ZSed3d4�ZTd5d6�ZUGd7d8�d8ed8d9��ZVGd:d;�d;eVe�ZWGd�d?d@�ZZe2fe[dAeWjYddddddB�dCdD�Z\eZZ]e\Z^GdEdF�dF�Z_dGdH�Z`GdIdJ�dJe@�ZaeaeX_be_eX_cdddAe[e2ddKdKdf dLdM�ZddNdO�ZedPZfdQZgdRdS�ZhdTdU�Zie2dfdVdW�ZjdXdY�ZkdS)Z�N)� namedtuple)�Enum�IntEnum�IntFlag)�OPENSSL_VERSION_NUMBER�OPENSSL_VERSION_INFO�OPENSSL_VERSION)� _SSLContext� MemoryBIO� SSLSession)�SSLError�SSLZeroReturnError�SSLWantReadError�SSLWantWriteError�SSLSyscallError� SSLEOFError�SSLCertVerificationError)�txt2obj�nid2obj)� RAND_status�RAND_add� RAND_bytes�RAND_pseudo_bytes)�RAND_egd) �HAS_SNI�HAS_ECDH�HAS_NPN�HAS_ALPN� HAS_SSLv2� HAS_SSLv3� HAS_TLSv1� HAS_TLSv1_1� HAS_TLSv1_2� HAS_TLSv1_3)�_DEFAULT_CIPHERS�_OPENSSL_API_VERSION� _SSLMethodcCs|�d�o|dkS)NZ PROTOCOL_�PROTOCOL_SSLv23�� startswith��name�r,�/usr/lib64/python3.9/ssl.py�}�r.)�source�OptionscCs |�d�S)NZOP_r(r*r,r,r-r.�r/ZAlertDescriptioncCs |�d�S)NZALERT_DESCRIPTION_r(r*r,r,r-r.�r/ZSSLErrorNumbercCs |�d�S)NZ SSL_ERROR_r(r*r,r,r-r.�r/� VerifyFlagscCs |�d�S)NZVERIFY_r(r*r,r,r-r.�r/� VerifyModecCs |�d�S)NZCERT_r(r*r,r,r-r.�r/cCsi|]\}}||�qSr,r,)�.0r+�valuer,r,r-� �r/r6ZPROTOCOL_SSLv2c@s6eZdZejZejZejZ ej Z ej Z ejZejZdS)� TLSVersionN)�__name__� __module__� __qualname__�_sslZPROTO_MINIMUM_SUPPORTEDZMINIMUM_SUPPORTEDZ PROTO_SSLv3�SSLv3Z PROTO_TLSv1ZTLSv1Z PROTO_TLSv1_1ZTLSv1_1Z PROTO_TLSv1_2ZTLSv1_2Z PROTO_TLSv1_3ZTLSv1_3ZPROTO_MAXIMUM_SUPPORTEDZMAXIMUM_SUPPORTEDr,r,r,r-r7�sr7c@s$eZdZdZdZdZdZdZdZdS)�_TLSContentType������N) r8r9r:�CHANGE_CIPHER_SPEC�ALERTZ HANDSHAKEZAPPLICATION_DATA�HEADERZINNER_CONTENT_TYPEr,r,r,r-r=�s r=c@s�eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#S)$� _TLSAlertTyper� r>r?r@��(�)�*�+�,�-�.�/�0�1�2�3�<�F�G�P�V�Z�d�m�n�o�p�q�r�s�t�xN)%r8r9r:Z CLOSE_NOTIFYZUNEXPECTED_MESSAGEZBAD_RECORD_MACZDECRYPTION_FAILEDZRECORD_OVERFLOWZDECOMPRESSION_FAILUREZHANDSHAKE_FAILUREZNO_CERTIFICATEZBAD_CERTIFICATEZUNSUPPORTED_CERTIFICATEZCERTIFICATE_REVOKEDZCERTIFICATE_EXPIREDZCERTIFICATE_UNKNOWNZILLEGAL_PARAMETERZ UNKNOWN_CAZ ACCESS_DENIEDZ DECODE_ERRORZ DECRYPT_ERRORZEXPORT_RESTRICTIONZPROTOCOL_VERSIONZINSUFFICIENT_SECURITYZINTERNAL_ERRORZINAPPROPRIATE_FALLBACKZ USER_CANCELEDZNO_RENEGOTIATIONZMISSING_EXTENSIONZUNSUPPORTED_EXTENSIONZCERTIFICATE_UNOBTAINABLEZUNRECOGNIZED_NAMEZBAD_CERTIFICATE_STATUS_RESPONSEZBAD_CERTIFICATE_HASH_VALUEZUNKNOWN_PSK_IDENTITYZCERTIFICATE_REQUIREDZNO_APPLICATION_PROTOCOLr,r,r,r-rG�sDrGc@sdeZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdS)�_TLSMessageTyper�������� � � ���r>r?r@rA��C��rCN)r8r9r:Z HELLO_REQUESTZ CLIENT_HELLOZ SERVER_HELLOZHELLO_VERIFY_REQUESTZNEWSESSION_TICKETZEND_OF_EARLY_DATAZHELLO_RETRY_REQUESTZENCRYPTED_EXTENSIONSZ CERTIFICATEZSERVER_KEY_EXCHANGEZCERTIFICATE_REQUESTZ SERVER_DONEZCERTIFICATE_VERIFYZCLIENT_KEY_EXCHANGE�FINISHEDZCERTIFICATE_URLZCERTIFICATE_STATUSZSUPPLEMENTAL_DATAZ KEY_UPDATEZ NEXT_PROTOZ MESSAGE_HASHrDr,r,r,r-rf�s,rf�win32)�enum_certificates� enum_crls)�socket� SOCK_STREAM�create_connection)� SOL_SOCKET�SO_TYPE� tls-unique�HOSTFLAG_NEVER_CHECK_SUBJECTcCs�|sdS|�d�}|s&|��|��kS|dkrsole wildcard without additional labels are not support: {!r}.z.shim_cb)Z sni_callback�callable� TypeError)r�r�r�r,r�r-�set_servername_callbacks z"SSLContext.set_servername_callbackcCs`t�}|D]F}t|d�}t|�dks0t|�dkr8td��|�t|��|�|�q |�|�dS)Nr�rr�z)ALPN protocols must be 1 to 255 in length)r�r�r�r r�r�Z_set_alpn_protocols)r�Zalpn_protocolsr�r�r�r,r,r-�set_alpn_protocols!s  zSSLContext.set_alpn_protocolscCstt�}zYn0|tjkrPt}n|tjkr`t}nt}z ||�}Wnty�Yn0�||||||�Sr�)r7r�r=rFrErGrf)�conn� direction�versionZ content_typeZmsg_type�dataZmsg_enum��callbackr,r-r�s(        �z'SSLContext._msg_callback..inner)r�r�r�r��hasattrr�r�)r�rrr�rr-r��s  cs tt�j�Sr�)r&r�r�r�r�r,r-r��szSSLContext.protocolcs tt�j�Sr�)r2r�� verify_flagsr�r�r,r-r �szSSLContext.verify_flagscsttt�j�||�dSr�)r�r�r r�r�r�r,r-r �scs.t�j}z t|�WSty(|YS0dSr�)r�� verify_moder3r�r�r�r,r-r �s   zSSLContext.verify_modecsttt�j�||�dSr�)r�r�r r�r�r�r,r-r �s)FTTNN)FNN) r8r9r:r�r�r�� PROTOCOL_TLSr�r�r�r�r�r�r�r�r�r�r�rr �propertyr��setterr�r�r;r�r�r�r r r�r,r,r�r-r��sh � �         &%r�)r�r�r�cCs�t|t�st|��tt�}|tjkr0t|_d|_ |s<|s<|rL|� |||�n|jt kr`|� |�t |d�r�tj�d�}|r�tjjs�||_|S)NT�keylog_filename� SSLKEYLOGFILE)r�r�r�r�r r�r�� CERT_REQUIREDr �check_hostnamer�� CERT_NONEr�rr�r�r�r��flags�ignore_environmentr)r�r�r�r�r�� keylogfiler,r,r-�create_default_context�s        rF)� cert_reqsrr��certfile�keyfiler�r�r�c Cs�t|t�st|��t|�} |s$d| _|dur2|| _|r�sz&SSLObject.verify_client_post_handshake)FNNN)r*N)F)r�)r8r9r:r r�r�r r�r r�r)r�r�r+r.r0r2r3r4r5r6r7r8r:r;rr>r,r,r,r-r-sB�           rcCstt|j�j|_|Sr�)�getattrrr8�__doc__)�funcr,r,r-� _sslcopydoc�srBcseZdZdd�ZedW�fdd� �Zeedd ���Zej d d ��Zeed d ���Z e j d d ��Z eedd���Z dd�Z dXdd�Z dd�ZdYdd�Zdd�ZedZdd��Zedd��Zedd ��Zed!d"��Zed#d$��Zed%d&��Zd[�fd(d)� Zd\�fd*d+� Zd,d-�Zd]�fd.d/� Zd^�fd0d1� Zd_�fd2d3� Zd`�fd4d5� Zda�fd6d7� Zdb�fd8d9� Zd:d;�Z dd?��Z"�fd@dA�Z#edBdC��Z$edDdE��Z%�fdFdG�Z&edcdHdI��Z'�fdJdK�Z(dLdM�Z)dNdO�Z*�fdPdQ�Z+edddSdT��Z,edUdV��Z-�Z.S)e� SSLSocketcOst|jj�d���dS)NzX does not have a public constructor. Instances are returned by SSLContext.wrap_socket().rrr,r,r-r �s �zSSLSocket.__init__FTNc sf|�tt�tkrtd��|r8|r(td��|dur8td��|jrJ|sJtd��t|j|j |j |� �d�}|j |fi|��} t t| �jfi|��|��} |��|| _|| _d| _d| _|| _|�|�| _|| _|| _z | ��Wn�t�y�} z�| jtjkr��d} | ��} | � d�z| �!d�}Wn@t�yb} z&| jtjtj"fv�rJ�d}WYd} ~ n d} ~ 00| � | �|�r�d }t#| j|�}||_$d|_%z | �&�Wnt�y�Yn0z |�Wd}nd}0WYd} ~ nd} ~ 00d } | �'| �| | _(| �rbzH| jj)| || j| | jd �| _|�r<| ��}|d k�r4td ��| �*�Wn"ttf�y`| �&��Yn0| S)Nz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)�family�type�proto�filenoFrgr/z5Closed before TLS handshake with data in recv buffer.T�r!r��zHdo_handshake_on_connect should not be specified for non-blocking sockets)+� getsockoptr~rr|�NotImplementedErrorr�r�dictrDrErFrGr�r�rCr � gettimeout�detach�_context�_session�_closedr"r�r�r�r�r�� getpeernamer��errnoZENOTCONN� getblocking� setblocking�recv�EINVALr �reasonZlibrary�close� settimeout� _connected� _wrap_socketr8)r�r�r�r�r�r�r�r�r�r�Z sock_timeout�eZ connected�blockingZnotconn_pre_handshake_datarXZ notconn_pre_handshake_data_error�timeoutr�r,r-r��s�  �       " �  zSSLSocket._createcCs|jSr�)rOr�r,r,r-r�8szSSLSocket.contextcCs||_||j_dSr�)rOr"r�r$r,r,r-r�=scCs|jdur|jjSdSr�r&r�r,r,r-r�Bs zSSLSocket.sessioncCs||_|jdur||j_dSr�)rPr"r�r'r,r,r-r�Hs cCs|jdur|jjSdSr�r(r�r,r,r-r)Ns zSSLSocket.session_reusedcCstd|jj��dS)NzCan't dup() %s instances)rKr�r8r�r,r,r-�dupTs�z SSLSocket.dupcCsdSr�r,)r��msgr,r,r-� _checkClosedXszSSLSocket._checkClosedcCs|js|��dSr�)r[rRr�r,r,r-�_check_connected\szSSLSocket._check_connectedr*c Cs�|��|jdurtd��z*|dur4|j�||�WS|j�|�WSWn`ty�}zH|jdtkr�|jr�|dur~WYd}~dSWYd}~dSn�WYd}~n d}~00dS)Nz'Read on closed or unwrapped SSL socket.rr/)rbr"r�r+r r�Z SSL_ERROR_EOFr�)r�r�r,�xr,r,r-r+ds zSSLSocket.readcCs&|��|jdurtd��|j�|�S)Nz(Write on closed or unwrapped SSL socket.)rbr"r�r.r/r,r,r-r.ys zSSLSocket.writecCs|��|��|j�|�Sr�)rbrcr"r0r1r,r,r-r0�szSSLSocket.getpeercertcCs*|��|jdustjsdS|j��SdSr�)rbr"r;rr2r�r,r,r-r2�szSSLSocket.selected_npn_protocolcCs*|��|jdustjsdS|j��SdSr�)rbr"r;rr3r�r,r,r-r3�sz SSLSocket.selected_alpn_protocolcCs$|��|jdurdS|j��SdSr�)rbr"r4r�r,r,r-r4�s zSSLSocket.ciphercCs$|��|jdurdS|j��SdSr�)rbr"r5r�r,r,r-r5�s zSSLSocket.shared_cipherscCs$|��|jdurdS|j��SdSr�)rbr"r6r�r,r,r-r6�s zSSLSocket.compressionrcsF|��|jdur4|dkr(td|j��|j�|�St��||�SdS)Nrz3non-zero flags not allowed in calls to send() on %s)rbr"r�r�r.r��send)r�rrr�r,r-re�s �� zSSLSocket.sendcsL|��|jdur"td|j��n&|dur8t��||�St��|||�SdS)Nz%sendto not allowed on instances of %s)rbr"r�r�r��sendto)r�rZ flags_or_addrr�r�r,r-rf�s �zSSLSocket.sendtocOstd|j��dS)Nz&sendmsg not allowed on instances of %s�rKr�rr,r,r-�sendmsg�s�zSSLSocket.sendmsgc s�|��|jdur�|dkr(td|j��d}t|��f}|�d��<}t|�}||krn|�||d��}||7}qJWd�n1s�0YWd�q�1s�0Ynt�� ||�SdS)Nrz6non-zero flags not allowed in calls to sendall() on %s�B) rbr"r�r�� memoryview�castr�rer��sendall)r�rrr��view� byte_view�amountr-r�r,r-rl�s ��HzSSLSocket.sendallcs,|jdur|�|||�St��|||�SdSr�)r"�_sendfile_use_sendr��sendfile)r��file�offsetr�r�r,r-rq�s zSSLSocket.sendfilecsD|��|jdur2|dkr(td|j��|�|�St��||�SdS)Nrz3non-zero flags not allowed in calls to recv() on %s)rbr"r�r�r+r�rV�r��buflenrr�r,r-rV�s �� zSSLSocket.recvcsj|��|r|durt|�}n |dur*d}|jdurV|dkrJtd|j��|�||�St��|||�SdS)Nr*rz8non-zero flags not allowed in calls to recv_into() on %s)rbr�r"r�r�r+r�� recv_into�r�r,�nbytesrr�r,r-rv�s   �� zSSLSocket.recv_intocs4|��|jdur"td|j��nt��||�SdS)Nz'recvfrom not allowed on instances of %s)rbr"r�r�r��recvfromrtr�r,r-ry�s  �zSSLSocket.recvfromcs6|��|jdur"td|j��nt��|||�SdS)Nz,recvfrom_into not allowed on instances of %s)rbr"r�r�r�� recvfrom_intorwr�r,r-rzs  �zSSLSocket.recvfrom_intocOstd|j��dS)Nz&recvmsg not allowed on instances of %srgrr,r,r-�recvmsgs�zSSLSocket.recvmsgcOstd|j��dS)Nz+recvmsg_into not allowed on instances of %srgrr,r,r-� recvmsg_intos�zSSLSocket.recvmsg_intocCs$|��|jdur|j��SdSdS)Nr)rbr"r7r�r,r,r-r7s  zSSLSocket.pendingcs|��d|_t��|�dSr�)rbr"r�r9)r��howr�r,r-r9szSSLSocket.shutdowncCs.|jr|j��}d|_|Stdt|���dS�NzNo SSL wrapper around )r"r9r�r�)r��sr,r,r-r:$s  zSSLSocket.unwrapcCs$|jr|j��Stdt|���dSr~)r"r>r�r�r�r,r,r-r>-s z&SSLSocket.verify_client_post_handshakecsd|_t���dSr�)r"r�� _real_closer�r�r,r-r�4szSSLSocket._real_closec CsP|��|��}z.|dkr(|r(|�d�|j��W|�|�n |�|�0dS)NrI)rcrMrZr"r8)r��blockr_r,r,r-r88s   zSSLSocket.do_handshakec s�|jrtd��|js|jdur&td��|jj|d|j||jd�|_z@|rVt�� |�}nd}t�� |�|s~d|_|j r~|� �|WSt tfy�d|_�Yn0dS)Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!FrHT)r�r�r[r"r�r\r�rPr�� connect_ex�connectr�r8r�)r�r�r��rcr�r,r-� _real_connectCs*� zSSLSocket._real_connectcCs|�|d�dS)NF�r��r�r�r,r,r-r�]szSSLSocket.connectcCs |�|d�Sr�r�r�r,r,r-r�bszSSLSocket.connect_excs.t���\}}|jj||j|jdd�}||fS)NT)r�r�r�)r��acceptr�r�r�r�)r�Znewsockr�r�r,r-r�gs�zSSLSocket.acceptr�cCs4|jdur|j�|�S|tvr,td�|���dSdS)Nz({0} channel binding type not implemented)r"r;�CHANNEL_BINDING_TYPESr�r�r<r,r,r-r;ss  �zSSLSocket.get_channel_bindingcCs|jdur|j��SdSdSr�r=r�r,r,r-r~s  zSSLSocket.version)FTTNNN)N)r*N)F)r)N)r)rN)r*r)Nr)r*r)Nr)F)r�)/r8r9r:r r�r�r rBr�r r�r)r`rbrcr+r.r0r2r3r4r5r6rerfrhrlrqrVrvryrzr{r|r7r9r:r>r�r8r�r�r�r�r;rr�r,r,r�r-rC�s��_                          rCTc Csl|r|std��|r |s td��t|�} || _|r<| �|�|rL| �||�| rZ| �| �| j||||d�S)Nz5certfile must be specified for server-side operationsr)r�r�r�r�)r�r�r r�rZ set_ciphersr�) r�rrr�r� ssl_version�ca_certsr�r�Zciphersr�r,r,r-r��s"   �r�cCs�ddlm}ddlm}d}d}z|�|dd����d}Wn"ty`td||f��Yn00||dd�|�}||d|f|d d ��SdS) Nr)�strptime)�timegm) ZJanZFebZMarZAprZMayZJunZJulZAugZSepZOctZNovZDecz %d %H:%M:%S %Y GMTrirgz*time data %r does not match format "%%b%s"rhrl)�timer�Zcalendarr��index�titler�)Z cert_timer�r�ZmonthsZ time_formatZ month_number�ttr,r,r-�cert_time_to_seconds�s   � r�z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----csRtt�|�dd��tg}|�fdd�tdt��d�D�7}|�td�d�|�S)N�ASCII�strictcsg|]}�||d��qS)�@r,)r4�i��fr,r-� �r/z(DER_cert_to_PEM_cert..rr�� ) r��base64Zstandard_b64encode� PEM_HEADER�ranger�r�� PEM_FOOTERr�)Zder_cert_bytes�ssr,r�r-�DER_cert_to_PEM_cert�s "r�cCs\|�t�stdt��|���t�s0tdt��|��tt�tt� �}t�|� dd��S)Nz(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr�r�) r)r�r��strip�endswithr�r�r�Z decodebytesr�)Zpem_cert_string�dr,r,r-�PEM_cert_to_DER_cert�s ��r�c Cs�|\}}|durt}nt}t|||d�}t|��D}|�|��}|�d�} Wd�n1s\0YWd�n1sz0Yt| �S)N)rr�T)rr�_create_stdlib_contextr}r�r0r�) r�r�r��host�portrr�r�ZsslsockZdercertr,r,r-�get_server_certificate�s�  Fr�cCs t�|d�S)Nz )�_PROTOCOL_NAMESr�)Z protocol_coder,r,r-�get_protocol_name�sr�)lr�r�� collectionsr�enumrZ_Enumr�_IntEnumrZ_IntFlagr;rrrr r r r r rrrrrrr�rr�rrrrr� ImportErrorrrrrrrr r!r"r#r$r%� _convert_r8r&r r'� __members__�itemsr�r?Z_SSLv2_IF_EXISTSr7r=rGrfr�ryrzr{r|r}r~rr�r�rSr�r�Z socket_errorr�rZHAS_NEVER_CHECK_COMMON_NAMEZ_RESTRICTED_SERVER_CIPHERSr�r�r�r�r�r�r�r�r�r�r�rrrZ_create_default_https_contextr�rrBrCr�r�r�r�r�r�r�r�r�r�r,r,r,r-�^s� $ 0������   )  1# 9�z� #� />�