U
|
ý°díK ã @ sh U d Z ddlmZ ddlZddlmZ zddlmZ W n$ e k
|
rZ G dd de
|
ZY nX ddl Z ddl Z ddl Z ddlZddlmZ dd lmZ dd
|
lmZ d d lmZ ejd ed d e jrÎddlmZ ddgZej j ej j ej j ej j e j!ej j"iZ#e$e dr$e$ej dr$ej j%e#e j&< e$e drLe$ej drLej j'e#e j(< e j)ej j*e j+ej j,e j-ej j,ej j. iZ/dd e/ 0¡ D Z1e2ej dde2ej ddB Z3de4d< e2ej d dZ5de4d < e2ej d dZ6de4d < e2ej d dZ7de4d!< e2ej d"dZ8de4d#< e j9j:e3e j9j;e3e j9j<e3e5B e j9j=e3e5B e6B e j9j>e3e5B e6B e7B e j9j?e3e5B e6B e7B iZ@d$e4d%< e j9j:e3e5B e6B e7B e8B e j9j;e3e6B e7B e8B e j9j<e3e7B e8B e j9j=e3e8B e j9j>e3e j9j?e3iZAd$e4d&< d'ZBej jCZDe EeF¡ZGd(d)d*dZHd(d)d+dZId(d)d,d-ZJd.d/d0d1d2ZKd3d4d5d6d7ZLG d8d9 d9ZMejNeM_NG d:d; d;ZOd<d3dddd=d>d?d@ZPdS )Aa
|
Module for using pyOpenSSL as a TLS backend. This module was relevant before
|
the standard library ``ssl`` module supported SNI, but now that we've dropped
|
support for Python 2.7 all relevant Python versions support SNI so
|
**this module is no longer recommended**.
|
|
This needs the following packages installed:
|
|
* `pyOpenSSL`_ (tested with 16.0.0)
|
* `cryptography`_ (minimum 1.3.4, from pyopenssl)
|
* `idna`_ (minimum 2.0, from cryptography)
|
|
However, pyOpenSSL depends on cryptography, which depends on idna, so while we
|
use all three directly here we end up having relatively few packages required.
|
|
You can install them with the following command:
|
|
.. code-block:: bash
|
|
$ python -m pip install pyopenssl cryptography idna
|
|
To activate certificate checking, call
|
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
|
before you begin making HTTP requests. This can be done in a ``sitecustomize``
|
module, or at any other time before your application begins using ``urllib3``,
|
like this:
|
|
.. code-block:: python
|
|
try:
|
import urllib3.contrib.pyopenssl
|
urllib3.contrib.pyopenssl.inject_into_urllib3()
|
except ImportError:
|
pass
|
|
.. _pyopenssl: https://www.pyopenssl.org
|
.. _cryptography: https://cryptography.io
|
.. _idna: https://github.com/kjd/idna
|
é )Ú annotationsN)Úx509)ÚUnsupportedExtensionc @ s e Zd ZdS )r N)Ú__name__Ú
|
__module__Ú __qualname__© r r úPd:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\urllib3/contrib/pyopenssl.pyr 2 s r )ÚBytesIO)Úsocket)Útimeouté )Úutilz'urllib3.contrib.pyopenssl' module is deprecated and will be removed in urllib3 v2.1.0. Read more in this issue: https://github.com/urllib3/urllib3/issues/2680)ÚcategoryÚ
|
stacklevel©ÚX509Úinject_into_urllib3Úextract_from_urllib3ÚPROTOCOL_TLSv1_1ÚTLSv1_1_METHODÚPROTOCOL_TLSv1_2ÚTLSv1_2_METHODc C s i | ]\}}||qS r r )Ú.0ÚkÚvr r r Ú
|
<dictcomp>b s r Ú OP_NO_SSLv2Ú OP_NO_SSLv3ÚintÚ_OP_NO_SSLv2_OR_SSLv3Ú OP_NO_TLSv1Ú _OP_NO_TLSv1Ú OP_NO_TLSv1_1Ú_OP_NO_TLSv1_1Ú OP_NO_TLSv1_2Ú_OP_NO_TLSv1_2Ú OP_NO_TLSv1_3Ú_OP_NO_TLSv1_3zdict[int, int]Ú _openssl_to_ssl_minimum_versionÚ _openssl_to_ssl_maximum_versioni @ ÚNone©Úreturnc C s& t tt_ttj_dt_dtj_dS )z7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.TN)Ú_validate_dependencies_metÚPyOpenSSLContextr Ú
|
SSLContextÚssl_Ú IS_PYOPENSSLr r r r r s
|
c C s t t_t tj_dt_dtj_dS )z4Undo monkey-patching by :func:`inject_into_urllib3`.FN)Úorig_util_SSLContextr r0 r1 r2 r r r r r s c C sR ddl m} t| dddkr$tdddlm} | }t|dddkrNtddS ) z{
|
Verifies that PyOpenSSL's package-level dependencies have been met.
|
Throws `ImportError` if they are not met.
|
r )Ú
|
ExtensionsÚget_extension_for_classNzX'cryptography' module missing required functionality. Try upgrading to v1.3.4 or newer.r Z_x509zS'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.)Z cryptography.x509.extensionsr4 ÚgetattrÚ ImportErrorÚOpenSSL.cryptor )r4 r r r r r r. ¨ s ÿ ÿr. Ústrú
|
str | None©Únamer- c C s: ddddd}d| kr | S || }|dkr0dS | d¡S ) a%
|
Converts a dNSName SubjectAlternativeName field to the form used by the
|
standard library on the given Python version.
|
|
Cryptography produces a dNSName as a unicode string that was idna-decoded
|
from ASCII bytes. We need to idna-encode that string to get it back, and
|
then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
|
uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
|
|
If the name cannot be idna-encoded then we return None signalling that
|
the name given should be skipped.
|
r9 ú bytes | Noner; c S sr ddl }zJdD ]8}| |¡r| t|d
} | d¡| | ¡ W S q| | ¡W S |jjk
|
rl Y dS X dS )zÒ
|
Borrowed wholesale from the Python Cryptography Project. It turns out
|
that we can't just safely call `idna.encode`: it can explode for
|
wildcard names. This avoids that problem.
|
r N)z*.Ú.Úascii)ÚidnaÚ
|
startswithÚlenÚencodeÚcoreÚ IDNAError)r< r@ Úprefixr r r Ú idna_encodeÐ s
|
z'_dnsname_to_stdlib.<locals>.idna_encodeú:Núutf-8)Údecode)r< rG Ú encoded_namer r r Ú_dnsname_to_stdlib s rL r zlist[tuple[str, str]])Ú peer_certr- c C s´ | ¡ }z|j tj¡j}W nZ tjk
|
r6 g Y S tjttj t
|
fk
|
rv } zt d|¡ g W Y ¢S d}~X Y nX dd t t| tj¡D }| dd | tj¡D ¡ |S )zU
|
Given an PyOpenSSL certificate, provides all the subject alternative names.
|
zA problem was encountered with the certificate that prevented urllib3 from finding the SubjectAlternativeName field. This can affect certificate validation. The error was %sNc S s g | ]}|d k rd|fqS )NÚDNSr ©r r< r r r Ú
|
<listcomp> s þz%get_subj_alt_name.<locals>.<listcomp>c s s | ]}d t |fV qdS )z
|
IP AddressN)r9 rO r r r Ú <genexpr> s z$get_subj_alt_name.<locals>.<genexpr>)Zto_cryptographyÚ
|
extensionsr5 r ZSubjectAlternativeNameÚvalueZExtensionNotFoundZDuplicateExtensionr ZUnsupportedGeneralNameTypeÚ UnicodeErrorÚlogÚwarningÚmaprL Zget_values_for_typeZDNSNameÚextendZ IPAddress)rM ÚcertÚextÚeÚnamesr r r Úget_subj_alt_nameë s. üü þ
|
|
ÿr] c @ sà e Zd ZdZd/ddddddd Zd
|
d d d Zdd ddZddddddZddd
|
dddZdddddZ dd
|
dd d Z
|
dddd d Z dd d d!Z dd d"d#Z dd d$d%Zd0dd'd(d)d*Zd+d d,d-Zd.S )1Ú WrappedSocketz@API-compatibility wrapper for Python OpenSSL's Connection-class.TúOpenSSL.SSL.ConnectionÚ
|
socket_clsÚboolr+ )Ú
|
connectionr Úsuppress_ragged_eofsr- c C s" || _ || _|| _d| _d| _d S ©Nr F)rb r rc Ú_io_refsÚ_closed)Úselfrb r rc r r r Ú__init__ s
|
zWrappedSocket.__init__r r, c C s
|
| j ¡ S ©N)r Úfileno©rg r r r rj * s zWrappedSocket.filenoc C s* | j dkr| j d8 _ | jr&| ¡ d S )Nr é )re rf Úcloserk r r r Ú_decref_socketios. s
|
z WrappedSocket._decref_socketiosz
|
typing.AnyÚbytes)ÚargsÚkwargsr- c
|
O s4 z| j j||}W n tjjk
|
rj } z4| jrD|jdkrDW Y ¢ dS t|jd t||W 5 d }~X Y nÆ tjj k
|
r | j
|
¡ tjj krY dS Y n tjj k
|
rò } z8t | j| j ¡ ¡sÎtd|n| j|| W Y ¢S W 5 d }~X Y n> tjjk
|
r* } zt d|¡|W 5 d }~X Y nX |S d S )N©éÿÿÿÿzUnexpected EOFó r ú The read operation timed outú read error: )rb ÚrecvÚOpenSSLÚSSLÚ SysCallErrorrc rp ÚOSErrorr9 ÚZeroReturnErrorÚ get_shutdownÚRECEIVED_SHUTDOWNÚ WantReadErrorr Ú wait_for_readr Ú
|
gettimeoutr ÚErrorÚsslÚSSLError)rg rp rq Údatar[ r r r rw 4 s"
|
& $$zWrappedSocket.recvc
|
O s, z| j j||W S tjjk
|
rf } z4| jr@|jdkr@W Y ¢ dS t|jd t||W 5 d }~X Y n tjj k
|
r | j
|
¡ tjj krY dS Y n tjj k
|
rî } z8t | j| j ¡ ¡sÊtd|n| j|| W Y ¢S W 5 d }~X Y n: tjjk
|
r& } zt d|¡|W 5 d }~X Y nX d S )Nrr r ru rv )rb Ú recv_intorx ry rz rc rp r{ r9 r| r} r~ r r r r r r r r r )rg rp rq r[ r r r r M s
|
& $zWrappedSocket.recv_intoÚfloat)r r- c C s | j |¡S ri )r Ú
|
settimeout)rg r r r r r d s zWrappedSocket.settimeout)r
r- c
|
C s z| j |¡W S tjjk
|
rX } z(t | j| j ¡ ¡s@t |W Y ¢q W 5 d }~X Y q tjj
|
k
|
r } zt |j d t ||W 5 d }~X Y q X q d S ©Nr )rb Úsendrx ry ZWantWriteErrorr Úwait_for_writer r r rz r{ rp r9 )rg r
r[ r r r Ú_send_until_doneg s z WrappedSocket._send_until_donec C s4 d}|t |k r0| |||t
¡}||7 }qd S r )rB r ÚSSL_WRITE_BLOCKSIZE)rg r
Ú
|
total_sentÚsentr r r Úsendallr s ÿzWrappedSocket.sendallc C s | j ¡ d S ri )rb Úshutdownrk r r r r z s zWrappedSocket.shutdownc C s d| _ | jdkr| ¡ d S )NTr )rf re Ú _real_closerk r r r rm ~ s
|
zWrappedSocket.closec C s, z | j ¡ W S tjjk
|
r& Y d S X d S ri )rb rm rx ry r rk r r r r s zWrappedSocket._real_closeFz"dict[str, list[typing.Any]] | None)Ú binary_formr- c C sD | j ¡ }|s|S |r(tj tjj|¡S d| ¡ jffft|dS )NÚ
|
commonName)ÚsubjectÚsubjectAltName) rb Zget_peer_certificaterx ZcryptoZdump_certificateZ FILETYPE_ASN1Z get_subjectZCNr] )rg r r r r r Ú getpeercert s
|
þzWrappedSocket.getpeercertr9 c C s
|
| j ¡ S ri )rb Zget_protocol_version_namerk r r r Úversion s zWrappedSocket.versionN)T)F)r r r Ú__doc__rh rj rn rw r r r r r rm r r r r r r r r^ s ü ÿr^ c @ sB e Zd ZdZdddddZedddd Zejddd
|
d d Zeddd d Zejddd
|
dd ZddddZ dddddZ
|
d7dddddddZ d8d dddd d d Z d dd!d"d#Z d9d&d'd'd'd(d)d*d+d,Zddd-d.Zeddd/d0Zejddd1d2d0Zeddd3d4Zejddd5d6d4ZdS ):r/ zÂ
|
I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
|
for translating the interface of the standard library ``SSLContext`` object
|
to calls into PyOpenSSL.
|
r r+ )Úprotocolr- c C s> t | | _tj | j¡| _d| _d| _tj j
|
| _ tj j | _ d S rd )Ú_openssl_versionsr rx ry ÚContextÚ_ctxÚ_optionsÚcheck_hostnamer Ú
|
TLSVersionÚMINIMUM_SUPPORTEDÚ_minimum_versionÚMAXIMUM_SUPPORTEDÚ_maximum_version)rg r r r r rh § s
|
|
zPyOpenSSLContext.__init__r, c C s | j S ri )r rk r r r Úoptions¯ s zPyOpenSSLContext.options)rS r- c C s || _ | ¡ d S ri )r Ú_set_ctx_options©rg rS r r r r¥ ³ s c C s t | j ¡ S ri )Ú_openssl_to_stdlib_verifyr Zget_verify_moderk r r r Ú verify_mode¸ s z PyOpenSSLContext.verify_modezssl.VerifyModec C s | j t| t¡ d S ri )r Z
|
set_verifyÚ_stdlib_to_openssl_verifyÚ_verify_callbackr§ r r r r© ¼ s c C s | j ¡ d S ri )r Úset_default_verify_pathsrk r r r r¬ À s z)PyOpenSSLContext.set_default_verify_pathsz bytes | str)Úciphersr- c C s$ t |tr| d¡}| j |¡ d S )NrI )Ú
|
isinstancer9 rC r Zset_cipher_list)rg r r r r Ú set_ciphersà s
|
|
z PyOpenSSLContext.set_ciphersNr: r= )ÚcafileÚcapathÚcadatar- c
|
C s |d k r| d¡}|d k r$| d¡}z*| j ||¡ |d k rL| j t|¡ W n8 tjjk
|
r } zt d|¡|W 5 d }~X Y nX d S )NrI z%unable to load trusted certificates: ) rC r Úload_verify_locationsr
|
rx ry r r r )rg r° r± r² r[ r r r r³ È s
|
|
z&PyOpenSSLContext.load_verify_locationsr9 )ÚcertfileÚkeyfileÚpasswordr- c
|
s zP| j |¡ d k r>t ts* d¡ | j fdd¡ | j |pJ|¡ W n8 tjj k
|
r } zt
|
d|¡|W 5 d }~X Y nX d S )NrI c s S ri r )Ú_©r¶ r r Ú<lambda>ä rt z2PyOpenSSLContext.load_cert_chain.<locals>.<lambda>z"Unable to load certificate chain: ) r Zuse_certificate_chain_filer® ro rC Z set_passwd_cbZuse_privatekey_filerx ry r r r )rg r´ rµ r¶ r[ r r¸ r Úload_cert_chainÙ s
|
|
z PyOpenSSLContext.load_cert_chainzlist[bytes | str])Ú protocolsr- c C s dd |D }| j |¡S )Nc S s g | ]}t j |d ¡qS )r? )r Úto_bytes)r Úpr r r rP ê s z7PyOpenSSLContext.set_alpn_protocols.<locals>.<listcomp>)r Zset_alpn_protos)rg r» r r r Úset_alpn_protocolsé s z#PyOpenSSLContext.set_alpn_protocolsFTr` ra zbytes | str | Noner^ )ÚsockÚ server_sideÚdo_handshake_on_connectrc Úserver_hostnamer- c
|
C sà t j | j|¡}|r>tj |¡s>t|tr4| d¡}|
|
|¡ | ¡ z | ¡ W qÖ t jj k
|
r } z&t || ¡ ¡std|W Y ¢qFW 5 d }~X Y qÖ t jjk
|
rÐ } zt d|¡|W 5 d }~X Y qÖX qÖqFt||S )NrI zselect timed outzbad handshake: )rx ry Ú
|
Connectionr r r1 Ú is_ipaddressr® r9 rC Zset_tlsext_host_nameZset_connect_stateÚ do_handshaker r r r r r r r^ )rg r¿ rÀ rÁ rc r Úcnxr[ r r r Ú wrap_socketí s
|
|
|
|
$z PyOpenSSLContext.wrap_socketc C s& | j | jt| j B t| j B ¡ d S ri )r Z set_optionsr r) r¢ r* r¤ rk r r r r¦ s ÿþÿz!PyOpenSSLContext._set_ctx_optionsc C s | j S ri )r¢ rk r r r Úminimum_version s z PyOpenSSLContext.minimum_version)rÈ r- c C s || _ | ¡ d S ri )r¢ r¦ )rg rÈ r r r rÈ s c C s | j S ri )r¤ rk r r r Úmaximum_version s z PyOpenSSLContext.maximum_version)rÉ r- c C s || _ | ¡ d S ri )r¤ r¦ )rg rÉ r r r rÉ s )NNN)NN)FTTN)r r r r rh Úpropertyr¥ Úsetterr© r¬ r¯ r³ rº r¾ rÇ r¦ rÈ rÉ r r r r r/ sD ü ü ú r/ r_ ra )rÆ r Úerr_noÚ err_depthÚ return_coder- c C s |dkS r r )rÆ r rÌ rÍ rÎ r r r r« & s r« )Qr Ú
|
__future__r Z OpenSSL.SSLrx Z cryptographyr Zcryptography.x509r r7 Ú ExceptionÚloggingr ÚtypingÚwarningsÚior
|
r r` r Ú r ÚwarnÚDeprecationWarningÚ TYPE_CHECKINGr8 r Ú__all__r1 Ú PROTOCOL_TLSry Z SSLv23_METHODÚPROTOCOL_TLS_CLIENTÚPROTOCOL_TLSv1Z TLSv1_METHODr Úhasattrr r r r Ú CERT_NONEZ VERIFY_NONEÚ CERT_OPTIONALZ VERIFY_PEERÚ CERT_REQUIREDZVERIFY_FAIL_IF_NO_PEER_CERTrª Úitemsr¨ r6 r Ú__annotations__r" r$ r& r( r r¡ ÚTLSv1ÚTLSv1_1ÚTLSv1_2ÚTLSv1_3r£ r) r* r r0 r3 Ú getLoggerr rU r r r. rL r] r^ Úmakefiler/ r« r r r r Ú<module> sÊ ( û ý ÿý ÿ
|
÷ ÿþýü
|
ò
|
)0
|
