î
)Ú X.  ã            '   @   s*  d  Z  d d l m Z y$ d d l m Z d d l m Z Wn1 e k
 rm Z	 z e
 e	 ƒ ‚ WYd d Z	 [	 Xn Xd d l Z d d l m Z d d l m Z m Z d d l m Z m Z y d d	 l m Z Wn( e
 k
 rô d Z d d
 l m Z Yn Xd d l Z d d l Z d d l Z d d l m Z d d l m Z d d g Z  e Z! i e j" j# e j$ 6e j" j% e j& 6Z' e( e d ƒ r¨e( e j" d ƒ r¨e j" j) e' e j* <n  e( e d ƒ rße( e j" d ƒ rße j" j+ e' e j, <n  y! e' j- i e j" j. e j/ 6ƒ Wn e0 k
 rYn Xi e j" j1 e j2 6e j" j3 e j4 6e j" j3 e j" j5 e j6 6Z7 e j8 j9 j: d ƒ Z; d Z< e j! Z= e j> Z? d d „  Z@ d d „  ZA Gd d „  d e ƒ Z d d „  ZB Gd d „  d eC ƒ ZD e rêd% d d  „ ZE n e ZE eE eD _E d! d" „  ZF d d d d d d d d# d$ „ Z> d S)&a!  SSL with SNI_-support for Python 2. Follow these instructions if you would
like to verify SSL certificates in Python 2. Note, the default libraries do
*not* do certificate checking; you need to do additional work to validate
certificates yourself.

This needs the following packages installed:

* pyOpenSSL (tested with 0.13)
* ndg-httpsclient (tested with 0.3.2)
* pyasn1 (tested with 0.1.6)

You can install them with the following command:

    pip install pyopenssl ndg-httpsclient pyasn1

To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this::

    try:
        import urllib3.contrib.pyopenssl
        urllib3.contrib.pyopenssl.inject_into_urllib3()
    except ImportError:
        pass

Now you can use :mod:`urllib3` as you normally would, and it will support SNI
when the required modules are installed.

Activating this module also has the positive side effect of disabling SSL/TLS
compression in Python 2 (see `CRIME attack`_).

If you want to configure the default list of supported cipher suites, you can
set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.

Module Variables
----------------

:var DEFAULT_SSL_CIPHER_LIST: The list of supported SSL/TLS cipher suites.

.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)

é    )Úabsolute_import)ÚSUBJ_ALT_NAME_SUPPORT)ÚSubjectAltNameN)Údecoder)ÚunivÚ
constraint)ÚtimeoutÚerror)Ú_fileobject)Úbackport_makefileé   )Ú
connection)ÚutilÚinject_into_urllib3Úextract_from_urllib3ÚPROTOCOL_TLSv1_1ÚTLSv1_1_METHODÚPROTOCOL_TLSv1_2ÚTLSv1_2_METHODÚasciii @  c               C   s   t  t _  t t _ d t _ d S)z7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.TN)Ússl_wrap_socketr   ÚHAS_SNIr   ÚIS_PYOPENSSL© r   r   ú[/home/ubuntu/projects/ifolica/build/requests/requests/packages/urllib3/contrib/pyopenssl.pyr   n   s    		c               C   s   t  t _ t t _ d t _ d S)z4Undo monkey-patching by :func:`inject_into_urllib3`.FN)Úorig_connection_ssl_wrap_socketr   r   Úorig_util_HAS_SNIr   r   r   r   r   r   r   r   v   s    		c               @   s2   e  Z d  Z d Z e j j e j d d ƒ Z d S)r   z0ASN.1 implementation for subjectAltNames supporté   i   N)	Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   Z
SequenceOfZsizeSpecr   ZValueSizeConstraintr   r   r   r   r      s   	r   c             C   s  g  } t  s | St ƒ  } xë t |  j ƒ  ƒ D]× } |  j | ƒ } | j ƒ  } | d k r_ q, n  | j ƒ  } t j | d | ƒ} x€ | D]x } t	 | t ƒ s¢ q‡ n  xZ t t
 | ƒ ƒ D]F }	 | j |	 ƒ }
 |
 j ƒ  d k râ qµ n  | j t |
 j ƒ  ƒ ƒ qµ Wq‡ Wq, W| S)Ns   subjectAltNameZasn1SpecZdNSName)r   r   ÚrangeZget_extension_countÚget_extensionZget_short_nameÚget_dataÚder_decoderÚdecodeÚ
isinstanceÚlenZgetComponentByPositionÚgetNameÚappendÚstrZgetComponent)Z	peer_certZdns_nameZgeneral_namesÚiÚextZext_nameZext_datZdecoded_datÚnameÚentryÚ	componentr   r   r   Úget_subj_alt_nameŠ   s*    		%r1   c               @   s¸   e  Z d  Z d Z d d d „ Z d d „  Z d d „  Z d	 d
 „  Z d d „  Z d d „  Z	 d d „  Z
 d d „  Z d d „  Z d d „  Z d d d „ Z d d „  Z d d „  Z d S)ÚWrappedSocketz§API-compatibility wrapper for Python OpenSSL's Connection-class.

    Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
    collector of pypy.
    Tc             C   s1   | |  _  | |  _ | |  _ d |  _ d |  _ d  S)Nr   F)r   ÚsocketÚsuppress_ragged_eofsÚ_makefile_refsÚ_closed)Úselfr   r3   r4   r   r   r   Ú__init__¯   s
    				zWrappedSocket.__init__c             C   s   |  j  j ƒ  S)N)r3   Úfileno)r7   r   r   r   r9   ¶   s    zWrappedSocket.filenoc             C   s;   |  j  d k r! |  j  d 8_  n  |  j r7 |  j ƒ  n  d  S)Nr   r   )r5   r6   Úclose)r7   r   r   r   Ú_decref_socketiosº   s    	zWrappedSocket._decref_socketiosc             O   s5  y |  j  j | | Ž  } Wnt j j k
 rt } z3 |  j rP | j d k rP d St t | ƒ ƒ ‚ WYd  d  } ~ Xn½ t j j	 k
 rÀ } z' |  j  j
 ƒ  t j j k r« d S‚  WYd  d  } ~ Xnq t j j k
 r,t j |  j g g  g  |  j j ƒ  ƒ \ } } } | st d ƒ ‚ n |  j | | Ž  SYn X| Sd  S)Nr   úUnexpected EOFó    zThe read operation timed outéÿÿÿÿ)r>   r<   )r   ÚrecvÚOpenSSLÚSSLÚSysCallErrorr4   ÚargsÚSocketErrorr+   ÚZeroReturnErrorÚget_shutdownÚRECEIVED_SHUTDOWNÚWantReadErrorÚselectr3   Ú
gettimeoutr   )r7   rC   ÚkwargsÚdataÚeÚrdÚwdÚedr   r   r   r?   À   s"    $*zWrappedSocket.recvc             O   s/  y |  j  j | | Ž  SWnt j j k
 rr } z3 |  j rN | j d k rN d St t | ƒ ƒ ‚ WYd  d  } ~ Xn¹ t j j	 k
 r¾ } z' |  j  j
 ƒ  t j j k r© d S‚  WYd  d  } ~ Xnm t j j k
 r*t j |  j g g  g  |  j j ƒ  ƒ \ } } } | st d ƒ ‚ n |  j | | Ž  SYn Xd  S)Nr   úUnexpected EOFr   zThe read operation timed outr>   )r>   rQ   )r   Ú	recv_intor@   rA   rB   r4   rC   rD   r+   rE   rF   rG   rH   rI   r3   rJ   r   )r7   rC   rK   rM   rN   rO   rP   r   r   r   rR   ×   s     $*zWrappedSocket.recv_intoc             C   s   |  j  j | ƒ S)N)r3   Ú
settimeout)r7   r   r   r   r   rS   ì   s    zWrappedSocket.settimeoutc             C   s   xx y |  j  j | ƒ SWq t j j k
 rv t j g  |  j g g  |  j j ƒ  ƒ \ } } } | so t ƒ  ‚ n  w Yq Xq Wd  S)N)	r   Úsendr@   rA   ZWantWriteErrorrI   r3   rJ   r   )r7   rL   Ú_Zwlistr   r   r   Ú_send_until_doneï   s    zWrappedSocket._send_until_donec             C   sJ   d } x= | t  | ƒ k  rE |  j | | | t … ƒ } | | 7} q	 Wd  S)Nr   )r(   rV   ÚSSL_WRITE_BLOCKSIZE)r7   rL   Z
total_sentZsentr   r   r   Úsendallú   s    zWrappedSocket.sendallc             C   s   |  j  j ƒ  d  S)N)r   Úshutdown)r7   r   r   r   rY      s    zWrappedSocket.shutdownc             C   s^   |  j  d k  rK y d |  _ |  j j ƒ  SWqZ t j j k
 rG d  SYqZ Xn |  j  d 8_  d  S)Nr   T)r5   r6   r   r:   r@   rA   ÚError)r7   r   r   r   r:     s    	zWrappedSocket.closeFc             C   sr   |  j  j ƒ  } | s | S| r8 t j j t j j | ƒ Si d | j ƒ  j f f f d 6d d „  t | ƒ Dƒ d 6S)NÚ
commonNameÚsubjectc             S   s   g  |  ] } d  | f ‘ q S)ÚDNSr   )Ú.0Úvaluer   r   r   ú
<listcomp>  s   	z-WrappedSocket.getpeercert.<locals>.<listcomp>ÚsubjectAltName)	r   Zget_peer_certificater@   ZcryptoZdump_certificateZFILETYPE_ASN1Zget_subjectZCNr1   )r7   Úbinary_formÚx509r   r   r   Úgetpeercert  s    			zWrappedSocket.getpeercertc             C   s   |  j  d 7_  d  S)Nr   )r5   )r7   r   r   r   Ú_reuse#  s    zWrappedSocket._reusec             C   s/   |  j  d k  r |  j ƒ  n |  j  d 8_  d  S)Nr   )r5   r:   )r7   r   r   r   Ú_drop&  s    zWrappedSocket._dropN)r   r   r    r!   r8   r9   r;   r?   rR   rS   rV   rX   rY   r:   rd   re   rf   r   r   r   r   r2   ¨   s   
r2   r   c             C   s%   |  j  d 7_  t |  | | d d ƒS)Nr   r:   T)r5   r
   )r7   ÚmodeÚbufsizer   r   r   Úmakefile.  s    ri   c             C   s
   | d k S)Nr   r   )Úcnxrc   Zerr_noZ	err_depthZreturn_coder   r   r   Ú_verify_callback7  s    rk   c             C   s  t  j j t | ƒ } | r8 | p% | } | j | ƒ n  | rN | j | ƒ n  | t j k rt | j t	 | t
 ƒ n  | s€ | rÛ y | j | | ƒ Wqå t  j j k
 r× }	 z t j d | |	 ƒ ‚ WYd  d  }	 ~	 Xqå Xn
 | j ƒ  d }
 | j |
 ƒ | j t ƒ t  j j | |  ƒ } t | t j ƒ r>| j d ƒ } n  | j | ƒ | j ƒ  x­ y | j ƒ  Wn— t  j j k
 rÂt j |  g g  g  |  j ƒ  ƒ \ } } } | s»t d ƒ ‚ n  wXYn> t  j j k
 rÿ}	 z t j d |	 ƒ ‚ WYd  d  }	 ~	 Xn XPqXWt | |  ƒ S)Nzbad ca_certs: %ri   zutf-8zselect timed outzbad handshake: %r)r@   rA   ZContextÚ_openssl_versionsZuse_certificate_fileZuse_privatekey_fileÚsslÚ	CERT_NONEZ
set_verifyÚ_openssl_verifyrk   Úload_verify_locationsrZ   ÚSSLErrorÚset_default_verify_pathsZset_optionsZset_cipher_listÚDEFAULT_SSL_CIPHER_LISTÚ
Connectionr'   ÚsixÚ	text_typeÚencodeZset_tlsext_host_nameZset_connect_stateÚdo_handshakerH   rI   rJ   r   r2   )ÚsockÚkeyfileÚcertfileÚ	cert_reqsÚca_certsÚserver_hostnameÚssl_versionZca_cert_dirÚctxrM   ÚOP_NO_COMPRESSIONrj   rN   rU   r   r   r   r   ;  sD    ,

*&r   r>   )Gr!   Ú
__future__r   Z%ndg.httpsclient.ssl_peer_verificationr   Zndg.httpsclient.subj_alt_namer   ZBaseSubjectAltNameÚSyntaxErrorrM   ÚImportErrorZOpenSSL.SSLr@   Zpyasn1.codec.derr   r%   Zpyasn1.typer   r   r3   r   r	   rD   r
   Z#urllib3.packages.backports.makefiler   rm   rI   ru   Ú r   r   Ú__all__r   rA   ZSSLv23_METHODÚPROTOCOL_SSLv23ZTLSv1_METHODÚPROTOCOL_TLSv1rl   Úhasattrr   r   r   r   ÚupdateZSSLv3_METHODÚPROTOCOL_SSLv3ÚAttributeErrorZVERIFY_NONErn   ZVERIFY_PEERÚCERT_OPTIONALZVERIFY_FAIL_IF_NO_PEER_CERTÚCERT_REQUIREDro   Zssl_ZDEFAULT_CIPHERSrw   rs   rW   r   r   r   r   r   r1   Úobjectr2   ri   rk   r   r   r   r   Ú<module>-   sl   !!!			…		