3
_Vjݭ @ sp d Z ddlZddlZddlZddlZddlZddlmZ ddlm Z
m Z m
Z ddlZddlmZmZmZ ddlmZmZmZ ddlmZmZmZmZmZmZ ddlm Z m Z dd lm Z m!Z!m"Z"m#Z# ydd
lm$Z$ W n e%k
r Y nX dd lm&Z&m'Z'm(Z(m)Z)m*Z* dd lm+Z+ dd
lm,Z, e j-de.dd ed ej-de.dd ed e j-de.dd ed e j-de.dd ed ej-de.dd ed e j-de.dd ed e/j0 Z1e/_1d d e/j2j3 D Z4e5e/d dZ6ej7d krdd lm8Z8m9Z9 dd!l:m:Z:m;Z;mZ>m?Z? ddl@Z@ddlAZAddlBZBeCZDejEr>d#gZFng ZFe+ZGG d$d% d%eHZIdRd'd(ZJd)d* ZKd+d, ZLed-d.ZMd/d0 ZNG d1d2 d2ed2d3ZOG d4d5 d5eOe
ZPG d6d7 d7eZQePjRfdddd8d9d:ZSe0feTd;ePjRdddddd<d=d>ZUeSZVeUZWG d?d@ d@ZXG dAdB dBe:ZYddd;eTe0ddCdCdf dDdEZZdFdG Z[dHZ\dIZ]dJdK Z^dLdM Z_e0dfdNdOZ`dPdQ ZadS )Sa
This module provides some more Pythonic support for SSL.
Object types:
SSLSocket -- subtype of socket.socket which does SSL over the socket
Exceptions:
SSLError -- exception raised for I/O errors
Functions:
cert_time_to_seconds -- convert time string used for certificate
notBefore and notAfter functions to integer
seconds past the Epoch (the time values
returned from time.time())
fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
by the server running on HOST at port PORT. No
validation of the certificate is performed.
Integer constants:
SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT
SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE
The following group define certificate requirements that one side is
allowing/requiring from the other side:
CERT_NONE - no certificates from the other side are required (or will
be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
validated, and if validation fails, the connection will
also fail
CERT_REQUIRED - certificates are required, and will be validated, and
if validation fails, the connection will also fail
The following constants identify various SSL protocol variants:
PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLS
PROTOCOL_TLS_CLIENT
PROTOCOL_TLS_SERVER
PROTOCOL_TLSv1
PROTOCOL_TLSv1_1
PROTOCOL_TLSv1_2
The following constants identify various SSL alert message descriptions as per
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
ALERT_DESCRIPTION_CLOSE_NOTIFY
ALERT_DESCRIPTION_UNEXPECTED_MESSAGE
ALERT_DESCRIPTION_BAD_RECORD_MAC
ALERT_DESCRIPTION_RECORD_OVERFLOW
ALERT_DESCRIPTION_DECOMPRESSION_FAILURE
ALERT_DESCRIPTION_HANDSHAKE_FAILURE
ALERT_DESCRIPTION_BAD_CERTIFICATE
ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE
ALERT_DESCRIPTION_CERTIFICATE_REVOKED
ALERT_DESCRIPTION_CERTIFICATE_EXPIRED
ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN
ALERT_DESCRIPTION_ILLEGAL_PARAMETER
ALERT_DESCRIPTION_UNKNOWN_CA
ALERT_DESCRIPTION_ACCESS_DENIED
ALERT_DESCRIPTION_DECODE_ERROR
ALERT_DESCRIPTION_DECRYPT_ERROR
ALERT_DESCRIPTION_PROTOCOL_VERSION
ALERT_DESCRIPTION_INSUFFICIENT_SECURITY
ALERT_DESCRIPTION_INTERNAL_ERROR
ALERT_DESCRIPTION_USER_CANCELLED
ALERT_DESCRIPTION_NO_RENEGOTIATION
ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION
ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE
ALERT_DESCRIPTION_UNRECOGNIZED_NAME
ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE
ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE
ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY
N)
namedtuple)EnumIntEnumIntFlag)OPENSSL_VERSION_NUMBEROPENSSL_VERSION_INFOOPENSSL_VERSION) _SSLContext MemoryBIO
SSLSession)SSLErrorSSLZeroReturnErrorSSLWantReadErrorSSLWantWriteErrorSSLSyscallError SSLEOFError)txt2objnid2obj) RAND_statusRAND_add
RAND_bytesRAND_pseudo_bytes)RAND_egd)HAS_SNIHAS_ECDHHAS_NPNHAS_ALPN HAS_TLSv1_3)_DEFAULT_CIPHERS)_OPENSSL_API_VERSION
_SSLMethodc C s | j do| dkS )NZ PROTOCOL_PROTOCOL_SSLv23)
startswith)name r$ /usr/lib64/python3.6/ssl.py} s r& )sourceOptionsc C s
| j dS )NZOP_)r" )r# r$ r$ r% r& s ZAlertDescriptionc C s
| j dS )NZALERT_DESCRIPTION_)r" )r# r$ r$ r% r& s ZSSLErrorNumberc C s
| j dS )NZ
SSL_ERROR_)r" )r# r$ r$ r% r& s VerifyFlagsc C s
| j dS )NZVERIFY_)r" )r# r$ r$ r% r& s
VerifyModec C s
| j dS )NZCERT_)r" )r# r$ r$ r% r& s c C s i | ]\}}||qS r$ r$ ).0r# valuer$ r$ r%
s r- ZPROTOCOL_SSLv2win32)enum_certificates enum_crls)socketAF_INET SOCK_STREAMcreate_connection)
SOL_SOCKETSO_TYPEz
tls-uniquec @ s e Zd ZdS )CertificateErrorN)__name__
__module__ __qualname__r$ r$ r$ r% r7 s r7 c C s g }| s dS | j d^}}|jd}||kr|jdsx|jdr|jtj| n|jtj|j dd x |D ]}|jtj| qW tj
d d
j | d tj }|j
|S ) zhMatching according to RFC 6125, section 6.4.3
http://tools.ietf.org/html/rfc6125#section-6.4.3
F.*z,too many wildcards in certificate DNS name: z[^.]+zxn--z\*z[^.]*z\Az\.z\Z)splitcountr7 reprlowerappendr" reescapereplacecompilejoin
IGNORECASEmatch) ZdnhostnameZ
max_wildcardsZpatsZleftmostZ remainderZ wildcardsZfragZpatr$ r$ r% _dnsname_match s&
rK c C s t j| j }||kS )zExact matching of IP addresses.
RFC 6125 explicitly doesn't define an algorithm for this
(section 1.7.2 - "Out of Scope").
) ipaddress
ip_addressrstrip)Zipnamehost_ipZipr$ r$ r% _ipaddress_match s rP c C sP | s t dytj|}W n t k
r2 d}Y nX g }| jdf }xb|D ]Z\}}|dkr||dkrpt||rpdS |j| qJ|dkrJ|dk rt||rdS |j| qJW |sxF| jdf D ]6}x0|D ](\}}|dkrt||rdS |j| qW qW t|dkr td |d
j t
t |f n,t|dkrDtd ||d f ntd
dS )a) Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
rules are followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDNZsubjectAltNameZDNSz
IP AddressZsubjectZ
commonNamer; z&hostname %r doesn't match either of %sz, z hostname %r doesn't match %rr z=no appropriate commonName or subjectAltName fields were found)
ValueErrorrL rM getrK rB rP lenr7 rG mapr@ )certrJ rO ZdnsnamesZsankeyr, subr$ r$ r% match_hostname s>
rX DefaultVerifyPathszQcafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathc C sd t j } tjj| d | d }tjj| d | d }ttjj|rF|ndtjj|rX|ndf| S )z/Return paths to default cafile and capath.
r r; N) _sslget_default_verify_pathsosenvironrR rY pathisfileisdir)partscafilecapathr$ r$ r% r] - s r] c sD e Zd ZdZf Z fddZe fddZe fddZ Z S ) _ASN1Objectz#ASN.1 object identifier lookup
c s t j| ft|dd S )NF)r# )super__new___txt2obj)clsoid) __class__r$ r% rh @ s z_ASN1Object.__new__c s t j| ft| S )z3Create _ASN1Object from OpenSSL numeric ID
)rg rh _nid2obj)rj Znid)rl r$ r% fromnidC s z_ASN1Object.fromnidc s t j| ft|dd S )z=Create _ASN1Object from short name, long name or OID
T)r# )rg rh ri )rj r# )rl r$ r% fromnameI s z_ASN1Object.fromname)
r8 r9 r: __doc__ __slots__rh classmethodrn ro
__classcell__r$ r$ )rl r% rf ; s
rf znid shortname longname oidc @ s e Zd ZdZdZdZdS )PurposezDSSLContext purpose flags with X509v3 Extended Key Usage objects
z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2N)r8 r9 r: rp SERVER_AUTHZ CLIENT_AUTHr$ r$ r$ r% rt P s rt c s e Zd ZdZd"Zd#ZefddZefdd Zd$d
dZ d%ddZ
dd Z dd Z dd Z
ejfddZe fddZej fddZe fd d Zej fd d Ze fd d Zej fd!d Z ZS )&
SSLContextz|An SSLContext holds various SSL-related configuration options and
data, such as certificates and possibly a private key.protocol __weakref__CAROOTc O s t j| |}|S )N)r rh )rj rw argskwargsselfr$ r$ r% rh ^ s zSSLContext.__new__c C s
|| _ d S )N)rw )r} rw r$ r$ r% __init__b s zSSLContext.__init__FTNc C s t |||||| |dS )N)sock server_sidedo_handshake_on_connectsuppress_ragged_eofsserver_hostname_context_session) SSLSocket)r} r r r r r sessionr$ r$ r% wrap_sockete s
zSSLContext.wrap_socketc C s | j ||||d}t||dS )N)r r )r )Z _wrap_bio SSLObject)r} ZincomingZoutgoingr r r sslobjr$ r$ r% wrap_bioo s
zSSLContext.wrap_bioc C sd t }xN|D ]F}t|d}t|dks2t|dkr:td|jt| |j| q W | j| d S )Nasciir z(NPN protocols must be 1 to 255 in length) bytearraybytesrS r rB extendZ_set_npn_protocols)r}
npn_protocolsprotosrw br$ r$ r% set_npn_protocolsu s
z SSLContext.set_npn_protocolsc C sd t }xN|D ]F}t|d}t|dks2t|dkr:td|jt| |j| q W | j| d S )Nr r r z)ALPN protocols must be 1 to 255 in length)r r rS r rB r Z_set_alpn_protocols)r} Zalpn_protocolsr rw r r$ r$ r% set_alpn_protocols s
z SSLContext.set_alpn_protocolsc C sz t }y@x:t|D ].\}}}|dkr|dks6|j|kr|j| qW W n tk
rd tjd Y nX |rv| j|d |S )NZx509_asnTz-unable to enumerate Windows certificate store)cadata)r r/ rk r PermissionErrorwarningswarnload_verify_locations)r} storenamepurposeZcertsrU encodingZtrustr$ r$ r% _load_windows_store_certs s z$SSLContext._load_windows_store_certsc C sD t |tst|tjdkr8x| jD ]}| j|| q$W | j d S )Nr. )
isinstancerf TypeErrorsysplatform_windows_cert_storesr Zset_default_verify_paths)r} r r r$ r$ r% load_default_certs s
z SSLContext.load_default_certsc s t t jS )N)r( rg options)r} )rl r$ r% r s zSSLContext.optionsc s t ttjj| | d S )N)rg rv r __set__)r} r, )rl r$ r% r s c s t t jS )N)r) rg verify_flags)r} )rl r$ r% r s zSSLContext.verify_flagsc s t ttjj| | d S )N)rg rv r r )r} r, )rl r$ r% r s c s* t j}yt|S tk
r$ |S X d S )N)rg verify_moder* rQ )r} r, )rl r$ r% r s
zSSLContext.verify_modec s t ttjj| | d S )N)rg rv r r )r} r, )rl r$ r% r s )rw rx )ry rz )FTTNN)FNN)r8 r9 r: rp rq r PROTOCOL_TLSrh r~ r r r r r rt ru r propertyr setterr r rs r$ r$ )rl r% rv W s*
rv )rd re r c C sd t | tst| tt}| tjkr0t|_d|_ |s<|s<|rL|j
||| n|jt kr`|j | |S )zCreate a SSLContext object with default settings.
NOTE: The protocol and settings may change anytime without prior
deprecation. The values represent a fair balance between maximum
compatibility and security.
T)
r rf r rv r rt ru
CERT_REQUIREDr check_hostnamer CERT_NONEr )r rd re r contextr$ r$ r% create_default_context s
r F) cert_reqsr r certfilekeyfilerd re r c
C s t |tst|t| } |s$d| _|dk r2|| _|r Z$d?d@ Z%dAdB Z&dCdD Z'dEdF Z(dadGdHZ)dIdJ Z*dKdL Z+dMdN Z,dOdP Z-dbdRdSZ.dTdU Z/ Z0S )cr zThis class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel.NFTr c 6 C s: d | _ |r|| _n|r$| r$td|r6| r6td|rD| rD|}t|| _|| j_|rf| jj| |rx| jj|| |r| jj| |r| jj| || _ || _
|| _ || _ || _
|| _|jtttkrtd|r|rtd|d k rtd| jjr| rtd|| _|| _|| _|| _|
| _|d k rftj| |j |j |j |j d |j }|j! n,| d k rtj| | d ntj| | |
| d y | j" W n t#k
r } z|j$t$j%kr d
}| j d k}| j&d
y| j'd }W n> t#k
r( } z |j$t$j%t$j(fkr d
}W Y d d }~X nX | j&| |rd}t)|j$|}||_*d |_+y | j, W n t#k
rx Y nX z|W d d }X W Y d d }~X nX d}| j-| d
| _.d | _ || _/|r6yN| jj0| ||}t1|| | jd| _ |r| j }|dkrtd| j2 W n$ t#tfk
r4 | j, Y nX d S )Nz5certfile must be specified for server-side operationszcertfile must be specifiedz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)familytypeprotofileno)r )r r r Fr r; z5Closed before TLS handshake with data in recv buffer.T)r r g zHdo_handshake_on_connect should not be specified for non-blocking sockets)3r r rQ rv r r r r Z set_ciphersr r r ssl_versionca_certsciphersZ
getsockoptr5 r6 r3 r r r r r r r r1 r~ r r r r
gettimeoutdetach getpeernameOSErrorerrnoZENOTCONNZ setblockingrecvZEINVALr reasonZlibraryclose
settimeoutZ_closed
_connected _wrap_socketr r ) r} r r r r r r r r r r r r r r r r r r Z sock_timeouteZ connectedZblockingZnotconn_pre_handshake_datar Z notconn_pre_handshake_data_errorr timeoutr$ r$ r% r~ s
zSSLSocket.__init__c C s | j S )N)r )r} r$ r$ r% r 0 s zSSLSocket.contextc C s || _ || j_d S )N)r r r )r} r r$ r$ r% r 4 s c C s | j dk r| j jS dS )z!The SSLSession for client socket.N)r r )r} r$ r$ r% r 9 s
zSSLSocket.sessionc C s || _ | jd k r|| j_d S )N)r r r )r} r r$ r$ r% r ? s
c C s | j dk r| j jS dS )z.Was the client session reused during handshakeN)r r )r} r$ r$ r% r E s
zSSLSocket.session_reusedc C s t d| jj d S )NzCan't dup() %s instances)r rl r8 )r} r$ r$ r% dupK s z
SSLSocket.dupc C s d S )Nr$ )r} msgr$ r$ r% _checkClosedO s zSSLSocket._checkClosedc C s | j s| j d S )N)r r )r} r$ r$ r% _check_connectedS s zSSLSocket._check_connected c C st | j | jstdy| jj||S tk
rn } z.|jd tkr\| jr\|dk rVdS dS n W Y dd}~X nX dS )zORead up to LEN bytes and return them.
Return zero-length string on EOF.z'Read on closed or unwrapped SSL socket.r Nr )r r rQ r r r{ Z
SSL_ERROR_EOFr )r} rS r xr$ r$ r% r [ s zSSLSocket.readc C s" | j | jstd| jj|S )zhWrite DATA to the underlying SSL channel. Returns
number of bytes of DATA actually transmitted.z(Write on closed or unwrapped SSL socket.)r r rQ r )r} r r$ r$ r% r m s zSSLSocket.writec C s | j | j | jj|S )zReturns a formatted version of the data in the
certificate provided by the other end of the SSL channel.
Return None if no certificate was provided, {} if a
certificate was provided, but not validated.)r r r r )r} r r$ r$ r% r v s zSSLSocket.getpeercertc C s* | j | j stj r d S | jj S d S )N)r r r\ r r )r} r$ r$ r% r s z SSLSocket.selected_npn_protocolc C s* | j | j stj r d S | jj S d S )N)r r r\ r r )r} r$ r$ r% r s z SSLSocket.selected_alpn_protocolc C s | j | jsd S | jj S d S )N)r r r )r} r$ r$ r% r s zSSLSocket.cipherc C s | j | jsd S | jj S )N)r r r )r} r$ r$ r% r s zSSLSocket.shared_ciphersc C s | j | jsd S | jj S d S )N)r r r )r} r$ r$ r% r s zSSLSocket.compressionc C sB | j | jr0|dkr$td| j | jj|S tj| ||S d S )Nr z3non-zero flags not allowed in calls to send() on %s)r r rQ rl r r1 send)r} r flagsr$ r$ r% r s
zSSLSocket.sendc C sH | j | jr td| j n&|d kr4tj| ||S tj| |||S d S )Nz%sendto not allowed on instances of %s)r r rQ rl r1 sendto)r} r Z
flags_or_addraddrr$ r$ r% r s zSSLSocket.sendtoc O s t d| j d S )Nz&sendmsg not allowed on instances of %s)r rl )r} r{ r| r$ r$ r% sendmsg s zSSLSocket.sendmsgc C s | j | jr|dkr$td| j d}t|L}|jd6}t|}x&||k rl| j||d }||7 }qHW W d Q R X W d Q R X ntj | ||S d S )Nr z6non-zero flags not allowed in calls to sendall() on %sB)
r r rQ rl
memoryviewcastrS r r1 sendall)r} r r r? ZviewZ byte_viewZamountr r$ r$ r% r s
"zSSLSocket.sendallc s, | j dkrt j|||S | j|||S dS )zSend a file, possibly by using os.sendfile() if this is a
clear-text socket. Return the total number of bytes sent.
N)r rg sendfileZ_sendfile_use_send)r} fileoffsetr? )rl r$ r% r s
zSSLSocket.sendfilec C s@ | j | jr.|dkr$td| j | j|S tj| ||S d S )Nr z3non-zero flags not allowed in calls to recv() on %s)r r rQ rl r r1 r )r} buflenr r$ r$ r% r s
zSSLSocket.recvc C sf | j |r |d kr t|}n |d kr*d}| jrR|dkrFtd| j | j||S tj| |||S d S )Ni r z8non-zero flags not allowed in calls to recv_into() on %s)r rS r rQ rl r r1 recv_into)r} r nbytesr r$ r$ r% r s
zSSLSocket.recv_intoc C s0 | j | jr td| j ntj| ||S d S )Nz'recvfrom not allowed on instances of %s)r r rQ rl r1 recvfrom)r} r r r$ r$ r% r s
zSSLSocket.recvfromc C s2 | j | jr td| j ntj| |||S d S )Nz,recvfrom_into not allowed on instances of %s)r r rQ rl r1
recvfrom_into)r} r r r r$ r$ r% r s
zSSLSocket.recvfrom_intoc O s t d| j d S )Nz&recvmsg not allowed on instances of %s)r rl )r} r{ r| r$ r$ r% recvmsg s zSSLSocket.recvmsgc O s t d| j d S )Nz+recvmsg_into not allowed on instances of %s)r rl )r} r{ r| r$ r$ r% recvmsg_into s zSSLSocket.recvmsg_intoc C s | j | jr| jj S dS d S )Nr )r r r )r} r$ r$ r% r s
zSSLSocket.pendingc C s | j d | _tj| | d S )N)r r r1 r )r} Zhowr$ r$ r% r s zSSLSocket.shutdownc C s. | j r| j j }d | _ |S tdt| d S )NzNo SSL wrapper around )r r rQ str)r} sr$ r$ r% r s
zSSLSocket.unwrapc C s$ | j r| j j S tdt| d S )NzNo SSL wrapper around )r r rQ r )r} r$ r$ r% r s
z&SSLSocket.verify_client_post_handshakec C s d | _ tj| d S )N)r r1 _real_close)r} r$ r$ r% r # s zSSLSocket._real_closec C sF | j | j }z$|dkr(|r(| jd | jj W d| j| X dS )z Perform a TLS/SSL handshake.g N)r r r r r )r} blockr r$ r$ r% r ' s
zSSLSocket.do_handshakec C s | j rtd| jr td| jj| d| j}t|| | jd| _y>|rTt j
| |}nd }t j | | |s|d| _| j r|| j
|S ttfk
r d | _ Y nX d S )Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!F)r r T)r rQ r r r r r r r r1
connect_exconnectr r r )r} r r r Zrcr$ r$ r%
_real_connect2 s( zSSLSocket._real_connectc C s | j |d dS )zQConnects to remote ADDR, and then wraps the connection in
an SSL channel.FN)r )r} r r$ r$ r% r K s zSSLSocket.connectc C s | j |dS )zQConnects to remote ADDR, and then wraps the connection in
an SSL channel.T)r )r} r r$ r$ r% r P s zSSLSocket.connect_exc C s. t j| \}}| jj|| j| jdd}||fS )zAccepts a new connection from a remote client, and returns
a tuple containing that new connection wrapped with a server-side
SSL channel, and the address of the remote client.T)r r r )r1 acceptr r r r )r} Znewsockr r$ r$ r% r U s zSSLSocket.accept
tls-uniquec C s | j dkrdS | j j|S )zGet channel binding data for current connection. Raise ValueError
if the requested `cb_type` is not supported. Return bytes of the data
or None if the data is not available (e.g. before the handshake).
N)r r )r} r r$ r$ r% r a s
z SSLSocket.get_channel_bindingc C s | j dkrdS | j j S )z
Return a string identifying the protocol version used by the
current SSL channel, or None if there is no established channel.
N)r r )r} r$ r$ r% r j s
zSSLSocket.version)N)r N)F)r )N)r )r N)r r )Nr )r r )Nr )F)r )1r8 r9 r: rp r r r2 r3 r~ r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r rs r$ r$ )rl r% r s` |
r Tc
C s t | ||||||||| d
S )N)
r r r r r r r r r r )r )
r r r r r r r r r r r$ r$ r% r t s r c
C s ddl m} ddlm} d}d}y |j| dd j d }W n$ tk
rb td| |f Y n0X || dd |}||d |f|dd S dS )a Return the time in seconds since the Epoch, given the timestring
representing the "notBefore" or "notAfter" date from a certificate
in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale).
"notBefore" or "notAfter" dates must use UTC (RFC 5280).
Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
UTC should be specified as GMT (see ASN1_TIME_print())
r )strptime)timegmJanFebMarAprMayJunJulAugSepOctNovDecz %d %H:%M:%S %Y GMTNr[ r; z*time data %r does not match format "%%b%s"rZ ) r r
r r r r r r r r r r )Ztimer
Zcalendarr indextitlerQ )Z cert_timer
r ZmonthsZ time_formatZ month_numberZttr$ r$ r% cert_time_to_seconds s
r z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----c C s2 t tj| dd}td tj|d d t d S )z[Takes a certificate in binary DER format and returns the
PEM version of it as a string.ASCIIstrict
@ )r base64Zstandard_b64encode
PEM_HEADERtextwrapZfill
PEM_FOOTER)Zder_cert_bytesfr$ r$ r% DER_cert_to_PEM_cert s r% c C s\ | j tstdt | j jts0tdt | j tttt }tj|j ddS )zhTakes a certificate in ASCII PEM format and returns the
DER-encoded version of it as a byte sequencez(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr r )
r" r! rQ stripendswithr# rS r Z decodebytesencode)Zpem_cert_stringdr$ r$ r% PEM_cert_to_DER_cert s
r* c
C sd | \}}|dk rt }nt}t|||d}t| &}|j|}|jd} W dQ R X W dQ R X t| S )zRetrieve the certificate from the server at the specified address,
and return it as a PEM-encoded string.
If 'ca_certs' is specified, validate the server cert against it.
If 'ssl_version' is specified, use it in the connection attempt.N)r rd T)r r _create_stdlib_contextr4 r r r% )
r r r hostZportr r r ZsslsockZdercertr$ r$ r% get_server_certificate s
r- c C s t j| dS )Nz )_PROTOCOL_NAMESrR )Z
protocol_coder$ r$ r% get_protocol_name s r/ )r; )brp rL r" rC r r^ collectionsr enumr Z_Enumr Z_IntEnumr Z_IntFlagr\ r r r r r
r r r
r r r r r ri r rm r r r r r ImportErrorr r r r r r r _convertr8 r r r! __members__itemsr. getattrZ_SSLv2_IF_EXISTSr r/ r0 r1 r2 r3 r4 r5 r6 r r r r Z socket_errorZHAS_TLS_UNIQUEr Z_RESTRICTED_SERVER_CIPHERSrQ r7 rK rP rX rY r] rf rt rv ru r r r Z _create_default_https_contextr+ r r r r r! r# r% r* r- r/ r$ r$ r$ r% [ s
1 4g ( O