Lc @ s d Z d d k Z d d k Z d d k l Z d d k l Z l Z l Z d d k l Z l Z l Z l
Z
d d k l Z l Z l
Z
d d k l Z l Z l Z l Z l Z l Z l Z l Z l Z d d k l Z l Z l Z d d k l Z d d
k l Z d d k Z d d k Z d e f d YZ d d e" e e d e# e# d
Z$ d Z% d Z& d Z' d Z( d Z) e d d Z* d Z+ d d d Z, d S( s This module provides some more Pythonic support for SSL.
Object types:
SSLSocket -- subtype of socket.socket which does SSL over the socket
Exceptions:
SSLError -- exception raised for I/O errors
Functions:
cert_time_to_seconds -- convert time string used for certificate
notBefore and notAfter functions to integer
seconds past the Epoch (the time values
returned from time.time())
fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
by the server running on HOST at port PORT. No
validation of the certificate is performed.
Integer constants:
SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT
SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE
The following group define certificate requirements that one side is
allowing/requiring from the other side:
CERT_NONE - no certificates from the other side are required (or will
be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
validated, and if validation fails, the connection will
also fail
CERT_REQUIRED - certificates are required, and will be validated, and
if validation fails, the connection will also fail
The following constants identify various SSL protocol variants:
PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLSv1
iN( t SSLError( t CERT_NONEt
CERT_OPTIONALt
CERT_REQUIRED( t PROTOCOL_SSLv2t PROTOCOL_SSLv3t PROTOCOL_SSLv23t PROTOCOL_TLSv1( t RAND_statust RAND_egdt RAND_add( t SSL_ERROR_ZERO_RETURNt SSL_ERROR_WANT_READt SSL_ERROR_WANT_WRITEt SSL_ERROR_WANT_X509_LOOKUPt SSL_ERROR_SYSCALLt
SSL_ERROR_SSLt SSL_ERROR_WANT_CONNECTt
SSL_ERROR_EOFt SSL_ERROR_INVALID_ERROR_CODE( t sockett _fileobjectt _delegate_methods( t error( t getnameinfot SSLSocketc B s e Z d Z d d e e e d e e d Z d d Z d Z
e d Z d Z d d Z
d d Z d d
Z d d d Z d d d Z d d d
Z d d d Z d Z d Z d Z d Z d Z d Z d Z d d d Z RS( s This class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel.c
C s; t i | d | i x5 t D]- }
y t | |
Wq t j
o q Xq W| o | o
| } n y t i | Wn8 t j
o, } | i t i j o n d | _ n> Xt i
| i | | | | | | | _ | o | i n | | _ | | _ | | _ | | _ | | _ | | _ | | _ d | _ d S( Nt _socki ( R t __init__R R t delattrt AttributeErrort getpeernamet socket_errort errnot ENOTCONNt Nonet _sslobjt _sslt sslwrapt do_handshaket keyfilet certfilet cert_reqst ssl_versiont ca_certst do_handshake_on_connectt suppress_ragged_eofst _makefile_refs( t selft sockR' R( t server_sideR) R* R+ R, R- t attrt e( ( s /usr/lib/python2.6/ssl.pyR Y s8
i c C sV y | i i | SWn; t j
o/ } | i d t j o | i o d S n Xd S( sO Read up to LEN bytes and return them.
Return zero-length string on EOF.i t N( R# t readR t argsR R- ( R/ t lent x( ( s /usr/lib/python2.6/ssl.pyR5 s c C s | i i | S( sh Write DATA to the underlying SSL channel. Returns
number of bytes of DATA actually transmitted.( R# t write( R/ t data( ( s /usr/lib/python2.6/ssl.pyR9 s c C s | i i | S( s Returns a formatted version of the data in the
certificate provided by the other end of the SSL channel.
Return None if no certificate was provided, {} if a
certificate was provided, but not validated.( R# t peer_certificate( R/ t binary_form( ( s /usr/lib/python2.6/ssl.pyt getpeercert s c C s | i p d S| i i Sd S( N( R# R" t cipher( R/ ( ( s /usr/lib/python2.6/ssl.pyR> s
i c C s | i o | d j o t d | i n x t ok y | i i | } WnJ t j
o> } | i d t j o d S| i d t j o d S q1 X| Sq1 Wn t i
| | | Sd S( Ni s3 non-zero flags not allowed in calls to send() on %s( R# t
ValueErrort __class__t TrueR9 R R6 R R
R t send( R/ R: t flagst vR8 ( ( s /usr/lib/python2.6/ssl.pyRB s"
c C s; | i o t d | i n t i | | | | Sd S( Ns% sendto not allowed on instances of %s( R# R? R@ R t sendto( R/ R: t addrRC ( ( s /usr/lib/python2.6/ssl.pyRE s
c C s | i om | d j o t d | i n t | } d } x/ | | j o! | i | | } | | 7} qC W| St i | | | Sd S( Ni s6 non-zero flags not allowed in calls to sendall() on %s( R# R? R@ R7 RB R t sendall( R/ R: RC t amountt countRD ( ( s /usr/lib/python2.6/ssl.pyRG s
c C sS | i o2 | d j o t d | i n | i | St i | | | Sd S( Ni s3 non-zero flags not allowed in calls to recv() on %s( R# R? R@ R5 R t recv( R/ t buflenRC ( ( s /usr/lib/python2.6/ssl.pyRJ s
c C s | o | d j o t | } n | d j o
d } n | i oN | d j o t d | i n | i | } t | } | | | *| St i | | | | Sd S( Ni i s8 non-zero flags not allowed in calls to recv_into() on %s( R" R7 R# R? R@ R5 R t recv_into( R/ t buffert nbytesRC t
tmp_bufferRD ( ( s /usr/lib/python2.6/ssl.pyRL s
c C s; | i o t d | i n t i | | | | Sd S( Ns' recvfrom not allowed on instances of %s( R# R? R@ R t recvfrom( R/ RF RK RC ( ( s /usr/lib/python2.6/ssl.pyRP s
c C s; | i o t d | i n t i | | | | Sd S( Ns, recvfrom_into not allowed on instances of %s( R# R? R@ R t
recvfrom_into( R/ RM RN RC ( ( s /usr/lib/python2.6/ssl.pyRQ s
c C s | i o | i i Sd Sd S( Ni ( R# t pending( R/ ( ( s /usr/lib/python2.6/ssl.pyRR s
c C sA | i o | i i } d | _ | St d t | d S( Ns No SSL wrapper around ( R# t shutdownR" R? t str( R/ t s( ( s /usr/lib/python2.6/ssl.pyt unwrap s
c C s d | _ t i | | d S( N( R" R# R RS ( R/ t how( ( s /usr/lib/python2.6/ssl.pyRS s c C s= | i d j o d | _ t i | n | i d 8_ d S( Ni ( R. R" R# R t close( R/ ( ( s /usr/lib/python2.6/ssl.pyRX s c C s | i i d S( s Perform a TLS/SSL handshake.N( R# R& ( R/ ( ( s /usr/lib/python2.6/ssl.pyR& s c C s| | i o t d n t i | | t i | i t | i | i | i
| i | i | _ | i
o | i n d S( sQ Connects to remote ADDR, and then wraps the connection in
an SSL channel.s/ attempt to connect already-connected SSLSocket!N( R# R? R t connectR$ R% R t FalseR' R( R) R* R+ R, R& ( R/ RF ( ( s /usr/lib/python2.6/ssl.pyRY s
c C s t i | \ } } yY t | d | i d | i d t d | i d | i d | i d | i d | i
| f SWn% t j
o } | i | n Xd S(
s Accepts a new connection from a remote client, and returns
a tuple containing that new connection wrapped with a server-side
SSL channel, and the address of the remote client.R' R( R1 R) R* R+ R, R- N(
R t acceptR R' R( RA R) R* R+ R, R- R RX ( R/ t newsockRF R3 ( ( s /usr/lib/python2.6/ssl.pyR[ ) s
t ric C s% | i d 7_ t | | | d t S( s Make and return a file-like object that
works with the SSL connection. Just use the code
from the socket module.i RX ( R. R RA ( R/ t modet bufsize( ( s /usr/lib/python2.6/ssl.pyt makefile? s N( t __name__t
__module__t __doc__R" RZ R R RA R R5 R9 R= R> RB RE RG RJ RL RP RQ RR RV RS RX R& RY R[ R` ( ( ( s /usr/lib/python2.6/ssl.pyR S s2 %
c C s: t | d | d | d | d | d | d | d | d | S( NR' R( R1 R) R* R+ R, R- ( R ( R0 R' R( R1 R) R* R+ R, R- ( ( s /usr/lib/python2.6/ssl.pyt wrap_socketL s
c C s% d d k } | i | i | d S( s Takes a date-time string in standard ASN1_print form
("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
a Python time value in seconds past the epoch.iNs %b %d %H:%M:%S %Y GMT( t timet mktimet strptime( t cert_timeRe ( ( s /usr/lib/python2.6/ssl.pyt cert_time_to_seconds[ s s -----BEGIN CERTIFICATE-----s -----END CERTIFICATE-----c C se t t d o4 t i | } t d t i | d d t d St d t i | t d Sd S( s[ Takes a certificate in binary DER format and returns the
PEM version of it as a string.t standard_b64encodes
i@ N( t hasattrt base64Rj t
PEM_HEADERt textwrapt fillt
PEM_FOOTERt encodestring( t der_cert_bytest f( ( s /usr/lib/python2.6/ssl.pyt DER_cert_to_PEM_certg s %c C s{ | i t p t d t n | i i t p t d t n | i t t t t !} t i | S( sh Takes a certificate in ASCII PEM format and returns the
DER-encoded version of it as a byte sequences( Invalid PEM encoding; must start with %ss& Invalid PEM encoding; must end with %s( t
startswithRm R? t stript endswithRp R7 Rl t decodestring( t pem_cert_stringt d( ( s /usr/lib/python2.6/ssl.pyt PEM_cert_to_DER_certw s c C sz | \ } } | d j o
t } n t } t t d | d | d | } | i | | i t } | i t | S( s Retrieve the certificate from the server at the specified address,
and return it as a PEM-encoded string.
If 'ca_certs' is specified, validate the server cert against it.
If 'ssl_version' is specified, use it in the connection attempt.R* R) R+ N(
R" R R Rd R RY R= RA RX Rt ( RF R* R+ t hostt portR) RU t dercert( ( s /usr/lib/python2.6/ssl.pyt get_server_certificate s
c C sP | t j o d S| t j o d S| t j o d S| t j o d Sd Sd S( Nt TLSv1t SSLv23t SSLv2t SSLv3s <unknown>( R R R R ( t
protocol_code( ( s /usr/lib/python2.6/ssl.pyt get_protocol_name s
c C sd t | d o
| i } n t i | d | | t t d } y | i Wn n X| i | S( s A replacement for the old socket.ssl function. Designed
for compability with Python 2.5 and earlier. Will disappear in
Python 3.0.R i N( Rk R R$ R% R R R" R R& ( R0 R' R( t ssl_sock( ( s /usr/lib/python2.6/ssl.pyt sslwrap_simple s
(- Rc Rn R$ R R R R R R R R R R R
R R R
R R R R R R R R R R R R t _getnameinfoRl R R R" RZ RA Rd Ri Rm Rp Rt R{ R R R ( ( ( s /usr/lib/python2.6/ssl.pyt <module>8 s4 " @
y~or5J ={Eeu磝Qk ᯘG{?+]ן?wM3X^歌>{7پK>on\jy R g/=fOroNVv~Y+ NGuÝHWyw[eQʨSb> >}Gmx[o[<{Ϯ_qF vM IENDB`
