U
|
I=®d~ ã @ s d Z ddlmZ ddlZddlZddlZddlZddlZddl Z ddl
|
Z
|
ddl Z ddl Z ddl mZ ddlmZmZmZ ddlmZmZmZmZ zdd l mZ W n$ ek
|
rÄ dZdd
|
lmZ Y nX d d gZ d Z ej Z ej j Z!e "¡ Z#e $¡ Z%dZ&ej'ej(ej)ej*ej+ej,ej-ej.ej/ej0ej1ej2ej3ej4ej5ej6ej7ej8ej9ej:ej;ej<ej=ej>ej?ej@ejAejBejCejDg ZEejFejGejHfiZIeJe
|
dr ejKejKfeIe
|
jL< eJe
|
dr¾ejMejMfeIe
|
jN< eJe
|
drÜejGejGfeIe
|
jO< eJe
|
drúejPejPfeIe
|
jQ< eJe
|
drejHejHfeIe
|
jR< dd ZSdd ZTdd ZUdd ZVe WeU¡ZXe YeV¡ZZG dd de[Z\ernd#d d Z]n
|
d$d d Z]e]e\_]G d!d" d"e[Z^dS )%aÊ
|
SecureTranport support for urllib3 via ctypes.
|
|
This makes platform-native TLS available to urllib3 users on macOS without the
|
use of a compiler. This is an important feature because the Python Package
|
Index is moving to become a TLSv1.2-or-higher server, and the default OpenSSL
|
that ships with macOS is not capable of doing TLSv1.2. The only way to resolve
|
this is to give macOS users an alternative solution to the problem, and that
|
solution is to use SecureTransport.
|
|
We use ctypes here because this solution must not require a compiler. That's
|
because pip is not allowed to require a compiler either.
|
|
This is not intended to be a seriously long-term solution to this problem.
|
The hope is that PEP 543 will eventually solve this issue for us, at which
|
point we can retire this contrib module. But in the short term, we need to
|
solve the impending tire fire that is Python on Mac without this kind of
|
contrib module. So...here we are.
|
|
To use this module, simply import and inject it::
|
|
import urllib3.contrib.securetransport
|
urllib3.contrib.securetransport.inject_into_urllib3()
|
|
Happy TLSing!
|
|
This code is a bastardised version of the code found in Will Bond's oscrypto
|
library. An enormous debt is owed to him for blazing this trail for us. For
|
that reason, this code should be considered to be covered both by urllib3's
|
license and by oscrypto's:
|
|
Copyright (c) 2015-2016 Will Bond <will@wbond.net>
|
|
Permission is hereby granted, free of charge, to any person obtaining a
|
copy of this software and associated documentation files (the "Software"),
|
to deal in the Software without restriction, including without limitation
|
the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
and/or sell copies of the Software, and to permit persons to whom the
|
Software is furnished to do so, subject to the following conditions:
|
|
The above copyright notice and this permission notice shall be included in
|
all copies or substantial portions of the Software.
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
DEALINGS IN THE SOFTWARE.
|
é )Úabsolute_importNé )Úutilé )ÚSecurityÚ SecurityConstÚCoreFoundation)Ú_assert_no_errorÚ_cert_array_from_pemÚ_temporary_keychainÚ_load_client_cert_chain)Ú _fileobject©Úbackport_makefileÚinject_into_urllib3Úextract_from_urllib3Ti @ ÚPROTOCOL_SSLv2ÚPROTOCOL_SSLv3ÚPROTOCOL_TLSv1ÚPROTOCOL_TLSv1_1ÚPROTOCOL_TLSv1_2c C s. t t_t tj_tt_ttj_dt_dtj_dS )zG
|
Monkey-patch urllib3 with SecureTransport-backed SSL-support.
|
TN)ÚSecureTransportContextr Ú
|
SSLContextÚssl_ÚHAS_SNIÚIS_SECURETRANSPORT© r r úbD:\z\workplace\VsCode\pyvenv\venv\Lib\site-packages\pip/_vendor/urllib3/contrib/securetransport.pyr ´ s c C s. t t_t tj_tt_ttj_dt_dtj_dS )z>
|
Undo monkey-patching by :func:`inject_into_urllib3`.
|
FN)Úorig_util_SSLContextr r r Úorig_util_HAS_SNIr r r r r r r À s c
|
C s d}zJt | ¡}|dkr"tjW S |j}|d }| ¡ }d}d}z|||k rº|dksZ|dkrtt ||¡stt t j
|
d¡|| } t j | || ¡}
|
| |
|
| ¡} || 7 }| sB|sºtjW W S qºqBW nt tjk
|
r0 } zR| j }|dk r |t j
|
kr ||d< |t jks|t jkr tj W Y ¢
|
W S W 5 d} ~ X Y nX ||d< ||krLtjW S W dS tk
|
r } z |dk rt| |_tj W Y ¢S d} ~ X Y nX dS )zs
|
SecureTransport read callback. This is called by ST to request that data
|
be returned from the socket.
|
Nr ú timed out)Ú_connection_refsÚgetr ÚerrSSLInternalÚsocketÚ
|
gettimeoutr Ú wait_for_readÚerrorÚerrnoÚEAGAINÚctypesÚc_charÚ from_addressÚ recv_intoÚerrSSLClosedGracefulÚ
|
ECONNRESETÚEPIPEÚerrSSLClosedAbortÚerrSSLWouldBlockÚ ExceptionÚ
|
_exception) Ú connection_idÚ data_bufferÚdata_length_pointerÚwrapped_socketÚ base_socketZrequested_lengthÚtimeoutr' Z
|
read_countÚ remainingÚbufferÚ
|
chunk_sizeÚer r r Ú_read_callbackÌ sP
|
|
ÿ
|
|
|
r? c
|
C sr d}z(t | ¡}|dkr"tjW S |j}|d }t ||¡}| ¡ }d}d} zV| |k r |dksf|dkrt ||¡st
|
t j d¡| |¡}
|
| |
|
7 } ||
|
d
}qNW nl tj
|
k
|
r } zJ| j }|dk rþ|t j krþ| |d< |t jksì|t jkrütj W Y ¢
|
W S W 5 d} ~ X Y nX | |d< | |kr*tjW S W dS tk
|
rl } z |dk rR| |_tj W Y ¢S d} ~ X Y nX dS )zx
|
SecureTransport write callback. This is called by ST to request that data
|
actually be sent on the network.
|
Nr r )r! r" r r# r$ r* Ú string_atr% r Úwait_for_writer' r( r) Úsendr/ r0 r1 r2 r3 r4 ) r5 r6 r7 r8 r9 Zbytes_to_writeÚdatar: r' ÚsentZ
|
chunk_sentr> r r r Ú_write_callback sD
|
|
|
|
rE c @ s² e Zd ZdZdd Zejdd Zdd Zdd Z d
|
d Z
|
d d Z dd Z dd Z d*ddZdd Zdd Zdd Zdd Zd d Zd d Zd+d"d#Zd$d% Zd&d' Zd(d) ZdS ),Ú WrappedSocketz²
|
API-compatibility wrapper for Python's OpenSSL wrapped socket object.
|
|
Note: _makefile_refs, _drop(), and _reuse() are needed for the garbage
|
collector of PyPy.
|
c C sL || _ d | _d| _d| _d | _d | _d | _d | _| j ¡ | _ | j
|
d¡ d S ©Nr F) r$ ÚcontextÚ_makefile_refsÚ_closedr4 Ú _keychainÚ _keychain_dirÚ_client_cert_chainr% Ú_timeoutÚ
|
settimeout)Úselfr$ r r r Ú__init__E s zWrappedSocket.__init__c c s4 d| _ dV | j dk r0| j d }| _ | ¡ |dS )a]
|
A context manager that can be used to wrap calls that do I/O from
|
SecureTransport. If any of the I/O callbacks hit an exception, this
|
context manager will correctly propagate the exception after the fact.
|
This avoids silently swallowing those exceptions.
|
|
It also correctly forces the socket closed.
|
N)r4 Úclose)rP Ú exceptionr r r Ú_raise_on_errorW s
|
|
z WrappedSocket._raise_on_errorc C s2 t jtt t }t | j|tt¡}t| dS )a4
|
Sets up the allowed ciphers. By default this matches the set in
|
util.ssl_.DEFAULT_CIPHERS, at least as supported by macOS. This is done
|
custom and doesn't allow changing at this time, mostly because parsing
|
OpenSSL cipher strings is going to be a freaking nightmare.
|
N)r ZSSLCipherSuiteÚlenÚ CIPHER_SUITESZSSLSetEnabledCiphersrH r )rP ÚciphersÚresultr r r Ú _set_ciphersl s ÿzWrappedSocket._set_ciphersc C s |sdS t j |¡r2t|d}| ¡ }W 5 Q R X d}t ¡ }zt |}t
|
| j t |¡¡}t| |srt d¡t ||¡}t| t |d¡}t| t ¡ }t |t |¡¡}t| W 5 |rÎt |¡ |dk ràt |¡ X tjtjf}|j|kr
|
t d|j ¡dS )zÁ
|
Called when we have set custom validation. We do this in two cases:
|
first, when cert validation is entirely disabled; and second, when
|
using a custom trust DB.
|
NÚrbz Failed to copy trust referenceTz)certificate verify failed, error code: %d)ÚosÚpathÚisfileÚopenÚreadr Ú SecTrustRefr Ú CFReleaser
|
ÚSSLCopyPeerTrustrH r* Úbyrefr ÚsslÚSSLErrorZ SecTrustSetAnchorCertificatesZ!SecTrustSetAnchorCertificatesOnlyZSecTrustResultTypeZSecTrustEvaluater ZkSecTrustResultUnspecifiedZkSecTrustResultProceedÚvalue) rP ÚverifyÚ trust_bundleÚfZ
|
cert_arrayÚtrustrX Z trust_resultZ successesr r r Ú_custom_validatey s>
|
|
þ ÿz WrappedSocket._custom_validatec C sÆ t dtjtj¡| _t | jtt¡} t | t
|
0 t | d }
|
|
|
t krT|
|
d d }
|
q>| t |
|
< W 5 Q R X t | j|
|
¡} t | |r°t|ts| d¡}t | j|t|¡} t | | ¡ t | j|¡} t | t | j|¡} t | |rò|dk r t | jtjd¡} t | |rHt \| _| _t| j||| _ t | j| j ¡} t | | ¡ h t | j¡} | tj krvt! "d¡n>| tj#kr| $||¡ W 5 Q R £ qHnt | W 5 Q R £ qÂW 5 Q R X qHdS )z
|
Actually performs the TLS handshake. This is run automatically by
|
wrapped socket, and shouldn't be needed in user code.
|
Niÿÿÿr zutf-8Tzhandshake timed out)%r ZSSLCreateContextr ZkSSLClientSideZkSSLStreamTyperH Z SSLSetIOFuncsÚ_read_callback_pointerÚ_write_callback_pointerr Ú_connection_ref_lockÚidr! ZSSLSetConnectionÚ
|
isinstanceÚbytesÚencodeZSSLSetPeerDomainNamerU rY ZSSLSetProtocolVersionMinZSSLSetProtocolVersionMaxZSSLSetSessionOptionZ"kSSLSessionOptionBreakOnServerAuthr rK rL r rM ZSSLSetCertificaterT Z SSLHandshaker2 r$ r: ZerrSSLServerAuthCompletedrk ) rP Úserver_hostnamerg rh Ú min_versionZ max_versionÚ client_certZ
|
client_keyZclient_key_passphraserX Úhandler r r Ú handshake² sr ÿ ÿ
|
|
ÿ ÿ ÿ
|
zWrappedSocket.handshakec C s
|
| j ¡ S ©N)r$ Úfileno©rP r r r ry s zWrappedSocket.filenoc C s* | j dkr| j d8 _ | jr&| ¡ d S )Nr r )rI rJ rR rz r r r Ú_decref_socketios s
|
z WrappedSocket._decref_socketiosc C s& t |¡}| ||¡}|d |
}|S rx )r* Úcreate_string_bufferr- )rP Zbufsizr< Ú
|
bytes_readrC r r r Úrecv s
|
zWrappedSocket.recvNc C s¨ | j r
|
dS |d krt|}tj| |¡}t d¡}| ¡ t | j ||t
|
|¡¡}W 5 Q R X |t j kr|j dkr¢t d¡n"|t jt jfkr| ¡ nt| |j S )Nr zrecv timed out)rJ rU r* r+ Ú from_bufferÚc_size_trT r ZSSLReadrH rc r r2 rf r$ r: r. ZerrSSLClosedNoNotifyrR r )rP r< ÚnbytesÚprocessed_bytesrX r r r r- s.
|
|
ÿ
|
|
þ
|
zWrappedSocket.recv_intoc C s
|
|| _ d S rx ©rN )rP r: r r r rO F s zWrappedSocket.settimeoutc C s | j S rx r rz r r r r% I s zWrappedSocket.gettimeoutc C sh t d¡}| ¡ " t | j|t|t |¡¡}W 5 Q R X |tj krZ|j
|
dkrZt d¡nt | |j
|
S )Nr zsend timed out)r* r rT r ZSSLWriterH rU rc r r2 rf r$ r: r )rP rC r rX r r r rB L s
|
|
ÿ zWrappedSocket.sendc C s4 d}|t |k r0| |||t
¡}||7 }qd S ©Nr )rU rB ÚSSL_WRITE_BLOCKSIZE)rP rC Ú
|
total_sentrD r r r Úsendall] s zWrappedSocket.sendallc C s$ | ¡ t | j¡ W 5 Q R X d S rx )rT r ZSSLCloserH rz r r r Úshutdownc s
|
zWrappedSocket.shutdownc C s | j dk rd| _| jr(t | j¡ d | _| jr@t | j¡ d | _| jrvt | j¡ t | j¡ t
|
| j ¡ d | _| _ | j ¡ S | j d8 _ d S )Nr T)rI rJ rH r ra rM rK r ZSecKeychainDeleteÚshutilÚrmtreerL r$ rR rz r r r rR g s
|
|
zWrappedSocket.closeFc
|
C sÈ |s t dt ¡ }d }d }zt | jt |¡¡}t | |sFW ¢dd S t
|
|¡}|s\W ¢Nd S t |d¡}|spt t |¡}|st t |¡}t |¡} t | |¡}W 5 |r´t |¡ |rÂt |¡ X |S )Nz2SecureTransport only supports dumping binary certsr )Ú
|
ValueErrorr r` r ra rb rH r* rc r ZSecTrustGetCertificateCountZ SecTrustGetCertificateAtIndexÚAssertionErrorZSecCertificateCopyDataZCFDataGetLengthZCFDataGetBytePtrr@ )
|
rP Ú binary_formrj ZcertdataZ der_bytesrX Z
|
cert_countZleafZ data_lengthr6 r r r Ú getpeercertz s2
|
|
|
|
|
zWrappedSocket.getpeercertc C s t ¡ }t | jt |¡¡}t| |jtj kr<t
|
d¡n^|jtj krLdS |jtj kr\dS |jtjkrldS |jtjkr|dS |jtjkrdS t
|
d| ¡d S )Nz(SecureTransport does not support TLS 1.3zTLSv1.2zTLSv1.1ÚTLSv1ÚSSLv3ZSSLv2zUnknown TLS version: %r)r Z SSLProtocolZ SSLGetNegotiatedProtocolVersionrH r* rc r rf r ZkTLSProtocol13rd re ÚkTLSProtocol12ÚkTLSProtocol11Ú kTLSProtocol1Ú kSSLProtocol3Ú kSSLProtocol2)rP ÚprotocolrX r r r Úversion´ s& ÿ zWrappedSocket.versionc C s | j d7 _ d S ©Nr )rI rz r r r Ú_reuseÉ s zWrappedSocket._reusec C s& | j dk r| ¡ n| j d8 _ d S r )rI rR rz r r r Ú_dropÌ s
|
|
zWrappedSocket._drop)N)F)Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__rQ Ú
|
contextlibÚcontextmanagerrT rY rk rw ry r{ r~ r- rO r% rB r r rR r r r r r r r r rF = s*
|
9Y
|
+
|
:rF éÿÿÿÿc C s | j d7 _ t| ||ddS )Nr T)rR )rI r )rP ÚmodeÚbufsizer r r ÚmakefileÕ s r¤ Úrc O s d}t | ||f||S r r )rP r¢ Ú bufferingÚargsÚkwargsr r r r¤ Ü s c @ s e Zd ZdZdd Zedd Zejdd Zedd Zejd d Zed
|
d Z e jd d Z d d Z
|
dd Z dd Z d ddZ d ddZd ddZdS ) r z¯
|
I am a wrapper class for the SecureTransport library, to translate the
|
interface of the standard library ``SSLContext`` object to calls into
|
SecureTransport.
|
c C s8 t | \| _| _d| _d| _d | _d | _d | _d | _d S rG ) Ú_protocol_to_min_maxÚ _min_versionÚ _max_versionÚ_optionsÚ_verifyÚ _trust_bundleÚ _client_certÚ _client_keyÚ_client_key_passphrase)rP r r r r rQ í s z SecureTransportContext.__init__c C s dS )ú
|
SecureTransport cannot have its hostname checking disabled. For more,
|
see the comment on getpeercert() in this file.
|
Tr rz r r r Úcheck_hostnameö s z%SecureTransportContext.check_hostnamec C s dS )r² Nr ©rP rf r r r r³ þ s c C s | j S rx ©r¬ rz r r r Úoptions s z SecureTransportContext.optionsc C s
|
|| _ d S rx rµ r´ r r r r¶ s c C s | j r tjS tjS rx )r rd Ú CERT_REQUIREDÚ CERT_NONErz r r r Ú verify_mode s z"SecureTransportContext.verify_modec C s |t jkrdnd| _d S )NTF)rd r· r r´ r r r r¹ s c C s d S rx r rz r r r Úset_default_verify_paths s
|
z/SecureTransportContext.set_default_verify_pathsc C s | ¡ S rx )rº rz r r r Úload_default_certs) s z)SecureTransportContext.load_default_certsc C s |t jjkrtdd S )Nz5SecureTransport doesn't support custom cipher strings)r r ÚDEFAULT_CIPHERSr )rP rW r r r Ú set_ciphers, s z"SecureTransportContext.set_ciphersNc C s: |d k rt d|d k r,t| W 5 Q R X |p2|| _d S )Nz1SecureTransport does not support cert directories)r r^ r® )rP ÚcafileÚcapathÚcadatar r r Úload_verify_locations1 s
|
|
z,SecureTransportContext.load_verify_locationsc C s || _ || _|| _d S rx )r¯ r° Z_client_cert_passphrase)rP ÚcertfileÚkeyfileÚpasswordr r r Úload_cert_chain= s z&SecureTransportContext.load_cert_chainFTc
|
C sJ |rt |st |st t|}| || j| j| j| j| j| j| j ¡ |S rx )
|
r rF rw r r® rª r« r¯ r° r± )rP ÚsockÚ server_sideÚdo_handshake_on_connectÚsuppress_ragged_eofsrs r8 r r r Ú wrap_socketB s ø
|
z"SecureTransportContext.wrap_socket)NNN)NN)FTTN)r r r r rQ Úpropertyr³ Úsetterr¶ r¹ rº r» r½ rÁ rÅ rÊ r r r r r æ s0
|
|
|
|
|
|
|
|
úr )r¡ )r¥ N)_r Ú
|
__future__r r r* r( Úos.pathr[ r r$ rd Ú threadingÚweakrefÚ r Z_securetransport.bindingsr r r Z_securetransport.low_levelr r
|
r r r Ú ImportErrorZpackages.backports.makefiler Ú__all__r r r r r ÚWeakValueDictionaryr! ÚLockrn r
Z'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384Z'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256Z%TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384Z%TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256Z-TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256Z+TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256Z#TLS_DHE_RSA_WITH_AES_256_GCM_SHA384Z#TLS_DHE_RSA_WITH_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384Z$TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAZ'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256Z$TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAZ%TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384Z"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAZ%TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256Z"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_256_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_256_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_128_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_128_CBC_SHAZTLS_AES_256_GCM_SHA384ZTLS_AES_128_GCM_SHA256Z TLS_RSA_WITH_AES_256_GCM_SHA384Z TLS_RSA_WITH_AES_128_GCM_SHA256ZTLS_AES_128_CCM_8_SHA256ZTLS_AES_128_CCM_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHA256Z TLS_RSA_WITH_AES_128_CBC_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHAZ TLS_RSA_WITH_AES_128_CBC_SHArV Ú PROTOCOL_TLSr r r© Úhasattrr r r r r r r r r r r? rE Z SSLReadFuncrl Z SSLWriteFuncrm ÚobjectrF r¤ r r r r r Ú<module> s¼ 3 â%
|
ÿ þ
|
þ
|
þ
|
þ
|
þ
|
76
|
|
|
|
