ó ^\kdc@sÝdZddlmZddlmZddlZddlm Z ddl m Z m Z ddlmZddlZddlZddlmZd d lmZd d lmZd d gZeZiejjej6ejjej6ejjej6Z iejj!ej"6ejj#ej$6ejj#ejj%ej&6Z'dddZ(ejZ)ej*Z+d„Z,d„Z-defd„ƒYZd„Z.defd„ƒYZ/de0fd„ƒYZ1d„Z2ddddddd„Z*dS(sQSSL with SNI_-support for Python 2. This needs the following packages installed: * pyOpenSSL (tested with 0.13) * ndg-httpsclient (tested with 0.3.2) * pyasn1 (tested with 0.1.6) To activate it call :func:`~urllib3.contrib.pyopenssl.inject_into_urllib3`. This can be done in a ``sitecustomize`` module, or at any other time before your application begins using ``urllib3``, like this:: try: import urllib3.contrib.pyopenssl urllib3.contrib.pyopenssl.inject_into_urllib3() except ImportError: pass Now you can use :mod:`urllib3` as you normally would, and it will support SNI when the required modules are installed. Activating this module also has the positive side effect of disabling SSL/TLS encryption in Python 2 (see `CRIME attack`_). If you want to configure the default list of supported cipher suites, you can set the ``urllib3.contrib.pyopenssl.DEFAULT_SSL_CIPHER_LIST`` variable. Module Variables ---------------- :var DEFAULT_SSL_CIPHER_LIST: The list of supported SSL/TLS cipher suites. Default: ``EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA256 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EDH+aRSA EECDH RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS'`` .. _sni: https://en.wikipedia.org/wiki/Server_Name_Indication .. _crime attack: https://en.wikipedia.org/wiki/CRIME_(security_exploit) iÿÿÿÿ(tSUBJ_ALT_NAME_SUPPORT(tSubjectAltNameN(tdecoder(tunivt constraint(t _fileobject(tStringIOi(t connection(tutiltinject_into_urllib3textract_from_urllib3s%EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM s=EECDH+ECDSA+SHA256 EECDH+aRSA+SHA256 EECDH+aRSA+RC4 EDH+aRSA s;EECDH RC4 !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSScCstt_tt_dS(s7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.N(tssl_wrap_socketRtHAS_SNIR(((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyR Ts cCstt_tt_dS(s4Undo monkey-patching by :func:`inject_into_urllib3`.N(torig_connection_ssl_wrap_socketRR torig_util_HAS_SNIRR (((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyR [s RcBs*eZdZejjejddƒZRS(s0ASN.1 implementation for subjectAltNames supportii(t__name__t __module__t__doc__Rt SequenceOftsizeSpecRtValueSizeConstraint(((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyRcs c Cs g}ts|Stƒ}xët|jƒƒD]×}|j|ƒ}|jƒ}|dkr_q,n|jƒ}tj|d|ƒ}x€|D]x}t |tƒs¢q‡nxZtt |ƒƒD]F} |j | ƒ} | j ƒdkrâqµn|j t| jƒƒƒqµWq‡Wq,W|S(NtsubjectAltNametasn1SpectdNSName(RRtrangetget_extension_countt get_extensiontget_short_nametget_datat der_decodertdecodet isinstancetlentgetComponentByPositiontgetNametappendtstrt getComponent( t peer_certtdns_namet general_namestitexttext_nametext_datt decoded_dattnametentryt component((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pytget_subj_alt_namens*       %t fileobjectcBs eZdd„Zdd„ZRS(iÿÿÿÿc Csît|j|jƒ}|j}|jddƒ|dkr§tƒ|_xTtrœy|jj|ƒ}Wnt j j k rqInX|sŒPn|j |ƒqIW|j ƒS|jƒ}||kr|jdƒ|j|ƒ}tƒ|_|jj |jƒƒ|Stƒ|_xÐtrß||}y|jj|ƒ}Wnt j j k rRqnX|s]Pnt|ƒ}||kr€| r€|S||kr |j |ƒ~Pn||ksÂtd||fƒ‚|j |ƒ||7}~qW|j ƒSdS(Niisrecv(%d) returned %d bytes(tmaxt _rbufsizetdefault_bufsizet_rbuftseekRtTruet_socktrecvtOpenSSLtSSLt WantReadErrortwritetgetvaluettelltreadR tAssertionError( tselftsizetrbufsizetbuftdatatbuf_lentrvtlefttn((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyRAŽsT               "  c CsÛ|j}|jddƒ|jƒdkr”|jdƒ|j|ƒ}|jdƒsht|ƒ|krŽtƒ|_|jj|jƒƒ|S~n|dkr,|j dkr[|jdƒ|jƒg}tƒ|_d}|j j }xbt rMy:x3|dkr*|dƒ}|sPn|j|ƒqøWWntjjk rHqìnXPqìWdj|ƒS|jddƒtƒ|_x¨t r!y|j j |j ƒ}Wntjjk rµqznX|sÀPn|jdƒ}|dkr|d7}|j|| ƒ|jj||ƒ~Pn|j|ƒqzW|jƒS|jddƒ|jƒ}||kr–|jdƒ|j|ƒ} tƒ|_|jj|jƒƒ| Stƒ|_x(t rÌy|j j |j ƒ}Wntjjk ràq¥nX|sëPn||} |jdd| ƒ}|dkrZ|d7}|jj||ƒ|rO|j|| ƒPqZ|| Snt|ƒ} | |kr}| r}|S| | kr²|j|| ƒ|jj|| ƒPn|j|ƒ|| 7}q¥W|jƒSdS(Niis it(R6R7R@treadlinetendswithR RR>RAR4tNoneR9R:R8R#R;R<R=tjointfindR?( RCRDRFtblinetbuffersRGR:tnlRHRIRJRK((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyRMÐs¢  !                          (RRRARM(((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyR2Œs Bt WrappedSocketcBsSeZdZd„Zd„Zdd„Zd„Zd„Zd„Ze d„Z RS( s@API-compatibility wrapper for Python OpenSSL's Connection-class.cCs||_||_dS(N(Rtsocket(RCRRV((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyt__init__5s cCs |jjƒS(N(RVtfileno(RC((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyRX9siÿÿÿÿcCst|j||ƒS(N(R2R(RCtmodetbufsize((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pytmakefile<scCs|jj|ƒS(N(RVt settimeout(RCttimeout((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyR\?scCs|jj|ƒS(N(Rtsendall(RCRG((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyR^BscCs |jjƒS(N(Rtshutdown(RC((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pytcloseEscCs~|jjƒ}|s|S|r8tjjtjj|ƒSid|jƒjfffd6gt|ƒD]}d|f^qdd6S(Nt commonNametsubjecttDNSR( Rtget_peer_certificateR;tcryptotdump_certificatet FILETYPE_ASN1t get_subjecttCNR1(RCt binary_formtx509tvalue((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyt getpeercertHs  ( RRRRWRXR[R\R^R`tFalseRm(((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyRU2s      cCs |dkS(Ni((tcnxRkterr_not err_deptht return_code((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyt_verify_callback^sc Cs‰tjjt|ƒ}|r,|j|ƒn|rB|j|ƒn|tjkrh|jt |t ƒn|r·y|j |dƒWq·tjj k r³}tjd||ƒ‚q·Xnd} |j| ƒ|jtƒtjj||ƒ} | j|ƒ| jƒxvtr{y| jƒWnZtjjk rLtj|gggƒqn+tjj k rv}tjd|ƒ‚nXPqWt| |ƒS(Nsbad ca_certs: %ris bad handshake(R;R<tContextt_openssl_versionstuse_certificate_filetuse_privatekey_filetsslt CERT_NONEt set_verifyt_openssl_verifyRstload_verify_locationsROtErrortSSLErrort set_optionstset_cipher_listtDEFAULT_SSL_CIPHER_LISTt Connectiontset_tlsext_host_nametset_connect_stateR8t do_handshakeR=tselectRU( tsocktkeyfiletcertfilet cert_reqstca_certstserver_hostnamet ssl_versiontctxtetOP_NO_COMPRESSIONRo((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyR bs8     (4Rt%ndg.httpsclient.ssl_peer_verificationRtndg.httpsclient.subj_alt_nameRtBaseSubjectAltNamet OpenSSL.SSLR;tpyasn1.codec.derRRt pyasn1.typeRRRVRRxR†t cStringIORRLRRt__all__R R<t SSLv23_METHODtPROTOCOL_SSLv23t SSLv3_METHODtPROTOCOL_SSLv3t TLSv1_METHODtPROTOCOL_TLSv1Rut VERIFY_NONERyt VERIFY_PEERt CERT_OPTIONALtVERIFY_FAIL_IF_NO_PEER_CERTt CERT_REQUIREDR{RRR R R R R1R2tobjectRURsRO(((s^/var/www/testScraper/venv/build/pip/pip/_vendor/requests/packages/urllib3/contrib/pyopenssl.pyt'sH          ¦,