3
F\[ R @ s d dl Z d dlZd dlmZ d dlmZmZ d dlmZm Z d dl
m Z d dl m
Z
d dlmZ d dlmZmZmZmZ d d lmZmZmZ m Z m Z m!Z"m#Z$m%Z&m'Z( d d
l)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/ d d d
ddddddddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\gRZ0ye1Z2W n& e3k
r G d]d^ d^e4Z2Y nX e j5Z5e j6Z6e j7Z7e j8Z8e j9Z9e j:Z:e j;Zd_Z?d`Z@daZAdbZBdcZCddZDe jEZFe jGZHe jIZJe jKZLe jMZNe jOZPe jQZRe jSZTe jUZVe jWZXe jYZZe j[Z\e j]Z^e j_Z`e jaZbe jcZde jeZfe jgZhe jiZje jkZle jmZne joZpe jqZre jsZte juZve jwZxe jyZze j{Z|e j}Z~e jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jr$e jZe jZe jZe jZe0jdedfdgdhg e jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZe jZdidjdkdldmgZdngZdoZdpZG dqdS dSeZeeeZe eZG drdT dTeZG dsdU dUeZG dtdV dVeZG dudW dWeZG dvdX dXeZG dwdx dxe4ZG dydz dzeZG d{d| d|eZG d}d~ d~eZG dd deZG dd deZG dd deZdd ZddY Zdd Zee jdZee jdZee jdZG ddZ dZe4ZG dd[ d[e4ZeeedeσZG dd\ d\e4ZeeedeσZe jӃ dS ) N)platform)wrapspartial)countchain)WeakValueDictionary) errorcode)
deprecated) binary_type
integer_typesint2byte
indexbytes) UNSPECIFIEDexception_from_error_queueffilib make_assertnative path_stringtext_to_bytes_and_warnno_zero_allocator) FILETYPE_PEM_PassphraseHelperPKeyX509NameX509 X509StoreOPENSSL_VERSION_NUMBERSSLEAY_VERSION
SSLEAY_CFLAGSSSLEAY_PLATFORM
SSLEAY_DIRSSLEAY_BUILT_ON
SENT_SHUTDOWNRECEIVED_SHUTDOWN SSLv2_METHOD SSLv3_METHOD
SSLv23_METHOD TLSv1_METHODTLSv1_1_METHODTLSv1_2_METHOD OP_NO_SSLv2 OP_NO_SSLv3 OP_NO_TLSv1
OP_NO_TLSv1_1
OP_NO_TLSv1_2MODE_RELEASE_BUFFERSOP_SINGLE_DH_USEOP_SINGLE_ECDH_USEOP_EPHEMERAL_RSAOP_MICROSOFT_SESS_ID_BUGOP_NETSCAPE_CHALLENGE_BUG#OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG OP_SSLREF2_REUSE_CERT_TYPE_BUG OP_MICROSOFT_BIG_SSLV3_BUFFEROP_MSIE_SSLV2_RSA_PADDINGOP_SSLEAY_080_CLIENT_DH_BUG
OP_TLS_D5_BUGOP_TLS_BLOCK_PADDING_BUG OP_DONT_INSERT_EMPTY_FRAGMENTSOP_CIPHER_SERVER_PREFERENCEOP_TLS_ROLLBACK_BUGOP_PKCS1_CHECK_1OP_PKCS1_CHECK_2OP_NETSCAPE_CA_DN_BUG"OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGOP_NO_COMPRESSIONOP_NO_QUERY_MTUOP_COOKIE_EXCHANGE OP_NO_TICKETOP_ALL VERIFY_PEERVERIFY_FAIL_IF_NO_PEER_CERTVERIFY_CLIENT_ONCE VERIFY_NONESESS_CACHE_OFFSESS_CACHE_CLIENTSESS_CACHE_SERVERSESS_CACHE_BOTHSESS_CACHE_NO_AUTO_CLEAR SESS_CACHE_NO_INTERNAL_LOOKUP SESS_CACHE_NO_INTERNAL_STORESESS_CACHE_NO_INTERNALSSL_ST_CONNECT
SSL_ST_ACCEPT SSL_ST_MASK SSL_CB_LOOP SSL_CB_EXIT SSL_CB_READ SSL_CB_WRITE SSL_CB_ALERTSSL_CB_READ_ALERTSSL_CB_WRITE_ALERTSSL_CB_ACCEPT_LOOPSSL_CB_ACCEPT_EXITSSL_CB_CONNECT_LOOPSSL_CB_CONNECT_EXITSSL_CB_HANDSHAKE_STARTSSL_CB_HANDSHAKE_DONEError
WantReadErrorWantWriteErrorWantX509LookupErrorZeroReturnError SysCallErrorSSLeay_versionSessionContext
Connectionc @ s e Zd ZdS )_bufferN)__name__
__module__ __qualname__ rs rs /usr/lib/python3.6/SSL.pyro v s ro SSL_ST_INIT
SSL_ST_BEFORE SSL_ST_OKSSL_ST_RENEGOTIATEz"/etc/ssl/certs/ca-certificates.crtz /etc/pki/tls/certs/ca-bundle.crtz/etc/ssl/ca-bundle.pemz/etc/pki/tls/cacert.pemz1/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pemz/etc/ssl/certss$ /opt/pyca/cryptography/openssl/certss' /opt/pyca/cryptography/openssl/cert.pemc @ s e Zd ZdZdS )re z4
An error occurred in an `OpenSSL.SSL` API.
N)rp rq rr __doc__rs rs rs rt re s c @ s e Zd ZdS )rf N)rp rq rr rs rs rs rt rf s c @ s e Zd ZdS )rg N)rp rq rr rs rs rs rt rg s c @ s e Zd ZdS )rh N)rp rq rr rs rs rs rt rh s c @ s e Zd ZdS )ri N)rp rq rr rs rs rs rt ri s c @ s e Zd ZdS )rj N)rp rq rr rs rs rs rt rj s c @ s e Zd ZdZdd Zdd ZdS )_CallbackExceptionHelpera
A base class for wrapper classes that allow for intelligent exception
handling in OpenSSL callbacks.
:ivar list _problems: Any exceptions that occurred while executing in a
context where they could not be raised in the normal way. Typically
this is because OpenSSL has called into some Python code and requires a
return value. The exceptions are saved to be raised later when it is
possible to do so.
c C s
g | _ d S )N) _problems)selfrs rs rt __init__ s z!_CallbackExceptionHelper.__init__c C s6 | j r2y
t W n tk
r$ Y nX | j jddS )z
Raise an exception from the OpenSSL error queue or that was previously
captured whe running a callback.
r N)r _raise_current_errorre pop)r rs rs rt raise_if_problem s
z)_CallbackExceptionHelper.raise_if_problemN)rp rq rr r r r rs rs rs rt r
s
r c @ s e Zd ZdZdd ZdS )
_VerifyHelperz^
Wrap a callback such that it can be used as a certificate verification
callback.
c s2 t j t fdd}tjd|_d S )Nc s t j|}t j| tj|}t j|}t j|}t j }t j||}t j
| }y ||||| } W n, t k
r }
zj j
|
dS d }
~
X n X | rt j|t j dS dS d S )Nr ru )_libZ X509_STORE_CTX_get_current_cert X509_up_refr _from_raw_x509_ptrZX509_STORE_CTX_get_errorZ X509_STORE_CTX_get_error_depthZ"SSL_get_ex_data_X509_STORE_CTX_idxZX509_STORE_CTX_get_ex_datarn _reverse_mapping Exceptionr appendZX509_STORE_CTX_set_errorZ X509_V_OK) okZ store_ctxZx509certZ error_numberZ error_depthindexsslZ
connectionresulte)callbackr rs rt wrapper2 s$
z'_VerifyHelper.__init__..wrapperz int (*)(int, X509_STORE_CTX *))r r r _ffir )r r r rs )r r rt r / s
z_VerifyHelper.__init__N)rp rq rr r r rs rs rs rt r ) s r c @ s e Zd ZdZdd ZdS )_NpnAdvertiseHelperzT
Wrap a callback such that it can be used as an NPN advertisement callback.
c s2 t j t fdd}tjd|_d S )Nc s ynt j| } |}djtjdd |D }tjdt|tjd|g|_|jd d |d< |jd |d< dS t k
r } zj
j | dS d }~X nX d S ) N c s s | ]}t t||fV qd S )N)r len).0prs rs rt a s z@_NpnAdvertiseHelper.__init__..wrapper..zunsigned int *zunsigned char[]r ru rv ) rn r joinr
from_iterabler newr _npn_advertise_callback_argsr r r )r outoutlenargconnprotosprotostrr )r r rs rt r X s
z-_NpnAdvertiseHelper.__init__..wrapperz>int (*)(SSL *, const unsigned char **, unsigned int *, void *))r r r r r )r r r rs )r r rt r U s
z _NpnAdvertiseHelper.__init__N)rp rq rr r r rs rs rs rt r P s r c @ s e Zd ZdZdd ZdS )_NpnSelectHelperzP
Wrap a callback such that it can be used as an NPN selection callback.
c s2 t j t fdd}tjd|_d S )Nc
s yt j| }tj||d d }g }x<|r`t|d} |d| d }
|j|
|| d d }q&W ||} tjdt| tjd| g|_|jd d |d< |jd |d< dS t k
r } zj
j| dS d } ~ X nX d S )Nr ru zunsigned char *zunsigned char[]rv ) rn r r bufferr
r r r _npn_select_callback_argsr r )
r r r in_inlenr r instr protolistlengthprotooutstrr )r r rs rt r s$
z*_NpnSelectHelper.__init__..wrapperz^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *))r r r r r )r r r rs )r r rt r ~ s
"z_NpnSelectHelper.__init__N)rp rq rr r r rs rs rs rt r y s r c @ s e Zd ZdZdd ZdS )_ALPNSelectHelperzQ
Wrap a callback such that it can be used as an ALPN selection callback.
c s2 t j t fdd}tjd|_d S )Nc
s yt j| }tj||d d }g }x<|r`t|d} |d| d }
|j|
|| d d }q&W ||} t| ts~tdtj dt
| tj d| g|_ |j d d |d< |j d |d< dS t k
r } zj
j| dS d } ~ X nX d S )Nr ru z'ALPN callback must return a bytestring.zunsigned char *zunsigned char[]rv )rn r r r r
r
isinstance _binary_type TypeErrorr r _alpn_select_callback_argsr r )
r r r r r r r r r Z encoded_lenr r r )r r rs rt r s(
z+_ALPNSelectHelper.__init__..wrapperz^int (*)(SSL *, unsigned char **, unsigned char *, const unsigned char *, unsigned int, void *))r r r r r )r r r rs )r r rt r s
$z_ALPNSelectHelper.__init__N)rp rq rr r r rs rs rs rt r s r c @ s e Zd ZdZdd ZdS )_OCSPServerCallbackHelpera
Wrap a callback such that it can be used as an OCSP callback for the server
side.
Annoyingly, OpenSSL defines one OCSP callback but uses it in two different
ways. For servers, that callback is expected to retrieve some OCSP data and
hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK,
SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback
is expected to check the OCSP data, and returns a negative value on error,
0 if the response is not acceptable, or positive if it is. These are
mutually exclusive return code behaviours, and they mean that we need two
helpers so that we always return an appropriate error code if the user's
code throws an exception.
Given that we have to have two helpers anyway, these helpers are a bit more
helpery than most: specifically, they hide a few more of the OpenSSL
functions so that the user has an easier time writing these callbacks.
This helper implements the server side.
c s2 t j t fdd}tjd|_d S )Nc s yt j| }|tjkr"tj|}nd } ||}t|tsBtd|sJdS t|}t j
|}|tj ||d d < t j | || dS t
k
r } zjj| dS d }~X nX d S )Nz'OCSP callback must return a bytestring.rw r rv )rn r r NULL from_handler r r r r ZOPENSSL_mallocr Z SSL_set_tlsext_status_ocsp_respr r r )r cdatar data ocsp_dataZocsp_data_lengthZdata_ptrr )r r rs rt r s&
z3_OCSPServerCallbackHelper.__init__..wrapperzint (*)(SSL *, void *))r r r r r )r r r rs )r r rt r s
'z"_OCSPServerCallbackHelper.__init__N)rp rq rr r r rs rs rs rt r s r c @ s e Zd ZdZdd ZdS )_OCSPClientCallbackHelpera
Wrap a callback such that it can be used as an OCSP callback for the client
side.
Annoyingly, OpenSSL defines one OCSP callback but uses it in two different
ways. For servers, that callback is expected to retrieve some OCSP data and
hand it to OpenSSL, and may return only SSL_TLSEXT_ERR_OK,
SSL_TLSEXT_ERR_FATAL, and SSL_TLSEXT_ERR_NOACK. For clients, that callback
is expected to check the OCSP data, and returns a negative value on error,
0 if the response is not acceptable, or positive if it is. These are
mutually exclusive return code behaviours, and they mean that we need two
helpers so that we always return an appropriate error code if the user's
code throws an exception.
Given that we have to have two helpers anyway, these helpers are a bit more
helpery than most: specifically, they hide a few more of the OpenSSL
functions so that the user has an easier time writing these callbacks.
This helper implements the client side.
c s2 t j t fdd}tjd|_d S )Nc s yxt j| }|tjkr"tj|}nd }tjd}tj| |}|dk rJd}ntj|d |d d } |||}t t
|S t k
r } zj j
| dS d }~X nX d S )Nzunsigned char **r r ru )rn r r r r r r Z SSL_get_tlsext_status_ocsp_respr intboolr r r ) r r r r Zocsp_ptrZocsp_lenr Zvalidr )r r rs rt r 9 s
z3_OCSPClientCallbackHelper.__init__..wrapperzint (*)(SSL *, void *))r r r r r )r r r rs )r r rt r 6 s
z"_OCSPClientCallbackHelper.__init__N)rp rq rr r r rs rs rs rt r s r c C sd d }t | ts(t| dd }|d k r(| } t | tr6| }t |tsJtdn|dk r`td|f |S )Nfilenoz3argument must be an int, or have a fileno() method.r z1file descriptor cannot be a negative integer (%i))r r getattrr
ValueError)objfdmethrs rs rt _asFileDescriptor[ s
r c C s t jtj| S )z
Return a string describing the version of OpenSSL in use.
:param type: One of the :const:`SSLEAY_` constants defined in this module.
)r stringr rk )typers rs rt rk n s c s fdd}|S )a
Builds a decorator that ensures that functions that rely on OpenSSL
functions that are not present in this build raise NotImplementedError,
rather than AttributeError coming out of cryptography.
:param flag: A cryptography flag that guards the functions, e.g.
``Cryptography_HAS_NEXTPROTONEG``.
:param error: The string to be used in the exception if the flag is false.
c s$ s t | fdd}|S | S d S )Nc s t d S )N)NotImplementedError)argskwargs)errorrs rt explode s z<_make_requires.._requires_decorator..explode)r )funcr )r flagrs rt _requires_decorator s z+_make_requires.._requires_decoratorrs )r r r rs )r r rt _make_requiresw s
r zNPN not availablezALPN not availablezSNI not availablec @ s e Zd ZdZdS )rl z
A class representing an SSL session. A session defines certain connection
parameters which may be re-used to speed up the setup of subsequent
connections.
.. versionadded:: 0.14
N)rp rq rr r rs rs rs rt rl s c @ s e Zd ZdZededededede diZ
e dd e
j D Z
d
d Z
ded
dZdd ZdfddZdd Zdd Zdd Zdd Zefdd Zd d Zd d Zd!d" Zefd#d$Zd%d& Z d'd( Z d)d* Z d+d, Z d-d. Z d/d0 Z!d1d2 Z"d3d4 Z#d5d6 Z$d7d8 Z%d9d: Z&d;d< Z'd=d> Z(d?d@ Z)dAdB Z*dCdD Z+dEdF Z,dGdH Z-dIdJ Z.dKdL Z/dMdN Z0dOdP Z1dQdR Z2e3dSdT Z4dUdV Z5e6dWdX Z7e6dYdZ Z8e9d[d\ Z:e9d]d^ Z;d_d` Zd S )irm z
:class:`OpenSSL.SSL.Context` instances define the parameters for setting
up new SSL connections.
:param method: One of SSLv2_METHOD, SSLv3_METHOD, SSLv23_METHOD, or
TLSv1_METHOD.
Z SSLv2_methodZ SSLv3_methodZ
SSLv23_methodZ TLSv1_methodZTLSv1_1_methodZTLSv1_2_methodc c s0 | ](\}}t t|d d k r|t t|fV qd S )N)r r )r Z
identifiernamers rs rt r s zContext.c C s& t |tstdy| j| }W n tk
r< tdY nX | }t|tjk t j
|}t|tjk tj |t j }y t j
|d}t|dk W n tk
r Y nX || _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _d | _ d | _ d | _ d | _ d | _ | j!t j" d S )Nzmethod must be an integerzNo such protocolru )#r r r _methodsKeyErrorr _openssl_assertr r r Z SSL_CTX_newgcZ SSL_CTX_freeZSSL_CTX_set_ecdh_autoAttributeError_context_passphrase_helper_passphrase_callback_passphrase_userdata_verify_helper_verify_callback_info_callback_tlsext_servername_callback _app_data_npn_advertise_helper_npn_advertise_callback_npn_select_helper_npn_select_callback_alpn_select_helper_alpn_select_callback _ocsp_helper_ocsp_callback
_ocsp_dataset_modeZ SSL_MODE_ENABLE_PARTIAL_WRITE)r methodZ method_funcZ
method_objcontextresrs rs rt r sF
zContext.__init__Nc C sN |dkrt j}nt|}|dkr(t j}nt|}tj| j||}|sJt dS )aU
Let SSL know where we can find trusted certificates for the certificate
chain. Note that the certificates have to be in PEM format.
If capath is passed, it must be a directory prepared using the
``c_rehash`` tool included with OpenSSL. Either, but not both, of
*pemfile* or *capath* may be :data:`None`.
:param cafile: In which file we can find the certificates (``bytes`` or
``unicode``).
:param capath: In which directory we can find the certificates
(``bytes`` or ``unicode``).
:return: None
N)r r _path_stringr Z SSL_CTX_load_verify_locationsr r )r cafilecapathZ load_resultrs rs rt load_verify_locations s z Context.load_verify_locationsc s& t fdd}tt|dddS )Nc s | |j S )N)r )sizeZverifyuserdata)r r rs rt r s z'Context._wrap_callback..wrapperT)Z more_argstruncate)r r r )r r r rs )r r rt _wrap_callback
s zContext._wrap_callbackc C s@ t |std| j|| _| jj| _tj| j| j || _ dS )a
Set the passphrase callback. This function will be called
when a private key with a passphrase is loaded.
:param callback: The Python callback to use. This must accept three
positional arguments. First, an integer giving the maximum length
of the passphrase it may return. If the returned passphrase is
longer than this, it will be truncated. Second, a boolean value
which will be true if the user should be prompted for the
passphrase twice and the callback should verify that the two values
supplied are equal. Third, the value given as the *userdata*
parameter to :meth:`set_passwd_cb`. The *callback* must return
a byte string. If an error occurs, *callback* should return a false
value (e.g. an empty string).
:param userdata: (optional) A Python object which will be given as
argument to the callback
:return: None
zcallback must be callableN)
callabler r r r r r Z SSL_CTX_set_default_passwd_cbr r )r r r rs rs rt
set_passwd_cb s
zContext.set_passwd_cbc C s t j| j}t|dk tjt j jd}tjt j jd}| j ||stjt j
}tjt j }|t kr|t
kr| jtt dS )a
Specify that the platform provided CA certificates are to be used for
verification purposes. This method has some caveats related to the
binary wheels that cryptography (pyOpenSSL's primary dependency) ships:
* macOS will only load certificates using this method if the user has
the ``openssl@1.1`` `Homebrew `_ formula installed
in the default location.
* Windows will not work.
* manylinux1 cryptography wheels will work on most common Linux
distributions in pyOpenSSL 17.1.0 and above. pyOpenSSL detects the
manylinux1 wheel and attempts to load roots via a fallback path.
:return: None
ru asciiN)r Z SSL_CTX_set_default_verify_pathsr r r r Z X509_get_default_cert_dir_envdecodeZ X509_get_default_cert_file_env_check_env_vars_setZX509_get_default_cert_dirZX509_get_default_cert_file _CRYPTOGRAPHY_MANYLINUX1_CA_DIR _CRYPTOGRAPHY_MANYLINUX1_CA_FILE _fallback_default_verify_paths_CERTIFICATE_FILE_LOCATIONS_CERTIFICATE_PATH_LOCATIONS)r
set_result dir_env_var file_env_varZ default_dirZ default_filers rs rt set_default_verify_paths- s
z Context.set_default_verify_pathsc C s t jj|dk p t jj|dk S )zp
Check to see if the default cert dir/file environment vars are present.
:return: bool
N)osenvironget)r r r rs rs rt r ^ s zContext._check_env_vars_setc C sR x$|D ] }t jj|r| j| P qW x&|D ] }t jj|r,| jd| P q,W dS )aW
Default verify paths are based on the compiled version of OpenSSL.
However, when pyca/cryptography is compiled as a manylinux1 wheel
that compiled location can potentially be wrong. So, like Go, we
will try a predefined set of paths and attempt to load roots
from there.
:return: None
N)r pathisfiler isdir)r Z file_pathZdir_pathr r rs rs rt r i s
z&Context._fallback_default_verify_pathsc C s$ t |}tj| j|}|s t dS )z
Load a certificate chain from a file.
:param certfile: The name of the certificate chain file (``bytes`` or
``unicode``). Must be PEM encoded.
:return: None
N)r r Z"SSL_CTX_use_certificate_chain_filer r )r certfiler rs rs rt use_certificate_chain_file} s
z"Context.use_certificate_chain_filec C s8 t |}t|tstdtj| j||}|s4t dS )ah
Load a certificate from a file
:param certfile: The name of the certificate file (``bytes`` or
``unicode``).
:param filetype: (optional) The encoding of the file, which is either
:const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`. The default is
:const:`FILETYPE_PEM`.
:return: None
zfiletype must be an integerN)r r r r r Z SSL_CTX_use_certificate_filer r )r r
filetype
use_resultrs rs rt use_certificate_file s
z Context.use_certificate_filec C s0 t |tstdtj| j|j}|s,t dS )zs
Load a certificate from a X509 object
:param cert: The X509 object
:return: None
z cert must be an X509 instanceN)r r r r ZSSL_CTX_use_certificater _x509r )r r r
rs rs rt use_certificate s
zContext.use_certificatec C sD t |tstdtj|j}tj| j|}|s@tj| t dS )z
Add certificate to chain
:param certobj: The X509 certificate object to add to the chain
:return: None
z certobj must be an X509 instanceN)
r r r r X509_dupr Z SSL_CTX_add_extra_chain_certr Z X509_freer )r Zcertobjcopy
add_resultrs rs rt add_extra_chain_cert s
z Context.add_extra_chain_certc C s | j d k r| j jt t d S )N)r r re r )r rs rs rt _raise_passphrase_exception s
z#Context._raise_passphrase_exceptionc C sH t |}|tkrt}nt|ts(tdtj| j||}|sD| j dS )aR
Load a private key from a file
:param keyfile: The name of the key file (``bytes`` or ``unicode``)
:param filetype: (optional) The encoding of the file, which is either
:const:`FILETYPE_PEM` or :const:`FILETYPE_ASN1`. The default is
:const:`FILETYPE_PEM`.
:return: None
zfiletype must be an integerN)
r _UNSPECIFIEDr r r r r ZSSL_CTX_use_PrivateKey_filer r )r Zkeyfiler r
rs rs rt use_privatekey_file s
zContext.use_privatekey_filec C s2 t |tstdtj| j|j}|s.| j dS )zs
Load a private key from a PKey object
:param pkey: The PKey object
:return: None
z pkey must be a PKey instanceN)r r r r ZSSL_CTX_use_PrivateKeyr Z_pkeyr )r Zpkeyr
rs rs rt use_privatekey s
zContext.use_privatekeyc C s t j| jst dS )z
Check if the private key (loaded with :meth:`use_privatekey`) matches
the certificate (loaded with :meth:`use_certificate`)
:return: :data:`None` (raises :exc:`Error` if something's wrong)
N)r ZSSL_CTX_check_private_keyr r )r rs rs rt check_privatekey s zContext.check_privatekeyc C s0 t jtd|}t|tjk t j| j| dS )a%
Load the trusted certificates that will be sent to the client. Does
not actually imply any of the certificates are trusted; that must be
configured separately.
:param bytes cafile: The path to a certificates file in PEM format.
:return: None
r N)r ZSSL_load_client_CA_file_text_to_bytes_and_warnr r r SSL_CTX_set_client_CA_listr )r r Zca_listrs rs rt load_client_ca s zContext.load_client_cac C s* t d|}ttj| j|t|dk dS )aV
Set the session id to *buf* within which a session can be reused for
this Context object. This is needed when doing session resumption,
because there is no way for a stored session to know which Context
object it is associated with.
:param bytes buf: The session id.
:returns: None
bufru N)r r r Z SSL_CTX_set_session_id_contextr r )r r rs rs rt set_session_id s
zContext.set_session_idc C s t |tstdtj| j|S )a
Set the behavior of the session cache used by all connections using
this Context. The previously set mode is returned. See
:const:`SESS_CACHE_*` for details about particular modes.
:param mode: One or more of the SESS_CACHE_* flags (combine using
bitwise or)
:returns: The previously set caching mode.
.. versionadded:: 0.14
zmode must be an integer)r r r r Z SSL_CTX_set_session_cache_moder )r moders rs rt set_session_cache_mode s
z Context.set_session_cache_modec C s t j| jS )z
Get the current session cache mode.
:returns: The currently used cache mode.
.. versionadded:: 0.14
)r Z SSL_CTX_get_session_cache_moder )r rs rs rt get_session_cache_mode, s z Context.get_session_cache_modec C sL t |tstdt|s"tdt|| _| jj| _tj | j
|| j dS )a
et the verification flags for this Context object to *mode* and specify
that *callback* should be used for verification callbacks.
:param mode: The verify mode, this should be one of
:const:`VERIFY_NONE` and :const:`VERIFY_PEER`. If
:const:`VERIFY_PEER` is used, *mode* can be OR:ed with
:const:`VERIFY_FAIL_IF_NO_PEER_CERT` and
:const:`VERIFY_CLIENT_ONCE` to further control the behaviour.
:param callback: The Python callback to use. This should take five
arguments: A Connection object, an X509 object, and three integer
variables, which are in turn potential error number, error depth
and return code. *callback* should return True if verification
passes and False otherwise.
:return: None
See SSL_CTX_set_verify(3SSL) for further details.
zmode must be an integerzcallback must be callableN) r r r r r r r r r ZSSL_CTX_set_verifyr )r r r rs rs rt
set_verify6 s
zContext.set_verifyc C s$ t |tstdtj| j| dS )z
Set the maximum depth for the certificate chain verification that shall
be allowed for this Context object.
:param depth: An integer specifying the verify depth
:return: None
zdepth must be an integerN)r r r r ZSSL_CTX_set_verify_depthr )r depthrs rs rt set_verify_depthS s
zContext.set_verify_depthc C s t j| jS )z
Retrieve the Context object's verify mode, as set by
:meth:`set_verify`.
:return: The verify mode
)r ZSSL_CTX_get_verify_moder )r rs rs rt get_verify_mode` s zContext.get_verify_modec C s t j| jS )z
Retrieve the Context object's verify depth, as set by
:meth:`set_verify_depth`.
:return: The verify depth
)r ZSSL_CTX_get_verify_depthr )r rs rs rt get_verify_depthi s zContext.get_verify_depthc C sh t |}tj|d}|tjkr$t tj|tj}tj|tjtjtj}tj|tj }tj
| j | dS )z
Load parameters for Ephemeral Diffie-Hellman
:param dhfile: The file to load EDH parameters from (``bytes`` or
``unicode``).
:return: None
rN) r r Z BIO_new_filer r r r ZBIO_freeZPEM_read_bio_DHparamsZDH_freeZSSL_CTX_set_tmp_dhr )r ZdhfilebioZdhrs rs rt load_tmp_dhr s
zContext.load_tmp_dhc C s t j| j|j dS )a
Select a curve to use for ECDHE key exchange.
:param curve: A curve object to use as returned by either
:meth:`OpenSSL.crypto.get_elliptic_curve` or
:meth:`OpenSSL.crypto.get_elliptic_curves`.
:return: None
N)r ZSSL_CTX_set_tmp_ecdhr Z
_to_EC_KEY)r Zcurvers rs rt set_tmp_ecdh s
zContext.set_tmp_ecdhc C sV t d|}t|ts tdttj| j|dk t| d}t|j dddgk dS )z
Set the list of ciphers to be used in this context.
See the OpenSSL manual for more information (e.g.
:manpage:`ciphers(1)`).
:param bytes cipher_list: An OpenSSL cipher string.
:return: None
cipher_listz"cipher_list must be a byte string.ru NZTLS_AES_256_GCM_SHA384Z TLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_GCM_SHA256)
r r bytesr r r ZSSL_CTX_set_cipher_listr rn get_cipher_list)r r+ Ztmpconnrs rs rt set_cipher_list s
zContext.set_cipher_listc C s t j }t|tjk yjxd|D ]\}t|ts@tdt|j f t j
|j }t|tjk t j ||}|s t j
| t q W W n tk
r t j| Y nX t j| j| dS )a_
Set the list of preferred client certificate signers for this server
context.
This list of certificate authorities will be sent to the client when
the server requests a client certificate.
:param certificate_authorities: a sequence of X509Names.
:return: None
.. versionadded:: 0.10
z3client CAs must be X509Name objects, not %s objectsN)r Zsk_X509_NAME_new_nullr r r r r r r rp
X509_NAME_dup_nameZsk_X509_NAME_pushX509_NAME_freer r Zsk_X509_NAME_freer r )r Zcertificate_authoritiesZ
name_stackZca_namer Z push_resultrs rs rt set_client_ca_list s$
zContext.set_client_ca_listc C s2 t |tstdtj| j|j}t|dk dS )ai
Add the CA certificate to the list of preferred signers for this
context.
The list of certificate authorities will be sent to the client when the
server requests a client certificate.
:param certificate_authority: certificate authority's X509 certificate.
:return: None
.. versionadded:: 0.10
z.certificate_authority must be an X509 instanceru N)r r r r ZSSL_CTX_add_client_CAr r r )r Zcertificate_authorityr rs rs rt
add_client_ca s
zContext.add_client_cac C s t |tstdtj| j|S )aQ
Set the timeout for newly created sessions for this Context object to
*timeout*. The default value is 300 seconds. See the OpenSSL manual
for more information (e.g. :manpage:`SSL_CTX_set_timeout(3)`).
:param timeout: The timeout in (whole) seconds
:return: The previous session timeout
ztimeout must be an integer)r r r r ZSSL_CTX_set_timeoutr )r Ztimeoutrs rs rt set_timeout s
zContext.set_timeoutc C s t j| jS )z
Retrieve session timeout, as set by :meth:`set_timeout`. The default
is 300 seconds.
:return: The session timeout
)r ZSSL_CTX_get_timeoutr )r rs rs rt get_timeout s zContext.get_timeoutc s6 t fdd}tjd|| _tj| j| j dS )a
Set the information callback to *callback*. This function will be
called from time to time during SSL handshakes.
:param callback: The Python callback to use. This should take three
arguments: a Connection object and two integers. The first integer
specifies where in the SSL handshake the function was called, and
the other the return code from a (possibly failed) internal
function call.
:return: None
c s t j| || d S )N)rn r )r whereZ return_code)r rs rt r s z*Context.set_info_callback..wrapperz void (*)(const SSL *, int, int)N)r r r r r ZSSL_CTX_set_info_callbackr )r r r rs )r rt set_info_callback s
zContext.set_info_callbackc C s | j S )zw
Get the application data (supplied via :meth:`set_app_data()`)
:return: The application data
)r )r rs rs rt get_app_data s zContext.get_app_datac C s
|| _ dS )z
Set the application data (will be returned from get_app_data())
:param data: Any Python object
:return: None
N)r )r r rs rs rt set_app_data s zContext.set_app_datac C s. t j| j}|tjkrdS tjt}||_|S )z
Get the certificate store for the context. This can be used to add
"trusted" certificates without using the
:meth:`load_verify_locations` method.
:return: A X509Store object or None if it does not have one.
N)r ZSSL_CTX_get_cert_storer r r r __new__Z_store)r ZstoreZpystorers rs rt get_cert_store& s
zContext.get_cert_storec C s t |tstdtj| j|S )z
Add options. Options set before are not cleared!
This method should be used with the :const:`OP_*` constants.
:param options: The options to add.
:return: The new option bitmask.
zoptions must be an integer)r r r r ZSSL_CTX_set_optionsr )r Zoptionsrs rs rt set_options7 s
zContext.set_optionsc C s t |tstdtj| j|S )z
Add modes via bitmask. Modes set before are not cleared! This method
should be used with the :const:`MODE_*` constants.
:param mode: The mode to add.
:return: The new mode bitmask.
zmode must be an integer)r r r r ZSSL_CTX_set_moder )r r rs rs rt r D s
zContext.set_modec s6 t fdd}tjd|| _tj| j| j dS )a
Specify a callback function to be called when clients specify a server
name.
:param callback: The callback function. It will be invoked with one
argument, the Connection instance.
.. versionadded:: 0.13
c s t j| dS )Nr )rn r )r Zalertr )r rs rt r \ s z7Context.set_tlsext_servername_callback..wrapperz int (*)(SSL *, int *, void *)N)r r r r r Z&SSL_CTX_set_tlsext_servername_callbackr )r r r rs )r rt set_tlsext_servername_callbackQ s
z&Context.set_tlsext_servername_callbackc C s, t |tstdttj| j|dk dS )z
Enable support for negotiating SRTP keying material.
:param bytes profiles: A colon delimited list of protection profile
names, like ``b'SRTP_AES128_CM_SHA1_80:SRTP_AES128_CM_SHA1_32'``.
:return: None
z profiles must be a byte string.r N)r r, r r r ZSSL_CTX_set_tlsext_use_srtpr )r Zprofilesrs rs rt set_tlsext_use_srtpf s
zContext.set_tlsext_use_srtpc C s, t || _| jj| _tj| j| jtj dS )a
Specify a callback function that will be called when offering `Next
Protocol Negotiation
`_ as a server.
:param callback: The callback function. It will be invoked with one
argument, the :class:`Connection` instance. It should return a
list of bytestrings representing the advertised protocols, like
``[b'http/1.1', b'spdy/2']``.
.. versionadded:: 0.15
N) r r r r r Z%SSL_CTX_set_next_protos_advertised_cbr r r )r r rs rs rt set_npn_advertise_callbacku s
z"Context.set_npn_advertise_callbackc C s, t || _| jj| _tj| j| jtj dS )a
Specify a callback function that will be called when a server offers
Next Protocol Negotiation options.
:param callback: The callback function. It will be invoked with two
arguments: the Connection, and a list of offered protocols as
bytestrings, e.g. ``[b'http/1.1', b'spdy/2']``. It should return
one of those bytestrings, the chosen protocol.
.. versionadded:: 0.15
N) r r r r r Z SSL_CTX_set_next_proto_select_cbr r r )r r rs rs rt set_npn_select_callback s
z Context.set_npn_select_callbackc C s> dj tjdd |D }tjd|}tj| j|t| dS )a
Specify the protocols that the client is prepared to speak after the
TLS connection has been negotiated using Application Layer Protocol
Negotiation.
:param protos: A list of the protocols to be offered to the server.
This list should be a Python list of bytestrings representing the
protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``.
r c s s | ]}t t||fV qd S )N)r r )r r rs rs rt r s z*Context.set_alpn_protos..zunsigned char[]N) r r r r r r ZSSL_CTX_set_alpn_protosr r )r r r input_strrs rs rt set_alpn_protos s
zContext.set_alpn_protosc C s, t || _| jj| _tj| j| jtj dS )a
Specify a callback function that will be called on the server when a
client offers protocols using ALPN.
:param callback: The callback function. It will be invoked with two
arguments: the Connection, and a list of offered protocols as
bytestrings, e.g ``[b'http/1.1', b'spdy/2']``. It should return
one of those bytestrings, the chosen protocol.
N) r r r r r ZSSL_CTX_set_alpn_select_cbr r r )r r rs rs rt set_alpn_select_callback s
z Context.set_alpn_select_callbackc C sh || _ |j| _|dkr tj| _n tj|| _tj| j | j}t
|dk tj | j | j}t
|dk dS )z
This internal helper does the common work for
``set_ocsp_server_callback`` and ``set_ocsp_client_callback``, which is
almost all of it.
Nru ) r r r r r r Z
new_handler Z SSL_CTX_set_tlsext_status_cbr r Z SSL_CTX_set_tlsext_status_arg)r helperr rcrs rs rt _set_ocsp_callback s
zContext._set_ocsp_callbackc C s t |}| j|| dS )a
Set a callback to provide OCSP data to be stapled to the TLS handshake
on the server side.
:param callback: The callback function. It will be invoked with two
arguments: the Connection, and the optional arbitrary data you have
provided. The callback must return a bytestring that contains the
OCSP data to staple to the handshake. If no OCSP data is available
for this connection, return the empty bytestring.
:param data: Some opaque data that will be passed into the callback
function when called. This can be used to avoid needing to do
complex data lookups or to keep track of what context is being
used. This parameter is optional.
N)r rF )r r r rD rs rs rt set_ocsp_server_callback s z Context.set_ocsp_server_callbackc C s t |}| j|| dS )a
Set a callback to validate OCSP data stapled to the TLS handshake on
the client side.
:param callback: The callback function. It will be invoked with three
arguments: the Connection, a bytestring containing the stapled OCSP
assertion, and the optional arbitrary data you have provided. The
callback must return a boolean that indicates the result of
validating the OCSP data: ``True`` if the OCSP data is valid and
the certificate can be trusted, or ``False`` if either the OCSP
data is invalid or the certificate has been revoked.
:param data: Some opaque data that will be passed into the callback
function when called. This can be used to avoid needing to do
complex data lookups or to keep track of what context is being
used. This parameter is optional.
N)r rF )r r r rD rs rs rt set_ocsp_client_callback s z Context.set_ocsp_client_callback)N)N)N)N)?rp rq rr r r% r& r' r( r) r* r dictitemsr r r r r r r r r r r r r r r r r r r r r! r" r$ r% r& r) r* r. r2 r3 r4 r5 r7 r8 r9 r; r< r
_requires_snir= r>
_requires_npnr? r@ _requires_alpnrB rC rF rG rH rs rs rs rt rm sn .
1
%
z4ContextType has been deprecated, use Context insteadc @ s e Zd ZdZe ZdxddZdd Zdd Zd d
Z d d Z
e d
d Z e dd Z
dd ZdyddZeZdzddZd{ddZeZd|ddZd d Zd d Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Z d,d- Z d.d/ Z d0d1 Z d2d3 Z d4d5 Z!d6d7 Z"d8d9 Z#d:d; Z$dd? Z&d@dA Z'dBdC Z(dDdE Z)dFdG Z*dHdI Z+d}dJdKZ,dLdM Z-dNdO Z.dPdQ Z/dRdS Z0dTdU Z1dVdW Z2dXdY Z3dZd[ Z4d\d] Z5d^d_ Z6d`da Z7dbdc Z8ddde Z9dfdg Z:dhdi Z;djdk Ze?dpdq Z@eAdrds ZBeAdtdu ZCdvdw ZDdS )~rn z
Nc C s t |tstdtj|j}tj|tj| _ tj
| j tj || _d| _ d| _
d| _d| _| | j| j < |dkrd| _tjtj | _t| jtjk tjtj | _t| jtjk tj| j | j| j n2d| _d| _|| _tj| j t| j}t|dk dS )z
Create a new Connection object, using the given OpenSSL.SSL.Context
instance and socket.
:param context: An SSL Context to use for this connection
:param socket: The socket to use for transport layer
z"context must be a Context instanceNru )r rm r r ZSSL_newr r r ZSSL_free_sslZ SSL_set_modeZSSL_MODE_AUTO_RETRYr r r r r _socketZBIO_newZ BIO_s_mem _into_sslr r _from_sslZ SSL_set_bioZ
SSL_set_fdr )r r socketr r rs rs rt r s0
zConnection.__init__c C s0 | j dkr td| jj|f n t| j |S dS )zy
Look up attributes on the wrapped socket object if they are not found
on the Connection object.
Nz!'%s' object has no attribute '%s')rO r __class__rp r )r r rs rs rt __getattr__< s
zConnection.__getattr__c C sT | j jd k r| j jj | j jd k r0| j jj | j jd k rH| j jj | j jd k r`| j jj | j jd k rx| j jj tj||}|tj krt
n|tj krt n|tj
krt n|tjkrt n|tjkr
Retrieve the protocol version of the current connection.
:returns: The TLS version of the current connection, for example
the value for TLS 1.2 would be ``TLSv1.2``or ``Unknown``
for connections that were not successfully established.
:rtype: :class:`unicode`
zutf-8)r r r ZSSL_get_versionrN r )r r rs rs rt get_protocol_version_namef s z$Connection.get_protocol_version_namec C s t j| j}|S )a
Retrieve the SSL or TLS protocol version of the current connection.
:returns: The TLS version of the current connection. For example,
it will return ``0x769`` for connections made over TLS version 1.
:rtype: :class:`int`
)r Z SSL_versionrN )r r rs rs rt get_protocol_versionr s z Connection.get_protocol_versionc C s@ t jd}t jd}tj| j|| t j|d |d dd S )z
Get the protocol that was negotiated by NPN.
:returns: A bytestring of the protocol name. If no protocol has been
negotiated yet, returns an empty string.
.. versionadded:: 0.15
zunsigned char **zunsigned int *r N)r r r Z SSL_get0_next_proto_negotiatedrN r )r r data_lenrs rs rt get_next_proto_negotiated} s
z$Connection.get_next_proto_negotiatedc C s> dj tjdd |D }tjd|}tj| j|t| dS )ah
Specify the client's ALPN protocol list.
These protocols are offered to the server during protocol negotiation.
:param protos: A list of the protocols to be offered to the server.
This list should be a Python list of bytestrings representing the
protocols to offer, e.g. ``[b'http/1.1', b'spdy/2']``.
r c s s | ]}t t||fV qd S )N)r r )r r rs rs rt r s z-Connection.set_alpn_protos..zunsigned char[]N) r r r r r r ZSSL_set_alpn_protosrN r )r r r rA rs rs rt rB s
zConnection.set_alpn_protosc C sH t jd}t jd}tj| j|| |s,dS t j|d |d dd S )z
Get the protocol that was negotiated by ALPN.
:returns: A bytestring of the protocol name. If no protocol has been
negotiated yet, returns an empty string.
zunsigned char **zunsigned int *r r N)r r r ZSSL_get0_alpn_selectedrN r )r r r rs rs rt get_alpn_proto_negotiated s
z$Connection.get_alpn_proto_negotiatedc C s t j| jt j}t|dk dS )a
Called to request that the server sends stapled OCSP data, if
available. If this is not called on the client side then the server
will not send OCSP data. Should be used in conjunction with
:meth:`Context.set_ocsp_client_callback`.
ru N)r ZSSL_set_tlsext_status_typerN ZTLSEXT_STATUSTYPE_ocspr )r rE rs rs rt request_ocsp s zConnection.request_ocsp)N)r )r )N)NN)N)Erp rq rr r r r r rT rV rW rX rK rY r[ r\ rb writerd rj readrl rn ro rp rr rs rq rt rv rx rz r| r} r- r r r8 r9 r r r r r r r r r r r r r r{ ry r r r r r r r r r r rL r rM rB r r rs rs rs rt rn s|
6 )
$
%
" z:ConnectionType has been deprecated, use Connection instead)r rR sysr functoolsr r itertoolsr r weakrefr rU r Zcryptography.utilsr Zsixr
r r r r
Z
OpenSSL._utilr r r Z_exception_from_error_queuer r r r r Z _make_assertr r~ r r r r r re ZOpenSSL.cryptor r r r r r __all__r ro NameErrorobjectr r r r r! r" ZSSL_SENT_SHUTDOWNr# ZSSL_RECEIVED_SHUTDOWNr$ r% r& r' r( r) r* ZSSL_OP_NO_SSLv2r+ ZSSL_OP_NO_SSLv3r, ZSSL_OP_NO_TLSv1r- ZSSL_OP_NO_TLSv1_1r. ZSSL_OP_NO_TLSv1_2r/ ZSSL_MODE_RELEASE_BUFFERSr0 ZSSL_OP_SINGLE_DH_USEr1 ZSSL_OP_SINGLE_ECDH_USEr2 ZSSL_OP_EPHEMERAL_RSAr3 Z SSL_OP_MICROSOFT_SESS_ID_BUGr4 Z SSL_OP_NETSCAPE_CHALLENGE_BUGr5 Z'SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUGr6 Z"SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUGr7 Z!SSL_OP_MICROSOFT_BIG_SSLV3_BUFFERr8 Z SSL_OP_MSIE_SSLV2_RSA_PADDINGr9 Z SSL_OP_SSLEAY_080_CLIENT_DH_BUGr: ZSSL_OP_TLS_D5_BUGr; Z SSL_OP_TLS_BLOCK_PADDING_BUGr< Z"SSL_OP_DONT_INSERT_EMPTY_FRAGMENTSr= Z SSL_OP_CIPHER_SERVER_PREFERENCEr> ZSSL_OP_TLS_ROLLBACK_BUGr? ZSSL_OP_PKCS1_CHECK_1r@ ZSSL_OP_PKCS1_CHECK_2rA ZSSL_OP_NETSCAPE_CA_DN_BUGrB Z&SSL_OP_NETSCAPE_DEMO_CIPHER_CHANGE_BUGrC ZSSL_OP_NO_COMPRESSIONrD ZSSL_OP_NO_QUERY_MTUrE ZSSL_OP_COOKIE_EXCHANGErF ZSSL_OP_NO_TICKETrG Z
SSL_OP_ALLrH ZSSL_VERIFY_PEERrI Z SSL_VERIFY_FAIL_IF_NO_PEER_CERTrJ ZSSL_VERIFY_CLIENT_ONCErK ZSSL_VERIFY_NONErL ZSSL_SESS_CACHE_OFFrM ZSSL_SESS_CACHE_CLIENTrN ZSSL_SESS_CACHE_SERVERrO ZSSL_SESS_CACHE_BOTHrP Z SSL_SESS_CACHE_NO_AUTO_CLEARrQ Z!SSL_SESS_CACHE_NO_INTERNAL_LOOKUPrR Z SSL_SESS_CACHE_NO_INTERNAL_STORErS ZSSL_SESS_CACHE_NO_INTERNALrT rU rV rW ZCryptography_HAS_SSL_STr{ r| r} r~ extendrX rY rZ r[ r\ r] r^ r_ r` ra rb rc rd r r r r r re r r rf rg rh ri rj r r r r r r r r rk r Z Cryptography_HAS_NEXTPROTONEGrL ZCryptography_HAS_ALPNrM Z Cryptography_HAS_TLSEXT_HOSTNAMErK rl rm rp DeprecationWarningZ ContextTypern ZConnectionTypeZSSL_library_initrs rs rs rt s ,
')13C;
Z I