U
|
ý°dlH ã @ s< U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl
|
m Z m Z m Z ddlmZmZ ddlmZmZ dZdZd Zd Zd Zd
|
gZejeeee ef Z e e e d Z d d ddddZ dd d ddddZ ej!r"d dl"m#Z# d dl$m%Z%m&Z& ddl'mZ( G dd de&d dZ)i Z*d e+d < z¶d dl"Z"d d l"m,Z,mZm-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3mZm4Z4 e0Z5ere e/ej6j7ej8sd Zd D ]BZ9z e:e4e9e*e:e"d e9 < W n e;k
|
rÐ Y qY nX qddl'mZ W n2 e<k
|
r d!Z-d"Z.d#Z2d$Z3d Z5Z0d%Z1Y nX ej=de>df Z?d&d d'd(d)d*Z@d+d,d-d.d/ZAd+dd-d0d1ZBdNd2d2d2d3d2d2d4d5d6d7ZCejDdOd9d3d3d2d3d3d2d3d:d3d3d;d<d=d>d?d@ZEejDdPd9d3d3d2d3d3d2d3d:d3d3d;ddAd>dBd@ZEdQd9d3d3d2d3d3d2d3d:d3d3d;ddAd>dCd@ZEdDddEdFdGZFd ddHdIdJZGdRd9d4dd3dAdKdLdMZHdS )Sé )Ú annotationsN)Ú unhexlify)Úmd5Úsha1Úsha256é )ÚProxySchemeUnsupportedÚSSLErroré )Ú_BRACELESS_IPV6_ADDRZ_REÚ_IPV4_REFzhttp/1.1)é é( é@ ÚstrÚ_TYPE_VERSION_INFOÚbool)Úimplementation_nameÚ version_infoÚreturnc C sH | dkr dS |dd
}|d }|dkr0|dkpF|dkr@|dkpF|d kS )
|
ad Return True for CPython 3.8.9+, 3.9.3+ or 3.10+ where setting
|
SSLContext.hostname_checks_common_name to False works.
|
|
PyPy 7.3.7 doesn't work as it doesn't ship with OpenSSL 1.1.1l+
|
so we're waiting for a version of PyPy that works before
|
allowing this function to return 'True'.
|
|
Outside of CPython and PyPy we don't know which implementations work
|
or not so we conservatively use our hostname matching as we know that works
|
on all implementations.
|
|
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
|
https://foss.heptapod.net/pypy/pypy/-/issues/3539#
|
ÚcpythonFNr )é é é )r r r )r é
|
© )r r Z major_minorÚmicror r úHd:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\urllib3/util/ssl_.pyÚ_is_bpo_43522_fixed s ÿýr Úint)Úopenssl_version_numberr r r c C s | dk}|pt ||S )NiÏ)r )r r r Z is_openssl_issue_14579_fixedr r r Ú(_is_has_never_check_common_name_reliable9 s
|
ÿr! )Ú
|
VerifyMode)ÚLiteralÚ TypedDict)Ú SSLTransportc @ s& e Zd ZU ded< ded< ded< dS )Ú_TYPE_PEER_CERT_RET_DICTztuple[tuple[str, str], ...]ÚsubjectAltNamez'tuple[tuple[tuple[str, str], ...], ...]Úsubjectr Z serialNumberN)Ú__name__Ú
|
__module__Ú __qualname__Ú__annotations__r r r r r& P s
|
r& )Útotalzdict[int, int]Ú_SSL_VERSION_TO_TLS_VERSION) Ú CERT_REQUIREDÚHAS_NEVER_CHECK_COMMON_NAMEÚOP_NO_COMPRESSIONÚ OP_NO_TICKETÚOPENSSL_VERSION_NUMBERÚ PROTOCOL_TLSÚPROTOCOL_TLS_CLIENTÚ OP_NO_SSLv2Ú OP_NO_SSLv3Ú
|
SSLContextÚ
|
TLSVersion)ÚTLSv1ÚTLSv1_1ÚTLSv1_2Ú PROTOCOL_i i @ i i é z bytes | NoneÚNone)ÚcertÚ fingerprintr c C s | dkrt d| dd¡ ¡ }t|}t |¡}|sDt d| t| ¡ }|| ¡ }t
|
||¡st d| d| ¡ ddS ) zá
|
Checks if given fingerprint matches the supplied certificate.
|
|
:param cert:
|
Certificate as bytes object.
|
:param fingerprint:
|
Fingerprint as string of hexdigits, can be interspersed by colons.
|
Nz No certificate for the peer.ú:Ú z Fingerprint of invalid length: z&Fingerprints did not match. Expected "z", got "ú") r ÚreplaceÚlowerÚlenÚ HASHFUNC_MAPÚgetr ÚencodeÚdigestÚhmacÚcompare_digestÚhex)r@ rA Ú digest_lengthÚhashfuncÚfingerprint_bytesÚ cert_digestr r r Úassert_fingerprint s
|
|
ÿrS zNone | int | strr" )Ú candidater c C s@ | dkr t S t| tr<tt| d}|dkr8ttd| }|S | S )aë
|
Resolves the argument to a numeric constant, which can be passed to
|
the wrap_socket function/method from the ssl module.
|
Defaults to :data:`ssl.CERT_REQUIRED`.
|
If given a string it is assumed to be the name of the constant in the
|
:mod:`ssl` module or its abbreviation.
|
(So you can specify `REQUIRED` instead of `CERT_REQUIRED`.
|
If it's neither `None` nor a string we assume it is already the numeric
|
constant which can directly be passed to wrap_socket.
|
NÚCERT_)r/ Ú
|
isinstancer ÚgetattrÚssl©rT Úresr r r Úresolve_cert_reqs© s
|
r[ c C sH | dkr t S t| trDtt| d}|dkr8ttd| }t t|¡S | S )z
|
like resolve_cert_reqs
|
Nr= )r4 rV r rW rX ÚtypingÚcastr rY r r r Úresolve_ssl_versionÀ s
|
r^ z
|
int | Nonez
|
str | Nonezssl.SSLContext)Ú ssl_versionÚ cert_reqsÚoptionsÚciphersÚssl_minimum_versionÚssl_maximum_versionr c C s t dkrtd| dttfkrd|dk s.|dk r8tdn,t | tj¡}t | tj ¡}t
|
j dt dd t t}|dk r|||_ ntj|_ |dk r||_|r | |¡ |dkr®tjn|}|dkrÞd}|tO }|tO }|tO }|tO }| j|O _|tjkstjdkr t|d ddk r d
|
|_|tjkr<t s<||_ d
|
|_ n d |_ ||_ z
|
d |_ W n t k
|
rh Y nX t!|d rt"j# d ¡}|r||_$|S )ac Creates and configures an :class:`ssl.SSLContext` instance for use with urllib3.
|
|
:param ssl_version:
|
The desired protocol version to use. This will default to
|
PROTOCOL_SSLv23 which will negotiate the highest protocol that both
|
the server and your installation of OpenSSL support.
|
|
This parameter is deprecated instead use 'ssl_minimum_version'.
|
:param ssl_minimum_version:
|
The minimum version of TLS to be used. Use the 'ssl.TLSVersion' enum for specifying the value.
|
:param ssl_maximum_version:
|
The maximum version of TLS to be used. Use the 'ssl.TLSVersion' enum for specifying the value.
|
Not recommended to set to anything other than 'ssl.TLSVersion.MAXIMUM_SUPPORTED' which is the
|
default value.
|
:param cert_reqs:
|
Whether to require the certificate verification. This defaults to
|
``ssl.CERT_REQUIRED``.
|
:param options:
|
Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2``,
|
``ssl.OP_NO_SSLv3``, ``ssl.OP_NO_COMPRESSION``, and ``ssl.OP_NO_TICKET``.
|
:param ciphers:
|
Which cipher suites to allow the server to select. Defaults to either system configured
|
ciphers if OpenSSL 1.1.1+, otherwise uses a secure default set of ciphers.
|
:returns:
|
Constructed SSLContext object with specified options
|
:rtype: SSLContext
|
Nz7Can't create an SSLContext object without an ssl modulezZCan't specify both 'ssl_version' and either 'ssl_minimum_version' or 'ssl_maximum_version'zk'ssl_version' option is deprecated and will be removed in urllib3 v2.1.0. Instead use 'ssl_minimum_version'r )ÚcategoryÚ
|
stacklevelr )r é é Úpost_handshake_authTFÚkeylog_filenameÚ SSLKEYLOGFILE)%r8 Ú TypeErrorr4 r5 Ú
|
ValueErrorr. rI r9 ÚMINIMUM_SUPPORTEDÚMAXIMUM_SUPPORTEDÚwarningsÚwarnÚDeprecationWarningÚminimum_versionr< Úmaximum_versionÚ set_ciphersrX r/ r6 r7 r1 r2 ra Úsysr rW ri Ú IS_PYOPENSSLÚ verify_modeÚcheck_hostnameÚhostname_checks_common_nameÚAttributeErrorÚhasattrÚosÚenvironrj )r_ r` ra rb rc rd ÚcontextZ sslkeylogfiler r r Úcreate_urllib3_contextÐ st #ÿ ÿ ÿü
|
ÿþ
|
r .z socket.socketzssl.SSLContext | NonezNone | str | byteszLiteral[False]z ssl.SSLSocket)ÚsockÚkeyfileÚcertfiler` Úca_certsÚserver_hostnamer_ rb Ú ssl_contextÚ ca_cert_dirÚ key_passwordÚ ca_cert_dataÚ
|
tls_in_tlsr c C s d S ©Nr © r r r r` r r
r_ rb r r r r r r r r Ússl_wrap_socket^ s r z ssl.SSLSocket | SSLTransportTypec C s d S r r r r r r r q s c
|
C sü |} | dkrt |||d} |s&| s&| rhz| || | ¡ W q tk
|
rd } zt||W 5 d}~X Y qX n|dkrt| dr| ¡ |r|
|
dkrt|rtd|rÆ|
|
dkr¸| ||¡ n| |||
|
¡ z| t ¡ W n t
|
k
|
rè Y nX t | | | |}|S )a
|
All arguments except for server_hostname, ssl_context, and ca_cert_dir have
|
the same meaning as they do when using :func:`ssl.wrap_socket`.
|
|
:param server_hostname:
|
When SNI is supported, the expected hostname of the certificate
|
:param ssl_context:
|
A pre-made :class:`SSLContext` object. If none is provided, one will
|
be created using :func:`create_urllib3_context`.
|
:param ciphers:
|
A string of ciphers we wish the client to support.
|
:param ca_cert_dir:
|
A directory containing CA certificates in multiple separate files, as
|
supported by OpenSSL's -CApath flag or the capath argument to
|
SSLContext.load_verify_locations().
|
:param key_password:
|
Optional password if the keyfile is encrypted.
|
:param ca_cert_data:
|
Optional string containing CA certificates in PEM format suitable for
|
passing as the cadata parameter to SSLContext.load_verify_locations()
|
:param tls_in_tls:
|
Use SSLTransport to wrap the existing socket.
|
N)rb Úload_default_certsz5Client private key is encrypted, password is required) r Úload_verify_locationsÚOSErrorr r| r Ú_is_key_file_encryptedÚload_cert_chainÚset_alpn_protocolsÚALPN_PROTOCOLSÚNotImplementedErrorÚ_ssl_wrap_socket_impl)r r r r` r r
r_ rb r r r r r r ÚeZssl_sockr r r r s, & z str | bytes)Úhostnamer c C s, t | tr| d¡} tt | ¡p(t | ¡S )zæDetects whether the hostname given is an IPv4 or IPv6 address.
|
Also detects IPv6 addresses with Zone IDs.
|
|
:param str hostname: Hostname to examine.
|
:return: True if the hostname is an IP address, False otherwise.
|
Úascii)rV ÚbytesÚdecoder r Úmatchr )r r r r Ú is_ipaddressÏ s
|
|
r )Úkey_filer c C s: t | (}|D ] }d|kr W 5 Q R £ dS qW 5 Q R X dS )z*Detects if a key file is encrypted or not.Ú ENCRYPTEDTF)Úopen)r ÚfÚliner r r r Ü s
|
|
r )r r r r
r c C s4 |r&t stdt |¡ t | ||S |j| |dS )Nz0TLS in TLS requires support for the 'ssl' module)r
)r% r Z$_validate_ssl_context_for_tls_in_tlsÚ wrap_socket)r r r r
r r r r ç s ÿ
|
r )NNNNNN) ............) ............) NNNNNNNNNNNF)N)IÚ
|
__future__r rL r} Úsocketrv r\ rp Úbinasciir Úhashlibr r r Ú
|
exceptionsr r Úurlr r r8 r% r0 rw ÚIS_SECURETRANSPORTr ÚTupler r r rH r r! Ú TYPE_CHECKINGrX r" Ztyping_extensionsr# r$ Z ssltransportZSSLTransportTyper& r. r, r/ r1 r2 r3 r4 r5 r6 r7 r9 ÚPROTOCOL_SSLv23ÚimplementationÚnamer ÚattrrW r{ Ú ImportErrorÚUnionr Z_TYPE_PEER_CERT_RETrS r[ r^ r Úoverloadr r r r r r r r Ú<module> sÜ 4ý ÿ
|
ú ó, ó, ó*K ü
|
