B
    u9a              
   @   s  d dl Z d dlZd dlmZ d dlmZmZm	Z
 d dlZd dlmZmZmZ d dlmZmZmZ d dlmZmZmZmZmZmZmZ d dlmZmZ d dlmZmZmZm Z  yd d	lm!Z! W n e"k
r   Y nX d d
lm#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z, d dlm-Z-m.Z. ej/de0dd ed e
j/de0dd ed ej/de0dd ed ej/de0dd ed e
j/de0dd ed ej/de0dd ed e1j2 Z3e1_3dd e1j45 D Z6e7e1ddZ8G dd deZ9e j:dkrd d lm;Z;m<Z< d d!l=m=Z=m>Z>m?Z?m@Z@ d d"l=mAZAmBZB d dl=ZCd dlDZDd dlEZEd dlFZFeGZHd#gZIeJed$ZKe-ZLeZMd%d& ZNd'd( ZOd)d* ZPd+d, ZQed-d.ZRd/d0 ZSG d1d2 d2ed2d3ZTG d4d5 d5eTeZUG d6d7 d7eZVeUjWfdddd8d9d:ZXe2feYd;eUjWdddddd<d=d>ZZeXZ[eZZ\G d?d@ d@Z]dAdB Z^G dCdD dDe=Z_e_eV_`e]eV_addd;eYe2ddEdEdf	dFdGZbdHdI ZcdJZddKZedLdM ZfdNdO Zge2dfdPdQZhdRdS ZidS )T    N)
namedtuple)EnumIntEnumIntFlag)OPENSSL_VERSION_NUMBEROPENSSL_VERSION_INFOOPENSSL_VERSION)_SSLContext	MemoryBIO
SSLSession)SSLErrorSSLZeroReturnErrorSSLWantReadErrorSSLWantWriteErrorSSLSyscallErrorSSLEOFErrorSSLCertVerificationError)txt2objnid2obj)RAND_statusRAND_add
RAND_bytesRAND_pseudo_bytes)RAND_egd)
HAS_SNIHAS_ECDHHAS_NPNHAS_ALPN	HAS_SSLv2	HAS_SSLv3	HAS_TLSv1HAS_TLSv1_1HAS_TLSv1_2HAS_TLSv1_3)_DEFAULT_CIPHERS_OPENSSL_API_VERSION
_SSLMethodc             C   s   |  do| dkS )NZ	PROTOCOL_PROTOCOL_SSLv23)
startswith)name r*   /usr/lib/python3.7/ssl.py<lambda>|       r,   )sourceOptionsc             C   s
   |  dS )NZOP_)r(   )r)   r*   r*   r+   r,      r-   ZAlertDescriptionc             C   s
   |  dS )NZALERT_DESCRIPTION_)r(   )r)   r*   r*   r+   r,      r-   ZSSLErrorNumberc             C   s
   |  dS )NZ
SSL_ERROR_)r(   )r)   r*   r*   r+   r,      r-   VerifyFlagsc             C   s
   |  dS )NZVERIFY_)r(   )r)   r*   r*   r+   r,      r-   
VerifyModec             C   s
   |  dS )NZCERT_)r(   )r)   r*   r*   r+   r,      r-   c             C   s   i | ]\}}||qS r*   r*   ).0r)   valuer*   r*   r+   
<dictcomp>   s    r4   ZPROTOCOL_SSLv2c               @   s6   e Zd ZejZejZejZ	ej
ZejZejZejZdS )
TLSVersionN)__name__
__module____qualname___sslZPROTO_MINIMUM_SUPPORTEDZMINIMUM_SUPPORTEDZPROTO_SSLv3SSLv3ZPROTO_TLSv1ZTLSv1ZPROTO_TLSv1_1ZTLSv1_1ZPROTO_TLSv1_2ZTLSv1_2ZPROTO_TLSv1_3ZTLSv1_3ZPROTO_MAXIMUM_SUPPORTEDZMAXIMUM_SUPPORTEDr*   r*   r*   r+   r5      s   r5   win32)enum_certificates	enum_crls)socketAF_INETSOCK_STREAMcreate_connection)
SOL_SOCKETSO_TYPEz
tls-uniqueHOSTFLAG_NEVER_CHECK_SUBJECTc             C   s   | sdS |  d}|s&|  | kS |dkr<td| | d\}}}d|krbtd| |sttd| |dkrtd| |d\}}}|r|sdS | | kS )	NF*   z1too many wildcards in certificate DNS name: {!r}..z9wildcard can only be present in the leftmost label: {!r}.z>sole wildcard without additional labels are not support: {!r}.z<partial wildcards in leftmost label are not supported: {!r}.)countlowerCertificateErrorformat	partition)ZdnhostnameZ	wildcardsZdn_leftmostsepZdn_remainderZhostname_leftmostZhostname_remainderr*   r*   r+   _dnsname_match   s2    

rO   c             C   s   yt | }W n tk
r"   Y n"X t || kr6|S td| yt t j| S  tk
rt   td| Y n tk
r   Y nX td| d S )Nz'{!r} is not a quad-dotted IPv4 address.z+{!r} is neither an IPv4 nor an IP6 address.z{!r} is not an IPv4 address.)	_socketZ	inet_atonOSErrorZ	inet_ntoa
ValueErrorrK   Z	inet_ptonZAF_INET6AttributeError)Zipnameaddrr*   r*   r+   _inet_paton   s     rU   c             C   s   t |  }||kS )N)rU   rstrip)Zcert_ipaddresshost_ipZipr*   r*   r+   _ipaddress_match  s    rX   c             C   sN  | st dyt|}W n t k
r0   d }Y nX g }| dd}xb|D ]Z\}}|dkrz|d krnt||rnd S || qH|dkrH|d k	rt||rd S || qHW |sxF| ddD ]6}x0|D ](\}}|dkrt||rd S || qW qW t|dkrtd	|d
t	t
|f n,t|dkrBtd||d f ntdd S )Nztempty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDZsubjectAltNamer*   ZDNSz
IP AddressZsubjectZ
commonNamerF   z&hostname %r doesn't match either of %sz, zhostname %r doesn't match %rr   z=no appropriate commonName or subjectAltName fields were found)rR   rU   getrO   appendrX   lenrJ   joinmaprepr)certrM   rW   ZdnsnamesZsankeyr3   subr*   r*   r+   match_hostname  s>    

rb   DefaultVerifyPathszQcafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathc              C   sd   t  } tj| d | d }tj| d | d }ttj|rF|nd tj|rX|nd f|  S )Nr   rF         )	r9   get_default_verify_pathsosenvironrY   rc   pathisfileisdir)partscafilecapathr*   r*   r+   rf   \  s    rf   c                   s@   e Zd ZdZ fddZe fddZe fddZ  ZS )_ASN1Objectr*   c                s   t  j| ft|dd S )NF)r)   )super__new___txt2obj)clsoid)	__class__r*   r+   rq   o  s    z_ASN1Object.__new__c                s   t  j| ft| S )N)rp   rq   _nid2obj)rs   Znid)ru   r*   r+   fromnidr  s    z_ASN1Object.fromnidc                s   t  j| ft|dd S )NT)r)   )rp   rq   rr   )rs   r)   )ru   r*   r+   fromnamex  s    z_ASN1Object.fromname)	r6   r7   r8   	__slots__rq   classmethodrw   rx   __classcell__r*   r*   )ru   r+   ro   j  s   ro   znid shortname longname oidc               @   s   e Zd ZdZdZdS )Purposez1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2N)r6   r7   r8   SERVER_AUTHZCLIENT_AUTHr*   r*   r*   r+   r|     s   r|   c                   sj  e Zd ZdZdZdZefddZdd Zd.d	d
Z	d/ddZ
dd Zdd Zdd Zdd ZejfddZeedre fddZej fddZe fddZej fddZe fddZej fd dZeed!red"d# Zejd$d# Zned%d# Ze fd&d'Ze fd(d)Zej fd*d)Ze fd+d,Zej fd-d,Z  ZS )0
SSLContext)ZCAZROOTNc             O   s   t | |}|S )N)r	   rq   )rs   protocolargskwargsselfr*   r*   r+   rq     s    zSSLContext.__new__c             C   s4   |d krd S t |tr&|ddS |dS d S )NZidnaascii)
isinstancestrencodedecode)r   rM   r*   r*   r+   _encode_hostname  s
    
zSSLContext._encode_hostnameFTc          	   C   s   | j j|||||| |dS )N)sockserver_sidedo_handshake_on_connectsuppress_ragged_eofsserver_hostnamecontextsession)sslsocket_class_create)r   r   r   r   r   r   r   r*   r*   r+   wrap_socket  s    zSSLContext.wrap_socketc             C   s   | j j|||| ||| dS )N)r   r   r   r   )sslobject_classr   r   )r   incomingoutgoingr   r   r   r*   r*   r+   wrap_bio  s    zSSLContext.wrap_bioc             C   sd   t  }xN|D ]F}t|d}t|dks2t|dkr:td|t| || qW | | d S )Nr   r      z(NPN protocols must be 1 to 255 in length)	bytearraybytesr[   r   rZ   extendZ_set_npn_protocols)r   Znpn_protocolsprotosr   br*   r*   r+   set_npn_protocols  s    

zSSLContext.set_npn_protocolsc                s8   d krd  _ n$ts td fdd}| _ d S )Nznot a callable objectc                s     |}| ||S )N)r   )sslobjZ
servernameZsslctx)r   server_name_callbackr*   r+   shim_cb  s    
z3SSLContext.set_servername_callback.<locals>.shim_cb)Zsni_callbackcallable	TypeError)r   r   r   r*   )r   r   r+   set_servername_callback  s    z"SSLContext.set_servername_callbackc             C   sd   t  }xN|D ]F}t|d}t|dks2t|dkr:td|t| || qW | | d S )Nr   r   r   z)ALPN protocols must be 1 to 255 in length)r   r   r[   r   rZ   r   Z_set_alpn_protocols)r   Zalpn_protocolsr   r   r   r*   r*   r+   set_alpn_protocols  s    

zSSLContext.set_alpn_protocolsc             C   sz   t  }y@x:t|D ].\}}}|dkr|dks6|j|kr|| qW W n tk
rd   td Y nX |rv| j|d |S )NZx509_asnTz-unable to enumerate Windows certificate store)cadata)r   r<   rt   r   PermissionErrorwarningswarnload_verify_locations)r   	storenamepurposeZcertsr_   encodingZtrustr*   r*   r+   _load_windows_store_certs  s    z$SSLContext._load_windows_store_certsc             C   sD   t |tst|tjdkr8x| jD ]}| || q$W |   d S )Nr;   )r   ro   r   sysplatform_windows_cert_storesr   Zset_default_verify_paths)r   r   r   r*   r*   r+   load_default_certs  s    

zSSLContext.load_default_certsminimum_versionc                s   t t jS )N)r5   rp   r   )r   )ru   r*   r+   r     s    zSSLContext.minimum_versionc                s4   |t jkr|  jtj M  _tttj| | d S )N)	r5   r:   optionsr/   ZOP_NO_SSLv3rp   r~   r   __set__)r   r3   )ru   r*   r+   r     s    
c                s   t t jS )N)r5   rp   maximum_version)r   )ru   r*   r+   r     s    zSSLContext.maximum_versionc                s   t ttj| | d S )N)rp   r~   r   r   )r   r3   )ru   r*   r+   r     s    c                s   t t jS )N)r/   rp   r   )r   )ru   r*   r+   r      s    zSSLContext.optionsc                s   t ttj| | d S )N)rp   r~   r   r   )r   r3   )ru   r*   r+   r     s    rD   c             C   s   | j tj@ }|tjkS )N)_host_flagsr9   rD   )r   Zncsr*   r*   r+   hostname_checks_common_name	  s    z&SSLContext.hostname_checks_common_namec             C   s,   |r|  j tj M  _ n|  j tjO  _ d S )N)r   r9   rD   )r   r3   r*   r*   r+   r     s    c             C   s   dS )NTr*   )r   r*   r*   r+   r     s    c                s   t t jS )N)r&   rp   r   )r   )ru   r*   r+   r     s    zSSLContext.protocolc                s   t t jS )N)r0   rp   verify_flags)r   )ru   r*   r+   r     s    zSSLContext.verify_flagsc                s   t ttj| | d S )N)rp   r~   r   r   )r   r3   )ru   r*   r+   r   !  s    c                s*   t  j}yt|S  tk
r$   |S X d S )N)rp   verify_moder1   rR   )r   r3   )ru   r*   r+   r   %  s
    zSSLContext.verify_modec                s   t ttj| | d S )N)rp   r~   r   r   )r   r3   )ru   r*   r+   r   -  s    )FTTNN)FNN)r6   r7   r8   r   r   r   PROTOCOL_TLSrq   r   r   r   r   r   r   r   r|   r}   r   hasattrr	   propertyr   setterr   r   r9   r   r   r   r   r{   r*   r*   )ru   r+   r~     s@      
 
	
r~   )rm   rn   r   c            C   sd   t | tst| tt}| tjkr0t|_d|_	|s<|s<|rL|
||| n|jtkr`||  |S )NT)r   ro   r   r~   r   r|   r}   CERT_REQUIREDr   check_hostnamer   	CERT_NONEr   )r   rm   rn   r   r   r*   r*   r+   create_default_context2  s    



r   F)	cert_reqsr   r   certfilekeyfilerm   rn   r   c      
      C   s   t |tst|t| }	|s$d|	_|d k	r2||	_|r<d|	_|rL|sLtd|sT|r`|	|| |sl|sl|r||	||| n|	jt	kr|	
| |	S )NFTzcertfile must be specified)r   ro   r   r~   r   r   rR   load_cert_chainr   r   r   )
r   r   r   r   r   r   rm   rn   r   r   r*   r*   r+   _create_unverified_contextP  s$    


r   c               @   s   e Zd Zdd Zed1ddZedd Zejd	d Zed
d Z	e	jdd Z	edd Z
edd Zedd Zd2ddZdd Zd3ddZdd Zdd Zdd Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd4d+d,Zd-d. Zd/d0 ZdS )5	SSLObjectc             O   s   t | jj dd S )NzU does not have a public constructor. Instances are returned by SSLContext.wrap_bio().)r   ru   r6   )r   r   r   r*   r*   r+   __init__  s    zSSLObject.__init__FNc       	      C   s*   |  | }|j||||||d}||_|S )N)r   r   ownerr   )rq   Z	_wrap_bio_sslobj)	rs   r   r   r   r   r   r   r   r   r*   r*   r+   r     s    

zSSLObject._createc             C   s   | j jS )N)r   r   )r   r*   r*   r+   r     s    zSSLObject.contextc             C   s   || j _d S )N)r   r   )r   ctxr*   r*   r+   r     s    c             C   s   | j jS )N)r   r   )r   r*   r*   r+   r     s    zSSLObject.sessionc             C   s   || j _d S )N)r   r   )r   r   r*   r*   r+   r     s    c             C   s   | j jS )N)r   session_reused)r   r*   r*   r+   r     s    zSSLObject.session_reusedc             C   s   | j jS )N)r   r   )r   r*   r*   r+   r     s    zSSLObject.server_sidec             C   s   | j jS )N)r   r   )r   r*   r*   r+   r     s    zSSLObject.server_hostname   c             C   s(   |d k	r| j ||}n| j |}|S )N)r   read)r   r[   buffervr*   r*   r+   r     s    zSSLObject.readc             C   s   | j |S )N)r   write)r   datar*   r*   r+   r     s    zSSLObject.writec             C   s   | j |S )N)r   getpeercert)r   binary_formr*   r*   r+   r     s    zSSLObject.getpeercertc             C   s   t jr| j S d S )N)r9   r   r   selected_npn_protocol)r   r*   r*   r+   r     s    zSSLObject.selected_npn_protocolc             C   s   t jr| j S d S )N)r9   r   r   selected_alpn_protocol)r   r*   r*   r+   r     s    z SSLObject.selected_alpn_protocolc             C   s
   | j  S )N)r   cipher)r   r*   r*   r+   r     s    zSSLObject.cipherc             C   s
   | j  S )N)r   shared_ciphers)r   r*   r*   r+   r     s    zSSLObject.shared_ciphersc             C   s
   | j  S )N)r   compression)r   r*   r*   r+   r     s    zSSLObject.compressionc             C   s
   | j  S )N)r   pending)r   r*   r*   r+   r      s    zSSLObject.pendingc             C   s   | j   d S )N)r   do_handshake)r   r*   r*   r+   r     s    zSSLObject.do_handshakec             C   s
   | j  S )N)r   shutdown)r   r*   r*   r+   unwrap  s    zSSLObject.unwrap
tls-uniquec             C   s   | j |S )N)r   get_channel_binding)r   cb_typer*   r*   r+   r     s    zSSLObject.get_channel_bindingc             C   s
   | j  S )N)r   version)r   r*   r*   r+   r     s    zSSLObject.versionc             C   s
   | j  S )N)r   verify_client_post_handshake)r   r*   r*   r+   r     s    z&SSLObject.verify_client_post_handshake)FNNN)r   N)F)r   )r6   r7   r8   r   rz   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r*   r*   r*   r+   r     s2    


	
r   c             C   s   t t| jj| _| S )N)getattrr   r6   __doc__)funcr*   r*   r+   _sslcopydoc  s    r   c                   s   e Zd Zdd ZedW fdd	Zeedd	 Zej	d
d	 Zeedd Z
e
j	dd Z
eedd Zdd ZdXddZdd ZdYddZdd ZedZddZedd Zedd  Zed!d" Zed#d$ Zed%d& Zd[ fd(d)	Zd\ fd*d+	Zd,d- Zd] fd.d/	Zd^ fd0d1	Zd_ fd2d3	Zd` fd4d5	Zda fd6d7	Zdb fd8d9	Zd:d; Z d<d= Z!ed>d? Z" fd@dAZ#edBdC Z$edDdE Z% fdFdGZ&edcdHdIZ' fdJdKZ(dLdM Z)dNdO Z* fdPdQZ+edddSdTZ,edUdV Z-  Z.S )e	SSLSocketc             O   s   t | jj dd S )NzX does not have a public constructor. Instances are returned by SSLContext.wrap_socket().)r   ru   r6   )r   r   r   r*   r*   r+   r   &  s    zSSLSocket.__init__FTNc          
      s  | tttkrtd|r8|r(td|d k	r8td|jrJ|sJtdt|j|j	|j
| d}| j| f|}	tt|	jf | |	|  |  ||	_||	_d|	_d |	_||	_|||	_||	_||	_y|	  W n6 tk
r }
 z|
jtjkr d}W d d }
~
X Y nX d}||	_ |ryH|	jj!|	||	j|	|	jd|	_|rj|	 }|d	krbtd
|	"  W n$ ttfk
r   |	#   Y nX |	S )Nz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)familytypeprotofilenoFT)r   r   g        zHdo_handshake_on_connect should not be specified for non-blocking sockets)$Z
getsockoptrB   rC   r@   NotImplementedErrorrR   r   dictr   r   r   r   rq   rp   r   r   
settimeout
gettimeoutdetach_context_sessionZ_closedr   r   r   r   r   r   getpeernamerQ   errnoZENOTCONN
_connected_wrap_socketr   close)rs   r   r   r   r   r   r   r   r   r   eZ	connectedtimeout)ru   r*   r+   r   -  s\    

zSSLSocket._createc             C   s   | j S )N)r   )r   r*   r*   r+   r   l  s    zSSLSocket.contextc             C   s   || _ || j_d S )N)r   r   r   )r   r   r*   r*   r+   r   q  s    c             C   s   | j d k	r| j jS d S )N)r   r   )r   r*   r*   r+   r   v  s    
zSSLSocket.sessionc             C   s   || _ | jd k	r|| j_d S )N)r   r   r   )r   r   r*   r*   r+   r   |  s    
c             C   s   | j d k	r| j jS d S )N)r   r   )r   r*   r*   r+   r     s    
zSSLSocket.session_reusedc             C   s   t d| jj d S )NzCan't dup() %s instances)r   ru   r6   )r   r*   r*   r+   dup  s    zSSLSocket.dupc             C   s   d S )Nr*   )r   msgr*   r*   r+   _checkClosed  s    zSSLSocket._checkClosedc             C   s   | j s|   d S )N)r   r   )r   r*   r*   r+   _check_connected  s    zSSLSocket._check_connected   c          
   C   s   |    | jd krtdy&|d k	r2| j||S | j|S W nJ tk
r } z,|jd tkrx| jrx|d k	rrdS dS n W d d }~X Y nX d S )Nz'Read on closed or unwrapped SSL socket.r   r-   )r   r   rR   r   r   r   ZSSL_ERROR_EOFr   )r   r[   r   xr*   r*   r+   r     s    
zSSLSocket.readc             C   s&   |    | jd krtd| j|S )Nz(Write on closed or unwrapped SSL socket.)r   r   rR   r   )r   r   r*   r*   r+   r     s    
zSSLSocket.writec             C   s   |    |   | j|S )N)r   r   r   r   )r   r   r*   r*   r+   r     s    zSSLSocket.getpeercertc             C   s*   |    | jd kstjsd S | j S d S )N)r   r   r9   r   r   )r   r*   r*   r+   r     s    zSSLSocket.selected_npn_protocolc             C   s*   |    | jd kstjsd S | j S d S )N)r   r   r9   r   r   )r   r*   r*   r+   r     s    z SSLSocket.selected_alpn_protocolc             C   s$   |    | jd krd S | j S d S )N)r   r   r   )r   r*   r*   r+   r     s    
zSSLSocket.cipherc             C   s$   |    | jd krd S | j S d S )N)r   r   r   )r   r*   r*   r+   r     s    
zSSLSocket.shared_ciphersc             C   s$   |    | jd krd S | j S d S )N)r   r   r   )r   r*   r*   r+   r     s    
zSSLSocket.compressionr   c                sF   |    | jd k	r4|dkr(td| j | j|S t ||S d S )Nr   z3non-zero flags not allowed in calls to send() on %s)r   r   rR   ru   r   rp   send)r   r   flags)ru   r*   r+   r     s    

zSSLSocket.sendc                sL   |    | jd k	r"td| j n&|d kr8t ||S t |||S d S )Nz%sendto not allowed on instances of %s)r   r   rR   ru   rp   sendto)r   r   Zflags_or_addrrT   )ru   r*   r+   r    s    
zSSLSocket.sendtoc             O   s   t d| j d S )Nz&sendmsg not allowed on instances of %s)r   ru   )r   r   r   r*   r*   r+   sendmsg  s    zSSLSocket.sendmsgc          
      s   |    | jd k	r|dkr(td| j d}t|L}|d6}t|}x&||k rp| ||d  }||7 }qLW W d Q R X W d Q R X nt 	||S d S )Nr   z6non-zero flags not allowed in calls to sendall() on %sB)
r   r   rR   ru   
memoryviewcastr[   r   rp   sendall)r   r   r  rH   ZviewZ	byte_viewamountr   )ru   r*   r+   r    s    


"zSSLSocket.sendallc                s,   | j d k	r| |||S t |||S d S )N)r   Z_sendfile_use_sendrp   sendfile)r   fileoffsetrH   )ru   r*   r+   r	    s    
zSSLSocket.sendfilec                sD   |    | jd k	r2|dkr(td| j | |S t ||S d S )Nr   z3non-zero flags not allowed in calls to recv() on %s)r   r   rR   ru   r   rp   recv)r   buflenr  )ru   r*   r+   r    s    


zSSLSocket.recvc                sj   |    |r|d krt|}n|d kr*d}| jd k	rV|dkrJtd| j | ||S t |||S d S )Ni   r   z8non-zero flags not allowed in calls to recv_into() on %s)r   r[   r   rR   ru   r   rp   	recv_into)r   r   nbytesr  )ru   r*   r+   r  $  s    


zSSLSocket.recv_intoc                s4   |    | jd k	r"td| j nt ||S d S )Nz'recvfrom not allowed on instances of %s)r   r   rR   ru   rp   recvfrom)r   r  r  )ru   r*   r+   r  3  s
    
zSSLSocket.recvfromc                s6   |    | jd k	r"td| j nt |||S d S )Nz,recvfrom_into not allowed on instances of %s)r   r   rR   ru   rp   recvfrom_into)r   r   r  r  )ru   r*   r+   r  ;  s
    
zSSLSocket.recvfrom_intoc             O   s   t d| j d S )Nz&recvmsg not allowed on instances of %s)r   ru   )r   r   r   r*   r*   r+   recvmsgC  s    zSSLSocket.recvmsgc             O   s   t d| j d S )Nz+recvmsg_into not allowed on instances of %s)r   ru   )r   r   r   r*   r*   r+   recvmsg_intoG  s    zSSLSocket.recvmsg_intoc             C   s$   |    | jd k	r| j S dS d S )Nr   )r   r   r   )r   r*   r*   r+   r   K  s    

zSSLSocket.pendingc                s   |    d | _t | d S )N)r   r   rp   r   )r   Zhow)ru   r*   r+   r   S  s    zSSLSocket.shutdownc             C   s.   | j r| j  }d | _ |S tdt|  d S )NzNo SSL wrapper around )r   r   rR   r   )r   sr*   r*   r+   r   X  s
    
zSSLSocket.unwrapc             C   s$   | j r| j  S tdt|  d S )NzNo SSL wrapper around )r   r   rR   r   )r   r*   r*   r+   r   a  s    
z&SSLSocket.verify_client_post_handshakec                s   d | _ t   d S )N)r   rp   _real_close)r   )ru   r*   r+   r  h  s    zSSLSocket._real_closec          	   C   sF   |    |  }z$|dkr(|r(| d  | j  W d | | X d S )Ng        )r   r   r   r   r   )r   blockr   r*   r*   r+   r   l  s    
zSSLSocket.do_handshakec          	      s   | j rtd| js| jd k	r&td| jj| d| j| | jd| _y>|rVt 	|}nd }t 
| |s~d| _| jr~|   |S  ttfk
r   d | _ Y nX d S )Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!F)r   r   T)r   rR   r   r   r   r   r   r   rp   
connect_exconnectr   r   rQ   )r   rT   r  Zrc)ru   r*   r+   _real_connectw  s(    zSSLSocket._real_connectc             C   s   |  |d d S )NF)r  )r   rT   r*   r*   r+   r    s    zSSLSocket.connectc             C   s   |  |dS )NT)r  )r   rT   r*   r*   r+   r    s    zSSLSocket.connect_exc                s.   t   \}}| jj|| j| jdd}||fS )NT)r   r   r   )rp   acceptr   r   r   r   )r   ZnewsockrT   )ru   r*   r+   r    s    zSSLSocket.accept
tls-uniquec             C   s4   | j d k	r| j |S |tkr,td|d S d S )Nz({0} channel binding type not implemented)r   r   CHANNEL_BINDING_TYPESrR   rK   )r   r   r*   r*   r+   r     s    
zSSLSocket.get_channel_bindingc             C   s   | j d k	r| j  S d S d S )N)r   r   )r   r*   r*   r+   r     s    

zSSLSocket.version)FTTNNN)N)r   N)F)r   )N)r   )r   N)r   r   )Nr   )r   r   )Nr   )F)r  )/r6   r7   r8   r   rz   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r  r  r  r	  r  r  r  r  r  r  r   r   r   r   r  r   r  r  r  r  r   r   r{   r*   r*   )ru   r+   r   !  sd     <

	

	

r   Tc
             C   sl   |r|st d|r |s t dt|}
||
_|r<|
| |rL|
|| |	rZ|
|	 |
j| |||dS )Nz5certfile must be specified for server-side operationszcertfile must be specified)r   r   r   r   )rR   r~   r   r   r   Zset_ciphersr   )r   r   r   r   r   ssl_versionca_certsr   r   Zciphersr   r*   r*   r+   r     s     

r   c             C   s   ddl m} ddlm} d}d}y|| d d  d }W n$ tk
rb   td| |f Y n0X || dd  |}||d |f|d	d
  S d S )Nr   )strptime)timegm)ZJanZFebZMarZAprZMayZJunZJulZAugZSepZOctZNovZDecz %d %H:%M:%S %Y GMTre   rF   z*time data %r does not match format "%%b%s"rd      )Ztimer  Zcalendarr   indextitlerR   )Z	cert_timer  r   ZmonthsZtime_formatZmonth_numberttr*   r*   r+   cert_time_to_seconds  s    
r%  z-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----c                sR   t t| dd tg}| fddtdt dD 7 }|td  d|S )NASCIIstrictc                s   g | ]} ||d   qS )@   r*   )r2   i)fr*   r+   
<listcomp>  s    z(DER_cert_to_PEM_cert.<locals>.<listcomp>r   r(  
)	r   base64Zstandard_b64encode
PEM_HEADERranger[   rZ   
PEM_FOOTERr\   )Zder_cert_bytesssr*   )r*  r+   DER_cert_to_PEM_cert  s
    "r2  c             C   s\   |  tstdt |  ts0tdt |  tttt  }t|	ddS )Nz(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %sr&  r'  )
r(   r.  rR   stripendswithr0  r[   r-  Zdecodebytesr   )Zpem_cert_stringdr*   r*   r+   PEM_cert_to_DER_cert  s    
r6  c       
   
   C   sd   | \}}|d k	rt }nt}t|||d}t| &}||}|d}	W d Q R X W d Q R X t|	S )N)r   rm   T)r   r   _create_stdlib_contextrA   r   r   r2  )
rT   r  r  ZhostZportr   r   r   ZsslsockZdercertr*   r*   r+   get_server_certificate  s    
r8  c             C   s   t | dS )Nz	<unknown>)_PROTOCOL_NAMESrY   )Zprotocol_coder*   r*   r+   get_protocol_name&  s    r:  )jr   rg   collectionsr   enumr   Z_Enumr   Z_IntEnumr   Z_IntFlagr9   r   r   r   r	   r
   r   r   r   r   r   r   r   r   r   rr   r   rv   r   r   r   r   r   ImportErrorr   r   r   r   r   r   r    r!   r"   r#   r$   r%   _convertr6   r&   r   r'   __members__itemsr9  r   Z_SSLv2_IF_EXISTSr5   r   r<   r=   r>   r?   r@   rA   rB   rC   rP   r-  r   r   rQ   Zsocket_errorr  r   ZHAS_NEVER_CHECK_COMMON_NAMEZ_RESTRICTED_SERVER_CIPHERSrJ   rO   rU   rX   rb   rc   rf   ro   r|   r~   r}   r   r   r   Z_create_default_https_contextr7  r   r   r   r   r   r   r%  r.  r0  r2  r6  r8  r:  r*   r*   r*   r+   <module>]   s   $0

1#9 -(    
