a d2 @sdZddlZddlZddlmZddlmZmZ m Z ddl Z ddl m Z mZmZddl mZmZmZddl mZmZmZmZmZmZmZddl mZmZdd l mZmZm Z m!Z!zdd l m"Z"Wne#yYn0dd l m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-dd l m.Z.m/Z/e j0d e1dde de j0de1dde de j0de1dde de j0de1dde de j0de1dde de j0de1dde de2j3Z4e2_4dde2j56DZ7e8e2ddZ9Gddde Z:Gd d!d!e Z;Gd"d#d#e Zd&kr dd'l m?Z?m@Z@dd(lAmAZAmBZBmCZCdd)lAmDZDmEZEddlAZFddlGZGddlHZHddlIZIeJZKd*gZLeMe d+ZNe.ZOeZPd,d-ZQd.d/ZRd0d1ZSd2d3ZTed4d5ZUd6d7ZVGd8d9d9ed9d:ZWGd;d<dd>eZYeXjZfdddd?d@dAZ[e3fe\dBeXjZddddddCdDdEZ]e[Z^e]Z_GdFdGdGZ`dHdIZaGdJdKdKeAZbebeY_ce`eY_ddddBe\e3ddLdLdf dMdNZedOdPZfdQZgdRZhdSdTZidUdVZje3dfdWdXZkdYdZZldS)[a This module provides some more Pythonic support for SSL. Object types: SSLSocket -- subtype of socket.socket which does SSL over the socket Exceptions: SSLError -- exception raised for I/O errors Functions: cert_time_to_seconds -- convert time string used for certificate notBefore and notAfter functions to integer seconds past the Epoch (the time values returned from time.time()) get_server_certificate (addr, ssl_version, ca_certs, timeout) -- Retrieve the certificate from the server at the specified address and return it as a PEM-encoded string Integer constants: SSL_ERROR_ZERO_RETURN SSL_ERROR_WANT_READ SSL_ERROR_WANT_WRITE SSL_ERROR_WANT_X509_LOOKUP SSL_ERROR_SYSCALL SSL_ERROR_SSL SSL_ERROR_WANT_CONNECT SSL_ERROR_EOF SSL_ERROR_INVALID_ERROR_CODE The following group define certificate requirements that one side is allowing/requiring from the other side: CERT_NONE - no certificates from the other side are required (or will be looked at if provided) CERT_OPTIONAL - certificates are not required, but if provided will be validated, and if validation fails, the connection will also fail CERT_REQUIRED - certificates are required, and will be validated, and if validation fails, the connection will also fail The following constants identify various SSL protocol variants: PROTOCOL_SSLv2 PROTOCOL_SSLv3 PROTOCOL_SSLv23 PROTOCOL_TLS PROTOCOL_TLS_CLIENT PROTOCOL_TLS_SERVER PROTOCOL_TLSv1 PROTOCOL_TLSv1_1 PROTOCOL_TLSv1_2 The following constants identify various SSL alert message descriptions as per http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6 ALERT_DESCRIPTION_CLOSE_NOTIFY ALERT_DESCRIPTION_UNEXPECTED_MESSAGE ALERT_DESCRIPTION_BAD_RECORD_MAC ALERT_DESCRIPTION_RECORD_OVERFLOW ALERT_DESCRIPTION_DECOMPRESSION_FAILURE ALERT_DESCRIPTION_HANDSHAKE_FAILURE ALERT_DESCRIPTION_BAD_CERTIFICATE ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE ALERT_DESCRIPTION_CERTIFICATE_REVOKED ALERT_DESCRIPTION_CERTIFICATE_EXPIRED ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN ALERT_DESCRIPTION_ILLEGAL_PARAMETER ALERT_DESCRIPTION_UNKNOWN_CA ALERT_DESCRIPTION_ACCESS_DENIED ALERT_DESCRIPTION_DECODE_ERROR ALERT_DESCRIPTION_DECRYPT_ERROR ALERT_DESCRIPTION_PROTOCOL_VERSION ALERT_DESCRIPTION_INSUFFICIENT_SECURITY ALERT_DESCRIPTION_INTERNAL_ERROR ALERT_DESCRIPTION_USER_CANCELLED ALERT_DESCRIPTION_NO_RENEGOTIATION ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE ALERT_DESCRIPTION_UNRECOGNIZED_NAME ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY N) namedtuple)EnumIntEnumIntFlag)OPENSSL_VERSION_NUMBEROPENSSL_VERSION_INFOOPENSSL_VERSION) _SSLContext MemoryBIO SSLSession)SSLErrorSSLZeroReturnErrorSSLWantReadErrorSSLWantWriteErrorSSLSyscallError SSLEOFErrorSSLCertVerificationError)txt2objnid2obj) RAND_statusRAND_add RAND_bytesRAND_pseudo_bytes)RAND_egd) HAS_SNIHAS_ECDHHAS_NPNHAS_ALPN HAS_SSLv2 HAS_SSLv3 HAS_TLSv1 HAS_TLSv1_1 HAS_TLSv1_2 HAS_TLSv1_3)_DEFAULT_CIPHERS_OPENSSL_API_VERSION _SSLMethodcCs|do|dkS)N PROTOCOL_PROTOCOL_SSLv23 startswithnamer-/usr/lib64/python3.9/ssl.py}r/)sourceOptionscCs |dS)NOP_r)r+r-r-r.r/r0AlertDescriptioncCs |dS)NALERT_DESCRIPTION_r)r+r-r-r.r/r0SSLErrorNumbercCs |dS)N SSL_ERROR_r)r+r-r-r.r/r0 VerifyFlagscCs |dS)NVERIFY_r)r+r-r-r.r/r0 VerifyModecCs |dS)NCERT_r)r+r-r-r.r/r0cCsi|]\}}||qSr-r-).0r,valuer-r-r. r0r>PROTOCOL_SSLv2c@s6eZdZejZejZejZ ej Z ej Z ejZejZdS) TLSVersionN)__name__ __module__ __qualname___sslPROTO_MINIMUM_SUPPORTEDMINIMUM_SUPPORTED PROTO_SSLv3SSLv3 PROTO_TLSv1TLSv1 PROTO_TLSv1_1TLSv1_1 PROTO_TLSv1_2TLSv1_2 PROTO_TLSv1_3TLSv1_3PROTO_MAXIMUM_SUPPORTEDMAXIMUM_SUPPORTEDr-r-r-r.r@sr@c@s(eZdZdZdZdZdZdZdZdZ dS) _TLSContentTypez@Content types (record layer) See RFC 8446, section B.1 N) rArBrC__doc__CHANGE_CIPHER_SPECALERT HANDSHAKEAPPLICATION_DATAHEADERINNER_CONTENT_TYPEr-r-r-r.rSsrSc@seZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$S)% _TLSAlertTypezQAlert types for TLSContentType.ALERT messages See RFC 8466, section B.2 r rTrUrV()*+,-./0123<FGPVZdmnopqrstxN)&rArBrCrZ CLOSE_NOTIFYUNEXPECTED_MESSAGEBAD_RECORD_MACDECRYPTION_FAILEDRECORD_OVERFLOWDECOMPRESSION_FAILUREHANDSHAKE_FAILURENO_CERTIFICATEBAD_CERTIFICATEUNSUPPORTED_CERTIFICATECERTIFICATE_REVOKEDCERTIFICATE_EXPIREDCERTIFICATE_UNKNOWNILLEGAL_PARAMETER UNKNOWN_CA ACCESS_DENIED DECODE_ERROR DECRYPT_ERROREXPORT_RESTRICTIONPROTOCOL_VERSIONINSUFFICIENT_SECURITYINTERNAL_ERRORINAPPROPRIATE_FALLBACK USER_CANCELEDNO_RENEGOTIATIONMISSING_EXTENSIONUNSUPPORTED_EXTENSIONCERTIFICATE_UNOBTAINABLEUNRECOGNIZED_NAMEBAD_CERTIFICATE_STATUS_RESPONSEBAD_CERTIFICATE_HASH_VALUEUNKNOWN_PSK_IDENTITYCERTIFICATE_REQUIREDNO_APPLICATION_PROTOCOLr-r-r-r.rasFrac@sheZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdS)_TLSMessageTypezFMessage types (handshake protocol) See RFC 8446, section B.3 r rTrUrVrWCrYN)rArBrCrZ HELLO_REQUEST CLIENT_HELLO SERVER_HELLOHELLO_VERIFY_REQUESTNEWSESSION_TICKETEND_OF_EARLY_DATAHELLO_RETRY_REQUESTENCRYPTED_EXTENSIONS CERTIFICATESERVER_KEY_EXCHANGECERTIFICATE_REQUEST SERVER_DONECERTIFICATE_VERIFYCLIENT_KEY_EXCHANGEFINISHEDCERTIFICATE_URLCERTIFICATE_STATUSSUPPLEMENTAL_DATA KEY_UPDATE NEXT_PROTO MESSAGE_HASHr[r-r-r-r.rs.rwin32)enum_certificates enum_crls)socket SOCK_STREAMcreate_connection) SOL_SOCKETSO_TYPE tls-uniqueHOSTFLAG_NEVER_CHECK_SUBJECTcCs|sdS|d}|s&||kS|dkrsole wildcard without additional labels are not support: {!r}.z.shim_cb) sni_callbackcallable TypeError)r&rIrJr-rHr.set_servername_callbacks z"SSLContext.set_servername_callbackcCs`t}|D]F}t|d}t|dks0t|dkr8td|t|||q ||dS)Nr(rr<z)ALPN protocols must be 1 to 255 in length)r=r>rr rr?_set_alpn_protocols)r&alpn_protocolsrBr#rCr-r-r.set_alpn_protocols!s  zSSLContext.set_alpn_protocolscCstt}zYn0|tjkrPt}n|tjkr`t}nt}z ||}WntyYn0||||||Sr")r@rrSr_r\rar)conn directionversion content_typemsg_typedatamsg_enumcallbackr-r.rps(        z'SSLContext._msg_callback..inner)rrrnrghasattrrMro)r&rzrprryr.rns  cs ttjSr")r&rr#rdrr-r.r#szSSLContext.protocolcs ttjSr")r8r verify_flagsrdrr-r.r|szSSLContext.verify_flagscstttj||dSr")rrr|rgrhrr-r.r|scs.tj}z t|WSty(|YS0dSr")r verify_moder:rrhrr-r.r}s   zSSLContext.verify_modecstttj||dSr")rrr}rgrhrr-r.r}s)FTTNN)FNN)!rArBrCrZr`r5r8 PROTOCOL_TLSrr-r7r;rDrNrQr]rrrbr{r propertyrcsetterrirerDrmrnr#r|r}rr-r-rr.rsj           &%r)r r rScCst|tst|tt}|tjkr0t|_d|_ |s<|s<|rL| |||n|jt kr`| |t |drtjd}|rtjjs||_|S)zCreate a SSLContext object with default settings. NOTE: The protocol and settings may change anytime without prior deprecation. The values represent a fair balance between maximum compatibility and security. Tkeylog_filename SSLKEYLOGFILE)r)r rMrr~rr CERT_REQUIREDr}check_hostnamerW CERT_NONErbr{rrrr^flagsignore_environmentr)rYr r rSr3 keylogfiler-r-r.create_default_contexts        rF) cert_reqsrrYcertfilekeyfiler r rSc Cst|tst|t|} |s$d| _|dur2|| _|rZ"ed?d@Z#fdAdBZ$edCdDZ%edEdFZ&fdGdHZ'edddIdJZ(fdKdLZ)dMdNZ*dOdPZ+fdQdRZ,ededTdUZ-edVdWZ.Z/S)f SSLSocketzThis class implements a subtype of socket.socket that wraps the underlying OS socket in an SSL context when necessary, and provides read and write methods over that channel. cOst|jjddS)NzX does not have a public constructor. Instances are returned by SSLContext.wrap_socket().rrr-r-r.rs zSSLSocket.__init__FTNc sf|tttkrtd|r8|r(td|dur8td|jrJ|sJtdt|j|j |j | d}|j |fi|} t t| jfi||} ||| _|| _d| _d| _|| _||| _|| _|| _z | Wnty} z| jtjkrd} | } | dz| !d}Wn@tyb} z&| jtjtj"fvrJd}WYd} ~ n d} ~ 00| | |rd }t#| j|}||_$d|_%z | &WntyYn0z |Wd}nd}0WYd} ~ nd} ~ 00d } | '| | | _(| rbzH| jj)| || j| | jd | _|r<| }|d kr4td | *Wn"ttfy`| &Yn0| S)Nz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)familytypeprotofilenoFrr0z5Closed before TLS handshake with data in recv buffer.Trr4zHdo_handshake_on_connect should not be specified for non-blocking sockets)+ getsockoptrrrNotImplementedErrorrrdictrrrrrrrr gettimeoutdetach_context_session_closedrr/r-r2r0r1 getpeernamererrnoENOTCONN getblocking setblockingrecvEINVALr reasonlibraryclose settimeout _connected _wrap_socketr)rr.r/r0r1r2r3r4r%r& sock_timeoute connectedblockingnotconn_pre_handshake_datar notconn_pre_handshake_data_errortimeoutrr-r.r6s         "   zSSLSocket._createcCs|jSr")rrdr-r-r.r38szSSLSocket.contextcCs||_||j_dSr")rrr3rr-r-r.r3=scCs|jdur|jjSdSr"rrdr-r-r.r4Bs zSSLSocket.sessioncCs||_|jdur||j_dSr")rrr4rr-r-r.r4Hs cCs|jdur|jjSdSr"rrdr-r-r.rNs zSSLSocket.session_reusedcCstd|jjdS)NzCan't dup() %s instances)rrrArdr-r-r.dupTsz SSLSocket.dupcCsdSr"r-)r&msgr-r-r. _checkClosedXszSSLSocket._checkClosedcCs|js|dSr")rrrdr-r-r._check_connected\szSSLSocket._check_connectedrc Cs||jdurtdz*|dur4|j||WS|j|WSWn`ty}zH|jdtkr|jr|dur~WYd}~dSWYd}~dSnWYd}~n d}~00dS)zORead up to LEN bytes and return them. Return zero-length string on EOF.Nz'Read on closed or unwrapped SSL socket.rr0)rrrrr r$ SSL_ERROR_EOFr1)r&rrxr-r-r.rds zSSLSocket.readcCs&||jdurtd|j|S)zhWrite DATA to the underlying SSL channel. Returns number of bytes of DATA actually transmitted.Nz(Write on closed or unwrapped SSL socket.)rrrrrr-r-r.rys zSSLSocket.writecCs|||j|Sr")rrrrrr-r-r.rszSSLSocket.getpeercertcCs*||jdustjsdS|jSdSr")rrrDrrrdr-r-r.rszSSLSocket.selected_npn_protocolcCs*||jdustjsdS|jSdSr")rrrDrrrdr-r-r.rsz SSLSocket.selected_alpn_protocolcCs$||jdurdS|jSdSr")rrrrdr-r-r.rs zSSLSocket.ciphercCs$||jdurdS|jSdSr")rrrrdr-r-r.rs zSSLSocket.shared_cipherscCs$||jdurdS|jSdSr")rrrrdr-r-r.rs zSSLSocket.compressionrcsF||jdur4|dkr(td|j|j|St||SdS)Nrz3non-zero flags not allowed in calls to send() on %s)rrrrrrsend)r&rwrrr-r.rs  zSSLSocket.sendcsL||jdur"td|jn&|dur8t||St|||SdS)Nz%sendto not allowed on instances of %s)rrrrrsendto)r&rw flags_or_addrrrr-r.rs zSSLSocket.sendtocOstd|jdS)Nz&sendmsg not allowed on instances of %srrrr-r-r.sendmsgszSSLSocket.sendmsgc s||jdur|dkr(td|jd}t|f}|d<}t|}||krn|||d}||7}qJWdn1s0YWdq1s0Ynt ||SdS)Nrz6non-zero flags not allowed in calls to sendall() on %sB) rrrr memoryviewcastrrrsendall)r&rwrrview byte_viewamountrrr-r.rs HzSSLSocket.sendallcs,|jdur||||St|||SdS)zSend a file, possibly by using os.sendfile() if this is a clear-text socket. Return the total number of bytes sent. N)r_sendfile_use_sendrsendfile)r&fileoffsetrrr-r.rs zSSLSocket.sendfilecsD||jdur2|dkr(td|j||St||SdS)Nrz3non-zero flags not allowed in calls to recv() on %s)rrrrrrrr&buflenrrr-r.rs  zSSLSocket.recvcsj||r|durt|}n |dur*d}|jdurV|dkrJtd|j|||St|||SdS)Nrrz8non-zero flags not allowed in calls to recv_into() on %s)rrrrrrr recv_intor&rnbytesrrr-r.rs    zSSLSocket.recv_intocs4||jdur"td|jnt||SdS)Nz'recvfrom not allowed on instances of %s)rrrrrrecvfromrrr-r.rs  zSSLSocket.recvfromcs6||jdur"td|jnt|||SdS)Nz,recvfrom_into not allowed on instances of %s)rrrrr recvfrom_intorrr-r.rs  zSSLSocket.recvfrom_intocOstd|jdS)Nz&recvmsg not allowed on instances of %srrr-r-r.recvmsgszSSLSocket.recvmsgcOstd|jdS)Nz+recvmsg_into not allowed on instances of %srrr-r-r. recvmsg_intoszSSLSocket.recvmsg_intocCs$||jdur|jSdSdS)Nr)rrrrdr-r-r.rs  zSSLSocket.pendingcs|d|_t|dSr")rrrr)r&howrr-r.rszSSLSocket.shutdowncCs.|jr|j}d|_|Stdt|dSNzNo SSL wrapper around )rrrr*)r&sr-r-r.r$s  zSSLSocket.unwrapcCs$|jr|jStdt|dSr)rrrr*rdr-r-r.r-s z&SSLSocket.verify_client_post_handshakecsd|_tdSr")rr _real_closerdrr-r.r4szSSLSocket._real_closec CsP||}z.|dkr(|r(|d|jW||n ||0dS)Nr)rrrrr)r&blockrr-r-r.r8s   zSSLSocket.do_handshakec s|jrtd|js|jdur&td|jj|d|j||jd|_z@|rVt |}nd}t ||s~d|_|j r~| |WSt tfyd|_Yn0dS)Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!FrT)r/rrrr3rr2rr connect_exconnectr0rr)r&rrrcrr-r. _real_connectCs* zSSLSocket._real_connectcCs||ddS)QConnects to remote ADDR, and then wraps the connection in an SSL channel.FNrr&rr-r-r.r]szSSLSocket.connectcCs ||dS)rTrrr-r-r.rbszSSLSocket.connect_excs.t\}}|jj||j|jdd}||fS)zAccepts a new connection from a remote client, and returns a tuple containing that new connection wrapped with a server-side SSL channel, and the address of the remote client.T)r0r1r/)racceptr3r7r0r1)r&newsockrrr-r.rgszSSLSocket.acceptrcCs4|jdur|j|S|tvr,td|dSdS)Nz({0} channel binding type not implemented)rrCHANNEL_BINDING_TYPESrrrr-r-r.rss  zSSLSocket.get_channel_bindingcCs|jdur|jSdSdSr"rrdr-r-r.rt~s  zSSLSocket.version)FTTNNN)N)rN)F)r)N)r)rN)rr)Nr)rr)Nr)F)r)0rArBrCrZrrr6rrr3rr4rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrtrr-r-rr.rs_                          rTc Csl|r|std|r |s tdt|} || _|r<| ||rL| ||| rZ| | | j||||dS)Nz5certfile must be specified for server-side operationsr)r.r/r0r1)rrr}rWr set_ciphersr7) r.rrr/r ssl_versionca_certsr0r1ciphersr3r-r-r.r7s"   r7cCsddlm}ddlm}d}d}z||ddd}Wn"ty`td ||fYn00||dd|}||d|f|d d SdS) aReturn the time in seconds since the Epoch, given the timestring representing the "notBefore" or "notAfter" date from a certificate in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale). "notBefore" or "notAfter" dates must use UTC (RFC 5280). Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec UTC should be specified as GMT (see ASN1_TIME_print()) r)strptime)timegm) JanFebMarAprMayJunJulAugSepOctNovDecz %d %H:%M:%S %Y GMTNrrz*time data %r does not match format "%%b%s"rr)timer calendarrindextitler) cert_timer rmonths time_format month_numberttr-r-r.cert_time_to_secondss    r$z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----csRtt|ddtg}|fddtdtdD7}|tdd|S)z[Takes a certificate in binary DER format and returns the PEM version of it as a string.ASCIIstrictcsg|]}||dqS)@r-)r<ifr-r. r0z(DER_cert_to_PEM_cert..rr' ) r*base64standard_b64encode PEM_HEADERrangerr PEM_FOOTERr)der_cert_bytesssr-r)r.DER_cert_to_PEM_certs "r4cCs\|tstdt|ts0tdt|tttt }t| ddS)zhTakes a certificate in ASCII PEM format and returns the DER-encoded version of it as a byte sequencez(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr%r&) r*r/rstripendswithr1rr- decodebytesr+)pem_cert_stringdr-r-r.PEM_cert_to_DER_certs r:c Cs|\}}|durt}nt}t|||d}t|D}||}|d} Wdn1s\0YWdn1sz0Yt| S)zRetrieve the certificate from the server at the specified address, and return it as a PEM-encoded string. If 'ca_certs' is specified, validate the server cert against it. If 'ssl_version' is specified, use it in the connection attempt.N)rr T)rr_create_stdlib_contextrr7rr4) rr r hostportrr3r.sslsockdercertr-r-r.get_server_certificates  Fr@cCs t|dS)Nz )_PROTOCOL_NAMESr) protocol_coder-r-r.get_protocol_namesrC)mrZr^r collectionsrenumr_Enumr_IntEnumr_IntFlagrDrrrr r r r r rrrrrrrrrrrrrr ImportErrorrrrrrrr r!r"r#r$r% _convert_rAr&r~r( __members__itemsrAr_SSLv2_IF_EXISTSr@rSrarr_rrrrrrrrr-rrUr socket_errorrr{HAS_NEVER_CHECK_COMMON_NAME_RESTRICTED_SERVER_CIPHERSrrrrrrrr rrrrrr_create_default_https_contextr;rrrr5r8r7r$r/r1r4r:r@rCr-r-r-r.sZ $ 0   )  1# 9z # />