Your IP : 172.28.240.42
|_c
@ s d Z d d l Z d d l Z d d l m Z m Z m Z d d l m Z d d l m Z m Z m Z d d l m
Z
m Z m Z d d l m
Z
m Z m Z m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z i d e 6d
e 6d e 6Z y d d l m Z e Z Wn e k
r,e Z n Xd
e e <d d l m Z m Z m Z m! Z" d d l m# Z$ d d l% Z% d d l& Z& d Z' d e f d YZ( e e e) e e e e* e* e d Z+ d Z, d Z- d Z. d Z/ d Z0 e e d Z1 d Z2 e e d Z3 d S( s This module provides some more Pythonic support for SSL.
Object types:
SSLSocket -- subtype of socket.socket which does SSL over the socket
Exceptions:
SSLError -- exception raised for I/O errors
Functions:
cert_time_to_seconds -- convert time string used for certificate
notBefore and notAfter functions to integer
seconds past the Epoch (the time values
returned from time.time())
fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
by the server running on HOST at port PORT. No
validation of the certificate is performed.
Integer constants:
SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT
SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE
The following group define certificate requirements that one side is
allowing/requiring from the other side:
CERT_NONE - no certificates from the other side are required (or will
be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
validated, and if validation fails, the connection will
also fail
CERT_REQUIRED - certificates are required, and will be validated, and
if validation fails, the connection will also fail
The following constants identify various SSL protocol variants:
PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLSv1
iN( t OPENSSL_VERSION_NUMBERt OPENSSL_VERSION_INFOt OPENSSL_VERSION( t SSLError( t CERT_NONEt
CERT_OPTIONALt
CERT_REQUIRED( t RAND_statust RAND_egdt RAND_add( t SSL_ERROR_ZERO_RETURNt SSL_ERROR_WANT_READt SSL_ERROR_WANT_WRITEt SSL_ERROR_WANT_X509_LOOKUPt SSL_ERROR_SYSCALLt
SSL_ERROR_SSLt SSL_ERROR_WANT_CONNECTt
SSL_ERROR_EOFt SSL_ERROR_INVALID_ERROR_CODE( t PROTOCOL_SSLv3t PROTOCOL_SSLv23t PROTOCOL_TLSv1t TLSv1t SSLv23t SSLv3( t PROTOCOL_SSLv2t SSLv2( t sockett _fileobjectt _delegate_methodst error( t getnameinfos) DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2t SSLSocketc
B s e Z d Z d d e e e d e e d d Z d d Z d Z
e d Z d Z d d Z
d d Z d d
Z d d d Z d d d Z d d d
Z d d d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d d d Z RS( s This class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel.c
C so t j | d | j x3 t D]+ } y t | | Wq t k
rG q Xq W|
d k rm | t k rm t }
n | r | r | } n y t j | Wn= t
k
r } | j t j k r n t
| _ d | _ nG Xt | _ t j | j | | | | | | |
| _ | r| j n | | _ | | _ | | _ | | _ | | _ |
| _ | | _ | | _ d | _ d S( Nt _socki ( R t __init__R! R t delattrt AttributeErrort Nonet _SSLv2_IF_EXISTSt _DEFAULT_CIPHERSt getpeernamet socket_errort errnot ENOTCONNt Falset
_connectedt _sslobjt Truet _sslt sslwrapt do_handshaket keyfilet certfilet cert_reqst ssl_versiont ca_certst cipherst do_handshake_on_connectt suppress_ragged_eofst _makefile_refs(
t selft sockR3 R4 t server_sideR5 R6 R7 R9 R: R8 t attrt e( ( s /usr/lib/python2.7/ssl.pyR" j sB
i c C sQ y | j j | SWn6 t k
rL } | j d t k rF | j rF d S n Xd S( sO Read up to LEN bytes and return them.
Return zero-length string on EOF.i t N( R. t readR t argsR R: ( R< t lent x( ( s /usr/lib/python2.7/ssl.pyRB s c C s | j j | S( sh Write DATA to the underlying SSL channel. Returns
number of bytes of DATA actually transmitted.( R. t write( R< t data( ( s /usr/lib/python2.7/ssl.pyRF s c C s | j j | S( s Returns a formatted version of the data in the
certificate provided by the other end of the SSL channel.
Return None if no certificate was provided, {} if a
certificate was provided, but not validated.( R. t peer_certificate( R< t binary_form( ( s /usr/lib/python2.7/ssl.pyt getpeercert s c C s | j s
d S| j j Sd S( N( R. R% t cipher( R< ( ( s /usr/lib/python2.7/ssl.pyRK s i c C s | j r | d k r+ t d | j n x t r y | j j | } WnD t k
r } | j d t k rs d S| j d t k r d S q. X| Sq. Wn | j j
| | Sd S( Ni s3 non-zero flags not allowed in calls to send() on %s( R. t
ValueErrort __class__R/ RF R RC R R R! t send( R< RG t flagst vRE ( ( s /usr/lib/python2.7/ssl.pyRN s c C sX | j r t d | j n5 | d k r> | j j | | S| j j | | | Sd S( Ns% sendto not allowed on instances of %s( R. RL RM R% R! t sendto( R< RG t
flags_or_addrt addr( ( s /usr/lib/python2.7/ssl.pyRQ s c C s | j rq | d k r+ t d | j n t | } d } x- | | k rl | j | | } | | 7} q@ W| St j | | | Sd S( Ni s6 non-zero flags not allowed in calls to sendall() on %s( R. RL RM RD RN R t sendall( R< RG RO t amountt countRP ( ( s /usr/lib/python2.7/ssl.pyRT s c C sO | j r8 | d k r+ t d | j n | j | S| j j | | Sd S( Ni s3 non-zero flags not allowed in calls to recv() on %s( R. RL RM RB R! t recv( R< t buflenRO ( ( s /usr/lib/python2.7/ssl.pyRW s
c C s | r! | d k r! t | } n | d k r6 d } n | j r | d k ra t d | j n | j | } t | } | | | *| S| j j | | | Sd S( Ni i s8 non-zero flags not allowed in calls to recv_into() on %s( R% RD R. RL RM RB R! t recv_into( R< t buffert nbytesRO t
tmp_bufferRP ( ( s /usr/lib/python2.7/ssl.pyRY s
c C s6 | j r t d | j n | j j | | Sd S( Ns' recvfrom not allowed on instances of %s( R. RL RM R! t recvfrom( R< RX RO ( ( s /usr/lib/python2.7/ssl.pyR] s c C s9 | j r t d | j n | j j | | | Sd S( Ns, recvfrom_into not allowed on instances of %s( R. RL RM R! t
recvfrom_into( R< RZ R[ RO ( ( s /usr/lib/python2.7/ssl.pyR^
s c C s | j r | j j Sd Sd S( Ni ( R. t pending( R< ( ( s /usr/lib/python2.7/ssl.pyR_ s
c C s? | j r% | j j } d | _ | St d t | d S( Ns No SSL wrapper around ( R. t shutdownR% RL t str( R< t s( ( s /usr/lib/python2.7/ssl.pyt unwrap s
c C s d | _ t j | | d S( N( R% R. R R` ( R< t how( ( s /usr/lib/python2.7/ssl.pyR` " s c C s; | j d k r( d | _ t j | n | j d 8_ d S( Ni ( R; R% R. R t close( R< ( ( s /usr/lib/python2.7/ssl.pyRe & s c C s | j j d S( s Perform a TLS/SSL handshake.N( R. R2 ( R< ( ( s /usr/lib/python2.7/ssl.pyR2 - s c C s | j r t d n t j | j t | j | j | j | j | j
| j | _ y* t
j | | | j r} | j n Wn/ t k
r } | r | j Sd | _ | n Xt | _ d S( Ns/ attempt to connect already-connected SSLSocket!i ( R- RL R0 R1 R! R, R3 R4 R5 R6 R7 R8 R. R t connectR9 R2 R) R* R% R/ ( R< RS t return_errnoR@ ( ( s /usr/lib/python2.7/ssl.pyt
_real_connect3 s
c C s | j | t d S( sQ Connects to remote ADDR, and then wraps the connection in
an SSL channel.N( Rh R, ( R< RS ( ( s /usr/lib/python2.7/ssl.pyRf H s c C s | j | t S( sQ Connects to remote ADDR, and then wraps the connection in
an SSL channel.( Rh R/ ( R< RS ( ( s /usr/lib/python2.7/ssl.pyt
connect_exM s c C ss t j | \ } } t | d | j d | j d t d | j d | j d | j d | j d | j
d | j | f S(
s Accepts a new connection from a remote client, and returns
a tuple containing that new connection wrapped with a server-side
SSL channel, and the address of the remote client.R3 R4 R> R5 R6 R7 R8 R9 R: ( R t acceptR R3 R4 R/ R5 R6 R7 R8 R9 R: ( R< t newsockRS ( ( s /usr/lib/python2.7/ssl.pyRj R s t ric C s% | j d 7_ t | | | d t S( s Make and return a file-like object that
works with the SSL connection. Just use the code
from the socket module.i Re ( R; R R/ ( R< t modet bufsize( ( s /usr/lib/python2.7/ssl.pyt makefilee s N( t __name__t
__module__t __doc__R% R, R R R/ R" RB RF RJ RK RN RQ RT RW RY R] R^ R_ Rc R` Re R2 Rh Rf Ri Rj Ro ( ( ( s /usr/lib/python2.7/ssl.pyR d s6 ,
c
C s@ t | d | d | d | d | d | d | d | d | d | S(
NR3 R4 R> R5 R6 R7 R9 R: R8 ( R (
R= R3 R4 R> R5 R6 R7 R9 R: R8 ( ( s /usr/lib/python2.7/ssl.pyt wrap_socketr s c C s% d d l } | j | j | d S( s Takes a date-time string in standard ASN1_print form
("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
a Python time value in seconds past the epoch.iNs %b %d %H:%M:%S %Y GMT( t timet mktimet strptime( t cert_timeRt ( ( s /usr/lib/python2.7/ssl.pyt cert_time_to_seconds s s -----BEGIN CERTIFICATE-----s -----END CERTIFICATE-----c C sc t t d rB t j | } t d t j | d d t d St d t j | t d Sd S( s[ Takes a certificate in binary DER format and returns the
PEM version of it as a string.t standard_b64encodes
i@ N( t hasattrt base64Ry t
PEM_HEADERt textwrapt fillt
PEM_FOOTERt encodestring( t der_cert_bytest f( ( s /usr/lib/python2.7/ssl.pyt DER_cert_to_PEM_cert s $c C sw | j t s" t d t n | j j t sJ t d t n | j t t t t !} t j | S( sh Takes a certificate in ASCII PEM format and returns the
DER-encoded version of it as a byte sequences( Invalid PEM encoding; must start with %ss& Invalid PEM encoding; must end with %s( t
startswithR| RL t stript endswithR RD R{ t decodestring( t pem_cert_stringt d( ( s /usr/lib/python2.7/ssl.pyt PEM_cert_to_DER_cert s
c C sx | \ } } | d k r! t } n t } t t d | d | d | } | j | | j t } | j t | S( s Retrieve the certificate from the server at the specified address,
and return it as a PEM-encoded string.
If 'ca_certs' is specified, validate the server cert against it.
If 'ssl_version' is specified, use it in the connection attempt.R6 R5 R7 N(
R% R R Rs R Rf RJ R/ Re R ( RS R6 R7 t hostt portR5 Rb t dercert( ( s /usr/lib/python2.7/ssl.pyt get_server_certificate s
c C s t j | d S( Ns <unknown>( t _PROTOCOL_NAMESt get( t
protocol_code( ( s /usr/lib/python2.7/ssl.pyt get_protocol_name s c C sl t | d r | j } n t j | d | | t t d } y | j Wn t k
r] n X| j | S( s A replacement for the old socket.ssl function. Designed
for compability with Python 2.5 and earlier. Will disappear in
Python 3.0.R! i N(
Rz R! R0 R1 R R R% R( R) R2 ( R= R3 R4 t ssl_sock( ( s /usr/lib/python2.7/ssl.pyt sslwrap_simple s
(4 Rr R} R0 R R R R R R R R R R R
R R R
R R R R R R R R R R R& t ImportErrorR% R R R R R) R t _getnameinfoR{ R* R' R R, R/ Rs Rx R| R R R R R R ( ( ( s /usr/lib/python2.7/ssl.pyt <module>8 sL @
"