ó
6Þ	Pc        
   @   s  d  Z  d d l Z d d l Z d d l m Z m Z m Z d d l m Z d d l m Z m Z m	 Z	 d d l m
 Z
 m Z m Z d d l m Z m Z m Z m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z i d	 e 6d
 e 6d e 6Z y d d l m Z Wn e k
 r n Xd e e <d d l m Z m Z m Z m Z  d d l m! Z" d d l# Z# d d l$ Z$ d e f d „  ƒ  YZ% e& e& e' e e e& e( e( e& d „	 Z) d „  Z* d Z+ d Z, d „  Z- d „  Z. e e& d „ Z/ d „  Z0 e& e& d „ Z1 d S(   s  This module provides some more Pythonic support for SSL.

Object types:

  SSLSocket -- subtype of socket.socket which does SSL over the socket

Exceptions:

  SSLError -- exception raised for I/O errors

Functions:

  cert_time_to_seconds -- convert time string used for certificate
                          notBefore and notAfter functions to integer
                          seconds past the Epoch (the time values
                          returned from time.time())

  fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
                          by the server running on HOST at port PORT.  No
                          validation of the certificate is performed.

Integer constants:

SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT

SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE

The following group define certificate requirements that one side is
allowing/requiring from the other side:

CERT_NONE - no certificates from the other side are required (or will
            be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
                validated, and if validation fails, the connection will
                also fail
CERT_REQUIRED - certificates are required, and will be validated, and
                if validation fails, the connection will also fail

The following constants identify various SSL protocol variants:

PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLSv1
iÿÿÿÿN(   t   OPENSSL_VERSION_NUMBERt   OPENSSL_VERSION_INFOt   OPENSSL_VERSION(   t   SSLError(   t	   CERT_NONEt   CERT_OPTIONALt   CERT_REQUIRED(   t   RAND_statust   RAND_egdt   RAND_add(	   t   SSL_ERROR_ZERO_RETURNt   SSL_ERROR_WANT_READt   SSL_ERROR_WANT_WRITEt   SSL_ERROR_WANT_X509_LOOKUPt   SSL_ERROR_SYSCALLt   SSL_ERROR_SSLt   SSL_ERROR_WANT_CONNECTt   SSL_ERROR_EOFt   SSL_ERROR_INVALID_ERROR_CODE(   t   PROTOCOL_SSLv3t   PROTOCOL_SSLv23t   PROTOCOL_TLSv1t   TLSv1t   SSLv23t   SSLv3(   t   PROTOCOL_SSLv2t   SSLv2(   t   sockett   _fileobjectt   _delegate_methodst   error(   t   getnameinfot	   SSLSocketc        
   B   s  e  Z d  Z d d e e e d e e d d „	 Z d d „ Z	 d „  Z
 e d „ Z d „  Z d d „ Z d d	 „ Z d d
 „ Z d d d „ Z d d d „ Z d d d „ Z d d d „ Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d „  Z d d d „ Z RS(   sµ   This class implements a subtype of socket.socket that wraps
    the underlying OS socket in an SSL context when necessary, and
    provides read and write methods over that channel.c      
   C   sN  t  j |  d | j ƒx3 t D]+ } y t |  | ƒ Wq t k
 rG q Xq W| rb | rb | } n  y t  j |  ƒ Wn= t k
 r² } | j t j	 k r ‚  n  t
 |  _ d  |  _ nG Xt |  _ t j |  j | | | | | | |
 ƒ |  _ | rù |  j ƒ  n  | |  _ | |  _ | |  _ | |  _ | |  _ |
 |  _ | |  _ |	 |  _ d |  _ d  S(   Nt   _socki    (   R   t   __init__R!   R   t   delattrt   AttributeErrort   getpeernamet   socket_errort   errnot   ENOTCONNt   Falset
   _connectedt   Nonet   _sslobjt   Truet   _sslt   sslwrapt   do_handshaket   keyfilet   certfilet	   cert_reqst   ssl_versiont   ca_certst   cipherst   do_handshake_on_connectt   suppress_ragged_eofst   _makefile_refs(   t   selft   sockR1   R2   t   server_sideR3   R4   R5   R7   R8   R6   t   attrt   e(    (    s   /usr/lib/python2.7/ssl.pyR"   d   s>    												i   c         C   sQ   y |  j  j | ƒ SWn6 t k
 rL } | j d t k rF |  j rF d S‚  n Xd S(   sO   Read up to LEN bytes and return them.
        Return zero-length string on EOF.i    t    N(   R,   t   readR   t   argsR   R8   (   R:   t   lent   x(    (    s   /usr/lib/python2.7/ssl.pyR@   ‘   s    c         C   s   |  j  j | ƒ S(   sh   Write DATA to the underlying SSL channel.  Returns
        number of bytes of DATA actually transmitted.(   R,   t   write(   R:   t   data(    (    s   /usr/lib/python2.7/ssl.pyRD   ž   s    c         C   s   |  j  j | ƒ S(   sá   Returns a formatted version of the data in the
        certificate provided by the other end of the SSL channel.
        Return None if no certificate was provided, {} if a
        certificate was provided, but not validated.(   R,   t   peer_certificate(   R:   t   binary_form(    (    s   /usr/lib/python2.7/ssl.pyt   getpeercert¥   s    c         C   s   |  j  s d  S|  j  j ƒ  Sd  S(   N(   R,   R+   t   cipher(   R:   (    (    s   /usr/lib/python2.7/ssl.pyRI   ®   s    	i    c         C   s³   |  j  rœ | d k r+ t d |  j ƒ ‚ n  x t r˜ y |  j  j | ƒ } WnD t k
 r } | j d t k rs d S| j d t k rŠ d S‚  q. X| Sq. Wn |  j	 j
 | | ƒ Sd  S(   Ni    s3   non-zero flags not allowed in calls to send() on %s(   R,   t
   ValueErrort	   __class__R-   RD   R   RA   R   R   R!   t   send(   R:   RE   t   flagst   vRC   (    (    s   /usr/lib/python2.7/ssl.pyRL   µ   s     		c         C   sX   |  j  r t d |  j ƒ ‚ n5 | d  k r> |  j j | | ƒ S|  j j | | | ƒ Sd  S(   Ns%   sendto not allowed on instances of %s(   R,   RJ   RK   R+   R!   t   sendto(   R:   RE   t   flags_or_addrt   addr(    (    s   /usr/lib/python2.7/ssl.pyRO   Ê   s    	c         C   sˆ   |  j  rq | d k r+ t d |  j ƒ ‚ n  t | ƒ } d } x- | | k  rl |  j | | ƒ } | | 7} q@ W| St j |  | | ƒ Sd  S(   Ni    s6   non-zero flags not allowed in calls to sendall() on %s(   R,   RJ   RK   RB   RL   R   t   sendall(   R:   RE   RM   t   amountt   countRN   (    (    s   /usr/lib/python2.7/ssl.pyRR   Ó   s    	c         C   sO   |  j  r8 | d k r+ t d |  j ƒ ‚ n  |  j | ƒ S|  j j | | ƒ Sd  S(   Ni    s3   non-zero flags not allowed in calls to recv() on %s(   R,   RJ   RK   R@   R!   t   recv(   R:   t   buflenRM   (    (    s   /usr/lib/python2.7/ssl.pyRU   â   s    	c         C   s¤   | r! | d  k r! t | ƒ } n | d  k r6 d } n  |  j rŠ | d k ra t d |  j ƒ ‚ n  |  j | ƒ } t | ƒ } | | | *| S|  j j | | | ƒ Sd  S(   Ni   i    s8   non-zero flags not allowed in calls to recv_into() on %s(   R+   RB   R,   RJ   RK   R@   R!   t	   recv_into(   R:   t   buffert   nbytesRM   t
   tmp_bufferRN   (    (    s   /usr/lib/python2.7/ssl.pyRW   ì   s    		
c         C   s6   |  j  r t d |  j ƒ ‚ n |  j j | | ƒ Sd  S(   Ns'   recvfrom not allowed on instances of %s(   R,   RJ   RK   R!   t   recvfrom(   R:   RV   RM   (    (    s   /usr/lib/python2.7/ssl.pyR[   ý   s    	c         C   s9   |  j  r t d |  j ƒ ‚ n |  j j | | | ƒ Sd  S(   Ns,   recvfrom_into not allowed on instances of %s(   R,   RJ   RK   R!   t   recvfrom_into(   R:   RX   RY   RM   (    (    s   /usr/lib/python2.7/ssl.pyR\     s    	c         C   s   |  j  r |  j  j ƒ  Sd Sd  S(   Ni    (   R,   t   pending(   R:   (    (    s   /usr/lib/python2.7/ssl.pyR]     s    	c         C   s?   |  j  r% |  j  j ƒ  } d  |  _  | St d t |  ƒ ƒ ‚ d  S(   Ns   No SSL wrapper around (   R,   t   shutdownR+   RJ   t   str(   R:   t   s(    (    s   /usr/lib/python2.7/ssl.pyt   unwrap  s
    		c         C   s   d  |  _ t j |  | ƒ d  S(   N(   R+   R,   R   R^   (   R:   t   how(    (    s   /usr/lib/python2.7/ssl.pyR^     s    	c         C   s;   |  j  d k  r( d  |  _ t j |  ƒ n |  j  d 8_  d  S(   Ni   (   R9   R+   R,   R   t   close(   R:   (    (    s   /usr/lib/python2.7/ssl.pyRc     s    	c         C   s   |  j  j ƒ  d S(   s   Perform a TLS/SSL handshake.N(   R,   R0   (   R:   (    (    s   /usr/lib/python2.7/ssl.pyR0   $  s    c      	   C   s½   |  j  r t d ƒ ‚ n  t j |  j t |  j |  j |  j |  j	 |  j
 |  j ƒ |  _ y* t j |  | ƒ |  j r} |  j ƒ  n  Wn/ t k
 r¯ } | r | j Sd  |  _ | ‚ n Xt |  _  d S(   Ns/   attempt to connect already-connected SSLSocket!i    (   R*   RJ   R.   R/   R!   R)   R1   R2   R3   R4   R5   R6   R,   R   t   connectR7   R0   R&   R'   R+   R-   (   R:   RQ   t   return_errnoR>   (    (    s   /usr/lib/python2.7/ssl.pyt   _real_connect*  s     			
	c         C   s   |  j  | t ƒ d S(   sQ   Connects to remote ADDR, and then wraps the connection in
        an SSL channel.N(   Rf   R)   (   R:   RQ   (    (    s   /usr/lib/python2.7/ssl.pyRd   ?  s    c         C   s   |  j  | t ƒ S(   sQ   Connects to remote ADDR, and then wraps the connection in
        an SSL channel.(   Rf   R-   (   R:   RQ   (    (    s   /usr/lib/python2.7/ssl.pyt
   connect_exD  s    c         C   ss   t  j |  ƒ \ } } t | d |  j d |  j d t d |  j d |  j d |  j d |  j	 d |  j
 d	 |  j ƒ	| f S(
   s¿   Accepts a new connection from a remote client, and returns
        a tuple containing that new connection wrapped with a server-side
        SSL channel, and the address of the remote client.R1   R2   R<   R3   R4   R5   R6   R7   R8   (   R   t   acceptR    R1   R2   R-   R3   R4   R5   R6   R7   R8   (   R:   t   newsockRQ   (    (    s   /usr/lib/python2.7/ssl.pyRh   I  s    									t   riÿÿÿÿc         C   s%   |  j  d 7_  t |  | | d t ƒS(   s   Make and return a file-like object that
        works with the SSL connection.  Just use the code
        from the socket module.i   Rc   (   R9   R   R-   (   R:   t   modet   bufsize(    (    s   /usr/lib/python2.7/ssl.pyt   makefile\  s    N(   t   __name__t
   __module__t   __doc__R+   R)   R   R   R-   R"   R@   RD   RH   RI   RL   RO   RR   RU   RW   R[   R\   R]   Ra   R^   Rc   R0   Rf   Rd   Rg   Rh   Rm   (    (    (    s   /usr/lib/python2.7/ssl.pyR    ^   s6   )				
									c
   
      C   s@   t  |  d | d | d | d | d | d | d | d | d	 |	 ƒ	S(
   NR1   R2   R<   R3   R4   R5   R7   R8   R6   (   R    (
   R;   R1   R2   R<   R3   R4   R5   R7   R8   R6   (    (    s   /usr/lib/python2.7/ssl.pyt   wrap_socketi  s    c         C   s%   d d l  } | j | j |  d ƒ ƒ S(   s¢   Takes a date-time string in standard ASN1_print form
    ("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
    a Python time value in seconds past the epoch.iÿÿÿÿNs   %b %d %H:%M:%S %Y GMT(   t   timet   mktimet   strptime(   t	   cert_timeRr   (    (    s   /usr/lib/python2.7/ssl.pyt   cert_time_to_secondsy  s    s   -----BEGIN CERTIFICATE-----s   -----END CERTIFICATE-----c         C   sc   t  t d ƒ rB t j |  ƒ } t d t j | d ƒ d t d St d t j |  ƒ t d Sd S(   s[   Takes a certificate in binary DER format and returns the
    PEM version of it as a string.t   standard_b64encodes   
i@   N(   t   hasattrt   base64Rw   t
   PEM_HEADERt   textwrapt   fillt
   PEM_FOOTERt   encodestring(   t   der_cert_bytest   f(    (    s   /usr/lib/python2.7/ssl.pyt   DER_cert_to_PEM_cert…  s    $c         C   sw   |  j  t ƒ s" t d t ƒ ‚ n  |  j ƒ  j t ƒ sJ t d t ƒ ‚ n  |  j ƒ  t t ƒ t t ƒ !} t j | ƒ S(   sh   Takes a certificate in ASCII PEM format and returns the
    DER-encoded version of it as a byte sequences(   Invalid PEM encoding; must start with %ss&   Invalid PEM encoding; must end with %s(	   t
   startswithRz   RJ   t   stript   endswithR}   RB   Ry   t   decodestring(   t   pem_cert_stringt   d(    (    s   /usr/lib/python2.7/ssl.pyt   PEM_cert_to_DER_cert•  s     c         C   sx   |  \ } } | d k	 r! t } n t } t t ƒ  d | d | d | ƒ} | j |  ƒ | j t ƒ } | j ƒ  t	 | ƒ S(   s÷   Retrieve the certificate from the server at the specified address,
    and return it as a PEM-encoded string.
    If 'ca_certs' is specified, validate the server cert against it.
    If 'ssl_version' is specified, use it in the connection attempt.R4   R3   R5   N(
   R+   R   R   Rq   R   Rd   RH   R-   Rc   R   (   RQ   R4   R5   t   hostt   portR3   R`   t   dercert(    (    s   /usr/lib/python2.7/ssl.pyt   get_server_certificate£  s    	
c         C   s   t  j |  d ƒ S(   Ns	   <unknown>(   t   _PROTOCOL_NAMESt   get(   t   protocol_code(    (    s   /usr/lib/python2.7/ssl.pyt   get_protocol_name¶  s    c         C   sl   t  |  d ƒ r |  j }  n  t j |  d | | t t d ƒ } y |  j ƒ  Wn t k
 r] n X| j	 ƒ  | S(   sŒ   A replacement for the old socket.ssl function.  Designed
    for compability with Python 2.5 and earlier.  Will disappear in
    Python 3.0.R!   i    N(
   Rx   R!   R.   R/   R   R   R+   R%   R&   R0   (   R;   R1   R2   t   ssl_sock(    (    s   /usr/lib/python2.7/ssl.pyt   sslwrap_simple¼  s    
(2   Rp   R{   R.   R    R   R   R   R   R   R   R   R   R	   R
   R   R   R   R   R   R   R   R   R   R   R   R   R   t   ImportErrorR   R   R   R   R&   R   t   _getnameinfoRy   R'   R    R+   R)   R-   Rq   Rv   Rz   R}   R   Rˆ   RŒ   R   R’   (    (    (    s   /usr/lib/python2.7/ssl.pyt   <module>8   sH   @


"ÿ 					