Ñò
§ÚêLc @ s¥ d Z d d k Z d d k Z d d k l Z d d k l Z l Z l Z d d k l Z l Z l Z l
Z
d d k l Z l Z l
Z
d d k l Z l Z l Z l Z l Z l Z l Z l Z l Z d d k l Z l Z l Z d d k l Z d d
k l Z d d k Z d d k Z d e f d „ ƒ YZ d d e" e e d e# e# d
„ Z$ d „ Z% d Z& d Z' d „ Z( d „ Z) e d d „ Z* d „ Z+ d d d „ Z, d S( s This module provides some more Pythonic support for SSL.
Object types:
SSLSocket -- subtype of socket.socket which does SSL over the socket
Exceptions:
SSLError -- exception raised for I/O errors
Functions:
cert_time_to_seconds -- convert time string used for certificate
notBefore and notAfter functions to integer
seconds past the Epoch (the time values
returned from time.time())
fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
by the server running on HOST at port PORT. No
validation of the certificate is performed.
Integer constants:
SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT
SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE
The following group define certificate requirements that one side is
allowing/requiring from the other side:
CERT_NONE - no certificates from the other side are required (or will
be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
validated, and if validation fails, the connection will
also fail
CERT_REQUIRED - certificates are required, and will be validated, and
if validation fails, the connection will also fail
The following constants identify various SSL protocol variants:
PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLSv1
iÿÿÿÿN( t SSLError( t CERT_NONEt
CERT_OPTIONALt
CERT_REQUIRED( t PROTOCOL_SSLv2t PROTOCOL_SSLv3t PROTOCOL_SSLv23t PROTOCOL_TLSv1( t RAND_statust RAND_egdt RAND_add( t SSL_ERROR_ZERO_RETURNt SSL_ERROR_WANT_READt SSL_ERROR_WANT_WRITEt SSL_ERROR_WANT_X509_LOOKUPt SSL_ERROR_SYSCALLt
SSL_ERROR_SSLt SSL_ERROR_WANT_CONNECTt
SSL_ERROR_EOFt SSL_ERROR_INVALID_ERROR_CODE( t sockett _fileobjectt _delegate_methods( t error( t getnameinfot SSLSocketc B s e Z d Z d d e e e d e e d „ Z d d „ Z d „ Z
e d „ Z d „ Z d d „ Z
d d „ Z d d
„ Z d d d „ Z d d d „ Z d d d
„ Z d d d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d „ Z d d d „ Z RS( sµ This class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel.c
C s; t i | d | i ƒx5 t D]- }
y t | |
ƒ Wq t j
o q Xq W| o | o
| } n y t i | ƒ Wn8 t j
o, } | i t i j o ‚ n d | _ n> Xt i
| i | | | | | | ƒ | _ | o | i ƒ n | | _ | | _ | | _ | | _ | | _ | | _ | | _ d | _ d S( Nt _socki ( R t __init__R R t delattrt AttributeErrort getpeernamet socket_errort errnot ENOTCONNt Nonet _sslobjt _sslt sslwrapt do_handshaket keyfilet certfilet cert_reqst ssl_versiont ca_certst do_handshake_on_connectt suppress_ragged_eofst _makefile_refs( t selft sockR' R( t server_sideR) R* R+ R, R- t attrt e( ( s /usr/lib64/python2.6/ssl.pyR Y s8
i c C sV y | i i | ƒ SWn; t j
o/ } | i d t j o | i o d S‚ n Xd S( sO Read up to LEN bytes and return them.
Return zero-length string on EOF.i t N( R# t readR t argsR R- ( R/ t lent x( ( s /usr/lib64/python2.6/ssl.pyR5 ‚ s c C s | i i | ƒ S( sh Write DATA to the underlying SSL channel. Returns
number of bytes of DATA actually transmitted.( R# t write( R/ t data( ( s /usr/lib64/python2.6/ssl.pyR9 s c C s | i i | ƒ S( sá Returns a formatted version of the data in the
certificate provided by the other end of the SSL channel.
Return None if no certificate was provided, {} if a
certificate was provided, but not validated.( R# t peer_certificate( R/ t binary_form( ( s /usr/lib64/python2.6/ssl.pyt getpeercert– s c C s | i p d S| i i ƒ Sd S( N( R# R" t cipher( R/ ( ( s /usr/lib64/python2.6/ssl.pyR> Ÿ s
i c C s¿ | i ož | d j o t d | i ƒ ‚ n xŠ t ok y | i i | ƒ } WnJ t j
o> } | i d t j o d S| i d t j o d S‚ q1 X| Sq1 Wn t i
| | | ƒ Sd S( Ni s3 non-zero flags not allowed in calls to send() on %s( R# t
ValueErrort __class__t TrueR9 R R6 R R
R t send( R/ R: t flagst vR8 ( ( s /usr/lib64/python2.6/ssl.pyRB ¦ s"
c C s; | i o t d | i ƒ ‚ n t i | | | | ƒ Sd S( Ns% sendto not allowed on instances of %s( R# R? R@ R t sendto( R/ R: t addrRC ( ( s /usr/lib64/python2.6/ssl.pyRE » s
c C sŽ | i om | d j o t d | i ƒ ‚ n t | ƒ } d } x/ | | j o! | i | | ƒ } | | 7} qC W| St i | | | ƒ Sd S( Ni s6 non-zero flags not allowed in calls to sendall() on %s( R# R? R@ R7 RB R t sendall( R/ R: RC t amountt countRD ( ( s /usr/lib64/python2.6/ssl.pyRG Â s
c C sS | i o2 | d j o t d | i ƒ ‚ n | i | ƒ St i | | | ƒ Sd S( Ni s3 non-zero flags not allowed in calls to recv() on %s( R# R? R@ R5 R t recv( R/ t buflenRC ( ( s /usr/lib64/python2.6/ssl.pyRJ Ñ s
c C s | o | d j o t | ƒ } n | d j o
d } n | i oN | d j o t d | i ƒ ‚ n | i | ƒ } t | ƒ } | | | *| St i | | | | ƒ Sd S( Ni i s8 non-zero flags not allowed in calls to recv_into() on %s( R" R7 R# R? R@ R5 R t recv_into( R/ t buffert nbytesRC t
tmp_bufferRD ( ( s /usr/lib64/python2.6/ssl.pyRL Û s
c C s; | i o t d | i ƒ ‚ n t i | | | | ƒ Sd S( Ns' recvfrom not allowed on instances of %s( R# R? R@ R t recvfrom( R/ RF RK RC ( ( s /usr/lib64/python2.6/ssl.pyRP ì s
c C s; | i o t d | i ƒ ‚ n t i | | | | ƒ Sd S( Ns, recvfrom_into not allowed on instances of %s( R# R? R@ R t
recvfrom_into( R/ RM RN RC ( ( s /usr/lib64/python2.6/ssl.pyRQ ó s
c C s | i o | i i ƒ Sd Sd S( Ni ( R# t pending( R/ ( ( s /usr/lib64/python2.6/ssl.pyRR ú s
c C sA | i o | i i ƒ } d | _ | St d t | ƒ ƒ ‚ d S( Ns No SSL wrapper around ( R# t shutdownR" R? t str( R/ t s( ( s /usr/lib64/python2.6/ssl.pyt unwrap s
c C s d | _ t i | | ƒ d S( N( R" R# R RS ( R/ t how( ( s /usr/lib64/python2.6/ssl.pyRS s c C s= | i d j o d | _ t i | ƒ n | i d 8_ d S( Ni ( R. R" R# R t close( R/ ( ( s /usr/lib64/python2.6/ssl.pyRX s c C s | i i ƒ d S( s Perform a TLS/SSL handshake.N( R# R& ( R/ ( ( s /usr/lib64/python2.6/ssl.pyR& s c C s| | i o t d ƒ ‚ n t i | | ƒ t i | i t | i | i | i
| i | i ƒ | _ | i
o | i ƒ n d S( sQ Connects to remote ADDR, and then wraps the connection in
an SSL channel.s/ attempt to connect already-connected SSLSocket!N( R# R? R t connectR$ R% R t FalseR' R( R) R* R+ R, R& ( R/ RF ( ( s /usr/lib64/python2.6/ssl.pyRY s
c C sš t i | ƒ \ } } yY t | d | i d | i d t d | i d | i d | i d | i d | i
ƒ| f SWn% t j
o } | i ƒ | ‚ n Xd S(
s¿ Accepts a new connection from a remote client, and returns
a tuple containing that new connection wrapped with a server-side
SSL channel, and the address of the remote client.R' R( R1 R) R* R+ R, R- N(
R t acceptR R' R( RA R) R* R+ R, R- R RX ( R/ t newsockRF R3 ( ( s /usr/lib64/python2.6/ssl.pyR[ ) s
t riÿÿÿÿc C s% | i d 7_ t | | | d t ƒS( s Make and return a file-like object that
works with the SSL connection. Just use the code
from the socket module.i RX ( R. R RA ( R/ t modet bufsize( ( s /usr/lib64/python2.6/ssl.pyt makefile? s N( t __name__t
__module__t __doc__R" RZ R R RA R R5 R9 R= R> RB RE RG RJ RL RP RQ RR RV RS RX R& RY R[ R` ( ( ( s /usr/lib64/python2.6/ssl.pyR S s2 %
c C s: t | d | d | d | d | d | d | d | d | ƒS( NR' R( R1 R) R* R+ R, R- ( R ( R0 R' R( R1 R) R* R+ R, R- ( ( s /usr/lib64/python2.6/ssl.pyt wrap_socketL s
c C s% d d k } | i | i | d ƒ ƒ S( s¢ Takes a date-time string in standard ASN1_print form
("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
a Python time value in seconds past the epoch.iÿÿÿÿNs %b %d %H:%M:%S %Y GMT( t timet mktimet strptime( t cert_timeRe ( ( s /usr/lib64/python2.6/ssl.pyt cert_time_to_seconds[ s s -----BEGIN CERTIFICATE-----s -----END CERTIFICATE-----c C se t t d ƒ o4 t i | ƒ } t d t i | d ƒ d t d St d t i | ƒ t d Sd S( s[ Takes a certificate in binary DER format and returns the
PEM version of it as a string.t standard_b64encodes
i@ N( t hasattrt base64Rj t
PEM_HEADERt textwrapt fillt
PEM_FOOTERt encodestring( t der_cert_bytest f( ( s /usr/lib64/python2.6/ssl.pyt DER_cert_to_PEM_certg s %c C s{ | i t ƒ p t d t ƒ ‚ n | i ƒ i t ƒ p t d t ƒ ‚ n | i ƒ t t ƒ t t ƒ !} t i | ƒ S( sh Takes a certificate in ASCII PEM format and returns the
DER-encoded version of it as a byte sequences( Invalid PEM encoding; must start with %ss& Invalid PEM encoding; must end with %s( t
startswithRm R? t stript endswithRp R7 Rl t decodestring( t pem_cert_stringt d( ( s /usr/lib64/python2.6/ssl.pyt PEM_cert_to_DER_certw s c C sz | \ } } | d j o
t } n t } t t ƒ d | d | d | ƒ} | i | ƒ | i t ƒ } | i ƒ t | ƒ S( s÷ Retrieve the certificate from the server at the specified address,
and return it as a PEM-encoded string.
If 'ca_certs' is specified, validate the server cert against it.
If 'ssl_version' is specified, use it in the connection attempt.R* R) R+ N(
R" R R Rd R RY R= RA RX Rt ( RF R* R+ t hostt portR) RU t dercert( ( s /usr/lib64/python2.6/ssl.pyt get_server_certificate… s
c C sP | t j o d S| t j o d S| t j o d S| t j o d Sd Sd S( Nt TLSv1t SSLv23t SSLv2t SSLv3s ( R R R R ( t
protocol_code( ( s /usr/lib64/python2.6/ssl.pyt get_protocol_name˜ s
c C sd t | d ƒ o
| i } n t i | d | | t t d ƒ } y | i ƒ Wn n X| i ƒ | S( sŒ A replacement for the old socket.ssl function. Designed
for compability with Python 2.5 and earlier. Will disappear in
Python 3.0.R i N( Rk R R$ R% R R R" R R& ( R0 R' R( t ssl_sock( ( s /usr/lib64/python2.6/ssl.pyt sslwrap_simple§ s
(- Rc Rn R$ R R R R R R R R R R R
R R R
R R R R R R R R R R R R t _getnameinfoRl R R R" RZ RA Rd Ri Rm Rp Rt R{ R R… R‡ ( ( ( s /usr/lib64/python2.6/ssl.pyt 8 s4 " @ ù