�`W. � ' @ s d Z d d l m Z y$ d d l m Z d d l m Z Wn1 e k
rm Z z e
e � � WYd d Z [ Xn Xd d l Z d d l
m Z d d l m Z m Z d d l m Z m Z y d d l m Z Wn( e
k
r� d Z d d
l m Z Yn Xd d l Z d d l Z d d l Z d d l m Z d d
l m Z d d g Z e Z! e j" e j# j$ e j% e j# j& i Z' e( e d � r�e( e j# d � r�e j# j) e' e j* <e( e d � r�e( e j# d � r�e j# j+ e' e j, <y e' j- e j. e j# j/ i � Wn e0 k
r Yn Xe j1 e j# j2 e j3 e j# j4 e j5 e j# j4 e j# j6 i Z7 e j8 j9 j: d � Z; d Z< e j! Z= e j> Z? d d � Z@ d d � ZA Gd d � d e � Z d d � ZB Gd d � d eC � ZD e r�d% d d � ZE n e ZE eE eD _E d! d" � ZF d d d d d d d d# d$ � Z> d S)&a! SSL with SNI_-support for Python 2. Follow these instructions if you would
like to verify SSL certificates in Python 2. Note, the default libraries do
*not* do certificate checking; you need to do additional work to validate
certificates yourself.
This needs the following packages installed:
* pyOpenSSL (tested with 0.13)
* ndg-httpsclient (tested with 0.3.2)
* pyasn1 (tested with 0.1.6)
You can install them with the following command:
pip install pyopenssl ndg-httpsclient pyasn1
To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this::
try:
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
except ImportError:
pass
Now you can use :mod:`urllib3` as you normally would, and it will support SNI
when the required modules are installed.
Activating this module also has the positive side effect of disabling SSL/TLS
compression in Python 2 (see `CRIME attack`_).
If you want to configure the default list of supported cipher suites, you can
set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.
Module Variables
----------------
:var DEFAULT_SSL_CIPHER_LIST: The list of supported SSL/TLS cipher suites.
.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)
� )�absolute_import)�SUBJ_ALT_NAME_SUPPORT)�SubjectAltNameN)�decoder)�univ�
constraint)�timeout�error)� _fileobject)�backport_makefile� )�
connection)�util�inject_into_urllib3�extract_from_urllib3�PROTOCOL_TLSv1_1�TLSv1_1_METHOD�PROTOCOL_TLSv1_2�TLSv1_2_METHOD�asciii @ c C s t t _ t t _ d t _ d S)z7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.TN)�ssl_wrap_socketr
�HAS_SNIr � IS_PYOPENSSL� r r �
/pyopenssl.pyr n s c C s t t _ t t _ d t _ d S)z4Undo monkey-patching by :func:`inject_into_urllib3`.FN)� orig_connection_ssl_wrap_socketr
r �orig_util_HAS_SNIr r r r r r r r v s c @ s2 e Z d Z d Z e j j e j d d � Z d S)r z0ASN.1 implementation for subjectAltNames support� i N) �__name__�
__module__� __qualname__�__doc__r Z
SequenceOfZsizeSpecr ZValueSizeConstraintr r r r r s r c C s g } t s | St � } x� t | j � � D]� } | j | � } | j � } | d k r\ q, | j � } t j | d | �} xz | D]r } t | t � s� q� xW t t
| � � D]C } | j | � }
|
j � d k r� q� | j
t |
j � � � q� Wq� Wq, W| S)Ns subjectAltNameZasn1SpecZdNSName)r r �rangeZget_extension_count�
get_extensionZget_short_name�get_data� der_decoder�decode�
isinstance�lenZgetComponentByPosition�getName�append�strZ getComponent) Z peer_certZdns_nameZ
general_names�i�extZext_nameZext_datZ decoded_dat�name�entryZ componentr r r �get_subj_alt_name� s*
%r0 c @ s� e Z d Z d Z d d d � Z d d � Z d d � Z d d
� Z d d � Z d
d � Z d d � Z
d d � Z d d � Z d d � Z
d d d � Z d d � Z d d � Z d S) �
WrappedSocketz�API-compatibility wrapper for Python OpenSSL's Connection-class.
Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
collector of pypy.
Tc C s1 | | _ | | _ | | _ d | _ d | _ d S)Nr F)r
�socket�suppress_ragged_eofs�_makefile_refs�_closed)�selfr
r2 r3 r r r �__init__� s
zWrappedSocket.__init__c C s
| j j � S)N)r2 �fileno)r6 r r r r8 � s zWrappedSocket.filenoc C s5 | j d k r | j d 8_ | j r1 | j � d S)Nr r )r4 r5 �close)r6 r r r �_decref_socketios� s z WrappedSocket._decref_socketiosc O s5 y | j j | | � } Wnt j j k
rt } z3 | j rP | j d k rP d St t | � � � WYd d } ~ Xn� t j j k
r� } z' | j j
� t j j k r� d S� WYd d } ~ Xnq t j j k
r,t
j
| j g g g | j j � � \ } } } | st d � � n | j | | � SYn X| Sd S)Nr �Unexpected EOF� z The read operation timed out���)r= r; )r
�recv�OpenSSL�SSL� SysCallErrorr3 �args� SocketErrorr+ �ZeroReturnError� get_shutdown�RECEIVED_SHUTDOWN�
WantReadError�selectr2 �
gettimeoutr )r6 rB �kwargs�data�e�rd�wd�edr r r r> � s" $*zWrappedSocket.recvc O s/ y | j j | | � SWnt j j k
rr } z3 | j rN | j d k rN d St t | � � � WYd d } ~ Xn� t j j k
r� } z' | j j
� t j j k r� d S� WYd d } ~ Xnm t j j k
r*t
j
| j g g g | j j � � \ } } } | st d � � n | j | | � SYn Xd S)Nr �Unexpected EOFr z The read operation timed outr= )r= rP )r
� recv_intor? r@ rA r3 rB rC r+ rD rE rF rG rH r2 rI r )r6 rB rJ rL rM rN rO r r r rQ � s $*zWrappedSocket.recv_intoc C s | j j | � S)N)r2 �
settimeout)r6 r r r r rR � s zWrappedSocket.settimeoutc C s| xu y | j j | � SWq t j j k
rs t j g | j g g | j j � � \ } } } | sl t � � w Yq Xq Wd S)N) r
�sendr? r@ ZWantWriteErrorrH r2 rI r )r6 rK �_Zwlistr r r �_send_until_done� s z WrappedSocket._send_until_donec C sJ d } x= | t | � k rE | j | | | t � � } | | 7} q Wd S)Nr )r( rU �SSL_WRITE_BLOCKSIZE)r6 rK �
total_sent�sentr r r �sendall� s zWrappedSocket.sendallc C s | j j � d S)N)r
�shutdown)r6 r r r rZ s zWrappedSocket.shutdownc C s^ | j d k rK y d | _ | j j � SWqZ t j j k
rG d SYqZ Xn | j d 8_ d S)Nr T)r4 r5 r
r9 r? r@ �Error)r6 r r r r9 s zWrappedSocket.closeFc C sp | j j � } | s | S| r8 t j j t j j | � Sd d | j � j f f f d d d � t | � D� i S)NZsubjectZ
commonNameZsubjectAltNamec S s g | ] } d | f � q S)ZDNSr )�.0�valuer r r �
<listcomp> s z-WrappedSocket.getpeercert.<locals>.<listcomp>) r
Zget_peer_certificater? ZcryptoZdump_certificateZ
FILETYPE_ASN1Z get_subjectZCNr0 )r6 Z binary_form�x509r r r � getpeercert s zWrappedSocket.getpeercertc C s | j d 7_ d S)Nr )r4 )r6 r r r �_reuse# s zWrappedSocket._reusec C s/ | j d k r | j � n | j d 8_ d S)Nr )r4 r9 )r6 r r r �_drop& s
zWrappedSocket._dropN)r r r r! r7 r8 r: r> rQ rR rU rY rZ r9 r` ra rb r r r r r1 � s
r1 r c C s% | j d 7_ t | | | d d �S)Nr r9 T)r4 r
)r6 �mode�bufsizer r r �makefile. s re c C s
| d k S)Nr r )�cnxr_ Zerr_noZ err_depthZ return_coder r r �_verify_callback7 s rg c C s t j j t | � } | r5 | p% | } | j | � | rH | j | � | t j k rk | j t | t
� | sw | r� y | j | | � Wq� t j j k
r� } z t j
d | | � � WYd d } ~ Xq� Xn
| j � d }
| j |
� | j t � t j j | | � } t | t j � r2| j d � } | j | � | j � x� y | j � Wn� t j j k
r�t j | g g g | j � � \ } }
}
| s�t d � � wLYn> t j j k
r�} z t j
d | � � WYd d } ~ Xn XPqLWt | | � S)Nzbad ca_certs: %ri zutf-8zselect timed outzbad handshake: %r) r? r@ ZContext�_openssl_versionsZuse_certificate_fileZuse_privatekey_file�ssl� CERT_NONEZ
set_verify�_openssl_verifyrg Zload_verify_locationsr[ ZSSLErrorZset_default_verify_pathsZ set_optionsZset_cipher_list�DEFAULT_SSL_CIPHER_LIST�
Connectionr' �sixZ text_type�encodeZset_tlsext_host_nameZset_connect_stateZ do_handshakerG rH rI r r1 )�sockZkeyfileZcertfileZ cert_reqsZca_certsZserver_hostnameZ ssl_versionZ ca_cert_dir�ctxrL ZOP_NO_COMPRESSIONrf rM rT r r r r ; sD
,
* &r r= )Gr! Z
__future__r Z%ndg.httpsclient.ssl_peer_verificationr Z ndg.httpsclient.subj_alt_namer ZBaseSubjectAltName� SyntaxErrorrL � ImportErrorZ OpenSSL.SSLr? Zpyasn1.codec.derr r% Z pyasn1.typer r r2 r r rC r
Z#urllib3.packages.backports.makefiler ri rH rn � r
r �__all__r ZPROTOCOL_SSLv23r@ Z
SSLv23_METHODZPROTOCOL_TLSv1Z TLSv1_METHODrh �hasattrr r r r �updateZPROTOCOL_SSLv3Z SSLv3_METHOD�AttributeErrorrj Z VERIFY_NONEZ
CERT_OPTIONALZ VERIFY_PEERZ
CERT_REQUIREDZVERIFY_FAIL_IF_NO_PEER_CERTrk Zssl_ZDEFAULT_CIPHERSro rl rV r r r r r r0 �objectr1 re rg r r r r �<module>- sj
!!
�