U
|
I=®dÆ@ ã @ s\ d Z ddlmZ ddlZddlmZ ddlmZ ddl
|
m Z zddl m Z W n$ ek
|
rp G dd d eZ Y nX dd
|
lmZmZ dd lmZ zdd lmZ W n$ ek
|
r dZd dlmZ Y nX ddlZddlZd dlm Z ddl Z d dl m Z ddgZ dZ!e j"ej#j$ej%ej#j&iZ'e(edr@e(ej#dr@ej#j)e'ej*< e(edrhe(ej#drhej#j+e'ej,< e(edre(ej#drej#j-e'ej.< ej/ej#j0ej1ej#j2ej3ej#j2ej#j4 iZ5e6dd e5 7¡ D Z8d Z9e j!Z:e j;j<Z=e >e?¡Z@d d ZAd d ZBd d ZCd!d" ZDd#d$ ZEG d%d& d&eFZGer6d.d(d)ZHneZHeHeG_HG d*d+ d+eFZId,d- ZJdS )/ab
|
SSL with SNI_-support for Python 2. Follow these instructions if you would
|
like to verify SSL certificates in Python 2. Note, the default libraries do
|
*not* do certificate checking; you need to do additional work to validate
|
certificates yourself.
|
|
This needs the following packages installed:
|
|
* pyOpenSSL (tested with 16.0.0)
|
* cryptography (minimum 1.3.4, from pyopenssl)
|
* idna (minimum 2.0, from cryptography)
|
|
However, pyopenssl depends on cryptography, which depends on idna, so while we
|
use all three directly here we end up having relatively few packages required.
|
|
You can install them with the following command:
|
|
pip install pyopenssl cryptography idna
|
|
To activate certificate checking, call
|
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
|
before you begin making HTTP requests. This can be done in a ``sitecustomize``
|
module, or at any other time before your application begins using ``urllib3``,
|
like this::
|
|
try:
|
import urllib3.contrib.pyopenssl
|
urllib3.contrib.pyopenssl.inject_into_urllib3()
|
except ImportError:
|
pass
|
|
Now you can use :mod:`urllib3` as you normally would, and it will support SNI
|
when the required modules are installed.
|
|
Activating this module also has the positive side effect of disabling SSL/TLS
|
compression in Python 2 (see `CRIME attack`_).
|
|
If you want to configure the default list of supported cipher suites, you can
|
set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.
|
|
.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
|
.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)
|
é )Úabsolute_importN)Úx509)Úbackend)Ú _Certificate)ÚUnsupportedExtensionc @ s e Zd ZdS )r N)Ú__name__Ú
|
__module__Ú __qualname__© r
|
r
|
ú\D:\z\workplace\VsCode\pyvenv\venv\Lib\site-packages\pip/_vendor/urllib3/contrib/pyopenssl.pyr 7 s r )ÚtimeoutÚerror)ÚBytesIO)Ú _fileobjecté )Úbackport_makefile)Úsix)ÚutilÚinject_into_urllib3Úextract_from_urllib3TÚPROTOCOL_SSLv3Ú SSLv3_METHODÚPROTOCOL_TLSv1_1ÚTLSv1_1_METHODÚPROTOCOL_TLSv1_2ÚTLSv1_2_METHODc c s | ]\}}||fV qd S ©Nr
|
)Ú.0ÚkÚvr
|
r
|
r Ú <genexpr>g s r i @ c C s4 t tt_ttj_tt_ttj_dt_dtj_dS )z7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.TN)Ú_validate_dependencies_metÚPyOpenSSLContextr Ú
|
SSLContextÚssl_ÚHAS_SNIÚ IS_PYOPENSSLr
|
r
|
r
|
r r s s c C s. t t_t tj_tt_ttj_dt_dtj_dS )z4Undo monkey-patching by :func:`inject_into_urllib3`.FN)Úorig_util_SSLContextr r# r$ Úorig_util_HAS_SNIr% r& r
|
r
|
r
|
r r s c C sR ddl m} t| dddkr$tdddlm} | }t|dddkrNtddS ) z{
|
Verifies that PyOpenSSL's package-level dependencies have been met.
|
Throws `ImportError` if they are not met.
|
r )Ú
|
ExtensionsÚget_extension_for_classNzX'cryptography' module missing required functionality. Try upgrading to v1.3.4 or newer.)ÚX509Ú_x509zS'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.)Z cryptography.x509.extensionsr) ÚgetattrÚ ImportErrorZOpenSSL.cryptor+ )r) r+ r r
|
r
|
r r! s ÿ ÿr! c C s@ dd }d| kr| S || } | dkr(dS t jdkr<| d¡} | S )a%
|
Converts a dNSName SubjectAlternativeName field to the form used by the
|
standard library on the given Python version.
|
|
Cryptography produces a dNSName as a unicode string that was idna-decoded
|
from ASCII bytes. We need to idna-encode that string to get it back, and
|
then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
|
uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
|
|
If the name cannot be idna-encoded then we return None signalling that
|
the name given should be skipped.
|
c S sv ddl m} zJdD ]8}| |¡r| t|d
} | d¡| | ¡ W S q| | ¡W S |jjk
|
rp Y dS X dS )zÒ
|
Borrowed wholesale from the Python Cryptography Project. It turns out
|
that we can't just safely call `idna.encode`: it can explode for
|
wildcard names. This avoids that problem.
|
r )Úidna)z*.Ú.NÚascii)Ú pip._vendorr/ Ú
|
startswithÚlenÚencodeÚcoreÚ IDNAError)Únamer/ Úprefixr
|
r
|
r Ú idna_encode³ s
|
z'_dnsname_to_stdlib.<locals>.idna_encodeú:N)é r úutf-8)ÚsysÚ version_infoÚdecode)r8 r: r
|
r
|
r Ú_dnsname_to_stdlib¥ s
|
|
rA c C sÌ t | dr| ¡ }n tt| j}z|j tj¡j }W nZ tj
|
k
|
rN g Y S tj t tj tfk
|
r } zt d|¡ g W Y ¢S d}~X Y nX dd tt| tj¡D }| dd | tj¡D ¡ |S )zU
|
Given an PyOpenSSL certificate, provides all the subject alternative names.
|
Úto_cryptographyzA problem was encountered with the certificate that prevented urllib3 from finding the SubjectAlternativeName field. This can affect certificate validation. The error was %sNc S s g | ]}|d k rd|fqS )NÚDNSr
|
©r r8 r
|
r
|
r Ú
|
<listcomp>ú s þz%get_subj_alt_name.<locals>.<listcomp>c s s | ]}d t |fV qdS )z
|
IP AddressN)ÚstrrD r
|
r
|
r r ÿ s z$get_subj_alt_name.<locals>.<genexpr>)ÚhasattrrB r Úopenssl_backendr, Ú
|
extensionsr* r ZSubjectAlternativeNameÚvalueZExtensionNotFoundZDuplicateExtensionr ZUnsupportedGeneralNameTypeÚ UnicodeErrorÚlogÚwarningÚmaprA Zget_values_for_typeZDNSNameÚextendZ IPAddress)Z peer_certÚcertÚextÚeÚnamesr
|
r
|
r Úget_subj_alt_nameÐ s2
|
|
üü þ
|
|
ÿrT c @ s e Zd ZdZd!ddZdd Zdd Zd d
|
Zd d Zd d Z dd Z
|
dd Z dd Z dd Z d"ddZdd Zd d Zd d Zd S )#Ú WrappedSocketz§API-compatibility wrapper for Python OpenSSL's Connection-class.
|
|
Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
|
collector of pypy.
|
Tc C s" || _ || _|| _d| _d| _d S ©Nr F)Ú
|
connectionÚsocketÚsuppress_ragged_eofsÚ_makefile_refsÚ_closed)ÚselfrW rX rY r
|
r
|
r Ú__init__ s
|
zWrappedSocket.__init__c C s
|
| j ¡ S r )rX Úfileno©r\ r
|
r
|
r r^ s zWrappedSocket.filenoc C s* | j dkr| j d8 _ | jr&| ¡ d S )Nr é )rZ r[ Úcloser_ r
|
r
|
r Ú_decref_socketios s
|
z WrappedSocket._decref_socketiosc
|
O s z| j j||}W nô tjjk
|
r^ } z*| jrB|jdkrBW Y ¢dS tt|W 5 d }~X Y n® tjj k
|
r | j
|
¡ tjj krY dS Y n~ tjj k
|
rÒ t | j| j ¡ ¡s¾tdn| j|| Y S Y n: tjjk
|
r } zt d| ¡W 5 d }~X Y nX |S d S )N©éÿÿÿÿzUnexpected EOFó ú The read operation timed outúread error: %r)rW ÚrecvÚOpenSSLÚSSLÚ SysCallErrorrY ÚargsÚ SocketErrorrF ÚZeroReturnErrorÚ get_shutdownÚRECEIVED_SHUTDOWNÚ WantReadErrorr Ú wait_for_readrX Ú
|
gettimeoutr ÚErrorÚsslÚSSLError)r\ rl ÚkwargsÚdatarR r
|
r
|
r rh s"
|
|
zWrappedSocket.recvc
|
O s
|
z| j j||W S tjjk
|
r\ } z*| jr@|jdkr@W Y ¢dS tt|W 5 d }~X Y nª tjj k
|
r | j
|
¡ tjj krY dS Y nz tjj k
|
rÐ t | j| j ¡ ¡s¼tdn| j|| Y S Y n6 tjjk
|
r } zt d| ¡W 5 d }~X Y nX d S )Nrc r rf rg )rW Ú recv_intori rj rk rY rl rm rF rn ro rp rq r rr rX rs r rt ru rv )r\ rl rw rR r
|
r
|
r ry 7 s
|
|
zWrappedSocket.recv_intoc C s | j |¡S r )rX Ú
|
settimeout)r\ r r
|
r
|
r rz N s zWrappedSocket.settimeoutc
|
C s| z| j |¡W S tjjk
|
rD t | j| j ¡ ¡s<t Y q Y q tjj
|
k
|
rt } zt t |W 5 d }~X Y q X q d S r ) rW Úsendri rj ZWantWriteErrorr Úwait_for_writerX rs r rk rm rF )r\ rx rR r
|
r
|
r Ú_send_until_doneQ s z WrappedSocket._send_until_donec C s4 d}|t |k r0| |||t
¡}||7 }qd S ©Nr )r4 r} ÚSSL_WRITE_BLOCKSIZE)r\ rx Ú
|
total_sentÚsentr
|
r
|
r Úsendall\ s ÿzWrappedSocket.sendallc C s | j ¡ d S r )rW Úshutdownr_ r
|
r
|
r r d s zWrappedSocket.shutdownc C sL | j dk r:zd| _| j ¡ W S tjjk
|
r6 Y d S X n| j d8 _ d S )Nr` T)rZ r[ rW ra ri rj rt r_ r
|
r
|
r ra h s
|
|
zWrappedSocket.closeFc C sD | j ¡ }|s|S |r(tj tjj|¡S d| ¡ jffft|dS )NÚ
|
commonName)ÚsubjectÚsubjectAltName) rW Zget_peer_certificateri ZcryptoZdump_certificateZ FILETYPE_ASN1Z get_subjectZCNrT )r\ Ú binary_formr r
|
r
|
r Ú getpeercertr s
|
þzWrappedSocket.getpeercertc C s
|
| j ¡ S r )rW Zget_protocol_version_namer_ r
|
r
|
r Úversion s zWrappedSocket.versionc C s | j d7 _ d S ©Nr` )rZ r_ r
|
r
|
r Ú_reuse s zWrappedSocket._reusec C s& | j dk r| ¡ n| j d8 _ d S r )rZ ra r_ r
|
r
|
r Ú_drop s
|
|
zWrappedSocket._dropN)T)F)r r r Ú__doc__r] r^ rb rh ry rz r} r r ra r r r r r
|
r
|
r
|
r rU s
|
|
|
rU rd c C s | j d7 _ t| ||ddS )Nr` T)ra )rZ r )r\ ÚmodeÚbufsizer
|
r
|
r Úmakefile s r c @ sz e Zd ZdZdd Zedd Zejdd Zedd Zejd d Zd
|
d Z d d Z
|
dddZ dddZ dddZ dS )r" zÂ
|
I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
|
for translating the interface of the standard library ``SSLContext`` object
|
to calls into PyOpenSSL.
|
c C s* t | | _tj | j¡| _d| _d| _d S rV )Ú_openssl_versionsÚprotocolri rj ÚContextÚ_ctxÚ_optionsÚcheck_hostname)r\ r r
|
r
|
r r] ¡ s
|
zPyOpenSSLContext.__init__c C s | j S r )r r_ r
|
r
|
r Úoptions§ s zPyOpenSSLContext.optionsc C s || _ | j |¡ d S r )r r Z set_options©r\ rJ r
|
r
|
r r « s c C s t | j ¡ S r )Ú_openssl_to_stdlib_verifyr Zget_verify_moder_ r
|
r
|
r Ú verify_mode° s z PyOpenSSLContext.verify_modec C s | j t| t¡ d S r )r Z
|
set_verifyÚ_stdlib_to_openssl_verifyÚ_verify_callbackr r
|
r
|
r r ´ s c C s | j ¡ d S r )r Úset_default_verify_pathsr_ r
|
r
|
r r ¸ s z)PyOpenSSLContext.set_default_verify_pathsc C s& t |tjr| d¡}| j |¡ d S )Nr= )Ú
|
isinstancer Ú text_typer5 r Zset_cipher_list)r\ Úciphersr
|
r
|
r Ú set_ciphers» s
|
z PyOpenSSLContext.set_ciphersNc
|
C s |d k r| d¡}|d k r$| d¡}z*| j ||¡ |d k rL| j t|¡ W n4 tjjk
|
r } zt d| ¡W 5 d }~X Y nX d S )Nr= z'unable to load trusted certificates: %r) r5 r Úload_verify_locationsr ri rj rt ru rv )r\ ÚcafileÚcapathÚcadatarR r
|
r
|
r r¢ À s
|
|
z&PyOpenSSLContext.load_verify_locationsc sR | j |¡ d k r>t tjs* d¡ | j fdd¡ | j |pJ|¡ d S )Nr= c s S r r
|
)Ú_©Úpasswordr
|
r Ú<lambda>Ñ re z2PyOpenSSLContext.load_cert_chain.<locals>.<lambda>)r Zuse_certificate_chain_filer r Ú binary_typer5 Z set_passwd_cbZuse_privatekey_file)r\ ÚcertfileÚkeyfiler¨ r
|
r§ r Úload_cert_chainÌ s
|
z PyOpenSSLContext.load_cert_chainFTc
|
C s t j | j|¡}t|tjr&| d¡}|d k r8| |¡ | ¡ z |
|
¡ W q¸ t jj k
|
r t || ¡ ¡sxtdY q@Y q¸ t jjk
|
r² } zt d| ¡W 5 d }~X Y q¸X q¸q@t||S )Nr= zselect timed outzbad handshake: %r)ri rj Ú
|
Connectionr r r r r5 Zset_tlsext_host_nameZset_connect_stateÚ do_handshakerq r rr rs r rt ru rv rU )r\ ÚsockÚ server_sideÚdo_handshake_on_connectrY Úserver_hostnameÚcnxrR r
|
r
|
r Ú wrap_socketÔ s
|
|
z PyOpenSSLContext.wrap_socket)NNN)NN)FTTN)r r r r r] Úpropertyr Úsetterr r r¡ r¢ r rµ r
|
r
|
r
|
r r" s&
|
|
|
|
|
|
úr" c C s |dkS r~ r
|
)r´ r Zerr_noZ err_depthZ return_coder
|
r
|
r r ô s r )rd )Kr Ú
|
__future__r Z OpenSSL.SSLri Z cryptographyr Z$cryptography.hazmat.backends.opensslr rH Z)cryptography.hazmat.backends.openssl.x509r Zcryptography.x509r r. Ú ExceptionrX r r rm Úior r Zpackages.backports.makefiler Úloggingru Úpackagesr r> Ú r Ú__all__r% Ú PROTOCOL_TLSrj Z SSLv23_METHODÚPROTOCOL_TLSv1Z TLSv1_METHODr rG r r r r r r Ú CERT_NONEZ VERIFY_NONEÚ CERT_OPTIONALZ VERIFY_PEERÚ CERT_REQUIREDZVERIFY_FAIL_IF_NO_PEER_CERTr ÚdictÚitemsr r r( r$ r# r' Ú getLoggerr rL r r r! rA rT ÚobjectrU r r" r r
|
r
|
r
|
r Ú<module> sz + þ ÿý
|
+6 Z
|
