U
|
ý°dI
ã
|
@ s U d Z ddlmZ ddlZddlZddlZddlZddlZddl Z ddl
|
Z
|
ddl Z ddl Z ddl Z ddlZddlZddl m Z ddlmZ ddlmZmZ dd lmZmZmZmZmZm Z m Z ej d
|
e dd e j ràdd l!m"Z" d dgZ#ej$j%Z&e '¡ Z(de)d< e *¡ Z+dZ,ej$j-ej.ej/fej$j0ej.ej/fiZ1e2e
|
drNej3ej3fe1e
|
j4< e2e
|
drlej5ej5fe1e
|
j6< e2e
|
drej.ej.fe1e
|
j7< e2e
|
dr¨ej8ej8fe1e
|
j9< e2e
|
drÆej/ej/fe1e
|
j:< e
|
j;j<ej.e
|
j;j=ej.e
|
j;j>ej8e
|
j;j?ej/e
|
j;j@ej/iZAde)d< dddd ZBddd dZCd d d d d d d!ZDd d d d d d"d#ZEe FeD¡ZGe HeE¡ZIG d$d% d%ZJd1d'd(d)d*d*d+d,d-d.ZKeKeJ_KG d/d0 d0ZLdS )2aÛ
|
SecureTranport support for urllib3 via ctypes.
|
|
This makes platform-native TLS available to urllib3 users on macOS without the
|
use of a compiler. This is an important feature because the Python Package
|
Index is moving to become a TLSv1.2-or-higher server, and the default OpenSSL
|
that ships with macOS is not capable of doing TLSv1.2. The only way to resolve
|
this is to give macOS users an alternative solution to the problem, and that
|
solution is to use SecureTransport.
|
|
We use ctypes here because this solution must not require a compiler. That's
|
because pip is not allowed to require a compiler either.
|
|
This is not intended to be a seriously long-term solution to this problem.
|
The hope is that PEP 543 will eventually solve this issue for us, at which
|
point we can retire this contrib module. But in the short term, we need to
|
solve the impending tire fire that is Python on Mac without this kind of
|
contrib module. So...here we are.
|
|
To use this module, simply import and inject it::
|
|
import urllib3.contrib.securetransport
|
urllib3.contrib.securetransport.inject_into_urllib3()
|
|
Happy TLSing!
|
|
This code is a bastardised version of the code found in Will Bond's oscrypto
|
library. An enormous debt is owed to him for blazing this trail for us. For
|
that reason, this code should be considered to be covered both by urllib3's
|
license and by oscrypto's:
|
|
.. code-block::
|
|
Copyright (c) 2015-2016 Will Bond <will@wbond.net>
|
|
Permission is hereby granted, free of charge, to any person obtaining a
|
copy of this software and associated documentation files (the "Software"),
|
to deal in the Software without restriction, including without limitation
|
the rights to use, copy, modify, merge, publish, distribute, sublicense,
|
and/or sell copies of the Software, and to permit persons to whom the
|
Software is furnished to do so, subject to the following conditions:
|
|
The above copyright notice and this permission notice shall be included in
|
all copies or substantial portions of the Software.
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
|
DEALINGS IN THE SOFTWARE.
|
é )Ú annotationsN)Úsocketé )Úutilé )ÚCoreFoundationÚSecurity)Ú SecurityConstÚ_assert_no_errorÚ_build_tls_unknown_ca_alertÚ_cert_array_from_pemÚ_create_cfstring_arrayÚ_load_client_cert_chainÚ_temporary_keychainz¥'urllib3.contrib.securetransport' module is deprecated and will be removed in urllib3 v2.1.0. Read more in this issue: https://github.com/urllib3/urllib3/issues/2681)ÚcategoryÚ
|
stacklevel)ÚLiteralÚinject_into_urllib3Úextract_from_urllib3z/weakref.WeakValueDictionary[int, WrappedSocket]Ú_connection_refsi @ ÚPROTOCOL_SSLv2ÚPROTOCOL_SSLv3ÚPROTOCOL_TLSv1ÚPROTOCOL_TLSv1_1ÚPROTOCOL_TLSv1_2zdict[int, int]Ú_tls_version_to_stÚNone©Úreturnc C s t t_t tj_dt_dtj_dS )zG
|
Monkey-patch urllib3 with SecureTransport-backed SSL-support.
|
TN)ÚSecureTransportContextr Ú
|
SSLContextÚssl_ÚIS_SECURETRANSPORT© r# r# úVd:\z\workplace\vscode\pyvenv\venv\Lib\site-packages\urllib3/contrib/securetransport.pyr s c C s t t_t tj_dt_dtj_dS )z>
|
Undo monkey-patching by :func:`inject_into_urllib3`.
|
FN)Úorig_util_SSLContextr r r! r" r# r# r# r$ r · s ÚintÚ bytearray)Ú connection_idÚ data_bufferÚdata_length_pointerr c
|
C s d}zFt | ¡}|dkr"tjW S |j}|d }| ¡ }d}d}zz||k r¸|dksZ|dkrrt ||¡srtt j
|
d|| } t j | || ¡}
|
| |
|
| ¡} || 7 }| sB|s¸tjW W S q¸qBW nr tk
|
r, } zR| j }|dk r |t j
|
kr ||d< |t jks
|
|t jkrtj W Y ¢
|
W S W 5 d} ~ X Y nX ||d< ||krHtjW S W dS tk
|
r } z |dk rp| |_tj W Y ¢S d} ~ X Y nX dS )zs
|
SecureTransport read callback. This is called by ST to request that data
|
be returned from the socket.
|
Nr ú timed out)r Úgetr ÚerrSSLInternalr Ú
|
gettimeoutr Ú wait_for_readÚOSErrorÚerrnoÚEAGAINÚctypesÚc_charÚ from_addressÚ recv_intoÚerrSSLClosedGracefulÚ
|
ECONNRESETÚEPIPEÚerrSSLClosedAbortÚerrSSLWouldBlockÚ ExceptionÚ
|
_exception) r( r) r* Úwrapped_socketÚ base_socketZrequested_lengthÚtimeoutÚerrorZ
|
read_countÚ remainingÚbufferÚ
|
chunk_sizeÚer# r# r$ Ú_read_callbackÁ sP
|
|
ÿ
|
|
|
rF c
|
C sn d}z$t | ¡}|dkr"tjW S |j}|d }t ||¡}| ¡ }d}d} zT| |k r|dksf|dkr~t ||¡s~t
|
t j d| |¡}
|
| |
|
7 } ||
|
d
}qNW nj t
|
k
|
r
|
} zJ| j }|dk rú|t j krú| |d< |t jksè|t jkrøtj W Y ¢
|
W S W 5 d} ~ X Y nX | |d< | |kr&tjW S W dS tk
|
rh } z |dk rN| |_tj W Y ¢S d} ~ X Y nX dS )zx
|
SecureTransport write callback. This is called by ST to request that data
|
actually be sent on the network.
|
Nr r+ )r r, r r- r r3 Ú string_atr. r Úwait_for_writer0 r1 r2 Úsendr8 r9 r: r; r< r= ) r( r) r* r> r? Zbytes_to_writeÚdatar@ rA ÚsentZ
|
chunk_sentrE r# r# r$ Ú_write_callbackú sD
|
|
|
|
rL c @ sN e Zd ZdZdddddZejddd d
|
Zd dd d dZddddddZ dddddZ
|
ddddddddd dd
|
d d Z ddd d Z ddd!d"Z ddd#d$d%ZdEd'd(dd)d*d+Zd,dd-d.d/Zd0dd1d2Zddd3d4d5Zddd3d6d7Zddd8d9Zddd:d;Zddd<d=ZdFddd?d@dAZdBddCdDZd&S )GÚ WrappedSocketzO
|
API-compatibility wrapper for Python's OpenSSL wrapped socket object.
|
Ú
|
socket_clsr )r r c C sR || _ d | _d| _d| _d| _d | _d | _d | _d | _| j ¡ | _
|
| j d¡ d S ©Nr F) r ÚcontextÚ_io_refsÚ_closedÚ _real_closedr= Ú _keychainÚ _keychain_dirÚ_client_cert_chainr. Ú_timeoutÚ
|
settimeout)Úselfr r# r# r$ Ú__init__; s zWrappedSocket.__init__z$typing.Generator[(None, None, None)]r c c s4 d| _ dV | j dk r0| j d }| _ | ¡ |dS )a]
|
A context manager that can be used to wrap calls that do I/O from
|
SecureTransport. If any of the I/O callbacks hit an exception, this
|
context manager will correctly propagate the exception after the fact.
|
This avoids silently swallowing those exceptions.
|
|
It also correctly forces the socket closed.
|
N)r= Ú _real_close)rY Ú exceptionr# r# r$ Ú_raise_on_errorN s
|
|
z WrappedSocket._raise_on_errorzlist[bytes] | None©Ú protocolsr c C s< |sdS t |}zt | j|¡}t| W 5 t |¡ X dS )z<
|
Sets up the ALPN protocols on the context.
|
N)r r Ú CFReleaser ÚSSLSetALPNProtocolsrP r
|
)rY r_ Z protocols_arrÚresultr# r# r$ Ú_set_alpn_protocolsc s z!WrappedSocket._set_alpn_protocolsÚboolú bytes | None)ÚverifyÚ trust_bundler c
|
|
C sÔ |r |dkrdS t jt jf}z.| |¡}||kr6W dS dt| }d}W n0 tk
|
rz } zd|}|}W 5 d}~X Y nX t| ¡ }| j |¡ t
|
ddd¡} | j tj tj| ¡ | ¡ t d| ¡|dS )zþ
|
Called when we have set custom validation. We do this in two cases:
|
first, when cert validation is entirely disabled; and second, when
|
using a custom trust DB.
|
Raises an SSLError if the connection is not trusted.
|
Nz error code: z exception: Úiir r zcertificate verify failed, )r ZkSecTrustResultUnspecifiedZkSecTrustResultProceedÚ_evaluate_trustr& r< r Úversionr ÚsendallÚstructÚpackÚ
|
setsockoptÚ
|
SOL_SOCKETÚ SO_LINGERr[ ÚsslÚSSLError)
|
rY rf rg Z successesÚ trust_resultÚreasonÚexcrE ZrecÚoptsr# r# r$ Ú_custom_validatep s( þ
|
|
z WrappedSocket._custom_validateÚbytesr& )rg r c C sà t j |¡r*t|d}| ¡ }W 5 Q R X d }t ¡ }zt |}t
|
| j t |¡¡}t| |sjt d¡t ||¡}t| t |d¡}t| t ¡ }t |t |¡¡}t| W 5 |rÆt |¡ |d k rØt |¡ X |jS )NÚrbz Failed to copy trust referenceT)ÚosÚpathÚisfileÚopenÚreadr Ú SecTrustRefr r` r ÚSSLCopyPeerTrustrP r3 Úbyrefr
|
rq rr Z SecTrustSetAnchorCertificatesZ!SecTrustSetAnchorCertificatesOnlyZSecTrustResultTypeZSecTrustEvaluateÚvalue)rY rg ÚfZ
|
cert_arrayÚtrustrb rs r# r# r$ ri s.
|
|
z WrappedSocket._evaluate_trustúbytes | str | Noneú
|
str | Noneú
|
typing.Any)
|
Úserver_hostnamerf rg Ú min_versionÚ max_versionÚ client_certÚ
|
client_keyÚclient_key_passphraseÚalpn_protocolsr c
|
C sÈ t dtjtj¡| _t | jtt¡}
|
t |
|
t
|
0 t | d } | t krT| d d } q>| t | < W 5 Q R X t | j| ¡}
|
t |
|
|r°t|ts| d¡}t | j|t|¡}
|
t |
|
| | ¡ t | j|¡}
|
t |
|
t | j|¡}
|
t |
|
|rô|dk rt | jtjd¡}
|
t |
|
|rJt \| _| _t| j||| _ t | j| j ¡}
|
t |
|
| ¡ h t | j¡}
|
|
|
tj krxt! "d¡n>|
|
tj#kr | $||¡ W 5 Q R £ qJnt |
|
W 5 Q R £ qÄW 5 Q R X qJdS )z
|
Actually performs the TLS handshake. This is run automatically by
|
wrapped socket, and shouldn't be needed in user code.
|
Niÿÿÿr zutf-8Tzhandshake timed out)%r ZSSLCreateContextr ZkSSLClientSideZkSSLStreamTyperP Z SSLSetIOFuncsÚ_read_callback_pointerÚ_write_callback_pointerr
|
Ú_connection_ref_lockÚidr ZSSLSetConnectionÚ
|
isinstancerx ÚencodeZSSLSetPeerDomainNameÚlenrc ZSSLSetProtocolVersionMinZSSLSetProtocolVersionMaxZSSLSetSessionOptionZ"kSSLSessionOptionBreakOnServerAuthr rT rU r rV ZSSLSetCertificater] Z SSLHandshaker; r r@ ZerrSSLServerAuthCompletedrw ) rY r rf rg r r r r r r rb Úhandler# r# r$ Ú handshake½ sr ÿ ÿ
|
|
ÿ
|
ÿ ÿ
|
zWrappedSocket.handshakec C s
|
| j ¡ S ©N)r Úfileno©rY r# r# r$ r s zWrappedSocket.filenoc C s* | j dkr| j d8 _ | jr&| ¡ d S )Nr r )rQ rR Úcloser r# r# r$ Ú_decref_socketios s
|
z WrappedSocket._decref_socketios)Úbufsizr c C s. t |¡}| ||¡}|d |
}t t|¡S r )r3 Úcreate_string_bufferr6 ÚtypingÚcastrx )rY r rC Ú
|
bytes_readrJ r# r# r$ Úrecv# s
|
zWrappedSocket.recvNzctypes.Array[ctypes.c_char]ú
|
int | None)rC Únbytesr c C s¨ | j r
|
dS |d krt|}tj| |¡}t d¡}| ¡ t | j ||t
|
|¡¡}W 5 Q R X |t j kr|j dkr¢t d¡n"|t jt jfkr| ¡ nt| |j S )Nr zrecv timed out)rS r r3 r4 Ú from_bufferÚc_size_tr] r ZSSLReadrP r r r; r r r@ r7 ZerrSSLClosedNoNotifyr[ r
|
)rY rC r¤ Úprocessed_bytesrb r# r# r$ r6 ) s.
|
|
ÿ
|
|
þ
|
zWrappedSocket.recv_intoÚfloat)r@ r c C s
|
|| _ d S r ©rW )rY r@ r# r# r$ rX V s zWrappedSocket.settimeoutz float | Nonec C s | j S r r© r r# r# r$ r. Y s zWrappedSocket.gettimeout)rJ r c C sh t d¡}| ¡ " t | j|t|t |¡¡}W 5 Q R X |tj krZ|j
|
dkrZt d¡nt | |j
|
S )Nr zsend timed out)r3 r¦ r] r ZSSLWriterP r r r r; r r r@ r
|
)rY rJ r§ rb r# r# r$ rI \ s
|
|
ÿ zWrappedSocket.sendc C s4 d}|t |k r0| |||t
¡}||7 }qd S ©Nr )r rI ÚSSL_WRITE_BLOCKSIZE)rY rJ Ú
|
total_sentrK r# r# r$ rk m s zWrappedSocket.sendallc C s$ | ¡ t | j¡ W 5 Q R X d S r )r] r ZSSLCloserP r r# r# r$ Úshutdowns s
|
zWrappedSocket.shutdownc C s d| _ | jdkr| ¡ d S )NTr )rR rQ r[ r r# r# r$ r w s
|
zWrappedSocket.closec C sv d| _ | jr t | j¡ d | _| jr6t | j¡ d | _| jrlt | j¡ t | j¡ t | j
|
¡ d | _| _
|
| j ¡ S )NT) rS rP r r` rV rT r ZSecKeychainDeleteÚshutilÚrmtreerU r r r r# r# r$ r[ } s zWrappedSocket._real_closeF)Ú binary_formr c
|
C sÈ |s t dt ¡ }d }d }zt | jt |¡¡}t | |sFW ¢dd S t
|
|¡}|s\W ¢Nd S t |d¡}|spt t |¡}|st t |¡}t |¡} t | |¡}W 5 |r´t |¡ |rÂt |¡ X |S )Nz2SecureTransport only supports dumping binary certsr )Ú
|
ValueErrorr r r r` r rP r3 r r
|
ZSecTrustGetCertificateCountZ SecTrustGetCertificateAtIndexÚAssertionErrorZSecCertificateCopyDataZCFDataGetLengthZCFDataGetBytePtrrG )
|
rY r° r ZcertdataZ der_bytesrb Z
|
cert_countZleafZ data_lengthr) r# r# r$ Ú getpeercert s2
|
|
|
|
|
zWrappedSocket.getpeercertÚstrc C s t ¡ }t | jt |¡¡}t| |jtj kr<t
|
d¡n`|jtj krLdS |jtj kr\dS |jtjkrldS |jtjkr|dS |jtjkrdS t
|
d|¡d S )Nz(SecureTransport does not support TLS 1.3zTLSv1.2zTLSv1.1ÚTLSv1ÚSSLv3ZSSLv2zUnknown TLS version: )r Z SSLProtocolZ SSLGetNegotiatedProtocolVersionrP r3 r r
|
r r ZkTLSProtocol13rq rr ÚkTLSProtocol12ÚkTLSProtocol11Ú kTLSProtocol1Ú kSSLProtocol3Ú kSSLProtocol2)rY Úprotocolrb r# r# r$ rj Æ s& ÿ zWrappedSocket.version)N)F)Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__rZ Ú
|
contextlibÚcontextmanagerr] rc rw ri r r r r¢ r6 rX r. rI rk r r r[ r³ rj r# r# r# r$ rM 6 s, %( \ ÿ-:rM ÚrrN zILiteral['r'] | Literal['w'] | Literal['rw'] | Literal['wr'] | Literal['']r£ r z typing.BinaryIO | typing.TextIO)rY ÚmodeÚ bufferingÚargsÚkwargsr c O s d}t j| ||f||S rª )rN Úmakefile)rY rÄ rÅ rÆ rÇ r# r# r$ rÈ Ü s rÈ c @ sj e Zd ZdZdddddZeddd d
|
Zejd dd d d
|
ZeddddZejddd ddZeddddZ e jddd ddZ ddddZ
|
ddddZ d ddddZ d:d d d dd d d Z d;d!d d dd"d#d$Zd%dd&d'd(Zd<d+d,d,d,d-d.d/d0d1Zeddd2d3Zejddd4d5d3Zeddd6d7Zejddd8d9d7ZdS )=r z¯
|
I am a wrapper class for the SecureTransport library, to translate the
|
interface of the standard library ``SSLContext`` object to calls into
|
SecureTransport.
|
r& r )r¼ r c C sd t jj| _t jj| _|d t jt jfkr6t| \| _ | _
|
d| _ d| _ d | _ d | _d | _d | _d | _d S rO )rq Ú
|
TLSVersionÚMINIMUM_SUPPORTEDÚ_minimum_versionÚMAXIMUM_SUPPORTEDÚ_maximum_versionÚ PROTOCOL_TLSÚPROTOCOL_TLS_CLIENTÚ_protocol_to_min_maxZ _min_versionZ _max_versionÚ_optionsÚ_verifyÚ _trust_bundleÚ _client_certÚ _client_keyÚ_client_key_passphraseÚ_alpn_protocols)rY r¼ r# r# r$ rZ õ s
|
|
z SecureTransportContext.__init__z Literal[True]r c C s dS )ú
|
SecureTransport cannot have its hostname checking disabled. For more,
|
see the comment on getpeercert() in this file.
|
Tr# r r# r# r$ Úcheck_hostname s z%SecureTransportContext.check_hostnamer )r r c C s dS )rØ Nr# ©rY r r# r# r$ rÙ s c C s | j S r ©rÑ r r# r# r$ Úoptions s z SecureTransportContext.optionsc C s
|
|| _ d S r rÛ rÚ r# r# r$ rÜ s c C s | j r tjS tjS r )rÒ rq Ú CERT_REQUIREDÚ CERT_NONEr r# r# r$ Ú verify_mode! s z"SecureTransportContext.verify_modec C s |t jk| _d S r )rq rÝ rÒ rÚ r# r# r$ rß % s c C s d S r r# r r# r# r$ Úset_default_verify_paths) s
|
z/SecureTransportContext.set_default_verify_pathsc C s | ¡ S r )rà r r# r# r$ Úload_default_certs5 s z)SecureTransportContext.load_default_certs)Úciphersr c C s t dd S )Nz5SecureTransport doesn't support custom cipher strings)r± )rY râ r# r# r$ Ú set_ciphers8 s z"SecureTransportContext.set_ciphersNr re )ÚcafileÚcapathÚcadatar c C s: |d k rt d|d k r,t| W 5 Q R X |p2|| _d S )Nz1SecureTransport does not support cert directories)r± r} rÓ )rY rä rå ræ r# r# r$ Úload_verify_locations; s
|
|
z,SecureTransportContext.load_verify_locationsr´ )ÚcertfileÚkeyfileÚpasswordr c C s || _ || _|| _d S r )rÔ rÕ Z_client_cert_passphrase)rY rè ré rê r# r# r$ Úload_cert_chainL s z&SecureTransportContext.load_cert_chainzlist[str | bytes]r^ c C s& t tdstddd |D | _dS )z
|
Sets the ALPN protocols that will later be set on the context.
|
|
Raises a NotImplementedError if ALPN is not supported.
|
ra z2SecureTransport supports ALPN only in macOS 10.12+c S s g | ]}t j |d ¡qS )Úascii)r Úto_bytes)Ú.0Úpr# r# r$ Ú
|
<listcomp>` s z=SecureTransportContext.set_alpn_protocols.<locals>.<listcomp>N)Úhasattrr ÚNotImplementedErrorr× )rY r_ r# r# r$ Úset_alpn_protocolsV s
|
|
ÿz)SecureTransportContext.set_alpn_protocolsFTrN rd r
rM )ÚsockÚ server_sideÚdo_handshake_on_connectÚsuppress_ragged_eofsr r c C sV |rt |st |st t|}| || j| jt| j t| j | j| j | j
|
| j ¡ |S r ) r² rM r rÒ rÓ r rË rÍ rÔ rÕ rÖ r× )rY rô rõ rö r÷ r r> r# r# r$ Ú wrap_socketb s ÷ z"SecureTransportContext.wrap_socketc C s | j S r ©rË r r# r# r$ Úminimum_version s z&SecureTransportContext.minimum_version)rú r c C s
|
|| _ d S r rù )rY rú r# r# r$ rú s c C s | j S r ©rÍ r r# r# r$ Úmaximum_version s z&SecureTransportContext.maximum_version)rü r c C s
|
|| _ d S r rû )rY rü r# r# r$ rü s )NNN)NN)FTTN)r½ r¾ r¿ rÀ rZ ÚpropertyrÙ ÚsetterrÜ rß rà rá rã rç rë ró rø rú rü r# r# r# r$ r î sL ü ü
|
ú!r )rà N)MrÀ Ú
|
__future__r rÁ r3 r1 Úos.pathrz r® r rq rl Ú threadingr ÚwarningsÚweakrefrN Ú r Z_securetransport.bindingsr r Z_securetransport.low_levelr r
|
r r r r r ÚwarnÚDeprecationWarningÚ TYPE_CHECKINGZtyping_extensionsr Ú__all__r! r r% ÚWeakValueDictionaryr Ú__annotations__ÚLockr r« rÎ r¹ r· rÏ rÐ rñ r» r rº r r r¸ r r rÉ rÊ rµ ÚTLSv1_1ÚTLSv1_2rÌ r r r rF rL Z SSLReadFuncr Z SSLWriteFuncr rM rÈ r r# r# r# r$ Ú<module> s¦ 6 $
|
û þ
|
|
þþ þ
|
þ
|
þ
|
þ
|
þ
|
û
|
|
98
|
|
- û
|
