ó
UèZc        
   @   s  d  Z  d d l Z d d l Z d d l m Z m Z m Z d d l m Z d d l m Z m Z m	 Z	 d d l m
 Z
 m Z m Z d d l m Z m Z m Z m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z i d	 e 6d
 e 6d e 6Z y d d l m Z e Z Wn e k
 r,e Z n Xd e e <d d l m Z m Z m  Z  m! Z" d d l m# Z$ d d l% Z% d d l& Z& d Z' d e f d „  ƒ  YZ( e e e) e e e e* e* e d „	 Z+ d „  Z, d Z- d Z. d „  Z/ d „  Z0 e e d „ Z1 d „  Z2 e e d „ Z3 d S(   s  This module provides some more Pythonic support for SSL.

Object types:

  SSLSocket -- subtype of socket.socket which does SSL over the socket

Exceptions:

  SSLError -- exception raised for I/O errors

Functions:

  cert_time_to_seconds -- convert time string used for certificate
                          notBefore and notAfter functions to integer
                          seconds past the Epoch (the time values
                          returned from time.time())

  fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
                          by the server running on HOST at port PORT.  No
                          validation of the certificate is performed.

Integer constants:

SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT

SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE

The following group define certificate requirements that one side is
allowing/requiring from the other side:

CERT_NONE - no certificates from the other side are required (or will
            be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
                validated, and if validation fails, the connection will
                also fail
CERT_REQUIRED - certificates are required, and will be validated, and
                if validation fails, the connection will also fail

The following constants identify various SSL protocol variants:

PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLSv1
iÿÿÿÿN(   t   OPENSSL_VERSION_NUMBERt   OPENSSL_VERSION_INFOt   OPENSSL_VERSION(   t   SSLError(   t	   CERT_NONEt   CERT_OPTIONALt   CERT_REQUIRED(   t   RAND_statust   RAND_egdt   RAND_add(	   t   SSL_ERROR_ZERO_RETURNt   SSL_ERROR_WANT_READt   SSL_ERROR_WANT_WRITEt   SSL_ERROR_WANT_X509_LOOKUPt   SSL_ERROR_SYSCALLt   SSL_ERROR_SSLt   SSL_ERROR_WANT_CONNECTt   SSL_ERROR_EOFt   SSL_ERROR_INVALID_ERROR_CODE(   t   PROTOCOL_SSLv3t   PROTOCOL_SSLv23t   PROTOCOL_TLSv1t   TLSv1t   SSLv23t   SSLv3(   t   PROTOCOL_SSLv2t   SSLv2(   t   sockett   _fileobjectt   _delegate_methodst   error(   t   getnameinfos)   DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2t	   SSLSocketc        
   B   s  e  Z d  Z d d e e e d e e d d „	 Z d d „ Z	 d „  Z
 e d „ Z d „  Z d d „ Z d d	 „ Z d d
 „ Z d d d „ Z d d d „ Z d d d „ Z d d d „ Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d d d „ Z RS(   sµ   This class implements a subtype of socket.socket that wraps
    the underlying OS socket in an SSL context when necessary, and
    provides read and write methods over that channel.c         C   so  t  j |  d | j ƒx3 t D]+ } y t |  | ƒ Wq t k
 rG q Xq W|
 d  k rm | t k rm t }
 n  | rƒ | rƒ | } n  y t  j	 |  ƒ Wn= t
 k
 rÓ } | j t j k r¾ ‚  n  t |  _ d  |  _ nG Xt |  _ t j |  j | | | | | | |
 ƒ |  _ | r|  j ƒ  n  | |  _ | |  _ | |  _ | |  _ | |  _ |
 |  _ | |  _ |	 |  _ d |  _ d  S(   Nt   _socki    (   R   t   __init__R!   R   t   delattrt   AttributeErrort   Nonet   _SSLv2_IF_EXISTSt   _DEFAULT_CIPHERSt   getpeernamet   socket_errort   errnot   ENOTCONNt   Falset
   _connectedt   _sslobjt   Truet   _sslt   sslwrapt   do_handshaket   keyfilet   certfilet	   cert_reqst   ssl_versiont   ca_certst   cipherst   do_handshake_on_connectt   suppress_ragged_eofst   _makefile_refs(   t   selft   sockR3   R4   t   server_sideR5   R6   R7   R9   R:   R8   t   attrt   e(    (    s   /usr/lib/python2.7/ssl.pyR"   j   sB    													i   c         C   sQ   y |  j  j | ƒ SWn6 t k
 rL } | j d t k rF |  j rF d S‚  n Xd S(   sO   Read up to LEN bytes and return them.
        Return zero-length string on EOF.i    t    N(   R.   t   readR   t   argsR   R:   (   R<   t   lent   x(    (    s   /usr/lib/python2.7/ssl.pyRB   š   s    c         C   s   |  j  j | ƒ S(   sh   Write DATA to the underlying SSL channel.  Returns
        number of bytes of DATA actually transmitted.(   R.   t   write(   R<   t   data(    (    s   /usr/lib/python2.7/ssl.pyRF   §   s    c         C   s   |  j  j | ƒ S(   sá   Returns a formatted version of the data in the
        certificate provided by the other end of the SSL channel.
        Return None if no certificate was provided, {} if a
        certificate was provided, but not validated.(   R.   t   peer_certificate(   R<   t   binary_form(    (    s   /usr/lib/python2.7/ssl.pyt   getpeercert®   s    c         C   s   |  j  s d  S|  j  j ƒ  Sd  S(   N(   R.   R%   t   cipher(   R<   (    (    s   /usr/lib/python2.7/ssl.pyRK   ·   s    	i    c         C   s³   |  j  rœ | d k r+ t d |  j ƒ ‚ n  x t r˜ y |  j  j | ƒ } WnD t k
 r } | j d t k rs d S| j d t k rŠ d S‚  q. X| Sq. Wn |  j	 j
 | | ƒ Sd  S(   Ni    s3   non-zero flags not allowed in calls to send() on %s(   R.   t
   ValueErrort	   __class__R/   RF   R   RC   R   R   R!   t   send(   R<   RG   t   flagst   vRE   (    (    s   /usr/lib/python2.7/ssl.pyRN   ¾   s     		c         C   sX   |  j  r t d |  j ƒ ‚ n5 | d  k r> |  j j | | ƒ S|  j j | | | ƒ Sd  S(   Ns%   sendto not allowed on instances of %s(   R.   RL   RM   R%   R!   t   sendto(   R<   RG   t   flags_or_addrt   addr(    (    s   /usr/lib/python2.7/ssl.pyRQ   Ó   s    	c         C   sˆ   |  j  rq | d k r+ t d |  j ƒ ‚ n  t | ƒ } d } x- | | k  rl |  j | | ƒ } | | 7} q@ W| St j |  | | ƒ Sd  S(   Ni    s6   non-zero flags not allowed in calls to sendall() on %s(   R.   RL   RM   RD   RN   R   t   sendall(   R<   RG   RO   t   amountt   countRP   (    (    s   /usr/lib/python2.7/ssl.pyRT   Ü   s    	c         C   sO   |  j  r8 | d k r+ t d |  j ƒ ‚ n  |  j | ƒ S|  j j | | ƒ Sd  S(   Ni    s3   non-zero flags not allowed in calls to recv() on %s(   R.   RL   RM   RB   R!   t   recv(   R<   t   buflenRO   (    (    s   /usr/lib/python2.7/ssl.pyRW   ë   s    	c         C   s¤   | r! | d  k r! t | ƒ } n | d  k r6 d } n  |  j rŠ | d k ra t d |  j ƒ ‚ n  |  j | ƒ } t | ƒ } | | | *| S|  j j | | | ƒ Sd  S(   Ni   i    s8   non-zero flags not allowed in calls to recv_into() on %s(   R%   RD   R.   RL   RM   RB   R!   t	   recv_into(   R<   t   buffert   nbytesRO   t
   tmp_bufferRP   (    (    s   /usr/lib/python2.7/ssl.pyRY   õ   s    		
c         C   s6   |  j  r t d |  j ƒ ‚ n |  j j | | ƒ Sd  S(   Ns'   recvfrom not allowed on instances of %s(   R.   RL   RM   R!   t   recvfrom(   R<   RX   RO   (    (    s   /usr/lib/python2.7/ssl.pyR]     s    	c         C   s9   |  j  r t d |  j ƒ ‚ n |  j j | | | ƒ Sd  S(   Ns,   recvfrom_into not allowed on instances of %s(   R.   RL   RM   R!   t   recvfrom_into(   R<   RZ   R[   RO   (    (    s   /usr/lib/python2.7/ssl.pyR^     s    	c         C   s   |  j  r |  j  j ƒ  Sd Sd  S(   Ni    (   R.   t   pending(   R<   (    (    s   /usr/lib/python2.7/ssl.pyR_     s    	c         C   s?   |  j  r% |  j  j ƒ  } d  |  _  | St d t |  ƒ ƒ ‚ d  S(   Ns   No SSL wrapper around (   R.   t   shutdownR%   RL   t   str(   R<   t   s(    (    s   /usr/lib/python2.7/ssl.pyt   unwrap  s
    		c         C   s   d  |  _ t j |  | ƒ d  S(   N(   R%   R.   R   R`   (   R<   t   how(    (    s   /usr/lib/python2.7/ssl.pyR`   "  s    	c         C   s;   |  j  d k  r( d  |  _ t j |  ƒ n |  j  d 8_  d  S(   Ni   (   R;   R%   R.   R   t   close(   R<   (    (    s   /usr/lib/python2.7/ssl.pyRe   &  s    	c         C   s   |  j  j ƒ  d S(   s   Perform a TLS/SSL handshake.N(   R.   R2   (   R<   (    (    s   /usr/lib/python2.7/ssl.pyR2   -  s    c      	   C   s½   |  j  r t d ƒ ‚ n  t j |  j t |  j |  j |  j |  j	 |  j
 |  j ƒ |  _ y* t j |  | ƒ |  j r} |  j ƒ  n  Wn/ t k
 r¯ } | r | j Sd  |  _ | ‚ n Xt |  _  d S(   Ns/   attempt to connect already-connected SSLSocket!i    (   R-   RL   R0   R1   R!   R,   R3   R4   R5   R6   R7   R8   R.   R   t   connectR9   R2   R)   R*   R%   R/   (   R<   RS   t   return_errnoR@   (    (    s   /usr/lib/python2.7/ssl.pyt   _real_connect3  s     			
	c         C   s   |  j  | t ƒ d S(   sQ   Connects to remote ADDR, and then wraps the connection in
        an SSL channel.N(   Rh   R,   (   R<   RS   (    (    s   /usr/lib/python2.7/ssl.pyRf   H  s    c         C   s   |  j  | t ƒ S(   sQ   Connects to remote ADDR, and then wraps the connection in
        an SSL channel.(   Rh   R/   (   R<   RS   (    (    s   /usr/lib/python2.7/ssl.pyt
   connect_exM  s    c         C   ss   t  j |  ƒ \ } } t | d |  j d |  j d t d |  j d |  j d |  j d |  j	 d |  j
 d	 |  j ƒ	| f S(
   s¿   Accepts a new connection from a remote client, and returns
        a tuple containing that new connection wrapped with a server-side
        SSL channel, and the address of the remote client.R3   R4   R>   R5   R6   R7   R8   R9   R:   (   R   t   acceptR    R3   R4   R/   R5   R6   R7   R8   R9   R:   (   R<   t   newsockRS   (    (    s   /usr/lib/python2.7/ssl.pyRj   R  s    									t   riÿÿÿÿc         C   s%   |  j  d 7_  t |  | | d t ƒS(   s   Make and return a file-like object that
        works with the SSL connection.  Just use the code
        from the socket module.i   Re   (   R;   R   R/   (   R<   t   modet   bufsize(    (    s   /usr/lib/python2.7/ssl.pyt   makefilee  s    N(   t   __name__t
   __module__t   __doc__R%   R,   R   R   R/   R"   RB   RF   RJ   RK   RN   RQ   RT   RW   RY   R]   R^   R_   Rc   R`   Re   R2   Rh   Rf   Ri   Rj   Ro   (    (    (    s   /usr/lib/python2.7/ssl.pyR    d   s6   ,				
									c
   
      C   s@   t  |  d | d | d | d | d | d | d | d | d	 |	 ƒ	S(
   NR3   R4   R>   R5   R6   R7   R9   R:   R8   (   R    (
   R=   R3   R4   R>   R5   R6   R7   R9   R:   R8   (    (    s   /usr/lib/python2.7/ssl.pyt   wrap_socketr  s    c         C   s%   d d l  } | j | j |  d ƒ ƒ S(   s¢   Takes a date-time string in standard ASN1_print form
    ("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
    a Python time value in seconds past the epoch.iÿÿÿÿNs   %b %d %H:%M:%S %Y GMT(   t   timet   mktimet   strptime(   t	   cert_timeRt   (    (    s   /usr/lib/python2.7/ssl.pyt   cert_time_to_seconds‚  s    s   -----BEGIN CERTIFICATE-----s   -----END CERTIFICATE-----c         C   sc   t  t d ƒ rB t j |  ƒ } t d t j | d ƒ d t d St d t j |  ƒ t d Sd S(   s[   Takes a certificate in binary DER format and returns the
    PEM version of it as a string.t   standard_b64encodes   
i@   N(   t   hasattrt   base64Ry   t
   PEM_HEADERt   textwrapt   fillt
   PEM_FOOTERt   encodestring(   t   der_cert_bytest   f(    (    s   /usr/lib/python2.7/ssl.pyt   DER_cert_to_PEM_certŽ  s    $c         C   sw   |  j  t ƒ s" t d t ƒ ‚ n  |  j ƒ  j t ƒ sJ t d t ƒ ‚ n  |  j ƒ  t t ƒ t t ƒ !} t j | ƒ S(   sh   Takes a certificate in ASCII PEM format and returns the
    DER-encoded version of it as a byte sequences(   Invalid PEM encoding; must start with %ss&   Invalid PEM encoding; must end with %s(	   t
   startswithR|   RL   t   stript   endswithR   RD   R{   t   decodestring(   t   pem_cert_stringt   d(    (    s   /usr/lib/python2.7/ssl.pyt   PEM_cert_to_DER_certž  s     c         C   sx   |  \ } } | d k	 r! t } n t } t t ƒ  d | d | d | ƒ} | j |  ƒ | j t ƒ } | j ƒ  t	 | ƒ S(   s÷   Retrieve the certificate from the server at the specified address,
    and return it as a PEM-encoded string.
    If 'ca_certs' is specified, validate the server cert against it.
    If 'ssl_version' is specified, use it in the connection attempt.R6   R5   R7   N(
   R%   R   R   Rs   R   Rf   RJ   R/   Re   Rƒ   (   RS   R6   R7   t   hostt   portR5   Rb   t   dercert(    (    s   /usr/lib/python2.7/ssl.pyt   get_server_certificate¬  s    	
c         C   s   t  j |  d ƒ S(   Ns	   <unknown>(   t   _PROTOCOL_NAMESt   get(   t   protocol_code(    (    s   /usr/lib/python2.7/ssl.pyt   get_protocol_name¿  s    c         C   sl   t  |  d ƒ r |  j }  n  t j |  d | | t t d ƒ } y |  j ƒ  Wn t k
 r] n X| j	 ƒ  | S(   sŒ   A replacement for the old socket.ssl function.  Designed
    for compability with Python 2.5 and earlier.  Will disappear in
    Python 3.0.R!   i    N(
   Rz   R!   R0   R1   R   R   R%   R(   R)   R2   (   R=   R3   R4   t   ssl_sock(    (    s   /usr/lib/python2.7/ssl.pyt   sslwrap_simpleÅ  s    
(4   Rr   R}   R0   R    R   R   R   R   R   R   R   R   R	   R
   R   R   R   R   R   R   R   R   R   R   R   R   R   R&   t   ImportErrorR%   R   R   R   R   R)   R   t   _getnameinfoR{   R*   R'   R    R,   R/   Rs   Rx   R|   R   Rƒ   RŠ   RŽ   R’   R”   (    (    (    s   /usr/lib/python2.7/ssl.pyt   <module>8   sL   @




"ÿ 					