Warning: file_get_contents(https://raw.githubusercontent.com/Den1xxx/Filemanager/master/languages/ru.json): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found
in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 88
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 215
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 216
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 217
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 218
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 219
Warning: Cannot modify header information - headers already sent by (output started at /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php:88) in /home/afelisqd/cppseducation.sc.tz/admin/images/photos/17587263121019776732_admin-dbb.php on line 220
PK ! j. . rubyforgepublisher.rbnu [ require 'rake/contrib/sshpublisher'
module Rake
class RubyForgePublisher < SshDirPublisher
attr_reader :project, :proj_id, :user
def initialize(projname, user)
super(
"#{user}@rubyforge.org",
"/var/www/gforge-projects/#{projname}",
"html")
end
end
end
PK ! Jn $ $ publisher.rbnu [ # Copyright 2003-2010 by Jim Weirich (jim.weirich@gmail.com)
# All rights reserved.
# :stopdoc:
# Configuration information about an upload host system.
# name :: Name of host system.
# webdir :: Base directory for the web information for the
# application. The application name (APP) is appended to
# this directory before using.
# pkgdir :: Directory on the host system where packages can be
# placed.
HostInfo = Struct.new(:name, :webdir, :pkgdir)
# :startdoc:
# Manage several publishers as a single entity.
class CompositePublisher
def initialize
@publishers = []
end
# Add a publisher to the composite.
def add(pub)
@publishers << pub
end
# Upload all the individual publishers.
def upload
@publishers.each { |p| p.upload }
end
end
# Publish an entire directory to an existing remote directory using
# SSH.
class SshDirPublisher
def initialize(host, remote_dir, local_dir)
@host = host
@remote_dir = remote_dir
@local_dir = local_dir
end
def upload
run %{scp -rq #{@local_dir}/* #{@host}:#{@remote_dir}}
end
end
# Publish an entire directory to a fresh remote directory using SSH.
class SshFreshDirPublisher < SshDirPublisher
def upload
run %{ssh #{@host} rm -rf #{@remote_dir}} rescue nil
run %{ssh #{@host} mkdir #{@remote_dir}}
super
end
end
# Publish a list of files to an existing remote directory.
class SshFilePublisher
# Create a publisher using the give host information.
def initialize(host, remote_dir, local_dir, *files)
@host = host
@remote_dir = remote_dir
@local_dir = local_dir
@files = files
end
# Upload the local directory to the remote directory.
def upload
@files.each do |fn|
run %{scp -q #{@local_dir}/#{fn} #{@host}:#{@remote_dir}}
end
end
end
PK ! 4 sys.rbnu [ warn 'Sys has been deprecated in favor of FileUtils'
#--
# Copyright 2003-2010 by Jim Weirich (jim.weirich@gmail.com)
# All rights reserved.
#++
#
begin
require 'ftools'
rescue LoadError
end
require 'rbconfig'
######################################################################
# Sys provides a number of file manipulation tools for the convenience
# of writing Rakefiles. All commands in this module will announce
# their activity on standard output if the $verbose flag is set
# ($verbose = true is the default). You can control this by globally
# setting $verbose or by using the +verbose+ and +quiet+ methods.
#
# Sys has been deprecated in favor of the FileUtils module available
# in Ruby 1.8.
#
module Sys
RUBY = RbConfig::CONFIG['ruby_install_name']
# Install all the files matching +wildcard+ into the +dest_dir+
# directory. The permission mode is set to +mode+.
def install(wildcard, dest_dir, mode)
Dir[wildcard].each do |fn|
File.install(fn, dest_dir, mode, $verbose)
end
end
# Run the system command +cmd+.
def run(cmd)
log cmd
system(cmd) or fail "Command Failed: [#{cmd}]"
end
# Run a Ruby interpreter with the given arguments.
def ruby(*args)
run "#{RUBY} #{args.join(' ')}"
end
# Copy a single file from +file_name+ to +dest_file+.
def copy(file_name, dest_file)
log "Copying file #{file_name} to #{dest_file}"
File.copy(file_name, dest_file)
end
# Copy all files matching +wildcard+ into the directory +dest_dir+.
def copy_files(wildcard, dest_dir)
for_matching_files(wildcard, dest_dir) { |from, to| copy(from, to) }
end
# Link +file_name+ to +dest_file+.
def link(file_name, dest_file)
log "Linking file #{file_name} to #{dest_file}"
File.link(file_name, dest_file)
end
# Link all files matching +wildcard+ into the directory +dest_dir+.
def link_files(wildcard, dest_dir)
for_matching_files(wildcard, dest_dir) { |from, to| link(from, to) }
end
# Symlink +file_name+ to +dest_file+.
def symlink(file_name, dest_file)
log "Symlinking file #{file_name} to #{dest_file}"
File.symlink(file_name, dest_file)
end
# Symlink all files matching +wildcard+ into the directory +dest_dir+.
def symlink_files(wildcard, dest_dir)
for_matching_files(wildcard, dest_dir) { |from, to| link(from, to) }
end
# Remove all files matching +wildcard+. If a matching file is a
# directory, it must be empty to be removed. used +delete_all+ to
# recursively delete directories.
def delete(*wildcards)
wildcards.each do |wildcard|
Dir[wildcard].each do |fn|
if File.directory?(fn)
log "Deleting directory #{fn}"
Dir.delete(fn)
else
log "Deleting file #{fn}"
File.delete(fn)
end
end
end
end
# Recursively delete all files and directories matching +wildcard+.
def delete_all(*wildcards)
wildcards.each do |wildcard|
Dir[wildcard].each do |fn|
next if ! File.exist?(fn)
if File.directory?(fn)
Dir["#{fn}/*"].each do |subfn|
next if subfn=='.' || subfn=='..'
delete_all(subfn)
end
log "Deleting directory #{fn}"
Dir.delete(fn)
else
log "Deleting file #{fn}"
File.delete(fn)
end
end
end
end
# Make the directories given in +dirs+.
def makedirs(*dirs)
dirs.each do |fn|
log "Making directory #{fn}"
File.makedirs(fn)
end
end
# Make +dir+ the current working directory for the duration of
# executing the given block.
def indir(dir)
olddir = Dir.pwd
Dir.chdir(dir)
yield
ensure
Dir.chdir(olddir)
end
# Split a file path into individual directory names.
#
# For example:
# split_all("a/b/c") => ['a', 'b', 'c']
def split_all(path)
head, tail = File.split(path)
return [tail] if head == '.' || tail == '/'
return [head, tail] if head == '/'
return split_all(head) + [tail]
end
# Write a message to standard error if $verbose is enabled.
def log(msg)
print " " if $trace && $verbose
$stderr.puts msg if $verbose
end
# Perform a block with $verbose disabled.
def quiet(&block)
with_verbose(false, &block)
end
# Perform a block with $verbose enabled.
def verbose(&block)
with_verbose(true, &block)
end
# Perform a block with each file matching a set of wildcards.
def for_files(*wildcards)
wildcards.each do |wildcard|
Dir[wildcard].each do |fn|
yield(fn)
end
end
end
extend(self)
private # ----------------------------------------------------------
def for_matching_files(wildcard, dest_dir)
Dir[wildcard].each do |fn|
dest_file = File.join(dest_dir, fn)
parent = File.dirname(dest_file)
makedirs(parent) if ! File.directory?(parent)
yield(fn, dest_file)
end
end
def with_verbose(v)
oldverbose = $verbose
$verbose = v
yield
ensure
$verbose = oldverbose
end
end
PK ! ȉ`t_ _ compositepublisher.rbnu [ module Rake
# Manage several publishers as a single entity.
class CompositePublisher
def initialize
@publishers = []
end
# Add a publisher to the composite.
def add(pub)
@publishers << pub
end
# Upload all the individual publishers.
def upload
@publishers.each { |p| p.upload }
end
end
end
PK ! Vl sshpublisher.rbnu [ require 'rake/dsl_definition'
require 'rake/contrib/compositepublisher'
module Rake
# Publish an entire directory to an existing remote directory using
# SSH.
class SshDirPublisher
include Rake::DSL
def initialize(host, remote_dir, local_dir)
@host = host
@remote_dir = remote_dir
@local_dir = local_dir
end
def upload
sh %{scp -rq #{@local_dir}/* #{@host}:#{@remote_dir}}
end
end
# Publish an entire directory to a fresh remote directory using SSH.
class SshFreshDirPublisher < SshDirPublisher
def upload
sh %{ssh #{@host} rm -rf #{@remote_dir}} rescue nil
sh %{ssh #{@host} mkdir #{@remote_dir}}
super
end
end
# Publish a list of files to an existing remote directory.
class SshFilePublisher
include Rake::DSL
# Create a publisher using the give host information.
def initialize(host, remote_dir, local_dir, *files)
@host = host
@remote_dir = remote_dir
@local_dir = local_dir
@files = files
end
# Upload the local directory to the remote directory.
def upload
@files.each do |fn|
sh %{scp -q #{@local_dir}/#{fn} #{@host}:#{@remote_dir}}
end
end
end
end
PK ! ¬P ftptools.rbnu [ # = Tools for FTP uploading.
#
# This file is still under development and is not released for general
# use.
require 'date'
require 'net/ftp'
module Rake # :nodoc:
####################################################################
# Note: Not released for general use.
class FtpFile
attr_reader :name, :size, :owner, :group, :time
def self.date
@date_class ||= Date
end
def self.time
@time_class ||= Time
end
def initialize(path, entry)
@path = path
@mode, _, @owner, @group, size, d1, d2, d3, @name = entry.split(' ')
@size = size.to_i
@time = determine_time(d1, d2, d3)
end
def path
File.join(@path, @name)
end
def directory?
@mode[0] == ?d
end
def mode
parse_mode(@mode)
end
def symlink?
@mode[0] == ?l
end
private # --------------------------------------------------------
def parse_mode(m)
result = 0
(1..9).each do |i|
result = 2*result + ((m[i]==?-) ? 0 : 1)
end
result
end
def determine_time(d1, d2, d3)
now = self.class.time.now
if /:/ =~ d3
result = Time.parse("#{d1} #{d2} #{now.year} #{d3}")
if result > now
result = Time.parse("#{d1} #{d2} #{now.year-1} #{d3}")
end
else
result = Time.parse("#{d1} #{d2} #{d3}")
end
result
# elements = ParseDate.parsedate("#{d1} #{d2} #{d3}")
# if elements[0].nil?
# today = self.class.date.today
# if elements[1] > today.month
# elements[0] = today.year - 1
# else
# elements[0] = today.year
# end
# end
# elements = elements.collect { |el| el.nil? ? 0 : el }
# Time.mktime(*elements[0,7])
end
end
####################################################################
# Manage the uploading of files to an FTP account.
class FtpUploader
# Log uploads to standard output when true.
attr_accessor :verbose
class << FtpUploader
# Create an uploader and pass it to the given block as +up+.
# When the block is complete, close the uploader.
def connect(path, host, account, password)
up = self.new(path, host, account, password)
begin
yield(up)
ensure
up.close
end
end
end
# Create an FTP uploader targeting the directory +path+ on +host+
# using the given account and password. +path+ will be the root
# path of the uploader.
def initialize(path, host, account, password)
@created = Hash.new
@path = path
@ftp = Net::FTP.new(host, account, password)
makedirs(@path)
@ftp.chdir(@path)
end
# Create the directory +path+ in the uploader root path.
def makedirs(path)
route = []
File.split(path).each do |dir|
route << dir
current_dir = File.join(route)
if @created[current_dir].nil?
@created[current_dir] = true
$stderr.puts "Creating Directory #{current_dir}" if @verbose
@ftp.mkdir(current_dir) rescue nil
end
end
end
# Upload all files matching +wildcard+ to the uploader's root
# path.
def upload_files(wildcard)
Dir[wildcard].each do |fn|
upload(fn)
end
end
# Close the uploader.
def close
@ftp.close
end
private # --------------------------------------------------------
# Upload a single file to the uploader's root path.
def upload(file)
$stderr.puts "Uploading #{file}" if @verbose
dir = File.dirname(file)
makedirs(dir)
@ftp.putbinaryfile(file, file) unless File.directory?(file)
end
end
end
PK ! socks.pynu [ # -*- coding: utf-8 -*-
"""
This module contains provisional support for SOCKS proxies from within
urllib3. This module supports SOCKS4 (specifically the SOCKS4A variant) and
SOCKS5. To enable its functionality, either install PySocks or install this
module with the ``socks`` extra.
The SOCKS implementation supports the full range of urllib3 features. It also
supports the following SOCKS features:
- SOCKS4
- SOCKS4a
- SOCKS5
- Usernames and passwords for the SOCKS proxy
Known Limitations:
- Currently PySocks does not support contacting remote websites via literal
IPv6 addresses. Any such connection attempt will fail. You must use a domain
name.
- Currently PySocks does not support IPv6 connections to the SOCKS proxy. Any
such connection attempt will fail.
"""
from __future__ import absolute_import
try:
import socks
except ImportError:
import warnings
from ..exceptions import DependencyWarning
warnings.warn((
'SOCKS support in urllib3 requires the installation of optional '
'dependencies: specifically, PySocks. For more information, see '
'https://urllib3.readthedocs.io/en/latest/contrib.html#socks-proxies'
),
DependencyWarning
)
raise
from socket import error as SocketError, timeout as SocketTimeout
from ..connection import (
HTTPConnection, HTTPSConnection
)
from ..connectionpool import (
HTTPConnectionPool, HTTPSConnectionPool
)
from ..exceptions import ConnectTimeoutError, NewConnectionError
from ..poolmanager import PoolManager
from ..util.url import parse_url
try:
import ssl
except ImportError:
ssl = None
class SOCKSConnection(HTTPConnection):
"""
A plain-text HTTP connection that connects via a SOCKS proxy.
"""
def __init__(self, *args, **kwargs):
self._socks_options = kwargs.pop('_socks_options')
super(SOCKSConnection, self).__init__(*args, **kwargs)
def _new_conn(self):
"""
Establish a new connection via the SOCKS proxy.
"""
extra_kw = {}
if self.source_address:
extra_kw['source_address'] = self.source_address
if self.socket_options:
extra_kw['socket_options'] = self.socket_options
try:
conn = socks.create_connection(
(self.host, self.port),
proxy_type=self._socks_options['socks_version'],
proxy_addr=self._socks_options['proxy_host'],
proxy_port=self._socks_options['proxy_port'],
proxy_username=self._socks_options['username'],
proxy_password=self._socks_options['password'],
proxy_rdns=self._socks_options['rdns'],
timeout=self.timeout,
**extra_kw
)
except SocketTimeout as e:
raise ConnectTimeoutError(
self, "Connection to %s timed out. (connect timeout=%s)" %
(self.host, self.timeout))
except socks.ProxyError as e:
# This is fragile as hell, but it seems to be the only way to raise
# useful errors here.
if e.socket_err:
error = e.socket_err
if isinstance(error, SocketTimeout):
raise ConnectTimeoutError(
self,
"Connection to %s timed out. (connect timeout=%s)" %
(self.host, self.timeout)
)
else:
raise NewConnectionError(
self,
"Failed to establish a new connection: %s" % error
)
else:
raise NewConnectionError(
self,
"Failed to establish a new connection: %s" % e
)
except SocketError as e: # Defensive: PySocks should catch all these.
raise NewConnectionError(
self, "Failed to establish a new connection: %s" % e)
return conn
# We don't need to duplicate the Verified/Unverified distinction from
# urllib3/connection.py here because the HTTPSConnection will already have been
# correctly set to either the Verified or Unverified form by that module. This
# means the SOCKSHTTPSConnection will automatically be the correct type.
class SOCKSHTTPSConnection(SOCKSConnection, HTTPSConnection):
pass
class SOCKSHTTPConnectionPool(HTTPConnectionPool):
ConnectionCls = SOCKSConnection
class SOCKSHTTPSConnectionPool(HTTPSConnectionPool):
ConnectionCls = SOCKSHTTPSConnection
class SOCKSProxyManager(PoolManager):
"""
A version of the urllib3 ProxyManager that routes connections via the
defined SOCKS proxy.
"""
pool_classes_by_scheme = {
'http': SOCKSHTTPConnectionPool,
'https': SOCKSHTTPSConnectionPool,
}
def __init__(self, proxy_url, username=None, password=None,
num_pools=10, headers=None, **connection_pool_kw):
parsed = parse_url(proxy_url)
if username is None and password is None and parsed.auth is not None:
split = parsed.auth.split(':')
if len(split) == 2:
username, password = split
if parsed.scheme == 'socks5':
socks_version = socks.PROXY_TYPE_SOCKS5
rdns = False
elif parsed.scheme == 'socks5h':
socks_version = socks.PROXY_TYPE_SOCKS5
rdns = True
elif parsed.scheme == 'socks4':
socks_version = socks.PROXY_TYPE_SOCKS4
rdns = False
elif parsed.scheme == 'socks4a':
socks_version = socks.PROXY_TYPE_SOCKS4
rdns = True
else:
raise ValueError(
"Unable to determine SOCKS version from %s" % proxy_url
)
self.proxy_url = proxy_url
socks_options = {
'socks_version': socks_version,
'proxy_host': parsed.host,
'proxy_port': parsed.port,
'username': username,
'password': password,
'rdns': rdns
}
connection_pool_kw['_socks_options'] = socks_options
super(SOCKSProxyManager, self).__init__(
num_pools, headers, **connection_pool_kw
)
self.pool_classes_by_scheme = SOCKSProxyManager.pool_classes_by_scheme
PK ! __init__.pynu [ PK ! _securetransport/__init__.pynu [ PK ! Y}D D _securetransport/bindings.pynu [ """
This module uses ctypes to bind a whole bunch of functions and constants from
SecureTransport. The goal here is to provide the low-level API to
SecureTransport. These are essentially the C-level functions and constants, and
they're pretty gross to work with.
This code is a bastardised version of the code found in Will Bond's oscrypto
library. An enormous debt is owed to him for blazing this trail for us. For
that reason, this code should be considered to be covered both by urllib3's
license and by oscrypto's:
Copyright (c) 2015-2016 Will Bond
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
"""
from __future__ import absolute_import
import platform
from ctypes.util import find_library
from ctypes import (
c_void_p, c_int32, c_char_p, c_size_t, c_byte, c_uint32, c_ulong, c_long,
c_bool
)
from ctypes import CDLL, POINTER, CFUNCTYPE
security_path = find_library('Security')
if not security_path:
raise ImportError('The library Security could not be found')
core_foundation_path = find_library('CoreFoundation')
if not core_foundation_path:
raise ImportError('The library CoreFoundation could not be found')
version = platform.mac_ver()[0]
version_info = tuple(map(int, version.split('.')))
if version_info < (10, 8):
raise OSError(
'Only OS X 10.8 and newer are supported, not %s.%s' % (
version_info[0], version_info[1]
)
)
Security = CDLL(security_path, use_errno=True)
CoreFoundation = CDLL(core_foundation_path, use_errno=True)
Boolean = c_bool
CFIndex = c_long
CFStringEncoding = c_uint32
CFData = c_void_p
CFString = c_void_p
CFArray = c_void_p
CFMutableArray = c_void_p
CFDictionary = c_void_p
CFError = c_void_p
CFType = c_void_p
CFTypeID = c_ulong
CFTypeRef = POINTER(CFType)
CFAllocatorRef = c_void_p
OSStatus = c_int32
CFDataRef = POINTER(CFData)
CFStringRef = POINTER(CFString)
CFArrayRef = POINTER(CFArray)
CFMutableArrayRef = POINTER(CFMutableArray)
CFDictionaryRef = POINTER(CFDictionary)
CFArrayCallBacks = c_void_p
CFDictionaryKeyCallBacks = c_void_p
CFDictionaryValueCallBacks = c_void_p
SecCertificateRef = POINTER(c_void_p)
SecExternalFormat = c_uint32
SecExternalItemType = c_uint32
SecIdentityRef = POINTER(c_void_p)
SecItemImportExportFlags = c_uint32
SecItemImportExportKeyParameters = c_void_p
SecKeychainRef = POINTER(c_void_p)
SSLProtocol = c_uint32
SSLCipherSuite = c_uint32
SSLContextRef = POINTER(c_void_p)
SecTrustRef = POINTER(c_void_p)
SSLConnectionRef = c_uint32
SecTrustResultType = c_uint32
SecTrustOptionFlags = c_uint32
SSLProtocolSide = c_uint32
SSLConnectionType = c_uint32
SSLSessionOption = c_uint32
try:
Security.SecItemImport.argtypes = [
CFDataRef,
CFStringRef,
POINTER(SecExternalFormat),
POINTER(SecExternalItemType),
SecItemImportExportFlags,
POINTER(SecItemImportExportKeyParameters),
SecKeychainRef,
POINTER(CFArrayRef),
]
Security.SecItemImport.restype = OSStatus
Security.SecCertificateGetTypeID.argtypes = []
Security.SecCertificateGetTypeID.restype = CFTypeID
Security.SecIdentityGetTypeID.argtypes = []
Security.SecIdentityGetTypeID.restype = CFTypeID
Security.SecKeyGetTypeID.argtypes = []
Security.SecKeyGetTypeID.restype = CFTypeID
Security.SecCertificateCreateWithData.argtypes = [
CFAllocatorRef,
CFDataRef
]
Security.SecCertificateCreateWithData.restype = SecCertificateRef
Security.SecCertificateCopyData.argtypes = [
SecCertificateRef
]
Security.SecCertificateCopyData.restype = CFDataRef
Security.SecCopyErrorMessageString.argtypes = [
OSStatus,
c_void_p
]
Security.SecCopyErrorMessageString.restype = CFStringRef
Security.SecIdentityCreateWithCertificate.argtypes = [
CFTypeRef,
SecCertificateRef,
POINTER(SecIdentityRef)
]
Security.SecIdentityCreateWithCertificate.restype = OSStatus
Security.SecKeychainCreate.argtypes = [
c_char_p,
c_uint32,
c_void_p,
Boolean,
c_void_p,
POINTER(SecKeychainRef)
]
Security.SecKeychainCreate.restype = OSStatus
Security.SecKeychainDelete.argtypes = [
SecKeychainRef
]
Security.SecKeychainDelete.restype = OSStatus
Security.SecPKCS12Import.argtypes = [
CFDataRef,
CFDictionaryRef,
POINTER(CFArrayRef)
]
Security.SecPKCS12Import.restype = OSStatus
SSLReadFunc = CFUNCTYPE(OSStatus, SSLConnectionRef, c_void_p, POINTER(c_size_t))
SSLWriteFunc = CFUNCTYPE(OSStatus, SSLConnectionRef, POINTER(c_byte), POINTER(c_size_t))
Security.SSLSetIOFuncs.argtypes = [
SSLContextRef,
SSLReadFunc,
SSLWriteFunc
]
Security.SSLSetIOFuncs.restype = OSStatus
Security.SSLSetPeerID.argtypes = [
SSLContextRef,
c_char_p,
c_size_t
]
Security.SSLSetPeerID.restype = OSStatus
Security.SSLSetCertificate.argtypes = [
SSLContextRef,
CFArrayRef
]
Security.SSLSetCertificate.restype = OSStatus
Security.SSLSetCertificateAuthorities.argtypes = [
SSLContextRef,
CFTypeRef,
Boolean
]
Security.SSLSetCertificateAuthorities.restype = OSStatus
Security.SSLSetConnection.argtypes = [
SSLContextRef,
SSLConnectionRef
]
Security.SSLSetConnection.restype = OSStatus
Security.SSLSetPeerDomainName.argtypes = [
SSLContextRef,
c_char_p,
c_size_t
]
Security.SSLSetPeerDomainName.restype = OSStatus
Security.SSLHandshake.argtypes = [
SSLContextRef
]
Security.SSLHandshake.restype = OSStatus
Security.SSLRead.argtypes = [
SSLContextRef,
c_char_p,
c_size_t,
POINTER(c_size_t)
]
Security.SSLRead.restype = OSStatus
Security.SSLWrite.argtypes = [
SSLContextRef,
c_char_p,
c_size_t,
POINTER(c_size_t)
]
Security.SSLWrite.restype = OSStatus
Security.SSLClose.argtypes = [
SSLContextRef
]
Security.SSLClose.restype = OSStatus
Security.SSLGetNumberSupportedCiphers.argtypes = [
SSLContextRef,
POINTER(c_size_t)
]
Security.SSLGetNumberSupportedCiphers.restype = OSStatus
Security.SSLGetSupportedCiphers.argtypes = [
SSLContextRef,
POINTER(SSLCipherSuite),
POINTER(c_size_t)
]
Security.SSLGetSupportedCiphers.restype = OSStatus
Security.SSLSetEnabledCiphers.argtypes = [
SSLContextRef,
POINTER(SSLCipherSuite),
c_size_t
]
Security.SSLSetEnabledCiphers.restype = OSStatus
Security.SSLGetNumberEnabledCiphers.argtype = [
SSLContextRef,
POINTER(c_size_t)
]
Security.SSLGetNumberEnabledCiphers.restype = OSStatus
Security.SSLGetEnabledCiphers.argtypes = [
SSLContextRef,
POINTER(SSLCipherSuite),
POINTER(c_size_t)
]
Security.SSLGetEnabledCiphers.restype = OSStatus
Security.SSLGetNegotiatedCipher.argtypes = [
SSLContextRef,
POINTER(SSLCipherSuite)
]
Security.SSLGetNegotiatedCipher.restype = OSStatus
Security.SSLGetNegotiatedProtocolVersion.argtypes = [
SSLContextRef,
POINTER(SSLProtocol)
]
Security.SSLGetNegotiatedProtocolVersion.restype = OSStatus
Security.SSLCopyPeerTrust.argtypes = [
SSLContextRef,
POINTER(SecTrustRef)
]
Security.SSLCopyPeerTrust.restype = OSStatus
Security.SecTrustSetAnchorCertificates.argtypes = [
SecTrustRef,
CFArrayRef
]
Security.SecTrustSetAnchorCertificates.restype = OSStatus
Security.SecTrustSetAnchorCertificatesOnly.argstypes = [
SecTrustRef,
Boolean
]
Security.SecTrustSetAnchorCertificatesOnly.restype = OSStatus
Security.SecTrustEvaluate.argtypes = [
SecTrustRef,
POINTER(SecTrustResultType)
]
Security.SecTrustEvaluate.restype = OSStatus
Security.SecTrustGetCertificateCount.argtypes = [
SecTrustRef
]
Security.SecTrustGetCertificateCount.restype = CFIndex
Security.SecTrustGetCertificateAtIndex.argtypes = [
SecTrustRef,
CFIndex
]
Security.SecTrustGetCertificateAtIndex.restype = SecCertificateRef
Security.SSLCreateContext.argtypes = [
CFAllocatorRef,
SSLProtocolSide,
SSLConnectionType
]
Security.SSLCreateContext.restype = SSLContextRef
Security.SSLSetSessionOption.argtypes = [
SSLContextRef,
SSLSessionOption,
Boolean
]
Security.SSLSetSessionOption.restype = OSStatus
Security.SSLSetProtocolVersionMin.argtypes = [
SSLContextRef,
SSLProtocol
]
Security.SSLSetProtocolVersionMin.restype = OSStatus
Security.SSLSetProtocolVersionMax.argtypes = [
SSLContextRef,
SSLProtocol
]
Security.SSLSetProtocolVersionMax.restype = OSStatus
Security.SecCopyErrorMessageString.argtypes = [
OSStatus,
c_void_p
]
Security.SecCopyErrorMessageString.restype = CFStringRef
Security.SSLReadFunc = SSLReadFunc
Security.SSLWriteFunc = SSLWriteFunc
Security.SSLContextRef = SSLContextRef
Security.SSLProtocol = SSLProtocol
Security.SSLCipherSuite = SSLCipherSuite
Security.SecIdentityRef = SecIdentityRef
Security.SecKeychainRef = SecKeychainRef
Security.SecTrustRef = SecTrustRef
Security.SecTrustResultType = SecTrustResultType
Security.SecExternalFormat = SecExternalFormat
Security.OSStatus = OSStatus
Security.kSecImportExportPassphrase = CFStringRef.in_dll(
Security, 'kSecImportExportPassphrase'
)
Security.kSecImportItemIdentity = CFStringRef.in_dll(
Security, 'kSecImportItemIdentity'
)
# CoreFoundation time!
CoreFoundation.CFRetain.argtypes = [
CFTypeRef
]
CoreFoundation.CFRetain.restype = CFTypeRef
CoreFoundation.CFRelease.argtypes = [
CFTypeRef
]
CoreFoundation.CFRelease.restype = None
CoreFoundation.CFGetTypeID.argtypes = [
CFTypeRef
]
CoreFoundation.CFGetTypeID.restype = CFTypeID
CoreFoundation.CFStringCreateWithCString.argtypes = [
CFAllocatorRef,
c_char_p,
CFStringEncoding
]
CoreFoundation.CFStringCreateWithCString.restype = CFStringRef
CoreFoundation.CFStringGetCStringPtr.argtypes = [
CFStringRef,
CFStringEncoding
]
CoreFoundation.CFStringGetCStringPtr.restype = c_char_p
CoreFoundation.CFStringGetCString.argtypes = [
CFStringRef,
c_char_p,
CFIndex,
CFStringEncoding
]
CoreFoundation.CFStringGetCString.restype = c_bool
CoreFoundation.CFDataCreate.argtypes = [
CFAllocatorRef,
c_char_p,
CFIndex
]
CoreFoundation.CFDataCreate.restype = CFDataRef
CoreFoundation.CFDataGetLength.argtypes = [
CFDataRef
]
CoreFoundation.CFDataGetLength.restype = CFIndex
CoreFoundation.CFDataGetBytePtr.argtypes = [
CFDataRef
]
CoreFoundation.CFDataGetBytePtr.restype = c_void_p
CoreFoundation.CFDictionaryCreate.argtypes = [
CFAllocatorRef,
POINTER(CFTypeRef),
POINTER(CFTypeRef),
CFIndex,
CFDictionaryKeyCallBacks,
CFDictionaryValueCallBacks
]
CoreFoundation.CFDictionaryCreate.restype = CFDictionaryRef
CoreFoundation.CFDictionaryGetValue.argtypes = [
CFDictionaryRef,
CFTypeRef
]
CoreFoundation.CFDictionaryGetValue.restype = CFTypeRef
CoreFoundation.CFArrayCreate.argtypes = [
CFAllocatorRef,
POINTER(CFTypeRef),
CFIndex,
CFArrayCallBacks,
]
CoreFoundation.CFArrayCreate.restype = CFArrayRef
CoreFoundation.CFArrayCreateMutable.argtypes = [
CFAllocatorRef,
CFIndex,
CFArrayCallBacks
]
CoreFoundation.CFArrayCreateMutable.restype = CFMutableArrayRef
CoreFoundation.CFArrayAppendValue.argtypes = [
CFMutableArrayRef,
c_void_p
]
CoreFoundation.CFArrayAppendValue.restype = None
CoreFoundation.CFArrayGetCount.argtypes = [
CFArrayRef
]
CoreFoundation.CFArrayGetCount.restype = CFIndex
CoreFoundation.CFArrayGetValueAtIndex.argtypes = [
CFArrayRef,
CFIndex
]
CoreFoundation.CFArrayGetValueAtIndex.restype = c_void_p
CoreFoundation.kCFAllocatorDefault = CFAllocatorRef.in_dll(
CoreFoundation, 'kCFAllocatorDefault'
)
CoreFoundation.kCFTypeArrayCallBacks = c_void_p.in_dll(CoreFoundation, 'kCFTypeArrayCallBacks')
CoreFoundation.kCFTypeDictionaryKeyCallBacks = c_void_p.in_dll(
CoreFoundation, 'kCFTypeDictionaryKeyCallBacks'
)
CoreFoundation.kCFTypeDictionaryValueCallBacks = c_void_p.in_dll(
CoreFoundation, 'kCFTypeDictionaryValueCallBacks'
)
CoreFoundation.CFTypeRef = CFTypeRef
CoreFoundation.CFArrayRef = CFArrayRef
CoreFoundation.CFStringRef = CFStringRef
CoreFoundation.CFDictionaryRef = CFDictionaryRef
except (AttributeError):
raise ImportError('Error initializing ctypes')
class CFConst(object):
"""
A class object that acts as essentially a namespace for CoreFoundation
constants.
"""
kCFStringEncodingUTF8 = CFStringEncoding(0x08000100)
class SecurityConst(object):
"""
A class object that acts as essentially a namespace for Security constants.
"""
kSSLSessionOptionBreakOnServerAuth = 0
kSSLProtocol2 = 1
kSSLProtocol3 = 2
kTLSProtocol1 = 4
kTLSProtocol11 = 7
kTLSProtocol12 = 8
kSSLClientSide = 1
kSSLStreamType = 0
kSecFormatPEMSequence = 10
kSecTrustResultInvalid = 0
kSecTrustResultProceed = 1
# This gap is present on purpose: this was kSecTrustResultConfirm, which
# is deprecated.
kSecTrustResultDeny = 3
kSecTrustResultUnspecified = 4
kSecTrustResultRecoverableTrustFailure = 5
kSecTrustResultFatalTrustFailure = 6
kSecTrustResultOtherError = 7
errSSLProtocol = -9800
errSSLWouldBlock = -9803
errSSLClosedGraceful = -9805
errSSLClosedNoNotify = -9816
errSSLClosedAbort = -9806
errSSLXCertChainInvalid = -9807
errSSLCrypto = -9809
errSSLInternal = -9810
errSSLCertExpired = -9814
errSSLCertNotYetValid = -9815
errSSLUnknownRootCert = -9812
errSSLNoRootCert = -9813
errSSLHostNameMismatch = -9843
errSSLPeerHandshakeFail = -9824
errSSLPeerUserCancelled = -9839
errSSLWeakPeerEphemeralDHKey = -9850
errSSLServerAuthCompleted = -9841
errSSLRecordOverflow = -9847
errSecVerifyFailed = -67808
errSecNoTrustSettings = -25263
errSecItemNotFound = -25300
errSecInvalidTrustSettings = -25262
# Cipher suites. We only pick the ones our default cipher string allows.
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 = 0xC02C
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 = 0xC030
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 = 0xC02B
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 = 0xC02F
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 = 0x00A3
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 = 0x009F
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 = 0x00A2
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 = 0x009E
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 = 0xC024
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 = 0xC028
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA = 0xC00A
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA = 0xC014
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 = 0x006B
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 = 0x006A
TLS_DHE_RSA_WITH_AES_256_CBC_SHA = 0x0039
TLS_DHE_DSS_WITH_AES_256_CBC_SHA = 0x0038
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 = 0xC023
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 = 0xC027
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA = 0xC009
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA = 0xC013
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 = 0x0067
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 = 0x0040
TLS_DHE_RSA_WITH_AES_128_CBC_SHA = 0x0033
TLS_DHE_DSS_WITH_AES_128_CBC_SHA = 0x0032
TLS_RSA_WITH_AES_256_GCM_SHA384 = 0x009D
TLS_RSA_WITH_AES_128_GCM_SHA256 = 0x009C
TLS_RSA_WITH_AES_256_CBC_SHA256 = 0x003D
TLS_RSA_WITH_AES_128_CBC_SHA256 = 0x003C
TLS_RSA_WITH_AES_256_CBC_SHA = 0x0035
TLS_RSA_WITH_AES_128_CBC_SHA = 0x002F
TLS_AES_128_GCM_SHA256 = 0x1301
TLS_AES_256_GCM_SHA384 = 0x1302
TLS_CHACHA20_POLY1305_SHA256 = 0x1303
PK ! "-X( X( : _securetransport/__pycache__/bindings.cpython-36.opt-1.pycnu [ 3
nf\D @ s d Z ddlmZ ddlZddlmZ ddlmZmZm Z m
Z
m Z m Z m
Z
mZmZ ddlmZmZmZ edZesxeded Zesed
ej d Zeeeejd Z e d k re de d e d f eeddZ eeddZ eZ eZ!e Z"eZ#eZ$eZ%eZ&eZ'eZ(eZ)e
Z*ee)Z+eZ,eZ-ee#Z.ee$Z/ee%Z0ee&Z1ee'Z2eZ3eZ4eZ5eeZ6e Z7e Z8eeZ9e Z:eZ;eeZeeZ?eeZ@e ZAe ZBe ZCe ZDe ZEe ZFye.e/ee7ee8e:ee;eee
ge ja_He-e ja_Ie?ee>e
ge jb_He-e jb_Ie?ee
ge jc_de-e jc_Ie?ee>ee
ge je_He-e je_Ie?ee>ge jf_He-e jf_Ie?ee=ge jg_He-e jg_Ie?ee@ge jh_He-e jh_Ie@e0ge ji_He-e ji_Ie@e ge jj_ke-e jj_Ie@eeBge jl_He-e jl_Ie@ge jm_He!e jm_Ie@e!ge jn_He6e jn_Ie,eDeEge jo_He?e jo_Ie?eFe ge jp_He-e jp_Ie?e=ge jq_He-e jq_Ie?e=ge jr_He-e jr_Ie-ege jO_He/e jO_IeTe _TeUe _Ue?e _?e=e _=e>e _>e9e _9e
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
)absolute_importN) find_library) c_void_pc_int32c_char_pc_size_tc_bytec_uint32c_ulongc_longc_bool)CDLLPOINTER CFUNCTYPESecurityz'The library Security could not be foundCoreFoundationz-The library CoreFoundation could not be found.
z1Only OS X 10.8 and newer are supported, not %s.%s T)Z use_errnokSecImportExportPassphrasekSecImportItemIdentitykCFAllocatorDefaultkCFTypeArrayCallBacks kCFTypeDictionaryKeyCallBacks kCFTypeDictionaryValueCallBackszError initializing ctypesc @ s e Zd ZdZedZdS )CFConstz_
A class object that acts as essentially a namespace for CoreFoundation
constants.
i N)__name__
__module__ __qualname____doc__CFStringEncodingZkCFStringEncodingUTF8 r" r" /usr/lib/python3.6/bindings.pyr s r c @ s, e Zd ZdZdZdZdZdZdZdZ dZ
dZ dZ dZ
dZd ZdZd
Zd ZdZdDZdEZdFZdGZdHZdIZdJZdKZdLZ dMZ dNZ dOZ dPZ dQZ!dRZ"dSZ#dTZ$dUZ%dVZ&dWZ'dXZ(dYZ)d"Z*d#Z+d$Z,d%Z-d&Z.d'Z/d(Z0d)Z1d*Z2d+Z3d,Z4d-Z5d.Z6d/Z7d0Z8d1Z9d2Z:d3Z;d4Zd7Z?d8Z@d9ZAd:ZBd;ZCdZFd?ZGd@ZHdAZIdBZJdCS )Z
SecurityConstzU
A class object that acts as essentially a namespace for Security constants.
r r r r iH& iK& iM& iX& iN& iO& iQ& iR& iV& iW& iT& iU& is& i`& io& iz& iq& iw& i ib ib ib i, i0 i+ i/ i$ i( i
i k j 9 8 i# i' i i g @ 3 2 = < 5 / i i i Niiiiiiiiiiiiiiiiiii iQi,iR)Kr r r r Z"kSSLSessionOptionBreakOnServerAuthZ
kSSLProtocol2Z
kSSLProtocol3Z
kTLSProtocol1ZkTLSProtocol11ZkTLSProtocol12ZkSSLClientSideZkSSLStreamTypeZkSecFormatPEMSequenceZkSecTrustResultInvalidZkSecTrustResultProceedZkSecTrustResultDenyZkSecTrustResultUnspecifiedZ&kSecTrustResultRecoverableTrustFailureZ kSecTrustResultFatalTrustFailureZkSecTrustResultOtherErrorZerrSSLProtocolZerrSSLWouldBlockZerrSSLClosedGracefulZerrSSLClosedNoNotifyZerrSSLClosedAbortZerrSSLXCertChainInvalidZ errSSLCryptoZerrSSLInternalZerrSSLCertExpiredZerrSSLCertNotYetValidZerrSSLUnknownRootCertZerrSSLNoRootCertZerrSSLHostNameMismatchZerrSSLPeerHandshakeFailZerrSSLPeerUserCancelledZ errSSLWeakPeerEphemeralDHKeyZerrSSLServerAuthCompletedZerrSSLRecordOverflowZerrSecVerifyFailedZerrSecNoTrustSettingsZerrSecItemNotFoundZerrSecInvalidTrustSettingsZ'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384Z'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256Z#TLS_DHE_DSS_WITH_AES_256_GCM_SHA384Z#TLS_DHE_RSA_WITH_AES_256_GCM_SHA384Z#TLS_DHE_DSS_WITH_AES_128_GCM_SHA256Z#TLS_DHE_RSA_WITH_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384Z$TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_256_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_256_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_256_CBC_SHAZ TLS_DHE_DSS_WITH_AES_256_CBC_SHAZ'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256Z$TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_128_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_128_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_128_CBC_SHAZ TLS_DHE_DSS_WITH_AES_128_CBC_SHAZ TLS_RSA_WITH_AES_256_GCM_SHA384Z TLS_RSA_WITH_AES_128_GCM_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHA256Z TLS_RSA_WITH_AES_128_CBC_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHAZ TLS_RSA_WITH_AES_128_CBC_SHAZTLS_AES_128_GCM_SHA256ZTLS_AES_256_GCM_SHA384Z TLS_CHACHA20_POLY1305_SHA256r" r" r" r# r$ s r$ )r r )r Z
__future__r platformZ ctypes.utilr Zctypesr r r r r r r
r r r
r r Z
security_path ImportErrorZcore_foundation_pathZmac_verversiontuplemapintsplit version_infoOSErrorr r ZBooleanZCFIndexr! ZCFDataZCFStringZCFArrayZCFMutableArrayZ CFDictionaryZCFErrorZCFTypeZCFTypeIDZ CFTypeRefZCFAllocatorRefZOSStatusZ CFDataRefZ CFStringRefZ
CFArrayRefZCFMutableArrayRefZCFDictionaryRefZCFArrayCallBacksZCFDictionaryKeyCallBacksZCFDictionaryValueCallBacksZSecCertificateRefZSecExternalFormatZSecExternalItemTypeZSecIdentityRefZSecItemImportExportFlagsZ SecItemImportExportKeyParametersZSecKeychainRefZ SSLProtocolZSSLCipherSuiteZ
SSLContextRefZ SecTrustRefZSSLConnectionRefZSecTrustResultTypeZSecTrustOptionFlagsZSSLProtocolSideZSSLConnectionTypeZSSLSessionOptionZ
SecItemImportZargtypesZrestypeZSecCertificateGetTypeIDZSecIdentityGetTypeIDZSecKeyGetTypeIDZ SecCertificateCreateWithDataZSecCertificateCopyDataZSecCopyErrorMessageStringZ SecIdentityCreateWithCertificateZSecKeychainCreateZSecKeychainDeleteZSecPKCS12ImportZ SSLReadFuncZ SSLWriteFuncZ
SSLSetIOFuncsZ SSLSetPeerIDZSSLSetCertificateZ SSLSetCertificateAuthoritiesZSSLSetConnectionZSSLSetPeerDomainNameZ SSLHandshakeZSSLReadZSSLWriteZSSLCloseZ SSLGetNumberSupportedCiphersZSSLGetSupportedCiphersZSSLSetEnabledCiphersZSSLGetNumberEnabledCiphersZargtypeZSSLGetEnabledCiphersZSSLGetNegotiatedCipherZ SSLGetNegotiatedProtocolVersionZSSLCopyPeerTrustZ SecTrustSetAnchorCertificatesZ!SecTrustSetAnchorCertificatesOnlyZ argstypesZSecTrustEvaluateZSecTrustGetCertificateCountZ SecTrustGetCertificateAtIndexZSSLCreateContextZSSLSetSessionOptionZSSLSetProtocolVersionMinZSSLSetProtocolVersionMaxZin_dllr r ZCFRetainZ CFReleaseZ CFGetTypeIDZCFStringCreateWithCStringZCFStringGetCStringPtrZCFStringGetCStringZ CFDataCreateZCFDataGetLengthZCFDataGetBytePtrZCFDictionaryCreateZCFDictionaryGetValueZ
CFArrayCreateZCFArrayCreateMutableZCFArrayAppendValueZCFArrayGetCountZCFArrayGetValueAtIndexr r r r AttributeErrorobjectr r$ r" r" r" r# s, ,
PK ! cl ; _securetransport/__pycache__/low_level.cpython-36.opt-1.pycnu [ 3
nf\/ @ s d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m
Z
m Z ej dej
Zdd Zdd Zd
d Zdd d
Zdd Zdd Zdd Zdd Zdd Zdd ZdS )a
Low-level helpers for the SecureTransport bindings.
These are Python functions that are not directly related to the high-level APIs
but are necessary to get them to work. They include a whole bunch of low-level
CoreFoundation messing about and memory management. The concerns in this module
are almost entirely about trying to avoid memory leaks and providing
appropriate and useful assistance to the higher-level code.
N )SecurityCoreFoundationCFConsts; -----BEGIN CERTIFICATE-----
(.*?)
-----END CERTIFICATE-----c C s t jt j| t| S )zv
Given a bytestring, create a CFData object from it. This CFData object must
be CFReleased by the caller.
)r CFDataCreatekCFAllocatorDefaultlen)Z
bytestring r /usr/lib/python3.6/low_level.py_cf_data_from_bytes s r c C sZ t | }dd | D }dd | D }tj| | }tj| | }tjtj|||tjtjS )zK
Given a list of Python tuples, create an associated CFDictionary.
c s s | ]}|d V qdS )r Nr ).0tr r r
, s z-_cf_dictionary_from_tuples..c s s | ]}|d V qdS )r Nr )r r
r r r
r - s )r r CFTypeRefZCFDictionaryCreater Z kCFTypeDictionaryKeyCallBacksZ kCFTypeDictionaryValueCallBacks)ZtuplesZdictionary_sizekeysvaluesZcf_keysZ cf_valuesr r r
_cf_dictionary_from_tuples% s r c C sn t j| t jt j}tj|tj}|dkrXt jd}tj ||dtj}|sRt
d|j }|dk rj|j d}|S )z
Creates a Unicode string from a CFString object. Used entirely for error
reporting.
Yes, it annoys me quite a lot that this function is this complex.
Ni z'Error copying C string from CFStringRefzutf-8)
ctypescastZPOINTERZc_void_pr ZCFStringGetCStringPtrr ZkCFStringEncodingUTF8Zcreate_string_bufferZCFStringGetCStringOSErrorvaluedecode)r Zvalue_as_void_pstringbufferresultr r r
_cf_string_to_unicode; s"
r c C s\ | dkr dS t j| d}t|}tj| |dks:|dkrBd| }|dkrPtj}||dS )z[
Checks the return code and throws an exception if there is an error to
report
r N z OSStatus %s)r ZSecCopyErrorMessageStringr r CFReleasesslSSLError)errorZexception_classZcf_error_stringoutputr r r
_assert_no_errorX s
r" c C s | j dd} dd tj| D }|s.tjdtjtjdtj tj
}|sTtjdydx^|D ]V}t |}|svtjdt j
tj|}tj| |stjdtj|| tj| q\W W n tk
r tj| Y nX |S ) z
Given a bundle of certs in PEM format, turns them into a CFArray of certs
that can be used to validate a cert chain.
s
c S s g | ]}t j|jd qS )r )base64Z b64decodegroup)r matchr r r
v s z(_cert_array_from_pem..z No root certificates specifiedr zUnable to allocate memory!z Unable to build cert object!)replace
_PEM_CERTS_REfinditerr r r CFArrayCreateMutabler r byrefkCFTypeArrayCallBacksr r Z SecCertificateCreateWithDatar CFArrayAppendValue Exception)Z
pem_bundleZ der_certsZ
cert_arrayZ der_bytesZcertdataZcertr r r
_cert_array_from_pemm s4
r0 c C s t j }tj| |kS )z=
Returns True if a given CFTypeRef is a certificate.
)r ZSecCertificateGetTypeIDr CFGetTypeID)itemexpectedr r r
_is_cert s r4 c C s t j }tj| |kS )z;
Returns True if a given CFTypeRef is an identity.
)r ZSecIdentityGetTypeIDr r1 )r2 r3 r r r
_is_identity s r5 c C s t jd} tj| dd jd}tj| dd }tj }t jj||j d}t
j }t
j |t
||ddtj|}t| ||fS )a
This function creates a temporary Mac keychain that we can use to work with
credentials. This keychain uses a one-time password and a temporary file to
store the data. We expect to have one keychain per socket. The returned
SecKeychainRef must be freed by the caller, including calling
SecKeychainDelete.
Returns a tuple of the SecKeychainRef and the path to the temporary
directory that contains it.
( N zutf-8F)osurandomr$ Z b16encoder tempfileZmkdtemppathjoinencoder ZSecKeychainRefZSecKeychainCreater r r, r" )Z random_bytesfilenameZpasswordZ
tempdirectoryZ
keychain_pathkeychainstatusr r r
_temporary_keychain s
rA c C s g }g }d}t |d}|j }W dQ R X ztjtj|t|}tj }tj|ddddd| t j
|}t | tj |} xdt
| D ]X}
tj||
} t j| tj} t| rtj| |j| qt| rtj| |j| qW W d|rtj| tj| X ||fS )z
Given a single file, loads all the trust objects from it into arrays and
the keychain.
Returns a tuple of lists: the first list is a list of identities, the
second a list of certs.
Nrbr )openreadr r r r Z
CFArrayRefr Z
SecItemImportr r, r" ZCFArrayGetCountrangeZCFArrayGetValueAtIndexr r r4 ZCFRetainappendr5 r ) r? r; certificates
identitiesZ result_arrayfZ raw_filedataZfiledatar Z result_countindexr2 r r r
_load_items_from_file sH
rK c G s g }g }dd |D }zx.|D ]&}t | |\}}|j| |j| q W |stj }tj| |d tj|}t| |j| t j
|j d t j t j
dtjt j} x tj||D ]}
t j| |
qW | S x tj||D ]} t j
| qW X dS )z
Load certificates and maybe keys from a number of files. Has the end goal
of returning a CFArray containing one SecIdentityRef, and then zero or more
SecCertificateRef objects, suitable for use as a client certificate trust
chain.
c s s | ]}|r|V qd S )Nr )r r; r r r
r 2 s z*_load_client_cert_chain..r N)rK extendr ZSecIdentityRefZ SecIdentityCreateWithCertificater r, r" rF r r popr+ r r- itertoolschainr. ) r? pathsrG rH Z file_pathZnew_identitiesZ new_certsZ new_identityr@ Z trust_chainr2 objr r r
_load_client_cert_chain s6
rR )N)__doc__r$ r rN rer8 r r: Zbindingsr r r compileDOTALLr) r r r r" r0 r4 r5 rA rK rR r r r r
s(
.(;PK ! cl 5 _securetransport/__pycache__/low_level.cpython-36.pycnu [ 3
nf\/ @ s d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z m
Z
m Z ej dej
Zdd Zdd Zd
d Zdd d
Zdd Zdd Zdd Zdd Zdd Zdd ZdS )a
Low-level helpers for the SecureTransport bindings.
These are Python functions that are not directly related to the high-level APIs
but are necessary to get them to work. They include a whole bunch of low-level
CoreFoundation messing about and memory management. The concerns in this module
are almost entirely about trying to avoid memory leaks and providing
appropriate and useful assistance to the higher-level code.
N )SecurityCoreFoundationCFConsts; -----BEGIN CERTIFICATE-----
(.*?)
-----END CERTIFICATE-----c C s t jt j| t| S )zv
Given a bytestring, create a CFData object from it. This CFData object must
be CFReleased by the caller.
)r CFDataCreatekCFAllocatorDefaultlen)Z
bytestring r /usr/lib/python3.6/low_level.py_cf_data_from_bytes s r c C sZ t | }dd | D }dd | D }tj| | }tj| | }tjtj|||tjtjS )zK
Given a list of Python tuples, create an associated CFDictionary.
c s s | ]}|d V qdS )r Nr ).0tr r r
, s z-_cf_dictionary_from_tuples..c s s | ]}|d V qdS )r Nr )r r
r r r
r - s )r r CFTypeRefZCFDictionaryCreater Z kCFTypeDictionaryKeyCallBacksZ kCFTypeDictionaryValueCallBacks)ZtuplesZdictionary_sizekeysvaluesZcf_keysZ cf_valuesr r r
_cf_dictionary_from_tuples% s r c C sn t j| t jt j}tj|tj}|dkrXt jd}tj ||dtj}|sRt
d|j }|dk rj|j d}|S )z
Creates a Unicode string from a CFString object. Used entirely for error
reporting.
Yes, it annoys me quite a lot that this function is this complex.
Ni z'Error copying C string from CFStringRefzutf-8)
ctypescastZPOINTERZc_void_pr ZCFStringGetCStringPtrr ZkCFStringEncodingUTF8Zcreate_string_bufferZCFStringGetCStringOSErrorvaluedecode)r Zvalue_as_void_pstringbufferresultr r r
_cf_string_to_unicode; s"
r c C s\ | dkr dS t j| d}t|}tj| |dks:|dkrBd| }|dkrPtj}||dS )z[
Checks the return code and throws an exception if there is an error to
report
r N z OSStatus %s)r ZSecCopyErrorMessageStringr r CFReleasesslSSLError)errorZexception_classZcf_error_stringoutputr r r
_assert_no_errorX s
r" c C s | j dd} dd tj| D }|s.tjdtjtjdtj tj
}|sTtjdydx^|D ]V}t |}|svtjdt j
tj|}tj| |stjdtj|| tj| q\W W n tk
r tj| Y nX |S ) z
Given a bundle of certs in PEM format, turns them into a CFArray of certs
that can be used to validate a cert chain.
s
c S s g | ]}t j|jd qS )r )base64Z b64decodegroup)r matchr r r
v s z(_cert_array_from_pem..z No root certificates specifiedr zUnable to allocate memory!z Unable to build cert object!)replace
_PEM_CERTS_REfinditerr r r CFArrayCreateMutabler r byrefkCFTypeArrayCallBacksr r Z SecCertificateCreateWithDatar CFArrayAppendValue Exception)Z
pem_bundleZ der_certsZ
cert_arrayZ der_bytesZcertdataZcertr r r
_cert_array_from_pemm s4
r0 c C s t j }tj| |kS )z=
Returns True if a given CFTypeRef is a certificate.
)r ZSecCertificateGetTypeIDr CFGetTypeID)itemexpectedr r r
_is_cert s r4 c C s t j }tj| |kS )z;
Returns True if a given CFTypeRef is an identity.
)r ZSecIdentityGetTypeIDr r1 )r2 r3 r r r
_is_identity s r5 c C s t jd} tj| dd jd}tj| dd }tj }t jj||j d}t
j }t
j |t
||ddtj|}t| ||fS )a
This function creates a temporary Mac keychain that we can use to work with
credentials. This keychain uses a one-time password and a temporary file to
store the data. We expect to have one keychain per socket. The returned
SecKeychainRef must be freed by the caller, including calling
SecKeychainDelete.
Returns a tuple of the SecKeychainRef and the path to the temporary
directory that contains it.
( N zutf-8F)osurandomr$ Z b16encoder tempfileZmkdtemppathjoinencoder ZSecKeychainRefZSecKeychainCreater r r, r" )Z random_bytesfilenameZpasswordZ
tempdirectoryZ
keychain_pathkeychainstatusr r r
_temporary_keychain s
rA c C s g }g }d}t |d}|j }W dQ R X ztjtj|t|}tj }tj|ddddd| t j
|}t | tj |} xdt
| D ]X}
tj||
} t j| tj} t| rtj| |j| qt| rtj| |j| qW W d|rtj| tj| X ||fS )z
Given a single file, loads all the trust objects from it into arrays and
the keychain.
Returns a tuple of lists: the first list is a list of identities, the
second a list of certs.
Nrbr )openreadr r r r Z
CFArrayRefr Z
SecItemImportr r, r" ZCFArrayGetCountrangeZCFArrayGetValueAtIndexr r r4 ZCFRetainappendr5 r ) r? r; certificates
identitiesZ result_arrayfZ raw_filedataZfiledatar Z result_countindexr2 r r r
_load_items_from_file sH
rK c G s g }g }dd |D }zx.|D ]&}t | |\}}|j| |j| q W |stj }tj| |d tj|}t| |j| t j
|j d t j t j
dtjt j} x tj||D ]}
t j| |
qW | S x tj||D ]} t j
| qW X dS )z
Load certificates and maybe keys from a number of files. Has the end goal
of returning a CFArray containing one SecIdentityRef, and then zero or more
SecCertificateRef objects, suitable for use as a client certificate trust
chain.
c s s | ]}|r|V qd S )Nr )r r; r r r
r 2 s z*_load_client_cert_chain..r N)rK extendr ZSecIdentityRefZ SecIdentityCreateWithCertificater r, r" rF r r popr+ r r- itertoolschainr. ) r? pathsrG rH Z file_pathZnew_identitiesZ new_certsZ new_identityr@ Z trust_chainr2 objr r r
_load_client_cert_chain s6
rR )N)__doc__r$ r rN rer8 r r: Zbindingsr r r compileDOTALLr) r r r r" r0 r4 r5 rA rK rR r r r r
s(
.(;PK ! "-X( X( 4 _securetransport/__pycache__/bindings.cpython-36.pycnu [ 3
nf\D @ s d Z ddlmZ ddlZddlmZ ddlmZmZm Z m
Z
m Z m Z m
Z
mZmZ ddlmZmZmZ edZesxeded Zesed
ej d Zeeeejd Z e d k re de d e d f eeddZ eeddZ eZ eZ!e Z"eZ#eZ$eZ%eZ&eZ'eZ(eZ)e
Z*ee)Z+eZ,eZ-ee#Z.ee$Z/ee%Z0ee&Z1ee'Z2eZ3eZ4eZ5eeZ6e Z7e Z8eeZ9e Z:eZ;eeZeeZ?eeZ@e ZAe ZBe ZCe ZDe ZEe ZFye.e/ee7ee8e:ee;eee
ge ja_He-e ja_Ie?ee>e
ge jb_He-e jb_Ie?ee
ge jc_de-e jc_Ie?ee>ee
ge je_He-e je_Ie?ee>ge jf_He-e jf_Ie?ee=ge jg_He-e jg_Ie?ee@ge jh_He-e jh_Ie@e0ge ji_He-e ji_Ie@e ge jj_ke-e jj_Ie@eeBge jl_He-e jl_Ie@ge jm_He!e jm_Ie@e!ge jn_He6e jn_Ie,eDeEge jo_He?e jo_Ie?eFe ge jp_He-e jp_Ie?e=ge jq_He-e jq_Ie?e=ge jr_He-e jr_Ie-ege jO_He/e jO_IeTe _TeUe _Ue?e _?e=e _=e>e _>e9e _9e
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
)absolute_importN) find_library) c_void_pc_int32c_char_pc_size_tc_bytec_uint32c_ulongc_longc_bool)CDLLPOINTER CFUNCTYPESecurityz'The library Security could not be foundCoreFoundationz-The library CoreFoundation could not be found.
z1Only OS X 10.8 and newer are supported, not %s.%s T)Z use_errnokSecImportExportPassphrasekSecImportItemIdentitykCFAllocatorDefaultkCFTypeArrayCallBacks kCFTypeDictionaryKeyCallBacks kCFTypeDictionaryValueCallBackszError initializing ctypesc @ s e Zd ZdZedZdS )CFConstz_
A class object that acts as essentially a namespace for CoreFoundation
constants.
i N)__name__
__module__ __qualname____doc__CFStringEncodingZkCFStringEncodingUTF8 r" r" /usr/lib/python3.6/bindings.pyr s r c @ s, e Zd ZdZdZdZdZdZdZdZ dZ
dZ dZ dZ
dZd ZdZd
Zd ZdZdDZdEZdFZdGZdHZdIZdJZdKZdLZ dMZ dNZ dOZ dPZ dQZ!dRZ"dSZ#dTZ$dUZ%dVZ&dWZ'dXZ(dYZ)d"Z*d#Z+d$Z,d%Z-d&Z.d'Z/d(Z0d)Z1d*Z2d+Z3d,Z4d-Z5d.Z6d/Z7d0Z8d1Z9d2Z:d3Z;d4Zd7Z?d8Z@d9ZAd:ZBd;ZCdZFd?ZGd@ZHdAZIdBZJdCS )Z
SecurityConstzU
A class object that acts as essentially a namespace for Security constants.
r r r r iH& iK& iM& iX& iN& iO& iQ& iR& iV& iW& iT& iU& is& i`& io& iz& iq& iw& i ib ib ib i, i0 i+ i/ i$ i( i
i k j 9 8 i# i' i i g @ 3 2 = < 5 / i i i Niiiiiiiiiiiiiiiiiii iQi,iR)Kr r r r Z"kSSLSessionOptionBreakOnServerAuthZ
kSSLProtocol2Z
kSSLProtocol3Z
kTLSProtocol1ZkTLSProtocol11ZkTLSProtocol12ZkSSLClientSideZkSSLStreamTypeZkSecFormatPEMSequenceZkSecTrustResultInvalidZkSecTrustResultProceedZkSecTrustResultDenyZkSecTrustResultUnspecifiedZ&kSecTrustResultRecoverableTrustFailureZ kSecTrustResultFatalTrustFailureZkSecTrustResultOtherErrorZerrSSLProtocolZerrSSLWouldBlockZerrSSLClosedGracefulZerrSSLClosedNoNotifyZerrSSLClosedAbortZerrSSLXCertChainInvalidZ errSSLCryptoZerrSSLInternalZerrSSLCertExpiredZerrSSLCertNotYetValidZerrSSLUnknownRootCertZerrSSLNoRootCertZerrSSLHostNameMismatchZerrSSLPeerHandshakeFailZerrSSLPeerUserCancelledZ errSSLWeakPeerEphemeralDHKeyZerrSSLServerAuthCompletedZerrSSLRecordOverflowZerrSecVerifyFailedZerrSecNoTrustSettingsZerrSecItemNotFoundZerrSecInvalidTrustSettingsZ'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384Z'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256Z#TLS_DHE_DSS_WITH_AES_256_GCM_SHA384Z#TLS_DHE_RSA_WITH_AES_256_GCM_SHA384Z#TLS_DHE_DSS_WITH_AES_128_GCM_SHA256Z#TLS_DHE_RSA_WITH_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384Z$TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_256_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_256_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_256_CBC_SHAZ TLS_DHE_DSS_WITH_AES_256_CBC_SHAZ'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256Z$TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_128_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_128_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_128_CBC_SHAZ TLS_DHE_DSS_WITH_AES_128_CBC_SHAZ TLS_RSA_WITH_AES_256_GCM_SHA384Z TLS_RSA_WITH_AES_128_GCM_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHA256Z TLS_RSA_WITH_AES_128_CBC_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHAZ TLS_RSA_WITH_AES_128_CBC_SHAZTLS_AES_128_GCM_SHA256ZTLS_AES_256_GCM_SHA384Z TLS_CHACHA20_POLY1305_SHA256r" r" r" r# r$ s r$ )r r )r Z
__future__r platformZ ctypes.utilr Zctypesr r r r r r r
r r r
r r Z
security_path ImportErrorZcore_foundation_pathZmac_verversiontuplemapintsplit version_infoOSErrorr r ZBooleanZCFIndexr! ZCFDataZCFStringZCFArrayZCFMutableArrayZ CFDictionaryZCFErrorZCFTypeZCFTypeIDZ CFTypeRefZCFAllocatorRefZOSStatusZ CFDataRefZ CFStringRefZ
CFArrayRefZCFMutableArrayRefZCFDictionaryRefZCFArrayCallBacksZCFDictionaryKeyCallBacksZCFDictionaryValueCallBacksZSecCertificateRefZSecExternalFormatZSecExternalItemTypeZSecIdentityRefZSecItemImportExportFlagsZ SecItemImportExportKeyParametersZSecKeychainRefZ SSLProtocolZSSLCipherSuiteZ
SSLContextRefZ SecTrustRefZSSLConnectionRefZSecTrustResultTypeZSecTrustOptionFlagsZSSLProtocolSideZSSLConnectionTypeZSSLSessionOptionZ
SecItemImportZargtypesZrestypeZSecCertificateGetTypeIDZSecIdentityGetTypeIDZSecKeyGetTypeIDZ SecCertificateCreateWithDataZSecCertificateCopyDataZSecCopyErrorMessageStringZ SecIdentityCreateWithCertificateZSecKeychainCreateZSecKeychainDeleteZSecPKCS12ImportZ SSLReadFuncZ SSLWriteFuncZ
SSLSetIOFuncsZ SSLSetPeerIDZSSLSetCertificateZ SSLSetCertificateAuthoritiesZSSLSetConnectionZSSLSetPeerDomainNameZ SSLHandshakeZSSLReadZSSLWriteZSSLCloseZ SSLGetNumberSupportedCiphersZSSLGetSupportedCiphersZSSLSetEnabledCiphersZSSLGetNumberEnabledCiphersZargtypeZSSLGetEnabledCiphersZSSLGetNegotiatedCipherZ SSLGetNegotiatedProtocolVersionZSSLCopyPeerTrustZ SecTrustSetAnchorCertificatesZ!SecTrustSetAnchorCertificatesOnlyZ argstypesZSecTrustEvaluateZSecTrustGetCertificateCountZ SecTrustGetCertificateAtIndexZSSLCreateContextZSSLSetSessionOptionZSSLSetProtocolVersionMinZSSLSetProtocolVersionMaxZin_dllr r ZCFRetainZ CFReleaseZ CFGetTypeIDZCFStringCreateWithCStringZCFStringGetCStringPtrZCFStringGetCStringZ CFDataCreateZCFDataGetLengthZCFDataGetBytePtrZCFDictionaryCreateZCFDictionaryGetValueZ
CFArrayCreateZCFArrayCreateMutableZCFArrayAppendValueZCFArrayGetCountZCFArrayGetValueAtIndexr r r r AttributeErrorobjectr r$ r" r" r" r# s, ,
PK ! 5 @q q 4 _securetransport/__pycache__/__init__.cpython-36.pycnu [ 3
nf\ @ s d S )N r r r /usr/lib/python3.6/__init__.py s PK ! 5 @q q : _securetransport/__pycache__/__init__.cpython-36.opt-1.pycnu [ 3
nf\ @ s d S )N r r r /usr/lib/python3.6/__init__.py s PK ! sK/ / _securetransport/low_level.pynu [ """
Low-level helpers for the SecureTransport bindings.
These are Python functions that are not directly related to the high-level APIs
but are necessary to get them to work. They include a whole bunch of low-level
CoreFoundation messing about and memory management. The concerns in this module
are almost entirely about trying to avoid memory leaks and providing
appropriate and useful assistance to the higher-level code.
"""
import base64
import ctypes
import itertools
import re
import os
import ssl
import tempfile
from .bindings import Security, CoreFoundation, CFConst
# This regular expression is used to grab PEM data out of a PEM bundle.
_PEM_CERTS_RE = re.compile(
b"-----BEGIN CERTIFICATE-----\n(.*?)\n-----END CERTIFICATE-----", re.DOTALL
)
def _cf_data_from_bytes(bytestring):
"""
Given a bytestring, create a CFData object from it. This CFData object must
be CFReleased by the caller.
"""
return CoreFoundation.CFDataCreate(
CoreFoundation.kCFAllocatorDefault, bytestring, len(bytestring)
)
def _cf_dictionary_from_tuples(tuples):
"""
Given a list of Python tuples, create an associated CFDictionary.
"""
dictionary_size = len(tuples)
# We need to get the dictionary keys and values out in the same order.
keys = (t[0] for t in tuples)
values = (t[1] for t in tuples)
cf_keys = (CoreFoundation.CFTypeRef * dictionary_size)(*keys)
cf_values = (CoreFoundation.CFTypeRef * dictionary_size)(*values)
return CoreFoundation.CFDictionaryCreate(
CoreFoundation.kCFAllocatorDefault,
cf_keys,
cf_values,
dictionary_size,
CoreFoundation.kCFTypeDictionaryKeyCallBacks,
CoreFoundation.kCFTypeDictionaryValueCallBacks,
)
def _cf_string_to_unicode(value):
"""
Creates a Unicode string from a CFString object. Used entirely for error
reporting.
Yes, it annoys me quite a lot that this function is this complex.
"""
value_as_void_p = ctypes.cast(value, ctypes.POINTER(ctypes.c_void_p))
string = CoreFoundation.CFStringGetCStringPtr(
value_as_void_p,
CFConst.kCFStringEncodingUTF8
)
if string is None:
buffer = ctypes.create_string_buffer(1024)
result = CoreFoundation.CFStringGetCString(
value_as_void_p,
buffer,
1024,
CFConst.kCFStringEncodingUTF8
)
if not result:
raise OSError('Error copying C string from CFStringRef')
string = buffer.value
if string is not None:
string = string.decode('utf-8')
return string
def _assert_no_error(error, exception_class=None):
"""
Checks the return code and throws an exception if there is an error to
report
"""
if error == 0:
return
cf_error_string = Security.SecCopyErrorMessageString(error, None)
output = _cf_string_to_unicode(cf_error_string)
CoreFoundation.CFRelease(cf_error_string)
if output is None or output == u'':
output = u'OSStatus %s' % error
if exception_class is None:
exception_class = ssl.SSLError
raise exception_class(output)
def _cert_array_from_pem(pem_bundle):
"""
Given a bundle of certs in PEM format, turns them into a CFArray of certs
that can be used to validate a cert chain.
"""
# Normalize the PEM bundle's line endings.
pem_bundle = pem_bundle.replace(b"\r\n", b"\n")
der_certs = [
base64.b64decode(match.group(1))
for match in _PEM_CERTS_RE.finditer(pem_bundle)
]
if not der_certs:
raise ssl.SSLError("No root certificates specified")
cert_array = CoreFoundation.CFArrayCreateMutable(
CoreFoundation.kCFAllocatorDefault,
0,
ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks)
)
if not cert_array:
raise ssl.SSLError("Unable to allocate memory!")
try:
for der_bytes in der_certs:
certdata = _cf_data_from_bytes(der_bytes)
if not certdata:
raise ssl.SSLError("Unable to allocate memory!")
cert = Security.SecCertificateCreateWithData(
CoreFoundation.kCFAllocatorDefault, certdata
)
CoreFoundation.CFRelease(certdata)
if not cert:
raise ssl.SSLError("Unable to build cert object!")
CoreFoundation.CFArrayAppendValue(cert_array, cert)
CoreFoundation.CFRelease(cert)
except Exception:
# We need to free the array before the exception bubbles further.
# We only want to do that if an error occurs: otherwise, the caller
# should free.
CoreFoundation.CFRelease(cert_array)
return cert_array
def _is_cert(item):
"""
Returns True if a given CFTypeRef is a certificate.
"""
expected = Security.SecCertificateGetTypeID()
return CoreFoundation.CFGetTypeID(item) == expected
def _is_identity(item):
"""
Returns True if a given CFTypeRef is an identity.
"""
expected = Security.SecIdentityGetTypeID()
return CoreFoundation.CFGetTypeID(item) == expected
def _temporary_keychain():
"""
This function creates a temporary Mac keychain that we can use to work with
credentials. This keychain uses a one-time password and a temporary file to
store the data. We expect to have one keychain per socket. The returned
SecKeychainRef must be freed by the caller, including calling
SecKeychainDelete.
Returns a tuple of the SecKeychainRef and the path to the temporary
directory that contains it.
"""
# Unfortunately, SecKeychainCreate requires a path to a keychain. This
# means we cannot use mkstemp to use a generic temporary file. Instead,
# we're going to create a temporary directory and a filename to use there.
# This filename will be 8 random bytes expanded into base64. We also need
# some random bytes to password-protect the keychain we're creating, so we
# ask for 40 random bytes.
random_bytes = os.urandom(40)
filename = base64.b16encode(random_bytes[:8]).decode('utf-8')
password = base64.b16encode(random_bytes[8:]) # Must be valid UTF-8
tempdirectory = tempfile.mkdtemp()
keychain_path = os.path.join(tempdirectory, filename).encode('utf-8')
# We now want to create the keychain itself.
keychain = Security.SecKeychainRef()
status = Security.SecKeychainCreate(
keychain_path,
len(password),
password,
False,
None,
ctypes.byref(keychain)
)
_assert_no_error(status)
# Having created the keychain, we want to pass it off to the caller.
return keychain, tempdirectory
def _load_items_from_file(keychain, path):
"""
Given a single file, loads all the trust objects from it into arrays and
the keychain.
Returns a tuple of lists: the first list is a list of identities, the
second a list of certs.
"""
certificates = []
identities = []
result_array = None
with open(path, 'rb') as f:
raw_filedata = f.read()
try:
filedata = CoreFoundation.CFDataCreate(
CoreFoundation.kCFAllocatorDefault,
raw_filedata,
len(raw_filedata)
)
result_array = CoreFoundation.CFArrayRef()
result = Security.SecItemImport(
filedata, # cert data
None, # Filename, leaving it out for now
None, # What the type of the file is, we don't care
None, # what's in the file, we don't care
0, # import flags
None, # key params, can include passphrase in the future
keychain, # The keychain to insert into
ctypes.byref(result_array) # Results
)
_assert_no_error(result)
# A CFArray is not very useful to us as an intermediary
# representation, so we are going to extract the objects we want
# and then free the array. We don't need to keep hold of keys: the
# keychain already has them!
result_count = CoreFoundation.CFArrayGetCount(result_array)
for index in range(result_count):
item = CoreFoundation.CFArrayGetValueAtIndex(
result_array, index
)
item = ctypes.cast(item, CoreFoundation.CFTypeRef)
if _is_cert(item):
CoreFoundation.CFRetain(item)
certificates.append(item)
elif _is_identity(item):
CoreFoundation.CFRetain(item)
identities.append(item)
finally:
if result_array:
CoreFoundation.CFRelease(result_array)
CoreFoundation.CFRelease(filedata)
return (identities, certificates)
def _load_client_cert_chain(keychain, *paths):
"""
Load certificates and maybe keys from a number of files. Has the end goal
of returning a CFArray containing one SecIdentityRef, and then zero or more
SecCertificateRef objects, suitable for use as a client certificate trust
chain.
"""
# Ok, the strategy.
#
# This relies on knowing that macOS will not give you a SecIdentityRef
# unless you have imported a key into a keychain. This is a somewhat
# artificial limitation of macOS (for example, it doesn't necessarily
# affect iOS), but there is nothing inside Security.framework that lets you
# get a SecIdentityRef without having a key in a keychain.
#
# So the policy here is we take all the files and iterate them in order.
# Each one will use SecItemImport to have one or more objects loaded from
# it. We will also point at a keychain that macOS can use to work with the
# private key.
#
# Once we have all the objects, we'll check what we actually have. If we
# already have a SecIdentityRef in hand, fab: we'll use that. Otherwise,
# we'll take the first certificate (which we assume to be our leaf) and
# ask the keychain to give us a SecIdentityRef with that cert's associated
# key.
#
# We'll then return a CFArray containing the trust chain: one
# SecIdentityRef and then zero-or-more SecCertificateRef objects. The
# responsibility for freeing this CFArray will be with the caller. This
# CFArray must remain alive for the entire connection, so in practice it
# will be stored with a single SSLSocket, along with the reference to the
# keychain.
certificates = []
identities = []
# Filter out bad paths.
paths = (path for path in paths if path)
try:
for file_path in paths:
new_identities, new_certs = _load_items_from_file(
keychain, file_path
)
identities.extend(new_identities)
certificates.extend(new_certs)
# Ok, we have everything. The question is: do we have an identity? If
# not, we want to grab one from the first cert we have.
if not identities:
new_identity = Security.SecIdentityRef()
status = Security.SecIdentityCreateWithCertificate(
keychain,
certificates[0],
ctypes.byref(new_identity)
)
_assert_no_error(status)
identities.append(new_identity)
# We now want to release the original certificate, as we no longer
# need it.
CoreFoundation.CFRelease(certificates.pop(0))
# We now need to build a new CFArray that holds the trust chain.
trust_chain = CoreFoundation.CFArrayCreateMutable(
CoreFoundation.kCFAllocatorDefault,
0,
ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks),
)
for item in itertools.chain(identities, certificates):
# ArrayAppendValue does a CFRetain on the item. That's fine,
# because the finally block will release our other refs to them.
CoreFoundation.CFArrayAppendValue(trust_chain, item)
return trust_chain
finally:
for obj in itertools.chain(identities, certificates):
CoreFoundation.CFRelease(obj)
PK ! / _appengine_environ.pynu [ """
This module provides means to detect the App Engine environment.
"""
import os
def is_appengine():
return (is_local_appengine() or
is_prod_appengine() or
is_prod_appengine_mvms())
def is_appengine_sandbox():
return is_appengine() and not is_prod_appengine_mvms()
def is_local_appengine():
return ('APPENGINE_RUNTIME' in os.environ and
'Development/' in os.environ['SERVER_SOFTWARE'])
def is_prod_appengine():
return ('APPENGINE_RUNTIME' in os.environ and
'Google App Engine/' in os.environ['SERVER_SOFTWARE'] and
not is_prod_appengine_mvms())
def is_prod_appengine_mvms():
return os.environ.get('GAE_VM', False) == 'true'
PK ! ev ev securetransport.pynu [ """
SecureTranport support for urllib3 via ctypes.
This makes platform-native TLS available to urllib3 users on macOS without the
use of a compiler. This is an important feature because the Python Package
Index is moving to become a TLSv1.2-or-higher server, and the default OpenSSL
that ships with macOS is not capable of doing TLSv1.2. The only way to resolve
this is to give macOS users an alternative solution to the problem, and that
solution is to use SecureTransport.
We use ctypes here because this solution must not require a compiler. That's
because pip is not allowed to require a compiler either.
This is not intended to be a seriously long-term solution to this problem.
The hope is that PEP 543 will eventually solve this issue for us, at which
point we can retire this contrib module. But in the short term, we need to
solve the impending tire fire that is Python on Mac without this kind of
contrib module. So...here we are.
To use this module, simply import and inject it::
import urllib3.contrib.securetransport
urllib3.contrib.securetransport.inject_into_urllib3()
Happy TLSing!
"""
from __future__ import absolute_import
import contextlib
import ctypes
import errno
import os.path
import shutil
import socket
import ssl
import threading
import weakref
from .. import util
from ._securetransport.bindings import (
Security, SecurityConst, CoreFoundation
)
from ._securetransport.low_level import (
_assert_no_error, _cert_array_from_pem, _temporary_keychain,
_load_client_cert_chain
)
try: # Platform-specific: Python 2
from socket import _fileobject
except ImportError: # Platform-specific: Python 3
_fileobject = None
from ..packages.backports.makefile import backport_makefile
__all__ = ['inject_into_urllib3', 'extract_from_urllib3']
# SNI always works
HAS_SNI = True
orig_util_HAS_SNI = util.HAS_SNI
orig_util_SSLContext = util.ssl_.SSLContext
# This dictionary is used by the read callback to obtain a handle to the
# calling wrapped socket. This is a pretty silly approach, but for now it'll
# do. I feel like I should be able to smuggle a handle to the wrapped socket
# directly in the SSLConnectionRef, but for now this approach will work I
# guess.
#
# We need to lock around this structure for inserts, but we don't do it for
# reads/writes in the callbacks. The reasoning here goes as follows:
#
# 1. It is not possible to call into the callbacks before the dictionary is
# populated, so once in the callback the id must be in the dictionary.
# 2. The callbacks don't mutate the dictionary, they only read from it, and
# so cannot conflict with any of the insertions.
#
# This is good: if we had to lock in the callbacks we'd drastically slow down
# the performance of this code.
_connection_refs = weakref.WeakValueDictionary()
_connection_ref_lock = threading.Lock()
# Limit writes to 16kB. This is OpenSSL's limit, but we'll cargo-cult it over
# for no better reason than we need *a* limit, and this one is right there.
SSL_WRITE_BLOCKSIZE = 16384
# This is our equivalent of util.ssl_.DEFAULT_CIPHERS, but expanded out to
# individual cipher suites. We need to do this because this is how
# SecureTransport wants them.
CIPHER_SUITES = [
SecurityConst.TLS_AES_256_GCM_SHA384,
SecurityConst.TLS_CHACHA20_POLY1305_SHA256,
SecurityConst.TLS_AES_128_GCM_SHA256,
SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
SecurityConst.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
SecurityConst.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
SecurityConst.TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,
SecurityConst.TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
SecurityConst.TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,
SecurityConst.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
SecurityConst.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
SecurityConst.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
SecurityConst.TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
SecurityConst.TLS_DHE_DSS_WITH_AES_256_CBC_SHA256,
SecurityConst.TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
SecurityConst.TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
SecurityConst.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
SecurityConst.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
SecurityConst.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
SecurityConst.TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
SecurityConst.TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
SecurityConst.TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
SecurityConst.TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
SecurityConst.TLS_RSA_WITH_AES_256_GCM_SHA384,
SecurityConst.TLS_RSA_WITH_AES_128_GCM_SHA256,
SecurityConst.TLS_RSA_WITH_AES_256_CBC_SHA256,
SecurityConst.TLS_RSA_WITH_AES_128_CBC_SHA256,
SecurityConst.TLS_RSA_WITH_AES_256_CBC_SHA,
SecurityConst.TLS_RSA_WITH_AES_128_CBC_SHA,
]
# Basically this is simple: for PROTOCOL_SSLv23 we turn it into a low of
# TLSv1 and a high of TLSv1.2. For everything else, we pin to that version.
_protocol_to_min_max = {
ssl.PROTOCOL_SSLv23: (SecurityConst.kTLSProtocol1, SecurityConst.kTLSProtocol12),
}
if hasattr(ssl, "PROTOCOL_SSLv2"):
_protocol_to_min_max[ssl.PROTOCOL_SSLv2] = (
SecurityConst.kSSLProtocol2, SecurityConst.kSSLProtocol2
)
if hasattr(ssl, "PROTOCOL_SSLv3"):
_protocol_to_min_max[ssl.PROTOCOL_SSLv3] = (
SecurityConst.kSSLProtocol3, SecurityConst.kSSLProtocol3
)
if hasattr(ssl, "PROTOCOL_TLSv1"):
_protocol_to_min_max[ssl.PROTOCOL_TLSv1] = (
SecurityConst.kTLSProtocol1, SecurityConst.kTLSProtocol1
)
if hasattr(ssl, "PROTOCOL_TLSv1_1"):
_protocol_to_min_max[ssl.PROTOCOL_TLSv1_1] = (
SecurityConst.kTLSProtocol11, SecurityConst.kTLSProtocol11
)
if hasattr(ssl, "PROTOCOL_TLSv1_2"):
_protocol_to_min_max[ssl.PROTOCOL_TLSv1_2] = (
SecurityConst.kTLSProtocol12, SecurityConst.kTLSProtocol12
)
if hasattr(ssl, "PROTOCOL_TLS"):
_protocol_to_min_max[ssl.PROTOCOL_TLS] = _protocol_to_min_max[ssl.PROTOCOL_SSLv23]
def inject_into_urllib3():
"""
Monkey-patch urllib3 with SecureTransport-backed SSL-support.
"""
util.ssl_.SSLContext = SecureTransportContext
util.HAS_SNI = HAS_SNI
util.ssl_.HAS_SNI = HAS_SNI
util.IS_SECURETRANSPORT = True
util.ssl_.IS_SECURETRANSPORT = True
def extract_from_urllib3():
"""
Undo monkey-patching by :func:`inject_into_urllib3`.
"""
util.ssl_.SSLContext = orig_util_SSLContext
util.HAS_SNI = orig_util_HAS_SNI
util.ssl_.HAS_SNI = orig_util_HAS_SNI
util.IS_SECURETRANSPORT = False
util.ssl_.IS_SECURETRANSPORT = False
def _read_callback(connection_id, data_buffer, data_length_pointer):
"""
SecureTransport read callback. This is called by ST to request that data
be returned from the socket.
"""
wrapped_socket = None
try:
wrapped_socket = _connection_refs.get(connection_id)
if wrapped_socket is None:
return SecurityConst.errSSLInternal
base_socket = wrapped_socket.socket
requested_length = data_length_pointer[0]
timeout = wrapped_socket.gettimeout()
error = None
read_count = 0
try:
while read_count < requested_length:
if timeout is None or timeout >= 0:
if not util.wait_for_read(base_socket, timeout):
raise socket.error(errno.EAGAIN, 'timed out')
remaining = requested_length - read_count
buffer = (ctypes.c_char * remaining).from_address(
data_buffer + read_count
)
chunk_size = base_socket.recv_into(buffer, remaining)
read_count += chunk_size
if not chunk_size:
if not read_count:
return SecurityConst.errSSLClosedGraceful
break
except (socket.error) as e:
error = e.errno
if error is not None and error != errno.EAGAIN:
data_length_pointer[0] = read_count
if error == errno.ECONNRESET or error == errno.EPIPE:
return SecurityConst.errSSLClosedAbort
raise
data_length_pointer[0] = read_count
if read_count != requested_length:
return SecurityConst.errSSLWouldBlock
return 0
except Exception as e:
if wrapped_socket is not None:
wrapped_socket._exception = e
return SecurityConst.errSSLInternal
def _write_callback(connection_id, data_buffer, data_length_pointer):
"""
SecureTransport write callback. This is called by ST to request that data
actually be sent on the network.
"""
wrapped_socket = None
try:
wrapped_socket = _connection_refs.get(connection_id)
if wrapped_socket is None:
return SecurityConst.errSSLInternal
base_socket = wrapped_socket.socket
bytes_to_write = data_length_pointer[0]
data = ctypes.string_at(data_buffer, bytes_to_write)
timeout = wrapped_socket.gettimeout()
error = None
sent = 0
try:
while sent < bytes_to_write:
if timeout is None or timeout >= 0:
if not util.wait_for_write(base_socket, timeout):
raise socket.error(errno.EAGAIN, 'timed out')
chunk_sent = base_socket.send(data)
sent += chunk_sent
# This has some needless copying here, but I'm not sure there's
# much value in optimising this data path.
data = data[chunk_sent:]
except (socket.error) as e:
error = e.errno
if error is not None and error != errno.EAGAIN:
data_length_pointer[0] = sent
if error == errno.ECONNRESET or error == errno.EPIPE:
return SecurityConst.errSSLClosedAbort
raise
data_length_pointer[0] = sent
if sent != bytes_to_write:
return SecurityConst.errSSLWouldBlock
return 0
except Exception as e:
if wrapped_socket is not None:
wrapped_socket._exception = e
return SecurityConst.errSSLInternal
# We need to keep these two objects references alive: if they get GC'd while
# in use then SecureTransport could attempt to call a function that is in freed
# memory. That would be...uh...bad. Yeah, that's the word. Bad.
_read_callback_pointer = Security.SSLReadFunc(_read_callback)
_write_callback_pointer = Security.SSLWriteFunc(_write_callback)
class WrappedSocket(object):
"""
API-compatibility wrapper for Python's OpenSSL wrapped socket object.
Note: _makefile_refs, _drop(), and _reuse() are needed for the garbage
collector of PyPy.
"""
def __init__(self, socket):
self.socket = socket
self.context = None
self._makefile_refs = 0
self._closed = False
self._exception = None
self._keychain = None
self._keychain_dir = None
self._client_cert_chain = None
# We save off the previously-configured timeout and then set it to
# zero. This is done because we use select and friends to handle the
# timeouts, but if we leave the timeout set on the lower socket then
# Python will "kindly" call select on that socket again for us. Avoid
# that by forcing the timeout to zero.
self._timeout = self.socket.gettimeout()
self.socket.settimeout(0)
@contextlib.contextmanager
def _raise_on_error(self):
"""
A context manager that can be used to wrap calls that do I/O from
SecureTransport. If any of the I/O callbacks hit an exception, this
context manager will correctly propagate the exception after the fact.
This avoids silently swallowing those exceptions.
It also correctly forces the socket closed.
"""
self._exception = None
# We explicitly don't catch around this yield because in the unlikely
# event that an exception was hit in the block we don't want to swallow
# it.
yield
if self._exception is not None:
exception, self._exception = self._exception, None
self.close()
raise exception
def _set_ciphers(self):
"""
Sets up the allowed ciphers. By default this matches the set in
util.ssl_.DEFAULT_CIPHERS, at least as supported by macOS. This is done
custom and doesn't allow changing at this time, mostly because parsing
OpenSSL cipher strings is going to be a freaking nightmare.
"""
ciphers = (Security.SSLCipherSuite * len(CIPHER_SUITES))(*CIPHER_SUITES)
result = Security.SSLSetEnabledCiphers(
self.context, ciphers, len(CIPHER_SUITES)
)
_assert_no_error(result)
def _custom_validate(self, verify, trust_bundle):
"""
Called when we have set custom validation. We do this in two cases:
first, when cert validation is entirely disabled; and second, when
using a custom trust DB.
"""
# If we disabled cert validation, just say: cool.
if not verify:
return
# We want data in memory, so load it up.
if os.path.isfile(trust_bundle):
with open(trust_bundle, 'rb') as f:
trust_bundle = f.read()
cert_array = None
trust = Security.SecTrustRef()
try:
# Get a CFArray that contains the certs we want.
cert_array = _cert_array_from_pem(trust_bundle)
# Ok, now the hard part. We want to get the SecTrustRef that ST has
# created for this connection, shove our CAs into it, tell ST to
# ignore everything else it knows, and then ask if it can build a
# chain. This is a buuuunch of code.
result = Security.SSLCopyPeerTrust(
self.context, ctypes.byref(trust)
)
_assert_no_error(result)
if not trust:
raise ssl.SSLError("Failed to copy trust reference")
result = Security.SecTrustSetAnchorCertificates(trust, cert_array)
_assert_no_error(result)
result = Security.SecTrustSetAnchorCertificatesOnly(trust, True)
_assert_no_error(result)
trust_result = Security.SecTrustResultType()
result = Security.SecTrustEvaluate(
trust, ctypes.byref(trust_result)
)
_assert_no_error(result)
finally:
if trust:
CoreFoundation.CFRelease(trust)
if cert_array is not None:
CoreFoundation.CFRelease(cert_array)
# Ok, now we can look at what the result was.
successes = (
SecurityConst.kSecTrustResultUnspecified,
SecurityConst.kSecTrustResultProceed
)
if trust_result.value not in successes:
raise ssl.SSLError(
"certificate verify failed, error code: %d" %
trust_result.value
)
def handshake(self,
server_hostname,
verify,
trust_bundle,
min_version,
max_version,
client_cert,
client_key,
client_key_passphrase):
"""
Actually performs the TLS handshake. This is run automatically by
wrapped socket, and shouldn't be needed in user code.
"""
# First, we do the initial bits of connection setup. We need to create
# a context, set its I/O funcs, and set the connection reference.
self.context = Security.SSLCreateContext(
None, SecurityConst.kSSLClientSide, SecurityConst.kSSLStreamType
)
result = Security.SSLSetIOFuncs(
self.context, _read_callback_pointer, _write_callback_pointer
)
_assert_no_error(result)
# Here we need to compute the handle to use. We do this by taking the
# id of self modulo 2**31 - 1. If this is already in the dictionary, we
# just keep incrementing by one until we find a free space.
with _connection_ref_lock:
handle = id(self) % 2147483647
while handle in _connection_refs:
handle = (handle + 1) % 2147483647
_connection_refs[handle] = self
result = Security.SSLSetConnection(self.context, handle)
_assert_no_error(result)
# If we have a server hostname, we should set that too.
if server_hostname:
if not isinstance(server_hostname, bytes):
server_hostname = server_hostname.encode('utf-8')
result = Security.SSLSetPeerDomainName(
self.context, server_hostname, len(server_hostname)
)
_assert_no_error(result)
# Setup the ciphers.
self._set_ciphers()
# Set the minimum and maximum TLS versions.
result = Security.SSLSetProtocolVersionMin(self.context, min_version)
_assert_no_error(result)
result = Security.SSLSetProtocolVersionMax(self.context, max_version)
_assert_no_error(result)
# If there's a trust DB, we need to use it. We do that by telling
# SecureTransport to break on server auth. We also do that if we don't
# want to validate the certs at all: we just won't actually do any
# authing in that case.
if not verify or trust_bundle is not None:
result = Security.SSLSetSessionOption(
self.context,
SecurityConst.kSSLSessionOptionBreakOnServerAuth,
True
)
_assert_no_error(result)
# If there's a client cert, we need to use it.
if client_cert:
self._keychain, self._keychain_dir = _temporary_keychain()
self._client_cert_chain = _load_client_cert_chain(
self._keychain, client_cert, client_key
)
result = Security.SSLSetCertificate(
self.context, self._client_cert_chain
)
_assert_no_error(result)
while True:
with self._raise_on_error():
result = Security.SSLHandshake(self.context)
if result == SecurityConst.errSSLWouldBlock:
raise socket.timeout("handshake timed out")
elif result == SecurityConst.errSSLServerAuthCompleted:
self._custom_validate(verify, trust_bundle)
continue
else:
_assert_no_error(result)
break
def fileno(self):
return self.socket.fileno()
# Copy-pasted from Python 3.5 source code
def _decref_socketios(self):
if self._makefile_refs > 0:
self._makefile_refs -= 1
if self._closed:
self.close()
def recv(self, bufsiz):
buffer = ctypes.create_string_buffer(bufsiz)
bytes_read = self.recv_into(buffer, bufsiz)
data = buffer[:bytes_read]
return data
def recv_into(self, buffer, nbytes=None):
# Read short on EOF.
if self._closed:
return 0
if nbytes is None:
nbytes = len(buffer)
buffer = (ctypes.c_char * nbytes).from_buffer(buffer)
processed_bytes = ctypes.c_size_t(0)
with self._raise_on_error():
result = Security.SSLRead(
self.context, buffer, nbytes, ctypes.byref(processed_bytes)
)
# There are some result codes that we want to treat as "not always
# errors". Specifically, those are errSSLWouldBlock,
# errSSLClosedGraceful, and errSSLClosedNoNotify.
if (result == SecurityConst.errSSLWouldBlock):
# If we didn't process any bytes, then this was just a time out.
# However, we can get errSSLWouldBlock in situations when we *did*
# read some data, and in those cases we should just read "short"
# and return.
if processed_bytes.value == 0:
# Timed out, no data read.
raise socket.timeout("recv timed out")
elif result in (SecurityConst.errSSLClosedGraceful, SecurityConst.errSSLClosedNoNotify):
# The remote peer has closed this connection. We should do so as
# well. Note that we don't actually return here because in
# principle this could actually be fired along with return data.
# It's unlikely though.
self.close()
else:
_assert_no_error(result)
# Ok, we read and probably succeeded. We should return whatever data
# was actually read.
return processed_bytes.value
def settimeout(self, timeout):
self._timeout = timeout
def gettimeout(self):
return self._timeout
def send(self, data):
processed_bytes = ctypes.c_size_t(0)
with self._raise_on_error():
result = Security.SSLWrite(
self.context, data, len(data), ctypes.byref(processed_bytes)
)
if result == SecurityConst.errSSLWouldBlock and processed_bytes.value == 0:
# Timed out
raise socket.timeout("send timed out")
else:
_assert_no_error(result)
# We sent, and probably succeeded. Tell them how much we sent.
return processed_bytes.value
def sendall(self, data):
total_sent = 0
while total_sent < len(data):
sent = self.send(data[total_sent:total_sent + SSL_WRITE_BLOCKSIZE])
total_sent += sent
def shutdown(self):
with self._raise_on_error():
Security.SSLClose(self.context)
def close(self):
# TODO: should I do clean shutdown here? Do I have to?
if self._makefile_refs < 1:
self._closed = True
if self.context:
CoreFoundation.CFRelease(self.context)
self.context = None
if self._client_cert_chain:
CoreFoundation.CFRelease(self._client_cert_chain)
self._client_cert_chain = None
if self._keychain:
Security.SecKeychainDelete(self._keychain)
CoreFoundation.CFRelease(self._keychain)
shutil.rmtree(self._keychain_dir)
self._keychain = self._keychain_dir = None
return self.socket.close()
else:
self._makefile_refs -= 1
def getpeercert(self, binary_form=False):
# Urgh, annoying.
#
# Here's how we do this:
#
# 1. Call SSLCopyPeerTrust to get hold of the trust object for this
# connection.
# 2. Call SecTrustGetCertificateAtIndex for index 0 to get the leaf.
# 3. To get the CN, call SecCertificateCopyCommonName and process that
# string so that it's of the appropriate type.
# 4. To get the SAN, we need to do something a bit more complex:
# a. Call SecCertificateCopyValues to get the data, requesting
# kSecOIDSubjectAltName.
# b. Mess about with this dictionary to try to get the SANs out.
#
# This is gross. Really gross. It's going to be a few hundred LoC extra
# just to repeat something that SecureTransport can *already do*. So my
# operating assumption at this time is that what we want to do is
# instead to just flag to urllib3 that it shouldn't do its own hostname
# validation when using SecureTransport.
if not binary_form:
raise ValueError(
"SecureTransport only supports dumping binary certs"
)
trust = Security.SecTrustRef()
certdata = None
der_bytes = None
try:
# Grab the trust store.
result = Security.SSLCopyPeerTrust(
self.context, ctypes.byref(trust)
)
_assert_no_error(result)
if not trust:
# Probably we haven't done the handshake yet. No biggie.
return None
cert_count = Security.SecTrustGetCertificateCount(trust)
if not cert_count:
# Also a case that might happen if we haven't handshaked.
# Handshook? Handshaken?
return None
leaf = Security.SecTrustGetCertificateAtIndex(trust, 0)
assert leaf
# Ok, now we want the DER bytes.
certdata = Security.SecCertificateCopyData(leaf)
assert certdata
data_length = CoreFoundation.CFDataGetLength(certdata)
data_buffer = CoreFoundation.CFDataGetBytePtr(certdata)
der_bytes = ctypes.string_at(data_buffer, data_length)
finally:
if certdata:
CoreFoundation.CFRelease(certdata)
if trust:
CoreFoundation.CFRelease(trust)
return der_bytes
def _reuse(self):
self._makefile_refs += 1
def _drop(self):
if self._makefile_refs < 1:
self.close()
else:
self._makefile_refs -= 1
if _fileobject: # Platform-specific: Python 2
def makefile(self, mode, bufsize=-1):
self._makefile_refs += 1
return _fileobject(self, mode, bufsize, close=True)
else: # Platform-specific: Python 3
def makefile(self, mode="r", buffering=None, *args, **kwargs):
# We disable buffering with SecureTransport because it conflicts with
# the buffering that ST does internally (see issue #1153 for more).
buffering = 0
return backport_makefile(self, mode, buffering, *args, **kwargs)
WrappedSocket.makefile = makefile
class SecureTransportContext(object):
"""
I am a wrapper class for the SecureTransport library, to translate the
interface of the standard library ``SSLContext`` object to calls into
SecureTransport.
"""
def __init__(self, protocol):
self._min_version, self._max_version = _protocol_to_min_max[protocol]
self._options = 0
self._verify = False
self._trust_bundle = None
self._client_cert = None
self._client_key = None
self._client_key_passphrase = None
@property
def check_hostname(self):
"""
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
"""
return True
@check_hostname.setter
def check_hostname(self, value):
"""
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
"""
pass
@property
def options(self):
# TODO: Well, crap.
#
# So this is the bit of the code that is the most likely to cause us
# trouble. Essentially we need to enumerate all of the SSL options that
# users might want to use and try to see if we can sensibly translate
# them, or whether we should just ignore them.
return self._options
@options.setter
def options(self, value):
# TODO: Update in line with above.
self._options = value
@property
def verify_mode(self):
return ssl.CERT_REQUIRED if self._verify else ssl.CERT_NONE
@verify_mode.setter
def verify_mode(self, value):
self._verify = True if value == ssl.CERT_REQUIRED else False
def set_default_verify_paths(self):
# So, this has to do something a bit weird. Specifically, what it does
# is nothing.
#
# This means that, if we had previously had load_verify_locations
# called, this does not undo that. We need to do that because it turns
# out that the rest of the urllib3 code will attempt to load the
# default verify paths if it hasn't been told about any paths, even if
# the context itself was sometime earlier. We resolve that by just
# ignoring it.
pass
def load_default_certs(self):
return self.set_default_verify_paths()
def set_ciphers(self, ciphers):
# For now, we just require the default cipher string.
if ciphers != util.ssl_.DEFAULT_CIPHERS:
raise ValueError(
"SecureTransport doesn't support custom cipher strings"
)
def load_verify_locations(self, cafile=None, capath=None, cadata=None):
# OK, we only really support cadata and cafile.
if capath is not None:
raise ValueError(
"SecureTransport does not support cert directories"
)
self._trust_bundle = cafile or cadata
def load_cert_chain(self, certfile, keyfile=None, password=None):
self._client_cert = certfile
self._client_key = keyfile
self._client_cert_passphrase = password
def wrap_socket(self, sock, server_side=False,
do_handshake_on_connect=True, suppress_ragged_eofs=True,
server_hostname=None):
# So, what do we do here? Firstly, we assert some properties. This is a
# stripped down shim, so there is some functionality we don't support.
# See PEP 543 for the real deal.
assert not server_side
assert do_handshake_on_connect
assert suppress_ragged_eofs
# Ok, we're good to go. Now we want to create the wrapped socket object
# and store it in the appropriate place.
wrapped_socket = WrappedSocket(sock)
# Now we can handshake
wrapped_socket.handshake(
server_hostname, self._verify, self._trust_bundle,
self._min_version, self._max_version, self._client_cert,
self._client_key, self._client_key_passphrase
)
return wrapped_socket
PK ! s{GE GE 0 __pycache__/securetransport.cpython-36.opt-1.pycnu [ 3
nf\ev ) @ s d Z ddlmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
mZ ddlmZmZmZ ddlmZmZmZmZ ydd l mZ W n$ ek
r dZdd
lmZ Y nX d d gZ d
Z ej Z ej j Z!e j" Z#e j$ Z%dZ&ej'ej(ej)ej*ej+ej,ej-ej.ej/ej0ej1ej2ej3ej4ej5ej6ej7ej8ej9ej:ej;ejej?ej@ejAejBejCejDejEejFejGg!ZHe
jIejJejKfiZLeMe
drejNejNfeLe
jO< eMe
drejPejPfeLe
jQ< eMe
drejJejJfeLe
jR< eMe
drejSejSfeLe
jT< eMe
dr$ejKejKfeLe
jU< eMe
dr@eLe
jI eLe
jV< dd ZWdd ZXdd ZYdd ZZej[eYZ\ej]eZZ^G dd d e_Z`erd$d d Zan
d%d d Zaeae`_aG d!d" d"e_ZbdS )&aU
SecureTranport support for urllib3 via ctypes.
This makes platform-native TLS available to urllib3 users on macOS without the
use of a compiler. This is an important feature because the Python Package
Index is moving to become a TLSv1.2-or-higher server, and the default OpenSSL
that ships with macOS is not capable of doing TLSv1.2. The only way to resolve
this is to give macOS users an alternative solution to the problem, and that
solution is to use SecureTransport.
We use ctypes here because this solution must not require a compiler. That's
because pip is not allowed to require a compiler either.
This is not intended to be a seriously long-term solution to this problem.
The hope is that PEP 543 will eventually solve this issue for us, at which
point we can retire this contrib module. But in the short term, we need to
solve the impending tire fire that is Python on Mac without this kind of
contrib module. So...here we are.
To use this module, simply import and inject it::
import urllib3.contrib.securetransport
urllib3.contrib.securetransport.inject_into_urllib3()
Happy TLSing!
)absolute_importN )util )Security
SecurityConstCoreFoundation)_assert_no_error_cert_array_from_pem_temporary_keychain_load_client_cert_chain) _fileobject)backport_makefileinject_into_urllib3extract_from_urllib3Ti @ PROTOCOL_SSLv2PROTOCOL_SSLv3PROTOCOL_TLSv1PROTOCOL_TLSv1_1PROTOCOL_TLSv1_2 PROTOCOL_TLSc C s( t tj_tt_ttj_dt_dtj_dS )zG
Monkey-patch urllib3 with SecureTransport-backed SSL-support.
TN)SecureTransportContextr ssl_
SSLContextHAS_SNIIS_SECURETRANSPORT r r %/usr/lib/python3.6/securetransport.pyr s
c C s( t tj_tt_ttj_dt_dtj_dS )z>
Undo monkey-patching by :func:`inject_into_urllib3`.
FN)orig_util_SSLContextr r r orig_util_HAS_SNIr r r r r r r s
c
C sx d}y8t j| }|dkr tjS |j}|d }|j }d}d}y|xv||k r|dksZ|dkrttj||sttjt j
d|| } t j | j
|| }
|j|
| } || 7 }| sB|stjS P qBW W nh tjk
r" } zH| j }|dk o|t j
kr||d< |t jks
|t jkrtjS W Y dd} ~ X nX ||d< ||kr r r r sendallC s zWrappedSocket.sendallc C s$ | j tj| j W d Q R X d S )N)rL r ZSSLCloserA )rI r r r shutdownI s
zWrappedSocket.shutdownc C s | j dk rd| _| jr(tj| j d | _| jr@tj| j d | _| jrvtj| j tj| j t j
| j d | _| _ | j j
S | j d8 _ d S )Nr T)rB rC rA r r\ rF rD r ZSecKeychainDeleteshutilZrmtreerE r# rK )rI r r r rK M s
zWrappedSocket.closeFc
C s |s t dtj }d }d }zptj| jtj|}t| |sBd S tj|}|sTd S tj |d}tj
|}t j |}t j
|} tj| |}W d |rt j| |rt j| X |S )Nz2SecureTransport only supports dumping binary certsr )
ValueErrorr rX rY rA r( rZ r ZSecTrustGetCertificateCountZ SecTrustGetCertificateAtIndexZSecCertificateCopyDatar ZCFDataGetLengthZCFDataGetBytePtrr; r\ )
rI Z binary_formra ZcertdataZ der_bytesrP Z
cert_countZleafZ data_lengthr3 r r r getpeercert` s2
zWrappedSocket.getpeercertc C s | j d7 _ d S )Nr )rB )rI r r r _reuse s zWrappedSocket._reusec C s& | j dk r| j n| j d8 _ d S )Nr )rB rK )rI r r r _drop s
zWrappedSocket._drop)N)F)__name__
__module__ __qualname____doc__rJ
contextlibcontextmanagerrL rQ rb rk rl rm rn r* rH r$ r< rs rt rK rw rx ry r r r r r@ ! s&
>Z
(
>r@ c C s | j d7 _ t| ||ddS )Nr T)rK )rB r
)rI modebufsizer r r makefile s r rc O s d}t | ||f||S )Nr )r )rI r bufferingargskwargsr r r r s c @ s e Zd ZdZdd Zedd Zejdd Zedd Zejd d Zed
d Z e jd d Z d
d Z
dd Z dd Z d ddZ
d ddZd ddZdS ) r z
I am a wrapper class for the SecureTransport library, to translate the
interface of the standard library ``SSLContext`` object to calls into
SecureTransport.
c C s8 t | \| _| _d| _d| _d | _d | _d | _d | _d S )Nr F) _protocol_to_min_max _min_version _max_version_options_verify
_trust_bundle _client_cert _client_key_client_key_passphrase)rI Zprotocolr r r rJ s z SecureTransportContext.__init__c C s dS )z
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
Tr )rI r r r check_hostname s z%SecureTransportContext.check_hostnamec C s dS )z
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
Nr )rI r] r r r r s c C s | j S )N)r )rI r r r options s z SecureTransportContext.optionsc C s
|| _ d S )N)r )rI r] r r r r s c C s | j r tjS tjS )N)r r[
CERT_REQUIREDZ CERT_NONE)rI r r r verify_mode s z"SecureTransportContext.verify_modec C s |t jkrdnd| _d S )NTF)r[ r r )rI r] r r r r s c C s d S )Nr )rI r r r set_default_verify_paths s
z/SecureTransportContext.set_default_verify_pathsc C s | j S )N)r )rI r r r load_default_certs s z)SecureTransportContext.load_default_certsc C s |t jjkrtdd S )Nz5SecureTransport doesn't support custom cipher strings)r r ZDEFAULT_CIPHERSrv )rI rO r r r set_ciphers s z"SecureTransportContext.set_ciphersNc C s |d k rt d|p|| _d S )Nz1SecureTransport does not support cert directories)rv r )rI ZcafileZcapathZcadatar r r load_verify_locations s z,SecureTransportContext.load_verify_locationsc C s || _ || _|| _d S )N)r r Z_client_cert_passphrase)rI ZcertfileZkeyfileZpasswordr r r load_cert_chain s z&SecureTransportContext.load_cert_chainFTc C s2 t |}|j|| j| j| j| j| j| j| j |S )N) r@ rk r r r r r r r )rI ZsockZ server_sideZdo_handshake_on_connectZsuppress_ragged_eofsrj r5 r r r wrap_socket s
z"SecureTransportContext.wrap_socket)NNN)NN)FTTN)rz r{ r| r} rJ propertyr setterr r r r r r r r r r r r r s
r )r )r N)cr} Z
__future__r r~ r( r& Zos.pathrS ru r# r[ Z threadingweakref r Z_securetransport.bindingsr r r Z_securetransport.low_levelr r
r r r
ImportErrorZpackages.backports.makefiler __all__r r r r r WeakValueDictionaryr ZLockre rr ZTLS_AES_256_GCM_SHA384Z TLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384Z'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256Z#TLS_DHE_DSS_WITH_AES_256_GCM_SHA384Z#TLS_DHE_RSA_WITH_AES_256_GCM_SHA384Z#TLS_DHE_DSS_WITH_AES_128_GCM_SHA256Z#TLS_DHE_RSA_WITH_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384Z$TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_256_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_256_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_256_CBC_SHAZ TLS_DHE_DSS_WITH_AES_256_CBC_SHAZ'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256Z$TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_128_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_128_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_128_CBC_SHAZ TLS_DHE_DSS_WITH_AES_128_CBC_SHAZ TLS_RSA_WITH_AES_256_GCM_SHA384Z TLS_RSA_WITH_AES_128_GCM_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHA256Z TLS_RSA_WITH_AES_128_CBC_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHAZ TLS_RSA_WITH_AES_128_CBC_SHArN ZPROTOCOL_SSLv23Z
kTLSProtocol1ZkTLSProtocol12r hasattrZ
kSSLProtocol2r Z
kSSLProtocol3r r ZkTLSProtocol11r r r r r r: r? Z SSLReadFuncrc Z SSLWriteFuncrd objectr@ r r r r r r s 76
PK ! s PK ! y2 3 __pycache__/_appengine_environ.cpython-36.opt-1.pycnu [ 3
nf\ @ s8 d Z ddlZdd Zdd Zdd Zd d
Zd d ZdS )
zB
This module provides means to detect the App Engine environment.
Nc C s t pt pt S )N)is_local_appengineis_prod_appengineis_prod_appengine_mvms r r (/usr/lib/python3.6/_appengine_environ.py is_appengine s r c C s t o t S )N)r r r r r r is_appengine_sandbox s r c C s dt jkodt jd kS )NAPPENGINE_RUNTIMEz Development/SERVER_SOFTWARE)osenvironr r r r r s
r c C s dt jko dt jd ko t S )Nr zGoogle App Engine/r
)r r r r r r r r s
r c C s t jjdddkS )NZGAE_VMFtrue)r r getr r r r r s r )__doc__r r r r r r r r r r s PK ! y2 - __pycache__/_appengine_environ.cpython-36.pycnu [ 3
nf\ @ s8 d Z ddlZdd Zdd Zdd Zd d
Zd d ZdS )
zB
This module provides means to detect the App Engine environment.
Nc C s t pt pt S )N)is_local_appengineis_prod_appengineis_prod_appengine_mvms r r (/usr/lib/python3.6/_appengine_environ.py is_appengine s r c C s t o t S )N)r r r r r r is_appengine_sandbox s r c C s dt jkodt jd kS )NAPPENGINE_RUNTIMEz Development/SERVER_SOFTWARE)osenvironr r r r r s
r c C s dt jko dt jd ko t S )Nr zGoogle App Engine/r
)r r r r r r r r s
r c C s t jjdddkS )NZGAE_VMFtrue)r r getr r r r r s r )__doc__r r r r r r r r r r s PK ! aX __pycache__/socks.cpython-36.pycnu [ 3
nf\ @ s( d Z ddlmZ y ddlZW n6 ek
rR ddlZddlmZ ejde Y nX ddl m
Z m Z
ddlmZmZ dd lmZmZ dd
lmZmZ dd lmZ dd lmZ y ddlZW n ek
r dZY nX G d
d deZG dd deeZ G dd deZ G dd deZ G dd deZ dS )a
This module contains provisional support for SOCKS proxies from within
urllib3. This module supports SOCKS4 (specifically the SOCKS4A variant) and
SOCKS5. To enable its functionality, either install PySocks or install this
module with the ``socks`` extra.
The SOCKS implementation supports the full range of urllib3 features. It also
supports the following SOCKS features:
- SOCKS4
- SOCKS4a
- SOCKS5
- Usernames and passwords for the SOCKS proxy
Known Limitations:
- Currently PySocks does not support contacting remote websites via literal
IPv6 addresses. Any such connection attempt will fail. You must use a domain
name.
- Currently PySocks does not support IPv6 connections to the SOCKS proxy. Any
such connection attempt will fail.
)absolute_importN )DependencyWarningzSOCKS support in urllib3 requires the installation of optional dependencies: specifically, PySocks. For more information, see https://urllib3.readthedocs.io/en/latest/contrib.html#socks-proxies)errortimeout)HTTPConnectionHTTPSConnection)HTTPConnectionPoolHTTPSConnectionPool)ConnectTimeoutErrorNewConnectionError) PoolManager) parse_urlc s( e Zd ZdZ fddZdd Z ZS )SOCKSConnectionzG
A plain-text HTTP connection that connects via a SOCKS proxy.
c s" |j d| _tt| j|| d S )N_socks_options)popr superr __init__)selfargskwargs) __class__ /usr/lib/python3.6/socks.pyr ? s zSOCKSConnection.__init__c C sX i }| j r| j |d< | jr$| j|d< yTtj| j| jff| jd | jd | jd | jd | jd | jd | jd |}W n tk
r } z t | d
| j| jf W Y d d }~X n tj
k
r" } zT|j r|j }t |trt | d
| j| jf nt
| d | nt
| d | W Y d d }~X n2 tk
rR } zt
| d | W Y d d }~X nX |S )
zA
Establish a new connection via the SOCKS proxy.
source_addresssocket_options
socks_version
proxy_host
proxy_portusernamepasswordrdns)Z
proxy_typeZ
proxy_addrr Zproxy_usernameZproxy_passwordZ
proxy_rdnsr z0Connection to %s timed out. (connect timeout=%s)Nz(Failed to establish a new connection: %s)r r socksZcreate_connectionhostportr r
SocketTimeoutr Z
ProxyErrorZ
socket_err
isinstancer SocketError)r Zextra_kwZconner r r r _new_connC sL
zSOCKSConnection._new_conn)__name__
__module__ __qualname____doc__r r)
__classcell__r r )r r r ; s r c @ s e Zd ZdS )SOCKSHTTPSConnectionN)r* r+ r, r r r r r/ s r/ c @ s e Zd ZeZdS )SOCKSHTTPConnectionPoolN)r* r+ r, r
ConnectionClsr r r r r0 s r0 c @ s e Zd ZeZdS )SOCKSHTTPSConnectionPoolN)r* r+ r, r/ r1 r r r r r2 s r2 c s, e Zd ZdZeedZd fdd Z ZS )SOCKSProxyManagerzh
A version of the urllib3 ProxyManager that routes connections via the
defined SOCKS proxy.
)ZhttpZhttpsN
c s t |}|d krB|d krB|jd k rB|jjd}t|dkrB|\}}|jdkrXtj} d}
nN|jdkrntj} d}
n8|jdkrtj} d}
n"|jdkrtj} d}
n td | || _ | |j
|j |||
d
} | |d < t t
| j||f| t
j| _d S ) N:r Zsocks5FZsocks5hTZsocks4Zsocks4az)Unable to determine SOCKS version from %s)r r r r r r! r )r Zauthsplitlenschemer" ZPROXY_TYPE_SOCKS5ZPROXY_TYPE_SOCKS4
ValueError proxy_urlr# r$ r r3 r pool_classes_by_scheme) r r: r r Z num_poolsZheadersZconnection_pool_kwZparsedr6 r r! Z
socks_options)r r r r s<
zSOCKSProxyManager.__init__)NNr4 N) r* r+ r, r- r0 r2 r; r r. r r )r r r3 s
r3 ) r- Z
__future__r r" ImportErrorwarnings
exceptionsr warnZsocketr r' r r% Z
connectionr r Zconnectionpoolr r
r r Z poolmanagerr
Zutil.urlr Zsslr r/ r0 r2 r3 r r r r s2
FPK ! I * __pycache__/appengine.cpython-36.opt-1.pycnu [ 3
nf\* @ s d Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZ ddlmZ ddlmZ dd lmZ dd
lmZ d d lmZ ydd
lmZ W n ek
r dZY nX ej e Z G dd de
Z G dd de Z G dd deZ!ej"Z"ej#Z#ej$Z$ej%Z%ej&Z&dS )aC
This module provides a pool manager that uses Google App Engine's
`URLFetch Service `_.
Example usage::
from urllib3 import PoolManager
from urllib3.contrib.appengine import AppEngineManager, is_appengine_sandbox
if is_appengine_sandbox():
# AppEngineManager uses AppEngine's URLFetch API behind the scenes
http = AppEngineManager()
else:
# PoolManager uses a socket-level API behind the scenes
http = PoolManager()
r = http.request('GET', 'https://google.com/')
There are `limitations `_ to the URLFetch service and it may not be
the best choice for your application. There are three options for using
urllib3 on Google App Engine:
1. You can use :class:`AppEngineManager` with URLFetch. URLFetch is
cost-effective in many circumstances as long as your usage is within the
limitations.
2. You can use a normal :class:`~urllib3.PoolManager` by enabling sockets.
Sockets also have `limitations and restrictions
`_ and have a lower free quota than URLFetch.
To use sockets, be sure to specify the following in your ``app.yaml``::
env_variables:
GAE_USE_SOCKETS_HTTPLIB : 'true'
3. If you are using `App Engine Flexible
`_, you can use the standard
:class:`PoolManager` without any configuration or special environment variables.
)absolute_importN )urljoin) HTTPError HTTPWarning
MaxRetryError
ProtocolError TimeoutErrorSSLError)RequestMethods) HTTPResponse)Timeout)Retry )_appengine_environ)urlfetchc @ s e Zd ZdS )AppEnginePlatformWarningN)__name__
__module__ __qualname__ r r /usr/lib/python3.6/appengine.pyr G s r c @ s e Zd ZdS )AppEnginePlatformErrorN)r r r r r r r r K s r c @ sX e Zd ZdZdddZdd Zdd Zddddejfd
d Z d d
Z
dd Z dd Z dS )AppEngineManagera
Connection manager for Google App Engine sandbox applications.
This manager uses the URLFetch service directly instead of using the
emulated httplib, and is subject to URLFetch limitations as described in
the App Engine documentation `here
`_.
Notably it will raise an :class:`AppEnginePlatformError` if:
* URLFetch is not available.
* If you attempt to use this on App Engine Flexible, as full socket
support is available.
* If a request size is more than 10 megabytes.
* If a response size is more than 32 megabtyes.
* If you use an unsupported request method such as OPTIONS.
Beyond those cases, it will raise normal urllib3 errors.
NTc C sN t s tdt rtdtjdt tj| | || _|| _ |pFt
j | _ d S )Nz.URLFetch is not available in this environment.zUse normal urllib3.PoolManager instead of AppEngineManageron Managed VMs, as using URLFetch is not necessary in this environment.zurllib3 is using URLFetch on Google App Engine sandbox instead of sockets. To use sockets directly instead of URLFetch see https://urllib3.readthedocs.io/en/latest/reference/urllib3.contrib.html.)
r r is_prod_appengine_mvmswarningswarnr r __init__validate_certificateurlfetch_retriesr ZDEFAULTretries)selfheadersr r r r r r r c s zAppEngineManager.__init__c C s | S )Nr )r! r r r __enter__{ s zAppEngineManager.__enter__c C s dS )NFr )r! exc_typeZexc_valZexc_tbr r r __exit__~ s zAppEngineManager.__exit__c K s | j ||}yF|o |jdko |j} tj||||p2i d| jo<| | j|| jd}
W nB tjk
r } zt | | W Y d d } ~ X n tj
k
r } z$dt | krt d| t
| W Y d d } ~ X n tjk
r } z(dt | krt| || dt
| W Y d d } ~ X n tjk
r6 } zt d| W Y d d } ~ X n` tjk
rb } zt| W Y d d } ~ X n4 tjk
r } zt d | | W Y d d } ~ X nX | j|
fd
|i|} |o| j }
|
rr| jr|jrt| |d n| jd krd
}y|j||| | d}W n* tk
r. |jr*t| |d | S X |j| tjd||
t ||
}| j ||||f|||d|S t | j d}|j || j|r|j||| | d}tjd| |j!| | j ||f|||||d|S | S )Nr F)Zpayloadmethodr" Zallow_truncatedfollow_redirectsZdeadliner z too largezOURLFetch request too large, URLFetch only supports requests up to 10mb in size.zToo many redirects)reasonzPURLFetch response too large, URLFetch only supportsresponses up to 32mb in size.z$URLFetch does not support method: %sr ztoo many redirectsi/ ZGET)responseZ_poolzRedirecting %s -> %s)r redirecttimeoutz Retry-Afterz Retry: %s)bodyr" r r* r+ )" _get_retriesr* totalr Zfetchr _get_absolute_timeoutr ZDeadlineExceededErrorr ZInvalidURLErrorstrr r Z
DownloadErrorr ZResponseTooLargeErrorZSSLCertificateErrorr
ZInvalidMethodError#_urlfetch_response_to_http_responseZget_redirect_locationZraise_on_redirectstatusZ incrementZsleep_for_retrylogdebugr urlopenboolZ getheaderZis_retryZsleep)r! r& Zurlr, r" r r* r+ response_kwr' r) eZ
http_responseZredirect_locationZ redirect_urlZhas_retry_afterr r r r5 s
zAppEngineManager.urlopenc K s t r"|jjd}|dkr"|jd= |jjd}|dkrZ|jd}|jd dj||jd< tf tj|j |j
|j|j d|}tf tj|j |j|j |d|S )Nzcontent-encodingZdeflateztransfer-encodingZchunked,)r, msgr" r2 )r, r" r2 original_response) is_prod_appenginer" getsplitremovejoinr ioBytesIOZcontentZ
header_msgZ status_code)r! Z
urlfetch_respr7 Zcontent_encodingZtransfer_encodingZ encodingsr; r r r r1 s*
z4AppEngineManager._urlfetch_response_to_http_responsec C sB |t jkrd S t|t r>|jd k s,|jd k r8tjdt |jS |S )NzdURLFetch does not support granular timeout settings, reverting to total or default URLFetch timeout.) r
DEFAULT_TIMEOUT
isinstanceZ_readZ_connectr r r r. )r! r+ r r r r/ s
z&AppEngineManager._get_absolute_timeoutc C s> t |ts tj||| jd}|js.|js.|jr:tjdt |S )N)r* defaultzhURLFetch only supports total retries and does not recognize connect, read, or redirect retry parameters.)
rD r Zfrom_intr Zconnectreadr* r r r )r! r r* r r r r-
s
z AppEngineManager._get_retries)NNTT)
r r r __doc__r r# r% r
rC r5 r1 r/ r- r r r r r O s
Z$ r )'rG Z
__future__r rA Zloggingr Z packages.six.moves.urllib.parser
exceptionsr r r r r r
Zrequestr r) r Z util.timeoutr
Z
util.retryr r Zgoogle.appengine.apir ImportErrorZ getLoggerr r3 r r r Z is_appengineZis_appengine_sandboxZis_local_appenginer< r r r r r ' s2
OPK ! aX & __pycache__/socks.cpython-36.opt-1.pycnu [ 3
nf\ @ s( d Z ddlmZ y ddlZW n6 ek
rR ddlZddlmZ ejde Y nX ddl m
Z m Z
ddlmZmZ dd lmZmZ dd
lmZmZ dd lmZ dd lmZ y ddlZW n ek
r dZY nX G d
d deZG dd deeZ G dd deZ G dd deZ G dd deZ dS )a
This module contains provisional support for SOCKS proxies from within
urllib3. This module supports SOCKS4 (specifically the SOCKS4A variant) and
SOCKS5. To enable its functionality, either install PySocks or install this
module with the ``socks`` extra.
The SOCKS implementation supports the full range of urllib3 features. It also
supports the following SOCKS features:
- SOCKS4
- SOCKS4a
- SOCKS5
- Usernames and passwords for the SOCKS proxy
Known Limitations:
- Currently PySocks does not support contacting remote websites via literal
IPv6 addresses. Any such connection attempt will fail. You must use a domain
name.
- Currently PySocks does not support IPv6 connections to the SOCKS proxy. Any
such connection attempt will fail.
)absolute_importN )DependencyWarningzSOCKS support in urllib3 requires the installation of optional dependencies: specifically, PySocks. For more information, see https://urllib3.readthedocs.io/en/latest/contrib.html#socks-proxies)errortimeout)HTTPConnectionHTTPSConnection)HTTPConnectionPoolHTTPSConnectionPool)ConnectTimeoutErrorNewConnectionError) PoolManager) parse_urlc s( e Zd ZdZ fddZdd Z ZS )SOCKSConnectionzG
A plain-text HTTP connection that connects via a SOCKS proxy.
c s" |j d| _tt| j|| d S )N_socks_options)popr superr __init__)selfargskwargs) __class__ /usr/lib/python3.6/socks.pyr ? s zSOCKSConnection.__init__c C sX i }| j r| j |d< | jr$| j|d< yTtj| j| jff| jd | jd | jd | jd | jd | jd | jd |}W n tk
r } z t | d
| j| jf W Y d d }~X n tj
k
r" } zT|j r|j }t |trt | d
| j| jf nt
| d | nt
| d | W Y d d }~X n2 tk
rR } zt
| d | W Y d d }~X nX |S )
zA
Establish a new connection via the SOCKS proxy.
source_addresssocket_options
socks_version
proxy_host
proxy_portusernamepasswordrdns)Z
proxy_typeZ
proxy_addrr Zproxy_usernameZproxy_passwordZ
proxy_rdnsr z0Connection to %s timed out. (connect timeout=%s)Nz(Failed to establish a new connection: %s)r r socksZcreate_connectionhostportr r
SocketTimeoutr Z
ProxyErrorZ
socket_err
isinstancer SocketError)r Zextra_kwZconner r r r _new_connC sL
zSOCKSConnection._new_conn)__name__
__module__ __qualname____doc__r r)
__classcell__r r )r r r ; s r c @ s e Zd ZdS )SOCKSHTTPSConnectionN)r* r+ r, r r r r r/ s r/ c @ s e Zd ZeZdS )SOCKSHTTPConnectionPoolN)r* r+ r, r
ConnectionClsr r r r r0 s r0 c @ s e Zd ZeZdS )SOCKSHTTPSConnectionPoolN)r* r+ r, r/ r1 r r r r r2 s r2 c s, e Zd ZdZeedZd fdd Z ZS )SOCKSProxyManagerzh
A version of the urllib3 ProxyManager that routes connections via the
defined SOCKS proxy.
)ZhttpZhttpsN
c s t |}|d krB|d krB|jd k rB|jjd}t|dkrB|\}}|jdkrXtj} d}
nN|jdkrntj} d}
n8|jdkrtj} d}
n"|jdkrtj} d}
n td | || _ | |j
|j |||
d
} | |d < t t
| j||f| t
j| _d S ) N:r Zsocks5FZsocks5hTZsocks4Zsocks4az)Unable to determine SOCKS version from %s)r r r r r r! r )r Zauthsplitlenschemer" ZPROXY_TYPE_SOCKS5ZPROXY_TYPE_SOCKS4
ValueError proxy_urlr# r$ r r3 r pool_classes_by_scheme) r r: r r Z num_poolsZheadersZconnection_pool_kwZparsedr6 r r! Z
socks_options)r r r r s<
zSOCKSProxyManager.__init__)NNr4 N) r* r+ r, r- r0 r2 r; r r. r r )r r r3 s
r3 ) r- Z
__future__r r" ImportErrorwarnings
exceptionsr warnZsocketr r' r r% Z
connectionr r Zconnectionpoolr r
r r Z poolmanagerr
Zutil.urlr Zsslr r/ r0 r2 r3 r r r r s2
FPK ! /ug8 g8 * __pycache__/pyopenssl.cpython-36.opt-1.pycnu [ 3
nf\= @ sd d Z ddlmZ ddlZddlmZ ddlmZ ddl
m Z yddl m
Z
W n$ ek
rp G dd d eZ
Y nX dd
lmZmZ dd lmZ ydd lmZ W n$ ek
r dZd
dlmZ Y nX ddlZddlZd
dlm Z ddl Z d
dl m Z ddgZ dZ!ej"ej#j$ej%ej#j&iZ'e(edr@e(ej#dr@ej#j)e'ej*< e(edrhe(ej#drhej#j+e'ej,< ye'j-ej.ej#j/i W n e0k
r Y nX ej1ej#j2ej3ej#j4ej5ej#j4ej#j6 iZ7e8dd e7j9 D Z:dZ;e j!ZZ?ej@eAZBdd ZCd d ZDd d ZEd d ZFd!d" ZGG d#d$ d$eHZIer>d-d&d'ZJneZJeJeI_JG d(d) d)eHZKd*d+ ZLdS ).ab
SSL with SNI_-support for Python 2. Follow these instructions if you would
like to verify SSL certificates in Python 2. Note, the default libraries do
*not* do certificate checking; you need to do additional work to validate
certificates yourself.
This needs the following packages installed:
* pyOpenSSL (tested with 16.0.0)
* cryptography (minimum 1.3.4, from pyopenssl)
* idna (minimum 2.0, from cryptography)
However, pyopenssl depends on cryptography, which depends on idna, so while we
use all three directly here we end up having relatively few packages required.
You can install them with the following command:
pip install pyopenssl cryptography idna
To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this::
try:
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
except ImportError:
pass
Now you can use :mod:`urllib3` as you normally would, and it will support SNI
when the required modules are installed.
Activating this module also has the positive side effect of disabling SSL/TLS
compression in Python 2 (see `CRIME attack`_).
If you want to configure the default list of supported cipher suites, you can
set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.
.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)
)absolute_importN)x509)backend) _Certificate)UnsupportedExtensionc @ s e Zd ZdS )r N)__name__
__module__ __qualname__ r
r
/usr/lib/python3.6/pyopenssl.pyr 6 s r )timeouterror)BytesIO) _fileobject )backport_makefile)six)utilinject_into_urllib3extract_from_urllib3TPROTOCOL_TLSv1_1TLSv1_1_METHODPROTOCOL_TLSv1_2TLSv1_2_METHODc c s | ]\}}||fV qd S )Nr
).0kvr
r
r f s r i @ c C s. t ttj_tt_ttj_dt_dtj_dS )z7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.TN)_validate_dependencies_metPyOpenSSLContextr ssl_
SSLContextHAS_SNI IS_PYOPENSSLr
r
r
r r s s c C s( t tj_tt_ttj_dt_dtj_dS )z4Undo monkey-patching by :func:`inject_into_urllib3`.FN)orig_util_SSLContextr r r! orig_util_HAS_SNIr" r# r
r
r
r r s
c C sR ddl m} t| dddkr$tdddlm} | }t|dddkrNtddS ) z{
Verifies that PyOpenSSL's package-level dependencies have been met.
Throws `ImportError` if they are not met.
r )
Extensionsget_extension_for_classNzX'cryptography' module missing required functionality. Try upgrading to v1.3.4 or newer.)X509_x509zS'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.)Z cryptography.x509.extensionsr& getattr ImportErrorZOpenSSL.cryptor( )r& r( r r
r
r r s r c C s@ dd }d| kr| S || } | dkr(dS t jdkr<| jd} | S ) a%
Converts a dNSName SubjectAlternativeName field to the form used by the
standard library on the given Python version.
Cryptography produces a dNSName as a unicode string that was idna-decoded
from ASCII bytes. We need to idna-encode that string to get it back, and
then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
If the name cannot be idna-encoded then we return None signalling that
the name given should be skipped.
c S sl ddl }yFx:dD ]2}| j|r| t|d } |jd|j| S qW |j| S |jjk
rf dS X dS )z
Borrowed wholesale from the Python Cryptography Project. It turns out
that we can't just safely call `idna.encode`: it can explode for
wildcard names. This avoids that problem.
r N*..ascii)r, r- )idna
startswithlenencodeZcoreZ IDNAError)namer/ prefixr
r
r idna_encode s
z'_dnsname_to_stdlib..idna_encode:N r zutf-8)r7 r )sys version_infodecode)r3 r5 r
r
r _dnsname_to_stdlib s
r; c C s t | dr| j }n tt| j}y|jjtjj }W nL tj
k
rJ g S tj t tj
tfk
r } ztjd| g S d}~X nX dd tt|jtjD }|jdd |jtjD |S )zU
Given an PyOpenSSL certificate, provides all the subject alternative names.
to_cryptographyzA problem was encountered with the certificate that prevented urllib3 from finding the SubjectAlternativeName field. This can affect certificate validation. The error was %sNc S s g | ]}|d k rd|fqS )NZDNSr
)r r3 r
r
r
s z%get_subj_alt_name..c s s | ]}d t |fV qdS )z
IP AddressN)str)r r3 r
r
r r s z$get_subj_alt_name..)hasattrr< r openssl_backendr)
extensionsr' r ZSubjectAlternativeNamevalueZExtensionNotFoundZDuplicateExtensionr ZUnsupportedGeneralNameType UnicodeErrorlogZwarningmapr; Zget_values_for_typeZDNSNameextendZ IPAddress)Z peer_certZcertZextenamesr
r
r get_subj_alt_name s&
rI c @ s| e Zd ZdZd ddZdd Zdd Zd d
Zd d Zd
d Z dd Z
dd Z dd Z dd Z
d ddZdd Zd d Zd S )!
WrappedSocketzAPI-compatibility wrapper for Python OpenSSL's Connection-class.
Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
collector of pypy.
Tc C s" || _ || _|| _d| _d| _d S )Nr F)
connectionsocketsuppress_ragged_eofs_makefile_refs_closed)selfrK rL rM r
r
r __init__ s
zWrappedSocket.__init__c C s
| j j S )N)rL fileno)rP r
r
r rR s zWrappedSocket.filenoc C s* | j dkr| j d8 _ | jr&| j d S )Nr )rN rO close)rP r
r
r _decref_socketios s
z WrappedSocket._decref_socketiosc O s y| j j||}W n tjjk
rX } z&| jr<|jdkr ZeroReturnError get_shutdownRECEIVED_SHUTDOWN
WantReadErrorr
wait_for_readrL
gettimeoutr )rP r] kwargsdatarG r
r
r rY s
zWrappedSocket.recvc O s y| j j||S tjjk
rT } z&| jr8|jdkr8dS tt|W Y d d }~X n~ tjj k
r } z | j j
tjj kr~dS W Y d d }~X nB tjj k
r t
j| j| jj stdn | j||S Y nX d S )NrS Unexpected EOFr z The read operation timed outrX )rX rg )rK recv_intorZ r[ r\ rM r] r^ r> r_ r` ra rb r rc rL rd r )rP r] re rG r
r
r rh ' s
zWrappedSocket.recv_intoc C s | j j|S )N)rL
settimeout)rP r r
r
r ri : s zWrappedSocket.settimeoutc C s| xvy | j j|S tjjk
rB tj| j| jj s )rP rf rG r
r
r _send_until_done= s z WrappedSocket._send_until_donec C s8 d}x.|t |k r2| j|||t }||7 }qW d S )Nr )r1 rk SSL_WRITE_BLOCKSIZE)rP rf Z
total_sentZsentr
r
r sendallH s zWrappedSocket.sendallc C s | j j d S )N)rK shutdown)rP r
r
r rn N s zWrappedSocket.shutdownc C sH | j dk r6yd| _| jj S tjjk
r2 d S X n| j d8 _ d S )NrS T)rN rO rK rT rZ r[ Error)rP r
r
r rT R s
zWrappedSocket.closeFc C sD | j j }|s|S |r(tjjtjj|S d|j jffft|dS )NZ
commonName)ZsubjectZsubjectAltName) rK Zget_peer_certificaterZ ZcryptoZdump_certificateZ
FILETYPE_ASN1Z get_subjectZCNrI )rP Z binary_formr r
r
r getpeercert\ s
zWrappedSocket.getpeercertc C s | j d7 _ d S )NrS )rN )rP r
r
r _reusen s zWrappedSocket._reusec C s& | j dk r| j n| j d8 _ d S )NrS )rN rT )rP r
r
r _dropq s
zWrappedSocket._dropN)T)F)r r r __doc__rQ rR rU rY rh ri rk rm rn rT rp rq rr r
r
r
r rJ s
rJ rS c C s | j d7 _ t| ||ddS )NrS T)rT )rN r )rP modebufsizer
r
r makefiley s rv c @ sz e Zd ZdZdd Zedd Zejdd Zedd Zejd d Zd
d Z d d
Z
dddZ dddZ dddZ
dS )r z
I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
for translating the interface of the standard library ``SSLContext`` object
to calls into PyOpenSSL.
c C s* t | | _tjj| j| _d| _d| _d S )Nr F)_openssl_versionsprotocolrZ r[ ZContext_ctx_optionsZcheck_hostname)rP rx r
r
r rQ s
zPyOpenSSLContext.__init__c C s | j S )N)rz )rP r
r
r options s zPyOpenSSLContext.optionsc C s || _ | jj| d S )N)rz ry Z set_options)rP rB r
r
r r{ s c C s t | jj S )N)_openssl_to_stdlib_verifyry Zget_verify_mode)rP r
r
r verify_mode s z PyOpenSSLContext.verify_modec C s | j jt| t d S )N)ry Z
set_verify_stdlib_to_openssl_verify_verify_callback)rP rB r
r
r r} s c C s | j j d S )N)ry set_default_verify_paths)rP r
r
r r s z)PyOpenSSLContext.set_default_verify_pathsc C s& t |tjr|jd}| jj| d S )Nzutf-8)
isinstancer text_typer2 ry Zset_cipher_list)rP Zciphersr
r
r set_ciphers s
z PyOpenSSLContext.set_ciphersNc C sN |d k r|j d}|d k r$|j d}| jj|| |d k rJ| jjt| d S )Nzutf-8)r2 ry load_verify_locationsr )rP ZcafileZcapathZcadatar
r
r r s
z&PyOpenSSLContext.load_verify_locationsc s< | j j| d k r(| j j fdd | j j|p4| d S )Nc s S )Nr
)Z
max_lengthZ prompt_twiceZuserdata)passwordr
r s z2PyOpenSSLContext.load_cert_chain..)ry Zuse_certificate_chain_fileZ
set_passwd_cbZuse_privatekey_file)rP ZcertfileZkeyfiler r
)r r load_cert_chain s z PyOpenSSLContext.load_cert_chainFTc C s t jj| j|}t|tjr&|jd}|d k r8|j| |j xxy |j
W nd t jj k
r t j
||j sztdwBY n4 t jjk
r } ztjd| W Y d d }~X nX P qBW t||S )Nzutf-8zselect timed outzbad handshake: %r)rZ r[ Z
Connectionry r r r r2 Zset_tlsext_host_nameZset_connect_stateZ do_handshakerb r rc rd r ro sslZSSLErrorrJ )rP ZsockZ server_sideZdo_handshake_on_connectrM Zserver_hostnamecnxrG r
r
r wrap_socket s"
z PyOpenSSLContext.wrap_socket)NNN)NN)FTTN)r r r rs rQ propertyr{ setterr} r r r r r r
r
r
r r s
r c C s |dkS )Nr r
)r r Zerr_noZ err_depthZ return_coder
r
r r s r rX )rX )Mrs Z
__future__r Z OpenSSL.SSLrZ Z cryptographyr Z$cryptography.hazmat.backends.opensslr r@ Z)cryptography.hazmat.backends.openssl.x509r Zcryptography.x509r r+ ExceptionrL r r
r^ ior r Zpackages.backports.makefiler Zloggingr Zpackagesr r8 r __all__r" ZPROTOCOL_SSLv23r[ Z
SSLv23_METHODZPROTOCOL_TLSv1Z TLSv1_METHODrw r? r r r r updateZPROTOCOL_SSLv3Z SSLv3_METHODAttributeErrorZ CERT_NONEZ VERIFY_NONEZ
CERT_OPTIONALZ VERIFY_PEERZ
CERT_REQUIREDZVERIFY_FAIL_IF_NO_PEER_CERTr~ dictitemsr| rl r% r r! r$ Z getLoggerr rD r r r r; rI objectrJ rv r r r
r
r
r + sn
)4~ RPK ! /ug8 g8 $ __pycache__/pyopenssl.cpython-36.pycnu [ 3
nf\= @ sd d Z ddlmZ ddlZddlmZ ddlmZ ddl
m Z yddl m
Z
W n$ ek
rp G dd d eZ
Y nX dd
lmZmZ dd lmZ ydd lmZ W n$ ek
r dZd
dlmZ Y nX ddlZddlZd
dlm Z ddl Z d
dl m Z ddgZ dZ!ej"ej#j$ej%ej#j&iZ'e(edr@e(ej#dr@ej#j)e'ej*< e(edrhe(ej#drhej#j+e'ej,< ye'j-ej.ej#j/i W n e0k
r Y nX ej1ej#j2ej3ej#j4ej5ej#j4ej#j6 iZ7e8dd e7j9 D Z:dZ;e j!ZZ?ej@eAZBdd ZCd d ZDd d ZEd d ZFd!d" ZGG d#d$ d$eHZIer>d-d&d'ZJneZJeJeI_JG d(d) d)eHZKd*d+ ZLdS ).ab
SSL with SNI_-support for Python 2. Follow these instructions if you would
like to verify SSL certificates in Python 2. Note, the default libraries do
*not* do certificate checking; you need to do additional work to validate
certificates yourself.
This needs the following packages installed:
* pyOpenSSL (tested with 16.0.0)
* cryptography (minimum 1.3.4, from pyopenssl)
* idna (minimum 2.0, from cryptography)
However, pyopenssl depends on cryptography, which depends on idna, so while we
use all three directly here we end up having relatively few packages required.
You can install them with the following command:
pip install pyopenssl cryptography idna
To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this::
try:
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
except ImportError:
pass
Now you can use :mod:`urllib3` as you normally would, and it will support SNI
when the required modules are installed.
Activating this module also has the positive side effect of disabling SSL/TLS
compression in Python 2 (see `CRIME attack`_).
If you want to configure the default list of supported cipher suites, you can
set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.
.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)
)absolute_importN)x509)backend) _Certificate)UnsupportedExtensionc @ s e Zd ZdS )r N)__name__
__module__ __qualname__ r
r
/usr/lib/python3.6/pyopenssl.pyr 6 s r )timeouterror)BytesIO) _fileobject )backport_makefile)six)utilinject_into_urllib3extract_from_urllib3TPROTOCOL_TLSv1_1TLSv1_1_METHODPROTOCOL_TLSv1_2TLSv1_2_METHODc c s | ]\}}||fV qd S )Nr
).0kvr
r
r f s r i @ c C s. t ttj_tt_ttj_dt_dtj_dS )z7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.TN)_validate_dependencies_metPyOpenSSLContextr ssl_
SSLContextHAS_SNI IS_PYOPENSSLr
r
r
r r s s c C s( t tj_tt_ttj_dt_dtj_dS )z4Undo monkey-patching by :func:`inject_into_urllib3`.FN)orig_util_SSLContextr r r! orig_util_HAS_SNIr" r# r
r
r
r r s
c C sR ddl m} t| dddkr$tdddlm} | }t|dddkrNtddS ) z{
Verifies that PyOpenSSL's package-level dependencies have been met.
Throws `ImportError` if they are not met.
r )
Extensionsget_extension_for_classNzX'cryptography' module missing required functionality. Try upgrading to v1.3.4 or newer.)X509_x509zS'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.)Z cryptography.x509.extensionsr& getattr ImportErrorZOpenSSL.cryptor( )r& r( r r
r
r r s r c C s@ dd }d| kr| S || } | dkr(dS t jdkr<| jd} | S ) a%
Converts a dNSName SubjectAlternativeName field to the form used by the
standard library on the given Python version.
Cryptography produces a dNSName as a unicode string that was idna-decoded
from ASCII bytes. We need to idna-encode that string to get it back, and
then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
If the name cannot be idna-encoded then we return None signalling that
the name given should be skipped.
c S sl ddl }yFx:dD ]2}| j|r| t|d } |jd|j| S qW |j| S |jjk
rf dS X dS )z
Borrowed wholesale from the Python Cryptography Project. It turns out
that we can't just safely call `idna.encode`: it can explode for
wildcard names. This avoids that problem.
r N*..ascii)r, r- )idna
startswithlenencodeZcoreZ IDNAError)namer/ prefixr
r
r idna_encode s
z'_dnsname_to_stdlib..idna_encode:N r zutf-8)r7 r )sys version_infodecode)r3 r5 r
r
r _dnsname_to_stdlib s
r; c C s t | dr| j }n tt| j}y|jjtjj }W nL tj
k
rJ g S tj t tj
tfk
r } ztjd| g S d}~X nX dd tt|jtjD }|jdd |jtjD |S )zU
Given an PyOpenSSL certificate, provides all the subject alternative names.
to_cryptographyzA problem was encountered with the certificate that prevented urllib3 from finding the SubjectAlternativeName field. This can affect certificate validation. The error was %sNc S s g | ]}|d k rd|fqS )NZDNSr
)r r3 r
r
r
s z%get_subj_alt_name..c s s | ]}d t |fV qdS )z
IP AddressN)str)r r3 r
r
r r s z$get_subj_alt_name..)hasattrr< r openssl_backendr)
extensionsr' r ZSubjectAlternativeNamevalueZExtensionNotFoundZDuplicateExtensionr ZUnsupportedGeneralNameType UnicodeErrorlogZwarningmapr; Zget_values_for_typeZDNSNameextendZ IPAddress)Z peer_certZcertZextenamesr
r
r get_subj_alt_name s&
rI c @ s| e Zd ZdZd ddZdd Zdd Zd d
Zd d Zd
d Z dd Z
dd Z dd Z dd Z
d ddZdd Zd d Zd S )!
WrappedSocketzAPI-compatibility wrapper for Python OpenSSL's Connection-class.
Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
collector of pypy.
Tc C s" || _ || _|| _d| _d| _d S )Nr F)
connectionsocketsuppress_ragged_eofs_makefile_refs_closed)selfrK rL rM r
r
r __init__ s
zWrappedSocket.__init__c C s
| j j S )N)rL fileno)rP r
r
r rR s zWrappedSocket.filenoc C s* | j dkr| j d8 _ | jr&| j d S )Nr )rN rO close)rP r
r
r _decref_socketios s
z WrappedSocket._decref_socketiosc O s y| j j||}W n tjjk
rX } z&| jr<|jdkr ZeroReturnError get_shutdownRECEIVED_SHUTDOWN
WantReadErrorr
wait_for_readrL
gettimeoutr )rP r] kwargsdatarG r
r
r rY s
zWrappedSocket.recvc O s y| j j||S tjjk
rT } z&| jr8|jdkr8dS tt|W Y d d }~X n~ tjj k
r } z | j j
tjj kr~dS W Y d d }~X nB tjj k
r t
j| j| jj stdn | j||S Y nX d S )NrS Unexpected EOFr z The read operation timed outrX )rX rg )rK recv_intorZ r[ r\ rM r] r^ r> r_ r` ra rb r rc rL rd r )rP r] re rG r
r
r rh ' s
zWrappedSocket.recv_intoc C s | j j|S )N)rL
settimeout)rP r r
r
r ri : s zWrappedSocket.settimeoutc C s| xvy | j j|S tjjk
rB tj| j| jj s )rP rf rG r
r
r _send_until_done= s z WrappedSocket._send_until_donec C s8 d}x.|t |k r2| j|||t }||7 }qW d S )Nr )r1 rk SSL_WRITE_BLOCKSIZE)rP rf Z
total_sentZsentr
r
r sendallH s zWrappedSocket.sendallc C s | j j d S )N)rK shutdown)rP r
r
r rn N s zWrappedSocket.shutdownc C sH | j dk r6yd| _| jj S tjjk
r2 d S X n| j d8 _ d S )NrS T)rN rO rK rT rZ r[ Error)rP r
r
r rT R s
zWrappedSocket.closeFc C sD | j j }|s|S |r(tjjtjj|S d|j jffft|dS )NZ
commonName)ZsubjectZsubjectAltName) rK Zget_peer_certificaterZ ZcryptoZdump_certificateZ
FILETYPE_ASN1Z get_subjectZCNrI )rP Z binary_formr r
r
r getpeercert\ s
zWrappedSocket.getpeercertc C s | j d7 _ d S )NrS )rN )rP r
r
r _reusen s zWrappedSocket._reusec C s& | j dk r| j n| j d8 _ d S )NrS )rN rT )rP r
r
r _dropq s
zWrappedSocket._dropN)T)F)r r r __doc__rQ rR rU rY rh ri rk rm rn rT rp rq rr r
r
r
r rJ s
rJ rS c C s | j d7 _ t| ||ddS )NrS T)rT )rN r )rP modebufsizer
r
r makefiley s rv c @ sz e Zd ZdZdd Zedd Zejdd Zedd Zejd d Zd
d Z d d
Z
dddZ dddZ dddZ
dS )r z
I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
for translating the interface of the standard library ``SSLContext`` object
to calls into PyOpenSSL.
c C s* t | | _tjj| j| _d| _d| _d S )Nr F)_openssl_versionsprotocolrZ r[ ZContext_ctx_optionsZcheck_hostname)rP rx r
r
r rQ s
zPyOpenSSLContext.__init__c C s | j S )N)rz )rP r
r
r options s zPyOpenSSLContext.optionsc C s || _ | jj| d S )N)rz ry Z set_options)rP rB r
r
r r{ s c C s t | jj S )N)_openssl_to_stdlib_verifyry Zget_verify_mode)rP r
r
r verify_mode s z PyOpenSSLContext.verify_modec C s | j jt| t d S )N)ry Z
set_verify_stdlib_to_openssl_verify_verify_callback)rP rB r
r
r r} s c C s | j j d S )N)ry set_default_verify_paths)rP r
r
r r s z)PyOpenSSLContext.set_default_verify_pathsc C s& t |tjr|jd}| jj| d S )Nzutf-8)
isinstancer text_typer2 ry Zset_cipher_list)rP Zciphersr
r
r set_ciphers s
z PyOpenSSLContext.set_ciphersNc C sN |d k r|j d}|d k r$|j d}| jj|| |d k rJ| jjt| d S )Nzutf-8)r2 ry load_verify_locationsr )rP ZcafileZcapathZcadatar
r
r r s
z&PyOpenSSLContext.load_verify_locationsc s< | j j| d k r(| j j fdd | j j|p4| d S )Nc s S )Nr
)Z
max_lengthZ prompt_twiceZuserdata)passwordr
r s z2PyOpenSSLContext.load_cert_chain..)ry Zuse_certificate_chain_fileZ
set_passwd_cbZuse_privatekey_file)rP ZcertfileZkeyfiler r
)r r load_cert_chain s z PyOpenSSLContext.load_cert_chainFTc C s t jj| j|}t|tjr&|jd}|d k r8|j| |j xxy |j
W nd t jj k
r t j
||j sztdwBY n4 t jjk
r } ztjd| W Y d d }~X nX P qBW t||S )Nzutf-8zselect timed outzbad handshake: %r)rZ r[ Z
Connectionry r r r r2 Zset_tlsext_host_nameZset_connect_stateZ do_handshakerb r rc rd r ro sslZSSLErrorrJ )rP ZsockZ server_sideZdo_handshake_on_connectrM Zserver_hostnamecnxrG r
r
r wrap_socket s"
z PyOpenSSLContext.wrap_socket)NNN)NN)FTTN)r r r rs rQ propertyr{ setterr} r r r r r r
r
r
r r s
r c C s |dkS )Nr r
)r r Zerr_noZ err_depthZ return_coder
r
r r s r rX )rX )Mrs Z
__future__r Z OpenSSL.SSLrZ Z cryptographyr Z$cryptography.hazmat.backends.opensslr r@ Z)cryptography.hazmat.backends.openssl.x509r Zcryptography.x509r r+ ExceptionrL r r
r^ ior r Zpackages.backports.makefiler Zloggingr Zpackagesr r8 r __all__r" ZPROTOCOL_SSLv23r[ Z
SSLv23_METHODZPROTOCOL_TLSv1Z TLSv1_METHODrw r? r r r r updateZPROTOCOL_SSLv3Z SSLv3_METHODAttributeErrorZ CERT_NONEZ VERIFY_NONEZ
CERT_OPTIONALZ VERIFY_PEERZ
CERT_REQUIREDZVERIFY_FAIL_IF_NO_PEER_CERTr~ dictitemsr| rl r% r r! r$ Z getLoggerr rD r r r r; rI objectrJ rv r r r
r
r
r + sn
)4~ RPK ! 6QE E * __pycache__/securetransport.cpython-36.pycnu [ 3
nf\ev ) @ s d Z ddlmZ ddlZddlZddlZddlZddlZddl Z ddl
Z
ddl Z ddl Z ddl
mZ ddlmZmZmZ ddlmZmZmZmZ ydd l mZ W n$ ek
r dZdd
lmZ Y nX d d gZ d
Z ej Z ej j Z!e j" Z#e j$ Z%dZ&ej'ej(ej)ej*ej+ej,ej-ej.ej/ej0ej1ej2ej3ej4ej5ej6ej7ej8ej9ej:ej;ejej?ej@ejAejBejCejDejEejFejGg!ZHe
jIejJejKfiZLeMe
drejNejNfeLe
jO< eMe
drejPejPfeLe
jQ< eMe
drejJejJfeLe
jR< eMe
drejSejSfeLe
jT< eMe
dr$ejKejKfeLe
jU< eMe
dr@eLe
jI eLe
jV< dd ZWdd ZXdd ZYdd ZZej[eYZ\ej]eZZ^G dd d e_Z`erd$d d Zan
d%d d Zaeae`_aG d!d" d"e_ZbdS )&aU
SecureTranport support for urllib3 via ctypes.
This makes platform-native TLS available to urllib3 users on macOS without the
use of a compiler. This is an important feature because the Python Package
Index is moving to become a TLSv1.2-or-higher server, and the default OpenSSL
that ships with macOS is not capable of doing TLSv1.2. The only way to resolve
this is to give macOS users an alternative solution to the problem, and that
solution is to use SecureTransport.
We use ctypes here because this solution must not require a compiler. That's
because pip is not allowed to require a compiler either.
This is not intended to be a seriously long-term solution to this problem.
The hope is that PEP 543 will eventually solve this issue for us, at which
point we can retire this contrib module. But in the short term, we need to
solve the impending tire fire that is Python on Mac without this kind of
contrib module. So...here we are.
To use this module, simply import and inject it::
import urllib3.contrib.securetransport
urllib3.contrib.securetransport.inject_into_urllib3()
Happy TLSing!
)absolute_importN )util )Security
SecurityConstCoreFoundation)_assert_no_error_cert_array_from_pem_temporary_keychain_load_client_cert_chain) _fileobject)backport_makefileinject_into_urllib3extract_from_urllib3Ti @ PROTOCOL_SSLv2PROTOCOL_SSLv3PROTOCOL_TLSv1PROTOCOL_TLSv1_1PROTOCOL_TLSv1_2 PROTOCOL_TLSc C s( t tj_tt_ttj_dt_dtj_dS )zG
Monkey-patch urllib3 with SecureTransport-backed SSL-support.
TN)SecureTransportContextr ssl_
SSLContextHAS_SNIIS_SECURETRANSPORT r r %/usr/lib/python3.6/securetransport.pyr s
c C s( t tj_tt_ttj_dt_dtj_dS )z>
Undo monkey-patching by :func:`inject_into_urllib3`.
FN)orig_util_SSLContextr r r orig_util_HAS_SNIr r r r r r r s
c
C sx d}y8t j| }|dkr tjS |j}|d }|j }d}d}y|xv||k r|dksZ|dkrttj||sttjt j
d|| } t j | j
|| }
|j|
| } || 7 }| sB|stjS P qBW W nh tjk
r" } zH| j }|dk o|t j
kr||d< |t jks
|t jkrtjS W Y dd} ~ X nX ||d< ||kr r r r sendallC s zWrappedSocket.sendallc C s$ | j tj| j W d Q R X d S )N)rL r ZSSLCloserA )rI r r r shutdownI s
zWrappedSocket.shutdownc C s | j dk rd| _| jr(tj| j d | _| jr@tj| j d | _| jrvtj| j tj| j t j
| j d | _| _ | j j
S | j d8 _ d S )Nr T)rB rC rA r r\ rF rD r ZSecKeychainDeleteshutilZrmtreerE r# rK )rI r r r rK M s
zWrappedSocket.closeFc
C s |s t dtj }d }d }ztj| jtj|}t| |sBd S tj|}|sTd S tj |d}|sht
tj |}|szt
t j
|}t j|} tj| |}W d |rt j| |rt j| X |S )Nz2SecureTransport only supports dumping binary certsr )
ValueErrorr rX rY rA r( rZ r ZSecTrustGetCertificateCountZ SecTrustGetCertificateAtIndexAssertionErrorZSecCertificateCopyDatar ZCFDataGetLengthZCFDataGetBytePtrr; r\ )
rI Z binary_formra ZcertdataZ der_bytesrP Z
cert_countZleafZ data_lengthr3 r r r getpeercert` s6
zWrappedSocket.getpeercertc C s | j d7 _ d S )Nr )rB )rI r r r _reuse s zWrappedSocket._reusec C s& | j dk r| j n| j d8 _ d S )Nr )rB rK )rI r r r _drop s
zWrappedSocket._drop)N)F)__name__
__module__ __qualname____doc__rJ
contextlibcontextmanagerrL rQ rb rk rl rm rn r* rH r$ r< rs rt rK rx ry rz r r r r r@ ! s&
>Z
(
>r@ c C s | j d7 _ t| ||ddS )Nr T)rK )rB r
)rI modebufsizer r r makefile s r rc O s d}t | ||f||S )Nr )r )rI r bufferingargskwargsr r r r s c @ s e Zd ZdZdd Zedd Zejdd Zedd Zejd d Zed
d Z e jd d Z d
d Z
dd Z dd Z d ddZ
d ddZd ddZdS ) r z
I am a wrapper class for the SecureTransport library, to translate the
interface of the standard library ``SSLContext`` object to calls into
SecureTransport.
c C s8 t | \| _| _d| _d| _d | _d | _d | _d | _d S )Nr F) _protocol_to_min_max _min_version _max_version_options_verify
_trust_bundle _client_cert _client_key_client_key_passphrase)rI Zprotocolr r r rJ s z SecureTransportContext.__init__c C s dS )z
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
Tr )rI r r r check_hostname s z%SecureTransportContext.check_hostnamec C s dS )z
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
Nr )rI r] r r r r s c C s | j S )N)r )rI r r r options s z SecureTransportContext.optionsc C s
|| _ d S )N)r )rI r] r r r r s c C s | j r tjS tjS )N)r r[
CERT_REQUIREDZ CERT_NONE)rI r r r verify_mode s z"SecureTransportContext.verify_modec C s |t jkrdnd| _d S )NTF)r[ r r )rI r] r r r r s c C s d S )Nr )rI r r r set_default_verify_paths s
z/SecureTransportContext.set_default_verify_pathsc C s | j S )N)r )rI r r r load_default_certs s z)SecureTransportContext.load_default_certsc C s |t jjkrtdd S )Nz5SecureTransport doesn't support custom cipher strings)r r ZDEFAULT_CIPHERSrv )rI rO r r r set_ciphers s z"SecureTransportContext.set_ciphersNc C s |d k rt d|p|| _d S )Nz1SecureTransport does not support cert directories)rv r )rI ZcafileZcapathZcadatar r r load_verify_locations s z,SecureTransportContext.load_verify_locationsc C s || _ || _|| _d S )N)r r Z_client_cert_passphrase)rI ZcertfileZkeyfileZpasswordr r r load_cert_chain s z&SecureTransportContext.load_cert_chainFTc C sL | s
t |st |st t|}|j|| j| j| j| j| j| j| j |S )N)
rw r@ rk r r r r r r r )rI ZsockZ server_sideZdo_handshake_on_connectZsuppress_ragged_eofsrj r5 r r r wrap_socket s
z"SecureTransportContext.wrap_socket)NNN)NN)FTTN)r{ r| r} r~ rJ propertyr setterr r r r r r r r r r r r r s
r )r )r N)cr~ Z
__future__r r r( r& Zos.pathrS ru r# r[ Z threadingweakref r Z_securetransport.bindingsr r r Z_securetransport.low_levelr r
r r r
ImportErrorZpackages.backports.makefiler __all__r r r r r WeakValueDictionaryr ZLockre rr ZTLS_AES_256_GCM_SHA384Z TLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384Z'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256Z#TLS_DHE_DSS_WITH_AES_256_GCM_SHA384Z#TLS_DHE_RSA_WITH_AES_256_GCM_SHA384Z#TLS_DHE_DSS_WITH_AES_128_GCM_SHA256Z#TLS_DHE_RSA_WITH_AES_128_GCM_SHA256Z'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384Z%TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384Z$TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_256_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_256_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_256_CBC_SHAZ TLS_DHE_DSS_WITH_AES_256_CBC_SHAZ'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256Z%TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256Z$TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAZ"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAZ#TLS_DHE_RSA_WITH_AES_128_CBC_SHA256Z#TLS_DHE_DSS_WITH_AES_128_CBC_SHA256Z TLS_DHE_RSA_WITH_AES_128_CBC_SHAZ TLS_DHE_DSS_WITH_AES_128_CBC_SHAZ TLS_RSA_WITH_AES_256_GCM_SHA384Z TLS_RSA_WITH_AES_128_GCM_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHA256Z TLS_RSA_WITH_AES_128_CBC_SHA256Z TLS_RSA_WITH_AES_256_CBC_SHAZ TLS_RSA_WITH_AES_128_CBC_SHArN ZPROTOCOL_SSLv23Z
kTLSProtocol1ZkTLSProtocol12r hasattrZ
kSSLProtocol2r Z
kSSLProtocol3r r ZkTLSProtocol11r r r r r r: r? Z SSLReadFuncrc Z SSLWriteFuncrd objectr@ r r r r r r s 76
PK ! s PK ! I $ __pycache__/appengine.cpython-36.pycnu [ 3
nf\* @ s d Z ddlmZ ddlZddlZddlZddlmZ ddlm Z m
Z
m Z m Z m
Z
mZ ddlmZ ddlmZ dd lmZ dd
lmZ d d lmZ ydd
lmZ W n ek
r dZY nX ej e Z G dd de
Z G dd de Z G dd deZ!ej"Z"ej#Z#ej$Z$ej%Z%ej&Z&dS )aC
This module provides a pool manager that uses Google App Engine's
`URLFetch Service `_.
Example usage::
from urllib3 import PoolManager
from urllib3.contrib.appengine import AppEngineManager, is_appengine_sandbox
if is_appengine_sandbox():
# AppEngineManager uses AppEngine's URLFetch API behind the scenes
http = AppEngineManager()
else:
# PoolManager uses a socket-level API behind the scenes
http = PoolManager()
r = http.request('GET', 'https://google.com/')
There are `limitations `_ to the URLFetch service and it may not be
the best choice for your application. There are three options for using
urllib3 on Google App Engine:
1. You can use :class:`AppEngineManager` with URLFetch. URLFetch is
cost-effective in many circumstances as long as your usage is within the
limitations.
2. You can use a normal :class:`~urllib3.PoolManager` by enabling sockets.
Sockets also have `limitations and restrictions
`_ and have a lower free quota than URLFetch.
To use sockets, be sure to specify the following in your ``app.yaml``::
env_variables:
GAE_USE_SOCKETS_HTTPLIB : 'true'
3. If you are using `App Engine Flexible
`_, you can use the standard
:class:`PoolManager` without any configuration or special environment variables.
)absolute_importN )urljoin) HTTPError HTTPWarning
MaxRetryError
ProtocolError TimeoutErrorSSLError)RequestMethods) HTTPResponse)Timeout)Retry )_appengine_environ)urlfetchc @ s e Zd ZdS )AppEnginePlatformWarningN)__name__
__module__ __qualname__ r r /usr/lib/python3.6/appengine.pyr G s r c @ s e Zd ZdS )AppEnginePlatformErrorN)r r r r r r r r K s r c @ sX e Zd ZdZdddZdd Zdd Zddddejfd
d Z d d
Z
dd Z dd Z dS )AppEngineManagera
Connection manager for Google App Engine sandbox applications.
This manager uses the URLFetch service directly instead of using the
emulated httplib, and is subject to URLFetch limitations as described in
the App Engine documentation `here
`_.
Notably it will raise an :class:`AppEnginePlatformError` if:
* URLFetch is not available.
* If you attempt to use this on App Engine Flexible, as full socket
support is available.
* If a request size is more than 10 megabytes.
* If a response size is more than 32 megabtyes.
* If you use an unsupported request method such as OPTIONS.
Beyond those cases, it will raise normal urllib3 errors.
NTc C sN t s tdt rtdtjdt tj| | || _|| _ |pFt
j | _ d S )Nz.URLFetch is not available in this environment.zUse normal urllib3.PoolManager instead of AppEngineManageron Managed VMs, as using URLFetch is not necessary in this environment.zurllib3 is using URLFetch on Google App Engine sandbox instead of sockets. To use sockets directly instead of URLFetch see https://urllib3.readthedocs.io/en/latest/reference/urllib3.contrib.html.)
r r is_prod_appengine_mvmswarningswarnr r __init__validate_certificateurlfetch_retriesr ZDEFAULTretries)selfheadersr r r r r r r c s zAppEngineManager.__init__c C s | S )Nr )r! r r r __enter__{ s zAppEngineManager.__enter__c C s dS )NFr )r! exc_typeZexc_valZexc_tbr r r __exit__~ s zAppEngineManager.__exit__c K s | j ||}yF|o |jdko |j} tj||||p2i d| jo<| | j|| jd}
W nB tjk
r } zt | | W Y d d } ~ X n tj
k
r } z$dt | krt d| t
| W Y d d } ~ X n tjk
r } z(dt | krt| || dt
| W Y d d } ~ X n tjk
r6 } zt d| W Y d d } ~ X n` tjk
rb } zt| W Y d d } ~ X n4 tjk
r } zt d | | W Y d d } ~ X nX | j|
fd
|i|} |o| j }
|
rr| jr|jrt| |d n| jd krd
}y|j||| | d}W n* tk
r. |jr*t| |d | S X |j| tjd||
t ||
}| j ||||f|||d|S t | j d}|j || j|r|j||| | d}tjd| |j!| | j ||f|||||d|S | S )Nr F)Zpayloadmethodr" Zallow_truncatedfollow_redirectsZdeadliner z too largezOURLFetch request too large, URLFetch only supports requests up to 10mb in size.zToo many redirects)reasonzPURLFetch response too large, URLFetch only supportsresponses up to 32mb in size.z$URLFetch does not support method: %sr ztoo many redirectsi/ ZGET)responseZ_poolzRedirecting %s -> %s)r redirecttimeoutz Retry-Afterz Retry: %s)bodyr" r r* r+ )" _get_retriesr* totalr Zfetchr _get_absolute_timeoutr ZDeadlineExceededErrorr ZInvalidURLErrorstrr r Z
DownloadErrorr ZResponseTooLargeErrorZSSLCertificateErrorr
ZInvalidMethodError#_urlfetch_response_to_http_responseZget_redirect_locationZraise_on_redirectstatusZ incrementZsleep_for_retrylogdebugr urlopenboolZ getheaderZis_retryZsleep)r! r& Zurlr, r" r r* r+ response_kwr' r) eZ
http_responseZredirect_locationZ redirect_urlZhas_retry_afterr r r r5 s
zAppEngineManager.urlopenc K s t r"|jjd}|dkr"|jd= |jjd}|dkrZ|jd}|jd dj||jd< tf tj|j |j
|j|j d|}tf tj|j |j|j |d|S )Nzcontent-encodingZdeflateztransfer-encodingZchunked,)r, msgr" r2 )r, r" r2 original_response) is_prod_appenginer" getsplitremovejoinr ioBytesIOZcontentZ
header_msgZ status_code)r! Z
urlfetch_respr7 Zcontent_encodingZtransfer_encodingZ encodingsr; r r r r1 s*
z4AppEngineManager._urlfetch_response_to_http_responsec C sB |t jkrd S t|t r>|jd k s,|jd k r8tjdt |jS |S )NzdURLFetch does not support granular timeout settings, reverting to total or default URLFetch timeout.) r
DEFAULT_TIMEOUT
isinstanceZ_readZ_connectr r r r. )r! r+ r r r r/ s
z&AppEngineManager._get_absolute_timeoutc C s> t |ts tj||| jd}|js.|js.|jr:tjdt |S )N)r* defaultzhURLFetch only supports total retries and does not recognize connect, read, or redirect retry parameters.)
rD r Zfrom_intr Zconnectreadr* r r r )r! r r* r r r r-
s
z AppEngineManager._get_retries)NNTT)
r r r __doc__r r# r% r
rC r5 r1 r/ r- r r r r r O s
Z$ r )'rG Z
__future__r rA Zloggingr Z packages.six.moves.urllib.parser
exceptionsr r r r r r
Zrequestr r) r Z util.timeoutr
Z
util.retryr r Zgoogle.appengine.apir ImportErrorZ getLoggerr r3 r r r Z is_appengineZis_appengine_sandboxZis_local_appenginer< r r r r r ' s2
OPK ! 5 @q q # __pycache__/__init__.cpython-36.pycnu [ 3
nf\ @ s d S )N r r r /usr/lib/python3.6/__init__.py s PK ! 5 @q q ) __pycache__/__init__.cpython-36.opt-1.pycnu [ 3
nf\ @ s d S )N r r r /usr/lib/python3.6/__init__.py s PK ! Jk k ntlmpool.pynu [ """
NTLM authenticating pool, contributed by erikcederstran
Issue #10, see: http://code.google.com/p/urllib3/issues/detail?id=10
"""
from __future__ import absolute_import
from logging import getLogger
from ntlm import ntlm
from .. import HTTPSConnectionPool
from ..packages.six.moves.http_client import HTTPSConnection
log = getLogger(__name__)
class NTLMConnectionPool(HTTPSConnectionPool):
"""
Implements an NTLM authentication version of an urllib3 connection pool
"""
scheme = 'https'
def __init__(self, user, pw, authurl, *args, **kwargs):
"""
authurl is a random URL on the server that is protected by NTLM.
user is the Windows user, probably in the DOMAIN\\username format.
pw is the password for the user.
"""
super(NTLMConnectionPool, self).__init__(*args, **kwargs)
self.authurl = authurl
self.rawuser = user
user_parts = user.split('\\', 1)
self.domain = user_parts[0].upper()
self.user = user_parts[1]
self.pw = pw
def _new_conn(self):
# Performs the NTLM handshake that secures the connection. The socket
# must be kept open while requests are performed.
self.num_connections += 1
log.debug('Starting NTLM HTTPS connection no. %d: https://%s%s',
self.num_connections, self.host, self.authurl)
headers = {'Connection': 'Keep-Alive'}
req_header = 'Authorization'
resp_header = 'www-authenticate'
conn = HTTPSConnection(host=self.host, port=self.port)
# Send negotiation message
headers[req_header] = (
'NTLM %s' % ntlm.create_NTLM_NEGOTIATE_MESSAGE(self.rawuser))
log.debug('Request headers: %s', headers)
conn.request('GET', self.authurl, None, headers)
res = conn.getresponse()
reshdr = dict(res.getheaders())
log.debug('Response status: %s %s', res.status, res.reason)
log.debug('Response headers: %s', reshdr)
log.debug('Response data: %s [...]', res.read(100))
# Remove the reference to the socket, so that it can not be closed by
# the response object (we want to keep the socket open)
res.fp = None
# Server should respond with a challenge message
auth_header_values = reshdr[resp_header].split(', ')
auth_header_value = None
for s in auth_header_values:
if s[:5] == 'NTLM ':
auth_header_value = s[5:]
if auth_header_value is None:
raise Exception('Unexpected %s response header: %s' %
(resp_header, reshdr[resp_header]))
# Send authentication message
ServerChallenge, NegotiateFlags = \
ntlm.parse_NTLM_CHALLENGE_MESSAGE(auth_header_value)
auth_msg = ntlm.create_NTLM_AUTHENTICATE_MESSAGE(ServerChallenge,
self.user,
self.domain,
self.pw,
NegotiateFlags)
headers[req_header] = 'NTLM %s' % auth_msg
log.debug('Request headers: %s', headers)
conn.request('GET', self.authurl, None, headers)
res = conn.getresponse()
log.debug('Response status: %s %s', res.status, res.reason)
log.debug('Response headers: %s', dict(res.getheaders()))
log.debug('Response data: %s [...]', res.read()[:100])
if res.status != 200:
if res.status == 401:
raise Exception('Server rejected request: wrong '
'username or password')
raise Exception('Wrong server response: %s %s' %
(res.status, res.reason))
res.fp = None
log.debug('Connection established')
return conn
def urlopen(self, method, url, body=None, headers=None, retries=3,
redirect=True, assert_same_host=True):
if headers is None:
headers = {}
headers['Connection'] = 'Keep-Alive'
return super(NTLMConnectionPool, self).urlopen(method, url, body,
headers, retries,
redirect,
assert_same_host)
PK ! D# = = pyopenssl.pynu [ """
SSL with SNI_-support for Python 2. Follow these instructions if you would
like to verify SSL certificates in Python 2. Note, the default libraries do
*not* do certificate checking; you need to do additional work to validate
certificates yourself.
This needs the following packages installed:
* pyOpenSSL (tested with 16.0.0)
* cryptography (minimum 1.3.4, from pyopenssl)
* idna (minimum 2.0, from cryptography)
However, pyopenssl depends on cryptography, which depends on idna, so while we
use all three directly here we end up having relatively few packages required.
You can install them with the following command:
pip install pyopenssl cryptography idna
To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this::
try:
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
except ImportError:
pass
Now you can use :mod:`urllib3` as you normally would, and it will support SNI
when the required modules are installed.
Activating this module also has the positive side effect of disabling SSL/TLS
compression in Python 2 (see `CRIME attack`_).
If you want to configure the default list of supported cipher suites, you can
set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.
.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)
"""
from __future__ import absolute_import
import OpenSSL.SSL
from cryptography import x509
from cryptography.hazmat.backends.openssl import backend as openssl_backend
from cryptography.hazmat.backends.openssl.x509 import _Certificate
try:
from cryptography.x509 import UnsupportedExtension
except ImportError:
# UnsupportedExtension is gone in cryptography >= 2.1.0
class UnsupportedExtension(Exception):
pass
from socket import timeout, error as SocketError
from io import BytesIO
try: # Platform-specific: Python 2
from socket import _fileobject
except ImportError: # Platform-specific: Python 3
_fileobject = None
from ..packages.backports.makefile import backport_makefile
import logging
import ssl
from ..packages import six
import sys
from .. import util
__all__ = ['inject_into_urllib3', 'extract_from_urllib3']
# SNI always works.
HAS_SNI = True
# Map from urllib3 to PyOpenSSL compatible parameter-values.
_openssl_versions = {
ssl.PROTOCOL_SSLv23: OpenSSL.SSL.SSLv23_METHOD,
ssl.PROTOCOL_TLSv1: OpenSSL.SSL.TLSv1_METHOD,
}
if hasattr(ssl, 'PROTOCOL_TLSv1_1') and hasattr(OpenSSL.SSL, 'TLSv1_1_METHOD'):
_openssl_versions[ssl.PROTOCOL_TLSv1_1] = OpenSSL.SSL.TLSv1_1_METHOD
if hasattr(ssl, 'PROTOCOL_TLSv1_2') and hasattr(OpenSSL.SSL, 'TLSv1_2_METHOD'):
_openssl_versions[ssl.PROTOCOL_TLSv1_2] = OpenSSL.SSL.TLSv1_2_METHOD
try:
_openssl_versions.update({ssl.PROTOCOL_SSLv3: OpenSSL.SSL.SSLv3_METHOD})
except AttributeError:
pass
_stdlib_to_openssl_verify = {
ssl.CERT_NONE: OpenSSL.SSL.VERIFY_NONE,
ssl.CERT_OPTIONAL: OpenSSL.SSL.VERIFY_PEER,
ssl.CERT_REQUIRED:
OpenSSL.SSL.VERIFY_PEER + OpenSSL.SSL.VERIFY_FAIL_IF_NO_PEER_CERT,
}
_openssl_to_stdlib_verify = dict(
(v, k) for k, v in _stdlib_to_openssl_verify.items()
)
# OpenSSL will only write 16K at a time
SSL_WRITE_BLOCKSIZE = 16384
orig_util_HAS_SNI = util.HAS_SNI
orig_util_SSLContext = util.ssl_.SSLContext
log = logging.getLogger(__name__)
def inject_into_urllib3():
'Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.'
_validate_dependencies_met()
util.ssl_.SSLContext = PyOpenSSLContext
util.HAS_SNI = HAS_SNI
util.ssl_.HAS_SNI = HAS_SNI
util.IS_PYOPENSSL = True
util.ssl_.IS_PYOPENSSL = True
def extract_from_urllib3():
'Undo monkey-patching by :func:`inject_into_urllib3`.'
util.ssl_.SSLContext = orig_util_SSLContext
util.HAS_SNI = orig_util_HAS_SNI
util.ssl_.HAS_SNI = orig_util_HAS_SNI
util.IS_PYOPENSSL = False
util.ssl_.IS_PYOPENSSL = False
def _validate_dependencies_met():
"""
Verifies that PyOpenSSL's package-level dependencies have been met.
Throws `ImportError` if they are not met.
"""
# Method added in `cryptography==1.1`; not available in older versions
from cryptography.x509.extensions import Extensions
if getattr(Extensions, "get_extension_for_class", None) is None:
raise ImportError("'cryptography' module missing required functionality. "
"Try upgrading to v1.3.4 or newer.")
# pyOpenSSL 0.14 and above use cryptography for OpenSSL bindings. The _x509
# attribute is only present on those versions.
from OpenSSL.crypto import X509
x509 = X509()
if getattr(x509, "_x509", None) is None:
raise ImportError("'pyOpenSSL' module missing required functionality. "
"Try upgrading to v0.14 or newer.")
def _dnsname_to_stdlib(name):
"""
Converts a dNSName SubjectAlternativeName field to the form used by the
standard library on the given Python version.
Cryptography produces a dNSName as a unicode string that was idna-decoded
from ASCII bytes. We need to idna-encode that string to get it back, and
then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
If the name cannot be idna-encoded then we return None signalling that
the name given should be skipped.
"""
def idna_encode(name):
"""
Borrowed wholesale from the Python Cryptography Project. It turns out
that we can't just safely call `idna.encode`: it can explode for
wildcard names. This avoids that problem.
"""
import idna
try:
for prefix in [u'*.', u'.']:
if name.startswith(prefix):
name = name[len(prefix):]
return prefix.encode('ascii') + idna.encode(name)
return idna.encode(name)
except idna.core.IDNAError:
return None
if ':' in name:
return name
name = idna_encode(name)
if name is None:
return None
elif sys.version_info >= (3, 0):
name = name.decode('utf-8')
return name
def get_subj_alt_name(peer_cert):
"""
Given an PyOpenSSL certificate, provides all the subject alternative names.
"""
# Pass the cert to cryptography, which has much better APIs for this.
if hasattr(peer_cert, "to_cryptography"):
cert = peer_cert.to_cryptography()
else:
# This is technically using private APIs, but should work across all
# relevant versions before PyOpenSSL got a proper API for this.
cert = _Certificate(openssl_backend, peer_cert._x509)
# We want to find the SAN extension. Ask Cryptography to locate it (it's
# faster than looping in Python)
try:
ext = cert.extensions.get_extension_for_class(
x509.SubjectAlternativeName
).value
except x509.ExtensionNotFound:
# No such extension, return the empty list.
return []
except (x509.DuplicateExtension, UnsupportedExtension,
x509.UnsupportedGeneralNameType, UnicodeError) as e:
# A problem has been found with the quality of the certificate. Assume
# no SAN field is present.
log.warning(
"A problem was encountered with the certificate that prevented "
"urllib3 from finding the SubjectAlternativeName field. This can "
"affect certificate validation. The error was %s",
e,
)
return []
# We want to return dNSName and iPAddress fields. We need to cast the IPs
# back to strings because the match_hostname function wants them as
# strings.
# Sadly the DNS names need to be idna encoded and then, on Python 3, UTF-8
# decoded. This is pretty frustrating, but that's what the standard library
# does with certificates, and so we need to attempt to do the same.
# We also want to skip over names which cannot be idna encoded.
names = [
('DNS', name) for name in map(_dnsname_to_stdlib, ext.get_values_for_type(x509.DNSName))
if name is not None
]
names.extend(
('IP Address', str(name))
for name in ext.get_values_for_type(x509.IPAddress)
)
return names
class WrappedSocket(object):
'''API-compatibility wrapper for Python OpenSSL's Connection-class.
Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
collector of pypy.
'''
def __init__(self, connection, socket, suppress_ragged_eofs=True):
self.connection = connection
self.socket = socket
self.suppress_ragged_eofs = suppress_ragged_eofs
self._makefile_refs = 0
self._closed = False
def fileno(self):
return self.socket.fileno()
# Copy-pasted from Python 3.5 source code
def _decref_socketios(self):
if self._makefile_refs > 0:
self._makefile_refs -= 1
if self._closed:
self.close()
def recv(self, *args, **kwargs):
try:
data = self.connection.recv(*args, **kwargs)
except OpenSSL.SSL.SysCallError as e:
if self.suppress_ragged_eofs and e.args == (-1, 'Unexpected EOF'):
return b''
else:
raise SocketError(str(e))
except OpenSSL.SSL.ZeroReturnError as e:
if self.connection.get_shutdown() == OpenSSL.SSL.RECEIVED_SHUTDOWN:
return b''
else:
raise
except OpenSSL.SSL.WantReadError:
if not util.wait_for_read(self.socket, self.socket.gettimeout()):
raise timeout('The read operation timed out')
else:
return self.recv(*args, **kwargs)
else:
return data
def recv_into(self, *args, **kwargs):
try:
return self.connection.recv_into(*args, **kwargs)
except OpenSSL.SSL.SysCallError as e:
if self.suppress_ragged_eofs and e.args == (-1, 'Unexpected EOF'):
return 0
else:
raise SocketError(str(e))
except OpenSSL.SSL.ZeroReturnError as e:
if self.connection.get_shutdown() == OpenSSL.SSL.RECEIVED_SHUTDOWN:
return 0
else:
raise
except OpenSSL.SSL.WantReadError:
if not util.wait_for_read(self.socket, self.socket.gettimeout()):
raise timeout('The read operation timed out')
else:
return self.recv_into(*args, **kwargs)
def settimeout(self, timeout):
return self.socket.settimeout(timeout)
def _send_until_done(self, data):
while True:
try:
return self.connection.send(data)
except OpenSSL.SSL.WantWriteError:
if not util.wait_for_write(self.socket, self.socket.gettimeout()):
raise timeout()
continue
except OpenSSL.SSL.SysCallError as e:
raise SocketError(str(e))
def sendall(self, data):
total_sent = 0
while total_sent < len(data):
sent = self._send_until_done(data[total_sent:total_sent + SSL_WRITE_BLOCKSIZE])
total_sent += sent
def shutdown(self):
# FIXME rethrow compatible exceptions should we ever use this
self.connection.shutdown()
def close(self):
if self._makefile_refs < 1:
try:
self._closed = True
return self.connection.close()
except OpenSSL.SSL.Error:
return
else:
self._makefile_refs -= 1
def getpeercert(self, binary_form=False):
x509 = self.connection.get_peer_certificate()
if not x509:
return x509
if binary_form:
return OpenSSL.crypto.dump_certificate(
OpenSSL.crypto.FILETYPE_ASN1,
x509)
return {
'subject': (
(('commonName', x509.get_subject().CN),),
),
'subjectAltName': get_subj_alt_name(x509)
}
def _reuse(self):
self._makefile_refs += 1
def _drop(self):
if self._makefile_refs < 1:
self.close()
else:
self._makefile_refs -= 1
if _fileobject: # Platform-specific: Python 2
def makefile(self, mode, bufsize=-1):
self._makefile_refs += 1
return _fileobject(self, mode, bufsize, close=True)
else: # Platform-specific: Python 3
makefile = backport_makefile
WrappedSocket.makefile = makefile
class PyOpenSSLContext(object):
"""
I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
for translating the interface of the standard library ``SSLContext`` object
to calls into PyOpenSSL.
"""
def __init__(self, protocol):
self.protocol = _openssl_versions[protocol]
self._ctx = OpenSSL.SSL.Context(self.protocol)
self._options = 0
self.check_hostname = False
@property
def options(self):
return self._options
@options.setter
def options(self, value):
self._options = value
self._ctx.set_options(value)
@property
def verify_mode(self):
return _openssl_to_stdlib_verify[self._ctx.get_verify_mode()]
@verify_mode.setter
def verify_mode(self, value):
self._ctx.set_verify(
_stdlib_to_openssl_verify[value],
_verify_callback
)
def set_default_verify_paths(self):
self._ctx.set_default_verify_paths()
def set_ciphers(self, ciphers):
if isinstance(ciphers, six.text_type):
ciphers = ciphers.encode('utf-8')
self._ctx.set_cipher_list(ciphers)
def load_verify_locations(self, cafile=None, capath=None, cadata=None):
if cafile is not None:
cafile = cafile.encode('utf-8')
if capath is not None:
capath = capath.encode('utf-8')
self._ctx.load_verify_locations(cafile, capath)
if cadata is not None:
self._ctx.load_verify_locations(BytesIO(cadata))
def load_cert_chain(self, certfile, keyfile=None, password=None):
self._ctx.use_certificate_chain_file(certfile)
if password is not None:
self._ctx.set_passwd_cb(lambda max_length, prompt_twice, userdata: password)
self._ctx.use_privatekey_file(keyfile or certfile)
def wrap_socket(self, sock, server_side=False,
do_handshake_on_connect=True, suppress_ragged_eofs=True,
server_hostname=None):
cnx = OpenSSL.SSL.Connection(self._ctx, sock)
if isinstance(server_hostname, six.text_type): # Platform-specific: Python 3
server_hostname = server_hostname.encode('utf-8')
if server_hostname is not None:
cnx.set_tlsext_host_name(server_hostname)
cnx.set_connect_state()
while True:
try:
cnx.do_handshake()
except OpenSSL.SSL.WantReadError:
if not util.wait_for_read(sock, sock.gettimeout()):
raise timeout('select timed out')
continue
except OpenSSL.SSL.Error as e:
raise ssl.SSLError('bad handshake: %r' % e)
break
return WrappedSocket(cnx, sock)
def _verify_callback(cnx, x509, err_no, err_depth, return_code):
return err_no == 0
PK ! * * appengine.pynu [ """
This module provides a pool manager that uses Google App Engine's
`URLFetch Service `_.
Example usage::
from urllib3 import PoolManager
from urllib3.contrib.appengine import AppEngineManager, is_appengine_sandbox
if is_appengine_sandbox():
# AppEngineManager uses AppEngine's URLFetch API behind the scenes
http = AppEngineManager()
else:
# PoolManager uses a socket-level API behind the scenes
http = PoolManager()
r = http.request('GET', 'https://google.com/')
There are `limitations `_ to the URLFetch service and it may not be
the best choice for your application. There are three options for using
urllib3 on Google App Engine:
1. You can use :class:`AppEngineManager` with URLFetch. URLFetch is
cost-effective in many circumstances as long as your usage is within the
limitations.
2. You can use a normal :class:`~urllib3.PoolManager` by enabling sockets.
Sockets also have `limitations and restrictions
`_ and have a lower free quota than URLFetch.
To use sockets, be sure to specify the following in your ``app.yaml``::
env_variables:
GAE_USE_SOCKETS_HTTPLIB : 'true'
3. If you are using `App Engine Flexible
`_, you can use the standard
:class:`PoolManager` without any configuration or special environment variables.
"""
from __future__ import absolute_import
import io
import logging
import warnings
from ..packages.six.moves.urllib.parse import urljoin
from ..exceptions import (
HTTPError,
HTTPWarning,
MaxRetryError,
ProtocolError,
TimeoutError,
SSLError
)
from ..request import RequestMethods
from ..response import HTTPResponse
from ..util.timeout import Timeout
from ..util.retry import Retry
from . import _appengine_environ
try:
from google.appengine.api import urlfetch
except ImportError:
urlfetch = None
log = logging.getLogger(__name__)
class AppEnginePlatformWarning(HTTPWarning):
pass
class AppEnginePlatformError(HTTPError):
pass
class AppEngineManager(RequestMethods):
"""
Connection manager for Google App Engine sandbox applications.
This manager uses the URLFetch service directly instead of using the
emulated httplib, and is subject to URLFetch limitations as described in
the App Engine documentation `here
`_.
Notably it will raise an :class:`AppEnginePlatformError` if:
* URLFetch is not available.
* If you attempt to use this on App Engine Flexible, as full socket
support is available.
* If a request size is more than 10 megabytes.
* If a response size is more than 32 megabtyes.
* If you use an unsupported request method such as OPTIONS.
Beyond those cases, it will raise normal urllib3 errors.
"""
def __init__(self, headers=None, retries=None, validate_certificate=True,
urlfetch_retries=True):
if not urlfetch:
raise AppEnginePlatformError(
"URLFetch is not available in this environment.")
if is_prod_appengine_mvms():
raise AppEnginePlatformError(
"Use normal urllib3.PoolManager instead of AppEngineManager"
"on Managed VMs, as using URLFetch is not necessary in "
"this environment.")
warnings.warn(
"urllib3 is using URLFetch on Google App Engine sandbox instead "
"of sockets. To use sockets directly instead of URLFetch see "
"https://urllib3.readthedocs.io/en/latest/reference/urllib3.contrib.html.",
AppEnginePlatformWarning)
RequestMethods.__init__(self, headers)
self.validate_certificate = validate_certificate
self.urlfetch_retries = urlfetch_retries
self.retries = retries or Retry.DEFAULT
def __enter__(self):
return self
def __exit__(self, exc_type, exc_val, exc_tb):
# Return False to re-raise any potential exceptions
return False
def urlopen(self, method, url, body=None, headers=None,
retries=None, redirect=True, timeout=Timeout.DEFAULT_TIMEOUT,
**response_kw):
retries = self._get_retries(retries, redirect)
try:
follow_redirects = (
redirect and
retries.redirect != 0 and
retries.total)
response = urlfetch.fetch(
url,
payload=body,
method=method,
headers=headers or {},
allow_truncated=False,
follow_redirects=self.urlfetch_retries and follow_redirects,
deadline=self._get_absolute_timeout(timeout),
validate_certificate=self.validate_certificate,
)
except urlfetch.DeadlineExceededError as e:
raise TimeoutError(self, e)
except urlfetch.InvalidURLError as e:
if 'too large' in str(e):
raise AppEnginePlatformError(
"URLFetch request too large, URLFetch only "
"supports requests up to 10mb in size.", e)
raise ProtocolError(e)
except urlfetch.DownloadError as e:
if 'Too many redirects' in str(e):
raise MaxRetryError(self, url, reason=e)
raise ProtocolError(e)
except urlfetch.ResponseTooLargeError as e:
raise AppEnginePlatformError(
"URLFetch response too large, URLFetch only supports"
"responses up to 32mb in size.", e)
except urlfetch.SSLCertificateError as e:
raise SSLError(e)
except urlfetch.InvalidMethodError as e:
raise AppEnginePlatformError(
"URLFetch does not support method: %s" % method, e)
http_response = self._urlfetch_response_to_http_response(
response, retries=retries, **response_kw)
# Handle redirect?
redirect_location = redirect and http_response.get_redirect_location()
if redirect_location:
# Check for redirect response
if (self.urlfetch_retries and retries.raise_on_redirect):
raise MaxRetryError(self, url, "too many redirects")
else:
if http_response.status == 303:
method = 'GET'
try:
retries = retries.increment(method, url, response=http_response, _pool=self)
except MaxRetryError:
if retries.raise_on_redirect:
raise MaxRetryError(self, url, "too many redirects")
return http_response
retries.sleep_for_retry(http_response)
log.debug("Redirecting %s -> %s", url, redirect_location)
redirect_url = urljoin(url, redirect_location)
return self.urlopen(
method, redirect_url, body, headers,
retries=retries, redirect=redirect,
timeout=timeout, **response_kw)
# Check if we should retry the HTTP response.
has_retry_after = bool(http_response.getheader('Retry-After'))
if retries.is_retry(method, http_response.status, has_retry_after):
retries = retries.increment(
method, url, response=http_response, _pool=self)
log.debug("Retry: %s", url)
retries.sleep(http_response)
return self.urlopen(
method, url,
body=body, headers=headers,
retries=retries, redirect=redirect,
timeout=timeout, **response_kw)
return http_response
def _urlfetch_response_to_http_response(self, urlfetch_resp, **response_kw):
if is_prod_appengine():
# Production GAE handles deflate encoding automatically, but does
# not remove the encoding header.
content_encoding = urlfetch_resp.headers.get('content-encoding')
if content_encoding == 'deflate':
del urlfetch_resp.headers['content-encoding']
transfer_encoding = urlfetch_resp.headers.get('transfer-encoding')
# We have a full response's content,
# so let's make sure we don't report ourselves as chunked data.
if transfer_encoding == 'chunked':
encodings = transfer_encoding.split(",")
encodings.remove('chunked')
urlfetch_resp.headers['transfer-encoding'] = ','.join(encodings)
original_response = HTTPResponse(
# In order for decoding to work, we must present the content as
# a file-like object.
body=io.BytesIO(urlfetch_resp.content),
msg=urlfetch_resp.header_msg,
headers=urlfetch_resp.headers,
status=urlfetch_resp.status_code,
**response_kw
)
return HTTPResponse(
body=io.BytesIO(urlfetch_resp.content),
headers=urlfetch_resp.headers,
status=urlfetch_resp.status_code,
original_response=original_response,
**response_kw
)
def _get_absolute_timeout(self, timeout):
if timeout is Timeout.DEFAULT_TIMEOUT:
return None # Defer to URLFetch's default.
if isinstance(timeout, Timeout):
if timeout._read is not None or timeout._connect is not None:
warnings.warn(
"URLFetch does not support granular timeout settings, "
"reverting to total or default URLFetch timeout.",
AppEnginePlatformWarning)
return timeout.total
return timeout
def _get_retries(self, retries, redirect):
if not isinstance(retries, Retry):
retries = Retry.from_int(
retries, redirect=redirect, default=self.retries)
if retries.connect or retries.read or retries.redirect:
warnings.warn(
"URLFetch only supports total retries and does not "
"recognize connect, read, or redirect retry parameters.",
AppEnginePlatformWarning)
return retries
# Alias methods from _appengine_environ to maintain public API interface.
is_appengine = _appengine_environ.is_appengine
is_appengine_sandbox = _appengine_environ.is_appengine_sandbox
is_local_appengine = _appengine_environ.is_local_appengine
is_prod_appengine = _appengine_environ.is_prod_appengine
is_prod_appengine_mvms = _appengine_environ.is_prod_appengine_mvms
PK ! i/k k % __pycache__/pyopenssl.cpython-312.pycnu [
@gK
U d Z ddlmZ ddlZddlmZ ddlmZ ddl Z ddl Z ddl
Z
ddlmZ dd lmZ dd
lmZ d d lmZ e
j* rdd
lmZ ddgZej2 j4 ej6 j8 ej2 j: ej6 j8 e j< ej6 j> iZ de!d< e"e d r6 e"ej6 d r#ej6 jF e e jH < e"e d r6 e"ej6 d r#ej6 jJ e e jL < e jN ej6 jP e jR ej6 jT e jV ej6 jT ej6 jX z iZ-e-j] D ci c] \ } }||
c}} Z/ e0ej6 dd e0ej6 dd z Z1de!d< e0ej6 dd Z2de!d< e0ej6 d d Z3de!d < e0ej6 d d Z4de!d < e0ej6 d d Z5de!d!< e jl jn e1e jl jp e1e jl jr e1e2z e jl jt e1e2z e3z e jl jv e1e2z e3z e4z e jl jx e1e2z e3z e4z iZ=de!d"< e jl jn e1e2z e3z e4z e5z e jl jp e1e3z e4z e5z e jl jr e1e4z e5z e jl jt e1e5z e jl jv e1e jl jx e1iZ>de!d#< d$Z?ej2 j ZA e j eC ZDd/d%ZEd/d&ZFd/d'ZGd0d(ZHd1d)ZI G d* d+ ZJej eJ_K G d, d- ZL d2d.ZMy# e $ r G d de
ZY 8w xY wc c}} w )3a
Module for using pyOpenSSL as a TLS backend. This module was relevant before
the standard library ``ssl`` module supported SNI, but now that we've dropped
support for Python 2.7 all relevant Python versions support SNI so
**this module is no longer recommended**.
This needs the following packages installed:
* `pyOpenSSL`_ (tested with 16.0.0)
* `cryptography`_ (minimum 1.3.4, from pyopenssl)
* `idna`_ (minimum 2.0)
However, pyOpenSSL depends on cryptography, so while we use all three directly here we
end up having relatively few packages required.
You can install them with the following command:
.. code-block:: bash
$ python -m pip install pyopenssl cryptography idna
To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this:
.. code-block:: python
try:
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
except ImportError:
pass
.. _pyopenssl: https://www.pyopenssl.org
.. _cryptography: https://cryptography.io
.. _idna: https://github.com/kjd/idna
) annotationsN)x509)UnsupportedExtensionc e Zd Zy)r N)__name__
__module__ __qualname__ H/opt/hc_python/lib/python3.12/site-packages/urllib3/contrib/pyopenssl.pyr r 2 s r r )BytesIO)socket)timeout )utilX509inject_into_urllib3extract_from_urllib3zdict[int, int]_openssl_versionsPROTOCOL_TLSv1_1TLSv1_1_METHODPROTOCOL_TLSv1_2TLSv1_2_METHOD OP_NO_SSLv2 OP_NO_SSLv3int_OP_NO_SSLv2_OR_SSLv3 OP_NO_TLSv1 _OP_NO_TLSv1
OP_NO_TLSv1_1_OP_NO_TLSv1_1
OP_NO_TLSv1_2_OP_NO_TLSv1_2
OP_NO_TLSv1_3_OP_NO_TLSv1_3 _openssl_to_ssl_minimum_version _openssl_to_ssl_maximum_versioni @ c t t t _ t t j _ dt _ dt j _ y)z7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.TN)_validate_dependencies_metPyOpenSSLContextr
SSLContextssl_ IS_PYOPENSSLr
r r r r s1 &DO+DII D !DIIr c t t _ t t j _ dt _ dt j _ y)z4Undo monkey-patching by :func:`inject_into_urllib3`.FN)orig_util_SSLContextr r, r- r. r
r r r r s+ +DO/DII D "DIIr c ddl m} t | dd t d ddlm} | }t |dd t d y) z{
Verifies that PyOpenSSL's package-level dependencies have been met.
Throws `ImportError` if they are not met.
r )
Extensionsget_extension_for_classNzX'cryptography' module missing required functionality. Try upgrading to v1.3.4 or newer.r _x509zS'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.) cryptography.x509.extensionsr2 getattr ImportErrorOpenSSL.cryptor )r2 r r s r r* r* s[ 8z4d;C
0
$ 6DtWd#+
/
,r c N dd}d| v r| S || }|y|j d S )a%
Converts a dNSName SubjectAlternativeName field to the form used by the
standard library on the given Python version.
Cryptography produces a dNSName as a unicode string that was idna-decoded
from ASCII bytes. We need to idna-encode that string to get it back, and
then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
If the name cannot be idna-encoded then we return None signalling that
the name given should be skipped.
c ddl } dD ]F }| j | s| t | d } |j d |j | z c S |j | S # |j j
$ r Y yw xY w)z
Borrowed wholesale from the Python Cryptography Project. It turns out
that we can't just safely call `idna.encode`: it can explode for
wildcard names. This avoids that problem.
r N)z*..ascii)idna
startswithlenencodecore IDNAError)namer= prefixs r idna_encodez'_dnsname_to_stdlib..idna_encode s| %??6* F
.D!==1DKK4EEE & ;;t$ $yy"" s A" 2A" A" "A>=A>:Nutf-8)rC strreturn bytes | None)decode)rC rE encoded_names r _dnsname_to_stdlibrM s9 $ d{ t$L w ''r c N | j } |j j t j j
}t t |j t j D cg c] }|d|f
}}|j# d |j t j$ D |S # t j $ r g cY S t j t t j t f$ r"}t j d| g cY d}~S d}~ww xY wc c}w )zU
Given an PyOpenSSL certificate, provides all the subject alternative names.
zA problem was encountered with the certificate that prevented urllib3 from finding the SubjectAlternativeName field. This can affect certificate validation. The error was %sNDNSc 3 6 K | ] }d t | f yw)z
IP AddressN)rH ).0rC s r z$get_subj_alt_name.. s .Ud s4y!.Us )to_cryptography
extensionsr3 r SubjectAlternativeNamevalueExtensionNotFoundDuplicateExtensionr UnsupportedGeneralNameType UnicodeErrorlogwarningmaprM get_values_for_typeDNSNameextend IPAddress) peer_certcertexterC namess r get_subj_alt_namerg s $ $ &Doo55d6Q6QRXX: *C,C,CDLL,QR
RD
R
LL .1.E.Ednn.U LG ! ! ''
>
.
s) 3B: 4
D":D ,D =DD D c e Zd ZdZ d ddZddZddZddZddZddZ ddZ
dd Z dd
Z dd Z
dd Z d d d
Zd dZd dZy)
WrappedSocketz@API-compatibility wrapper for Python OpenSSL's Connection-class.c J || _ || _ || _ d| _ d| _ y Nr F)
connectionr suppress_ragged_eofs_io_refs_closed)selfrl r rm s r __init__zWrappedSocket.__init__ s( % $8!
r c 6 | j j S N)r filenorp s r rt zWrappedSocket.fileno! s {{!!##r c | j dkD r| xj dz c_ | j r| j y y )Nr )rn ro closeru s r _decref_socketiosz WrappedSocket._decref_socketios% s1 ==1 MMQ M << JJL r c | j j |i |}|S # t j j $ rH}| j
r|j dk( rY d }~yt |j d t | |d }~wt j j $ r9 | j j t j j k( rY y t j j $ r`}t j | j | j j! s t# d | | j |i |cY d }~S d }~wt j j$ $ r }t' j( d| |d }~ww xY w)NzUnexpected EOFr r The read operation timed out read error: )rl recvOpenSSLSSL SysCallErrorrm argsOSErrorrH ZeroReturnError get_shutdownRECEIVED_SHUTDOWN
WantReadErrorr
wait_for_readr
gettimeoutr ErrorsslSSLError)rp r kwargsdatare s r r zWrappedSocket.recv+ s4 '4??''88D* K) {{'' 8((QVV7M-M affQiQ0a7{{** ++-1N1NN{{(( 2%%dkk4;;3I3I3KL <=1D tyy$1&11 {{ <,, aU 34! ; #A>>AF F 2AE
F
F -FF c 8 | j j | S rs )r
settimeout)rp r s r r zWrappedSocket.settimeout[ s {{%%g..r c | j j | S # t j j $ rM}t j | j | j j s t |Y d }~d }~wt j j $ r(}t |j d t | |d }~ww xY wNr )rl sendr r WantWriteErrorr wait_for_writer r r r r r rH )rp r re s r _send_until_donez WrappedSocket._send_until_done^ s
8++D11;;--
**4;; 8N8N8PQ!)*;;++
8 affQiQ0a7
8s! C AB C ##CC c d}|t | k r0| j |||t z }||z
}|t | k r/y y r )r? r SSL_WRITE_BLOCKSIZE)rp r
total_sentsents r sendallzWrappedSocket.sendalli sM
3t9$((Z*/B"BCD
$ J 3t9$r c | j j y # t j j $ r }t j d| |d }~ww xY w)Nzshutdown error: )rl shutdownr r r r r )rp howre s r r zWrappedSocket.shutdownq sM @ OO $ $ &{{ @,,!1! 78a ? @s AAAc R d| _ | j dk r| j y y )NTr )ro rn _real_closeru s r rx zWrappedSocket.closew s& ==A r c ~ | j j S # t j j $ r Y y w xY wrs )rl rx r r r ru s r r zWrappedSocket._real_close| s6 ??((* *{{ s <<c | j j }|s|S |r8t j j t j j
| S d |j j ffft | dS )N
commonName)subjectsubjectAltName) rl get_peer_certificater cryptodump_certificate
FILETYPE_ASN1 get_subjectCNrg )rp binary_formr s r getpeercertzWrappedSocket.getpeercert sw 335K >>227>>3O3OQUV V '(8(8(8(:(=(=>@B / 5
r c 6 | j j S rs )rl get_protocol_version_nameru s r versionzWrappedSocket.version s 88::r c ^ | j j }|r|j S d S rs )rl get_alpn_proto_negotiatedrK )rp
alpn_protos r selected_alpn_protocolz$WrappedSocket.selected_alpn_protocol s* __>>@
&0z ":d:r N)T)rl OpenSSL.SSL.Connectionr
socket_clsrm boolrI NonerI r rI r )r
typing.Anyr r rI bytes)r r r r rI r )r floatrI r )r r rI r )r r rI r )r r rI r )F)r r rI z"dict[str, list[typing.Any]] | None)rI rH )rI
str | None)r r r __doc__rq rt ry r r r r r r rx r r r r r
r r ri ri s J &*
*
#
$ 2<./ 8 @
#(
+
;;r ri c z e Zd ZdZddZedd Zej dd Zedd Zej dd ZddZ ddZ
d dd
Z d d d Z d d Z
d d d
ZddZedd Zej d d Zedd Zej d!d Zy )"r+ z
I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
for translating the interface of the standard library ``SSLContext`` object
to calls into PyOpenSSL.
c t | | _ t j j | j | _ d| _ d| _ t j j | _ t j j | _
y rk )r protocolr r Context_ctx_optionscheck_hostnamer
TLSVersionMINIMUM_SUPPORTED_minimum_versionMAXIMUM_SUPPORTED_maximum_version)rp r s r rq zPyOpenSSLContext.__init__ s[ )(3
KK''
6
#%(^^%E%E %(^^%E%E r c | j S rs )r ru s r optionszPyOpenSSLContext.options s }} r c 2 || _ | j y rs )r _set_ctx_optionsrp rV s r r zPyOpenSSLContext.options s
r c D t | j j S rs )_openssl_to_stdlib_verifyr get_verify_moderu s r verify_modez PyOpenSSLContext.verify_mode s ()B)B)DEEr c R | j j t | t y rs )r
set_verify_stdlib_to_openssl_verify_verify_callbackr s r r z PyOpenSSLContext.verify_mode s 6u =?OPr c 8 | j j y rs )r set_default_verify_pathsru s r r z)PyOpenSSLContext.set_default_verify_paths s **,r c | t |t r|j d }| j j | y )NrG )
isinstancerH r@ r set_cipher_list)rp cipherss r set_ciphersz PyOpenSSLContext.set_ciphers s, gs # nnW-G !!'*r Nc T ||j d }||j d } | j j || |%| j j t | y y # t j
j $ r }t j d| |d }~ww xY w)NrG z%unable to load trusted certificates: ) r@ r load_verify_locationsr
r r r r r )rp cafilecapathcadatare s r r z&PyOpenSSLContext.load_verify_locations s ]]7+F ]]7+F U II + +FF ;! //@ "{{ U,,!Fqe LMST T Us AA, , B' B""B'c z | j j | ?t t sj d | j j fd | j j
|xs | y # t j j $ r }t j d| |d }~ww xY w)NrG c S rs r
)_passwords r z2PyOpenSSLContext.load_cert_chain.. s 8r z"Unable to load certificate chain: ) r use_certificate_chain_filer r r@
set_passwd_cbuse_privatekey_filer r r r r )rp certfilekeyfiler re s ` r load_cert_chainz PyOpenSSLContext.load_cert_chain s R II 0 0 :#!(E2 'w 7H ''(;< II ) )'*=X >{{ R,,!CA5 IJPQ Q Rs A;A? ? B: B55B:c |D cg c]" }t j j |d $ }}| j j | S c c}w )Nr< )r to_bytesr set_alpn_protos)rp protocolsps r set_alpn_protocolsz#PyOpenSSLContext.set_alpn_protocols sB =FGYTYY''73Y Gyy((33 Hs 'A c t j j | j | }|rQt j
j
| s2t |t r|j d }|j | |j |j t) || S # t j j $ r:}t j ||j s t! d |Y d }~qd }~wt j j" $ r }t% j& d| |d }~ww xY w)NrG zselect timed outzbad handshake: )r r
Connectionr r r- is_ipaddressr rH r@ set_tlsext_host_nameset_connect_state do_handshaker r r r r r r ri )rp sock server_sidedo_handshake_on_connectrm server_hostnamecnxre s r wrap_socketz PyOpenSSLContext.wrap_socket s kk$$TYY5 499#9#9/#J/3/"1"8"8"A $ $_ 5
C "
S$'' ;;,,
))$0AB!"451<;;$$
Cll_QE#:;B
Cs$ B- - D=
0C?? D= D88D=c | j j | j t | j z t
| j z y rs )r set_optionsr r' r r( r ru s r r z!PyOpenSSLContext._set_ctx_options sC MM-d.C.CD
E-d.C.CD
E
r c | j S rs )r ru s r minimum_versionz PyOpenSSLContext.minimum_version $$$r c 2 || _ | j y rs )r r )rp r s r r z PyOpenSSLContext.minimum_version / r c | j S rs )r ru s r maximum_versionz PyOpenSSLContext.maximum_version r r c 2 || _ | j y rs )r r )rp r
s r r
z PyOpenSSLContext.maximum_version r r )r r rI r r )rV r rI r )rV zssl.VerifyModerI r r )r z bytes | strrI r )NNN)r r r r r rJ rI r )NN)r rH r r r r rI r )r zlist[bytes | str]rI r )FTTN) r r r r r r rm r r zbytes | str | NonerI ri )r r rI r )r
r rI r )r r r r rq propertyr setterr r r r r r r r r r
r
r r r+ r+ s F
^^ F F Q Q-+ " ! # UU U U
U( # # RR R R
R 4 "(,%).2
( ( ( "& (
# ( ,
(
(>
% % % % r r+ c |dk( S r r
)r r err_no err_depth return_codes r r r # s Q;r r )rC rH rI r )rb r rI zlist[tuple[str, str]]) r r r r r r r r r r rI r )Nr
__future__r OpenSSL.SSLr cryptographyr cryptography.x509r r7 Exceptionloggingr typingior
r r r r
TYPE_CHECKINGr8 r __all__r- PROTOCOL_TLSr
SSLv23_METHODPROTOCOL_TLS_CLIENTPROTOCOL_TLSv1 TLSv1_METHODr __annotations__hasattrr r r r CERT_NONE VERIFY_NONE
CERT_OPTIONAL VERIFY_PEER
CERT_REQUIREDVERIFY_FAIL_IF_NO_PEER_CERTr itemsr r6 r r r" r$ r& r r TLSv1TLSv1_1TLSv1_2TLSv1_3r r' r( r r, r0 getLoggerr r[ r r r* rM rg ri makefiler+ r )kvs 00r r6 sK &P #
6
' # !"8
9 IIGKK 5 5II!!7;;#<#< 00% > 3"# =M(N.5kk.H.Hc**+
3"# =M(N.5kk.H.Hc**+ MM7;;**w{{..w{{..
kk--. /H.M.M.O P.OdaQT.O P %W[[- Cg KK G s GKK : c : gkk?A> > gkk?A> > gkk?A> > NN$$&;NN/NN 1L @NN 1L @> QNN ,~=NNN$$ ,~=N 3 NN$$
NN . ?.PNN 1N B^ SNN 1N BNN 1NN$$&; 3 $ yy++ g!"#
4&(R-`E; E;P $,,
C C L
g
y
R Qs Q
Q QQPK ! ;H $ __pycache__/__init__.cpython-312.pycnu [
@g y )N r G/opt/hc_python/lib/python3.12/site-packages/urllib3/contrib/__init__.pyr s r PK ! ! __pycache__/socks.cpython-312.pycnu [
@g} d Z ddlmZ ddlZddl Z ddl
m Z ddl
mZmZ dd lmZmZ dd
lmZmZ dd lmZ dd lmZ ddlZ G d
de j4 Z G d de Z G d de e Z G d de Z G d de Z G d de Z y# e$ r ddlZddlmZ ej de w xY w# e$ r dZY ~w xY w)a
This module contains provisional support for SOCKS proxies from within
urllib3. This module supports SOCKS4, SOCKS4A (an extension of SOCKS4), and
SOCKS5. To enable its functionality, either install PySocks or install this
module with the ``socks`` extra.
The SOCKS implementation supports the full range of urllib3 features. It also
supports the following SOCKS features:
- SOCKS4A (``proxy_url='socks4a://...``)
- SOCKS4 (``proxy_url='socks4://...``)
- SOCKS5 with remote DNS (``proxy_url='socks5h://...``)
- SOCKS5 with local DNS (``proxy_url='socks5://...``)
- Usernames and passwords for the SOCKS proxy
.. note::
It is recommended to use ``socks5h://`` or ``socks4a://`` schemes in
your ``proxy_url`` to ensure that DNS resolution is done from the remote
server instead of client-side when connecting to a domain name.
SOCKS4 supports IPv4 and domain names with the SOCKS4A extension. SOCKS5
supports IPv4, IPv6, and domain names.
When connecting to a SOCKS4 proxy the ``username`` portion of the ``proxy_url``
will be sent as the ``userid`` section of the SOCKS request:
.. code-block:: python
proxy_url="socks4a://@proxy-host"
When connecting to a SOCKS5 proxy the ``username`` and ``password`` portion
of the ``proxy_url`` will be sent as the username/password to authenticate
with the proxy:
.. code-block:: python
proxy_url="socks5h://:@proxy-host"
) annotationsN )DependencyWarningzSOCKS support in urllib3 requires the installation of optional dependencies: specifically, PySocks. For more information, see https://urllib3.readthedocs.io/en/latest/advanced-usage.html#socks-proxies)timeout)HTTPConnectionHTTPSConnection)HTTPConnectionPoolHTTPSConnectionPool)ConnectTimeoutErrorNewConnectionError) PoolManager) parse_urlc J e Zd ZU ded< ded< ded< ded< ded< ded < y
) _TYPE_SOCKS_OPTIONSint
socks_version
str | None
proxy_host
proxy_portusernamepasswordboolrdnsN)__name__
__module__ __qualname____annotations__ D/opt/hc_python/lib/python3.12/site-packages/urllib3/contrib/socks.pyr r K s%
Jr r c < e Zd ZdZ d fd ZddZ xZS )SOCKSConnectionzG
A plain-text HTTP connection that connects via a SOCKS proxy.
c 2 || _ t | |i | y )N)_socks_optionssuper__init__)selfr$ argskwargs __class__s r r& zSOCKSConnection.__init__Y s -
$)&)r c D i }| j r| j |d< | j r| j |d< t j | j | j
ff| j d | j d | j d | j d | j d | j d | j d |}|S # t $ r-}t | d
| j d | j d |d
}~wt j $ rt}|j rS|j }t |t r(t | d
| j d | j d |t | d| t | d| |d
}~wt $ r}t | d| |d
}~ww xY w)zA
Establish a new connection via the SOCKS proxy.
source_addresssocket_optionsr r r r r r )
proxy_type
proxy_addrr proxy_usernameproxy_password
proxy_rdnsr zConnection to z timed out. (connect timeout=)Nz&Failed to establish a new connection: )r, r- sockscreate_connectionhostportr$ r
SocketTimeoutr
ProxyError
socket_err
isinstancer OSError)r' extra_kwconneerrors r _new_connzSOCKSConnection._new_connb s +- )-)<) # 2 2: > ..v6
DX A % +H VWX
|| e]3- ( 3PQUQ]Q]P^^_` - Fug N ) B1#F $>qcB
s1 B C F (C99F A/E>> F
FF )r$ r r(
typing.Anyr) rB returnNone)rC zsocks.socksocket)r r r __doc__r& rA
__classcell__r* s @r r" r" T s8 *+* * *
*8r r" c e Zd Zy)SOCKSHTTPSConnectionN)r r r r r r rI rI s r rI c e Zd ZeZy)SOCKSHTTPConnectionPoolN)r r r r"
ConnectionClsr r r rK rK s #Mr rK c e Zd ZeZy)SOCKSHTTPSConnectionPoolN)r r r rI rL r r r rN rN s (Mr rN c N e Zd ZdZeedZ d d fd
Z xZS )SOCKSProxyManagerzh
A version of the urllib3 ProxyManager that routes connections via the
defined SOCKS proxy.
)httphttpsc b t | }|<|:|j .|j j d }t | dk( r|\ }}|j dk( rt
j } d}
nt|j dk( rt
j } d}
nR|j dk( rt
j } d}
n0|j dk( rt
j } d}
nt d | || _ | |j |j |||
d
} | |d < t | 4 ||fi | t j | _ y ) N:r socks5Fsocks5hTsocks4socks4az'Unable to determine SOCKS version from )r r r r r r r$ )r authsplitlenschemer4 PROXY_TYPE_SOCKS5PROXY_TYPE_SOCKS4
ValueError proxy_urlr6 r7 r% r& rP pool_classes_by_scheme)
r' r` r r num_poolsheadersconnection_pool_kwparsedrZ r r
socks_optionsr* s
r r& zSOCKSProxyManager.__init__ s* 9% 0V[[5LKK%%c*E5zQ%*"( ==H $ ! 3 3MD
]]i
' ! 3 3MD
]]h
& ! 3 3MD
]]i
' ! 3 3MD Fyk RS S" + ++ ++
0=+,
GB/AB&7&N&N#r )NN
N) r` strr r r r rb r rc z typing.Mapping[str, str] | Nonerd rB ) r r r rE rK rN ra r& rF rG s @r rP rP sr () $ #37
,O,O ,O ,O
,O 1
,O ),O ,Or rP )!rE
__future__r r4 ImportErrorwarnings
exceptionsr warntypingsocketr r8
connectionr r connectionpoolr r
r r poolmanagerr
util.urlr ssl TypedDictr r" rI rK rN rP r r r rv s &P #
+ 8 D @ %
&** Fn FZ ?O $ 0 $) 2 )7O 7OA
.HMM
Y
4
Cs B B6 $B36C ?C PK ! л& & emscripten/response.pynu [ from __future__ import annotations
import json as _json
import logging
import typing
from contextlib import contextmanager
from dataclasses import dataclass
from http.client import HTTPException as HTTPException
from io import BytesIO, IOBase
from ...exceptions import InvalidHeader, TimeoutError
from ...response import BaseHTTPResponse
from ...util.retry import Retry
from .request import EmscriptenRequest
if typing.TYPE_CHECKING:
from ..._base_connection import BaseHTTPConnection, BaseHTTPSConnection
log = logging.getLogger(__name__)
@dataclass
class EmscriptenResponse:
status_code: int
headers: dict[str, str]
body: IOBase | bytes
request: EmscriptenRequest
class EmscriptenHttpResponseWrapper(BaseHTTPResponse):
def __init__(
self,
internal_response: EmscriptenResponse,
url: str | None = None,
connection: BaseHTTPConnection | BaseHTTPSConnection | None = None,
):
self._pool = None # set by pool class
self._body = None
self._response = internal_response
self._url = url
self._connection = connection
self._closed = False
super().__init__(
headers=internal_response.headers,
status=internal_response.status_code,
request_url=url,
version=0,
version_string="HTTP/?",
reason="",
decode_content=True,
)
self.length_remaining = self._init_length(self._response.request.method)
self.length_is_certain = False
@property
def url(self) -> str | None:
return self._url
@url.setter
def url(self, url: str | None) -> None:
self._url = url
@property
def connection(self) -> BaseHTTPConnection | BaseHTTPSConnection | None:
return self._connection
@property
def retries(self) -> Retry | None:
return self._retries
@retries.setter
def retries(self, retries: Retry | None) -> None:
# Override the request_url if retries has a redirect location.
self._retries = retries
def stream(
self, amt: int | None = 2**16, decode_content: bool | None = None
) -> typing.Generator[bytes]:
"""
A generator wrapper for the read() method. A call will block until
``amt`` bytes have been read from the connection or until the
connection is closed.
:param amt:
How much of the content to read. The generator will return up to
much data per iteration, but may return less. This is particularly
likely when using compressed data. However, the empty string will
never be returned.
:param decode_content:
If True, will attempt to decode the body based on the
'content-encoding' header.
"""
while True:
data = self.read(amt=amt, decode_content=decode_content)
if data:
yield data
else:
break
def _init_length(self, request_method: str | None) -> int | None:
length: int | None
content_length: str | None = self.headers.get("content-length")
if content_length is not None:
try:
# RFC 7230 section 3.3.2 specifies multiple content lengths can
# be sent in a single Content-Length header
# (e.g. Content-Length: 42, 42). This line ensures the values
# are all valid ints and that as long as the `set` length is 1,
# all values are the same. Otherwise, the header is invalid.
lengths = {int(val) for val in content_length.split(",")}
if len(lengths) > 1:
raise InvalidHeader(
"Content-Length contained multiple "
"unmatching values (%s)" % content_length
)
length = lengths.pop()
except ValueError:
length = None
else:
if length < 0:
length = None
else: # if content_length is None
length = None
# Check for responses that shouldn't include a body
if (
self.status in (204, 304)
or 100 <= self.status < 200
or request_method == "HEAD"
):
length = 0
return length
def read(
self,
amt: int | None = None,
decode_content: bool | None = None, # ignored because browser decodes always
cache_content: bool = False,
) -> bytes:
if (
self._closed
or self._response is None
or (isinstance(self._response.body, IOBase) and self._response.body.closed)
):
return b""
with self._error_catcher():
# body has been preloaded as a string by XmlHttpRequest
if not isinstance(self._response.body, IOBase):
self.length_remaining = len(self._response.body)
self.length_is_certain = True
# wrap body in IOStream
self._response.body = BytesIO(self._response.body)
if amt is not None and amt >= 0:
# don't cache partial content
cache_content = False
data = self._response.body.read(amt)
if self.length_remaining is not None:
self.length_remaining = max(self.length_remaining - len(data), 0)
if (self.length_is_certain and self.length_remaining == 0) or len(
data
) < amt:
# definitely finished reading, close response stream
self._response.body.close()
return typing.cast(bytes, data)
else: # read all we can (and cache it)
data = self._response.body.read()
if cache_content:
self._body = data
if self.length_remaining is not None:
self.length_remaining = max(self.length_remaining - len(data), 0)
if len(data) == 0 or (
self.length_is_certain and self.length_remaining == 0
):
# definitely finished reading, close response stream
self._response.body.close()
return typing.cast(bytes, data)
def read_chunked(
self,
amt: int | None = None,
decode_content: bool | None = None,
) -> typing.Generator[bytes]:
# chunked is handled by browser
while True:
bytes = self.read(amt, decode_content)
if not bytes:
break
yield bytes
def release_conn(self) -> None:
if not self._pool or not self._connection:
return None
self._pool._put_conn(self._connection)
self._connection = None
def drain_conn(self) -> None:
self.close()
@property
def data(self) -> bytes:
if self._body:
return self._body
else:
return self.read(cache_content=True)
def json(self) -> typing.Any:
"""
Deserializes the body of the HTTP response as a Python object.
The body of the HTTP response must be encoded using UTF-8, as per
`RFC 8529 Section 8.1 `_.
To use a custom JSON decoder pass the result of :attr:`HTTPResponse.data` to
your custom decoder instead.
If the body of the HTTP response is not decodable to UTF-8, a
`UnicodeDecodeError` will be raised. If the body of the HTTP response is not a
valid JSON document, a `json.JSONDecodeError` will be raised.
Read more :ref:`here `.
:returns: The body of the HTTP response as a Python object.
"""
data = self.data.decode("utf-8")
return _json.loads(data)
def close(self) -> None:
if not self._closed:
if isinstance(self._response.body, IOBase):
self._response.body.close()
if self._connection:
self._connection.close()
self._connection = None
self._closed = True
@contextmanager
def _error_catcher(self) -> typing.Generator[None]:
"""
Catch Emscripten specific exceptions thrown by fetch.py,
instead re-raising urllib3 variants, so that low-level exceptions
are not leaked in the high-level api.
On exit, release the connection back to the pool.
"""
from .fetch import _RequestError, _TimeoutError # avoid circular import
clean_exit = False
try:
yield
# If no exception is thrown, we should avoid cleaning up
# unnecessarily.
clean_exit = True
except _TimeoutError as e:
raise TimeoutError(str(e))
except _RequestError as e:
raise HTTPException(str(e))
finally:
# If we didn't terminate cleanly, we need to throw away our
# connection.
if not clean_exit:
# The response may not be closed but we're not going to use it
# anymore so close it now
if (
isinstance(self._response.body, IOBase)
and not self._response.body.closed
):
self._response.body.close()
# release the connection back to the pool
self.release_conn()
else:
# If we have read everything from the response stream,
# return the connection back to the pool.
if (
isinstance(self._response.body, IOBase)
and self._response.body.closed
):
self.release_conn()
PK ! ﱮ' ' 1 emscripten/__pycache__/connection.cpython-312.pycnu [
@gC" r U d dl mZ d dlZd dlZd dlmZ d dlmZ ddlmZ ddl m
Z
m Z m Z ddl
mZ dd lmZ dd
lmZ dd lmZmZ dd lmZ d
dlmZmZmZm Z d
dl m Z d
dlm Z m Z ejB rddlm"Z"m#Z# G d d Z$ G d de$ Z%ejB r e$dd Z&de'd< e%dd Z(de'd< yy) ) annotationsN)
HTTPException)ResponseNotReady )
_TYPE_BODY)HTTPConnection ProxyConfigport_by_scheme) TimeoutError)BaseHTTPResponse)_TYPE_SOCKET_OPTIONS)_DEFAULT_TIMEOUT
_TYPE_TIMEOUT)Url )
_RequestError
_TimeoutError send_requestsend_streaming_request)EmscriptenRequest) EmscriptenHttpResponseWrapperEmscriptenResponse)BaseHTTPConnectionBaseHTTPSConnectionc e Zd ZU ed Zded< ded< ded< ded < d
ed < d
ed < d
ed< ded< ded< ded< dZded< dZded< ded < d*edd dddd d+d Z d, d-d Z
d.d!Z d/dd"d"d"d# d0d$Z d1d%Z
d.d&Zed2d' Zed2d( Zed2d) Zy)3EmscriptenHTTPConnectionhttpztyping.ClassVar[int] default_portz%typing.ClassVar[_TYPE_SOCKET_OPTIONS]default_socket_optionsz None | floattimeoutstrhostintport blocksizetuple[str, int] | Nonesource_address_TYPE_SOCKET_OPTIONS | Nonesocket_options
Url | NoneproxyProxyConfig | None proxy_configFbool is_verifiedNz bool | Noneproxy_is_verifiedzEmscriptenResponse | None _responsei )r r' r% r) r+ r- c || _ || _ t |t r|nd| _ d| _ d| _ d | _ d | _ d | _ || _
d | _ d | _ d| _
y )Ng r TF)r" r$
isinstancefloatr scheme_closedr1 r+ r- r% r' r) r/ ) selfr" r$ r r' r% r) r+ r- s T/opt/hc_python/lib/python3.12/site-packages/urllib3/contrib/emscripten/connection.py__init__z!EmscriptenHTTPConnection.__init__- si ",We" rC rD rE rF requestkves
r8 rR z EmscriptenHTTPConnection.requestT s >># [[MTYYKq > %0"&..NN**..
#$ $r: c d| _ d | _ y )NT)r6 r1 rA s r8 closez EmscriptenHTTPConnection.close s r: c | j S )zWhether the connection either is brand new or has been previously closed.
If this property is True then both ``is_connected`` and ``has_connected_to_proxy``
properties must be False.
)r6 rA s r8 is_closedz"EmscriptenHTTPConnection.is_closed s ||r: c y)zLWhether the connection is actively connected to any origin (proxy or target)Tr= rA s r8 is_connectedz%EmscriptenHTTPConnection.is_connected s r: c y)zWhether the connection has successfully connected to its proxy.
This returns False if no proxy is in use. Used to determine whether
errors are coming from the proxy layer or from tunnelling to the target origin.
Fr= rA s r8 has_connected_to_proxyz/EmscriptenHTTPConnection.has_connected_to_proxy s r: r )r" r! r$ r# r r r' r& r% r# r) r( r+ r* r- r, returnNone)r Nr )
r" r! r$
int | Noner> typing.Mapping[str, str] | Noner5 r! rc rd )rc rd )NN)rK r! rJ r! rQ z_TYPE_BODY | Noner> rf rC r. rD r. rE r. rF r. rc rd )rc r )rc r. )__name__
__module__ __qualname__r
r __annotations__r/ r0 r r9 r? rB rR rY r[ propertyr] r_ ra r= r: r8 r r s )7)?L&? AA
I
IN**// $$ K %){)((
!
"215 6: +/!! !
! /
! ! 4! ! )!
!< 37
1
#'37 &2 $ #'+&2&2 &2 &2
1 &2 &2 &2 &2 !%&2
&2P% r: r c e Zd ZU ed ZdZded< dZded< dZded< dZ ded < ded
< ded < ded < d
ed< dZ
ded< dZ ded< dZ ded< ded< dZ
ded< deddej ddddddddddddddddd d fdZ d d dZ xZS ) EmscriptenHTTPSConnectionhttpsNint | str | None cert_reqs
str | Noneca_certs ca_cert_dirNone | str | bytes ca_cert_data cert_filekey_file key_passwordtyping.Any | None ssl_context ssl_versionre ssl_minimum_versionssl_maximum_version"None | str | typing.Literal[False]assert_hostnameassert_fingerprinti @ )r r' r% r) r+ r- rp r r server_hostnamerz rr rs ru r| r} r{ rv rw rx c
t | |||||||| d| _ || _ || _ || _ |
| _ | | _ |
| _ | | _ || _
|| _ || _ |xr t j j | | _ |xr t j j | | _ || _ d | _ d| _ y )N)r$ r r' r% r) r+ r- rn T)superr9 r5 rw rv rx rz r r r r{ r| r} ospath
expanduserrr rs ru rp r/ )r7 r" r$ r r' r% r) r+ r- rp r r r rz rr rs ru r| r} r{ rv rw rx __class__s r8 r9 z"EmscriptenHTTPSConnection.__init__ s 8 ) )%
" (& . . "4  #6 ARWW%7%7%A
&J277+=+=k+J ( r: c
y r< r= )
r7 rw rv rp rx rr r r rs ru s
r8 set_certz"EmscriptenHTTPSConnection.set_cert s
r: rb ).r" r! r$ r# r r r' r& r% r# r) zNone | _TYPE_SOCKET_OPTIONSr+ r* r- r, rp ro r r~ r rq r rq rz ry rr rq rs rq ru rt r| re r} re r{ ro rv rq rw rq rx rq rc rd ) NNNNNNNNN)rw rq rv rq rp ro rx rq rr rq r r~ r rq rs rq ru rt rc rd )rg rh ri r
r rp rj rr rs ru r{ r| r} r r r r r9 r
__classcell__)r s @r8 rm rm s? !'*L"&I & Hj "K"'+L$+ ""$(K!(&**&**77%)
)
:
"215
1 1 +/&*>B)-&*)- #"&+/*.*.(, $ ##'5: : :
: /
: :
(: : ): $: < : ' : $!: " '#: $ %: & ': ( )): * (+: , (-: . &/: 0 1: 2 3: 4 !5: 6
7: | $ $&*#' #>B)-"&+/
$
!
<
'
)
r: rm r _supports_http_protocolr _supports_https_protocol))
__future__r r typing http.clientr r _base_connectionr rX r r r
exceptionsr responser util.connectionr
util.timeoutr r util.urlr fetchr r r r rR r r r
TYPE_CHECKINGr r r rm r rj r r= r: r8 r s "
7 ( * E E & ( 3 ; U U & G KD DNY
8 Y
z
2J2q2Q /Q4MbRS4T 1T r: PK ! D5i1 i1 / emscripten/__pycache__/response.cpython-312.pycnu [
@g& d dl mZ d dlZd dlZd dlZd dlmZ d dlm Z d dl
m Z d dl m
Z
mZ ddlmZmZ dd lmZ dd
lmZ d d lmZ ej0 rdd
lmZmZ ej8 e Z e G d d Z G d de Z y) ) annotationsN)contextmanager) dataclass)
HTTPException)BytesIOIOBase )
InvalidHeader TimeoutError)BaseHTTPResponse)Retry )EmscriptenRequest)BaseHTTPConnectionBaseHTTPSConnectionc 6 e Zd ZU ded< ded< ded< ded< y )
EmscriptenResponseint status_codezdict[str, str]headerszIOBase | bytesbodyr requestN)__name__
__module__ __qualname____annotations__ R/opt/hc_python/lib/python3.12/site-packages/urllib3/contrib/emscripten/response.pyr r s
r r c J e Zd Z d d fd
Zedd Zej dd Zedd Zedd Zej dd Z d ddZ ddZ
d d d Z d dd
Z d d Z
d d Zed d
Zd dZd dZed d Z xZS )! EmscriptenHttpResponseWrapperc $ d | _ d | _ || _ || _ || _ d| _ t | |j |j |dddd | j | j j j | _
d| _ y )NFr zHTTP/? T)r status request_urlversionversion_stringreasondecode_content)_pool_body _response_url _connection_closedsuper__init__r r _init_lengthr methodlength_remaininglength_is_certain)selfinternal_responseurl
connection __class__s r r1 z&EmscriptenHttpResponseWrapper.__init__ s
* %
%--$00#
!% 1 1$..2H2H2O2O P !& r c | j S Nr- r6 s r r8 z!EmscriptenHttpResponseWrapper.url7 s yyr c || _ y r< r= )r6 r8 s r r8 z!EmscriptenHttpResponseWrapper.url; s r c | j S r< )r. r> s r r9 z(EmscriptenHttpResponseWrapper.connection? s r c | j S r< _retriesr> s r retriesz%EmscriptenHttpResponseWrapper.retriesC s }} r c || _ y r< rB )r6 rD s r rD z%EmscriptenHttpResponseWrapper.retriesG s
r c # D K | j || }|r| ny w)a_
A generator wrapper for the read() method. A call will block until
``amt`` bytes have been read from the connection or until the
connection is closed.
:param amt:
How much of the content to read. The generator will return up to
much data per iteration, but may return less. This is particularly
likely when using compressed data. However, the empty string will
never be returned.
:param decode_content:
If True, will attempt to decode the body based on the
'content-encoding' header.
)amtr) Nread)r6 rG r) datas r streamz$EmscriptenHttpResponseWrapper.streamL s- $ 99^9DD
s c | j j d }|\ |j d D ch c]
}t | }}t | dkD rt d|z |j
}|dk rd }nd }| j dv s d| j cxk rdk sn |d k( rd}|S c c}w # t $ r d }Y @w xY w)
Nzcontent-length,r z8Content-Length contained multiple unmatching values (%s)r ) i0 d HEAD) r getsplitr lenr
pop
ValueErrorr$ )r6 request_methodcontent_lengthvallengthslengths r r2 z*EmscriptenHttpResponseWrapper._init_lengthf s %)\\%5%56F%G %
" 0>/C/CC/HI/H3s8/HIw>..7DNN**t/D/D/I NN''--/ {{5$/= #
"
"s .EJ
=CJ
Jc # @ K | j || }|sy | wr< rH )r6 rG r) rd s r read_chunkedz*EmscriptenHttpResponseWrapper.read_chunked s+ IIc>2EK s c | j r | j sy | j j | j d | _ y r< )r* r. _put_connr> s r release_connz*EmscriptenHttpResponseWrapper.release_conn s4 zz!1!1
T - -. r c $ | j y r< )ra r> s r
drain_connz(EmscriptenHttpResponseWrapper.drain_conn s
r c V | j r | j S | j d S )NT)re )r+ rI r> s r rJ z"EmscriptenHttpResponseWrapper.data s$ :::: 99490 0r c b | j j d }t j | S )a
Deserializes the body of the HTTP response as a Python object.
The body of the HTTP response must be encoded using UTF-8, as per
`RFC 8529 Section 8.1 `_.
To use a custom JSON decoder pass the result of :attr:`HTTPResponse.data` to
your custom decoder instead.
If the body of the HTTP response is not decodable to UTF-8, a
`UnicodeDecodeError` will be raised. If the body of the HTTP response is not a
valid JSON document, a `json.JSONDecodeError` will be raised.
Read more :ref:`here `.
:returns: The body of the HTTP response as a Python object.
zutf-8)rJ decode_jsonloads)r6 rJ s r jsonz"EmscriptenHttpResponseWrapper.json s' $ yy ({{4 r c | j s}t | j j t r$| j j j | j r!| j j d | _ d| _ y y )NT)r/ r] r, r r ra r. r> s r ra z#EmscriptenHttpResponseWrapper.close sb ||$..--v6##))+ &&(#' DL
r c # K ddl m}m} d} d d} |syt
| j j t rD| j j j s$| j j j | j yt
| j j t r2| j j j r| j yyy# |$ r}t t | d}~w|$ r}t t | d}~ww xY w# |syt
| j j t rD| j j j s$| j j j | j w t
| j j t r2| j j j r| j w w w xY ww)z
Catch Emscripten specific exceptions thrown by fetch.py,
instead re-raising urllib3 variants, so that low-level exceptions
are not leaked in the high-level api.
On exit, release the connection back to the pool.
r )
_RequestError
_TimeoutErrorFNT)
fetchru rv r strr r] r, r r r^ ra rj )r6 ru rv
clean_exites r r_ z,EmscriptenHttpResponseWrapper._error_catcher sv 8
( J t~~ 2 2F; NN / / 6 6NN''--/!!#
t~~ 2 2F; ++22%%' 3 <+ ' s1v& & ( A' ' (
t~~ 2 2F; NN / / 6 6NN''--/!!#
t~~ 2 2F; ++22%%' 3 r so "
% ! 6 5 ( & Kg! ($4 (r PK ! 1{
t t . emscripten/__pycache__/request.cpython-312.pycnu [
@g6 J d dl mZ d dlmZmZ ddlmZ e G d d Zy) ) annotations) dataclassfield )
_TYPE_BODYc e Zd ZU ded< ded< dZded< dZded< ee Zd
ed < d Z d
ed< dZ
ded< ddZ ddZ y)EmscriptenRequeststrmethodurlNzdict[str, str] | Noneparams_TYPE_BODY | Nonebody)default_factoryzdict[str, str]headersr floattimeoutTbooldecode_contentc > || j |j < y N)r
capitalize)selfnamevalues Q/opt/hc_python/lib/python3.12/site-packages/urllib3/contrib/emscripten/request.py
set_headerz EmscriptenRequest.set_header s */ T__&' c || _ y r )r )r r s r set_bodyzEmscriptenRequest.set_body s r )r r
r r
returnNone)r r r! r" )
__name__
__module__ __qualname____annotations__r
r r dictr r r r r r r r r sO K H$(F !( "D
" #D 9G^9GU ND 0r r N)
__future__r dataclassesr r _base_connectionr r r( r r r, s' " ( *
r PK ! ζl l / emscripten/__pycache__/__init__.cpython-312.pycnu [
@g @ d dl mZ d dlZddlmZmZ ddlmZm Z ddZ
y) ) annotationsN )HTTPConnectionPoolHTTPSConnectionPool )EmscriptenHTTPConnectionEmscriptenHTTPSConnectionc t t _ t t _ t t
j _ t t
j _ y )N) r r
ConnectionClsr r urllib3
connectionHTTPConnectionHTTPSConnection R/opt/hc_python/lib/python3.12/site-packages/urllib3/contrib/emscripten/__init__.pyinject_into_urllib3r s3 (@$(A%(@G%)BG&r )returnNone)
__future__r urllib3.connectionr connectionpoolr r r
r r r r r r r s " E KCr PK ! (|Zm m , emscripten/__pycache__/fetch.cpython-312.pycnu [
@gSY U d Z ddlmZ ddlZddlZddlmZ ddlmZ ddl m
Z
m Z ddl Z ddl
mZmZmZmZ e
rddlmZ d d
lmZ d d lmZ d Zd
ZdZdZdZ ee j= d j? d Z G d de! Z" G d de" Z# G d de" Z$d2dZ% G d d ejL Z' G d d Z( G d d ejL Z)d3d!Z*d3d"Z+d3d#Z,d3d$Z-dZ.d%e/d&< e- r e+ r e* s e, s e( Z.ndZ.d'Z0d4d(Z1d)a2d5d*Z3d)a4d5d+Z5d6d,Z6 d7d-Z7 d8d.Z8d3d/Z9d9d0Z:d3d1Z;y):a
Support for streaming http requests in emscripten.
A few caveats -
If your browser (or Node.js) has WebAssembly JavaScript Promise Integration enabled
https://github.com/WebAssembly/js-promise-integration/blob/main/proposals/js-promise-integration/Overview.md
*and* you launch pyodide using `pyodide.runPythonAsync`, this will fetch data using the
JavaScript asynchronous fetch api (wrapped via `pyodide.ffi.call_sync`). In this case
timeouts and streaming should just work.
Otherwise, it uses a combination of XMLHttpRequest and a web-worker for streaming.
This approach has several caveats:
Firstly, you can't do streaming http in the main UI thread, because atomics.wait isn't allowed.
Streaming only works if you're running pyodide in a web worker.
Secondly, this uses an extra web worker and SharedArrayBuffer to do the asynchronous fetch
operation, so it requires that you have crossOriginIsolation enabled, by serving over https
(or from localhost) with the two headers below set:
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
You can tell if cross origin isolation is successfully enabled by looking at the global crossOriginIsolated variable in
JavaScript console. If it isn't, streaming requests will fallback to XMLHttpRequest, i.e. getting the whole
request into a buffer and then returning it. it shows a warning in the JavaScript console in this case.
Finally, the webworker which does the streaming fetch is created on initial import, but will only be started once
control is returned to javascript. Call `await wait_for_streaming_ready()` to wait for streaming fetch.
NB: in this code, there are a lot of JavaScript objects. They are named js_*
to make it clear what type of object they are.
) annotationsN)Parser)files)
TYPE_CHECKINGAny)JsArray JsExceptionJsProxyto_js)Buffer )EmscriptenRequest)EmscriptenResponse)z
user-agentzemscripten_fetch_worker.jszutf-8)encodingc 6 e Zd Z dddd d fdZ xZS )
_RequestErrorNrequestresponsec b || _ || _ || _ t | | j y N)r r messagesuper__init__)selfr r r __class__s O/opt/hc_python/lib/python3.12/site-packages/urllib3/contrib/emscripten/fetch.pyr z_RequestError.__init__N s+
& r )r z
str | Noner EmscriptenRequest | Noner EmscriptenResponse | None)__name__
__module__ __qualname__r
__classcell__r s @r! r r M s; #
' -1.2
'
' *
'
,
'
'r" r c e Zd Zy)_StreamingErrorNr% r& r' r" r! r+ r+ [ r" r+ c e Zd Zy)
_TimeoutErrorNr, r- r" r! r0 r0 _ r. r" r0 c L t | t j j S )N)dict_converter)r jsObject fromEntries)dict_vals r! _obj_from_dictr7 c s "))*?*? @@r" c e Zd Z d
dZd dZd dZed d Zd fd Zd dZ d dZ
d dZ d
d Z xZ
S ) _ReadStreamc || _ || _ d| _ d| _ || _ || _ |dkD rt
d|z nd | _ d| _ d| _ || _
y )Nr TF)
int_buffer byte_bufferread_posread_len
connection_idworkerinttimeoutis_live
_is_closedr )r r< r= rC rA r@ r s r! r z_ReadStream.__init__h s] %&
* .5ks4'>*t 18 r" c $ | j y r closer s r! __del__z_ReadStream.__del__|
r" c | j S r rE rI s r! is_closedz_ReadStream.is_closed r" c " | j S r rN rI s r! closedz_ReadStream.closed ~~ r" c | j ry d| _ d| _ d | _ d | _ d| _ d | _ | j r7| j j t d| j i d| _ t | 5 y )Nr TrH F)rN r? r> r< r= rE r rD rA postMessager7 r@ r rH r r s r! rH z_ReadStream.close st >>
<< KK # #NGT=O=O3P$Q R DL
r" c yNTr- rI s r! readablez_ReadStream.readable r" c yNFr- rI s r! writablez_ReadStream.writable r" c yr\ r- rI s r! seekablez_ReadStream.seekable r^ r" c b | j st d| j d | j dk( rYt j
j
| j dt | j j t d| j i t j
j | j dt | j dk( rt | j d }|dkD r|| _ d| _ n|t k( rs| j d }t j" j% }|j' | j( j+ d| }t d| | j d d| _ | j/ yt1 | j t3 t5 | }| j( j7 | j | j |z j9 }|t5 | d| | xj |z c_ | xj |z
c_ |S ) Nz,No buffer for stream in _ReadStream.readintor r getMorez timed-outr
Exception thrown in fetch: F) r< r+ r r? r3 Atomicsstore
ERROR_TIMEOUTrA rU r7 r@ waitrC r0 r> ERROR_EXCEPTION TextDecodernewdecoder= slicerD rH minlen
memoryviewsubarrayto_py)r byte_objdata_len
string_len
js_decoderjson_str
ret_lengthrp s r! readintoz_ReadStream.readinto s !>
==A JJ T__a ? KK # #NIt?Q?Q3R$S T
M4<<P $#q)H!| (
!
_, !__Q /
^^ / / 1
%,,T-=-=-C-CAz-RS%1(< LL ! %
Jx,@(AB
##,, MM4==:5
%' .6
8 Qz*
#
#
r" ) r< r r= r rC floatrA r
r@ rB r r returnNoner{ boolrr r r{ rB )r% r& r' r rJ rN propertyrR rH rY r] r` rx r( r) s @r! r9 r9 g sy 99 9 9
9
9 #9( ,r" r9 c e Zd ZddZddZy)_StreamingFetcherc d _ t j j t t
gd t
ddi }d fd }t j j | }t j j j | _ t j j j | _
y )NF)create_pyproxiestypezapplication/javascriptc h d fd }dfd }|j _ |j _ y )Nc $ d_ | y rX )streaming_ready)e
js_resolve_fnr s r! onMsgzC_StreamingFetcher.__init__..promise_resolver..onMsg s '+$ a r" c | y r r- )r js_reject_fns r! onErrzC_StreamingFetcher.__init__..promise_resolver..onErr s
Qr" )r r
r{ r| ) js_worker onmessageonerror)r r r r r s `` r! promise_resolverz4_StreamingFetcher.__init__..promise_resolver s'
!
(-DNN $%*DNN "r" )r r
r r
r{ r| )r r3 Blobrj r _STREAMING_WORKER_CODEr7 URLcreateObjectURL
globalThisWorkerr Promisejs_worker_ready_promise)r js_data_blobr js_data_urls ` r! r z_StreamingFetcher.__init__ s $ ww{{ )*U C F$<= >
+ ff,,\: --11+>')}}'<'<'@'@AQ'R$r" c
|j j D ci c] \ }}|t vs|| }}}|j }|t | |j
d}|j dkD rt d|j z nd }t j j d }t j j | } t j j |d }
t j j | dt t j j! | d t j" j |j$ t j& j( } | j* j- t/ || |d t j j1 | dt | | d t k( rt3 d|d | d t4 k( r| d } t j6 j }
|
j9 |
j; d| }t= j> | }tA ||d
|d tC | |
|j | j* |d |
S | d tD k( rU| d } t j6 j }
|
j9 |
j; d| }tG d| |d tG d| d |d c c}}w )N)headersbodymethodr r; i )bufferurl fetchParamsz'Timeout connecting to streaming requestr r
statusr connectionID)r status_coder r rc z%Unknown status from worker in fetch: )$r itemsHEADERS_TO_IGNOREr r r rC rB r3 SharedArrayBufferrj
Int32Array
Uint8Arrayrd re rf notifyr r locationhrefr rU r7 rg r0 SUCCESS_HEADERri rk rl jsonloadsr r9 rh r+ )r r kvr r
fetch_datarC js_shared_buffer
js_int_bufferjs_byte_bufferjs_absolute_urlrt ru rv response_objs r! sendz_StreamingFetcher.send s $__ 2 2 4
4TQAR8RAqD 4
||!(%+ X
18 11D#dW__,-$ //33G<
))*:;
**+;Q?
=9
-+ &&**W[["++>CC "" .*#-
q-A } , 9
1
/ 'q)J ++-J "(( )=)=a)LMH ::h/L% ( 2$Y/ !"OONN 0
1
0&q)J ++-J!(( )=)=a)LMH!-hZ8'TX
"7
a8H7IJ
C
s
K&K&Nrz r r r{ r )r% r& r' r r r- r" r! r r s S0Fr" r c e Zd ZdZ d dZd
dZddZedd Zd
fd Z ddZ
ddZ dd Z dd
Z
dd Z xZS )_JSPIReadStreamaF
A read stream that uses pyodide.ffi.run_sync to read from a JavaScript fetch
response. This requires support for WebAssembly JavaScript Promise Integration
in the containing browser, and for pyodide to be launched via runPythonAsync.
:param js_read_stream:
The JavaScript stream reader
:param timeout:
Timeout in seconds
:param request:
The request we're handling
:param response:
The response this stream relates to
:param js_abort_controller:
A JavaScript AbortController object, used for timeouts
c || _ || _ d| _ d| _ || _ || _ d | _ d| _ || _ y )NFr ) js_read_streamrC rE _is_doner r current_buffercurrent_buffer_posjs_abort_controller)r r rC r r r s r! r z_JSPIReadStream.__init__F sG -
18 3;
""# #6 r" c $ | j y r rG rI s r! rJ z_JSPIReadStream.__del__X rK r" c | j S r rM rI s r! rN z_JSPIReadStream.is_closed\ rO r" c " | j S r rQ rI s r! rR z_JSPIReadStream.closed` rS r" c | j ry d| _ d| _ | j j d | _ d| _ d| _ d | _ d | _ t | ) y )Nr T) rN r? r> r cancelrE r r r r rH rV s r! rH z_JSPIReadStream.closed s] >>
""$ "
r" c yrX r- rI s r! rY z_JSPIReadStream.readableq rZ r" c yr\ r- rI s r! r] z_JSPIReadStream.writablet r^ r" c yr\ r- rI s r! r` z_JSPIReadStream.seekablew r^ r" c t | j j | j | j | j
| j }|j rd| _ y|j j | _ d| _ y)Nr TFr )
_run_sync_with_timeoutr readrC r r r doner valuerq r r )r result_jss r! _get_next_bufferz _JSPIReadStream._get_next_bufferz so * $ $ & LL $ $LL]]
>> DM"+//"7"7"9D &'D #r" c | j -| j r | j | j yt t | t | j | j
z
}| j | j
| j
|z |d| | xj
|z
c_ | j
t | j k( rd | _ |S )Nr )r r rH rm rn r )r rr rw s r! rx z_JSPIReadStream.readinto s &((*d.A.A.I
M3t 2 23d6M6MM
"&!4!4 # #d&=&=
&J"
:
:- " "c$*=*=&> >"&D r" )
r r rC ry r r r r r r rz r} r )r% r& r' __doc__r rJ rN r rR rH rY r] r` r rx r( r) s @r! r r 0 sy *77 7 # 7
% 7 !
7$ r" r c t t d xr3 t t d xr! t j t j k( S )Nwindowr )hasattrr3 r r r- r" r! is_in_browser_main_threadr s- 2x QWR%8 QRWW =QQr" c F t t d xr t j S )NcrossOriginIsolated)r r3 r r- r" r! is_cross_origin_isolatedr s 2, - H"2H2HHr" c t t d xri t t j d xrM t t j j d xr' t j j j dk( S )Nprocessreleasenamenode)r r3 r r r r- r" r!
is_in_noder s\ I . BJJ * . BJJ&& / .
JJ # #v - r" c F t t d xr t t d S )Nr r )r r3 r- r" r! is_worker_availabler s 2x 8WR%88r" z_StreamingFetcher | None_fetcherzurllib3 only works in Node.js with pyodide.runPythonAsync and requires the flag --experimental-wasm-stack-switching in versions of node <24.c t r t | d S t rt t | d t
r t
rt
j | S t y )NTr r r ) has_jspisend_jspi_requestr r NODE_JSPI_ERRORr r r _show_streaming_warningr s r! send_streaming_requestr sQ z $// #
O%}}W%% !r" Fc X t s$da d} t j j | y y )NTz8Warning: Timeout is not available on main browser thread)_SHOWN_TIMEOUT_WARNINGr3 consolewarn)r s r! _show_timeout_warningr s% !!% L
"r" c t sZda d} t s| dz
} t r| dz
} t s| dz
} t du r| dz
} dd lm} |j | y y )
NTz%Can't stream HTTP requests because:
z$ Page is not cross-origin isolated
z+ Python is running in main browser thread
z> Worker or Blob classes are not available in this environment.Fz Streaming fetch worker isn't ready. If you want to be sure that streaming fetch
is working, you need to call: 'await urllib3.contrib.emscripten.fetch.wait_for_streaming_ready()`r )r )_SHOWN_STREAMING_WARNINGr r r r r3 r r )r r s r! r r ss ##' :') > >G $ & E EG"$ W WG % e
eG W $r" c t r t | d S t rt t | d t
j j }t s1d|_ | j rEt | j dz |_
n'|j d | j r
t |j | j | j d | j" j% D ]. \ }}|j' t( vs |j+ || 0 |j- t/ | j0 t3 t5 j7 |j9 }t s)|j: j= j? }n|j: jA d }tC |jD ||| S # tF $ rh}|jH dk( rtK |jL | |jH d
k( rt |jL | t |jL | d }~ww xY w) NFr arraybufferr; z text/plain; charset=ISO-8859-15z ISO-8859-15r r r r TimeoutErrorr NetworkError)'r r r r r r3 XMLHttpRequestrj r responseTyperC rB overrideMimeTyper openr r r r lowerr setRequestHeaderr r r dictr parsestrgetAllResponseHeadersr rq tobytesencoder r r r r0 r )r js_xhrr r r r errs r! send_requestr s z %00 #
%>""&&((*"/F !$W__t%;!< # #$E F &' GNNGKK7"??002KD%zz|#44''e4 3 E',,'(vx(()E)E)GHI(*??((*224D??))-8D!
wT7
> 88~ % W= =
XX
' W= = W= =>s C G! CG! ! I*A#I
Ic | j }t j j }| j j D ci c] \ }}|t vs|| }}}| j }|t | | j |j d}t j | j t | } t | ||| d }
i }|
j j } | j! } t# | dd rn2t% | j& d |t% | j& d < P|
j( }
d}t+ |
|d| }|r6|
j V|
j j- }t/ ||| || }n,t |
j1 ||| | j3 }||_ |S c c}}w )
a7
Send a request using WebAssembly JavaScript Promise Integration
to wrap the asynchronous JavaScript fetch api (experimental).
:param request:
Request to send
:param streaming:
Whether to stream the response
:return: The response object
:rtype: EmscriptenResponse
)r r r signalNr r Fr
r r" r )rC r3 AbortControllerrj r r r r r r r fetchr r7 r entriesnextgetattrstrr r r getReaderr arrayBufferrq )r streamingrC r r r r req_bodyr fetcher_promise_js response_js header_iter
iter_value_jsr r r body_stream_jss r! r r & s ooG ,,002 ' 5 5 7V 711DU;Uq!t 7GV||Hh..%,, J '++~j/IJ ) K G %%--/K
#((*
=&% 0 36}7J7J17M3NGC
++A./ 0 $$K!$D! sGH ' ( - - 7 7 9N" ( H{== % % * *+> ?Wt^AT
&( OOH % Y 88| # +Wx
WxX X
Y OOH % s$
A* * B-35B((B--B0 0C
c R ddl m} m} t | S # t $ r Y yw xY w)a
Return true if jspi can be used.
This requires both browser support and also WebAssembly
to be in the correct state - i.e. that the javascript
call into python was async not sync.
:return: True if jspi can be used.
:rtype: bool
r can_run_syncr F)r r% r r~ ImportErrorr$ s r! r r s) 6LN## s &&c 0 t rt j S y r )r r r- r" r! r r s '''r" c N K t rt j d { yy7 w)NTF)r r r- r" r! wait_for_streaming_readyr) s# .... /s %#%)r6 zdict[str, Any]r{ r
r} )r r r{ r$ rz r )r r r r~ r{ r ) r! r rC ry r r r r# r r$ r{ r )r{ z bool | None)r7 s "H # % % ( & ( $
+
X*+YY 'I ' m M Ad",, dN_ _Dhbll hXRI9 &*
" ) (A(C
\ "HH " ! ! &.>bF
F+/FFR3&
3&
3& 3& & 3&
( 3&
3&l&r" PK ! Rh6 6 emscripten/request.pynu [ from __future__ import annotations
from dataclasses import dataclass, field
from ..._base_connection import _TYPE_BODY
@dataclass
class EmscriptenRequest:
method: str
url: str
params: dict[str, str] | None = None
body: _TYPE_BODY | None = None
headers: dict[str, str] = field(default_factory=dict)
timeout: float = 0
decode_content: bool = True
def set_header(self, name: str, value: str) -> None:
self.headers[name.capitalize()] = value
def set_body(self, body: _TYPE_BODY | None) -> None:
self.body = body
PK ! KG G % emscripten/emscripten_fetch_worker.jsnu [ let Status = {
SUCCESS_HEADER: -1,
SUCCESS_EOF: -2,
ERROR_TIMEOUT: -3,
ERROR_EXCEPTION: -4,
};
let connections = {};
let nextConnectionID = 1;
const encoder = new TextEncoder();
self.addEventListener("message", async function (event) {
if (event.data.close) {
let connectionID = event.data.close;
delete connections[connectionID];
return;
} else if (event.data.getMore) {
let connectionID = event.data.getMore;
let { curOffset, value, reader, intBuffer, byteBuffer } =
connections[connectionID];
// if we still have some in buffer, then just send it back straight away
if (!value || curOffset >= value.length) {
// read another buffer if required
try {
let readResponse = await reader.read();
if (readResponse.done) {
// read everything - clear connection and return
delete connections[connectionID];
Atomics.store(intBuffer, 0, Status.SUCCESS_EOF);
Atomics.notify(intBuffer, 0);
// finished reading successfully
// return from event handler
return;
}
curOffset = 0;
connections[connectionID].value = readResponse.value;
value = readResponse.value;
} catch (error) {
console.log("Request exception:", error);
let errorBytes = encoder.encode(error.message);
let written = errorBytes.length;
byteBuffer.set(errorBytes);
intBuffer[1] = written;
Atomics.store(intBuffer, 0, Status.ERROR_EXCEPTION);
Atomics.notify(intBuffer, 0);
}
}
// send as much buffer as we can
let curLen = value.length - curOffset;
if (curLen > byteBuffer.length) {
curLen = byteBuffer.length;
}
byteBuffer.set(value.subarray(curOffset, curOffset + curLen), 0);
Atomics.store(intBuffer, 0, curLen); // store current length in bytes
Atomics.notify(intBuffer, 0);
curOffset += curLen;
connections[connectionID].curOffset = curOffset;
return;
} else {
// start fetch
let connectionID = nextConnectionID;
nextConnectionID += 1;
const intBuffer = new Int32Array(event.data.buffer);
const byteBuffer = new Uint8Array(event.data.buffer, 8);
try {
const response = await fetch(event.data.url, event.data.fetchParams);
// return the headers first via textencoder
var headers = [];
for (const pair of response.headers.entries()) {
headers.push([pair[0], pair[1]]);
}
let headerObj = {
headers: headers,
status: response.status,
connectionID,
};
const headerText = JSON.stringify(headerObj);
let headerBytes = encoder.encode(headerText);
let written = headerBytes.length;
byteBuffer.set(headerBytes);
intBuffer[1] = written;
// make a connection
connections[connectionID] = {
reader: response.body.getReader(),
intBuffer: intBuffer,
byteBuffer: byteBuffer,
value: undefined,
curOffset: 0,
};
// set header ready
Atomics.store(intBuffer, 0, Status.SUCCESS_HEADER);
Atomics.notify(intBuffer, 0);
// all fetching after this goes through a new postmessage call with getMore
// this allows for parallel requests
} catch (error) {
console.log("Request exception:", error);
let errorBytes = encoder.encode(error.message);
let written = errorBytes.length;
byteBuffer.set(errorBytes);
intBuffer[1] = written;
Atomics.store(intBuffer, 0, Status.ERROR_EXCEPTION);
Atomics.notify(intBuffer, 0);
}
}
});
self.postMessage({ inited: true });
PK ! 1C" C" emscripten/connection.pynu [ from __future__ import annotations
import os
import typing
# use http.client.HTTPException for consistency with non-emscripten
from http.client import HTTPException as HTTPException # noqa: F401
from http.client import ResponseNotReady
from ..._base_connection import _TYPE_BODY
from ...connection import HTTPConnection, ProxyConfig, port_by_scheme
from ...exceptions import TimeoutError
from ...response import BaseHTTPResponse
from ...util.connection import _TYPE_SOCKET_OPTIONS
from ...util.timeout import _DEFAULT_TIMEOUT, _TYPE_TIMEOUT
from ...util.url import Url
from .fetch import _RequestError, _TimeoutError, send_request, send_streaming_request
from .request import EmscriptenRequest
from .response import EmscriptenHttpResponseWrapper, EmscriptenResponse
if typing.TYPE_CHECKING:
from ..._base_connection import BaseHTTPConnection, BaseHTTPSConnection
class EmscriptenHTTPConnection:
default_port: typing.ClassVar[int] = port_by_scheme["http"]
default_socket_options: typing.ClassVar[_TYPE_SOCKET_OPTIONS]
timeout: None | (float)
host: str
port: int
blocksize: int
source_address: tuple[str, int] | None
socket_options: _TYPE_SOCKET_OPTIONS | None
proxy: Url | None
proxy_config: ProxyConfig | None
is_verified: bool = False
proxy_is_verified: bool | None = None
_response: EmscriptenResponse | None
def __init__(
self,
host: str,
port: int = 0,
*,
timeout: _TYPE_TIMEOUT = _DEFAULT_TIMEOUT,
source_address: tuple[str, int] | None = None,
blocksize: int = 8192,
socket_options: _TYPE_SOCKET_OPTIONS | None = None,
proxy: Url | None = None,
proxy_config: ProxyConfig | None = None,
) -> None:
self.host = host
self.port = port
self.timeout = timeout if isinstance(timeout, float) else 0.0
self.scheme = "http"
self._closed = True
self._response = None
# ignore these things because we don't
# have control over that stuff
self.proxy = None
self.proxy_config = None
self.blocksize = blocksize
self.source_address = None
self.socket_options = None
self.is_verified = False
def set_tunnel(
self,
host: str,
port: int | None = 0,
headers: typing.Mapping[str, str] | None = None,
scheme: str = "http",
) -> None:
pass
def connect(self) -> None:
pass
def request(
self,
method: str,
url: str,
body: _TYPE_BODY | None = None,
headers: typing.Mapping[str, str] | None = None,
# We know *at least* botocore is depending on the order of the
# first 3 parameters so to be safe we only mark the later ones
# as keyword-only to ensure we have space to extend.
*,
chunked: bool = False,
preload_content: bool = True,
decode_content: bool = True,
enforce_content_length: bool = True,
) -> None:
self._closed = False
if url.startswith("/"):
# no scheme / host / port included, make a full url
url = f"{self.scheme}://{self.host}:{self.port}" + url
request = EmscriptenRequest(
url=url,
method=method,
timeout=self.timeout if self.timeout else 0,
decode_content=decode_content,
)
request.set_body(body)
if headers:
for k, v in headers.items():
request.set_header(k, v)
self._response = None
try:
if not preload_content:
self._response = send_streaming_request(request)
if self._response is None:
self._response = send_request(request)
except _TimeoutError as e:
raise TimeoutError(e.message) from e
except _RequestError as e:
raise HTTPException(e.message) from e
def getresponse(self) -> BaseHTTPResponse:
if self._response is not None:
return EmscriptenHttpResponseWrapper(
internal_response=self._response,
url=self._response.request.url,
connection=self,
)
else:
raise ResponseNotReady()
def close(self) -> None:
self._closed = True
self._response = None
@property
def is_closed(self) -> bool:
"""Whether the connection either is brand new or has been previously closed.
If this property is True then both ``is_connected`` and ``has_connected_to_proxy``
properties must be False.
"""
return self._closed
@property
def is_connected(self) -> bool:
"""Whether the connection is actively connected to any origin (proxy or target)"""
return True
@property
def has_connected_to_proxy(self) -> bool:
"""Whether the connection has successfully connected to its proxy.
This returns False if no proxy is in use. Used to determine whether
errors are coming from the proxy layer or from tunnelling to the target origin.
"""
return False
class EmscriptenHTTPSConnection(EmscriptenHTTPConnection):
default_port = port_by_scheme["https"]
# all this is basically ignored, as browser handles https
cert_reqs: int | str | None = None
ca_certs: str | None = None
ca_cert_dir: str | None = None
ca_cert_data: None | str | bytes = None
cert_file: str | None
key_file: str | None
key_password: str | None
ssl_context: typing.Any | None
ssl_version: int | str | None = None
ssl_minimum_version: int | None = None
ssl_maximum_version: int | None = None
assert_hostname: None | str | typing.Literal[False]
assert_fingerprint: str | None = None
def __init__(
self,
host: str,
port: int = 0,
*,
timeout: _TYPE_TIMEOUT = _DEFAULT_TIMEOUT,
source_address: tuple[str, int] | None = None,
blocksize: int = 16384,
socket_options: (
None | _TYPE_SOCKET_OPTIONS
) = HTTPConnection.default_socket_options,
proxy: Url | None = None,
proxy_config: ProxyConfig | None = None,
cert_reqs: int | str | None = None,
assert_hostname: None | str | typing.Literal[False] = None,
assert_fingerprint: str | None = None,
server_hostname: str | None = None,
ssl_context: typing.Any | None = None,
ca_certs: str | None = None,
ca_cert_dir: str | None = None,
ca_cert_data: None | str | bytes = None,
ssl_minimum_version: int | None = None,
ssl_maximum_version: int | None = None,
ssl_version: int | str | None = None, # Deprecated
cert_file: str | None = None,
key_file: str | None = None,
key_password: str | None = None,
) -> None:
super().__init__(
host,
port=port,
timeout=timeout,
source_address=source_address,
blocksize=blocksize,
socket_options=socket_options,
proxy=proxy,
proxy_config=proxy_config,
)
self.scheme = "https"
self.key_file = key_file
self.cert_file = cert_file
self.key_password = key_password
self.ssl_context = ssl_context
self.server_hostname = server_hostname
self.assert_hostname = assert_hostname
self.assert_fingerprint = assert_fingerprint
self.ssl_version = ssl_version
self.ssl_minimum_version = ssl_minimum_version
self.ssl_maximum_version = ssl_maximum_version
self.ca_certs = ca_certs and os.path.expanduser(ca_certs)
self.ca_cert_dir = ca_cert_dir and os.path.expanduser(ca_cert_dir)
self.ca_cert_data = ca_cert_data
self.cert_reqs = None
# The browser will automatically verify all requests.
# We have no control over that setting.
self.is_verified = True
def set_cert(
self,
key_file: str | None = None,
cert_file: str | None = None,
cert_reqs: int | str | None = None,
key_password: str | None = None,
ca_certs: str | None = None,
assert_hostname: None | str | typing.Literal[False] = None,
assert_fingerprint: str | None = None,
ca_cert_dir: str | None = None,
ca_cert_data: None | str | bytes = None,
) -> None:
pass
# verify that this class implements BaseHTTP(s) connection correctly
if typing.TYPE_CHECKING:
_supports_http_protocol: BaseHTTPConnection = EmscriptenHTTPConnection("", 0)
_supports_https_protocol: BaseHTTPSConnection = EmscriptenHTTPSConnection("", 0)
PK ! nSY SY emscripten/fetch.pynu [ """
Support for streaming http requests in emscripten.
A few caveats -
If your browser (or Node.js) has WebAssembly JavaScript Promise Integration enabled
https://github.com/WebAssembly/js-promise-integration/blob/main/proposals/js-promise-integration/Overview.md
*and* you launch pyodide using `pyodide.runPythonAsync`, this will fetch data using the
JavaScript asynchronous fetch api (wrapped via `pyodide.ffi.call_sync`). In this case
timeouts and streaming should just work.
Otherwise, it uses a combination of XMLHttpRequest and a web-worker for streaming.
This approach has several caveats:
Firstly, you can't do streaming http in the main UI thread, because atomics.wait isn't allowed.
Streaming only works if you're running pyodide in a web worker.
Secondly, this uses an extra web worker and SharedArrayBuffer to do the asynchronous fetch
operation, so it requires that you have crossOriginIsolation enabled, by serving over https
(or from localhost) with the two headers below set:
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
You can tell if cross origin isolation is successfully enabled by looking at the global crossOriginIsolated variable in
JavaScript console. If it isn't, streaming requests will fallback to XMLHttpRequest, i.e. getting the whole
request into a buffer and then returning it. it shows a warning in the JavaScript console in this case.
Finally, the webworker which does the streaming fetch is created on initial import, but will only be started once
control is returned to javascript. Call `await wait_for_streaming_ready()` to wait for streaming fetch.
NB: in this code, there are a lot of JavaScript objects. They are named js_*
to make it clear what type of object they are.
"""
from __future__ import annotations
import io
import json
from email.parser import Parser
from importlib.resources import files
from typing import TYPE_CHECKING, Any
import js # type: ignore[import-not-found]
from pyodide.ffi import ( # type: ignore[import-not-found]
JsArray,
JsException,
JsProxy,
to_js,
)
if TYPE_CHECKING:
from typing_extensions import Buffer
from .request import EmscriptenRequest
from .response import EmscriptenResponse
"""
There are some headers that trigger unintended CORS preflight requests.
See also https://github.com/koenvo/pyodide-http/issues/22
"""
HEADERS_TO_IGNORE = ("user-agent",)
SUCCESS_HEADER = -1
SUCCESS_EOF = -2
ERROR_TIMEOUT = -3
ERROR_EXCEPTION = -4
_STREAMING_WORKER_CODE = (
files(__package__)
.joinpath("emscripten_fetch_worker.js")
.read_text(encoding="utf-8")
)
class _RequestError(Exception):
def __init__(
self,
message: str | None = None,
*,
request: EmscriptenRequest | None = None,
response: EmscriptenResponse | None = None,
):
self.request = request
self.response = response
self.message = message
super().__init__(self.message)
class _StreamingError(_RequestError):
pass
class _TimeoutError(_RequestError):
pass
def _obj_from_dict(dict_val: dict[str, Any]) -> JsProxy:
return to_js(dict_val, dict_converter=js.Object.fromEntries)
class _ReadStream(io.RawIOBase):
def __init__(
self,
int_buffer: JsArray,
byte_buffer: JsArray,
timeout: float,
worker: JsProxy,
connection_id: int,
request: EmscriptenRequest,
):
self.int_buffer = int_buffer
self.byte_buffer = byte_buffer
self.read_pos = 0
self.read_len = 0
self.connection_id = connection_id
self.worker = worker
self.timeout = int(1000 * timeout) if timeout > 0 else None
self.is_live = True
self._is_closed = False
self.request: EmscriptenRequest | None = request
def __del__(self) -> None:
self.close()
# this is compatible with _base_connection
def is_closed(self) -> bool:
return self._is_closed
# for compatibility with RawIOBase
@property
def closed(self) -> bool:
return self.is_closed()
def close(self) -> None:
if self.is_closed():
return
self.read_len = 0
self.read_pos = 0
self.int_buffer = None
self.byte_buffer = None
self._is_closed = True
self.request = None
if self.is_live:
self.worker.postMessage(_obj_from_dict({"close": self.connection_id}))
self.is_live = False
super().close()
def readable(self) -> bool:
return True
def writable(self) -> bool:
return False
def seekable(self) -> bool:
return False
def readinto(self, byte_obj: Buffer) -> int:
if not self.int_buffer:
raise _StreamingError(
"No buffer for stream in _ReadStream.readinto",
request=self.request,
response=None,
)
if self.read_len == 0:
# wait for the worker to send something
js.Atomics.store(self.int_buffer, 0, ERROR_TIMEOUT)
self.worker.postMessage(_obj_from_dict({"getMore": self.connection_id}))
if (
js.Atomics.wait(self.int_buffer, 0, ERROR_TIMEOUT, self.timeout)
== "timed-out"
):
raise _TimeoutError
data_len = self.int_buffer[0]
if data_len > 0:
self.read_len = data_len
self.read_pos = 0
elif data_len == ERROR_EXCEPTION:
string_len = self.int_buffer[1]
# decode the error string
js_decoder = js.TextDecoder.new()
json_str = js_decoder.decode(self.byte_buffer.slice(0, string_len))
raise _StreamingError(
f"Exception thrown in fetch: {json_str}",
request=self.request,
response=None,
)
else:
# EOF, free the buffers and return zero
# and free the request
self.is_live = False
self.close()
return 0
# copy from int32array to python bytes
ret_length = min(self.read_len, len(memoryview(byte_obj)))
subarray = self.byte_buffer.subarray(
self.read_pos, self.read_pos + ret_length
).to_py()
memoryview(byte_obj)[0:ret_length] = subarray
self.read_len -= ret_length
self.read_pos += ret_length
return ret_length
class _StreamingFetcher:
def __init__(self) -> None:
# make web-worker and data buffer on startup
self.streaming_ready = False
js_data_blob = js.Blob.new(
to_js([_STREAMING_WORKER_CODE], create_pyproxies=False),
_obj_from_dict({"type": "application/javascript"}),
)
def promise_resolver(js_resolve_fn: JsProxy, js_reject_fn: JsProxy) -> None:
def onMsg(e: JsProxy) -> None:
self.streaming_ready = True
js_resolve_fn(e)
def onErr(e: JsProxy) -> None:
js_reject_fn(e) # Defensive: never happens in ci
self.js_worker.onmessage = onMsg
self.js_worker.onerror = onErr
js_data_url = js.URL.createObjectURL(js_data_blob)
self.js_worker = js.globalThis.Worker.new(js_data_url)
self.js_worker_ready_promise = js.globalThis.Promise.new(promise_resolver)
def send(self, request: EmscriptenRequest) -> EmscriptenResponse:
headers = {
k: v for k, v in request.headers.items() if k not in HEADERS_TO_IGNORE
}
body = request.body
fetch_data = {"headers": headers, "body": to_js(body), "method": request.method}
# start the request off in the worker
timeout = int(1000 * request.timeout) if request.timeout > 0 else None
js_shared_buffer = js.SharedArrayBuffer.new(1048576)
js_int_buffer = js.Int32Array.new(js_shared_buffer)
js_byte_buffer = js.Uint8Array.new(js_shared_buffer, 8)
js.Atomics.store(js_int_buffer, 0, ERROR_TIMEOUT)
js.Atomics.notify(js_int_buffer, 0)
js_absolute_url = js.URL.new(request.url, js.location).href
self.js_worker.postMessage(
_obj_from_dict(
{
"buffer": js_shared_buffer,
"url": js_absolute_url,
"fetchParams": fetch_data,
}
)
)
# wait for the worker to send something
js.Atomics.wait(js_int_buffer, 0, ERROR_TIMEOUT, timeout)
if js_int_buffer[0] == ERROR_TIMEOUT:
raise _TimeoutError(
"Timeout connecting to streaming request",
request=request,
response=None,
)
elif js_int_buffer[0] == SUCCESS_HEADER:
# got response
# header length is in second int of intBuffer
string_len = js_int_buffer[1]
# decode the rest to a JSON string
js_decoder = js.TextDecoder.new()
# this does a copy (the slice) because decode can't work on shared array
# for some silly reason
json_str = js_decoder.decode(js_byte_buffer.slice(0, string_len))
# get it as an object
response_obj = json.loads(json_str)
return EmscriptenResponse(
request=request,
status_code=response_obj["status"],
headers=response_obj["headers"],
body=_ReadStream(
js_int_buffer,
js_byte_buffer,
request.timeout,
self.js_worker,
response_obj["connectionID"],
request,
),
)
elif js_int_buffer[0] == ERROR_EXCEPTION:
string_len = js_int_buffer[1]
# decode the error string
js_decoder = js.TextDecoder.new()
json_str = js_decoder.decode(js_byte_buffer.slice(0, string_len))
raise _StreamingError(
f"Exception thrown in fetch: {json_str}", request=request, response=None
)
else:
raise _StreamingError(
f"Unknown status from worker in fetch: {js_int_buffer[0]}",
request=request,
response=None,
)
class _JSPIReadStream(io.RawIOBase):
"""
A read stream that uses pyodide.ffi.run_sync to read from a JavaScript fetch
response. This requires support for WebAssembly JavaScript Promise Integration
in the containing browser, and for pyodide to be launched via runPythonAsync.
:param js_read_stream:
The JavaScript stream reader
:param timeout:
Timeout in seconds
:param request:
The request we're handling
:param response:
The response this stream relates to
:param js_abort_controller:
A JavaScript AbortController object, used for timeouts
"""
def __init__(
self,
js_read_stream: Any,
timeout: float,
request: EmscriptenRequest,
response: EmscriptenResponse,
js_abort_controller: Any, # JavaScript AbortController for timeouts
):
self.js_read_stream = js_read_stream
self.timeout = timeout
self._is_closed = False
self._is_done = False
self.request: EmscriptenRequest | None = request
self.response: EmscriptenResponse | None = response
self.current_buffer = None
self.current_buffer_pos = 0
self.js_abort_controller = js_abort_controller
def __del__(self) -> None:
self.close()
# this is compatible with _base_connection
def is_closed(self) -> bool:
return self._is_closed
# for compatibility with RawIOBase
@property
def closed(self) -> bool:
return self.is_closed()
def close(self) -> None:
if self.is_closed():
return
self.read_len = 0
self.read_pos = 0
self.js_read_stream.cancel()
self.js_read_stream = None
self._is_closed = True
self._is_done = True
self.request = None
self.response = None
super().close()
def readable(self) -> bool:
return True
def writable(self) -> bool:
return False
def seekable(self) -> bool:
return False
def _get_next_buffer(self) -> bool:
result_js = _run_sync_with_timeout(
self.js_read_stream.read(),
self.timeout,
self.js_abort_controller,
request=self.request,
response=self.response,
)
if result_js.done:
self._is_done = True
return False
else:
self.current_buffer = result_js.value.to_py()
self.current_buffer_pos = 0
return True
def readinto(self, byte_obj: Buffer) -> int:
if self.current_buffer is None:
if not self._get_next_buffer() or self.current_buffer is None:
self.close()
return 0
ret_length = min(
len(byte_obj), len(self.current_buffer) - self.current_buffer_pos
)
byte_obj[0:ret_length] = self.current_buffer[
self.current_buffer_pos : self.current_buffer_pos + ret_length
]
self.current_buffer_pos += ret_length
if self.current_buffer_pos == len(self.current_buffer):
self.current_buffer = None
return ret_length
# check if we are in a worker or not
def is_in_browser_main_thread() -> bool:
return hasattr(js, "window") and hasattr(js, "self") and js.self == js.window
def is_cross_origin_isolated() -> bool:
return hasattr(js, "crossOriginIsolated") and js.crossOriginIsolated
def is_in_node() -> bool:
return (
hasattr(js, "process")
and hasattr(js.process, "release")
and hasattr(js.process.release, "name")
and js.process.release.name == "node"
)
def is_worker_available() -> bool:
return hasattr(js, "Worker") and hasattr(js, "Blob")
_fetcher: _StreamingFetcher | None = None
if is_worker_available() and (
(is_cross_origin_isolated() and not is_in_browser_main_thread())
and (not is_in_node())
):
_fetcher = _StreamingFetcher()
else:
_fetcher = None
NODE_JSPI_ERROR = (
"urllib3 only works in Node.js with pyodide.runPythonAsync"
" and requires the flag --experimental-wasm-stack-switching in "
" versions of node <24."
)
def send_streaming_request(request: EmscriptenRequest) -> EmscriptenResponse | None:
if has_jspi():
return send_jspi_request(request, True)
elif is_in_node():
raise _RequestError(
message=NODE_JSPI_ERROR,
request=request,
response=None,
)
if _fetcher and streaming_ready():
return _fetcher.send(request)
else:
_show_streaming_warning()
return None
_SHOWN_TIMEOUT_WARNING = False
def _show_timeout_warning() -> None:
global _SHOWN_TIMEOUT_WARNING
if not _SHOWN_TIMEOUT_WARNING:
_SHOWN_TIMEOUT_WARNING = True
message = "Warning: Timeout is not available on main browser thread"
js.console.warn(message)
_SHOWN_STREAMING_WARNING = False
def _show_streaming_warning() -> None:
global _SHOWN_STREAMING_WARNING
if not _SHOWN_STREAMING_WARNING:
_SHOWN_STREAMING_WARNING = True
message = "Can't stream HTTP requests because: \n"
if not is_cross_origin_isolated():
message += " Page is not cross-origin isolated\n"
if is_in_browser_main_thread():
message += " Python is running in main browser thread\n"
if not is_worker_available():
message += " Worker or Blob classes are not available in this environment." # Defensive: this is always False in browsers that we test in
if streaming_ready() is False:
message += """ Streaming fetch worker isn't ready. If you want to be sure that streaming fetch
is working, you need to call: 'await urllib3.contrib.emscripten.fetch.wait_for_streaming_ready()`"""
from js import console
console.warn(message)
def send_request(request: EmscriptenRequest) -> EmscriptenResponse:
if has_jspi():
return send_jspi_request(request, False)
elif is_in_node():
raise _RequestError(
message=NODE_JSPI_ERROR,
request=request,
response=None,
)
try:
js_xhr = js.XMLHttpRequest.new()
if not is_in_browser_main_thread():
js_xhr.responseType = "arraybuffer"
if request.timeout:
js_xhr.timeout = int(request.timeout * 1000)
else:
js_xhr.overrideMimeType("text/plain; charset=ISO-8859-15")
if request.timeout:
# timeout isn't available on the main thread - show a warning in console
# if it is set
_show_timeout_warning()
js_xhr.open(request.method, request.url, False)
for name, value in request.headers.items():
if name.lower() not in HEADERS_TO_IGNORE:
js_xhr.setRequestHeader(name, value)
js_xhr.send(to_js(request.body))
headers = dict(Parser().parsestr(js_xhr.getAllResponseHeaders()))
if not is_in_browser_main_thread():
body = js_xhr.response.to_py().tobytes()
else:
body = js_xhr.response.encode("ISO-8859-15")
return EmscriptenResponse(
status_code=js_xhr.status, headers=headers, body=body, request=request
)
except JsException as err:
if err.name == "TimeoutError":
raise _TimeoutError(err.message, request=request)
elif err.name == "NetworkError":
raise _RequestError(err.message, request=request)
else:
# general http error
raise _RequestError(err.message, request=request)
def send_jspi_request(
request: EmscriptenRequest, streaming: bool
) -> EmscriptenResponse:
"""
Send a request using WebAssembly JavaScript Promise Integration
to wrap the asynchronous JavaScript fetch api (experimental).
:param request:
Request to send
:param streaming:
Whether to stream the response
:return: The response object
:rtype: EmscriptenResponse
"""
timeout = request.timeout
js_abort_controller = js.AbortController.new()
headers = {k: v for k, v in request.headers.items() if k not in HEADERS_TO_IGNORE}
req_body = request.body
fetch_data = {
"headers": headers,
"body": to_js(req_body),
"method": request.method,
"signal": js_abort_controller.signal,
}
# Call JavaScript fetch (async api, returns a promise)
fetcher_promise_js = js.fetch(request.url, _obj_from_dict(fetch_data))
# Now suspend WebAssembly until we resolve that promise
# or time out.
response_js = _run_sync_with_timeout(
fetcher_promise_js,
timeout,
js_abort_controller,
request=request,
response=None,
)
headers = {}
header_iter = response_js.headers.entries()
while True:
iter_value_js = header_iter.next()
if getattr(iter_value_js, "done", False):
break
else:
headers[str(iter_value_js.value[0])] = str(iter_value_js.value[1])
status_code = response_js.status
body: bytes | io.RawIOBase = b""
response = EmscriptenResponse(
status_code=status_code, headers=headers, body=b"", request=request
)
if streaming:
# get via inputstream
if response_js.body is not None:
# get a reader from the fetch response
body_stream_js = response_js.body.getReader()
body = _JSPIReadStream(
body_stream_js, timeout, request, response, js_abort_controller
)
else:
# get directly via arraybuffer
# n.b. this is another async JavaScript call.
body = _run_sync_with_timeout(
response_js.arrayBuffer(),
timeout,
js_abort_controller,
request=request,
response=response,
).to_py()
response.body = body
return response
def _run_sync_with_timeout(
promise: Any,
timeout: float,
js_abort_controller: Any,
request: EmscriptenRequest | None,
response: EmscriptenResponse | None,
) -> Any:
"""
Await a JavaScript promise synchronously with a timeout which is implemented
via the AbortController
:param promise:
Javascript promise to await
:param timeout:
Timeout in seconds
:param js_abort_controller:
A JavaScript AbortController object, used on timeout
:param request:
The request being handled
:param response:
The response being handled (if it exists yet)
:raises _TimeoutError: If the request times out
:raises _RequestError: If the request raises a JavaScript exception
:return: The result of awaiting the promise.
"""
timer_id = None
if timeout > 0:
timer_id = js.setTimeout(
js_abort_controller.abort.bind(js_abort_controller), int(timeout * 1000)
)
try:
from pyodide.ffi import run_sync
# run_sync here uses WebAssembly JavaScript Promise Integration to
# suspend python until the JavaScript promise resolves.
return run_sync(promise)
except JsException as err:
if err.name == "AbortError":
raise _TimeoutError(
message="Request timed out", request=request, response=response
)
else:
raise _RequestError(message=err.message, request=request, response=response)
finally:
if timer_id is not None:
js.clearTimeout(timer_id)
def has_jspi() -> bool:
"""
Return true if jspi can be used.
This requires both browser support and also WebAssembly
to be in the correct state - i.e. that the javascript
call into python was async not sync.
:return: True if jspi can be used.
:rtype: bool
"""
try:
from pyodide.ffi import can_run_sync, run_sync # noqa: F401
return bool(can_run_sync())
except ImportError:
return False
def streaming_ready() -> bool | None:
if _fetcher:
return _fetcher.streaming_ready
else:
return None # no fetcher, return None to signify that
async def wait_for_streaming_ready() -> bool:
if _fetcher:
await _fetcher.js_worker_ready_promise
return True
else:
return False
PK ! `D emscripten/__init__.pynu [ from __future__ import annotations
import urllib3.connection
from ...connectionpool import HTTPConnectionPool, HTTPSConnectionPool
from .connection import EmscriptenHTTPConnection, EmscriptenHTTPSConnection
def inject_into_urllib3() -> None:
# override connection classes to use emscripten specific classes
# n.b. mypy complains about the overriding of classes below
# if it isn't ignored
HTTPConnectionPool.ConnectionCls = EmscriptenHTTPConnection
HTTPSConnectionPool.ConnectionCls = EmscriptenHTTPSConnection
urllib3.connection.HTTPConnection = EmscriptenHTTPConnection # type: ignore[misc,assignment]
urllib3.connection.HTTPSConnection = EmscriptenHTTPSConnection # type: ignore[misc,assignment]
PK ! Ko _securetransport/__init__.pyonu [
abc @ s d S( N( ( ( ( sY /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/__init__.pyt t PK ! N$ $ _securetransport/low_level.pyonu [
abc @ s d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m
Z
m Z e j d e j
Z d Z d Z d Z d d Z d
Z d Z d Z d
Z d Z d Z d S( s
Low-level helpers for the SecureTransport bindings.
These are Python functions that are not directly related to the high-level APIs
but are necessary to get them to work. They include a whole bunch of low-level
CoreFoundation messing about and memory management. The concerns in this module
are almost entirely about trying to avoid memory leaks and providing
appropriate and useful assistance to the higher-level code.
iNi ( t Securityt CoreFoundationt CFConsts; -----BEGIN CERTIFICATE-----
(.*?)
-----END CERTIFICATE-----c C s t j t j | t | S( sv
Given a bytestring, create a CFData object from it. This CFData object must
be CFReleased by the caller.
( R t CFDataCreatet kCFAllocatorDefaultt len( t
bytestring( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_data_from_bytes s c C sw t | } d | D } d | D } t j | | } t j | | } t j t j | | | t j t j S( sK
Given a list of Python tuples, create an associated CFDictionary.
c s s | ] } | d Vq d S( i N( ( t .0t t( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys , s c s s | ] } | d Vq d S( i N( ( R R ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys - s ( R R t CFTypeReft CFDictionaryCreateR t kCFTypeDictionaryKeyCallBackst kCFTypeDictionaryValueCallBacks( t tuplest dictionary_sizet keyst valuest cf_keyst cf_values( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_dictionary_from_tuples% s c C s t j | t j t j } t j | t j } | d k r t j d } t j
| | d t j } | s~ t d n | j } n | d k r | j
d } n | S( s
Creates a Unicode string from a CFString object. Used entirely for error
reporting.
Yes, it annoys me quite a lot that this function is this complex.
i s' Error copying C string from CFStringRefs utf-8N( t ctypest castt POINTERt c_void_pR t CFStringGetCStringPtrR t kCFStringEncodingUTF8t Nonet create_string_buffert CFStringGetCStringt OSErrort valuet decode( R t value_as_void_pt stringt buffert result( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_string_to_unicode; s" c C s | d k r d St j | d } t | } t j | | d k sS | d k r` d | } n | d k rx t j } n | | d S( s[
Checks the return code and throws an exception if there is an error to
report
i Nu u OSStatus %s( R t SecCopyErrorMessageStringR R% R t CFReleaset sslt SSLError( t errort exception_classt cf_error_stringt output( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _assert_no_errorX s
c C s= g t j | D] } t j | j d ^ q } | sL t j d n t j t j d t
j t j } | s t j d n y x | D] } t
| } | s t j d n t j t j | } t j | | s t j d n t j | | t j | q WWn t k
r8t j | n X| S( s
Given a bundle of certs in PEM format, turns them into a CFArray of certs
that can be used to validate a cert chain.
i s No root certificates specifiedi s Unable to allocate memory!s Unable to build cert object!( t
_PEM_CERTS_REt finditert base64t b64decodet groupR( R) R t CFArrayCreateMutableR R t byreft kCFTypeArrayCallBacksR R t SecCertificateCreateWithDataR' t CFArrayAppendValuet Exception( t
pem_bundlet matcht der_certst
cert_arrayt der_bytest certdatat cert( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cert_array_from_pemm s2 1
c C s t j } t j | | k S( s=
Returns True if a given CFTypeRef is a certificate.
( R t SecCertificateGetTypeIDR t CFGetTypeID( t itemt expected( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _is_cert s c C s t j } t j | | k S( s;
Returns True if a given CFTypeRef is an identity.
( R t SecIdentityGetTypeIDR RC ( RD RE ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _is_identity s c C s t j d } t j | d j d } t j | d } t j } t j j | | j d } t
j } t
j | t
| | t d t j | } t | | | f S( s
This function creates a temporary Mac keychain that we can use to work with
credentials. This keychain uses a one-time password and a temporary file to
store the data. We expect to have one keychain per socket. The returned
SecKeychainRef must be freed by the caller, including calling
SecKeychainDelete.
Returns a tuple of the SecKeychainRef and the path to the temporary
directory that contains it.
i( i s utf-8N( t ost urandomR1 t b64encodeR t tempfilet mkdtempt patht joint encodeR t SecKeychainReft SecKeychainCreateR t FalseR R R5 R. ( t random_bytest filenamet passwordt
tempdirectoryt
keychain_patht keychaint status( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _temporary_keychain s
c C sk g } g } d } t | d } | j } Wd QXzt j t j | t | } t j } t j | d d d d d | t
j | } t | t j
| } x t | D] }
t j | |
} t
j | t j } t | r t j | | j | q t | r t j | | j | q q WWd | rSt j | n t j | X| | f S( s
Given a single file, loads all the trust objects from it into arrays and
the keychain.
Returns a tuple of lists: the first list is a list of identities, the
second a list of certs.
t rbNi ( R t opent readR R R R t
CFArrayRefR t
SecItemImportR R5 R. t CFArrayGetCountt ranget CFArrayGetValueAtIndexR R
RF t CFRetaint appendRH R' ( RY RN t certificatest
identitiest result_arrayt ft raw_filedatat filedataR$ t result_countt indexRD ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _load_items_from_file sH
c G sK g } g } d | D } z x= | D]5 } t | | \ } } | j | | j | q& W| s t j } t j | | d t j | } t | | j | t j
| j d n t j t j
d t j t j } x* t j | | D] }
t j | |
q W| SWd x' t j | | D] } t j
| q/WXd S( s
Load certificates and maybe keys from a number of files. Has the end goal
of returning a CFArray containing one SecIdentityRef, and then zero or more
SecCertificateRef objects, suitable for use as a client certificate trust
chain.
c s s | ] } | r | Vq d S( N( ( R RN ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys / s i N( Rn t extendR t SecIdentityReft SecIdentityCreateWithCertificateR R5 R. Re R R' t popR4 R R6 t itertoolst chainR8 ( RY t pathsRf Rg t file_patht new_identitiest new_certst new_identityRZ t trust_chainRD t obj( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _load_client_cert_chain s6
( t __doc__R1 R Rs t reRI R( RL t bindingsR R R t compilet DOTALLR/ R R R% R R. RA RF RH R[ Rn R| ( ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt s(
+ ( ;PK ! y/ / _securetransport/bindings.pyonu [
abc @@ sE d Z d d l m Z d d l Z d d l m Z d d l m Z m Z m Z m
Z
m Z m Z m
Z
m Z m Z d d l m Z m Z m Z e d Z e s e d n e d Z e s e d
n e j d Z e e e e j d Z e d k r+e d e d e d f n e e d e Z e e d e Z e Z! e Z" e Z# e Z$ e Z% e Z& e Z' e Z( e Z) e Z* e
Z+ e e* Z, e Z- e Z. e e$ Z/ e e% Z0 e e& Z1 e e' Z2 e e( Z3 e Z4 e Z5 e Z6 e e Z7 e Z8 e Z9 e e Z: e Z; e Z< e e Z= e Z> e Z? e e Z@ e e ZA e ZB e ZC e ZD e ZE e ZF e ZG yze/ e0 e e8 e e9 e; e e< e= e e1 g e jH _I e. e jH _J g e jK _I e+ e jK _J g e jL _I e+ e jL _J g e jM _I e+ e jM _J e- e/ g e jN _I e7 e jN _J e7 g e jO _I e/ e jO _J e. e g e jP _I e0 e jP _J e, e7 e e: g e jQ _I e. e jQ _J e e e e! e e e= g e jR _I e. e jR _J e= g e jS _I e. e jS _J e/ e3 e e1 g e jT _I e. e jT _J e e. eB e e e
ZU e e. eB e e e e
ZV e@ eU eV g e jW _I e. e jW _J e@ e e
g e jX _I e. e jX _J e@ e1 g e jY _I e. e jY _J e@ e, e! g e jZ _I e. e jZ _J e@ eB g e j[ _I e. e j[ _J e@ e e
g e j\ _I e. e j\ _J e@ g e j] _I e. e j] _J e@ e e
e e
g e j^ _I e. e j^ _J e@ e e
e e
g e j_ _I e. e j_ _J e@ g e j` _I e. e j` _J e@ e e
g e ja _I e. e ja _J e@ e e? e e
g e jb _I e. e jb _J e@ e e? e
g e jc _I e. e jc _J e@ e e
g e jd _e e. e jd _J e@ e e? e e
g e jf _I e. e jf _J e@ e e? g e jg _I e. e jg _J e@ e e> g e jh _I e. e jh _J e@ e eA g e ji _I e. e ji _J eA e1 g e jj _I e. e jj _J eA e! g e jk _l e. e jk _J eA e eC g e jm _I e. e jm _J eA g e jn _I e" e jn _J eA e" g e jo _I e7 e jo _J e- eE eF g e jp _I e@ e jp _J e@ eG e! g e jq _I e. e jq _J e@ e> g e jr _I e. e jr _J e@ e> g e js _I e. e js _J e. e g e jP _I e0 e jP _J eU e _U eV e _V e@ e _@ e> e _> e? e _? e: e _: e= e _= eA e _A eC e _C e8 e _8 e. e _. e0 jt e d e _u e0 jt e d e _v e, g e jw _I e, e jw _J e, g e jx _I d e jx _J e, g e jz _I e+ e jz _J e- e e# g e j{ _I e0 e j{ _J e0 e# g e j| _I e e j| _J e0 e e" e# g e j} _I e e j} _J e- e e" g e j~ _I e/ e j~ _J e/ g e j _I e" e j _J e/ g e j _I e e j _J e- e e, e e, e" e5 e6 g e j _I e3 e j _J e3 e, g e j _I e, e j _J e- e e, e" e4 g e j _I e1 e j _J e- e" e4 g e j _I e2 e j _J e2 e g e j _I d e j _J e1 g e j _I e" e j _J e1 e" g e j _I e e j _J e- jt e d e _ e jt e d e _ e jt e d e _ e jt e d e _ e, e _, e1 e _1 e0 e _0 e3 e _3 Wn e k
r e d n Xd e f d YZ d e f d YZ d S( sy
This module uses ctypes to bind a whole bunch of functions and constants from
SecureTransport. The goal here is to provide the low-level API to
SecureTransport. These are essentially the C-level functions and constants, and
they're pretty gross to work with.
This code is a bastardised version of the code found in Will Bond's oscrypto
library. An enormous debt is owed to him for blazing this trail for us. For
that reason, this code should be considered to be covered both by urllib3's
license and by oscrypto's:
Copyright (c) 2015-2016 Will Bond
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
i ( t absolute_importN( t find_library( t c_void_pt c_int32t c_char_pt c_size_tt c_bytet c_uint32t c_ulongt c_longt c_bool( t CDLLt POINTERt CFUNCTYPEt Securitys' The library Security could not be foundt CoreFoundations- The library CoreFoundation could not be foundt .i
i s1 Only OS X 10.8 and newer are supported, not %s.%si t use_errnot kSecImportExportPassphraset kSecImportItemIdentityt kCFAllocatorDefaultt kCFTypeArrayCallBackst kCFTypeDictionaryKeyCallBackst kCFTypeDictionaryValueCallBackss Error initializing ctypest CFConstc B@ s e Z d Z e d Z RS( s_
A class object that acts as essentially a namespace for CoreFoundation
constants.
i ( t __name__t
__module__t __doc__t CFStringEncodingt kCFStringEncodingUTF8( ( ( sY /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/bindings.pyR s t
SecurityConstc B@ s e Z d Z d Z d Z d Z d Z d Z d Z d Z d Z
d Z d Z d Z
d Z d Z d Z d
Z d Z d Z d Z d
Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z! d Z" d Z# d Z$ d Z% d Z& d Z' d Z( d! Z) d" Z* d# Z+ d$ Z, d% Z- d& Z. d' Z/ d( Z0 d) Z1 d* Z2 d+ Z3 d, Z4 d- Z5 d. Z6 d/ Z7 d0 Z8 d1 Z9 d2 Z: d3 Z; d4 Z< d5 Z= d6 Z> d7 Z? d8 Z@ d9 ZA d: ZB d; ZC d< ZD d= ZE d> ZF d? ZG d@ ZH dA ZI RS(B sU
A class object that acts as essentially a namespace for Security constants.
i i i i i i i
i i i iiiiiiiiiiiiiiiiiii iQi,iRi, i0 i+ i/ i i i i i$ i( i
i ik ij i9 i8 i# i' i i ig i@ i3 i2 i i i= i< i5 i/ i i i (J R R R t" kSSLSessionOptionBreakOnServerAutht
kSSLProtocol2t
kSSLProtocol3t
kTLSProtocol1t kTLSProtocol11t kTLSProtocol12t kSSLClientSidet kSSLStreamTypet kSecFormatPEMSequencet kSecTrustResultInvalidt kSecTrustResultProceedt kSecTrustResultDenyt kSecTrustResultUnspecifiedt& kSecTrustResultRecoverableTrustFailuret kSecTrustResultFatalTrustFailuret kSecTrustResultOtherErrort errSSLProtocolt errSSLWouldBlockt errSSLClosedGracefult errSSLClosedNoNotifyt errSSLClosedAbortt errSSLXCertChainInvalidt errSSLCryptot errSSLInternalt errSSLCertExpiredt errSSLCertNotYetValidt errSSLUnknownRootCertt errSSLNoRootCertt errSSLHostNameMismatcht errSSLPeerHandshakeFailt errSSLPeerUserCancelledt errSSLWeakPeerEphemeralDHKeyt errSSLServerAuthCompletedt errSSLRecordOverflowt errSecVerifyFailedt errSecNoTrustSettingst errSecItemNotFoundt errSecInvalidTrustSettingst' TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384t% TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384t' TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256t% TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256t# TLS_DHE_DSS_WITH_AES_256_GCM_SHA384t# TLS_DHE_RSA_WITH_AES_256_GCM_SHA384t# TLS_DHE_DSS_WITH_AES_128_GCM_SHA256t# TLS_DHE_RSA_WITH_AES_128_GCM_SHA256t' TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384t% TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384t$ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAt" TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAt# TLS_DHE_RSA_WITH_AES_256_CBC_SHA256t# TLS_DHE_DSS_WITH_AES_256_CBC_SHA256t TLS_DHE_RSA_WITH_AES_256_CBC_SHAt TLS_DHE_DSS_WITH_AES_256_CBC_SHAt' TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256t% TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256t$ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAt" TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAt# TLS_DHE_RSA_WITH_AES_128_CBC_SHA256t# TLS_DHE_DSS_WITH_AES_128_CBC_SHA256t TLS_DHE_RSA_WITH_AES_128_CBC_SHAt TLS_DHE_DSS_WITH_AES_128_CBC_SHAt TLS_RSA_WITH_AES_256_GCM_SHA384t TLS_RSA_WITH_AES_128_GCM_SHA256t TLS_RSA_WITH_AES_256_CBC_SHA256t TLS_RSA_WITH_AES_128_CBC_SHA256t TLS_RSA_WITH_AES_256_CBC_SHAt TLS_RSA_WITH_AES_128_CBC_SHAt TLS_AES_128_GCM_SHA256t TLS_AES_256_GCM_SHA384t TLS_CHACHA20_POLY1305_SHA256( ( ( sY /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/bindings.pyR s ( i
i ( R t
__future__R t platformt ctypes.utilR t ctypesR R R R R R R R R
R R R
t
security_patht ImportErrort core_foundation_patht mac_vert versiont tuplet mapt intt splitt version_infot OSErrort TrueR R t Booleant CFIndexR t CFDatat CFStringt CFArrayt CFMutableArrayt CFDictionaryt CFErrort CFTypet CFTypeIDt CFTypeReft CFAllocatorReft OSStatust CFDataReft CFStringReft
CFArrayReft CFMutableArrayReft CFDictionaryReft CFArrayCallBackst CFDictionaryKeyCallBackst CFDictionaryValueCallBackst SecCertificateReft SecExternalFormatt SecExternalItemTypet SecIdentityReft SecItemImportExportFlagst SecItemImportExportKeyParameterst SecKeychainReft SSLProtocolt SSLCipherSuitet
SSLContextReft SecTrustReft SSLConnectionReft SecTrustResultTypet SecTrustOptionFlagst SSLProtocolSidet SSLConnectionTypet SSLSessionOptiont
SecItemImportt argtypest restypet SecCertificateGetTypeIDt SecIdentityGetTypeIDt SecKeyGetTypeIDt SecCertificateCreateWithDatat SecCertificateCopyDatat SecCopyErrorMessageStringt SecIdentityCreateWithCertificatet SecKeychainCreatet SecKeychainDeletet SecPKCS12Importt SSLReadFunct SSLWriteFunct
SSLSetIOFuncst SSLSetPeerIDt SSLSetCertificatet SSLSetCertificateAuthoritiest SSLSetConnectiont SSLSetPeerDomainNamet SSLHandshaket SSLReadt SSLWritet SSLCloset SSLGetNumberSupportedCipherst SSLGetSupportedCipherst SSLSetEnabledCipherst SSLGetNumberEnabledCipherst argtypet SSLGetEnabledCipherst SSLGetNegotiatedCiphert SSLGetNegotiatedProtocolVersiont SSLCopyPeerTrustt SecTrustSetAnchorCertificatest! SecTrustSetAnchorCertificatesOnlyt argstypest SecTrustEvaluatet SecTrustGetCertificateCountt SecTrustGetCertificateAtIndext SSLCreateContextt SSLSetSessionOptiont SSLSetProtocolVersionMint SSLSetProtocolVersionMaxt in_dllR R t CFRetaint CFReleaset Nonet CFGetTypeIDt CFStringCreateWithCStringt CFStringGetCStringPtrt CFStringGetCStringt CFDataCreatet CFDataGetLengtht CFDataGetBytePtrt CFDictionaryCreatet CFDictionaryGetValuet
CFArrayCreatet CFArrayCreateMutablet CFArrayAppendValuet CFArrayGetCountt CFArrayGetValueAtIndexR R R R t AttributeErrort objectR R ( ( ( sY /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/bindings.pyt s, @ !
PK ! N$ $ _securetransport/low_level.pycnu [
abc @ s d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l m Z m
Z
m Z e j d e j
Z d Z d Z d Z d d Z d
Z d Z d Z d
Z d Z d Z d S( s
Low-level helpers for the SecureTransport bindings.
These are Python functions that are not directly related to the high-level APIs
but are necessary to get them to work. They include a whole bunch of low-level
CoreFoundation messing about and memory management. The concerns in this module
are almost entirely about trying to avoid memory leaks and providing
appropriate and useful assistance to the higher-level code.
iNi ( t Securityt CoreFoundationt CFConsts; -----BEGIN CERTIFICATE-----
(.*?)
-----END CERTIFICATE-----c C s t j t j | t | S( sv
Given a bytestring, create a CFData object from it. This CFData object must
be CFReleased by the caller.
( R t CFDataCreatet kCFAllocatorDefaultt len( t
bytestring( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_data_from_bytes s c C sw t | } d | D } d | D } t j | | } t j | | } t j t j | | | t j t j S( sK
Given a list of Python tuples, create an associated CFDictionary.
c s s | ] } | d Vq d S( i N( ( t .0t t( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys , s c s s | ] } | d Vq d S( i N( ( R R ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys - s ( R R t CFTypeReft CFDictionaryCreateR t kCFTypeDictionaryKeyCallBackst kCFTypeDictionaryValueCallBacks( t tuplest dictionary_sizet keyst valuest cf_keyst cf_values( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_dictionary_from_tuples% s c C s t j | t j t j } t j | t j } | d k r t j d } t j
| | d t j } | s~ t d n | j } n | d k r | j
d } n | S( s
Creates a Unicode string from a CFString object. Used entirely for error
reporting.
Yes, it annoys me quite a lot that this function is this complex.
i s' Error copying C string from CFStringRefs utf-8N( t ctypest castt POINTERt c_void_pR t CFStringGetCStringPtrR t kCFStringEncodingUTF8t Nonet create_string_buffert CFStringGetCStringt OSErrort valuet decode( R t value_as_void_pt stringt buffert result( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cf_string_to_unicode; s" c C s | d k r d St j | d } t | } t j | | d k sS | d k r` d | } n | d k rx t j } n | | d S( s[
Checks the return code and throws an exception if there is an error to
report
i Nu u OSStatus %s( R t SecCopyErrorMessageStringR R% R t CFReleaset sslt SSLError( t errort exception_classt cf_error_stringt output( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _assert_no_errorX s
c C s= g t j | D] } t j | j d ^ q } | sL t j d n t j t j d t
j t j } | s t j d n y x | D] } t
| } | s t j d n t j t j | } t j | | s t j d n t j | | t j | q WWn t k
r8t j | n X| S( s
Given a bundle of certs in PEM format, turns them into a CFArray of certs
that can be used to validate a cert chain.
i s No root certificates specifiedi s Unable to allocate memory!s Unable to build cert object!( t
_PEM_CERTS_REt finditert base64t b64decodet groupR( R) R t CFArrayCreateMutableR R t byreft kCFTypeArrayCallBacksR R t SecCertificateCreateWithDataR' t CFArrayAppendValuet Exception( t
pem_bundlet matcht der_certst
cert_arrayt der_bytest certdatat cert( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _cert_array_from_pemm s2 1
c C s t j } t j | | k S( s=
Returns True if a given CFTypeRef is a certificate.
( R t SecCertificateGetTypeIDR t CFGetTypeID( t itemt expected( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _is_cert s c C s t j } t j | | k S( s;
Returns True if a given CFTypeRef is an identity.
( R t SecIdentityGetTypeIDR RC ( RD RE ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _is_identity s c C s t j d } t j | d j d } t j | d } t j } t j j | | j d } t
j } t
j | t
| | t d t j | } t | | | f S( s
This function creates a temporary Mac keychain that we can use to work with
credentials. This keychain uses a one-time password and a temporary file to
store the data. We expect to have one keychain per socket. The returned
SecKeychainRef must be freed by the caller, including calling
SecKeychainDelete.
Returns a tuple of the SecKeychainRef and the path to the temporary
directory that contains it.
i( i s utf-8N( t ost urandomR1 t b64encodeR t tempfilet mkdtempt patht joint encodeR t SecKeychainReft SecKeychainCreateR t FalseR R R5 R. ( t random_bytest filenamet passwordt
tempdirectoryt
keychain_patht keychaint status( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _temporary_keychain s
c C sk g } g } d } t | d } | j } Wd QXzt j t j | t | } t j } t j | d d d d d | t
j | } t | t j
| } x t | D] }
t j | |
} t
j | t j } t | r t j | | j | q t | r t j | | j | q q WWd | rSt j | n t j | X| | f S( s
Given a single file, loads all the trust objects from it into arrays and
the keychain.
Returns a tuple of lists: the first list is a list of identities, the
second a list of certs.
t rbNi ( R t opent readR R R R t
CFArrayRefR t
SecItemImportR R5 R. t CFArrayGetCountt ranget CFArrayGetValueAtIndexR R
RF t CFRetaint appendRH R' ( RY RN t certificatest
identitiest result_arrayt ft raw_filedatat filedataR$ t result_countt indexRD ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _load_items_from_file sH
c G sK g } g } d | D } z x= | D]5 } t | | \ } } | j | | j | q& W| s t j } t j | | d t j | } t | | j | t j
| j d n t j t j
d t j t j } x* t j | | D] }
t j | |
q W| SWd x' t j | | D] } t j
| q/WXd S( s
Load certificates and maybe keys from a number of files. Has the end goal
of returning a CFArray containing one SecIdentityRef, and then zero or more
SecCertificateRef objects, suitable for use as a client certificate trust
chain.
c s s | ] } | r | Vq d S( N( ( R RN ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pys / s i N( Rn t extendR t SecIdentityReft SecIdentityCreateWithCertificateR R5 R. Re R R' t popR4 R R6 t itertoolst chainR8 ( RY t pathsRf Rg t file_patht new_identitiest new_certst new_identityRZ t trust_chainRD t obj( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt _load_client_cert_chain s6
( t __doc__R1 R Rs t reRI R( RL t bindingsR R R t compilet DOTALLR/ R R R% R R. RA RF RH R[ Rn R| ( ( ( sZ /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.pyt s(
+ ( ;PK ! y/ / _securetransport/bindings.pycnu [
abc @@ sE d Z d d l m Z d d l Z d d l m Z d d l m Z m Z m Z m
Z
m Z m Z m
Z
m Z m Z d d l m Z m Z m Z e d Z e s e d n e d Z e s e d
n e j d Z e e e e j d Z e d k r+e d e d e d f n e e d e Z e e d e Z e Z! e Z" e Z# e Z$ e Z% e Z& e Z' e Z( e Z) e Z* e
Z+ e e* Z, e Z- e Z. e e$ Z/ e e% Z0 e e& Z1 e e' Z2 e e( Z3 e Z4 e Z5 e Z6 e e Z7 e Z8 e Z9 e e Z: e Z; e Z< e e Z= e Z> e Z? e e Z@ e e ZA e ZB e ZC e ZD e ZE e ZF e ZG yze/ e0 e e8 e e9 e; e e< e= e e1 g e jH _I e. e jH _J g e jK _I e+ e jK _J g e jL _I e+ e jL _J g e jM _I e+ e jM _J e- e/ g e jN _I e7 e jN _J e7 g e jO _I e/ e jO _J e. e g e jP _I e0 e jP _J e, e7 e e: g e jQ _I e. e jQ _J e e e e! e e e= g e jR _I e. e jR _J e= g e jS _I e. e jS _J e/ e3 e e1 g e jT _I e. e jT _J e e. eB e e e
ZU e e. eB e e e e
ZV e@ eU eV g e jW _I e. e jW _J e@ e e
g e jX _I e. e jX _J e@ e1 g e jY _I e. e jY _J e@ e, e! g e jZ _I e. e jZ _J e@ eB g e j[ _I e. e j[ _J e@ e e
g e j\ _I e. e j\ _J e@ g e j] _I e. e j] _J e@ e e
e e
g e j^ _I e. e j^ _J e@ e e
e e
g e j_ _I e. e j_ _J e@ g e j` _I e. e j` _J e@ e e
g e ja _I e. e ja _J e@ e e? e e
g e jb _I e. e jb _J e@ e e? e
g e jc _I e. e jc _J e@ e e
g e jd _e e. e jd _J e@ e e? e e
g e jf _I e. e jf _J e@ e e? g e jg _I e. e jg _J e@ e e> g e jh _I e. e jh _J e@ e eA g e ji _I e. e ji _J eA e1 g e jj _I e. e jj _J eA e! g e jk _l e. e jk _J eA e eC g e jm _I e. e jm _J eA g e jn _I e" e jn _J eA e" g e jo _I e7 e jo _J e- eE eF g e jp _I e@ e jp _J e@ eG e! g e jq _I e. e jq _J e@ e> g e jr _I e. e jr _J e@ e> g e js _I e. e js _J e. e g e jP _I e0 e jP _J eU e _U eV e _V e@ e _@ e> e _> e? e _? e: e _: e= e _= eA e _A eC e _C e8 e _8 e. e _. e0 jt e d e _u e0 jt e d e _v e, g e jw _I e, e jw _J e, g e jx _I d e jx _J e, g e jz _I e+ e jz _J e- e e# g e j{ _I e0 e j{ _J e0 e# g e j| _I e e j| _J e0 e e" e# g e j} _I e e j} _J e- e e" g e j~ _I e/ e j~ _J e/ g e j _I e" e j _J e/ g e j _I e e j _J e- e e, e e, e" e5 e6 g e j _I e3 e j _J e3 e, g e j _I e, e j _J e- e e, e" e4 g e j _I e1 e j _J e- e" e4 g e j _I e2 e j _J e2 e g e j _I d e j _J e1 g e j _I e" e j _J e1 e" g e j _I e e j _J e- jt e d e _ e jt e d e _ e jt e d e _ e jt e d e _ e, e _, e1 e _1 e0 e _0 e3 e _3 Wn e k
r e d n Xd e f d YZ d e f d YZ d S( sy
This module uses ctypes to bind a whole bunch of functions and constants from
SecureTransport. The goal here is to provide the low-level API to
SecureTransport. These are essentially the C-level functions and constants, and
they're pretty gross to work with.
This code is a bastardised version of the code found in Will Bond's oscrypto
library. An enormous debt is owed to him for blazing this trail for us. For
that reason, this code should be considered to be covered both by urllib3's
license and by oscrypto's:
Copyright (c) 2015-2016 Will Bond
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
i ( t absolute_importN( t find_library( t c_void_pt c_int32t c_char_pt c_size_tt c_bytet c_uint32t c_ulongt c_longt c_bool( t CDLLt POINTERt CFUNCTYPEt Securitys' The library Security could not be foundt CoreFoundations- The library CoreFoundation could not be foundt .i
i s1 Only OS X 10.8 and newer are supported, not %s.%si t use_errnot kSecImportExportPassphraset kSecImportItemIdentityt kCFAllocatorDefaultt kCFTypeArrayCallBackst kCFTypeDictionaryKeyCallBackst kCFTypeDictionaryValueCallBackss Error initializing ctypest CFConstc B@ s e Z d Z e d Z RS( s_
A class object that acts as essentially a namespace for CoreFoundation
constants.
i ( t __name__t
__module__t __doc__t CFStringEncodingt kCFStringEncodingUTF8( ( ( sY /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/bindings.pyR s t
SecurityConstc B@ s e Z d Z d Z d Z d Z d Z d Z d Z d Z d Z
d Z d Z d Z
d Z d Z d Z d
Z d Z d Z d Z d
Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z! d Z" d Z# d Z$ d Z% d Z& d Z' d Z( d! Z) d" Z* d# Z+ d$ Z, d% Z- d& Z. d' Z/ d( Z0 d) Z1 d* Z2 d+ Z3 d, Z4 d- Z5 d. Z6 d/ Z7 d0 Z8 d1 Z9 d2 Z: d3 Z; d4 Z< d5 Z= d6 Z> d7 Z? d8 Z@ d9 ZA d: ZB d; ZC d< ZD d= ZE d> ZF d? ZG d@ ZH dA ZI RS(B sU
A class object that acts as essentially a namespace for Security constants.
i i i i i i i
i i i iiiiiiiiiiiiiiiiiii iQi,iRi, i0 i+ i/ i i i i i$ i( i
i ik ij i9 i8 i# i' i i ig i@ i3 i2 i i i= i< i5 i/ i i i (J R R R t" kSSLSessionOptionBreakOnServerAutht
kSSLProtocol2t
kSSLProtocol3t
kTLSProtocol1t kTLSProtocol11t kTLSProtocol12t kSSLClientSidet kSSLStreamTypet kSecFormatPEMSequencet kSecTrustResultInvalidt kSecTrustResultProceedt kSecTrustResultDenyt kSecTrustResultUnspecifiedt& kSecTrustResultRecoverableTrustFailuret kSecTrustResultFatalTrustFailuret kSecTrustResultOtherErrort errSSLProtocolt errSSLWouldBlockt errSSLClosedGracefult errSSLClosedNoNotifyt errSSLClosedAbortt errSSLXCertChainInvalidt errSSLCryptot errSSLInternalt errSSLCertExpiredt errSSLCertNotYetValidt errSSLUnknownRootCertt errSSLNoRootCertt errSSLHostNameMismatcht errSSLPeerHandshakeFailt errSSLPeerUserCancelledt errSSLWeakPeerEphemeralDHKeyt errSSLServerAuthCompletedt errSSLRecordOverflowt errSecVerifyFailedt errSecNoTrustSettingst errSecItemNotFoundt errSecInvalidTrustSettingst' TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384t% TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384t' TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256t% TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256t# TLS_DHE_DSS_WITH_AES_256_GCM_SHA384t# TLS_DHE_RSA_WITH_AES_256_GCM_SHA384t# TLS_DHE_DSS_WITH_AES_128_GCM_SHA256t# TLS_DHE_RSA_WITH_AES_128_GCM_SHA256t' TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384t% TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384t$ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAt" TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAt# TLS_DHE_RSA_WITH_AES_256_CBC_SHA256t# TLS_DHE_DSS_WITH_AES_256_CBC_SHA256t TLS_DHE_RSA_WITH_AES_256_CBC_SHAt TLS_DHE_DSS_WITH_AES_256_CBC_SHAt' TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256t% TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256t$ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAt" TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAt# TLS_DHE_RSA_WITH_AES_128_CBC_SHA256t# TLS_DHE_DSS_WITH_AES_128_CBC_SHA256t TLS_DHE_RSA_WITH_AES_128_CBC_SHAt TLS_DHE_DSS_WITH_AES_128_CBC_SHAt TLS_RSA_WITH_AES_256_GCM_SHA384t TLS_RSA_WITH_AES_128_GCM_SHA256t TLS_RSA_WITH_AES_256_CBC_SHA256t TLS_RSA_WITH_AES_128_CBC_SHA256t TLS_RSA_WITH_AES_256_CBC_SHAt TLS_RSA_WITH_AES_128_CBC_SHAt TLS_AES_128_GCM_SHA256t TLS_AES_256_GCM_SHA384t TLS_CHACHA20_POLY1305_SHA256( ( ( sY /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/bindings.pyR s ( i
i ( R t
__future__R t platformt ctypes.utilR t ctypesR R R R R R R R R
R R R
t
security_patht ImportErrort core_foundation_patht mac_vert versiont tuplet mapt intt splitt version_infot OSErrort TrueR R t Booleant CFIndexR t CFDatat CFStringt CFArrayt CFMutableArrayt CFDictionaryt CFErrort CFTypet CFTypeIDt CFTypeReft CFAllocatorReft OSStatust CFDataReft CFStringReft
CFArrayReft CFMutableArrayReft CFDictionaryReft CFArrayCallBackst CFDictionaryKeyCallBackst CFDictionaryValueCallBackst SecCertificateReft SecExternalFormatt SecExternalItemTypet SecIdentityReft SecItemImportExportFlagst SecItemImportExportKeyParameterst SecKeychainReft SSLProtocolt SSLCipherSuitet
SSLContextReft SecTrustReft SSLConnectionReft SecTrustResultTypet SecTrustOptionFlagst SSLProtocolSidet SSLConnectionTypet SSLSessionOptiont
SecItemImportt argtypest restypet SecCertificateGetTypeIDt SecIdentityGetTypeIDt SecKeyGetTypeIDt SecCertificateCreateWithDatat SecCertificateCopyDatat SecCopyErrorMessageStringt SecIdentityCreateWithCertificatet SecKeychainCreatet SecKeychainDeletet SecPKCS12Importt SSLReadFunct SSLWriteFunct
SSLSetIOFuncst SSLSetPeerIDt SSLSetCertificatet SSLSetCertificateAuthoritiest SSLSetConnectiont SSLSetPeerDomainNamet SSLHandshaket SSLReadt SSLWritet SSLCloset SSLGetNumberSupportedCipherst SSLGetSupportedCipherst SSLSetEnabledCipherst SSLGetNumberEnabledCipherst argtypet SSLGetEnabledCipherst SSLGetNegotiatedCiphert SSLGetNegotiatedProtocolVersiont SSLCopyPeerTrustt SecTrustSetAnchorCertificatest! SecTrustSetAnchorCertificatesOnlyt argstypest SecTrustEvaluatet SecTrustGetCertificateCountt SecTrustGetCertificateAtIndext SSLCreateContextt SSLSetSessionOptiont SSLSetProtocolVersionMint SSLSetProtocolVersionMaxt in_dllR R t CFRetaint CFReleaset Nonet CFGetTypeIDt CFStringCreateWithCStringt CFStringGetCStringPtrt CFStringGetCStringt CFDataCreatet CFDataGetLengtht CFDataGetBytePtrt CFDictionaryCreatet CFDictionaryGetValuet
CFArrayCreatet CFArrayCreateMutablet CFArrayAppendValuet CFArrayGetCountt CFArrayGetValueAtIndexR R R R t AttributeErrort objectR R ( ( ( sY /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/bindings.pyt s, @ !
PK ! Ko _securetransport/__init__.pycnu [
abc @ s d S( N( ( ( ( sY /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/_securetransport/__init__.pyt t PK ! oe __init__.pyonu [
abc @ s d S( N( ( ( ( sH /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/__init__.pyt t PK ! GۇD D
pyopenssl.pyonu [
abc @@ s d Z d d l m Z d d l Z d d l m Z d d l m Z d d l
m Z d d l m
Z
m Z d d l m Z y d d l m Z Wn' e k
r d Z d
d l m Z n Xd d l Z d d l Z d
d l m Z d d l Z d
d
l m Z d d g Z e Z i e j! j" e j# 6e j! j$ e j% 6Z& e' e d rie' e j! d rie j! j( e& e j) e j? e@ ZA d ZB d ZC d ZD d ZE d ZF d eG f d YZH e rd d ZI n e ZI eI eH _I d eG f d YZJ d! ZK d S(" sb
SSL with SNI_-support for Python 2. Follow these instructions if you would
like to verify SSL certificates in Python 2. Note, the default libraries do
*not* do certificate checking; you need to do additional work to validate
certificates yourself.
This needs the following packages installed:
* pyOpenSSL (tested with 16.0.0)
* cryptography (minimum 1.3.4, from pyopenssl)
* idna (minimum 2.0, from cryptography)
However, pyopenssl depends on cryptography, which depends on idna, so while we
use all three directly here we end up having relatively few packages required.
You can install them with the following command:
pip install pyopenssl cryptography idna
To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this::
try:
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
except ImportError:
pass
Now you can use :mod:`urllib3` as you normally would, and it will support SNI
when the required modules are installed.
Activating this module also has the positive side effect of disabling SSL/TLS
compression in Python 2 (see `CRIME attack`_).
If you want to configure the default list of supported cipher suites, you can
set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.
.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)
i ( t absolute_importN( t x509( t backend( t _Certificate( t timeoutt error( t BytesIO( t _fileobjecti ( t backport_makefile( t six( t utilt inject_into_urllib3t extract_from_urllib3t PROTOCOL_TLSv1_1t TLSv1_1_METHODt PROTOCOL_TLSv1_2t TLSv1_2_METHODc c@ s! | ] \ } } | | f Vq d S( N( ( t .0t kt v( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pys ` s i @ c C@ sA t t t j _ t t _ t t j _ t t _ t t j _ d S( s7 Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.N( t _validate_dependencies_mett PyOpenSSLContextR
t ssl_t
SSLContextt HAS_SNIt Truet IS_PYOPENSSL( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR m s c C@ s: t t j _ t t _ t t j _ t t _ t t j _ d S( s4 Undo monkey-patching by :func:`inject_into_urllib3`.N( t orig_util_SSLContextR
R R t orig_util_HAS_SNIR t FalseR ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR y s
c C@ s{ d d l m } t | d d d k r7 t d n d d l m } | } t | d d d k rw t d n d S( s{
Verifies that PyOpenSSL's package-level dependencies have been met.
Throws `ImportError` if they are not met.
i ( t
Extensionst get_extension_for_classsX 'cryptography' module missing required functionality. Try upgrading to v1.3.4 or newer.( t X509t _x509sS 'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.N( t cryptography.x509.extensionsR t getattrt Nonet ImportErrort OpenSSL.cryptoR ( R R R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c C@ s: d } | | } t j d k r6 | j d } n | S( s
Converts a dNSName SubjectAlternativeName field to the form used by the
standard library on the given Python version.
Cryptography produces a dNSName as a unicode string that was idna-decoded
from ASCII bytes. We need to idna-encode that string to get it back, and
then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
c S@ si d d l } xM d d g D]? } | j | r | t | } | j d | j | Sq W| j | S( s
Borrowed wholesale from the Python Cryptography Project. It turns out
that we can't just safely call `idna.encode`: it can explode for
wildcard names. This avoids that problem.
i Nu *.u .t ascii( t idnat
startswitht lent encode( t nameR( t prefix( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt idna_encode s i i s utf-8( i i ( t syst version_infot decode( R, R. ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _dnsname_to_stdlib s
c C@ s t | d r | j } n t t | j } y | j j t j j } WnM t j
k
rc g St j t j t j
t f k
r } t j d | g SXg | j t j D] } d t | f ^ q } | j d | j t j D | S( sU
Given an PyOpenSSL certificate, provides all the subject alternative names.
t to_cryptographys A problem was encountered with the certificate that prevented urllib3 from finding the SubjectAlternativeName field. This can affect certificate validation. The error was %st DNSc s@ s! | ] } d t | f Vq d S( s
IP AddressN( t str( R R, ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pys s ( t hasattrR3 R t openssl_backendR! t
extensionsR R t SubjectAlternativeNamet valuet ExtensionNotFoundt DuplicateExtensiont UnsupportedExtensiont UnsupportedGeneralNameTypet UnicodeErrort logt warningt get_values_for_typet DNSNameR2 t extendt IPAddress( t peer_certt certt extt eR, t names( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt get_subj_alt_name s(
.t
WrappedSocketc B@ s e Z d Z e d Z d Z d Z d Z d Z d Z d Z
d Z d Z d
Z
e d Z d Z d
Z RS( s API-compatibility wrapper for Python OpenSSL's Connection-class.
Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
collector of pypy.
c C@ s1 | | _ | | _ | | _ d | _ t | _ d S( Ni ( t
connectiont sockett suppress_ragged_eofst _makefile_refsR t _closed( t selfRM RN RO ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt __init__ s
c C@ s
| j j S( N( RN t fileno( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRT s c C@ s; | j d k r! | j d 8_ n | j r7 | j n d S( Ni i ( RP RQ t close( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _decref_socketios s c O@ s y | j j | | } Wn t j j k
rb } | j rM | j d k rM d St t | n t j j k
r } | j j
t j j k r d S n^ t j j k
r t
j | j | j j } | s t d q | j | | Sn X| Sd S( Nis Unexpected EOFt s The read operation timed out( is Unexpected EOF( RM t recvt OpenSSLt SSLt SysCallErrorRO t argst SocketErrorR5 t ZeroReturnErrort get_shutdownt RECEIVED_SHUTDOWNt
WantReadErrorR
t
wait_for_readRN t
gettimeoutR ( RR R\ t kwargst dataRI t rd( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRX s c O@ s y | j j | | SWn t j j k
r` } | j rK | j d k rK d St t | n t j j k
r } | j j
t j j k r d S nZ t j j k
r t
j | j | j j } | s t d q | j | | Sn Xd S( Nis Unexpected EOFi s The read operation timed out( is Unexpected EOF( RM t recv_intoRY RZ R[ RO R\ R] R5 R^ R_ R` Ra R
Rb RN Rc R ( RR R\ Rd RI Rf ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRg s c C@ s | j j | S( N( RN t
settimeout( RR R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRh * s c C@ s x t r y | j j | SWq t j j k
ri t j | j | j j } | s t
q q q t j j k
r } t t
| q Xq Wd S( N( R RM t sendRY RZ t WantWriteErrorR
t wait_for_writeRN Rc R R[ R] R5 ( RR Re t wrRI ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _send_until_done- s c C@ sG d } x: | t | k rB | j | | | t ! } | | 7} q Wd S( Ni ( R* Rm t SSL_WRITE_BLOCKSIZE( RR Re t
total_sentt sent( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt sendall9 s c C@ s | j j d S( N( RM t shutdown( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRr ? s c C@ sZ | j d k rG y t | _ | j j SWqV t j j k
rC d SXn | j d 8_ d S( Ni ( RP R RQ RM RU RY RZ t Error( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRU C s c C@ se | j j } | s | S| r8 t j j t j j | Si d | j j f f f d 6t | d 6S( Nt
commonNamet subjectt subjectAltName( RM t get_peer_certificateRY t cryptot dump_certificatet
FILETYPE_ASN1t get_subjectt CNRK ( RR t binary_formR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt getpeercertM s c C@ s | j d 7_ d S( Ni ( RP ( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _reuse_ s c C@ s/ | j d k r | j n | j d 8_ d S( Ni ( RP RU ( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _dropb s
( t __name__t
__module__t __doc__R RS RT RV RX Rg Rh Rm Rq Rr RU R R~ R R ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRL s
ic C@ s% | j d 7_ t | | | d t S( Ni RU ( RP R R ( RR t modet bufsize( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt makefilej s R c B@ s e Z d Z d Z e d Z e j d Z e d Z e j d Z d Z d Z d d d d Z d d d Z e
e e d d
Z RS( s
I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
for translating the interface of the standard library ``SSLContext`` object
to calls into PyOpenSSL.
c C@ s; t | | _ t j j | j | _ d | _ t | _ d S( Ni ( t _openssl_versionst protocolRY RZ t Contextt _ctxt _optionsR t check_hostname( RR R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRS y s
c C@ s | j S( N( R ( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt options s c C@ s | | _ | j j | d S( N( R R t set_options( RR R: ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c C@ s t | j j S( N( t _openssl_to_stdlib_verifyR t get_verify_mode( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt verify_mode s c C@ s | j j t | t d S( N( R t
set_verifyt _stdlib_to_openssl_verifyt _verify_callback( RR R: ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c C@ s | j j d S( N( R t set_default_verify_paths( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c C@ s8 t | t j r$ | j d } n | j j | d S( Ns utf-8( t
isinstanceR t text_typeR+ R t set_cipher_list( RR t ciphers( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt set_ciphers s c C@ sx | d k r | j d } n | d k r< | j d } n | j j | | | d k rt | j j t | n d S( Ns utf-8( R$ R+ R t load_verify_locationsR ( RR t cafilet capatht cadata( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c @ sR | j j | d k r8 | j j f d n | j j | pJ | d S( Nc @ s S( N( ( t
max_lengtht prompt_twicet userdata( t password( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt RW ( R t use_certificate_fileR$ t
set_passwd_cbt use_privatekey_file( RR t certfilet keyfileR ( ( R sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt load_cert_chain s c C@ s t j j | j | } t | t j r< | j d } n | d k rX | j | n | j
x t r y | j Wnr t j j
k
r t j | | j } | se t d qe qe n, t j j k
r } t j d | n XPqe Wt | | S( Ns utf-8s select timed outs bad handshake: %r( RY RZ t
ConnectionR R R R R+ R$ t set_tlsext_host_namet set_connect_stateR t do_handshakeRa R
Rb Rc R Rs t sslt SSLErrorRL ( RR t sockt server_sidet do_handshake_on_connectRO t server_hostnamet cnxRf RI ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt wrap_socket s$
N( R R R RS t propertyR t setterR R R R$ R R R R R ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s s c C@ s
| d k S( Ni ( ( R R t err_not err_deptht return_code( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s (L R t
__future__R t OpenSSL.SSLRY t cryptographyR t$ cryptography.hazmat.backends.opensslR R7 t) cryptography.hazmat.backends.openssl.x509R RN R R R] t ioR R R% R$ t packages.backports.makefileR t loggingR t packagesR R/ RW R
t __all__R R RZ t
SSLv23_METHODt PROTOCOL_SSLv23t TLSv1_METHODt PROTOCOL_TLSv1R R6 R R
R R t updatet SSLv3_METHODt PROTOCOL_SSLv3t AttributeErrort VERIFY_NONEt CERT_NONEt VERIFY_PEERt
CERT_OPTIONALt VERIFY_FAIL_IF_NO_PEER_CERTt
CERT_REQUIREDR t dictt itemsR Rn R R R R t getLoggerR R@ R R R R2 RK t objectRL R R R ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt + sh
!!!
3 SPK ! 8bX X securetransport.pyonu [
abc ! @@ s d Z d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
m Z d d l m Z m Z m Z d d l m Z m Z m Z m Z y d d l m Z Wn' e k
r
e Z d d
l m Z n Xy e d Wn e k
r;e d n Xd
d g Z e Z! e j! Z" e j# j$ Z% e j& Z' e j( Z) d Z* e j+ e j, e j- e j. e j/ e j0 e j1 e j2 e j3 e j4 e j5 e j6 e j7 e j8 e j9 e j: e j; e j< e j= e j> e j? e j@ e jA e jB e jC e jD e jE e jF e jG e jH e jI e jJ e jK g! ZL i e jM e jN f e
jO 6ZP eQ e
d re jR e jR f eP e
jS
Undo monkey-patching by :func:`inject_into_urllib3`.
N( t orig_util_SSLContextR R R t orig_util_HAS_SNIR t FalseR ( ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR
s
c C@ s d } yt j | } | d k r+ t j S| j } | d } | j } d } d } t j | j | } t
| }
y x | | k r| d k s | d k r t j | g | } | s t j
t j d q n | j |
| | ! } | | 7} | s~ | s t j SPq~ q~ WWnV t j
k
rl}
|
j } | d k rm| t j k rm| t j k rct j S qmn X| | d <| | k rt j Sd SWn/ t k
r}
| d k r|
| _ n t j SXd S( ss
SecureTransport read callback. This is called by ST to request that data
be returned from the socket.
i s timed outN( t Nonet _connection_refst getR t errSSLInternalt sockett
gettimeoutt ctypest c_chart from_addresst
memoryviewR t
wait_for_readt errort errnot EAGAINt recv_intot errSSLClosedGracefult
ECONNRESETt errSSLClosedAbortt errSSLWouldBlockt Exceptiont
_exception( t
connection_idt data_buffert data_length_pointert wrapped_sockett base_sockett requested_lengtht timeoutR( t
read_countt buffert buffer_viewt readablest
chunk_sizet e( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _read_callback sN
c
C@ s d } yet j | } | d k r+ t j S| j } | d } t j | | } | j } d } d } y x | | k r | d k s | d k r t j
| g | }
|
s t j t j
d q n | j | } | | 7} | | } qn WWnV t j k
rH} | j } | d k rI| t j
k rI| t j k r?t j S qIn X| | d <| | k rft j Sd SWn/ t k
r} | d k r| | _ n t j SXd S( sx
SecureTransport write callback. This is called by ST to request that data
actually be sent on the network.
i s timed outN( R R R R R R! R# t string_atR" R t wait_for_writeR( R) R* t sendR- R. R/ R0 R1 (
R2 R3 R4 R5 R6 t bytes_to_writet dataR8 R( t sentt writablest
chunk_sentR> ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _write_callback sD
t
WrappedSocketc B@ s e Z d Z d Z e j d Z d Z d Z d Z d Z
d Z d Z d d Z d
Z d Z d Z d
Z d Z d Z e d Z d Z d Z RS( s
API-compatibility wrapper for Python's OpenSSL wrapped socket object.
Note: _makefile_refs, _drop(), and _reuse() are needed for the garbage
collector of PyPy.
c C@ sn | | _ d | _ d | _ t | _ d | _ d | _ d | _ d | _ | j j
| _ | j j d d S( Ni (
R! R t contextt _makefile_refsR t _closedR1 t _keychaint
_keychain_dirt _client_cert_chainR" t _timeoutt
settimeout( t selfR! ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt __init__. s c c@ sG d | _ d V| j d k rC | j d } | _ | j | n d S( s]
A context manager that can be used to wrap calls that do I/O from
SecureTransport. If any of the I/O callbacks hit an exception, this
context manager will correctly propagate the exception after the fact.
This avoids silently swallowing those exceptions.
It also correctly forces the socket closed.
N( R R1 t close( RR t exception( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _raise_on_error@ s
c C@ sE t j t t t } t j | j | t t } t | d S( s4
Sets up the allowed ciphers. By default this matches the set in
util.ssl_.DEFAULT_CIPHERS, at least as supported by macOS. This is done
custom and doesn't allow changing at this time, mostly because parsing
OpenSSL cipher strings is going to be a freaking nightmare.
N( R t SSLCipherSuitet lent
CIPHER_SUITESt SSLSetEnabledCiphersRJ R ( RR t cipherst result( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _set_ciphersU s c C@ s | s
d St j j | rC t | d } | j } Wd QXn d } t j } z t | } t j | j
t j | } t
| | s t j d n t j | | } t
| t j | t } t
| t j } t j | t j | } t
| Wd | r't j | n | d k rCt j | n Xt j t j f } | j | k r~t j d | j n d S( s
Called when we have set custom validation. We do this in two cases:
first, when cert validation is entirely disabled; and second, when
using a custom trust DB.
Nt rbs Failed to copy trust references) certificate verify failed, error code: %d( t ost patht isfilet opent readR R t SecTrustRefR t SSLCopyPeerTrustRJ R# t byrefR t sslt SSLErrort SecTrustSetAnchorCertificatest! SecTrustSetAnchorCertificatesOnlyR t SecTrustResultTypet SecTrustEvaluateR t CFReleaseR t kSecTrustResultUnspecifiedt kSecTrustResultProceedt value( RR t verifyt trust_bundlet ft
cert_arrayt trustR\ t trust_resultt successes( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _custom_validateb s@
c C@ s[ t j d t j t j | _ t j | j t t } t
| t @ t | d }
x |
t
k rw |
d d }
qZ W| t
|
Z ( > ic C@ s% | j d 7_ t | | | d t S( Ni RT ( RK R R ( RR t modet bufsize( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt makefile s t rc O@ s d } t | | | | | S( Ni ( R
( RR R t bufferingt argst kwargs( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s R c B@ s e Z d Z d Z e d Z e j d Z e d Z e j d Z e d Z e j d Z d Z d Z
d
Z d d d d Z
d d d Z e e e d d
Z RS( s
I am a wrapper class for the SecureTransport library, to translate the
interface of the standard library ``SSLContext`` object to calls into
SecureTransport.
c C@ sP t | \ | _ | _ d | _ t | _ d | _ d | _ d | _ d | _
d S( Ni ( t _protocol_to_min_maxt _min_versiont _max_versiont _optionsR t _verifyR t
_trust_bundlet _client_certt _client_keyt _client_key_passphrase( RR t protocol( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyRS s c C@ s t S( s
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
( R ( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt check_hostname s c C@ s d S( s
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
N( ( RR Rp ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s c C@ s | j S( N( R ( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt options s c C@ s
| | _ d S( N( R ( RR Rp ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s c C@ s | j r t j St j S( N( R Rg t
CERT_REQUIREDt CERT_NONE( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt verify_mode s c C@ s" | t j k r t n t | _ d S( N( Rg R R R R ( RR Rp ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s c C@ s d S( N( ( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt set_default_verify_paths s
c C@ s
| j S( N( R ( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt load_default_certs s c C@ s% | t j j k r! t d n d S( Ns5 SecureTransport doesn't support custom cipher strings( R R t DEFAULT_CIPHERSR ( RR R[ ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt set_ciphers s c C@ s. | d k r t d n | p$ | | _ d S( Ns1 SecureTransport does not support cert directories( R R R ( RR t cafilet capatht cadata( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt load_verify_locations s c C@ s | | _ | | _ | | _ d S( N( R R t _client_cert_passphrase( RR t certfilet keyfilet password( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt load_cert_chain s c C@ sG t | } | j | | j | j | j | j | j | j | j | S( N( RI R R R R R R R R ( RR t sockt server_sidet do_handshake_on_connectt suppress_ragged_eofsR R5 ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt wrap_socket s N( R R R RS t propertyR t setterR R R R R R R R R R R ( ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s
(g R t
__future__R R R# R) t os.pathR_ R R! Rg t threadingt weakrefR R t _securetransport.bindingsR R R t _securetransport.low_levelR R R R R t ImportErrorR t packages.backports.makefileR
R& t NameErrort __all__R R R R R R t WeakValueDictionaryR t LockR R t TLS_AES_256_GCM_SHA384t TLS_CHACHA20_POLY1305_SHA256t TLS_AES_128_GCM_SHA256t' TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384t% TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384t' TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256t% TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256t# TLS_DHE_DSS_WITH_AES_256_GCM_SHA384t# TLS_DHE_RSA_WITH_AES_256_GCM_SHA384t# TLS_DHE_DSS_WITH_AES_128_GCM_SHA256t# TLS_DHE_RSA_WITH_AES_128_GCM_SHA256t' TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384t% TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384t$ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAt" TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAt# TLS_DHE_RSA_WITH_AES_256_CBC_SHA256t# TLS_DHE_DSS_WITH_AES_256_CBC_SHA256t TLS_DHE_RSA_WITH_AES_256_CBC_SHAt TLS_DHE_DSS_WITH_AES_256_CBC_SHAt' TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256t% TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256t$ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAt" TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAt# TLS_DHE_RSA_WITH_AES_128_CBC_SHA256t# TLS_DHE_DSS_WITH_AES_128_CBC_SHA256t TLS_DHE_RSA_WITH_AES_128_CBC_SHAt TLS_DHE_DSS_WITH_AES_128_CBC_SHAt TLS_RSA_WITH_AES_256_GCM_SHA384t TLS_RSA_WITH_AES_128_GCM_SHA256t TLS_RSA_WITH_AES_256_CBC_SHA256t TLS_RSA_WITH_AES_128_CBC_SHA256t TLS_RSA_WITH_AES_256_CBC_SHAt TLS_RSA_WITH_AES_128_CBC_SHARY t
kTLSProtocol1t kTLSProtocol12t PROTOCOL_SSLv23R t hasattrt
kSSLProtocol2R t
kSSLProtocol3R R t kTLSProtocol11R R R R R
R? RH t SSLReadFuncR} t SSLWriteFuncR~ t objectRI R R ( ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt s "
9 5 PK ! GۇD D
pyopenssl.pycnu [
abc @@ s d Z d d l m Z d d l Z d d l m Z d d l m Z d d l
m Z d d l m
Z
m Z d d l m Z y d d l m Z Wn' e k
r d Z d
d l m Z n Xd d l Z d d l Z d
d l m Z d d l Z d
d
l m Z d d g Z e Z i e j! j" e j# 6e j! j$ e j% 6Z& e' e d rie' e j! d rie j! j( e& e j) e j? e@ ZA d ZB d ZC d ZD d ZE d ZF d eG f d YZH e rd d ZI n e ZI eI eH _I d eG f d YZJ d! ZK d S(" sb
SSL with SNI_-support for Python 2. Follow these instructions if you would
like to verify SSL certificates in Python 2. Note, the default libraries do
*not* do certificate checking; you need to do additional work to validate
certificates yourself.
This needs the following packages installed:
* pyOpenSSL (tested with 16.0.0)
* cryptography (minimum 1.3.4, from pyopenssl)
* idna (minimum 2.0, from cryptography)
However, pyopenssl depends on cryptography, which depends on idna, so while we
use all three directly here we end up having relatively few packages required.
You can install them with the following command:
pip install pyopenssl cryptography idna
To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this::
try:
import urllib3.contrib.pyopenssl
urllib3.contrib.pyopenssl.inject_into_urllib3()
except ImportError:
pass
Now you can use :mod:`urllib3` as you normally would, and it will support SNI
when the required modules are installed.
Activating this module also has the positive side effect of disabling SSL/TLS
compression in Python 2 (see `CRIME attack`_).
If you want to configure the default list of supported cipher suites, you can
set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable.
.. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication
.. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit)
i ( t absolute_importN( t x509( t backend( t _Certificate( t timeoutt error( t BytesIO( t _fileobjecti ( t backport_makefile( t six( t utilt inject_into_urllib3t extract_from_urllib3t PROTOCOL_TLSv1_1t TLSv1_1_METHODt PROTOCOL_TLSv1_2t TLSv1_2_METHODc c@ s! | ] \ } } | | f Vq d S( N( ( t .0t kt v( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pys ` s i @ c C@ sA t t t j _ t t _ t t j _ t t _ t t j _ d S( s7 Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.N( t _validate_dependencies_mett PyOpenSSLContextR
t ssl_t
SSLContextt HAS_SNIt Truet IS_PYOPENSSL( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR m s c C@ s: t t j _ t t _ t t j _ t t _ t t j _ d S( s4 Undo monkey-patching by :func:`inject_into_urllib3`.N( t orig_util_SSLContextR
R R t orig_util_HAS_SNIR t FalseR ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR y s
c C@ s{ d d l m } t | d d d k r7 t d n d d l m } | } t | d d d k rw t d n d S( s{
Verifies that PyOpenSSL's package-level dependencies have been met.
Throws `ImportError` if they are not met.
i ( t
Extensionst get_extension_for_classsX 'cryptography' module missing required functionality. Try upgrading to v1.3.4 or newer.( t X509t _x509sS 'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.N( t cryptography.x509.extensionsR t getattrt Nonet ImportErrort OpenSSL.cryptoR ( R R R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c C@ s: d } | | } t j d k r6 | j d } n | S( s
Converts a dNSName SubjectAlternativeName field to the form used by the
standard library on the given Python version.
Cryptography produces a dNSName as a unicode string that was idna-decoded
from ASCII bytes. We need to idna-encode that string to get it back, and
then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).
c S@ si d d l } xM d d g D]? } | j | r | t | } | j d | j | Sq W| j | S( s
Borrowed wholesale from the Python Cryptography Project. It turns out
that we can't just safely call `idna.encode`: it can explode for
wildcard names. This avoids that problem.
i Nu *.u .t ascii( t idnat
startswitht lent encode( t nameR( t prefix( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt idna_encode s i i s utf-8( i i ( t syst version_infot decode( R, R. ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _dnsname_to_stdlib s
c C@ s t | d r | j } n t t | j } y | j j t j j } WnM t j
k
rc g St j t j t j
t f k
r } t j d | g SXg | j t j D] } d t | f ^ q } | j d | j t j D | S( sU
Given an PyOpenSSL certificate, provides all the subject alternative names.
t to_cryptographys A problem was encountered with the certificate that prevented urllib3 from finding the SubjectAlternativeName field. This can affect certificate validation. The error was %st DNSc s@ s! | ] } d t | f Vq d S( s
IP AddressN( t str( R R, ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pys s ( t hasattrR3 R t openssl_backendR! t
extensionsR R t SubjectAlternativeNamet valuet ExtensionNotFoundt DuplicateExtensiont UnsupportedExtensiont UnsupportedGeneralNameTypet UnicodeErrort logt warningt get_values_for_typet DNSNameR2 t extendt IPAddress( t peer_certt certt extt eR, t names( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt get_subj_alt_name s(
.t
WrappedSocketc B@ s e Z d Z e d Z d Z d Z d Z d Z d Z d Z
d Z d Z d
Z
e d Z d Z d
Z RS( s API-compatibility wrapper for Python OpenSSL's Connection-class.
Note: _makefile_refs, _drop() and _reuse() are needed for the garbage
collector of pypy.
c C@ s1 | | _ | | _ | | _ d | _ t | _ d S( Ni ( t
connectiont sockett suppress_ragged_eofst _makefile_refsR t _closed( t selfRM RN RO ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt __init__ s
c C@ s
| j j S( N( RN t fileno( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRT s c C@ s; | j d k r! | j d 8_ n | j r7 | j n d S( Ni i ( RP RQ t close( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _decref_socketios s c O@ s y | j j | | } Wn t j j k
rb } | j rM | j d k rM d St t | n t j j k
r } | j j
t j j k r d S n^ t j j k
r t
j | j | j j } | s t d q | j | | Sn X| Sd S( Nis Unexpected EOFt s The read operation timed out( is Unexpected EOF( RM t recvt OpenSSLt SSLt SysCallErrorRO t argst SocketErrorR5 t ZeroReturnErrort get_shutdownt RECEIVED_SHUTDOWNt
WantReadErrorR
t
wait_for_readRN t
gettimeoutR ( RR R\ t kwargst dataRI t rd( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRX s c O@ s y | j j | | SWn t j j k
r` } | j rK | j d k rK d St t | n t j j k
r } | j j
t j j k r d S nZ t j j k
r t
j | j | j j } | s t d q | j | | Sn Xd S( Nis Unexpected EOFi s The read operation timed out( is Unexpected EOF( RM t recv_intoRY RZ R[ RO R\ R] R5 R^ R_ R` Ra R
Rb RN Rc R ( RR R\ Rd RI Rf ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRg s c C@ s | j j | S( N( RN t
settimeout( RR R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRh * s c C@ s x t r y | j j | SWq t j j k
ri t j | j | j j } | s t
q q q t j j k
r } t t
| q Xq Wd S( N( R RM t sendRY RZ t WantWriteErrorR
t wait_for_writeRN Rc R R[ R] R5 ( RR Re t wrRI ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _send_until_done- s c C@ sG d } x: | t | k rB | j | | | t ! } | | 7} q Wd S( Ni ( R* Rm t SSL_WRITE_BLOCKSIZE( RR Re t
total_sentt sent( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt sendall9 s c C@ s | j j d S( N( RM t shutdown( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRr ? s c C@ sZ | j d k rG y t | _ | j j SWqV t j j k
rC d SXn | j d 8_ d S( Ni ( RP R RQ RM RU RY RZ t Error( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRU C s c C@ se | j j } | s | S| r8 t j j t j j | Si d | j j f f f d 6t | d 6S( Nt
commonNamet subjectt subjectAltName( RM t get_peer_certificateRY t cryptot dump_certificatet
FILETYPE_ASN1t get_subjectt CNRK ( RR t binary_formR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt getpeercertM s c C@ s | j d 7_ d S( Ni ( RP ( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _reuse_ s c C@ s/ | j d k r | j n | j d 8_ d S( Ni ( RP RU ( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt _dropb s
( t __name__t
__module__t __doc__R RS RT RV RX Rg Rh Rm Rq Rr RU R R~ R R ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRL s
ic C@ s% | j d 7_ t | | | d t S( Ni RU ( RP R R ( RR t modet bufsize( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt makefilej s R c B@ s e Z d Z d Z e d Z e j d Z e d Z e j d Z d Z d Z d d d d Z d d d Z e
e e d d
Z RS( s
I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
for translating the interface of the standard library ``SSLContext`` object
to calls into PyOpenSSL.
c C@ s; t | | _ t j j | j | _ d | _ t | _ d S( Ni ( t _openssl_versionst protocolRY RZ t Contextt _ctxt _optionsR t check_hostname( RR R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyRS y s
c C@ s | j S( N( R ( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt options s c C@ s | | _ | j j | d S( N( R R t set_options( RR R: ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c C@ s t | j j S( N( t _openssl_to_stdlib_verifyR t get_verify_mode( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt verify_mode s c C@ s | j j t | t d S( N( R t
set_verifyt _stdlib_to_openssl_verifyt _verify_callback( RR R: ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c C@ s | j j d S( N( R t set_default_verify_paths( RR ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c C@ s8 t | t j r$ | j d } n | j j | d S( Ns utf-8( t
isinstanceR t text_typeR+ R t set_cipher_list( RR t ciphers( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt set_ciphers s c C@ sx | d k r | j d } n | d k r< | j d } n | j j | | | d k rt | j j t | n d S( Ns utf-8( R$ R+ R t load_verify_locationsR ( RR t cafilet capatht cadata( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s c @ sR | j j | d k r8 | j j f d n | j j | pJ | d S( Nc @ s S( N( ( t
max_lengtht prompt_twicet userdata( t password( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt RW ( R t use_certificate_fileR$ t
set_passwd_cbt use_privatekey_file( RR t certfilet keyfileR ( ( R sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt load_cert_chain s c C@ s t j j | j | } t | t j r< | j d } n | d k rX | j | n | j
x t r y | j Wnr t j j
k
r t j | | j } | se t d qe qe n, t j j k
r } t j d | n XPqe Wt | | S( Ns utf-8s select timed outs bad handshake: %r( RY RZ t
ConnectionR R R R R+ R$ t set_tlsext_host_namet set_connect_stateR t do_handshakeRa R
Rb Rc R Rs t sslt SSLErrorRL ( RR t sockt server_sidet do_handshake_on_connectRO t server_hostnamet cnxRf RI ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt wrap_socket s$
N( R R R RS t propertyR t setterR R R R$ R R R R R ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s s c C@ s
| d k S( Ni ( ( R R t err_not err_deptht return_code( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyR s (L R t
__future__R t OpenSSL.SSLRY t cryptographyR t$ cryptography.hazmat.backends.opensslR R7 t) cryptography.hazmat.backends.openssl.x509R RN R R R] t ioR R R% R$ t packages.backports.makefileR t loggingR t packagesR R/ RW R
t __all__R R RZ t
SSLv23_METHODt PROTOCOL_SSLv23t TLSv1_METHODt PROTOCOL_TLSv1R R6 R R
R R t updatet SSLv3_METHODt PROTOCOL_SSLv3t AttributeErrort VERIFY_NONEt CERT_NONEt VERIFY_PEERt
CERT_OPTIONALt VERIFY_FAIL_IF_NO_PEER_CERTt
CERT_REQUIREDR t dictt itemsR Rn R R R R t getLoggerR R@ R R R R2 RK t objectRL R R R ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.pyt + sh
!!!
3 SPK ! ^ ^ socks.pyonu [
abc @@ s d Z d d l m Z y d d l Z Wn@ e k
rh d d l Z d d l m Z e j d e n Xd d l m
Z m Z
d d l m Z m Z d d l m Z m Z d d
l m Z m Z d d l m Z d d l m Z y d d l Z Wn e k
r
d Z n Xd
e f d YZ d e e f d YZ d e f d YZ d e f d YZ d e f d YZ d S( s
This module contains provisional support for SOCKS proxies from within
urllib3. This module supports SOCKS4 (specifically the SOCKS4A variant) and
SOCKS5. To enable its functionality, either install PySocks or install this
module with the ``socks`` extra.
The SOCKS implementation supports the full range of urllib3 features. It also
supports the following SOCKS features:
- SOCKS4
- SOCKS4a
- SOCKS5
- Usernames and passwords for the SOCKS proxy
Known Limitations:
- Currently PySocks does not support contacting remote websites via literal
IPv6 addresses. Any such connection attempt will fail. You must use a domain
name.
- Currently PySocks does not support IPv6 connections to the SOCKS proxy. Any
such connection attempt will fail.
i ( t absolute_importNi ( t DependencyWarnings SOCKS support in urllib3 requires the installation of optional dependencies: specifically, PySocks. For more information, see https://urllib3.readthedocs.io/en/latest/contrib.html#socks-proxies( t errort timeout( t HTTPConnectiont HTTPSConnection( t HTTPConnectionPoolt HTTPSConnectionPool( t ConnectTimeoutErrort NewConnectionError( t PoolManager( t parse_urlt SOCKSConnectionc B@ s e Z d Z d Z d Z RS( sG
A plain-text HTTP connection that connects via a SOCKS proxy.
c O@ s/ | j d | _ t t | j | | d S( Nt _socks_options( t popR
t superR t __init__( t selft argst kwargs( ( sE /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/socks.pyR ? s c C@ s i } | j r | j | d s2
FPK ! q( (
appengine.pyonu [
abc @@ sx d Z d d l m Z d d l Z d d l Z d d l Z d d l m Z d d l m Z m
Z
m Z m Z m
Z
m Z d d l m Z d d l m Z d d l m Z d d
l m Z d d l m Z y d d l m Z Wn e k
r d Z n Xe j e Z d
e
f d YZ d e f d YZ! d e f d YZ" d Z# d Z$ d Z% d Z& d Z' d S( sC
This module provides a pool manager that uses Google App Engine's
`URLFetch Service `_.
Example usage::
from urllib3 import PoolManager
from urllib3.contrib.appengine import AppEngineManager, is_appengine_sandbox
if is_appengine_sandbox():
# AppEngineManager uses AppEngine's URLFetch API behind the scenes
http = AppEngineManager()
else:
# PoolManager uses a socket-level API behind the scenes
http = PoolManager()
r = http.request('GET', 'https://google.com/')
There are `limitations `_ to the URLFetch service and it may not be
the best choice for your application. There are three options for using
urllib3 on Google App Engine:
1. You can use :class:`AppEngineManager` with URLFetch. URLFetch is
cost-effective in many circumstances as long as your usage is within the
limitations.
2. You can use a normal :class:`~urllib3.PoolManager` by enabling sockets.
Sockets also have `limitations and restrictions
`_ and have a lower free quota than URLFetch.
To use sockets, be sure to specify the following in your ``app.yaml``::
env_variables:
GAE_USE_SOCKETS_HTTPLIB : 'true'
3. If you are using `App Engine Flexible
`_, you can use the standard
:class:`PoolManager` without any configuration or special environment variables.
i ( t absolute_importNi ( t urljoin( t HTTPErrort HTTPWarningt
MaxRetryErrort
ProtocolErrort TimeoutErrort SSLError( t BytesIO( t RequestMethods( t HTTPResponse( t Timeout( t Retry( t urlfetcht AppEnginePlatformWarningc B@ s e Z RS( ( t __name__t
__module__( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyR G s t AppEnginePlatformErrorc B@ s e Z RS( ( R R ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyR K s t AppEngineManagerc B@ sk e Z d Z d d e e d Z d Z d Z d d d e e j d Z
d Z d Z d Z
RS( s
Connection manager for Google App Engine sandbox applications.
This manager uses the URLFetch service directly instead of using the
emulated httplib, and is subject to URLFetch limitations as described in
the App Engine documentation `here
`_.
Notably it will raise an :class:`AppEnginePlatformError` if:
* URLFetch is not available.
* If you attempt to use this on App Engine Flexible, as full socket
support is available.
* If a request size is more than 10 megabytes.
* If a response size is more than 32 megabtyes.
* If you use an unsupported request method such as OPTIONS.
Beyond those cases, it will raise normal urllib3 errors.
c C@ su t s t d n t r- t d n t j d t t j | | | | _ | | _ | pk t
j | _ d S( Ns. URLFetch is not available in this environment.s Use normal urllib3.PoolManager instead of AppEngineManageron Managed VMs, as using URLFetch is not necessary in this environment.s urllib3 is using URLFetch on Google App Engine sandbox instead of sockets. To use sockets directly instead of URLFetch see https://urllib3.readthedocs.io/en/latest/reference/urllib3.contrib.html.(
R
R t is_prod_appengine_mvmst warningst warnR R t __init__t validate_certificatet urlfetch_retriesR t DEFAULTt retries( t selft headersR R R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyR c s c C@ s | S( N( ( R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyt __enter__{ s c C@ s t S( N( t False( R t exc_typet exc_valt exc_tb( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyt __exit__~ s c K@ sk | j | | } yv | o0 | j d k o0 | j } t j | d | d | d | pT i d t d | j oi | d | j | d | j }
Wn"t j k
r } t
| | n t j k
r } d t | k r t
d
| n t | n t j k
r?} d t | k r0t | | d | n t | nn t j k
rc} t
d
| nJ t j k
r} t | n) t j k
r} t
d | | n X| j |
d | | } | o| j }
|
r| j r| j rt | | d q| j d k r d } n y" | j | | d | d | } Wn0 t k
rp| j rlt | | d n | SX| j | t j d | |
t | |
} | j | | | | d | d | d | | Sn t | j d } | j! | | j | rg| j | | d | d | } t j d | | j" | | j | | d | d | d | d | d | | S| S( Ni t payloadt methodR t allow_truncatedt follow_redirectst deadlineR s too largesO URLFetch request too large, URLFetch only supports requests up to 10mb in size.s Too many redirectst reasonsP URLFetch response too large, URLFetch only supportsresponses up to 32mb in size.s$ URLFetch does not support method: %sR s too many redirectsi/ t GETt responset _pools Redirecting %s -> %st redirectt timeouts Retry-Afters Retry: %st body(# t _get_retriesR, t totalR
t fetchR R t _get_absolute_timeoutR t DeadlineExceededErrorR t InvalidURLErrort strR R t
DownloadErrorR t ResponseTooLargeErrort SSLCertificateErrorR t InvalidMethodErrort# _urlfetch_response_to_http_responset get_redirect_locationt raise_on_redirectt statust incrementt sleep_for_retryt logt debugR t urlopent boolt getheadert is_retryt sleep( R R$ t urlR. R R R, R- t response_kwR& R* t et
http_responset redirect_locationt redirect_urlt has_retry_after( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyRB s "
c K@ s t r7 | j j d } | d k r7 | j d =q7 n | j j d } | d k r | j d } | j d d j | | j d ' s0 .
PK ! q( (
appengine.pycnu [
abc @@ sx d Z d d l m Z d d l Z d d l Z d d l Z d d l m Z d d l m Z m
Z
m Z m Z m
Z
m Z d d l m Z d d l m Z d d l m Z d d
l m Z d d l m Z y d d l m Z Wn e k
r d Z n Xe j e Z d
e
f d YZ d e f d YZ! d e f d YZ" d Z# d Z$ d Z% d Z& d Z' d S( sC
This module provides a pool manager that uses Google App Engine's
`URLFetch Service `_.
Example usage::
from urllib3 import PoolManager
from urllib3.contrib.appengine import AppEngineManager, is_appengine_sandbox
if is_appengine_sandbox():
# AppEngineManager uses AppEngine's URLFetch API behind the scenes
http = AppEngineManager()
else:
# PoolManager uses a socket-level API behind the scenes
http = PoolManager()
r = http.request('GET', 'https://google.com/')
There are `limitations `_ to the URLFetch service and it may not be
the best choice for your application. There are three options for using
urllib3 on Google App Engine:
1. You can use :class:`AppEngineManager` with URLFetch. URLFetch is
cost-effective in many circumstances as long as your usage is within the
limitations.
2. You can use a normal :class:`~urllib3.PoolManager` by enabling sockets.
Sockets also have `limitations and restrictions
`_ and have a lower free quota than URLFetch.
To use sockets, be sure to specify the following in your ``app.yaml``::
env_variables:
GAE_USE_SOCKETS_HTTPLIB : 'true'
3. If you are using `App Engine Flexible
`_, you can use the standard
:class:`PoolManager` without any configuration or special environment variables.
i ( t absolute_importNi ( t urljoin( t HTTPErrort HTTPWarningt
MaxRetryErrort
ProtocolErrort TimeoutErrort SSLError( t BytesIO( t RequestMethods( t HTTPResponse( t Timeout( t Retry( t urlfetcht AppEnginePlatformWarningc B@ s e Z RS( ( t __name__t
__module__( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyR G s t AppEnginePlatformErrorc B@ s e Z RS( ( R R ( ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyR K s t AppEngineManagerc B@ sk e Z d Z d d e e d Z d Z d Z d d d e e j d Z
d Z d Z d Z
RS( s
Connection manager for Google App Engine sandbox applications.
This manager uses the URLFetch service directly instead of using the
emulated httplib, and is subject to URLFetch limitations as described in
the App Engine documentation `here
`_.
Notably it will raise an :class:`AppEnginePlatformError` if:
* URLFetch is not available.
* If you attempt to use this on App Engine Flexible, as full socket
support is available.
* If a request size is more than 10 megabytes.
* If a response size is more than 32 megabtyes.
* If you use an unsupported request method such as OPTIONS.
Beyond those cases, it will raise normal urllib3 errors.
c C@ su t s t d n t r- t d n t j d t t j | | | | _ | | _ | pk t
j | _ d S( Ns. URLFetch is not available in this environment.s Use normal urllib3.PoolManager instead of AppEngineManageron Managed VMs, as using URLFetch is not necessary in this environment.s urllib3 is using URLFetch on Google App Engine sandbox instead of sockets. To use sockets directly instead of URLFetch see https://urllib3.readthedocs.io/en/latest/reference/urllib3.contrib.html.(
R
R t is_prod_appengine_mvmst warningst warnR R t __init__t validate_certificatet urlfetch_retriesR t DEFAULTt retries( t selft headersR R R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyR c s c C@ s | S( N( ( R ( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyt __enter__{ s c C@ s t S( N( t False( R t exc_typet exc_valt exc_tb( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyt __exit__~ s c K@ sk | j | | } yv | o0 | j d k o0 | j } t j | d | d | d | pT i d t d | j oi | d | j | d | j }
Wn"t j k
r } t
| | n t j k
r } d t | k r t
d
| n t | n t j k
r?} d t | k r0t | | d | n t | nn t j k
rc} t
d
| nJ t j k
r} t | n) t j k
r} t
d | | n X| j |
d | | } | o| j }
|
r| j r| j rt | | d q| j d k r d } n y" | j | | d | d | } Wn0 t k
rp| j rlt | | d n | SX| j | t j d | |
t | |
} | j | | | | d | d | d | | Sn t | j d } | j! | | j | rg| j | | d | d | } t j d | | j" | | j | | d | d | d | d | d | | S| S( Ni t payloadt methodR t allow_truncatedt follow_redirectst deadlineR s too largesO URLFetch request too large, URLFetch only supports requests up to 10mb in size.s Too many redirectst reasonsP URLFetch response too large, URLFetch only supportsresponses up to 32mb in size.s$ URLFetch does not support method: %sR s too many redirectsi/ t GETt responset _pools Redirecting %s -> %st redirectt timeouts Retry-Afters Retry: %st body(# t _get_retriesR, t totalR
t fetchR R t _get_absolute_timeoutR t DeadlineExceededErrorR t InvalidURLErrort strR R t
DownloadErrorR t ResponseTooLargeErrort SSLCertificateErrorR t InvalidMethodErrort# _urlfetch_response_to_http_responset get_redirect_locationt raise_on_redirectt statust incrementt sleep_for_retryt logt debugR t urlopent boolt getheadert is_retryt sleep( R R$ t urlR. R R R, R- t response_kwR& R* t et
http_responset redirect_locationt redirect_urlt has_retry_after( ( sI /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/appengine.pyRB s "
c K@ s t r7 | j j d } | d k r7 | j d =q7 n | j j d } | d k r | j d } | j d d j | | j d ' s0 .
PK ! CFX X securetransport.pycnu [
abc ! @@ s d Z d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
m Z d d l m Z m Z m Z d d l m Z m Z m Z m Z y d d l m Z Wn' e k
r
e Z d d
l m Z n Xy e d Wn e k
r;e d n Xd
d g Z e Z! e j! Z" e j# j$ Z% e j& Z' e j( Z) d Z* e j+ e j, e j- e j. e j/ e j0 e j1 e j2 e j3 e j4 e j5 e j6 e j7 e j8 e j9 e j: e j; e j< e j= e j> e j? e j@ e jA e jB e jC e jD e jE e jF e jG e jH e jI e jJ e jK g! ZL i e jM e jN f e
jO 6ZP eQ e
d re jR e jR f eP e
jS
Undo monkey-patching by :func:`inject_into_urllib3`.
N( t orig_util_SSLContextR R R t orig_util_HAS_SNIR t FalseR ( ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR
s
c C@ s d } yt j | } | d k r+ t j S| j } | d } | j } d } d } t j | j | } t
| }
y x | | k r| d k s | d k r t j | g | } | s t j
t j d q n | j |
| | ! } | | 7} | s~ | s t j SPq~ q~ WWnV t j
k
rl}
|
j } | d k rm| t j k rm| t j k rct j S qmn X| | d <| | k rt j Sd SWn/ t k
r}
| d k r|
| _ n t j SXd S( ss
SecureTransport read callback. This is called by ST to request that data
be returned from the socket.
i s timed outN( t Nonet _connection_refst getR t errSSLInternalt sockett
gettimeoutt ctypest c_chart from_addresst
memoryviewR t
wait_for_readt errort errnot EAGAINt recv_intot errSSLClosedGracefult
ECONNRESETt errSSLClosedAbortt errSSLWouldBlockt Exceptiont
_exception( t
connection_idt data_buffert data_length_pointert wrapped_sockett base_sockett requested_lengtht timeoutR( t
read_countt buffert buffer_viewt readablest
chunk_sizet e( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _read_callback sN
c
C@ s d } yet j | } | d k r+ t j S| j } | d } t j | | } | j } d } d } y x | | k r | d k s | d k r t j
| g | }
|
s t j t j
d q n | j | } | | 7} | | } qn WWnV t j k
rH} | j } | d k rI| t j
k rI| t j k r?t j S qIn X| | d <| | k rft j Sd SWn/ t k
r} | d k r| | _ n t j SXd S( sx
SecureTransport write callback. This is called by ST to request that data
actually be sent on the network.
i s timed outN( R R R R R R! R# t string_atR" R t wait_for_writeR( R) R* t sendR- R. R/ R0 R1 (
R2 R3 R4 R5 R6 t bytes_to_writet dataR8 R( t sentt writablest
chunk_sentR> ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _write_callback sD
t
WrappedSocketc B@ s e Z d Z d Z e j d Z d Z d Z d Z d Z
d Z d Z d d Z d
Z d Z d Z d
Z d Z d Z e d Z d Z d Z RS( s
API-compatibility wrapper for Python's OpenSSL wrapped socket object.
Note: _makefile_refs, _drop(), and _reuse() are needed for the garbage
collector of PyPy.
c C@ sn | | _ d | _ d | _ t | _ d | _ d | _ d | _ d | _ | j j
| _ | j j d d S( Ni (
R! R t contextt _makefile_refsR t _closedR1 t _keychaint
_keychain_dirt _client_cert_chainR" t _timeoutt
settimeout( t selfR! ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt __init__. s c c@ sG d | _ d V| j d k rC | j d } | _ | j | n d S( s]
A context manager that can be used to wrap calls that do I/O from
SecureTransport. If any of the I/O callbacks hit an exception, this
context manager will correctly propagate the exception after the fact.
This avoids silently swallowing those exceptions.
It also correctly forces the socket closed.
N( R R1 t close( RR t exception( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _raise_on_error@ s
c C@ sE t j t t t } t j | j | t t } t | d S( s4
Sets up the allowed ciphers. By default this matches the set in
util.ssl_.DEFAULT_CIPHERS, at least as supported by macOS. This is done
custom and doesn't allow changing at this time, mostly because parsing
OpenSSL cipher strings is going to be a freaking nightmare.
N( R t SSLCipherSuitet lent
CIPHER_SUITESt SSLSetEnabledCiphersRJ R ( RR t cipherst result( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _set_ciphersU s c C@ s | s
d St j j | rC t | d } | j } Wd QXn d } t j } z t | } t j | j
t j | } t
| | s t j d n t j | | } t
| t j | t } t
| t j } t j | t j | } t
| Wd | r't j | n | d k rCt j | n Xt j t j f } | j | k r~t j d | j n d S( s
Called when we have set custom validation. We do this in two cases:
first, when cert validation is entirely disabled; and second, when
using a custom trust DB.
Nt rbs Failed to copy trust references) certificate verify failed, error code: %d( t ost patht isfilet opent readR R t SecTrustRefR t SSLCopyPeerTrustRJ R# t byrefR t sslt SSLErrort SecTrustSetAnchorCertificatest! SecTrustSetAnchorCertificatesOnlyR t SecTrustResultTypet SecTrustEvaluateR t CFReleaseR t kSecTrustResultUnspecifiedt kSecTrustResultProceedt value( RR t verifyt trust_bundlet ft
cert_arrayt trustR\ t trust_resultt successes( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt _custom_validateb s@
c C@ s[ t j d t j t j | _ t j | j t t } t
| t @ t | d }
x |
t
k rw |
d d }
qZ W| t
|
Z ( > ic C@ s% | j d 7_ t | | | d t S( Ni RT ( RK R R ( RR t modet bufsize( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt makefile s t rc O@ s d } t | | | | | S( Ni ( R
( RR R t bufferingt argst kwargs( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s R c B@ s e Z d Z d Z e d Z e j d Z e d Z e j d Z e d Z e j d Z d Z d Z
d
Z d d d d Z
d d d Z e e e d d
Z RS( s
I am a wrapper class for the SecureTransport library, to translate the
interface of the standard library ``SSLContext`` object to calls into
SecureTransport.
c C@ sP t | \ | _ | _ d | _ t | _ d | _ d | _ d | _ d | _
d S( Ni ( t _protocol_to_min_maxt _min_versiont _max_versiont _optionsR t _verifyR t
_trust_bundlet _client_certt _client_keyt _client_key_passphrase( RR t protocol( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyRS s c C@ s t S( s
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
( R ( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt check_hostname s c C@ s d S( s
SecureTransport cannot have its hostname checking disabled. For more,
see the comment on getpeercert() in this file.
N( ( RR Rp ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s c C@ s | j S( N( R ( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt options s c C@ s
| | _ d S( N( R ( RR Rp ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s c C@ s | j r t j St j S( N( R Rg t
CERT_REQUIREDt CERT_NONE( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt verify_mode s c C@ s" | t j k r t n t | _ d S( N( Rg R R R R ( RR Rp ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s c C@ s d S( N( ( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt set_default_verify_paths s
c C@ s
| j S( N( R ( RR ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt load_default_certs s c C@ s% | t j j k r! t d n d S( Ns5 SecureTransport doesn't support custom cipher strings( R R t DEFAULT_CIPHERSR ( RR R[ ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt set_ciphers s c C@ s. | d k r t d n | p$ | | _ d S( Ns1 SecureTransport does not support cert directories( R R R ( RR t cafilet capatht cadata( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt load_verify_locations s c C@ s | | _ | | _ | | _ d S( N( R R t _client_cert_passphrase( RR t certfilet keyfilet password( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt load_cert_chain s c C@ sl | s
t | s t | s% t t | } | j | | j | j | j | j | j | j | j | S( N(
R RI R R R R R R R R ( RR t sockt server_sidet do_handshake_on_connectt suppress_ragged_eofsR R5 ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt wrap_socket s
N( R R R RS t propertyR t setterR R R R R R R R R R R ( ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyR s
(g R t
__future__R R R# R) t os.pathR_ R R! Rg t threadingt weakrefR R t _securetransport.bindingsR R R t _securetransport.low_levelR R R R R t ImportErrorR t packages.backports.makefileR
R& t NameErrort __all__R R R R R R t WeakValueDictionaryR t LockR R t TLS_AES_256_GCM_SHA384t TLS_CHACHA20_POLY1305_SHA256t TLS_AES_128_GCM_SHA256t' TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384t% TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384t' TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256t% TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256t# TLS_DHE_DSS_WITH_AES_256_GCM_SHA384t# TLS_DHE_RSA_WITH_AES_256_GCM_SHA384t# TLS_DHE_DSS_WITH_AES_128_GCM_SHA256t# TLS_DHE_RSA_WITH_AES_128_GCM_SHA256t' TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384t% TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384t$ TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAt" TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAt# TLS_DHE_RSA_WITH_AES_256_CBC_SHA256t# TLS_DHE_DSS_WITH_AES_256_CBC_SHA256t TLS_DHE_RSA_WITH_AES_256_CBC_SHAt TLS_DHE_DSS_WITH_AES_256_CBC_SHAt' TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256t% TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256t$ TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAt" TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAt# TLS_DHE_RSA_WITH_AES_128_CBC_SHA256t# TLS_DHE_DSS_WITH_AES_128_CBC_SHA256t TLS_DHE_RSA_WITH_AES_128_CBC_SHAt TLS_DHE_DSS_WITH_AES_128_CBC_SHAt TLS_RSA_WITH_AES_256_GCM_SHA384t TLS_RSA_WITH_AES_128_GCM_SHA256t TLS_RSA_WITH_AES_256_CBC_SHA256t TLS_RSA_WITH_AES_128_CBC_SHA256t TLS_RSA_WITH_AES_256_CBC_SHAt TLS_RSA_WITH_AES_128_CBC_SHARY t
kTLSProtocol1t kTLSProtocol12t PROTOCOL_SSLv23R t hasattrt
kSSLProtocol2R t
kSSLProtocol3R R t kTLSProtocol11R R R R R
R? RH t SSLReadFuncR} t SSLWriteFuncR~ t objectRI R R ( ( ( sO /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/securetransport.pyt s "
9 5 PK ! ^ ^ socks.pycnu [
abc @@ s d Z d d l m Z y d d l Z Wn@ e k
rh d d l Z d d l m Z e j d e n Xd d l m
Z m Z
d d l m Z m Z d d l m Z m Z d d
l m Z m Z d d l m Z d d l m Z y d d l Z Wn e k
r
d Z n Xd
e f d YZ d e e f d YZ d e f d YZ d e f d YZ d e f d YZ d S( s
This module contains provisional support for SOCKS proxies from within
urllib3. This module supports SOCKS4 (specifically the SOCKS4A variant) and
SOCKS5. To enable its functionality, either install PySocks or install this
module with the ``socks`` extra.
The SOCKS implementation supports the full range of urllib3 features. It also
supports the following SOCKS features:
- SOCKS4
- SOCKS4a
- SOCKS5
- Usernames and passwords for the SOCKS proxy
Known Limitations:
- Currently PySocks does not support contacting remote websites via literal
IPv6 addresses. Any such connection attempt will fail. You must use a domain
name.
- Currently PySocks does not support IPv6 connections to the SOCKS proxy. Any
such connection attempt will fail.
i ( t absolute_importNi ( t DependencyWarnings SOCKS support in urllib3 requires the installation of optional dependencies: specifically, PySocks. For more information, see https://urllib3.readthedocs.io/en/latest/contrib.html#socks-proxies( t errort timeout( t HTTPConnectiont HTTPSConnection( t HTTPConnectionPoolt HTTPSConnectionPool( t ConnectTimeoutErrort NewConnectionError( t PoolManager( t parse_urlt SOCKSConnectionc B@ s e Z d Z d Z d Z RS( sG
A plain-text HTTP connection that connects via a SOCKS proxy.
c O@ s/ | j d | _ t t | j | | d S( Nt _socks_options( t popR
t superR t __init__( t selft argst kwargs( ( sE /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/socks.pyR ? s c C@ s i } | j r | j | d s2
FPK ! R F9g g ntlmpool.pycnu [
abc @@ s| d Z d d l m Z d d l m Z d d l m Z d d l m Z d d l m Z e e
Z d e f d YZ d
S( s
NTLM authenticating pool, contributed by erikcederstran
Issue #10, see: http://code.google.com/p/urllib3/issues/detail?id=10
i ( t absolute_import( t getLogger( t ntlmi ( t HTTPSConnectionPool( t HTTPSConnectiont NTLMConnectionPoolc B@ s> e Z d Z d Z d Z d Z d d d e e d Z RS( sQ
Implements an NTLM authentication version of an urllib3 connection pool
t httpsc O@ sj t t | j | | | | _ | | _ | j d d } | d j | _ | d | _ | | _ d S( s
authurl is a random URL on the server that is protected by NTLM.
user is the Windows user, probably in the DOMAIN\username format.
pw is the password for the user.
s \i i N(
t superR t __init__t authurlt rawusert splitt uppert domaint usert pw( t selfR R R t argst kwargst
user_parts( ( sH /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/ntlmpool.pyR s
c
C@ s | j d 7_ t j d | j | j | j i } d | d s PK ! oe __init__.pycnu [
abc @ s d S( N( ( ( ( sH /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/__init__.pyt t PK ! R F9g g ntlmpool.pyonu [
abc @@ s| d Z d d l m Z d d l m Z d d l m Z d d l m Z d d l m Z e e
Z d e f d YZ d
S( s
NTLM authenticating pool, contributed by erikcederstran
Issue #10, see: http://code.google.com/p/urllib3/issues/detail?id=10
i ( t absolute_import( t getLogger( t ntlmi ( t HTTPSConnectionPool( t HTTPSConnectiont NTLMConnectionPoolc B@ s> e Z d Z d Z d Z d Z d d d e e d Z RS( sQ
Implements an NTLM authentication version of an urllib3 connection pool
t httpsc O@ sj t t | j | | | | _ | | _ | j d d } | d j | _ | d | _ | | _ d S( s
authurl is a random URL on the server that is protected by NTLM.
user is the Windows user, probably in the DOMAIN\username format.
pw is the password for the user.
s \i i N(
t superR t __init__t authurlt rawusert splitt uppert domaint usert pw( t selfR R R t argst kwargst
user_parts( ( sH /usr/lib/python2.7/site-packages/pip/_vendor/urllib3/contrib/ntlmpool.pyR s
c
C@ s | j d 7_ t j d | j | j | j i } d | d s PK ! j. . rubyforgepublisher.rbnu [ PK ! Jn $ $ s publisher.rbnu [ PK ! 4 sys.rbnu [ PK ! ȉ`t_ _ compositepublisher.rbnu [ PK ! Vl h sshpublisher.rbnu [ PK ! ¬P q# ftptools.rbnu [ PK ! W2 socks.pynu [ PK ! K __init__.pynu [ PK ! K _securetransport/__init__.pynu [ PK ! Y}D D
L _securetransport/bindings.pynu [ PK ! "-X( X( : _securetransport/__pycache__/bindings.cpython-36.opt-1.pycnu [ PK ! cl ; _securetransport/__pycache__/low_level.cpython-36.opt-1.pycnu [ PK ! cl 5 _securetransport/__pycache__/low_level.cpython-36.pycnu [ PK ! "-X( X( 4 = _securetransport/__pycache__/bindings.cpython-36.pycnu [ PK ! 5 @q q 4 _securetransport/__pycache__/__init__.cpython-36.pycnu [ PK ! 5 @q q : _securetransport/__pycache__/__init__.cpython-36.opt-1.pycnu [ PK ! sK/ / _securetransport/low_level.pynu [ PK ! / xN _appengine_environ.pynu [ PK ! ev ev Q securetransport.pynu [ PK ! s{GE GE 0 1 __pycache__/securetransport.cpython-36.opt-1.pycnu [ PK !