�
z fc
@ sP d Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l Z d d l m
Z
m Z m Z d d l m
Z
d d l m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z d d l m Z m Z d d
l m Z m Z y d d l m Z Wn e k
r+n Xd � Z e d
� e d � e d � e d � e d � d d l m Z m! Z! m" Z" m# Z# m$ Z$ d d l m% Z% d � e& � j' � D� Z( e) Z* y
e+ Z, Wn e- k
r�e. Z, n Xd d l/ m/ Z/ m0 Z0 m1 Z1 m2 Z3 e j4 d k r,d d l m5 Z5 m6 Z6 n d d l/ m/ Z/ m7 Z7 m8 Z8 m9 Z9 d d l/ m: Z: m; Z; d d l< Z< d d l= Z= d d l> Z> e j? r�d g Z@ n g Z@ d ZA d ZB d eC f d � � YZD d d � ZE d! � ZF e d" d# � ZG d$ � ZH d% e d% d& � f d' � � YZI d( eI f d) � � YZJ eJ d* � eJ _K eJ d+ � eJ _L d, e
f d- � � YZM eJ jK e. e. e. d. � ZN e) e. eO eJ jK e. e. e. e. e. d/ � ZP eP ZQ d0 ZR d1 � ZS eS � aT eU d2 � ZV d3 e/ f d4 � � YZW e. e. eO e e) e. eU eU e. d5 � ZX d6 � ZY d7 ZZ d8 Z[ d9 � Z\ d: � Z] e) e. d; � Z^ d< � Z_ e. e. d= � Z` d S(> s�
This module provides some more Pythonic support for SSL.
Object types:
SSLSocket -- subtype of socket.socket which does SSL over the socket
Exceptions:
SSLError -- exception raised for I/O errors
Functions:
cert_time_to_seconds -- convert time string used for certificate
notBefore and notAfter functions to integer
seconds past the Epoch (the time values
returned from time.time())
fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
by the server running on HOST at port PORT. No
validation of the certificate is performed.
Integer constants:
SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT
SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE
The following group define certificate requirements that one side is
allowing/requiring from the other side:
CERT_NONE - no certificates from the other side are required (or will
be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
validated, and if validation fails, the connection will
also fail
CERT_REQUIRED - certificates are required, and will be validated, and
if validation fails, the connection will also fail
The following constants identify various SSL protocol variants:
PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLS
PROTOCOL_TLSv1
PROTOCOL_TLSv1_1
PROTOCOL_TLSv1_2
The following constants identify various SSL alert message descriptions as per
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
ALERT_DESCRIPTION_CLOSE_NOTIFY
ALERT_DESCRIPTION_UNEXPECTED_MESSAGE
ALERT_DESCRIPTION_BAD_RECORD_MAC
ALERT_DESCRIPTION_RECORD_OVERFLOW
ALERT_DESCRIPTION_DECOMPRESSION_FAILURE
ALERT_DESCRIPTION_HANDSHAKE_FAILURE
ALERT_DESCRIPTION_BAD_CERTIFICATE
ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE
ALERT_DESCRIPTION_CERTIFICATE_REVOKED
ALERT_DESCRIPTION_CERTIFICATE_EXPIRED
ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN
ALERT_DESCRIPTION_ILLEGAL_PARAMETER
ALERT_DESCRIPTION_UNKNOWN_CA
ALERT_DESCRIPTION_ACCESS_DENIED
ALERT_DESCRIPTION_DECODE_ERROR
ALERT_DESCRIPTION_DECRYPT_ERROR
ALERT_DESCRIPTION_PROTOCOL_VERSION
ALERT_DESCRIPTION_INSUFFICIENT_SECURITY
ALERT_DESCRIPTION_INTERNAL_ERROR
ALERT_DESCRIPTION_USER_CANCELLED
ALERT_DESCRIPTION_NO_RENEGOTIATION
ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION
ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE
ALERT_DESCRIPTION_UNRECOGNIZED_NAME
ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE
ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE
ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY
i����N( t
namedtuple( t closing( t OPENSSL_VERSION_NUMBERt OPENSSL_VERSION_INFOt OPENSSL_VERSION( t _SSLContext( t SSLErrort SSLZeroReturnErrort SSLWantReadErrort SSLWantWriteErrort SSLSyscallErrort SSLEOFError( t CERT_NONEt
CERT_OPTIONALt
CERT_REQUIRED( t txt2objt nid2obj( t RAND_statust RAND_add( t RAND_egdc C sC x< t t � D]. } | j | � r
t t | � t � | <q
q
Wd S( N( t dirt _sslt
startswitht getattrt globals( t prefixt n( ( s /usr/lib64/python2.7/ssl.pyt _import_symbolss s t OP_t ALERT_DESCRIPTION_t
SSL_ERROR_t PROTOCOL_t VERIFY_( t HAS_SNIt HAS_ECDHt HAS_NPNt HAS_ALPNt HAS_TLSv1_3( t _OPENSSL_API_VERSIONc C s: i | ]0 \ } } | j d � r | d k r | | � q S( R t PROTOCOL_SSLv23( R ( t .0t namet value( ( s /usr/lib64/python2.7/ssl.pys
<dictcomp>� s ( t sockett _fileobjectt _delegate_methodst errort win32( t enum_certificatest enum_crls( R+ t AF_INETt SOCK_STREAMt create_connection( t
SOL_SOCKETt SO_TYPEs
tls-uniques� TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:DH+CHACHA20:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!3DESs� TLS13-AES-256-GCM-SHA384:TLS13-CHACHA20-POLY1305-SHA256:TLS13-AES-128-GCM-SHA256:ECDH+AESGCM:ECDH+CHACHA20:DH+AESGCM:DH+CHACHA20:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!DSS:!RC4:!3DESt CertificateErrorc B s e Z RS( ( t __name__t
__module__( ( ( s /usr/lib64/python2.7/ssl.pyR7 � s i c
C sR g } | s t S| j d � } | d } | d } | j d � } | | k rg t d t | � � � n | s� | j � | j � k S| d k r� | j d � nY | j d � s� | j d � r� | j t j | � � n" | j t j | � j
d d � � x$ | D] } | j t j | � � q� Wt j d
d j | � d t j
� } | j | � S(
sh Matching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
t .i i t *s, too many wildcards in certificate DNS name: s [^.]+s xn--s \*s [^.]*s \As \.s \Z( t Falset splitt countR7 t reprt lowert appendR t ret escapet replacet compilet joint
IGNORECASEt match(
t dnt hostnamet
max_wildcardst patst piecest leftmostt remaindert wildcardst fragt pat( ( s /usr/lib64/python2.7/ssl.pyt _dnsname_match� s*
"
&c C s[ | s t d � � n g } | j d d
� } xC | D]; \ } } | d k r4 t | | � r_ d S| j | � q4 q4 W| s� xc | j d d � D]L } xC | D]; \ } } | d k r� t | | � r� d S| j | � q� q� Wq� Wn t | � d k r t d | d j t t | � � f � � n; t | � d k rKt d
| | d f � � n t d � � d S( s) Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
st empty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDt subjectAltNamet DNSNt subjectt
commonNamei s& hostname %r doesn't match either of %ss , s hostname %r doesn't match %ri s= no appropriate commonName or subjectAltName fields were found( ( ( t
ValueErrort getRS RA t lenR7 RF t mapR? ( t certRJ t dnsnamest sant keyR* t sub( ( s /usr/lib64/python2.7/ssl.pyt match_hostname� s. %t DefaultVerifyPathssQ cafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathc C s� t j � } t j j | d | d � } t j j | d | d � } t t j j | � ra | n d t j j | � r| | n d | � S( s/ Return paths to default cafile and capath.
i i i i N(
R t get_default_verify_pathst ost environRY Rb t patht isfilet Nonet isdir( t partst cafilet capath( ( s /usr/lib64/python2.7/ssl.pyRc . s t _ASN1Objects nid shortname longname oidc B s; e Z d Z d Z d � Z e d � � Z e d � � Z RS( s# ASN.1 object identifier lookup
c C s% t t | � j | t | d t �� S( NR) ( t superRm t __new__t _txt2objR< ( t clst oid( ( s /usr/lib64/python2.7/ssl.pyRo A s c C s t t | � j | t | � � S( s3 Create _ASN1Object from OpenSSL numeric ID
( Rn Rm Ro t _nid2obj( Rq t nid( ( s /usr/lib64/python2.7/ssl.pyt fromnidD s c C s% t t | � j | t | d t �� S( s= Create _ASN1Object from short name, long name or OID
R) ( Rn Rm Ro Rp t True( Rq R) ( ( s /usr/lib64/python2.7/ssl.pyt fromnameJ s ( ( R8 R9 t __doc__t __slots__Ro t classmethodRu Rw ( ( ( s /usr/lib64/python2.7/ssl.pyRm < s
t Purposec B s e Z d Z RS( sD SSLContext purpose flags with X509v3 Extended Key Usage objects
( R8 R9 Rx ( ( ( s /usr/lib64/python2.7/ssl.pyR{ Q s s 1.3.6.1.5.5.7.3.1s 1.3.6.1.5.5.7.3.2t
SSLContextc B sk e Z d Z d Z d
Z d � Z d � Z e e e d d � Z
d � Z d � Z d
� Z
e j d � Z RS( s| An SSLContext holds various SSL-related configuration options and
data, such as certificates and possibly a private key.t protocolt __weakref__t CAt ROOTc O s2 t j | | � } | t k r. | j t � n | S( N( R Ro t _SSLv2_IF_EXISTSt set_cipherst _DEFAULT_CIPHERS( Rq R} t argst kwargst self( ( s /usr/lib64/python2.7/ssl.pyRo ` s c C s
| | _ d S( N( R} ( R� R} ( ( s /usr/lib64/python2.7/ssl.pyt __init__f s c
C s+ t d | d | d | d | d | d | � S( Nt sockt server_sidet do_handshake_on_connectt suppress_ragged_eofst server_hostnamet _context( t SSLSocket( R� R� R� R� R� R� ( ( s /usr/lib64/python2.7/ssl.pyt wrap_socketi s
c C s� t � } xp | D]h } | j d � } t | � d k sI t | � d k rX t d � � n | j t | � � | j | � q W| j | � d S( Nt asciii i� s( NPN protocols must be 1 to 255 in length( t bytearrayt encodeRZ R RA t extendt _set_npn_protocols( R� t
npn_protocolst protosR} t b( ( s /usr/lib64/python2.7/ssl.pyt set_npn_protocolss s
$c C s� t � } xp | D]h } | j d � } t | � d k sI t | � d k rX t d � � n | j t | � � | j | � q W| j | � d S( NR� i i� s) ALPN protocols must be 1 to 255 in length( R� R� RZ R RA R� t _set_alpn_protocols( R� t alpn_protocolsR� R} R� ( ( s /usr/lib64/python2.7/ssl.pyt set_alpn_protocols~ s
$c C s� t � } y^ xW t | � D]I \ } } } | d k r | t k sO | j | k rb | j | � qb q q WWn t k
r� t j d � n X| r� | j d | � n | S( Nt x509_asns- unable to enumerate Windows certificate storet cadata( R� R0 Rv Rr R� t OSErrort warningst warnt load_verify_locations( R� t storenamet purposet certsR\ t encodingt trust( ( s /usr/lib64/python2.7/ssl.pyt _load_windows_store_certs� s
c C sb t | t � s t | � � n t j d k rT x$ | j D] } | j | | � q7 Wn | j � d S( NR/ ( t
isinstanceRm t TypeErrort syst platformt _windows_cert_storesR� t set_default_verify_paths( R� R� R� ( ( s /usr/lib64/python2.7/ssl.pyt load_default_certs� s ( R} R~ ( R R� N( R8 R9 Rx Ry R� Ro R� R< Rv Rh R� R� R� R� R{ t SERVER_AUTHR� ( ( ( s /usr/lib64/python2.7/ssl.pyR| Y s c C s� t | t � s t | � � n t t � } | t j k rN t | _ t | _
n | t j k rm | j t
� n | s | s | r� | j | | | � n | j t k r� | j | � n | S( s� Create a SSLContext object with default settings.
NOTE: The protocol and settings may change anytime without prior
deprecation. The values represent a fair balance between maximum
compatibility and security.
( R� Rm R� R| t PROTOCOL_TLSR{ R� R t verify_modeRv t check_hostnamet CLIENT_AUTHR� t _RESTRICTED_SERVER_CIPHERSR� R R� ( R� Rk Rl R� t context( ( s /usr/lib64/python2.7/ssl.pyt create_default_context� s c
C s� t | t � s t | � � n t | � } | d k rB | | _ n | | _ | rg | rg t d � � n | ss | r� | j | | � n | s� | s� | r� | j | | | � n | j t
k r� | j | � n | S( s/ Create a SSLContext object for Python stdlib modules
All Python stdlib modules shall use this function to create SSLContext
objects in order to keep common settings in one place. The configuration
is less restrict than create_default_context()'s to increase backward
compatibility.
s certfile must be specifiedN( R� Rm R� R| Rh R� R� RX t load_cert_chainR� R R� (
R} t cert_reqsR� R� t certfilet keyfileRk Rl R� R� ( ( s /usr/lib64/python2.7/ssl.pyt _create_unverified_context� s
t PYTHONHTTPSVERIFYc C s5 t j j s1 t j j t � } | d k r1 t Sn t S( Nt 0( R� t flagst ignore_environmentRd Re RY t _https_verify_envvarR� R� ( t config_setting( ( s /usr/lib64/python2.7/ssl.pyt _get_https_context_factory� s
c C s | r t a n t a d S( s, Verify server HTTPS certificates by default?N( R� t _create_default_https_contextR� ( t enable( ( s /usr/lib64/python2.7/ssl.pyt _https_verify_certificates� s R� c B s� e Z d Z d' d' d' e e e d' e e e d d' e d' d' d' d' d � Z
e d � � Z e j
d � � Z d � Z d' d � Z d � Z d d' d � Z d
� Z e d � Z d � Z d
� Z d � Z d � Z d d � Z d' d � Z d d � Z d d d � Z d' d d � Z d d d � Z d' d d � Z d � Z d � Z d � Z! d � Z" d � Z# e d � Z$ d � Z% d � Z& d � Z' d � Z( d! d" d# � Z) d$ d% � Z* d& � Z+ RS(( s� This class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel.i c C s� d | _ d | _ | r$ | | _ n| r@ | r@ t d � � n | r\ | r\ t d � � n | rr | rr | } n t | � | _ | | j _ | r� | j j | � n | r� | j j | | � n | r� | j j | � n | r� | j j
| � n | | _ | | _ | | _
| | _ | | _ | | _ | j t t � t k rQt d � � n t j | d | j �x3 t D]+ } y t | | � Wqnt k
r�qnXqnW| r�| r�t d � � n | j j r�| r�t d � � n | | _ | | _ | | _ |
| _ | j! � } y | j" � Wnt# k
r0} | j$ t$ j% k rB� n t& } | j! � d k } | j' t& � y | j( d � } Wn: t# k
r�} | j$ t$ j% t$ j) f k r�� n d } n X| j' | � | r7d
} t* | j$ | � } | | _+ d | _, y | j- � Wn t. k
rn Xz
| � Wd d } Xq7n Xt/ } | j0 | � t& | _1 d | _ | | _2 | r�yb | j j3 | j | | d | �| _ | r�| j! � } | d k r�t d
� � n | j4 � n Wq�t. t f k
r�| j- � � q�Xn d S( Ni s5 certfile must be specified for server-side operationss certfile must be specifieds! only stream sockets are supportedt _socks4 server_hostname can only be specified in client modes' check_hostname requires server_hostnamei t s4 Closed before TLS handshake with data in recv buffert ssl_sockg sH do_handshake_on_connect should not be specified for non-blocking sockets(5 Rh t _sslobjt _makefile_refsR� RX R| R� R� R� R� R� R� R� R� t ssl_versiont ca_certst cipherst
getsockoptR5 R6 R3 t NotImplementedErrorR+ R� R� R- t delattrt AttributeErrorR� R� R� R� R� t
gettimeoutt getpeernamet socket_errort errnot ENOTCONNR< t setblockingt recvt EINVALR t reasont libraryt closeR� Rv t
settimeoutt _closedt
_connectedt _wrap_sockett do_handshake( R� R� R� R� R� R� R� R� R� t familyt typet protot filenoR� R� R� R� R� t attrt sock_timeoutt et connectedt blockingt notconn_pre_handshake_dataR� t notconn_pre_handshake_data_errort timeout( ( s /usr/lib64/python2.7/ssl.pyR� s�
c C s | j S( N( R� ( R� ( ( s /usr/lib64/python2.7/ssl.pyR� � s c C s | | _ | | j _ d S( N( R� R� R� ( R� t ctx( ( s /usr/lib64/python2.7/ssl.pyR� � s c C s t d | j j � � d S( Ns Can't dup() %s instances( R� t __class__R8 ( R� ( ( s /usr/lib64/python2.7/ssl.pyt dup� s c C s d S( N( ( R� t msg( ( s /usr/lib64/python2.7/ssl.pyt _checkClosed� s c C s | j s | j � n d S( N( R� R� ( R� ( ( s /usr/lib64/python2.7/ssl.pyt _check_connected� s i c C s� | j � | j s" t d � � n y> | d k rI | j j | | � } n | j j | � } | SWnI t k
r� } | j d t k r� | j r� | d k r� d Sd Sq� � n Xd S( sO Read up to LEN bytes and return them.
Return zero-length string on EOF.s' Read on closed or unwrapped SSL socket.i R� N( R� R� RX Rh t readR R� t
SSL_ERROR_EOFR� ( R� RZ t buffert vt x( ( s /usr/lib64/python2.7/ssl.pyR� � s
c C s2 | j � | j s" t d � � n | j j | � S( sh Write DATA to the underlying SSL channel. Returns
number of bytes of DATA actually transmitted.s( Write on closed or unwrapped SSL socket.( R� R� RX t write( R� t data( ( s /usr/lib64/python2.7/ssl.pyR� � s
c C s$ | j � | j � | j j | � S( s� Returns a formatted version of the data in the
certificate provided by the other end of the SSL channel.
Return None if no certificate was provided, {} if a
certificate was provided, but not validated.( R� R� R� t peer_certificate( R� t binary_form( ( s /usr/lib64/python2.7/ssl.pyt getpeercert� s
c C s3 | j � | j s t j r" d S| j j � Sd S( N( R� R� R R# Rh t selected_npn_protocol( R� ( ( s /usr/lib64/python2.7/ssl.pyR� � s
c C s3 | j � | j s t j r" d S| j j � Sd S( N( R� R� R R$ Rh t selected_alpn_protocol( R� ( ( s /usr/lib64/python2.7/ssl.pyR� � s
c C s( | j � | j s d S| j j � Sd S( N( R� R� Rh t cipher( R� ( ( s /usr/lib64/python2.7/ssl.pyR � s
c C s( | j � | j s d S| j j � Sd S( N( R� R� Rh t compression( R� ( ( s /usr/lib64/python2.7/ssl.pyR � s
c C s� | j � | j r� | d k r5 t d | j � � n y | j j | � } WnD t k
r� } | j d t k rt d S| j d t k r� d S� q� X| Sn | j j
| | � Sd S( Ni s3 non-zero flags not allowed in calls to send() on %s( R� R� RX R� R� R R� t SSL_ERROR_WANT_READt SSL_ERROR_WANT_WRITER� t send( R� R� R� R� R� ( ( s /usr/lib64/python2.7/ssl.pyR � s
c C sb | j � | j r) t d | j � � n5 | d k rH | j j | | � S| j j | | | � Sd S( Ns% sendto not allowed on instances of %s( R� R� RX R� Rh R� t sendto( R� R� t
flags_or_addrt addr( ( s /usr/lib64/python2.7/ssl.pyR � s
c C s� | j � | j r{ | d k r5 t d | j � � n t | � } d } x- | | k rv | j | | � } | | 7} qJ W| St j | | | � Sd S( Ni s6 non-zero flags not allowed in calls to sendall() on %s( R� R� RX R� RZ R R+ t sendall( R� R� R� t amountR> R� ( ( s /usr/lib64/python2.7/ssl.pyR � s
c C sY | j � | j rB | d k r5 t d | j � � n | j | � S| j j | | � Sd S( Ni s3 non-zero flags not allowed in calls to recv() on %s( R� R� RX R� R� R� R� ( R� t buflenR� ( ( s /usr/lib64/python2.7/ssl.pyR� s
c C s� | j � | r+ | d k r+ t | � } n | d k r@ d } n | j r{ | d k rk t d | j � � n | j | | � S| j j | | | � Sd S( Ni i s8 non-zero flags not allowed in calls to recv_into() on %s( R� Rh RZ R� RX R� R� R� t recv_into( R� R� t nbytesR� ( ( s /usr/lib64/python2.7/ssl.pyR s
c C s@ | j � | j r) t d | j � � n | j j | | � Sd S( Ns' recvfrom not allowed on instances of %s( R� R� RX R� R� t recvfrom( R� R
R� ( ( s /usr/lib64/python2.7/ssl.pyR
) s
c C sC | j � | j r) t d | j � � n | j j | | | � Sd S( Ns, recvfrom_into not allowed on instances of %s( R� R� RX R� R� t
recvfrom_into( R� R� R R� ( ( s /usr/lib64/python2.7/ssl.pyR 1 s
c C s( | j � | j r | j j � Sd Sd S( Ni ( R� R� t pending( R� ( ( s /usr/lib64/python2.7/ssl.pyR : s
c C s' | j � d | _ t j | | � d S( N( R� Rh R� R+ t shutdown( R� t how( ( s /usr/lib64/python2.7/ssl.pyR A s
c C s; | j d k r( d | _ t j | � n | j d 8_ d S( Ni ( R� Rh R� R+ R� ( R� ( ( s /usr/lib64/python2.7/ssl.pyR� F s c C s? | j r% | j j � } d | _ | St d t | � � � d S( Ns No SSL wrapper around ( R� R Rh RX t str( R� t s( ( s /usr/lib64/python2.7/ssl.pyt unwrapM s
c C s d | _ t j | � d S( N( Rh R� R+ t _real_close( R� ( ( s /usr/lib64/python2.7/ssl.pyR U s c C s� | j � | j � } z3 | d k r; | r; | j d � n | j j � Wd | j | � X| j j r� | j s~ t d � � n t
| j � | j � n d S( s Perform a TLS/SSL handshake.g Ns- check_hostname needs server_hostname argument( R� R� R� Rh R� R� R� R� R� RX Ra R� ( R� t blockR� ( ( s /usr/lib64/python2.7/ssl.pyR� Y s
c C s� | j r t d � � n | j r0 t d � � n | j j | j t | j d | �| _ ya | ru t j
| | � } n d } t j | | � | s� t
| _ | j r� | j � q� n | SWn# t t f k
r� d | _ � n Xd S( Ns! can't connect in server-side modes/ attempt to connect already-connected SSLSocket!R� ( R� RX R� R� R� R� R< R� R� R+ t
connect_exRh t connectRv R� R� R� ( R� R R t rc( ( s /usr/lib64/python2.7/ssl.pyt
_real_connectj s$ ' c C s | j | t � d S( sQ Connects to remote ADDR, and then wraps the connection in
an SSL channel.N( R R< ( R� R ( ( s /usr/lib64/python2.7/ssl.pyR � s c C s | j | t � S( sQ Connects to remote ADDR, and then wraps the connection in
an SSL channel.( R Rv ( R� R ( ( s /usr/lib64/python2.7/ssl.pyR � s c C sI t j | � \ } } | j j | d | j d | j d t �} | | f S( s� Accepts a new connection from a remote client, and returns
a tuple containing that new connection wrapped with a server-side
SSL channel, and the address of the remote client.R� R� R� ( R+ t acceptR� R� R� R� Rv ( R� t newsockR ( ( s /usr/lib64/python2.7/ssl.pyR � s t ri����c C s% | j d 7_ t | | | d t �S( s� Make and return a file-like object that
works with the SSL connection. Just use the code
from the socket module.i R� ( R� R, Rv ( R� t modet bufsize( ( s /usr/lib64/python2.7/ssl.pyt makefile� s s
tls-uniquec C s_ | t k r t d � � n | d k r? t d j | � � � n | j d k rR d S| j j � S( s� Get channel binding data for current connection. Raise ValueError
if the requested `cb_type` is not supported. Return bytes of the data
or None if the data is not available (e.g. before the handshake).
s Unsupported channel binding types
tls-uniques( {0} channel binding type not implementedN( t CHANNEL_BINDING_TYPESRX R� t formatR� Rh t
tls_unique_cb( R� t cb_type( ( s /usr/lib64/python2.7/ssl.pyt get_channel_binding� s c C s | j d k r d S| j j � S( s�
Return a string identifying the protocol version used by the
current SSL channel, or None if there is no established channel.
N( R� Rh t version( R� ( ( s /usr/lib64/python2.7/ssl.pyR& � s N(, R8 R9 Rx Rh R< R R� Rv R2 R3 R� t propertyR� t setterR� R� R� R� R� R� R� R� R R R R R R� R R
R R R R� R R R� R R R R R R% R& ( ( ( s /usr/lib64/python2.7/ssl.pyR� sR u
c
C sC t d | d | d | d | d | d | d | d | d | d
| �
S( NR� R� R� R� R� R� R� R� R� R� ( R� (
R� R� R� R� R� R� R� R� R� R� ( ( s /usr/lib64/python2.7/ssl.pyR� � s c C s� d d l m } d d l m } d } d } y! | j | d j � � d } Wn' t k
rv t d | | f � � n3 X| | d | � } | | d | f | d d !� Sd S( s� Return the time in seconds since the Epoch, given the timestring
representing the "notBefore" or "notAfter" date from a certificate
in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale).
"notBefore" or "notAfter" dates must use UTC (RFC 5280).
Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
UTC should be specified as GMT (see ASN1_TIME_print())
i����( t strptime( t timegmt Jant Febt Mart Aprt Mayt Junt Jult Augt Sept Octt Novt Decs %d %H:%M:%S %Y GMTi i s* time data %r does not match format "%%b%s"i i i N( R+ R, R- R. R/ R0 R1 R2 R3 R4 R5 R6 ( t timeR) t calendarR* t indext titleRX ( t cert_timeR) R* t monthst time_formatt month_numbert tt( ( s /usr/lib64/python2.7/ssl.pyt cert_time_to_seconds� s
!
s -----BEGIN CERTIFICATE-----s -----END CERTIFICATE-----c C s< t j | � j d � } t d t j | d � d t d S( s[ Takes a certificate in binary DER format and returns the
PEM version of it as a string.R� s
i@ ( t base64t standard_b64encodet decodet
PEM_HEADERt textwrapt fillt
PEM_FOOTER( t der_cert_bytest f( ( s /usr/lib64/python2.7/ssl.pyt DER_cert_to_PEM_cert� s c C s� | j t � s" t d t � � n | j � j t � sJ t d t � � n | j � t t � t t � !} t j | j d d � � S( sh Takes a certificate in ASCII PEM format and returns the
DER-encoded version of it as a byte sequences( Invalid PEM encoding; must start with %ss& Invalid PEM encoding; must end with %st ASCIIt strict(
R RD RX t stript endswithRG RZ RA t decodestringR� ( t pem_cert_stringt d( ( s /usr/lib64/python2.7/ssl.pyt PEM_cert_to_DER_cert� s
c
C s� | \ } } | d k r! t } n t } t | d | d | �} t t | � � �4 } t | j | � � � } | j t � } Wd QXWd QXt | � S( s� Retrieve the certificate from the server at the specified address,
and return it as a PEM-encoded string.
If 'ca_certs' is specified, validate the server cert against it.
If 'ssl_version' is specified, use it in the connection attempt.R� Rk N(
Rh R R t _create_stdlib_contextR R4 R� R� Rv RJ (
R R� R� t hostt portR� R� R� t sslsockt dercert( ( s /usr/lib64/python2.7/ssl.pyt get_server_certificate s c C s t j | d � S( Ns <unknown>( t _PROTOCOL_NAMESRY ( t
protocol_code( ( s /usr/lib64/python2.7/ssl.pyt get_protocol_name s c C s� t | d � r | j } n t t � } | s3 | rF | j | | � n | j | d t �} y | j � Wn t k
r| n X| j � | S( s� A replacement for the old socket.ssl function. Designed
for compability with Python 2.5 and earlier. Will disappear in
Python 3.0.R� R� (
t hasattrR� R| R' R� R� R< R� R� R� ( R� R� R� R� R� ( ( s /usr/lib64/python2.7/ssl.pyt sslwrap_simple s
(a Rx RE RB R� Rd t collectionsR t
contextlibR R R R R R R R R R R
R R R
R R Rp R Rs R R R t ImportErrorR R! R" R# R$ R% R& R t itemsRY R� R' t PROTOCOL_SSLv2R� t NameErrorRh R+ R, R- R. R� R� R0 R1 R2 R3 R4 R5 R6 RA R� R� t HAS_TLS_UNIQUER! R� R� RX R7 RS Ra Rb Rc Rm R{ R� R� R| R� R< R� RS R� R� R� Rv R� R� R� R@ RD RG RJ RR RX R[ R] ( ( ( s /usr/lib64/python2.7/ssl.pyt <module>Y s� .
(
"" 3 + G % � �