ó
CØê[c        
   @   sf  d  Z  d d l Z d d l Z d d l Z d d l m Z m Z m Z d d l m Z d d l m Z m	 Z	 m
 Z
 d d l m Z m Z m Z d d l m Z m Z m Z m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z i d	 e 6d
 e 6d e 6Z y d d l m Z e Z Wn e k
 r8e Z n Xd e e <d d l m Z m  Z  m! Z! m" Z# d d l m$ Z% d d l m& Z& m' Z' m( Z( d d l) Z) d d l* Z* d Z+ d e, f d „  ƒ  YZ- d d „ Z. d „  Z/ d e f d „  ƒ  YZ0 e e e1 e e e e2 e2 e d „	 Z3 d „  Z4 d Z5 d Z6 d „  Z7 d „  Z8 e e d „ Z9 d  „  Z: e e d! „ Z; d S("   s  This module provides some more Pythonic support for SSL.

Object types:

  SSLSocket -- subtype of socket.socket which does SSL over the socket

Exceptions:

  SSLError -- exception raised for I/O errors

Functions:

  cert_time_to_seconds -- convert time string used for certificate
                          notBefore and notAfter functions to integer
                          seconds past the Epoch (the time values
                          returned from time.time())

  fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
                          by the server running on HOST at port PORT.  No
                          validation of the certificate is performed.

Integer constants:

SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT

SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE

The following group define certificate requirements that one side is
allowing/requiring from the other side:

CERT_NONE - no certificates from the other side are required (or will
            be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
                validated, and if validation fails, the connection will
                also fail
CERT_REQUIRED - certificates are required, and will be validated, and
                if validation fails, the connection will also fail

The following constants identify various SSL protocol variants:

PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLSv1
iÿÿÿÿN(   t   OPENSSL_VERSION_NUMBERt   OPENSSL_VERSION_INFOt   OPENSSL_VERSION(   t   SSLError(   t	   CERT_NONEt   CERT_OPTIONALt   CERT_REQUIRED(   t   RAND_statust   RAND_egdt   RAND_add(	   t   SSL_ERROR_ZERO_RETURNt   SSL_ERROR_WANT_READt   SSL_ERROR_WANT_WRITEt   SSL_ERROR_WANT_X509_LOOKUPt   SSL_ERROR_SYSCALLt   SSL_ERROR_SSLt   SSL_ERROR_WANT_CONNECTt   SSL_ERROR_EOFt   SSL_ERROR_INVALID_ERROR_CODE(   t   PROTOCOL_SSLv3t   PROTOCOL_SSLv23t   PROTOCOL_TLSv1t   TLSv1t   SSLv23t   SSLv3(   t   PROTOCOL_SSLv2t   SSLv2(   t   sockett   _fileobjectt   _delegate_methodst   error(   t   getnameinfo(   t
   SOL_SOCKETt   SO_TYPEt   SOCK_STREAMs)   DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2t   CertificateErrorc           B   s   e  Z RS(    (   t   __name__t
   __module__(    (    (    s   /usr/lib/python2.7/ssl.pyR#   e   s   i   c   
      C   sR  g  } |  s t  S|  j d ƒ } | d } | d } | j d ƒ } | | k rg t d t |  ƒ ƒ ‚ n  | sƒ |  j ƒ  | j ƒ  k S| d k rŸ | j d ƒ nY | j d ƒ s½ | j d ƒ rÖ | j t j	 | ƒ ƒ n" | j t j	 | ƒ j
 d d	 ƒ ƒ x$ | D] } | j t j	 | ƒ ƒ qÿ Wt j d
 d j | ƒ d t j ƒ }	 |	 j | ƒ S(   sh   Matching according to RFC 6125, section 6.4.3

    http://tools.ietf.org/html/rfc6125#section-6.4.3
    t   .i    i   t   *s,   too many wildcards in certificate DNS name: s   [^.]+s   xn--s   \*s   [^.]*s   \As   \.s   \Z(   t   Falset   splitt   countR#   t   reprt   lowert   appendt
   startswitht   ret   escapet   replacet   compilet   joint
   IGNORECASEt   match(
   t   dnt   hostnamet   max_wildcardst   patst   dn_splitt   leftmostt	   remaindert	   wildcardst   fragt   pat(    (    s   /usr/lib/python2.7/ssl.pyt   _dnsname_matchi   s*    

"&c         C   s[  |  s t  d ƒ ‚ n  g  } |  j d d ƒ } xC | D]; \ } } | d k r4 t | | ƒ r_ d S| j | ƒ q4 q4 W| sß xc |  j d d ƒ D]L } xC | D]; \ } } | d k r™ t | | ƒ rÄ d S| j | ƒ q™ q™ WqŒ Wn  t | ƒ d k rt d | d	 j t t | ƒ ƒ f ƒ ‚ n; t | ƒ d k rKt d
 | | d f ƒ ‚ n t d ƒ ‚ d S(   s)  Verify that *cert* (in decoded format as returned by
    SSLSocket.getpeercert()) matches the *hostname*.  RFC 2818 and RFC 6125
    rules are followed, but IP addresses are not accepted for *hostname*.

    CertificateError is raised on failure. On success, the function
    returns nothing.
    s   empty or no certificatet   subjectAltNamet   DNSNt   subjectt
   commonNamei   s&   hostname %r doesn't match either of %ss   , s   hostname %r doesn't match %ri    s=   no appropriate commonName or subjectAltName fields were found(    (    (	   t
   ValueErrort   getR@   R-   t   lenR#   R3   t   mapR+   (   t   certR7   t   dnsnamest   sant   keyt   valuet   sub(    (    s   /usr/lib/python2.7/ssl.pyt   match_hostnameœ   s.    %t	   SSLSocketc        
   B   s  e  Z d  Z d d e e e d e e d d „	 Z d d „ Z	 d „  Z
 e d „ Z d „  Z d d „ Z d d	 „ Z d d
 „ Z d d d „ Z d d d „ Z d d d „ Z d d d „ Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d d d „ Z RS(   sµ   This class implements a subtype of socket.socket that wraps
    the underlying OS socket in an SSL context when necessary, and
    provides read and write methods over that channel.c         C   s–  | j  t t ƒ t k r' t d ƒ ‚ n  t j |  d | j ƒx3 t D]+ } y t	 |  | ƒ WqD t
 k
 rn qD XqD W|
 d  k r” | t k r” t }
 n  | rª | rª | } n  y t j |  ƒ Wn= t k
 rú } | j t j k rå ‚  n  t |  _ d  |  _ nG Xt |  _ t j |  j | | | | | | |
 ƒ |  _ | rA|  j ƒ  n  | |  _ | |  _ | |  _ | |  _ | |  _ |
 |  _ | |  _ |	 |  _  d |  _! d  S(   Ns!   only stream sockets are supportedt   _socki    ("   t
   getsockoptR    R!   R"   t   NotImplementedErrorR   t   __init__RQ   R   t   delattrt   AttributeErrort   Nonet   _SSLv2_IF_EXISTSt   _DEFAULT_CIPHERSt   getpeernamet   socket_errort   errnot   ENOTCONNR(   t
   _connectedt   _sslobjt   Truet   _sslt   sslwrapt   do_handshaket   keyfilet   certfilet	   cert_reqst   ssl_versiont   ca_certst   cipherst   do_handshake_on_connectt   suppress_ragged_eofst   _makefile_refs(   t   selft   sockRd   Re   t   server_sideRf   Rg   Rh   Rj   Rk   Ri   t   attrt   e(    (    s   /usr/lib/python2.7/ssl.pyRT   Ê   sF    													i   c         C   sQ   y |  j  j | ƒ SWn6 t k
 rL } | j d t k rF |  j rF d S‚  n Xd S(   sO   Read up to LEN bytes and return them.
        Return zero-length string on EOF.i    t    N(   R_   t   readR   t   argsR   Rk   (   Rm   RG   t   x(    (    s   /usr/lib/python2.7/ssl.pyRs   þ   s    c         C   s   |  j  j | ƒ S(   sh   Write DATA to the underlying SSL channel.  Returns
        number of bytes of DATA actually transmitted.(   R_   t   write(   Rm   t   data(    (    s   /usr/lib/python2.7/ssl.pyRv     s    c         C   s   |  j  j | ƒ S(   sá   Returns a formatted version of the data in the
        certificate provided by the other end of the SSL channel.
        Return None if no certificate was provided, {} if a
        certificate was provided, but not validated.(   R_   t   peer_certificate(   Rm   t   binary_form(    (    s   /usr/lib/python2.7/ssl.pyt   getpeercert  s    c         C   s   |  j  s d  S|  j  j ƒ  Sd  S(   N(   R_   RW   t   cipher(   Rm   (    (    s   /usr/lib/python2.7/ssl.pyR{     s    	i    c         C   s³   |  j  rœ | d k r+ t d |  j ƒ ‚ n  x t r˜ y |  j  j | ƒ } WnD t k
 r } | j d t k rs d S| j d t k rŠ d S‚  q. X| Sq. Wn |  j	 j
 | | ƒ Sd  S(   Ni    s3   non-zero flags not allowed in calls to send() on %s(   R_   RE   t	   __class__R`   Rv   R   Rt   R   R   RQ   t   send(   Rm   Rw   t   flagst   vRu   (    (    s   /usr/lib/python2.7/ssl.pyR}   "  s     		c         C   sX   |  j  r t d |  j ƒ ‚ n5 | d  k r> |  j j | | ƒ S|  j j | | | ƒ Sd  S(   Ns%   sendto not allowed on instances of %s(   R_   RE   R|   RW   RQ   t   sendto(   Rm   Rw   t   flags_or_addrt   addr(    (    s   /usr/lib/python2.7/ssl.pyR€   7  s    	c         C   sˆ   |  j  rq | d k r+ t d |  j ƒ ‚ n  t | ƒ } d } x- | | k  rl |  j | | ƒ } | | 7} q@ W| St j |  | | ƒ Sd  S(   Ni    s6   non-zero flags not allowed in calls to sendall() on %s(   R_   RE   R|   RG   R}   R   t   sendall(   Rm   Rw   R~   t   amountR*   R   (    (    s   /usr/lib/python2.7/ssl.pyRƒ   @  s    	c         C   sO   |  j  r8 | d k r+ t d |  j ƒ ‚ n  |  j | ƒ S|  j j | | ƒ Sd  S(   Ni    s3   non-zero flags not allowed in calls to recv() on %s(   R_   RE   R|   Rs   RQ   t   recv(   Rm   t   buflenR~   (    (    s   /usr/lib/python2.7/ssl.pyR…   O  s    	c         C   s¤   | r! | d  k r! t | ƒ } n | d  k r6 d } n  |  j rŠ | d k ra t d |  j ƒ ‚ n  |  j | ƒ } t | ƒ } | | | *| S|  j j | | | ƒ Sd  S(   Ni   i    s8   non-zero flags not allowed in calls to recv_into() on %s(   RW   RG   R_   RE   R|   Rs   RQ   t	   recv_into(   Rm   t   buffert   nbytesR~   t
   tmp_bufferR   (    (    s   /usr/lib/python2.7/ssl.pyR‡   Y  s    		
c         C   s6   |  j  r t d |  j ƒ ‚ n |  j j | | ƒ Sd  S(   Ns'   recvfrom not allowed on instances of %s(   R_   RE   R|   RQ   t   recvfrom(   Rm   R†   R~   (    (    s   /usr/lib/python2.7/ssl.pyR‹   j  s    	c         C   s9   |  j  r t d |  j ƒ ‚ n |  j j | | | ƒ Sd  S(   Ns,   recvfrom_into not allowed on instances of %s(   R_   RE   R|   RQ   t   recvfrom_into(   Rm   Rˆ   R‰   R~   (    (    s   /usr/lib/python2.7/ssl.pyRŒ   q  s    	c         C   s   |  j  r |  j  j ƒ  Sd Sd  S(   Ni    (   R_   t   pending(   Rm   (    (    s   /usr/lib/python2.7/ssl.pyR   x  s    	c         C   s?   |  j  r% |  j  j ƒ  } d  |  _  | St d t |  ƒ ƒ ‚ d  S(   Ns   No SSL wrapper around (   R_   t   shutdownRW   RE   t   str(   Rm   t   s(    (    s   /usr/lib/python2.7/ssl.pyt   unwrap~  s
    		c         C   s   d  |  _ t j |  | ƒ d  S(   N(   RW   R_   R   RŽ   (   Rm   t   how(    (    s   /usr/lib/python2.7/ssl.pyRŽ   †  s    	c         C   s;   |  j  d k  r( d  |  _ t j |  ƒ n |  j  d 8_  d  S(   Ni   (   Rl   RW   R_   R   t   close(   Rm   (    (    s   /usr/lib/python2.7/ssl.pyR“   Š  s    	c         C   s   |  j  j ƒ  d S(   s   Perform a TLS/SSL handshake.N(   R_   Rc   (   Rm   (    (    s   /usr/lib/python2.7/ssl.pyRc   ‘  s    c      	   C   sÙ   |  j  r t d ƒ ‚ n  t j |  j t |  j |  j |  j |  j	 |  j
 |  j ƒ |  _ ya | rr t j |  | ƒ } n d  } t j |  | ƒ | s° |  j r¤ |  j ƒ  n  t |  _  n  | SWn t k
 rÔ d  |  _ ‚  n Xd  S(   Ns/   attempt to connect already-connected SSLSocket!(   R^   RE   Ra   Rb   RQ   R(   Rd   Re   Rf   Rg   Rh   Ri   R_   R   t
   connect_exRW   t   connectRj   Rc   R`   R[   (   Rm   R‚   t   return_errnot   rc(    (    s   /usr/lib/python2.7/ssl.pyt   _real_connect—  s$    			c         C   s   |  j  | t ƒ d S(   sQ   Connects to remote ADDR, and then wraps the connection in
        an SSL channel.N(   R˜   R(   (   Rm   R‚   (    (    s   /usr/lib/python2.7/ssl.pyR•   ®  s    c         C   s   |  j  | t ƒ S(   sQ   Connects to remote ADDR, and then wraps the connection in
        an SSL channel.(   R˜   R`   (   Rm   R‚   (    (    s   /usr/lib/python2.7/ssl.pyR”   ³  s    c         C   s¡   t  j |  ƒ \ } } yb t | d |  j d |  j d t d |  j d |  j d |  j d |  j	 d |  j
 d	 |  j ƒ	| f SWn# t k
 rœ } | j ƒ  | ‚ n Xd
 S(   s¿   Accepts a new connection from a remote client, and returns
        a tuple containing that new connection wrapped with a server-side
        SSL channel, and the address of the remote client.Rd   Re   Ro   Rf   Rg   Rh   Ri   Rj   Rk   N(   R   t   acceptRP   Rd   Re   R`   Rf   Rg   Rh   Ri   Rj   Rk   R[   R“   (   Rm   t   newsockR‚   Rq   (    (    s   /usr/lib/python2.7/ssl.pyR™   ¸  s     									
t   riÿÿÿÿc         C   s%   |  j  d 7_  t |  | | d t ƒS(   s   Make and return a file-like object that
        works with the SSL connection.  Just use the code
        from the socket module.i   R“   (   Rl   R   R`   (   Rm   t   modet   bufsize(    (    s   /usr/lib/python2.7/ssl.pyt   makefileÏ  s    N(   R$   R%   t   __doc__RW   R(   R   R   R`   RT   Rs   Rv   Rz   R{   R}   R€   Rƒ   R…   R‡   R‹   RŒ   R   R‘   RŽ   R“   Rc   R˜   R•   R”   R™   Rž   (    (    (    s   /usr/lib/python2.7/ssl.pyRP   Ä   s6   0				
									c
   
      C   s@   t  |  d | d | d | d | d | d | d | d | d	 |	 ƒ	S(
   NRd   Re   Ro   Rf   Rg   Rh   Rj   Rk   Ri   (   RP   (
   Rn   Rd   Re   Ro   Rf   Rg   Rh   Rj   Rk   Ri   (    (    s   /usr/lib/python2.7/ssl.pyt   wrap_socketÜ  s    c         C   s%   d d l  } | j | j |  d ƒ ƒ S(   s¢   Takes a date-time string in standard ASN1_print form
    ("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
    a Python time value in seconds past the epoch.iÿÿÿÿNs   %b %d %H:%M:%S %Y GMT(   t   timet   mktimet   strptime(   t	   cert_timeR¡   (    (    s   /usr/lib/python2.7/ssl.pyt   cert_time_to_secondsì  s    s   -----BEGIN CERTIFICATE-----s   -----END CERTIFICATE-----c         C   sc   t  t d ƒ rB t j |  ƒ } t d t j | d ƒ d t d St d t j |  ƒ t d Sd S(   s[   Takes a certificate in binary DER format and returns the
    PEM version of it as a string.t   standard_b64encodes   
i@   N(   t   hasattrt   base64R¦   t
   PEM_HEADERt   textwrapt   fillt
   PEM_FOOTERt   encodestring(   t   der_cert_bytest   f(    (    s   /usr/lib/python2.7/ssl.pyt   DER_cert_to_PEM_certø  s    $c         C   sw   |  j  t ƒ s" t d t ƒ ‚ n  |  j ƒ  j t ƒ sJ t d t ƒ ‚ n  |  j ƒ  t t ƒ t t ƒ !} t j | ƒ S(   sh   Takes a certificate in ASCII PEM format and returns the
    DER-encoded version of it as a byte sequences(   Invalid PEM encoding; must start with %ss&   Invalid PEM encoding; must end with %s(	   R.   R©   RE   t   stript   endswithR¬   RG   R¨   t   decodestring(   t   pem_cert_stringt   d(    (    s   /usr/lib/python2.7/ssl.pyt   PEM_cert_to_DER_cert  s     c         C   sx   |  \ } } | d k	 r! t } n t } t t ƒ  d | d | d | ƒ} | j |  ƒ | j t ƒ } | j ƒ  t	 | ƒ S(   s÷   Retrieve the certificate from the server at the specified address,
    and return it as a PEM-encoded string.
    If 'ca_certs' is specified, validate the server cert against it.
    If 'ssl_version' is specified, use it in the connection attempt.Rg   Rf   Rh   N(
   RW   R   R   R    R   R•   Rz   R`   R“   R°   (   R‚   Rg   Rh   t   hostt   portRf   R   t   dercert(    (    s   /usr/lib/python2.7/ssl.pyt   get_server_certificate  s    	
c         C   s   t  j |  d ƒ S(   Ns	   <unknown>(   t   _PROTOCOL_NAMESRF   (   t   protocol_code(    (    s   /usr/lib/python2.7/ssl.pyt   get_protocol_name)  s    c         C   sl   t  |  d ƒ r |  j }  n  t j |  d | | t t d ƒ } y |  j ƒ  Wn t k
 r] n X| j	 ƒ  | S(   sŒ   A replacement for the old socket.ssl function.  Designed
    for compability with Python 2.5 and earlier.  Will disappear in
    Python 3.0.RQ   i    N(
   R§   RQ   Ra   Rb   R   R   RW   RZ   R[   Rc   (   Rn   Rd   Re   t   ssl_sock(    (    s   /usr/lib/python2.7/ssl.pyt   sslwrap_simple/  s    
(<   RŸ   Rª   R/   Ra   R    R   R   R   R   R   R   R   R   R	   R
   R   R   R   R   R   R   R   R   R   R   R   R»   R   RX   t   ImportErrorRW   R   R   R   R   R[   R   t   _getnameinfoR    R!   R"   R¨   R\   RY   RE   R#   R@   RO   RP   R(   R`   R    R¥   R©   R¬   R°   R¶   Rº   R½   R¿   (    (    (    s   /usr/lib/python2.7/ssl.pyt   <module>8   sV   @




"3	(ÿ 					