[pypy-commit] pypy py3.5: (arigato, plan_rich) merge enhancements to py3.5-ssl
plan_rich
pypy.commits at gmail.com
Mon Nov 28 10:53:24 EST 2016
Author: Richard Plangger <planrichi at gmail.com>
Branch: py3.5
Changeset: r88705:851b07eec964
Date: 2016-11-28 16:52 +0100
http://bitbucket.org/pypy/pypy/changeset/851b07eec964/
Log: (arigato, plan_rich) merge enhancements to py3.5-ssl
diff --git a/lib_pypy/_cffi_ssl/_stdssl/__init__.py b/lib_pypy/_cffi_ssl/_stdssl/__init__.py
--- a/lib_pypy/_cffi_ssl/_stdssl/__init__.py
+++ b/lib_pypy/_cffi_ssl/_stdssl/__init__.py
@@ -20,6 +20,8 @@
SSL_ERROR_EOF, SSL_ERROR_NO_SOCKET, SSL_ERROR_INVALID_ERROR_CODE,
pyerr_write_unraisable)
from _cffi_ssl._stdssl import error
+from select import poll, POLLIN, POLLOUT, select
+from enum import IntEnum as _IntEnum
OPENSSL_VERSION = ffi.string(lib.OPENSSL_VERSION_TEXT).decode('utf-8')
OPENSSL_VERSION_NUMBER = lib.OPENSSL_VERSION_NUMBER
@@ -77,7 +79,6 @@
_PROTOCOL_NAMES = (name for name in dir(lib) if name.startswith('PROTOCOL_'))
-from enum import IntEnum as _IntEnum
_IntEnum._convert('_SSLMethod', __name__,
lambda name: name.startswith('PROTOCOL_'))
@@ -120,7 +121,6 @@
def _Cryptography_pem_password_cb(buf, size, rwflag, userdata):
pw_info = ffi.from_handle(userdata)
- # TODO PySSL_END_ALLOW_THREADS_S(pw_info->thread_state);
password = pw_info.password
if pw_info.callable:
@@ -140,7 +140,6 @@
pw_info.operationerror = ValueError("password cannot be longer than %d bytes" % size)
return 0
- #PySSL_BEGIN_ALLOW_THREADS_S(pw_info->thread_state);
ffi.memmove(buf, password, len(password))
return len(password)
@@ -150,7 +149,12 @@
else:
Cryptography_pem_password_cb = ffi.callback("int(char*,int,int,void*)")(_Cryptography_pem_password_cb)
-from select import poll, POLLIN, POLLOUT, select
+if hasattr(time, 'monotonic'):
+ def _monotonic_clock():
+ return time.monotonic()
+else:
+ def _monotonic_clock():
+ return time.clock_gettime(time.CLOCK_MONOTONIC)
HAVE_POLL = True
@@ -177,10 +181,9 @@
if HAVE_POLL:
p.register(sock.fileno(), POLLOUT | POLLIN)
- #PySSL_BEGIN_ALLOW_THREADS
rc = len(p.poll(timeout * 1000.0))
- #PySSL_END_ALLOW_THREADS
else:
+ # currently disabled, see HAVE_POLL
fd = sock.fileno()
#if (!_PyIsSelectable_fd(s->sock_fd))
# return SOCKET_TOO_LARGE_FOR_SELECT;
@@ -200,9 +203,6 @@
SOCKET_TOO_LARGE_FOR_SELECT = 4
SOCKET_OPERATION_OK = 5
-def _buffer_new(length):
- return ffi.new("char[%d]"%length)
-
class _SSLSocket(object):
@staticmethod
@@ -215,9 +215,9 @@
lib.ERR_get_state()
lib.ERR_clear_error()
- self.ssl = ssl = lib.SSL_new(ctx)
+ self.ssl = ssl = ffi.gc(lib.SSL_new(ctx), lib.SSL_free)
- self._app_data_handle = ffi.new_handle(self) # TODO release later
+ self._app_data_handle = ffi.new_handle(self)
lib.SSL_set_app_data(ssl, ffi.cast("char*", self._app_data_handle))
if sock:
lib.SSL_set_fd(ssl, sock.fileno())
@@ -247,13 +247,11 @@
lib.BIO_set_nbio(lib.SSL_get_rbio(ssl), 1)
lib.BIO_set_nbio(lib.SSL_get_wbio(ssl), 1)
- #PySSL_BEGIN_ALLOW_THREADS
if socket_type == SSL_CLIENT:
lib.SSL_set_connect_state(ssl)
else:
lib.SSL_set_accept_state(ssl)
self.socket_type = socket_type
- #PySSL_END_ALLOW_THREADS
if sock:
self.socket = weakref.ref(sock)
@@ -309,8 +307,7 @@
has_timeout = timeout > 0
deadline = -1
if has_timeout:
- # REVIEW, cpython uses a monotonic clock here
- deadline = time.time() + timeout;
+ deadline = _monotonic_clock() + timeout;
# Actually negotiate SSL connection
# XXX If SSL_do_handshake() returns 0, it's also a failure.
while True:
@@ -323,7 +320,7 @@
if has_timeout:
# REIVIEW monotonic clock?
- timeout = deadline - time.time()
+ timeout = deadline - _monotonic_clock()
if err == SSL_ERROR_WANT_READ:
sockstate = _ssl_select(sock, 0, timeout)
@@ -345,10 +342,11 @@
if ret < 1:
raise pyssl_error(self, ret)
- if self.peer_cert != ffi.NULL:
- lib.X509_free(self.peer_cert)
- #PySSL_BEGIN_ALLOW_THREADS
- self.peer_cert = lib.SSL_get_peer_certificate(ssl)
+ peer_cert = lib.SSL_get_peer_certificate(ssl)
+ if peer_cert != ffi.NULL:
+ peer_cert = ffi.gc(peer_cert, lib.X509_free)
+ self.peer_cert = peer_cert
+
#PySSL_END_ALLOW_THREADS
self.handshake_done = 1
return None
@@ -387,8 +385,7 @@
has_timeout = timeout > 0
if has_timeout:
- # TODO monotonic clock?
- deadline = time.time() + timeout
+ deadline = _monotonic_clock() + timeout
sockstate = _ssl_select(sock, 1, timeout)
if sockstate == SOCKET_HAS_TIMED_OUT:
@@ -399,16 +396,13 @@
raise ssl_error("Underlying socket too large for select().")
while True:
- #PySSL_START_ALLOW_THREADS
length = lib.SSL_write(self.ssl, b, len(b))
err = lib.SSL_get_error(self.ssl, length)
- #PySSL_END_ALLOW_THREADS
check_signals()
if has_timeout:
- # TODO monotonic clock
- timeout = deadline - time.time()
+ timeout = deadline - _monotonic_clock()
if err == SSL_ERROR_WANT_READ:
sockstate = _ssl_select(sock, 0, timeout)
@@ -440,7 +434,7 @@
sock = self.get_socket_or_connection_gone()
if not buffer_into:
- dest = _buffer_new(length)
+ dest = ffi.new("char[]", length)
mem = dest
else:
mem = ffi.from_buffer(buffer_into)
@@ -459,20 +453,17 @@
timeout = _socket_timeout(sock)
has_timeout = timeout > 0
if has_timeout:
- # TODO monotonic clock?
- deadline = time.time() + timeout
+ deadline = _monotonic_clock() + timeout
shutdown = False
while True:
- #PySSL_BEGIN_ALLOW_THREADS
count = lib.SSL_read(self.ssl, mem, length);
err = lib.SSL_get_error(self.ssl, count);
- #PySSL_END_ALLOW_THREADS
check_signals()
if has_timeout:
- timeout = deadline - time.time() # TODO ? _PyTime_GetMonotonicClock();
+ timeout = deadline - _monotonic_clock()
if err == SSL_ERROR_WANT_READ:
sockstate = _ssl_select(sock, 0, timeout)
@@ -591,13 +582,11 @@
has_timeout = (timeout > 0);
if has_timeout:
- # TODO monotonic clock
- deadline = time.time() + timeout;
+ deadline = _monotonic_clock() + timeout;
zeros = 0
while True:
- # TODO PySSL_BEGIN_ALLOW_THREADS
# Disable read-ahead so that unwrap can work correctly.
# Otherwise OpenSSL might read in too much data,
# eating clear text data that happens to be
@@ -609,7 +598,6 @@
if self.shutdown_seen_zero:
lib.SSL_set_read_ahead(self.ssl, 0)
err = lib.SSL_shutdown(self.ssl)
- # TODO PySSL_END_ALLOW_THREADS
# If err == 1, a secure shutdown with SSL_shutdown() is complete
if err > 0:
@@ -626,8 +614,7 @@
continue
if has_timeout:
- # TODO monotonic clock
- timeout = deadline - time.time() #_PyTime_GetMonotonicClock();
+ timeout = deadline - _monotonic_clock()
# Possibly retry shutdown until timeout or failure
ssl_err = lib.SSL_get_error(self.ssl, err)
@@ -657,16 +644,14 @@
return None
def pending(self):
- # TODO PySSL_BEGIN_ALLOW_THREADS
count = lib.SSL_pending(self.ssl)
- # TODO PySSL_END_ALLOW_THREADS
if count < 0:
raise pyssl_error(self, count)
else:
return count
def tls_unique_cb(self):
- buf = ffi.new("char[%d]" % SSL_CB_MAXLEN)
+ buf = ffi.new("char[]", SSL_CB_MAXLEN)
if lib.SSL_session_reused(self.ssl) ^ (not self.socket_type):
# if session is resumed XOR we are the client
@@ -692,8 +677,12 @@
def _fs_decode(name):
- # TODO return PyUnicode_DecodeFSDefault(short_name);
- return name.decode('utf-8')
+ return name.decode(sys.getfilesystemencoding())
+def _fs_converter(name):
+ """ name must not be None """
+ if isinstance(name, str):
+ return name.encode(sys.getfilesystemencoding())
+ return bytes(name)
def cipher_to_tuple(cipher):
@@ -747,9 +736,10 @@
else:
raise ValueError("invalid protocol version")
- self.ctx = lib.SSL_CTX_new(method)
- if self.ctx == ffi.NULL:
+ ctx = lib.SSL_CTX_new(method)
+ if ctx == ffi.NULL:
raise ssl_error("failed to allocate SSL context")
+ self.ctx = ffi.gc(lib.SSL_CTX_new(method), lib.SSL_CTX_free)
self._check_hostname = False
@@ -1049,15 +1039,6 @@
return {'x509': x509, 'x509_ca': x509_ca, 'crl': crl}
- def __del__(self):
- # REVIEW, is this done properly? In RPython the a finalizer
- # function is added
- ctx = self.ctx
- if ctx:
- self.ctx = None
- lib.SSL_CTX_free(ctx)
-
-
def session_stats(self):
stats = {}
for name, ssl_func in SSL_CTX_STATS:
@@ -1072,7 +1053,7 @@
ffi.errno = 0
if filepath is None:
raise TypeError("filepath must not be None")
- buf = _str_to_ffi_buffer(filepath, zeroterm=True)
+ buf = _fs_converter(filepath)
mode = ffi.new("char[]",b"r")
ffi.errno = 0
bio = lib.BIO_new_file(buf, mode)
@@ -1120,7 +1101,10 @@
return _list
def set_ecdh_curve(self, name):
- buf = _str_to_ffi_buffer(name, zeroterm=True)
+ # needs to be zero terminated
+ if name is None:
+ raise TypeError()
+ buf = _fs_converter(name)
nid = lib.OBJ_sn2nid(buf)
if nid == 0:
raise ValueError("unknown elliptic curve name '%s'" % name)
@@ -1273,7 +1257,6 @@
self.ctx = ctx
SERVERNAME_CALLBACKS = weakref.WeakValueDictionary()
-TEST = None
def _asn1obj2py(obj):
nid = lib.OBJ_obj2nid(obj)
@@ -1281,7 +1264,7 @@
raise ValueError("Unknown object")
sn = _str_from_buf(lib.OBJ_nid2sn(nid))
ln = _str_from_buf(lib.OBJ_nid2ln(nid))
- buf = ffi.new("char[255]")
+ buf = ffi.new("char[]", 255)
length = lib.OBJ_obj2txt(buf, len(buf), obj, 1)
if length < 0:
ssl_error(None)
@@ -1323,7 +1306,7 @@
lib.BIO_set_retry_read(bio);
lib.BIO_set_mem_eof_return(bio, -1);
- self.bio = bio;
+ self.bio = ffi.gc(bio, lib.BIO_free)
self.eof_written = False
@property
@@ -1361,7 +1344,7 @@
if count < 0 or count > avail:
count = avail;
- buf = ffi.new("char[%d]" % count)
+ buf = ffi.new("char[]", count)
nbytes = lib.BIO_read(self.bio, buf, count);
# There should never be any short reads but check anyway.
@@ -1376,12 +1359,11 @@
RAND_status = lib.RAND_status
-RAND_add = lib.RAND_add
def _RAND_bytes(count, pseudo):
if count < 0:
raise ValueError("num must be positive")
- buf = ffi.new("unsigned char[%d]" % count)
+ buf = ffi.new("unsigned char[]", count)
if pseudo:
# note by reaperhulk, RAND_pseudo_bytes is deprecated in 3.6 already,
# it is totally fine to just call RAND_bytes instead
diff --git a/lib_pypy/_cffi_ssl/_stdssl/certificate.py b/lib_pypy/_cffi_ssl/_stdssl/certificate.py
--- a/lib_pypy/_cffi_ssl/_stdssl/certificate.py
+++ b/lib_pypy/_cffi_ssl/_stdssl/certificate.py
@@ -278,7 +278,6 @@
lib.BIO_free(cert)
raise ssl_error("Can't malloc memory to read file")
- # REVIEW how to encode this properly?
epath = path.encode()
if lib.BIO_read_filename(cert, epath) <= 0:
lib.BIO_free(cert)
diff --git a/lib_pypy/_cffi_ssl/_stdssl/utility.py b/lib_pypy/_cffi_ssl/_stdssl/utility.py
--- a/lib_pypy/_cffi_ssl/_stdssl/utility.py
+++ b/lib_pypy/_cffi_ssl/_stdssl/utility.py
@@ -13,39 +13,22 @@
def _bytes_with_len(char_ptr, length):
return ffi.buffer(char_ptr, length)[:]
-def _str_to_ffi_buffer(view, zeroterm=False):
- # REVIEW unsure how to solve this. might be easy:
- # str does not support buffer protocol.
- # I think a user should really encode the string before it is
- # passed here!
+def _str_to_ffi_buffer(view):
if isinstance(view, str):
- enc = view.encode()
- if zeroterm:
- return ffi.from_buffer(enc + b'\x00')
- else:
- return ffi.from_buffer(enc)
- else:
- if isinstance(view, memoryview):
- # TODO pypy limitation StringBuffer does not allow
- # to get a raw address to the string!
- view = bytes(view)
- if zeroterm:
- return ffi.from_buffer(view + b'\x00')
- else:
- return ffi.from_buffer(view)
+ return ffi.from_buffer(view.encode())
+ elif isinstance(view, memoryview):
+ # NOTE pypy limitation StringBuffer does not allow
+ # to get a raw address to the string!
+ view = bytes(view)
+ # dont call call ffi.from_buffer(bytes(view)), arguments
+ # like ints/bools should result in a TypeError
+ return ffi.from_buffer(view)
def _str_from_buf(buf):
return ffi.string(buf).decode('utf-8')
def _cstr_decode_fs(buf):
-#define CONVERT(info, target) { \
-# const char *tmp = (info); \
-# target = NULL; \
-# if (!tmp) { Py_INCREF(Py_None); target = Py_None; } \
-# else if ((target = PyUnicode_DecodeFSDefault(tmp)) == NULL) { \
-# target = PyBytes_FromString(tmp); } \
-# if (!target) goto error; \
-# }
- # REVIEW
+ if buf == ffi.NULL:
+ return None
return ffi.string(buf).decode(sys.getfilesystemencoding())
diff --git a/lib_pypy/ssl.py b/lib_pypy/ssl.py
deleted file mode 100644
--- a/lib_pypy/ssl.py
+++ /dev/null
@@ -1,1148 +0,0 @@
-# Wrapper module for _ssl, providing some additional facilities
-# implemented in Python. Written by Bill Janssen.
-
-"""This module provides some more Pythonic support for SSL.
-
-Object types:
-
- SSLSocket -- subtype of socket.socket which does SSL over the socket
-
-Exceptions:
-
- SSLError -- exception raised for I/O errors
-
-Functions:
-
- cert_time_to_seconds -- convert time string used for certificate
- notBefore and notAfter functions to integer
- seconds past the Epoch (the time values
- returned from time.time())
-
- fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
- by the server running on HOST at port PORT. No
- validation of the certificate is performed.
-
-Integer constants:
-
-SSL_ERROR_ZERO_RETURN
-SSL_ERROR_WANT_READ
-SSL_ERROR_WANT_WRITE
-SSL_ERROR_WANT_X509_LOOKUP
-SSL_ERROR_SYSCALL
-SSL_ERROR_SSL
-SSL_ERROR_WANT_CONNECT
-
-SSL_ERROR_EOF
-SSL_ERROR_INVALID_ERROR_CODE
-
-The following group define certificate requirements that one side is
-allowing/requiring from the other side:
-
-CERT_NONE - no certificates from the other side are required (or will
- be looked at if provided)
-CERT_OPTIONAL - certificates are not required, but if provided will be
- validated, and if validation fails, the connection will
- also fail
-CERT_REQUIRED - certificates are required, and will be validated, and
- if validation fails, the connection will also fail
-
-The following constants identify various SSL protocol variants:
-
-PROTOCOL_SSLv2
-PROTOCOL_SSLv3
-PROTOCOL_SSLv23
-PROTOCOL_TLSv1
-PROTOCOL_TLSv1_1
-PROTOCOL_TLSv1_2
-
-The following constants identify various SSL alert message descriptions as per
-http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
-
-ALERT_DESCRIPTION_CLOSE_NOTIFY
-ALERT_DESCRIPTION_UNEXPECTED_MESSAGE
-ALERT_DESCRIPTION_BAD_RECORD_MAC
-ALERT_DESCRIPTION_RECORD_OVERFLOW
-ALERT_DESCRIPTION_DECOMPRESSION_FAILURE
-ALERT_DESCRIPTION_HANDSHAKE_FAILURE
-ALERT_DESCRIPTION_BAD_CERTIFICATE
-ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE
-ALERT_DESCRIPTION_CERTIFICATE_REVOKED
-ALERT_DESCRIPTION_CERTIFICATE_EXPIRED
-ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN
-ALERT_DESCRIPTION_ILLEGAL_PARAMETER
-ALERT_DESCRIPTION_UNKNOWN_CA
-ALERT_DESCRIPTION_ACCESS_DENIED
-ALERT_DESCRIPTION_DECODE_ERROR
-ALERT_DESCRIPTION_DECRYPT_ERROR
-ALERT_DESCRIPTION_PROTOCOL_VERSION
-ALERT_DESCRIPTION_INSUFFICIENT_SECURITY
-ALERT_DESCRIPTION_INTERNAL_ERROR
-ALERT_DESCRIPTION_USER_CANCELLED
-ALERT_DESCRIPTION_NO_RENEGOTIATION
-ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION
-ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE
-ALERT_DESCRIPTION_UNRECOGNIZED_NAME
-ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE
-ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE
-ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY
-"""
-
-import ipaddress
-import textwrap
-import re
-import sys
-import os
-from collections import namedtuple
-from enum import Enum as _Enum, IntEnum as _IntEnum
-
-import _ssl # if we can't import it, let the error propagate
-
-from _ssl import OPENSSL_VERSION_NUMBER, OPENSSL_VERSION_INFO, OPENSSL_VERSION
-from _ssl import _SSLContext, MemoryBIO
-from _ssl import (
- SSLError, SSLZeroReturnError, SSLWantReadError, SSLWantWriteError,
- SSLSyscallError, SSLEOFError,
- )
-from _ssl import CERT_NONE, CERT_OPTIONAL, CERT_REQUIRED
-from _ssl import txt2obj as _txt2obj, nid2obj as _nid2obj
-from _ssl import RAND_status, RAND_add, RAND_bytes, RAND_pseudo_bytes
-try:
- from _ssl import RAND_egd
-except ImportError:
- # LibreSSL does not provide RAND_egd
- pass
-
-def _import_symbols(prefix):
- for n in dir(_ssl):
- if n.startswith(prefix):
- globals()[n] = getattr(_ssl, n)
-
-_import_symbols('OP_')
-_import_symbols('ALERT_DESCRIPTION_')
-_import_symbols('SSL_ERROR_')
-_import_symbols('VERIFY_')
-
-from _ssl import HAS_SNI, HAS_ECDH, HAS_NPN, HAS_ALPN
-
-from _ssl import _OPENSSL_API_VERSION
-
-_IntEnum._convert(
- '_SSLMethod', __name__,
- lambda name: name.startswith('PROTOCOL_'),
- source=_ssl)
-
-_PROTOCOL_NAMES = {value: name for name, value in _SSLMethod.__members__.items()}
-
-try:
- _SSLv2_IF_EXISTS = PROTOCOL_SSLv2
-except NameError:
- _SSLv2_IF_EXISTS = None
-
-if sys.platform == "win32":
- from _ssl import enum_certificates, enum_crls
-
-from socket import socket, AF_INET, SOCK_STREAM, create_connection
-from socket import SOL_SOCKET, SO_TYPE
-import base64 # for DER-to-PEM translation
-import errno
-import warnings
-
-
-socket_error = OSError # keep that public name in module namespace
-
-if _ssl.HAS_TLS_UNIQUE:
- CHANNEL_BINDING_TYPES = ['tls-unique']
-else:
- CHANNEL_BINDING_TYPES = []
-
-# Disable weak or insecure ciphers by default
-# (OpenSSL's default setting is 'DEFAULT:!aNULL:!eNULL')
-# Enable a better set of ciphers by default
-# This list has been explicitly chosen to:
-# * Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
-# * Prefer ECDHE over DHE for better performance
-# * Prefer any AES-GCM over any AES-CBC for better performance and security
-# * Then Use HIGH cipher suites as a fallback
-# * Then Use 3DES as fallback which is secure but slow
-# * Disable NULL authentication, NULL encryption, and MD5 MACs for security
-# reasons
-_DEFAULT_CIPHERS = (
- 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
- 'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:'
- '!eNULL:!MD5'
-)
-
-# Restricted and more secure ciphers for the server side
-# This list has been explicitly chosen to:
-# * Prefer cipher suites that offer perfect forward secrecy (DHE/ECDHE)
-# * Prefer ECDHE over DHE for better performance
-# * Prefer any AES-GCM over any AES-CBC for better performance and security
-# * Then Use HIGH cipher suites as a fallback
-# * Then Use 3DES as fallback which is secure but slow
-# * Disable NULL authentication, NULL encryption, MD5 MACs, DSS, and RC4 for
-# security reasons
-_RESTRICTED_SERVER_CIPHERS = (
- 'ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+HIGH:'
- 'DH+HIGH:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+HIGH:RSA+3DES:!aNULL:'
- '!eNULL:!MD5:!DSS:!RC4'
-)
-
-
-class CertificateError(ValueError):
- pass
-
-
-def _dnsname_match(dn, hostname, max_wildcards=1):
- """Matching according to RFC 6125, section 6.4.3
-
- http://tools.ietf.org/html/rfc6125#section-6.4.3
- """
- pats = []
- if not dn:
- return False
-
- leftmost, *remainder = dn.split(r'.')
-
- wildcards = leftmost.count('*')
- if wildcards > max_wildcards:
- # Issue #17980: avoid denials of service by refusing more
- # than one wildcard per fragment. A survey of established
- # policy among SSL implementations showed it to be a
- # reasonable choice.
- raise CertificateError(
- "too many wildcards in certificate DNS name: " + repr(dn))
-
- # speed up common case w/o wildcards
- if not wildcards:
- return dn.lower() == hostname.lower()
-
- # RFC 6125, section 6.4.3, subitem 1.
- # The client SHOULD NOT attempt to match a presented identifier in which
- # the wildcard character comprises a label other than the left-most label.
- if leftmost == '*':
- # When '*' is a fragment by itself, it matches a non-empty dotless
- # fragment.
- pats.append('[^.]+')
- elif leftmost.startswith('xn--') or hostname.startswith('xn--'):
- # RFC 6125, section 6.4.3, subitem 3.
- # The client SHOULD NOT attempt to match a presented identifier
- # where the wildcard character is embedded within an A-label or
- # U-label of an internationalized domain name.
- pats.append(re.escape(leftmost))
- else:
- # Otherwise, '*' matches any dotless string, e.g. www*
- pats.append(re.escape(leftmost).replace(r'\*', '[^.]*'))
-
- # add the remaining fragments, ignore any wildcards
- for frag in remainder:
- pats.append(re.escape(frag))
-
- pat = re.compile(r'\A' + r'\.'.join(pats) + r'\Z', re.IGNORECASE)
- return pat.match(hostname)
-
-
-def _ipaddress_match(ipname, host_ip):
- """Exact matching of IP addresses.
-
- RFC 6125 explicitly doesn't define an algorithm for this
- (section 1.7.2 - "Out of Scope").
- """
- # OpenSSL may add a trailing newline to a subjectAltName's IP address
- ip = ipaddress.ip_address(ipname.rstrip())
- return ip == host_ip
-
-
-def match_hostname(cert, hostname):
- """Verify that *cert* (in decoded format as returned by
- SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
- rules are followed, but IP addresses are not accepted for *hostname*.
-
- CertificateError is raised on failure. On success, the function
- returns nothing.
- """
- if not cert:
- raise ValueError("empty or no certificate, match_hostname needs a "
- "SSL socket or SSL context with either "
- "CERT_OPTIONAL or CERT_REQUIRED")
- try:
- host_ip = ipaddress.ip_address(hostname)
- except ValueError:
- # Not an IP address (common case)
- host_ip = None
- dnsnames = []
- san = cert.get('subjectAltName', ())
- for key, value in san:
- if key == 'DNS':
- if host_ip is None and _dnsname_match(value, hostname):
- return
- dnsnames.append(value)
- elif key == 'IP Address':
- if host_ip is not None and _ipaddress_match(value, host_ip):
- return
- dnsnames.append(value)
- if not dnsnames:
- # The subject is only checked when there is no dNSName entry
- # in subjectAltName
- for sub in cert.get('subject', ()):
- for key, value in sub:
- # XXX according to RFC 2818, the most specific Common Name
- # must be used.
- if key == 'commonName':
- if _dnsname_match(value, hostname):
- return
- dnsnames.append(value)
- if len(dnsnames) > 1:
- raise CertificateError("hostname %r "
- "doesn't match either of %s"
- % (hostname, ', '.join(map(repr, dnsnames))))
- elif len(dnsnames) == 1:
- raise CertificateError("hostname %r "
- "doesn't match %r"
- % (hostname, dnsnames[0]))
- else:
- raise CertificateError("no appropriate commonName or "
- "subjectAltName fields were found")
-
-
-DefaultVerifyPaths = namedtuple("DefaultVerifyPaths",
- "cafile capath openssl_cafile_env openssl_cafile openssl_capath_env "
- "openssl_capath")
-
-def get_default_verify_paths():
- """Return paths to default cafile and capath.
- """
- parts = _ssl.get_default_verify_paths()
-
- # environment vars shadow paths
- cafile = os.environ.get(parts[0], parts[1])
- capath = os.environ.get(parts[2], parts[3])
-
- return DefaultVerifyPaths(cafile if os.path.isfile(cafile) else None,
- capath if os.path.isdir(capath) else None,
- *parts)
-
-
-class _ASN1Object(namedtuple("_ASN1Object", "nid shortname longname oid")):
- """ASN.1 object identifier lookup
- """
- __slots__ = ()
-
- def __new__(cls, oid):
- return super().__new__(cls, *_txt2obj(oid, name=False))
-
- @classmethod
- def fromnid(cls, nid):
- """Create _ASN1Object from OpenSSL numeric ID
- """
- return super().__new__(cls, *_nid2obj(nid))
-
- @classmethod
- def fromname(cls, name):
- """Create _ASN1Object from short name, long name or OID
- """
- return super().__new__(cls, *_txt2obj(name, name=True))
-
-
-class Purpose(_ASN1Object, _Enum):
- """SSLContext purpose flags with X509v3 Extended Key Usage objects
- """
- SERVER_AUTH = '1.3.6.1.5.5.7.3.1'
- CLIENT_AUTH = '1.3.6.1.5.5.7.3.2'
-
-
-class SSLContext(_SSLContext):
- """An SSLContext holds various SSL-related configuration options and
- data, such as certificates and possibly a private key."""
-
- __slots__ = ('protocol', '__weakref__')
- _windows_cert_stores = ("CA", "ROOT")
-
- def __new__(cls, protocol, *args, **kwargs):
- self = _SSLContext.__new__(cls, protocol)
- if protocol != _SSLv2_IF_EXISTS:
- self.set_ciphers(_DEFAULT_CIPHERS)
- return self
-
- def __init__(self, protocol):
- self.protocol = protocol
-
- def wrap_socket(self, sock, server_side=False,
- do_handshake_on_connect=True,
- suppress_ragged_eofs=True,
- server_hostname=None):
- return SSLSocket(sock=sock, server_side=server_side,
- do_handshake_on_connect=do_handshake_on_connect,
- suppress_ragged_eofs=suppress_ragged_eofs,
- server_hostname=server_hostname,
- _context=self)
-
- def wrap_bio(self, incoming, outgoing, server_side=False,
- server_hostname=None):
- sslobj = self._wrap_bio(incoming, outgoing, server_side=server_side,
- server_hostname=server_hostname)
- return SSLObject(sslobj)
-
- def set_npn_protocols(self, npn_protocols):
- protos = bytearray()
- for protocol in npn_protocols:
- b = bytes(protocol, 'ascii')
- if len(b) == 0 or len(b) > 255:
- raise SSLError('NPN protocols must be 1 to 255 in length')
- protos.append(len(b))
- protos.extend(b)
-
- self._set_npn_protocols(protos)
-
- def set_alpn_protocols(self, alpn_protocols):
- protos = bytearray()
- for protocol in alpn_protocols:
- b = bytes(protocol, 'ascii')
- if len(b) == 0 or len(b) > 255:
- raise SSLError('ALPN protocols must be 1 to 255 in length')
- protos.append(len(b))
- protos.extend(b)
-
- self._set_alpn_protocols(protos)
-
- def _load_windows_store_certs(self, storename, purpose):
- certs = bytearray()
- try:
- for cert, encoding, trust in enum_certificates(storename):
- # CA certs are never PKCS#7 encoded
- if encoding == "x509_asn":
- if trust is True or purpose.oid in trust:
- certs.extend(cert)
- except PermissionError:
- warnings.warn("unable to enumerate Windows certificate store")
- if certs:
- self.load_verify_locations(cadata=certs)
- return certs
-
- def load_default_certs(self, purpose=Purpose.SERVER_AUTH):
- if not isinstance(purpose, _ASN1Object):
- raise TypeError(purpose)
- if sys.platform == "win32":
- for storename in self._windows_cert_stores:
- self._load_windows_store_certs(storename, purpose)
- self.set_default_verify_paths()
-
-
-def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
- capath=None, cadata=None):
- """Create a SSLContext object with default settings.
-
- NOTE: The protocol and settings may change anytime without prior
- deprecation. The values represent a fair balance between maximum
- compatibility and security.
- """
- if not isinstance(purpose, _ASN1Object):
- raise TypeError(purpose)
-
- context = SSLContext(PROTOCOL_SSLv23)
-
- # SSLv2 considered harmful.
- context.options |= OP_NO_SSLv2
-
- # SSLv3 has problematic security and is only required for really old
- # clients such as IE6 on Windows XP
- context.options |= OP_NO_SSLv3
-
- # disable compression to prevent CRIME attacks (OpenSSL 1.0+)
- context.options |= getattr(_ssl, "OP_NO_COMPRESSION", 0)
-
- if purpose == Purpose.SERVER_AUTH:
- # verify certs and host name in client mode
- context.verify_mode = CERT_REQUIRED
- context.check_hostname = True
- elif purpose == Purpose.CLIENT_AUTH:
- # Prefer the server's ciphers by default so that we get stronger
- # encryption
- context.options |= getattr(_ssl, "OP_CIPHER_SERVER_PREFERENCE", 0)
-
- # Use single use keys in order to improve forward secrecy
- context.options |= getattr(_ssl, "OP_SINGLE_DH_USE", 0)
- context.options |= getattr(_ssl, "OP_SINGLE_ECDH_USE", 0)
-
- # disallow ciphers with known vulnerabilities
- context.set_ciphers(_RESTRICTED_SERVER_CIPHERS)
-
- if cafile or capath or cadata:
- context.load_verify_locations(cafile, capath, cadata)
- elif context.verify_mode != CERT_NONE:
- # no explicit cafile, capath or cadata but the verify mode is
- # CERT_OPTIONAL or CERT_REQUIRED. Let's try to load default system
- # root CA certificates for the given purpose. This may fail silently.
- context.load_default_certs(purpose)
- return context
-
-def _create_unverified_context(protocol=PROTOCOL_SSLv23, *, cert_reqs=None,
- check_hostname=False, purpose=Purpose.SERVER_AUTH,
- certfile=None, keyfile=None,
- cafile=None, capath=None, cadata=None):
- """Create a SSLContext object for Python stdlib modules
-
- All Python stdlib modules shall use this function to create SSLContext
- objects in order to keep common settings in one place. The configuration
- is less restrict than create_default_context()'s to increase backward
- compatibility.
- """
- if not isinstance(purpose, _ASN1Object):
- raise TypeError(purpose)
-
- context = SSLContext(protocol)
- # SSLv2 considered harmful.
- context.options |= OP_NO_SSLv2
- # SSLv3 has problematic security and is only required for really old
- # clients such as IE6 on Windows XP
- context.options |= OP_NO_SSLv3
-
- if cert_reqs is not None:
- context.verify_mode = cert_reqs
- context.check_hostname = check_hostname
-
- if keyfile and not certfile:
- raise ValueError("certfile must be specified")
- if certfile or keyfile:
- context.load_cert_chain(certfile, keyfile)
-
- # load CA root certs
- if cafile or capath or cadata:
- context.load_verify_locations(cafile, capath, cadata)
- elif context.verify_mode != CERT_NONE:
- # no explicit cafile, capath or cadata but the verify mode is
- # CERT_OPTIONAL or CERT_REQUIRED. Let's try to load default system
- # root CA certificates for the given purpose. This may fail silently.
- context.load_default_certs(purpose)
-
- return context
-
-# Used by http.client if no context is explicitly passed.
-_create_default_https_context = create_default_context
-
-
-# Backwards compatibility alias, even though it's not a public name.
-_create_stdlib_context = _create_unverified_context
-
-
-class SSLObject:
- """This class implements an interface on top of a low-level SSL object as
- implemented by OpenSSL. This object captures the state of an SSL connection
- but does not provide any network IO itself. IO needs to be performed
- through separate "BIO" objects which are OpenSSL's IO abstraction layer.
-
- This class does not have a public constructor. Instances are returned by
- ``SSLContext.wrap_bio``. This class is typically used by framework authors
- that want to implement asynchronous IO for SSL through memory buffers.
-
- When compared to ``SSLSocket``, this object lacks the following features:
-
- * Any form of network IO incluging methods such as ``recv`` and ``send``.
- * The ``do_handshake_on_connect`` and ``suppress_ragged_eofs`` machinery.
- """
-
- def __init__(self, sslobj, owner=None):
- self._sslobj = sslobj
- # Note: _sslobj takes a weak reference to owner
- self._sslobj.owner = owner or self
-
- @property
- def context(self):
- """The SSLContext that is currently in use."""
- return self._sslobj.context
-
- @context.setter
- def context(self, ctx):
- self._sslobj.context = ctx
-
- @property
- def server_side(self):
- """Whether this is a server-side socket."""
- return self._sslobj.server_side
-
- @property
- def server_hostname(self):
- """The currently set server hostname (for SNI), or ``None`` if no
- server hostame is set."""
- return self._sslobj.server_hostname
-
- def read(self, len=1024, buffer=None):
- """Read up to 'len' bytes from the SSL object and return them.
-
- If 'buffer' is provided, read into this buffer and return the number of
- bytes read.
- """
- if buffer is not None:
- v = self._sslobj.read(len, buffer)
- else:
- v = self._sslobj.read(len)
- return v
-
- def write(self, data):
- """Write 'data' to the SSL object and return the number of bytes
- written.
-
- The 'data' argument must support the buffer interface.
- """
- return self._sslobj.write(data)
-
- def getpeercert(self, binary_form=False):
- """Returns a formatted version of the data in the certificate provided
- by the other end of the SSL channel.
-
- Return None if no certificate was provided, {} if a certificate was
- provided, but not validated.
- """
- return self._sslobj.peer_certificate(binary_form)
-
- def selected_npn_protocol(self):
- """Return the currently selected NPN protocol as a string, or ``None``
- if a next protocol was not negotiated or if NPN is not supported by one
- of the peers."""
- if _ssl.HAS_NPN:
- return self._sslobj.selected_npn_protocol()
-
- def selected_alpn_protocol(self):
- """Return the currently selected ALPN protocol as a string, or ``None``
- if a next protocol was not negotiated or if ALPN is not supported by one
- of the peers."""
- if _ssl.HAS_ALPN:
- return self._sslobj.selected_alpn_protocol()
-
- def cipher(self):
- """Return the currently selected cipher as a 3-tuple ``(name,
- ssl_version, secret_bits)``."""
- return self._sslobj.cipher()
-
- def shared_ciphers(self):
- """Return a list of ciphers shared by the client during the handshake or
- None if this is not a valid server connection.
- """
- return self._sslobj.shared_ciphers()
-
- def compression(self):
- """Return the current compression algorithm in use, or ``None`` if
- compression was not negotiated or not supported by one of the peers."""
- return self._sslobj.compression()
-
- def pending(self):
- """Return the number of bytes that can be read immediately."""
- return self._sslobj.pending()
-
- def do_handshake(self):
- """Start the SSL/TLS handshake."""
- self._sslobj.do_handshake()
- if self.context.check_hostname:
- if not self.server_hostname:
- raise ValueError("check_hostname needs server_hostname "
- "argument")
- match_hostname(self.getpeercert(), self.server_hostname)
-
- def unwrap(self):
- """Start the SSL shutdown handshake."""
- return self._sslobj.shutdown()
-
- def get_channel_binding(self, cb_type="tls-unique"):
- """Get channel binding data for current connection. Raise ValueError
- if the requested `cb_type` is not supported. Return bytes of the data
- or None if the data is not available (e.g. before the handshake)."""
- if cb_type not in CHANNEL_BINDING_TYPES:
- raise ValueError("Unsupported channel binding type")
- if cb_type != "tls-unique":
- raise NotImplementedError(
- "{0} channel binding type not implemented"
- .format(cb_type))
- return self._sslobj.tls_unique_cb()
-
- def version(self):
- """Return a string identifying the protocol version used by the
- current SSL channel. """
- return self._sslobj.version()
-
-
-class SSLSocket(socket):
- """This class implements a subtype of socket.socket that wraps
- the underlying OS socket in an SSL context when necessary, and
- provides read and write methods over that channel."""
-
- def __init__(self, sock=None, keyfile=None, certfile=None,
- server_side=False, cert_reqs=CERT_NONE,
- ssl_version=PROTOCOL_SSLv23, ca_certs=None,
- do_handshake_on_connect=True,
- family=AF_INET, type=SOCK_STREAM, proto=0, fileno=None,
- suppress_ragged_eofs=True, npn_protocols=None, ciphers=None,
- server_hostname=None,
- _context=None):
-
- if _context:
- self._context = _context
- else:
- if server_side and not certfile:
- raise ValueError("certfile must be specified for server-side "
- "operations")
- if keyfile and not certfile:
- raise ValueError("certfile must be specified")
- if certfile and not keyfile:
- keyfile = certfile
- self._context = SSLContext(ssl_version)
- self._context.verify_mode = cert_reqs
- if ca_certs:
- self._context.load_verify_locations(ca_certs)
- if certfile:
- self._context.load_cert_chain(certfile, keyfile)
- if npn_protocols:
- self._context.set_npn_protocols(npn_protocols)
- if ciphers:
- self._context.set_ciphers(ciphers)
- self.keyfile = keyfile
- self.certfile = certfile
- self.cert_reqs = cert_reqs
- self.ssl_version = ssl_version
- self.ca_certs = ca_certs
- self.ciphers = ciphers
- # Can't use sock.type as other flags (such as SOCK_NONBLOCK) get
- # mixed in.
- if sock.getsockopt(SOL_SOCKET, SO_TYPE) != SOCK_STREAM:
- raise NotImplementedError("only stream sockets are supported")
- if server_side and server_hostname:
- raise ValueError("server_hostname can only be specified "
- "in client mode")
- if self._context.check_hostname and not server_hostname:
- raise ValueError("check_hostname requires server_hostname")
- self.server_side = server_side
- self.server_hostname = server_hostname
- self.do_handshake_on_connect = do_handshake_on_connect
- self.suppress_ragged_eofs = suppress_ragged_eofs
- if sock is not None:
- socket.__init__(self,
- family=sock.family,
- type=sock.type,
- proto=sock.proto,
- fileno=sock.fileno())
- self.settimeout(sock.gettimeout())
- sock.detach()
- elif fileno is not None:
- socket.__init__(self, fileno=fileno)
- else:
- socket.__init__(self, family=family, type=type, proto=proto)
-
- # See if we are connected
- try:
- self.getpeername()
- except OSError as e:
- if e.errno != errno.ENOTCONN:
- raise
- connected = False
- else:
- connected = True
-
- self._closed = False
- self._sslobj = None
- self._connected = connected
- if connected:
- # create the SSL object
- try:
- sslobj = self._context._wrap_socket(self, server_side,
- server_hostname)
- self._sslobj = SSLObject(sslobj, owner=self)
- if do_handshake_on_connect:
- timeout = self.gettimeout()
- if timeout == 0.0:
- # non-blocking
- raise ValueError("do_handshake_on_connect should not be specified for non-blocking sockets")
- self.do_handshake()
-
- except (OSError, ValueError):
- self.close()
- raise
-
- @property
- def context(self):
- return self._context
-
- @context.setter
- def context(self, ctx):
- self._context = ctx
- self._sslobj.context = ctx
-
- def dup(self):
- raise NotImplemented("Can't dup() %s instances" %
- self.__class__.__name__)
-
- def _checkClosed(self, msg=None):
- # raise an exception here if you wish to check for spurious closes
- pass
-
- def _check_connected(self):
- if not self._connected:
- # getpeername() will raise ENOTCONN if the socket is really
- # not connected; note that we can be connected even without
- # _connected being set, e.g. if connect() first returned
- # EAGAIN.
- self.getpeername()
-
- def read(self, len=1024, buffer=None):
- """Read up to LEN bytes and return them.
- Return zero-length string on EOF."""
-
- self._checkClosed()
- if not self._sslobj:
- raise ValueError("Read on closed or unwrapped SSL socket.")
- try:
- return self._sslobj.read(len, buffer)
- except SSLError as x:
- if x.args[0] == SSL_ERROR_EOF and self.suppress_ragged_eofs:
- if buffer is not None:
- return 0
- else:
- return b''
- else:
- raise
-
- def write(self, data):
- """Write DATA to the underlying SSL channel. Returns
- number of bytes of DATA actually transmitted."""
-
- self._checkClosed()
- if not self._sslobj:
- raise ValueError("Write on closed or unwrapped SSL socket.")
- return self._sslobj.write(data)
-
- def getpeercert(self, binary_form=False):
- """Returns a formatted version of the data in the
- certificate provided by the other end of the SSL channel.
- Return None if no certificate was provided, {} if a
- certificate was provided, but not validated."""
-
- self._checkClosed()
- self._check_connected()
- return self._sslobj.getpeercert(binary_form)
-
- def selected_npn_protocol(self):
- self._checkClosed()
- if not self._sslobj or not _ssl.HAS_NPN:
- return None
- else:
- return self._sslobj.selected_npn_protocol()
-
- def selected_alpn_protocol(self):
- self._checkClosed()
- if not self._sslobj or not _ssl.HAS_ALPN:
- return None
- else:
- return self._sslobj.selected_alpn_protocol()
-
- def cipher(self):
- self._checkClosed()
- if not self._sslobj:
- return None
- else:
- return self._sslobj.cipher()
-
- def shared_ciphers(self):
- self._checkClosed()
- if not self._sslobj:
- return None
- return self._sslobj.shared_ciphers()
-
- def compression(self):
- self._checkClosed()
- if not self._sslobj:
- return None
- else:
- return self._sslobj.compression()
-
- def send(self, data, flags=0):
- self._checkClosed()
- if self._sslobj:
- if flags != 0:
- raise ValueError(
- "non-zero flags not allowed in calls to send() on %s" %
- self.__class__)
- return self._sslobj.write(data)
- else:
- return socket.send(self, data, flags)
-
- def sendto(self, data, flags_or_addr, addr=None):
- self._checkClosed()
- if self._sslobj:
- raise ValueError("sendto not allowed on instances of %s" %
- self.__class__)
- elif addr is None:
- return socket.sendto(self, data, flags_or_addr)
- else:
- return socket.sendto(self, data, flags_or_addr, addr)
-
- def sendmsg(self, *args, **kwargs):
- # Ensure programs don't send data unencrypted if they try to
- # use this method.
- raise NotImplementedError("sendmsg not allowed on instances of %s" %
- self.__class__)
-
- def sendall(self, data, flags=0):
- self._checkClosed()
- if self._sslobj:
- if flags != 0:
- raise ValueError(
- "non-zero flags not allowed in calls to sendall() on %s" %
- self.__class__)
- amount = len(data)
- count = 0
- while (count < amount):
- v = self.send(data[count:])
- count += v
- return amount
- else:
- return socket.sendall(self, data, flags)
-
- def sendfile(self, file, offset=0, count=None):
- """Send a file, possibly by using os.sendfile() if this is a
- clear-text socket. Return the total number of bytes sent.
- """
- if self._sslobj is None:
- # os.sendfile() works with plain sockets only
- return super().sendfile(file, offset, count)
- else:
- return self._sendfile_use_send(file, offset, count)
-
- def recv(self, buflen=1024, flags=0):
- self._checkClosed()
- if self._sslobj:
- if flags != 0:
- raise ValueError(
- "non-zero flags not allowed in calls to recv() on %s" %
- self.__class__)
- return self.read(buflen)
- else:
- return socket.recv(self, buflen, flags)
-
- def recv_into(self, buffer, nbytes=None, flags=0):
- self._checkClosed()
- if buffer and (nbytes is None):
- nbytes = len(buffer)
- elif nbytes is None:
- nbytes = 1024
- if self._sslobj:
- if flags != 0:
- raise ValueError(
- "non-zero flags not allowed in calls to recv_into() on %s" %
- self.__class__)
- return self.read(nbytes, buffer)
- else:
- return socket.recv_into(self, buffer, nbytes, flags)
-
- def recvfrom(self, buflen=1024, flags=0):
- self._checkClosed()
- if self._sslobj:
- raise ValueError("recvfrom not allowed on instances of %s" %
- self.__class__)
- else:
- return socket.recvfrom(self, buflen, flags)
-
- def recvfrom_into(self, buffer, nbytes=None, flags=0):
- self._checkClosed()
- if self._sslobj:
- raise ValueError("recvfrom_into not allowed on instances of %s" %
- self.__class__)
- else:
- return socket.recvfrom_into(self, buffer, nbytes, flags)
-
- def recvmsg(self, *args, **kwargs):
- raise NotImplementedError("recvmsg not allowed on instances of %s" %
- self.__class__)
-
- def recvmsg_into(self, *args, **kwargs):
- raise NotImplementedError("recvmsg_into not allowed on instances of "
- "%s" % self.__class__)
-
- def pending(self):
- self._checkClosed()
- if self._sslobj:
- return self._sslobj.pending()
- else:
- return 0
-
- def shutdown(self, how):
- self._checkClosed()
- self._sslobj = None
- socket.shutdown(self, how)
-
- def unwrap(self):
- if self._sslobj:
- s = self._sslobj.unwrap()
- self._sslobj = None
- return s
- else:
- raise ValueError("No SSL wrapper around " + str(self))
-
- def _real_close(self):
- self._sslobj = None
- socket._real_close(self)
-
- def do_handshake(self, block=False):
- """Perform a TLS/SSL handshake."""
- self._check_connected()
- timeout = self.gettimeout()
- try:
- if timeout == 0.0 and block:
- self.settimeout(None)
- self._sslobj.do_handshake()
- finally:
- self.settimeout(timeout)
-
- def _real_connect(self, addr, connect_ex):
- if self.server_side:
- raise ValueError("can't connect in server-side mode")
- # Here we assume that the socket is client-side, and not
- # connected at the time of the call. We connect it, then wrap it.
- if self._connected:
- raise ValueError("attempt to connect already-connected SSLSocket!")
- sslobj = self.context._wrap_socket(self, False, self.server_hostname)
- self._sslobj = SSLObject(sslobj, owner=self)
- try:
- if connect_ex:
- rc = socket.connect_ex(self, addr)
- else:
- rc = None
- socket.connect(self, addr)
- if not rc:
- self._connected = True
- if self.do_handshake_on_connect:
- self.do_handshake()
- return rc
- except (OSError, ValueError):
- self._sslobj = None
- raise
-
- def connect(self, addr):
- """Connects to remote ADDR, and then wraps the connection in
- an SSL channel."""
- self._real_connect(addr, False)
-
- def connect_ex(self, addr):
- """Connects to remote ADDR, and then wraps the connection in
- an SSL channel."""
- return self._real_connect(addr, True)
-
- def accept(self):
- """Accepts a new connection from a remote client, and returns
- a tuple containing that new connection wrapped with a server-side
- SSL channel, and the address of the remote client."""
-
- newsock, addr = socket.accept(self)
- newsock = self.context.wrap_socket(newsock,
- do_handshake_on_connect=self.do_handshake_on_connect,
- suppress_ragged_eofs=self.suppress_ragged_eofs,
- server_side=True)
- return newsock, addr
-
- def get_channel_binding(self, cb_type="tls-unique"):
- """Get channel binding data for current connection. Raise ValueError
- if the requested `cb_type` is not supported. Return bytes of the data
- or None if the data is not available (e.g. before the handshake).
- """
- if self._sslobj is None:
- return None
- return self._sslobj.get_channel_binding(cb_type)
-
- def version(self):
- """
- Return a string identifying the protocol version used by the
- current SSL channel, or None if there is no established channel.
- """
- if self._sslobj is None:
- return None
- return self._sslobj.version()
-
-
-def wrap_socket(sock, keyfile=None, certfile=None,
- server_side=False, cert_reqs=CERT_NONE,
- ssl_version=PROTOCOL_SSLv23, ca_certs=None,
- do_handshake_on_connect=True,
- suppress_ragged_eofs=True,
- ciphers=None):
-
- return SSLSocket(sock=sock, keyfile=keyfile, certfile=certfile,
- server_side=server_side, cert_reqs=cert_reqs,
- ssl_version=ssl_version, ca_certs=ca_certs,
- do_handshake_on_connect=do_handshake_on_connect,
- suppress_ragged_eofs=suppress_ragged_eofs,
- ciphers=ciphers)
-
-# some utility functions
-
-def cert_time_to_seconds(cert_time):
- """Return the time in seconds since the Epoch, given the timestring
- representing the "notBefore" or "notAfter" date from a certificate
- in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale).
-
- "notBefore" or "notAfter" dates must use UTC (RFC 5280).
-
- Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec
- UTC should be specified as GMT (see ASN1_TIME_print())
- """
- from time import strptime
- from calendar import timegm
-
- months = (
- "Jan","Feb","Mar","Apr","May","Jun",
- "Jul","Aug","Sep","Oct","Nov","Dec"
- )
- time_format = ' %d %H:%M:%S %Y GMT' # NOTE: no month, fixed GMT
- try:
- month_number = months.index(cert_time[:3].title()) + 1
- except ValueError:
- raise ValueError('time data %r does not match '
- 'format "%%b%s"' % (cert_time, time_format))
- else:
- # found valid month
- tt = strptime(cert_time[3:], time_format)
- # return an integer, the previous mktime()-based implementation
- # returned a float (fractional seconds are always zero here).
- return timegm((tt[0], month_number) + tt[2:6])
-
-PEM_HEADER = "-----BEGIN CERTIFICATE-----"
-PEM_FOOTER = "-----END CERTIFICATE-----"
-
-def DER_cert_to_PEM_cert(der_cert_bytes):
- """Takes a certificate in binary DER format and returns the
- PEM version of it as a string."""
-
- f = str(base64.standard_b64encode(der_cert_bytes), 'ASCII', 'strict')
- return (PEM_HEADER + '\n' +
- textwrap.fill(f, 64) + '\n' +
- PEM_FOOTER + '\n')
-
-def PEM_cert_to_DER_cert(pem_cert_string):
- """Takes a certificate in ASCII PEM format and returns the
- DER-encoded version of it as a byte sequence"""
-
- if not pem_cert_string.startswith(PEM_HEADER):
- raise ValueError("Invalid PEM encoding; must start with %s"
- % PEM_HEADER)
- if not pem_cert_string.strip().endswith(PEM_FOOTER):
- raise ValueError("Invalid PEM encoding; must end with %s"
- % PEM_FOOTER)
- d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]
- return base64.decodebytes(d.encode('ASCII', 'strict'))
-
-def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv23, ca_certs=None):
- """Retrieve the certificate from the server at the specified address,
- and return it as a PEM-encoded string.
- If 'ca_certs' is specified, validate the server cert against it.
- If 'ssl_version' is specified, use it in the connection attempt."""
-
- host, port = addr
- if ca_certs is not None:
- cert_reqs = CERT_REQUIRED
- else:
- cert_reqs = CERT_NONE
- context = _create_stdlib_context(ssl_version,
- cert_reqs=cert_reqs,
- cafile=ca_certs)
- with create_connection(addr) as sock:
- with context.wrap_socket(sock) as sslsock:
- dercert = sslsock.getpeercert(True)
- return DER_cert_to_PEM_cert(dercert)
-
-def get_protocol_name(protocol_code):
- return _PROTOCOL_NAMES.get(protocol_code, '<unknown>')
diff --git a/pypy/module/imp/interp_imp.py b/pypy/module/imp/interp_imp.py
--- a/pypy/module/imp/interp_imp.py
+++ b/pypy/module/imp/interp_imp.py
@@ -9,8 +9,6 @@
def extension_suffixes(space):
suffixes_w = []
- # REVIEW this condition prevents pypy/tools/build_cffi_imports.py to succeed if
- # pypy was compiled without cpyext module. why nore always append it?
if space.config.objspace.usemodules.cpyext:
suffixes_w.append(space.wrap(importing.get_so_extension(space)))
return space.newlist(suffixes_w)
More information about the pypy-commit
mailing list