Ë
|
ê^iÙM ã
|
ó U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
|
Z
|
ddl m Z m Z ddlmZmZ dZdZdZdZd gZeeeeeef Zd
|
D ci c] \ } }| ee|d« c}} Z d+d Z d,d Z ej< r d d l m Z d dlm!Z! ddl"mZ# G d de!d¬« Z$i Z%de&d< d dl Z d dl m'Z'mZm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0mZm1Z1 e,Z2 ee dd« Z3erQ e e*e+ejh jj ejl ejh jj dk( r ejn nd« sdZdD ] Z8 ee1e8« e% ee de8 « < ddl"mZ ejv de<df Z=d-d!Z>d.d"Z?d/d#Z@ d0 d1d$ZAej d2 d3d%« ZCej d2 d4d&« ZC d5 d4d'ZCd6d(ZDd7d)ZE d8 d9d*ZFyc c}} w # e9$ r Y #w xY w# e:$ r dZ(d Z)d Z/d Z0dxZ2Z,d Z-dZ3d Z.Y w xY w):é )Ú annotationsN)Ú unhexlifyé )ÚProxySchemeUnsupportedÚSSLErroré )Ú_BRACELESS_IPV6_ADDRZ_REÚ_IPV4_REFzhttp/1.1))é Úmd5)é( Úsha1)é@ Úsha256c ó\ | dk( r|dk\ S | dk( r |dd }|d }|dk( xr |dk\ xs |dk\ S y )
|
a¼ Return True for CPython 3.9.3+ or 3.10+ and PyPy 7.3.8+ where
|
setting SSLContext.hostname_checks_common_name to False works.
|
|
Outside of CPython and PyPy we don't know which implementations work
|
or not so we conservatively use our hostname matching as we know that works
|
on all implementations.
|
|
https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963
|
https://foss.heptapod.net/pypy/pypy/-/issues/3539
|
Úpypy)é é é ÚcpythonNr )r é r )r é
|
F© )Úimplementation_nameÚ version_infoÚpypy_version_infoÚ major_minorÚmicros õd H:\项ç®\archive\æµè¯ç»\èæ¬\Change_password\venv_build\Lib\site-packages\urllib3/util/ssl_.pyÚ_is_bpo_43522_fixedr sU ð fÒ$à IÑ-Ð-Ø Ò )Ø" 2 AÐ& Ø QØvÑ%Ò4¨%°1©*ÒO¸ÈÑ9OÐOàó c óX | j d« }|dk\ }|xr |xs t |||« S )NzOpenSSL iÏ)Ú
|
startswithr )Úopenssl_versionÚopenssl_version_numberr r r Ú
|
is_opensslÚ is_openssl_issue_14579_fixeds r Ú(_is_has_never_check_common_name_reliabler( 8 sE ð !×+Ñ+¨JÓ7Jð
|
$:¸ZÑ#GÐ à ò Ø$ò UÜ Ð 2°LÐBSÓ Tðr! )Ú
|
VerifyMode)Ú TypedDict)Ú SSLTransportc ó, e Zd ZU ded< ded< ded< y)Ú_TYPE_PEER_CERT_RET_DICTztuple[tuple[str, str], ...]ÚsubjectAltNamez'tuple[tuple[tuple[str, str], ...], ...]ÚsubjectÚstrÚ serialNumberN)Ú__name__Ú
|
__module__Ú __qualname__Ú__annotations__r r! r r- r- T s
Ø3Ó3Ø8Ó8ØÔr! r- )Útotalzdict[int, int]Ú_SSL_VERSION_TO_TLS_VERSION) Ú CERT_REQUIREDÚHAS_NEVER_CHECK_COMMON_NAMEÚOP_NO_COMPRESSIONÚ OP_NO_TICKETÚOPENSSL_VERSIONÚOPENSSL_VERSION_NUMBERÚ PROTOCOL_TLSÚPROTOCOL_TLS_CLIENTÚVERIFY_X509_STRICTÚ OP_NO_SSLv2Ú OP_NO_SSLv3Ú
|
SSLContextÚ
|
TLSVersionÚVERIFY_X509_PARTIAL_CHAINi r )ÚTLSv1ÚTLSv1_1ÚTLSv1_2Ú PROTOCOL_i i @ i i é r c ó´ | t d« |j dd« j « }t |« }|t vrt d| « t j |« }|t d| « t |j « « } || « j « }t j ||« s t d| d|j « d « y)
|
zá
|
Checks if given fingerprint matches the supplied certificate.
|
|
:param cert:
|
Certificate as bytes object.
|
:param fingerprint:
|
Fingerprint as string of hexdigits, can be interspersed by colons.
|
Nz No certificate for the peer.ú:Ú z Fingerprint of invalid length: zAHash function implementation unavailable for fingerprint length: z&Fingerprints did not match. Expected "z", got "ú") r ÚreplaceÚlowerÚlenÚ HASHFUNC_MAPÚgetr ÚencodeÚdigestÚhmacÚcompare_digestÚhex)ÚcertÚ fingerprintÚ digest_lengthÚhashfuncÚfingerprint_bytesÚ cert_digests r Úassert_fingerprintr_ sé ð |ÜÐ5Ó6Ð6à ×%Ñ% c¨2Ó.×4Ñ4Ó6KÜ Ó$MØLÑ(ÜÐ8¸¸ ÐFÓGÐGÜ× Ñ Ó.HØÐÜØOÐP]ÈÐ _ó
|
ð
|
ô
|
" +×"4Ñ"4Ó"6Ó7Ðá4.×'Ñ'Ó)Kä × Ñ {Ð,=Ô >ÜØ4°[°MÀÈ+Ï/É/ÓJ[ÐI\Ð\]Ð ^ó
|
ð
|
ð ?r! c ó | t S t | t « r(t t | d« }|t t d| z « }|S | S )aë
|
Resolves the argument to a numeric constant, which can be passed to
|
the wrap_socket function/method from the ssl module.
|
Defaults to :data:`ssl.CERT_REQUIRED`.
|
If given a string it is assumed to be the name of the constant in the
|
:mod:`ssl` module or its abbreviation.
|
(So you can specify `REQUIRED` instead of `CERT_REQUIRED`.
|
If it's neither `None` nor a string we assume it is already the numeric
|
constant which can directly be passed to wrap_socket.
|
NÚCERT_)r8 Ú
|
isinstancer0 ÚgetattrÚssl©Ú candidateÚress r Úresolve_cert_reqsrh º sI ð ÐÜ Ð ä)SÔ!Üc9 dÓ+Ø ;Ü#w¨Ñ 2Ó3CØ
|
à Ðr! c ó¶ | t S t | t « r@t t | d« }|t t d| z « }t j t |« S | S )z
|
like resolve_cert_reqs
|
NrI )r> rb r0 rc rd ÚtypingÚcastÚintre s r Úresolve_ssl_versionrm Ñ sU ð ÐÜÐä)SÔ!Üc9 dÓ+Ø ;Ü#{¨YÑ 6Ó7CÜ{{3 Ó$Ð$à Ðr! c óT t t d« | dt t fvrs|| t d« t
|
j | t j « }t
|
j | t j « }t j dt d¬« t t « }|||_ nt j |_ |||_ |r|j! |« |t" j$ n|}|&d}|t& z }|t( z }|t* z }|t, z }|xj. |z c_ |'d}t0 j2 dk\ r|t4 z }|t6 z }|xj8 |z c_ t; |d d« d
|
|_ |t" j$ k( rt> s||_ d
|
|_! nd |_! ||_ d |_" d tH jJ v r=tH jL jO tH jJ j d « « }nd}|r||_( |S # tF $ r Y gw xY w) a# Creates and configures an :class:`ssl.SSLContext` instance for use with urllib3.
|
|
:param ssl_version:
|
The desired protocol version to use. This will default to
|
PROTOCOL_SSLv23 which will negotiate the highest protocol that both
|
the server and your installation of OpenSSL support.
|
|
This parameter is deprecated instead use 'ssl_minimum_version'.
|
:param ssl_minimum_version:
|
The minimum version of TLS to be used. Use the 'ssl.TLSVersion' enum for specifying the value.
|
:param ssl_maximum_version:
|
The maximum version of TLS to be used. Use the 'ssl.TLSVersion' enum for specifying the value.
|
Not recommended to set to anything other than 'ssl.TLSVersion.MAXIMUM_SUPPORTED' which is the
|
default value.
|
:param cert_reqs:
|
Whether to require the certificate verification. This defaults to
|
``ssl.CERT_REQUIRED``.
|
:param options:
|
Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2``,
|
``ssl.OP_NO_SSLv3``, ``ssl.OP_NO_COMPRESSION``, and ``ssl.OP_NO_TICKET``.
|
:param ciphers:
|
Which cipher suites to allow the server to select. Defaults to either system configured
|
ciphers if OpenSSL 1.1.1+, otherwise uses a secure default set of ciphers.
|
:param verify_flags:
|
The flags for certificate verification operations. These default to
|
``ssl.VERIFY_X509_PARTIAL_CHAIN`` and ``ssl.VERIFY_X509_STRICT`` for Python 3.13+.
|
:returns:
|
Constructed SSLContext object with specified options
|
:rtype: SSLContext
|
Nz7Can't create an SSLContext object without an ssl modulezZCan't specify both 'ssl_version' and either 'ssl_minimum_version' or 'ssl_maximum_version'zk'ssl_version' option is deprecated and will be removed in urllib3 v2.6.0. Instead use 'ssl_minimum_version'r )ÚcategoryÚ
|
stacklevelr )r é Úpost_handshake_authTFÚ SSLKEYLOGFILE))rC Ú TypeErrorr> r? Ú
|
ValueErrorr7 rS rD ÚMINIMUM_SUPPORTEDÚMAXIMUM_SUPPORTEDÚwarningsÚwarnÚDeprecationWarningÚminimum_versionrH Úmaximum_versionÚ set_ciphersrd r8 rA rB r: r; ÚoptionsÚsysr rE r@ Ú verify_flagsrc rr Ú IS_PYOPENSSLÚ verify_modeÚcheck_hostnameÚhostname_checks_common_nameÚAttributeErrorÚosÚenvironÚpathÚ
|
expandvarsÚkeylog_filename) Ú ssl_versionÚ cert_reqsr~ ÚciphersÚssl_minimum_versionÚssl_maximum_versionr ÚcontextÚ sslkeylogfiles r Úcreate_urllib3_contextr á s6 ôN ÐÜÐQÓRÐRð 4¤ Ô/BÐCÑCð Ð *Ð.AÐ.MÜ ðAóð ô #>×"AÑ"AØZ× 9Ñ 9ó#Ð ô #>×"AÑ"AØZ× 9Ñ 9ó#Ð ô MMðOä+Ø õ ô Ô,Ó-GàÐ&Ø"5Õ ä",×"4Ñ"4Ô àÐ&Ø"5Ô ñ Ø×ÑGÔ$ð &/Ð%6×!Ò!¸IIàØà;Ñ à;Ñ ð Ô$Ñ$ð
|
<Ñ à OOwÑ
OàÐØ ô × Ñ wÒ &Ø Ô 5Ñ 5LØ Ô .Ñ .Là ×ÒLÑ(Õô wÐ-¨tÓ4Ð@Ø&*Ô#ð C×%Ñ%Ò%lØ 'ÔØ!%Õ à!&Ô Ø 'Ôð Ø.3Ô+ð "**Ñ$Ü×*Ñ*¬2¯:©:¯>©>¸/Ó+JÓK à ÙØ"/Ô à Nøô ò Ù ð ús Æ8H È H'È&H'c ó y ©Nr © ÚsockÚkeyfileÚcertfiler Úca_certsÚserver_hostnamer r Ú ssl_contextÚ ca_cert_dirÚ key_passwordÚ ca_cert_dataÚ
|
tls_in_tlss r Ússl_wrap_socketr y s ð r! c ó y r r r s r r r s ð (+r! c ó¤ |} | t |||¬« } |s| s| r | j || | « n | t | d« r| j « |r|
|
t |« r t d« |r(|
|
| j ||« n| j |||
|
« | j t « t | | | |« }|S # t $ r}t |« |d}~ww xY w)a´
|
All arguments except for server_hostname, ssl_context, tls_in_tls, ca_cert_data and
|
ca_cert_dir have the same meaning as they do when using
|
:func:`ssl.create_default_context`, :meth:`ssl.SSLContext.load_cert_chain`,
|
:meth:`ssl.SSLContext.set_ciphers` and :meth:`ssl.SSLContext.wrap_socket`.
|
|
:param server_hostname:
|
When SNI is supported, the expected hostname of the certificate
|
:param ssl_context:
|
A pre-made :class:`SSLContext` object. If none is provided, one will
|
be created using :func:`create_urllib3_context`.
|
:param ciphers:
|
A string of ciphers we wish the client to support.
|
:param ca_cert_dir:
|
A directory containing CA certificates in multiple separate files, as
|
supported by OpenSSL's -CApath flag or the capath argument to
|
SSLContext.load_verify_locations().
|
:param key_password:
|
Optional password if the keyfile is encrypted.
|
:param ca_cert_data:
|
Optional string containing CA certificates in PEM format suitable for
|
passing as the cadata parameter to SSLContext.load_verify_locations()
|
:param tls_in_tls:
|
Use SSLTransport to wrap the existing socket.
|
N)r Úload_default_certsz5Client private key is encrypted, password is required) r Úload_verify_locationsÚOSErrorr Úhasattrr£ Ú_is_key_file_encryptedÚload_cert_chainÚset_alpn_protocolsÚALPN_PROTOCOLSÚ_ssl_wrap_socket_impl)r r r r r r r r r r r r r r ÚeÚssl_socks r r r så ðP GØô )¨°iÈÔQá;¡,ð %Ø × )Ñ )¨(°KÀ Õ Nð
|
Ð ¤¨Ð2FÔ!Gà×"Ñ"Ô$ñ
|
<Ð'Ô,BÀ7Ô,KÜÐNÓOÐOáØ Ð Ø × #Ñ # H¨gÕ 6à × #Ñ # H¨g°|Ô Dà × Ñ ~Ô.ä$ T¨7°JÀÓPHØ Oøô- ò %Ü1+ 1Ð $ûð %ús B5 Â5 CÂ> C
|
Ã
|
Cc ó® t | t « r| j d« } t t j
|
| « xs t j
|
| « « S )zæDetects whether the hostname given is an IPv4 or IPv6 address.
|
Also detects IPv6 addresses with Zone IDs.
|
|
:param str hostname: Hostname to examine.
|
:return: True if the hostname is an IP address, False otherwise.
|
Úascii)rb ÚbytesÚdecodeÚboolr
|
Úmatchr )Úhostnames r Ú is_ipaddressrµ ç sA ô (EÔ"à?? 7Ó+Ü xÓ(ÒTÔ,D×,JÑ,JÈ8Ó,TÓ UÐUr! c óp t | « 5 }|D ] }d|v s ddd« y ddd« y# 1 sw Y yxY w)z*Detects if a key file is encrypted or not.Ú ENCRYPTEDNTF)Úopen)Úkey_fileÚfÚlines r r§ r§ ô sI ä h ð 1Øò DàdÒ"Ø÷ ð ñ ÷ ð ÷ ð ús
|
,,¡,¬5c ó |r3t s t d« t j |« t | ||« S |j | |¬« S )Nz0TLS in TLS requires support for the 'ssl' module)r )r+ r Ú$_validate_ssl_context_for_tls_in_tlsÚ wrap_socket)r r r r s r r« r« ÿ sO ñ Ýä(ØBóð ô ×9Ñ9¸+ÔFÜD +¨Ó?Ð?à × "Ñ " 4¸ Ð "Ó IÐIr! )r r0 r Ú_TYPE_VERSION_INFOr ú_TYPE_VERSION_INFO | NoneÚreturnr² ) r$ r0 r% rl r r0 r r¿ r rÀ rÁ r² )rY z bytes | NonerZ r0 rÁ ÚNone)rf úNone | int | strrÁ r) )rf rà rÁ rl )NNNNNNN)r ú
|
int | Noner rÄ r~ rÄ r ú
|
str | Noner rÄ r rÄ r rÄ rÁ ússl.SSLContext) ............) r ú socket.socketr rÅ r rÅ r rÄ r rÅ r rÅ r rÄ r rÅ r ússl.SSLContext | Noner rÅ r rÅ r úNone | str | bytesr ztyping.Literal[False]rÁ z ssl.SSLSocket) r rÇ r rÅ r rÅ r rÄ r rÅ r rÅ r rÄ r rÅ r rÈ r rÅ r rÅ r rÉ r r² rÁ ú ssl.SSLSocket | SSLTransportType) NNNNNNNNNNNF)r´ z str | bytesrÁ r² )r¹ r0 rÁ r² r )
|
r rÇ r rÆ r r² r rÅ rÁ rÊ )GÚ
|
__future__r ÚhashlibrV r Úsocketr rj rx Úbinasciir Ú
|
exceptionsr r Úurlr r
|
rC r+ r9 r rª Útuplerl r0 r¿ rc rR r r( Ú TYPE_CHECKINGrd r) r* Ú ssltransportÚSSLTransportTyper- r7 r5 r8 r: r; r< r= r> r? r@ rA rB rD ÚPROTOCOL_SSLv23rE ÚimplementationÚnamer r Úattrr
Ú ImportErrorÚUnionr° Ú_TYPE_PEER_CERT_RETr_ rh rm r Úoverloadr rµ r§ r« )ÚlengthÚ algorithms 00r ú<module>rß sn ðÞ "ã Û Û Û Û
|
Û Û Ý ç 9ß 3à
|
Ø Ø #Ð Ø Ø à3 S¨#¨sÐ2Ñ3Ð ð
|
I÷á ð GGY¨Ó -Ñ-ó ð Ø ðà$ðð 1ðð
|
ó ð4Øðà ðð ðð %ð ð
|
1ð ð
|
ó ð,
|
×ÒÝ Ý å>ô 9°Eõ ð /1Ð ^Ó 0ð5 Û÷÷ ÷ õ ð #Oñ !(¨Ð-HÈ'Ó RÐ ñ #Ñ+SØØ Ø ×Ñ× Ñ Ø ×ÑØ!$×!3Ñ!3×!8Ñ!8¸FÒ!B× Ò Èô ,ð ',Ð#ð 0ò ð ÙLSØDóMÐ '©°°yÀÀÐ5GÓ(HÒ Iðõ +ð llÐ#=¸uÀdÐ#JÑKÐ ó
|
óDó. ð" #Ø Ø Ø Ø&*Ø&*Ø #ðUØðUàðUð ðUð ð Uð
|
$ð Uð $ð Uð ðUð óUðp ð Ø Ø Ø Ø"%Ø !Ø Ø),Ø !Ø "Ø'*Ø(+ðØ
|
ðà ðð ðð ð ð
|
ð ð ð ð ðð ðð 'ðð ðð ðð %ðð &ðð ò ó ðð" ð Ø Ø Ø Ø"%Ø !Ø Ø),Ø !Ø "Ø'*Øð+Ø
|
ð+à ð+ð ð+ð ð +ð
|
ð +ð ð +ð ð+ð ð+ð 'ð+ð ð+ð ð+ð %ð+ð ð+ð &ò +ó ð+ð& Ø Ø Ø Ø"&Ø "Ø Ø)-Ø "Ø #Ø'+Ø ðGØ
|
ðGà ðGð ðGð ð Gð
|
ð Gð ð Gð ðGð ðGð 'ðGð ðGð ðGð %ðGð ðGð &ó GóT
|
Vóð #'ð JØ
|
ðJà ðJð ðJð ð Jð
|
&ô JùóOøð\ ò Ú ð ûð ò Ø ÐØLØKØKØ%&Ð&OlØ ÐØ 'Ð Ø Óð ús= ÁIÂ<BI& ÅIÅI& ÉI#É I& É"I#É#I& É&JÊ J
|
