Aic @ s: d Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z d d l Z d d l m Z m Z m Z d d l m Z d d l m Z m Z m Z m Z m Z m Z d d l m Z m Z m Z d d l m Z m Z m Z m Z d d l m Z m Z d d l m Z m Z m! Z! d Z" e" d e" d e" d e" d d d l m# Z# m$ Z$ m% Z% d d l m& Z& d e' j( D Z) y e* Z+ Wn e, k re- Z+ n Xd d l. m. Z. m/ Z/ m0 Z0 m1 Z2 e j3 d k rd d l m4 Z4 m5 Z5 n d d l. m. Z. m6 Z6 m7 Z7 m8 Z8 d d l. m9 Z9 m: Z: d d l; Z; d d l< Z< e j= rud g Z> n g Z> d Z? d Z@ d eA f d YZB d d ZC d ZD e d! d" ZE d# ZF d$ e d$ d% f d& YZG d' eG f d( YZH eH d) eH _I eH d* eH _J d+ e f d, YZK eH jI e- e- e- d- ZL eM e- eN eH jI e- e- e- e- e- d. ZO d/ ZP d0 ZQ d1 ZR d2 ZS eT d3 ZU eS d4 aV eO ZW d5 e. f d6 YZX e- e- eN e eM e- eT eT e- d7 ZY d8 ZZ d9 Z[ d: Z\ d; Z] d< Z^ eM e- d= Z_ d> Z` e- e- d? Za d S(@ s This module provides some more Pythonic support for SSL. Object types: SSLSocket -- subtype of socket.socket which does SSL over the socket Exceptions: SSLError -- exception raised for I/O errors Functions: cert_time_to_seconds -- convert time string used for certificate notBefore and notAfter functions to integer seconds past the Epoch (the time values returned from time.time()) fetch_server_certificate (HOST, PORT) -- fetch the certificate provided by the server running on HOST at port PORT. No validation of the certificate is performed. Integer constants: SSL_ERROR_ZERO_RETURN SSL_ERROR_WANT_READ SSL_ERROR_WANT_WRITE SSL_ERROR_WANT_X509_LOOKUP SSL_ERROR_SYSCALL SSL_ERROR_SSL SSL_ERROR_WANT_CONNECT SSL_ERROR_EOF SSL_ERROR_INVALID_ERROR_CODE The following group define certificate requirements that one side is allowing/requiring from the other side: CERT_NONE - no certificates from the other side are required (or will be looked at if provided) CERT_OPTIONAL - certificates are not required, but if provided will be validated, and if validation fails, the connection will also fail CERT_REQUIRED - certificates are required, and will be validated, and if validation fails, the connection will also fail The following constants identify various SSL protocol variants: PROTOCOL_SSLv2 PROTOCOL_SSLv3 PROTOCOL_SSLv23 PROTOCOL_TLSv1 PROTOCOL_TLSv1_1 PROTOCOL_TLSv1_2 The following constants identify various SSL alert message descriptions as per http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6 ALERT_DESCRIPTION_CLOSE_NOTIFY ALERT_DESCRIPTION_UNEXPECTED_MESSAGE ALERT_DESCRIPTION_BAD_RECORD_MAC ALERT_DESCRIPTION_RECORD_OVERFLOW ALERT_DESCRIPTION_DECOMPRESSION_FAILURE ALERT_DESCRIPTION_HANDSHAKE_FAILURE ALERT_DESCRIPTION_BAD_CERTIFICATE ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE ALERT_DESCRIPTION_CERTIFICATE_REVOKED ALERT_DESCRIPTION_CERTIFICATE_EXPIRED ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN ALERT_DESCRIPTION_ILLEGAL_PARAMETER ALERT_DESCRIPTION_UNKNOWN_CA ALERT_DESCRIPTION_ACCESS_DENIED ALERT_DESCRIPTION_DECODE_ERROR ALERT_DESCRIPTION_DECRYPT_ERROR ALERT_DESCRIPTION_PROTOCOL_VERSION ALERT_DESCRIPTION_INSUFFICIENT_SECURITY ALERT_DESCRIPTION_INTERNAL_ERROR ALERT_DESCRIPTION_USER_CANCELLED ALERT_DESCRIPTION_NO_RENEGOTIATION ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE ALERT_DESCRIPTION_UNRECOGNIZED_NAME ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY iN( t namedtuple( t closing( t OPENSSL_VERSION_NUMBERt OPENSSL_VERSION_INFOt OPENSSL_VERSION( t _SSLContext( t SSLErrort SSLZeroReturnErrort SSLWantReadErrort SSLWantWriteErrort SSLSyscallErrort SSLEOFError( t CERT_NONEt CERT_OPTIONALt CERT_REQUIRED( t VERIFY_DEFAULTt VERIFY_CRL_CHECK_LEAFt VERIFY_CRL_CHECK_CHAINt VERIFY_X509_STRICT( t txt2objt nid2obj( t RAND_statust RAND_egdt RAND_addc C sC x< t t D]. } | j | r t t | t | <q q Wd S( N( t dirt _sslt startswitht getattrt globals( t prefixt n( ( s /usr/lib64/python2.7/ssl.pyt _import_symbolso s t OP_t ALERT_DESCRIPTION_t SSL_ERROR_t PROTOCOL_( t HAS_SNIt HAS_ECDHt HAS_NPN( t _OPENSSL_API_VERSIONc C s. i | ]$ \ } } | j d r | | q S( R# ( R ( t .0t namet value( ( s /usr/lib64/python2.7/ssl.pys <dictcomp>} s ( t sockett _fileobjectt _delegate_methodst errort win32( t enum_certificatest enum_crls( R+ t AF_INETt SOCK_STREAMt create_connection( t SOL_SOCKETt SO_TYPEs tls-uniques ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:ECDH+RC4:DH+RC4:RSA+RC4:!aNULL:!eNULL:!MD5:!3DESs ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:DH+HIGH:RSA+AESGCM:RSA+AES:RSA+HIGH:!aNULL:!eNULL:!MD5:!DSS:!RC4:!3DESt CertificateErrorc B s e Z RS( ( t __name__t __module__( ( ( s /usr/lib64/python2.7/ssl.pyR7 s i c C sR g } | s t S| j d } | d } | d } | j d } | | k rg t d t | n | s | j | j k S| d k r | j d nY | j d s | j d r | j t j | n" | j t j | j d d x$ | D] } | j t j | q Wt j d d j | d t j } | j | S( sh Matching according to RFC 6125, section 6.4.3 http://tools.ietf.org/html/rfc6125#section-6.4.3 t .i i t *s, too many wildcards in certificate DNS name: s [^.]+s xn--s \*s [^.]*s \As \.s \Z( t Falset splitt countR7 t reprt lowert appendR t ret escapet replacet compilet joint IGNORECASEt match( t dnt hostnamet max_wildcardst patst piecest leftmostt remaindert wildcardst fragt pat( ( s /usr/lib64/python2.7/ssl.pyt _dnsname_match s* " &c C s[ | s t d n g } | j d d } xC | D]; \ } } | d k r4 t | | r_ d S| j | q4 q4 W| s xc | j d d D]L } xC | D]; \ } } | d k r t | | r d S| j | q q Wq Wn t | d k r t d | d j t t | f n; t | d k rKt d | | d f n t d d S( s) Verify that *cert* (in decoded format as returned by SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125 rules are followed, but IP addresses are not accepted for *hostname*. CertificateError is raised on failure. On success, the function returns nothing. st empty or no certificate, match_hostname needs a SSL socket or SSL context with either CERT_OPTIONAL or CERT_REQUIREDt subjectAltNamet DNSNt subjectt commonNamei s& hostname %r doesn't match either of %ss , s hostname %r doesn't match %ri s= no appropriate commonName or subjectAltName fields were found( ( ( t ValueErrort getRS RA t lenR7 RF t mapR? ( t certRJ t dnsnamest sant keyR* t sub( ( s /usr/lib64/python2.7/ssl.pyt match_hostname s. %t DefaultVerifyPathssQ cafile capath openssl_cafile_env openssl_cafile openssl_capath_env openssl_capathc C s t j } t j j | d | d } t j j | d | d } t t j j | ra | n d t j j | r| | n d | S( s/ Return paths to default cafile and capath. i i i i N( R t get_default_verify_pathst ost environRY Rb t patht isfilet Nonet isdir( t partst cafilet capath( ( s /usr/lib64/python2.7/ssl.pyRc s t _ASN1Objects nid shortname longname oidc B s; e Z d Z d Z d Z e d Z e d Z RS( s# ASN.1 object identifier lookup c C s% t t | j | t | d t S( NR) ( t superRm t __new__t _txt2objR< ( t clst oid( ( s /usr/lib64/python2.7/ssl.pyRo , s c C s t t | j | t | S( s3 Create _ASN1Object from OpenSSL numeric ID ( Rn Rm Ro t _nid2obj( Rq t nid( ( s /usr/lib64/python2.7/ssl.pyt fromnid/ s c C s% t t | j | t | d t S( s= Create _ASN1Object from short name, long name or OID R) ( Rn Rm Ro Rp t True( Rq R) ( ( s /usr/lib64/python2.7/ssl.pyt fromname5 s ( ( R8 R9 t __doc__t __slots__Ro t classmethodRu Rw ( ( ( s /usr/lib64/python2.7/ssl.pyRm ' s t Purposec B s e Z d Z RS( sD SSLContext purpose flags with X509v3 Extended Key Usage objects ( R8 R9 Rx ( ( ( s /usr/lib64/python2.7/ssl.pyR{ < s s 1.3.6.1.5.5.7.3.1s 1.3.6.1.5.5.7.3.2t SSLContextc B sb e Z d Z d Z d Z d Z d Z e e e d d Z d Z d Z e j d Z RS( s| An SSLContext holds various SSL-related configuration options and data, such as certificates and possibly a private key.t protocolt __weakref__t CAt ROOTc O s2 t j | | } | t k r. | j t n | S( N( R Ro t _SSLv2_IF_EXISTSt set_cipherst _DEFAULT_CIPHERS( Rq R} t argst kwargst self( ( s /usr/lib64/python2.7/ssl.pyRo K s c C s | | _ d S( N( R} ( R R} ( ( s /usr/lib64/python2.7/ssl.pyt __init__Q s c C s+ t d | d | d | d | d | d | S( Nt sockt server_sidet do_handshake_on_connectt suppress_ragged_eofst server_hostnamet _context( t SSLSocket( R R R R R R ( ( s /usr/lib64/python2.7/ssl.pyt wrap_socketT s c C s t } xp | D]h } | j d } t | d k sI t | d k rX t d n | j t | | j | q W| j | d S( Nt asciii i s( NPN protocols must be 1 to 255 in length( t bytearrayt encodeRZ R RA t extendt _set_npn_protocols( R t npn_protocolst protosR} t b( ( s /usr/lib64/python2.7/ssl.pyt set_npn_protocols^ s $c C sw t } xW t | D]I \ } } } | d k r | t k sL | j | k r_ | j | q_ q q W| j d | | S( Nt x509_asnt cadata( R R0 Rv Rr R t load_verify_locations( R t storenamet purposet certsR\ t encodingt trust( ( s /usr/lib64/python2.7/ssl.pyt _load_windows_store_certsi s c C sb t | t s t | n t j d k rT x. | j D] } | j | | q7 Wn | j d S( NR/ ( t isinstanceRm t TypeErrort syst platformt _windows_cert_storesR t set_default_verify_paths( R R R ( ( s /usr/lib64/python2.7/ssl.pyt load_default_certss s ( s protocols __weakref__( R R N( R8 R9 Rx Ry R Ro R R< Rv Rh R R R R{ t SERVER_AUTHR ( ( ( s /usr/lib64/python2.7/ssl.pyR| D s c C sB t | t s t | n t t } | j t O_ | j t O_ | j t t d d O_ | t j k r t | _ t | _ np | t j k r | j t t d d O_ | j t t d d O_ | j t t d d O_ | j t n | s | s | r | j | | | n | j t k r>| j | n | S( s Create a SSLContext object with default settings. NOTE: The protocol and settings may change anytime without prior deprecation. The values represent a fair balance between maximum compatibility and security. t OP_NO_COMPRESSIONi t OP_CIPHER_SERVER_PREFERENCEt OP_SINGLE_DH_USEt OP_SINGLE_ECDH_USE( R Rm R R| t PROTOCOL_SSLv23t optionst OP_NO_SSLv2t OP_NO_SSLv3R R R{ R R t verify_modeRv t check_hostnamet CLIENT_AUTHR t _RESTRICTED_SERVER_CIPHERSR R R ( R Rk Rl R t context( ( s /usr/lib64/python2.7/ssl.pyt create_default_context} s& c C s t | t s t | n t | } | j t O_ | d k rQ | | _ n | | _ | rv | rv t d n | s | r | j | | n | s | s | r | j | | | n | j t k r | j | n | S( s/ Create a SSLContext object for Python stdlib modules All Python stdlib modules shall use this function to create SSLContext objects in order to keep common settings in one place. The configuration is less restrict than create_default_context()'s to increase backward compatibility. s certfile must be specifiedN( R Rm R R| R R Rh R R RX t load_cert_chainR R R ( R} t cert_reqsR R t certfilet keyfileRk Rl R R ( ( s /usr/lib64/python2.7/ssl.pyt _create_unverified_context s t PYTHONHTTPSVERIFYs! /etc/python/cert-verification.cfgc C s t d S( Nt https( t _get_verify_status( ( ( s /usr/lib64/python2.7/ssl.pyt <lambda> s c C s t j j sA t j j t } | d k rA | d k r: t St Sn i t d 6t d 6t d 6} d d l } y/ | j } | j t | j | d } Wn# | j | j f k r d } n X| j d } | j | | S( Nt 0t platform_defaultt enablet disableit verify( R t flagst ignore_environmentRd Re RY t _https_verify_envvarRh R R t ConfigParsert RawConfigParsert readt _cert_verification_configt NoSectionErrort NoOptionError( R} t config_settingt context_factoryR t configt statust default( ( s /usr/lib64/python2.7/ssl.pyR s& c C s | r t a n t a d S( s, Verify server HTTPS certificates by default?N( R t _create_default_https_contextR ( R ( ( s /usr/lib64/python2.7/ssl.pyt _https_verify_certificates s R R c B s e Z d Z d& d& d& e e e d& e e e d d& e d& d& d& d& d Z e d Z e j d Z d Z d& d Z d Z d d& d Z d Z e d Z d Z d Z d Z d d Z d& d Z d d Z d d d Z d& d d Z d d d Z d& d d Z d Z d Z d Z d Z! d Z" e d Z# d Z$ d Z% d Z& d Z' d d! d" Z( d# d$ Z) d% Z* RS(' s This class implements a subtype of socket.socket that wraps the underlying OS socket in an SSL context when necessary, and provides read and write methods over that channel.i c C s d | _ d | _ | r$ | | _ n| r@ | r@ t d n | r\ | r\ t d n | rr | rr | } n t | | _ | | j _ | r | j j | n | r | j j | | n | r | j j | n | r | j j | n | | _ | | _ | | _ | | _ | | _ | | _ | j t t t k rQt d n t j | d | j x3 t D]+ } y t | | Wqnt k rqnXqnW| r| rt d n | j j r| rt rt d qt d n | | _ | | _ | | _ | | _! | j" } y | j# Wnt$ k rE} | j% t% j& k rW n t' } | j" d k } | j( t' y | j) d } Wn: t$ k r} | j% t% j& t% j* f k r n d } n X| j( | | rLd } t+ | j% | } | | _, d | _- y | j. Wn t/ k r*n Xz | Wd d } XqLn Xt0 } | j1 | t' | _2 d | _ | | _3 | ryb | j j4 | j | | d | | _ | r| j" } | d k rt d n | j5 n Wqt/ t f k r| j. qXn d S( Ni s5 certfile must be specified for server-side operationss certfile must be specifieds! only stream sockets are supportedt _socks4 server_hostname can only be specified in client modes' check_hostname requires server_hostnamesW check_hostname requires server_hostname, but it's not supported by your OpenSSL libraryi t s4 Closed before TLS handshake with data in recv buffert ssl_sockg sH do_handshake_on_connect should not be specified for non-blocking sockets(6 Rh t _sslobjt _makefile_refsR RX R| R R R R R R R R t ssl_versiont ca_certst cipherst getsockoptR5 R6 R3 t NotImplementedErrorR+ R R R- t delattrt AttributeErrorR R$ R R R R t gettimeoutt getpeernamet socket_errort errnot ENOTCONNR< t setblockingt recvt EINVALR t reasont libraryt closet OSErrorRv t settimeoutt _closedt _connectedt _wrap_sockett do_handshake( R R R R R R R R R t familyt typet protot filenoR R R R R t attrt sock_timeoutt et connectedt blockingt notconn_pre_handshake_dataR t notconn_pre_handshake_data_errort timeout( ( s /usr/lib64/python2.7/ssl.pyR s c C s | j S( N( R ( R ( ( s /usr/lib64/python2.7/ssl.pyR s c C s | | _ | | j _ d S( N( R R R ( R t ctx( ( s /usr/lib64/python2.7/ssl.pyR s c C s t d | j j d S( Ns Can't dup() %s instances( t NotImplementedt __class__R8 ( R ( ( s /usr/lib64/python2.7/ssl.pyt dup s c C s d S( N( ( R t msg( ( s /usr/lib64/python2.7/ssl.pyt _checkClosed s c C s | j s | j n d S( N( R R ( R ( ( s /usr/lib64/python2.7/ssl.pyt _check_connected s c C s | j | j s" t d n yD | d k rI | j j | | } n | j j | p[ d } | SWnI t k r } | j d t k r | j r | d k r d Sd Sq n Xd S( sO Read up to LEN bytes and return them. Return zero-length string on EOF.s' Read on closed or unwrapped SSL socket.i i R N( R R RX Rh R R R t SSL_ERROR_EOFR ( R RZ t buffert vt x( ( s /usr/lib64/python2.7/ssl.pyR s c C s2 | j | j s" t d n | j j | S( sh Write DATA to the underlying SSL channel. Returns number of bytes of DATA actually transmitted.s( Write on closed or unwrapped SSL socket.( R R RX t write( R t data( ( s /usr/lib64/python2.7/ssl.pyR s c C s$ | j | j | j j | S( s Returns a formatted version of the data in the certificate provided by the other end of the SSL channel. Return None if no certificate was provided, {} if a certificate was provided, but not validated.( R R R t peer_certificate( R t binary_form( ( s /usr/lib64/python2.7/ssl.pyt getpeercert s c C s3 | j | j s t j r" d S| j j Sd S( N( R R R R& Rh t selected_npn_protocol( R ( ( s /usr/lib64/python2.7/ssl.pyR s c C s( | j | j s d S| j j Sd S( N( R R Rh t cipher( R ( ( s /usr/lib64/python2.7/ssl.pyR s c C s( | j | j s d S| j j Sd S( N( R R Rh t compression( R ( ( s /usr/lib64/python2.7/ssl.pyR s c C s | j | j r | d k r5 t d | j n y | j j | } WnD t k r } | j d t k rt d S| j d t k r d S q X| Sn | j j | | Sd S( Ni s3 non-zero flags not allowed in calls to send() on %s( R R RX R R R R t SSL_ERROR_WANT_READt SSL_ERROR_WANT_WRITER t send( R R R R R ( ( s /usr/lib64/python2.7/ssl.pyR s c C sb | j | j r) t d | j n5 | d k rH | j j | | S| j j | | | Sd S( Ns% sendto not allowed on instances of %s( R R RX R Rh R t sendto( R R t flags_or_addrt addr( ( s /usr/lib64/python2.7/ssl.pyR s c C s | j | j r{ | d k r5 t d | j n t | } d } x- | | k rv | j | | } | | 7} qJ W| St j | | | Sd S( Ni s6 non-zero flags not allowed in calls to sendall() on %s( R R RX R RZ R R+ t sendall( R R R t amountR> R ( ( s /usr/lib64/python2.7/ssl.pyR s i c C sY | j | j rB | d k r5 t d | j n | j | S| j j | | Sd S( Ni s3 non-zero flags not allowed in calls to recv() on %s( R R RX R R R R ( R t buflenR ( ( s /usr/lib64/python2.7/ssl.pyR s c C s | j | r+ | d k r+ t | } n | d k r@ d } n | j r{ | d k rk t d | j n | j | | S| j j | | | Sd S( Ni i s8 non-zero flags not allowed in calls to recv_into() on %s( R Rh RZ R RX R R R t recv_into( R R t nbytesR ( ( s /usr/lib64/python2.7/ssl.pyR s c C s@ | j | j r) t d | j n | j j | | Sd S( Ns' recvfrom not allowed on instances of %s( R R RX R R t recvfrom( R R R ( ( s /usr/lib64/python2.7/ssl.pyR , s c C sC | j | j r) t d | j n | j j | | | Sd S( Ns, recvfrom_into not allowed on instances of %s( R R RX R R t recvfrom_into( R R R R ( ( s /usr/lib64/python2.7/ssl.pyR 4 s c C s( | j | j r | j j Sd Sd S( Ni ( R R t pending( R ( ( s /usr/lib64/python2.7/ssl.pyR = s c C s' | j d | _ t j | | d S( N( R Rh R R+ t shutdown( R t how( ( s /usr/lib64/python2.7/ssl.pyR D s c C s; | j d k r( d | _ t j | n | j d 8_ d S( Ni ( R Rh R R+ R ( R ( ( s /usr/lib64/python2.7/ssl.pyR I s c C s? | j r% | j j } d | _ | St d t | d S( Ns No SSL wrapper around ( R R Rh RX t str( R t s( ( s /usr/lib64/python2.7/ssl.pyt unwrapP s c C s d | _ t j | d S( N( Rh R R+ t _real_close( R ( ( s /usr/lib64/python2.7/ssl.pyR% X s c C s | j | j } z3 | d k r; | r; | j d n | j j Wd | j | X| j j r | j s~ t d n t | j | j n d S( s Perform a TLS/SSL handshake.g Ns- check_hostname needs server_hostname argument( R R R Rh R R R R R RX Ra R ( R t blockR ( ( s /usr/lib64/python2.7/ssl.pyR \ s c C s | j r t d n | j r0 t d n | j j | j t | j d | | _ ya | ru t j | | } n d } t j | | | s t | _ | j r | j q n | SWn# t t f k r d | _ n Xd S( Ns! can't connect in server-side modes/ attempt to connect already-connected SSLSocket!R ( R RX R R R R R< R R R+ t connect_exRh t connectRv R R R ( R R R' t rc( ( s /usr/lib64/python2.7/ssl.pyt _real_connectm s$ ' c C s | j | t d S( sQ Connects to remote ADDR, and then wraps the connection in an SSL channel.N( R* R< ( R R ( ( s /usr/lib64/python2.7/ssl.pyR( s c C s | j | t S( sQ Connects to remote ADDR, and then wraps the connection in an SSL channel.( R* Rv ( R R ( ( s /usr/lib64/python2.7/ssl.pyR' s c C sI t j | \ } } | j j | d | j d | j d t } | | f S( s Accepts a new connection from a remote client, and returns a tuple containing that new connection wrapped with a server-side SSL channel, and the address of the remote client.R R R ( R+ t acceptR R R R Rv ( R t newsockR ( ( s /usr/lib64/python2.7/ssl.pyR+ s t ric C s% | j d 7_ t | | | d t S( s Make and return a file-like object that works with the SSL connection. Just use the code from the socket module.i R ( R R, Rv ( R t modet bufsize( ( s /usr/lib64/python2.7/ssl.pyt makefile s s tls-uniquec C s_ | t k r t d n | d k r? t d j | n | j d k rR d S| j j S( s Get channel binding data for current connection. Raise ValueError if the requested `cb_type` is not supported. Return bytes of the data or None if the data is not available (e.g. before the handshake). s Unsupported channel binding types tls-uniques( {0} channel binding type not implementedN( t CHANNEL_BINDING_TYPESRX R t formatR Rh t tls_unique_cb( R t cb_type( ( s /usr/lib64/python2.7/ssl.pyt get_channel_binding s c C s | j d k r d S| j j S( s Return a string identifying the protocol version used by the current SSL channel, or None if there is no established channel. N( R Rh t version( R ( ( s /usr/lib64/python2.7/ssl.pyR6 s N(+ R8 R9 Rx Rh R< R R Rv R2 R3 R t propertyR t setterR R R R R R R R R R R R R R R R R R R R$ R% R R* R( R' R+ R0 R5 R6 ( ( ( s /usr/lib64/python2.7/ssl.pyR sP z c C sC t d | d | d | d | d | d | d | d | d | d | S( NR R R R R R R R R R ( R ( R R R R R R R R R R ( ( s /usr/lib64/python2.7/ssl.pyR s c C s d d l m } d d l m } d } d } y! | j | d j d } Wn' t k rv t d | | f n3 X| | d | } | | d | f | d d ! Sd S( s Return the time in seconds since the Epoch, given the timestring representing the "notBefore" or "notAfter" date from a certificate in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale). "notBefore" or "notAfter" dates must use UTC (RFC 5280). Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec UTC should be specified as GMT (see ASN1_TIME_print()) i( t strptime( t timegmt Jant Febt Mart Aprt Mayt Junt Jult Augt Sept Octt Novt Decs %d %H:%M:%S %Y GMTi i s* time data %r does not match format "%%b%s"i i i N( R; R< R= R> R? R@ RA RB RC RD RE RF ( t timeR9 t calendarR: t indext titleRX ( t cert_timeR9 R: t monthst time_formatt month_numbert tt( ( s /usr/lib64/python2.7/ssl.pyt cert_time_to_seconds s ! s -----BEGIN CERTIFICATE-----s -----END CERTIFICATE-----c C s< t j | j d } t d t j | d d t d S( s[ Takes a certificate in binary DER format and returns the PEM version of it as a string.R s i@ ( t base64t standard_b64encodet decodet PEM_HEADERt textwrapt fillt PEM_FOOTER( t der_cert_bytest f( ( s /usr/lib64/python2.7/ssl.pyt DER_cert_to_PEM_cert s c C s | j t s" t d t n | j j t sJ t d t n | j t t t t !} t j | j d d S( sh Takes a certificate in ASCII PEM format and returns the DER-encoded version of it as a byte sequences( Invalid PEM encoding; must start with %ss& Invalid PEM encoding; must end with %st ASCIIt strict( R RT RX t stript endswithRW RZ RQ t decodestringR ( t pem_cert_stringt d( ( s /usr/lib64/python2.7/ssl.pyt PEM_cert_to_DER_cert s c C s | \ } } | d k r! t } n t } t | d | d | } t t | 4 } t | j | } | j t } Wd QXWd QXt | S( s Retrieve the certificate from the server at the specified address, and return it as a PEM-encoded string. If 'ca_certs' is specified, validate the server cert against it. If 'ssl_version' is specified, use it in the connection attempt.R Rk N( Rh R R t _create_stdlib_contextR R4 R R Rv RZ ( R R R t hostt portR R R t sslsockt dercert( ( s /usr/lib64/python2.7/ssl.pyt get_server_certificate s c C s t j | d S( Ns <unknown>( t _PROTOCOL_NAMESRY ( t protocol_code( ( s /usr/lib64/python2.7/ssl.pyt get_protocol_name s c C s t | d r | j } n t t } | s3 | rF | j | | n | j | d t } y | j Wn t k r| n X| j | S( s A replacement for the old socket.ssl function. Designed for compability with Python 2.5 and earlier. Will disappear in Python 3.0.R R ( t hasattrR R| R R R R< R R R ( R R R R R ( ( s /usr/lib64/python2.7/ssl.pyt sslwrap_simple s (b Rx RU RB R Rd t collectionsR t contextlibR R R R R R R R R R R R R R R R R R R R Rp R Rs R R R R R$ R% R& R' R t itemsRi t PROTOCOL_SSLv2R t NameErrorRh R+ R, R- R. R R R0 R1 R2 R3 R4 R5 R6 RQ R t HAS_TLS_UNIQUER1 R R RX R7 RS Ra Rb Rc Rm R{ R R R| R R R< R R R t _get_https_context_factoryR Rv R R Rc R R RP RT RW RZ Rb Rh Rk Rm ( ( ( s /usr/lib64/python2.7/ssl.pyt <module>X s . " "" 3 + 9 / #