U k]e @sdZddlZddlZddlmZddlmZmZ m Z ddl Z ddl m Z mZmZddl mZmZmZddl mZmZmZmZmZmZmZddl mZmZdd l mZmZm Z m!Z!zdd l m"Z"Wne#k rYnXdd l m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-dd l m.Z.m/Z/e j0d e1dde de j0de1dde de j0de1dde de j0de1dde de j0de1dde de j0de1dde de2j3Z4e2_4dde2j56DZ7e8e2ddZ9Gddde Z:Gd d!d!e Z;Gd"d#d#e Zd&kr"dd'l m?Z?m@Z@dd(lAmAZAmBZBmCZCmDZDdd)lAmEZEmFZFddlAZGddlHZHddlIZIddlJZJeKZLd*gZMeNe d+ZOe.ZPeZQd,d-ZRd.d/ZSd0d1ZTd2d3ZUed4d5ZVd6d7ZWGd8d9d9ed9d:ZXGd;d<dd>eZZeYj[fdddd?d@dAZ\e3fe]dBeYj[ddddddCdDdEZ^e\Z_e^Z`GdFdGdGZadHdIZbGdJdKdKeAZceceZ_deaeZ_edddBe]e3ddLdLdf dMdNZfdOdPZgdQZhdRZidSdTZjdUdVZke3dfdWdXZldYdZZmdS)[a This module provides some more Pythonic support for SSL. Object types: SSLSocket -- subtype of socket.socket which does SSL over the socket Exceptions: SSLError -- exception raised for I/O errors Functions: cert_time_to_seconds -- convert time string used for certificate notBefore and notAfter functions to integer seconds past the Epoch (the time values returned from time.time()) fetch_server_certificate (HOST, PORT) -- fetch the certificate provided by the server running on HOST at port PORT. No validation of the certificate is performed. Integer constants: SSL_ERROR_ZERO_RETURN SSL_ERROR_WANT_READ SSL_ERROR_WANT_WRITE SSL_ERROR_WANT_X509_LOOKUP SSL_ERROR_SYSCALL SSL_ERROR_SSL SSL_ERROR_WANT_CONNECT SSL_ERROR_EOF SSL_ERROR_INVALID_ERROR_CODE The following group define certificate requirements that one side is allowing/requiring from the other side: CERT_NONE - no certificates from the other side are required (or will be looked at if provided) CERT_OPTIONAL - certificates are not required, but if provided will be validated, and if validation fails, the connection will also fail CERT_REQUIRED - certificates are required, and will be validated, and if validation fails, the connection will also fail The following constants identify various SSL protocol variants: PROTOCOL_SSLv2 PROTOCOL_SSLv3 PROTOCOL_SSLv23 PROTOCOL_TLS PROTOCOL_TLS_CLIENT PROTOCOL_TLS_SERVER PROTOCOL_TLSv1 PROTOCOL_TLSv1_1 PROTOCOL_TLSv1_2 The following constants identify various SSL alert message descriptions as per http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6 ALERT_DESCRIPTION_CLOSE_NOTIFY ALERT_DESCRIPTION_UNEXPECTED_MESSAGE ALERT_DESCRIPTION_BAD_RECORD_MAC ALERT_DESCRIPTION_RECORD_OVERFLOW ALERT_DESCRIPTION_DECOMPRESSION_FAILURE ALERT_DESCRIPTION_HANDSHAKE_FAILURE ALERT_DESCRIPTION_BAD_CERTIFICATE ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE ALERT_DESCRIPTION_CERTIFICATE_REVOKED ALERT_DESCRIPTION_CERTIFICATE_EXPIRED ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN ALERT_DESCRIPTION_ILLEGAL_PARAMETER ALERT_DESCRIPTION_UNKNOWN_CA ALERT_DESCRIPTION_ACCESS_DENIED ALERT_DESCRIPTION_DECODE_ERROR ALERT_DESCRIPTION_DECRYPT_ERROR ALERT_DESCRIPTION_PROTOCOL_VERSION ALERT_DESCRIPTION_INSUFFICIENT_SECURITY ALERT_DESCRIPTION_INTERNAL_ERROR ALERT_DESCRIPTION_USER_CANCELLED ALERT_DESCRIPTION_NO_RENEGOTIATION ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE ALERT_DESCRIPTION_UNRECOGNIZED_NAME ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY N) namedtuple)EnumIntEnumIntFlag)OPENSSL_VERSION_NUMBEROPENSSL_VERSION_INFOOPENSSL_VERSION) _SSLContext MemoryBIO SSLSession)SSLErrorSSLZeroReturnErrorSSLWantReadErrorSSLWantWriteErrorSSLSyscallError SSLEOFErrorSSLCertVerificationError)txt2objnid2obj) RAND_statusRAND_add RAND_bytesRAND_pseudo_bytes)RAND_egd) HAS_SNIHAS_ECDHHAS_NPNHAS_ALPN HAS_SSLv2 HAS_SSLv3 HAS_TLSv1 HAS_TLSv1_1 HAS_TLSv1_2 HAS_TLSv1_3)_DEFAULT_CIPHERS_OPENSSL_API_VERSION _SSLMethodcCs|do|dkS)NZ PROTOCOL_PROTOCOL_SSLv23 startswithnamer,/usr/lib/python3.8/ssl.py|r.)sourceOptionscCs |dS)NZOP_r(r*r,r,r-r.r/ZAlertDescriptioncCs |dS)NZALERT_DESCRIPTION_r(r*r,r,r-r.r/ZSSLErrorNumbercCs |dS)NZ SSL_ERROR_r(r*r,r,r-r.r/ VerifyFlagscCs |dS)NZVERIFY_r(r*r,r,r-r.r/ VerifyModecCs |dS)NZCERT_r(r*r,r,r-r.r/cCsi|]\}}||qSr,r,).0r+valuer,r,r- sr6ZPROTOCOL_SSLv2c@s6eZdZejZejZejZ ej Z ej Z ejZejZdS) TLSVersionN)__name__ __module__ __qualname___sslZPROTO_MINIMUM_SUPPORTEDZMINIMUM_SUPPORTEDZ PROTO_SSLv3SSLv3Z PROTO_TLSv1ZTLSv1Z PROTO_TLSv1_1ZTLSv1_1Z PROTO_TLSv1_2ZTLSv1_2Z PROTO_TLSv1_3ZTLSv1_3ZPROTO_MAXIMUM_SUPPORTEDZMAXIMUM_SUPPORTEDr,r,r,r-r7sr7c@s(eZdZdZdZdZdZdZdZdZ dS) _TLSContentTypez@Content types (record layer) See RFC 8446, section B.1 N) r8r9r:__doc__CHANGE_CIPHER_SPECALERTZ HANDSHAKEZAPPLICATION_DATAHEADERZINNER_CONTENT_TYPEr,r,r,r-r=sr=c@seZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$S)% _TLSAlertTypezQAlert types for TLSContentType.ALERT messages See RFC 8466, section B.2 r r>r?r@()*+,-./0123<FGPVZdmnopqrstxN)&r8r9r:rDZ CLOSE_NOTIFYZUNEXPECTED_MESSAGEZBAD_RECORD_MACZDECRYPTION_FAILEDZRECORD_OVERFLOWZDECOMPRESSION_FAILUREZHANDSHAKE_FAILUREZNO_CERTIFICATEZBAD_CERTIFICATEZUNSUPPORTED_CERTIFICATEZCERTIFICATE_REVOKEDZCERTIFICATE_EXPIREDZCERTIFICATE_UNKNOWNZILLEGAL_PARAMETERZ UNKNOWN_CAZ ACCESS_DENIEDZ DECODE_ERRORZ DECRYPT_ERRORZEXPORT_RESTRICTIONZPROTOCOL_VERSIONZINSUFFICIENT_SECURITYZINTERNAL_ERRORZINAPPROPRIATE_FALLBACKZ USER_CANCELEDZNO_RENEGOTIATIONZMISSING_EXTENSIONZUNSUPPORTED_EXTENSIONZCERTIFICATE_UNOBTAINABLEZUNRECOGNIZED_NAMEZBAD_CERTIFICATE_STATUS_RESPONSEZBAD_CERTIFICATE_HASH_VALUEZUNKNOWN_PSK_IDENTITYZCERTIFICATE_REQUIREDZNO_APPLICATION_PROTOCOLr,r,r,r-rHsFrHc@sheZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdS)_TLSMessageTypezFMessage types (handshake protocol) See RFC 8446, section B.3 r r>r?r@rACrCN)r8r9r:rDZ HELLO_REQUESTZ CLIENT_HELLOZ SERVER_HELLOZHELLO_VERIFY_REQUESTZNEWSESSION_TICKETZEND_OF_EARLY_DATAZHELLO_RETRY_REQUESTZENCRYPTED_EXTENSIONSZ CERTIFICATEZSERVER_KEY_EXCHANGEZCERTIFICATE_REQUESTZ SERVER_DONEZCERTIFICATE_VERIFYZCLIENT_KEY_EXCHANGEZFINISHEDZCERTIFICATE_URLZCERTIFICATE_STATUSZSUPPLEMENTAL_DATAZ KEY_UPDATEZ NEXT_PROTOZ MESSAGE_HASHrEr,r,r,r-rgs.rgwin32)enum_certificates enum_crls)socketAF_INET SOCK_STREAMcreate_connection) SOL_SOCKETSO_TYPE tls-uniqueHOSTFLAG_NEVER_CHECK_SUBJECTcCs|sdS|d}|s&||kS|dkrsole wildcard without additional labels are not support: {!r}.ztd ||d fntddS)aVerify that *cert* (in decoded format as returned by SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125 rules are followed. The function matches IP addresses rather than dNSNames if hostname is a valid ipaddress string. IPv4 addresses are supported on all platforms. IPv6 addresses are supported on platforms with IPv6 support (AF_INET6 and inet_pton). CertificateError is raised on failure. On success, the function returns nothing. ztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDNZsubjectAltNamer,ZDNSz IP AddressZsubjectZ commonNamerhz&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rrz=no appropriate commonName or subjectAltName fields were found) rrgetrappendrlenrjoinmaprepr)certrrZdnsnamesZsankeyr5subr,r,r-match_hostnamessB          rDefaultVerifyPathszQcafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathcCsdt}tj|d|d}tj|d|d}ttj|rF|ndtj|rX|ndf|S)z/Return paths to default cafile and capath. rrhrirjN) r;get_default_verify_pathsosenvironrrpathisfileisdir)partscafilecapathr,r,r-rsrcsDeZdZdZdZfddZefddZefddZZ S) _ASN1Objectz#ASN.1 object identifier lookup r,cstj|ft|ddS)NFr*super__new___txt2obj)clsoid __class__r,r-rsz_ASN1Object.__new__cstj|ft|S)z3Create _ASN1Object from OpenSSL numeric ID )rr_nid2obj)rZnidrr,r-fromnidsz_ASN1Object.fromnidcstj|ft|ddS)z=Create _ASN1Object from short name, long name or OID Tr*r)rr+rr,r-fromnamesz_ASN1Object.fromname) r8r9r:rD __slots__r classmethodrr __classcell__r,r,rr-rs rznid shortname longname oidc@seZdZdZdZdZdS)PurposezDSSLContext purpose flags with X509v3 Extended Key Usage objects z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2N)r8r9r:rD SERVER_AUTHZ CLIENT_AUTHr,r,r,r-rsrcseZdZdZdZdZdZefddZddZ d2d d Z d3d d Z ddZ ddZ ddZddZejfddZeedrefddZejfddZefddZejfddZefdd Zejfd!d Zeed"red#d$Zejd%d$Zn ed&d$Zefd'd(Zejfd)d(Zefd*d+Zefd,d-Zejfd.d-Zefd/d0Zejfd1d0ZZ S)4 SSLContextz|An SSLContext holds various SSL-related configuration options and data, such as certificates and possibly a private key.)ZCAZROOTNcOst||}|SN)r r)rprotocolargskwargsselfr,r,r-rs zSSLContext.__new__cCs4|dkr dSt|tr&|ddS|dSdS)NZidnaascii) isinstancestrencodedecode)rrr,r,r-_encode_hostnames  zSSLContext._encode_hostnameFTc Cs|jj|||||||dS)N)sock server_sidedo_handshake_on_connectsuppress_ragged_eofsserver_hostnamecontextsession)sslsocket_class_create)rrrrrrrr,r,r- wrap_socketszSSLContext.wrap_socketcCs|jj|||||||dS)N)rrrr)sslobject_classrr)rincomingoutgoingrrrr,r,r-wrap_bioszSSLContext.wrap_biocCs`t}|D]F}t|d}t|dks0t|dkr8td|t|||q ||dS)Nrrz(NPN protocols must be 1 to 255 in length) bytearraybytesrr rextendZ_set_npn_protocols)rZ npn_protocolsprotosrbr,r,r-set_npn_protocolss  zSSLContext.set_npn_protocolscs8dkrd_n$ts tdfdd}|_dS)Nznot a callable objectcs|}|||Sr)r)sslobjZ servernameZsslctxrserver_name_callbackr,r-shim_cbs z3SSLContext.set_servername_callback..shim_cb)Z sni_callbackcallable TypeError)rrrr,rr-set_servername_callbacks z"SSLContext.set_servername_callbackcCs`t}|D]F}t|d}t|dks0t|dkr8td|t|||q ||dS)Nrrrz)ALPN protocols must be 1 to 255 in length)rrrr rrZ_set_alpn_protocols)rZalpn_protocolsrrrr,r,r-set_alpn_protocols s  zSSLContext.set_alpn_protocolscCsvt}z.inner)rrrrhasattrrr)rrrrrr-rs  cs ttjSr)r&rrrrr,r-rszSSLContext.protocolcs ttjSr)r2r verify_flagsrrr,r-rszSSLContext.verify_flagscstttj||dSr)rrrrrrr,r-rscs0tj}z t|WStk r*|YSXdSr)r verify_moder3rrrr,r-rs  zSSLContext.verify_modecstttj||dSr)rrrrrrr,r-rs)FTTNN)FNN)!r8r9r:rDrrr PROTOCOL_TLSrrrrrrrrrrrrr propertyrsetterrrr;rrrrrrr,r,rr-rsn           &%r)rrrcCst|tst|tt}|tjkr0t|_d|_ |s<|s<|rL| |||n|jt kr`| |t |drtjd}|rtjjs||_|S)zCreate a SSLContext object with default settings. NOTE: The protocol and settings may change anytime without prior deprecation. The values represent a fair balance between maximum compatibility and security. Tkeylog_filename SSLKEYLOGFILE)rrrrrrr CERT_REQUIREDrcheck_hostnamer CERT_NONErrrrrrflagsignore_environmentr)rrrrr keylogfiler,r,r-create_default_contexts        rF) cert_reqsr rcertfilekeyfilerrrc Cst|tst|t|} |s$d| _|dk r2|| _|rZ"ed?d@Z#fdAdBZ$edCdDZ%edEdFZ&fdGdHZ'edddIdJZ(fdKdLZ)dMdNZ*dOdPZ+fdQdRZ,ededTdUZ-edVdWZ.Z/S)f SSLSocketzThis class implements a subtype of socket.socket that wraps the underlying OS socket in an SSL context when necessary, and provides read and write methods over that channel. cOst|jjddS)NzX does not have a public constructor. Instances are returned by SSLContext.wrap_socket().rrr,r,r-rs zSSLSocket.__init__FTNc sN|tttkrtd|r8|r(td|dk r8td|jrJ|sJtdt|j|j |j | d}|j |f|} t t| jf||} ||| _|| _d| _d| _|| _||| _|| _|| _z | Wntk r} z| jtjkrd} | } | dz| !d}Wn>tk rZ} z| jtjtj"fkrFd}W5d} ~ XYnX| | |rd }t#| j|}||_$d|_%z | &Wntk rYnX|W5d} ~ XYnXd } | '| | | _(| rJzH| jj)| || j| | jd | _|r"| }|d krtd | *Wn$ttfk rH| &YnX| S)Nz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)familytypeprotofilenoFrhr/z5Closed before TLS handshake with data in recv buffer.TrrzHdo_handshake_on_connect should not be specified for non-blocking sockets)+Z getsockoptrrr}NotImplementedErrorrr dictr<r=r>r?rrr;r gettimeoutdetach_context_sessionZ_closedrrrrrr getpeernamererrnoZENOTCONNZ getblockingZ setblockingrecvZEINVALr reasonZlibraryclose settimeout _connected _wrap_socketr1)rrrrrrrrrrZ sock_timeouteZ connectedZblockingZnotconn_pre_handshake_datarKZ notconn_pre_handshake_data_errortimeoutrr,r-rs           zSSLSocket._createcCs|jSr)rFrr,r,r-r3szSSLSocket.contextcCs||_||j_dSr)rFrrrr,r,r-r8scCs|jdk r|jjSdSrrrr,r,r-r=s zSSLSocket.sessioncCs||_|jdk r||j_dSr)rGrrr r,r,r-rCs cCs|jdk r|jjSdSrr!rr,r,r-r"Is zSSLSocket.session_reusedcCstd|jjdS)NzCan't dup() %s instances)rBrr8rr,r,r-dupOsz SSLSocket.dupcCsdSrr,)rmsgr,r,r- _checkClosedSszSSLSocket._checkClosedcCs|js|dSr)rNrHrr,r,r-_check_connectedWszSSLSocket._check_connectedr#c Cs||jdkrtdz*|dk r4|j||WS|j|WSWnVtk r}z8|jdtkr|jr|dk r|WYdSWY dSnW5d}~XYnXdS)zORead up to LEN bytes and return them. Return zero-length string on EOF.Nz'Read on closed or unwrapped SSL socket.rr/)rTrrr$r rZ SSL_ERROR_EOFr)rrr%xr,r,r-r$_s   zSSLSocket.readcCs&||jdkrtd|j|S)zhWrite DATA to the underlying SSL channel. Returns number of bytes of DATA actually transmitted.Nz(Write on closed or unwrapped SSL socket.)rTrrr'r(r,r,r-r'ts zSSLSocket.writecCs|||j|Sr)rTrUrr)r*r,r,r-r)}szSSLSocket.getpeercertcCs*||jdkstjsdS|jSdSr)rTrr;rr+rr,r,r-r+szSSLSocket.selected_npn_protocolcCs*||jdkstjsdS|jSdSr)rTrr;rr,rr,r,r-r,sz SSLSocket.selected_alpn_protocolcCs$||jdkrdS|jSdSr)rTrr-rr,r,r-r-s zSSLSocket.ciphercCs$||jdkrdS|jSdSr)rTrr.rr,r,r-r.s zSSLSocket.shared_cipherscCs$||jdkrdS|jSdSr)rTrr/rr,r,r-r/s zSSLSocket.compressionrcsF||jdk r4|dkr(td|j|j|St||SdS)Nrz3non-zero flags not allowed in calls to send() on %s)rTrrrr'rsend)rrr rr,r-rWs  zSSLSocket.sendcsL||jdk r"td|jn&|dkr8t||St|||SdS)Nz%sendto not allowed on instances of %s)rTrrrrsendto)rrZ flags_or_addrrrr,r-rXs zSSLSocket.sendtocOstd|jdS)Nz&sendmsg not allowed on instances of %srBrrr,r,r-sendmsgszSSLSocket.sendmsgc s||jdk r|dkr(td|jd}t|H}|d2}t|}||krn|||d}||7}qJW5QRXW5QRXnt ||SdS)Nrz6non-zero flags not allowed in calls to sendall() on %sB) rTrrr memoryviewcastrrWrsendall)rrr rZviewZ byte_viewZamountr&rr,r-r^s  zSSLSocket.sendallcs,|jdk r||||St|||SdS)zSend a file, possibly by using os.sendfile() if this is a clear-text socket. Return the total number of bytes sent. N)rZ_sendfile_use_sendrsendfile)rfileoffsetrrr,r-r_s zSSLSocket.sendfilecsD||jdk r2|dkr(td|j||St||SdS)Nrz3non-zero flags not allowed in calls to recv() on %s)rTrrrr$rrJrZbuflenr rr,r-rJs  zSSLSocket.recvcsj||r|dkrt|}n |dkr*d}|jdk rV|dkrJtd|j|||St|||SdS)Nr#rz8non-zero flags not allowed in calls to recv_into() on %s)rTrrrrr$r recv_intorr%nbytesr rr,r-rcs    zSSLSocket.recv_intocs4||jdk r"td|jnt||SdS)Nz'recvfrom not allowed on instances of %s)rTrrrrrecvfromrbrr,r-rfs  zSSLSocket.recvfromcs6||jdk r"td|jnt|||SdS)Nz,recvfrom_into not allowed on instances of %s)rTrrrr recvfrom_intordrr,r-rgs  zSSLSocket.recvfrom_intocOstd|jdS)Nz&recvmsg not allowed on instances of %srYrr,r,r-recvmsg szSSLSocket.recvmsgcOstd|jdS)Nz+recvmsg_into not allowed on instances of %srYrr,r,r- recvmsg_intoszSSLSocket.recvmsg_intocCs$||jdk r|jSdSdS)Nr)rTrr0rr,r,r-r0s  zSSLSocket.pendingcs|d|_t|dSr)rTrrr2)rZhowrr,r-r2szSSLSocket.shutdowncCs.|jr|j}d|_|Stdt|dSNzNo SSL wrapper around )rr2rr)rsr,r,r-r3s  zSSLSocket.unwrapcCs$|jr|jStdt|dSrj)rr7rrrr,r,r-r7(s z&SSLSocket.verify_client_post_handshakecsd|_tdSr)rr _real_closerrr,r-rl/szSSLSocket._real_closec CsF||}z$|dkr(|r(|d|jW5||XdS)NrA)rUrDrMrr1)rblockrQr,r,r-r13s  zSSLSocket.do_handshakec s|jrtd|js|jdk r&td|jj|d|j||jd|_z@|rVt |}nd}t ||s~d|_|j r~| |WSt tfk rd|_YnXdS)Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!Fr@T)rrrNrrrOrrGr connect_exconnectrr1r)rrrnZrcrr,r- _real_connect>s0 zSSLSocket._real_connectcCs||ddS)QConnects to remote ADDR, and then wraps the connection in an SSL channel.FNrprrr,r,r-roXszSSLSocket.connectcCs ||dS)rqTrrrsr,r,r-rn]szSSLSocket.connect_excs.t\}}|jj||j|jdd}||fS)zAccepts a new connection from a remote client, and returns a tuple containing that new connection wrapped with a server-side SSL channel, and the address of the remote client.T)rrr)racceptrrrr)rZnewsockrrr,r-rtbszSSLSocket.acceptrcCs4|jdk r|j|S|tkr,td|dSdS)Nz({0} channel binding type not implemented)rr4CHANNEL_BINDING_TYPESrrr5r,r,r-r4ns  zSSLSocket.get_channel_bindingcCs|jdk r|jSdSdSrr6rr,r,r-rys  zSSLSocket.version)FTTNNN)N)r#N)F)r)N)r)rN)r#r)Nr)r#r)Nr)F)r)0r8r9r:rDrrrrr:rrrr"rRrTrUr$r'r)r+r,r-r.r/rWrXrZr^r_rJrcrfrgrhrir0r2r3r7rlr1rprornrtr4rrr,r,rr-r;s[                          r;Tc Csl|r|std|r |s tdt|} || _|r<| ||rL| ||| rZ| | | j||||dS)Nz5certfile must be specified for server-side operationsr)rrrr)rrrrrZ set_ciphersr) rrrrr ssl_versionca_certsrrZciphersrr,r,r-rs$   rcCsddlm}ddlm}d}d}z||ddd}Wn$tk rbtd ||fYn0X||dd|}||d|f|d d SdS) aReturn the time in seconds since the Epoch, given the timestring representing the "notBefore" or "notAfter" date from a certificate in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale). "notBefore" or "notAfter" dates must use UTC (RFC 5280). Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec UTC should be specified as GMT (see ASN1_TIME_print()) r)strptime)timegm) ZJanZFebZMarZAprZMayZJunZJulZAugZSepZOctZNovZDecz %d %H:%M:%S %Y GMTNrjrhz*time data %r does not match format "%%b%s"rirm)timerxZcalendarryindextitler)Z cert_timerxryZmonthsZ time_formatZ month_numberZttr,r,r-cert_time_to_secondss   r}z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----csRtt|ddtg}|fddtdtdD7}|tdd|S)z[Takes a certificate in binary DER format and returns the PEM version of it as a string.ASCIIstrictcsg|]}||dqS)@r,)r4ifr,r- sz(DER_cert_to_PEM_cert..rr ) rbase64Zstandard_b64encode PEM_HEADERrangerr PEM_FOOTERr)Zder_cert_bytesZssr,rr-DER_cert_to_PEM_certs "rcCs\|tstdt|ts0tdt|tttt }t| ddS)zhTakes a certificate in ASCII PEM format and returns the DER-encoded version of it as a byte sequencez(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr~r) r)rrstripendswithrrrZ decodebytesr)Zpem_cert_stringdr,r,r-PEM_cert_to_DER_certs rc Csd|\}}|dk rt}nt}t|||d}t|&}||}|d} W5QRXW5QRXt| S)zRetrieve the certificate from the server at the specified address, and return it as a PEM-encoded string. If 'ca_certs' is specified, validate the server cert against it. If 'ssl_version' is specified, use it in the connection attempt.N)rrT)r r _create_stdlib_contextr~rr)r) rrvrwZhostZportrrrZsslsockZdercertr,r,r-get_server_certificates  rcCs t|dS)Nz )_PROTOCOL_NAMESr)Z protocol_coder,r,r-get_protocol_namesr)nrDrr collectionsrenumrZ_EnumrZ_IntEnumrZ_IntFlagr;rrrr r r r r rrrrrrrrrrrrrr ImportErrorrrrrrrr r!r"r#r$r% _convert_r8r&rr' __members__itemsrr8Z_SSLv2_IF_EXISTSr7r=rHrgrryrzr{r|r}r~rrrrrIrrZ socket_errorrurZHAS_NEVER_CHECK_COMMON_NAMEZ_RESTRICTED_SERVER_CIPHERSrrrrrrrrrrrrr rZ_create_default_https_contextrrr:r;rrrr}rrrrrrr,r,r,r-sY $0   )  1# 9z # /: