RIFFWEBPVP8X ALPHz)NaصE.̱nmwww H5uΜa~ˆ~oeW|aV_:]\iVۦ6ؿ÷i]65b%ymniU]^^|ŇdOZV˗/_V_\nP\Qu<_+*m߮'O$C_}QǹQjEZ;\Q<=)?U(Qc_,Vޛr^˷6Uq(Lߡ9e ;R*7lLݰqkcA׫$O`l^Xlک}jRm*;^~W^\$%W^~_/"^H@G5KIJ A  p)Ax9A+sF+Vd\kUz#\׹*@Γ<:/gTtեiqs$)XҚq臒Q(InDRZj$aKtS.IQ}.2>EX҂OqDIҍ`)X8 qܭDI~Pe'R8 !4XRAubIn38NJ$:xG)Vdw;sEbxP O{h~<3JR@ޑt.Z<)(XJ/W,)/M8Aqi CuJZQ JRjII)VŒKm"I~nBN+$bI4"Œj<8T"AEE&OǨ*%)RjI;SEbQkMw]|LUJR+7J}VW '/h:Krly(WHI4<_XREQKwҜF2$XRU]ၔ(ߩ:o*$)(Thx H˃fU$s\X+[jNWXvť1O DII@ c'Q 3S gDO(Jġ/*RfR#UFxCq9=Y.(H0z~7BREQHn8SJIqq,)z9IaI`ZaE+d&QŒ*fSSG&m)*(SUQbV媬*GIz1.zMo\'8r=+>kpJI&`>JR)5v)(}R{qyr<ٗ=~t$-^  ˦;p :~ɗtgФwٴ'۽.` ]؍4'OpDGyנI'L9MU5jtF:hE&xڍv4ud'bzRw轑߼@ H:{OUw: 6O^0r\GqwU7s>pFU{w9Q\;j;=Γ;-A˶mo[+K;dxLw7. -fK2lII;̧wLI6[͖d/ ͖d٬w:W8oF~@GחRuO&4ҍ(Zmꎽ:c:6fcLsM{ X 4ߴ&y1b9Xۍb8ڏ;N8V@fkTK]f9d]c^,Ǒk;pl8Gߥ0M r6e\)Pu~> Gfܣwv?B?}l3GEmRk;r›k^]0,9jRrIO\ ,desfƳ۽sF8j_Щ`ݝdX2;gJm 𜴰yg `d^rͰ_h&wο6So&?W>sωZAbұu~zqزfOOAI?=Jw}?%Mꆒ pW-;r;Yx=L]s/%e|q'Va:9FY'%2 3b>{|YVYۺ6<6,n@-0{.59>n?>}w||%YV: #ֶ.}7wcuBZ?X޾:1pv]o#sIْL|,9ΞϔOYyQJ9L WȃE)ǯqPc_Oɗ4e4 (M۔@ h跬c5kY W맲×6 Ok`{xzyA;0 hYRS-ál7||s<{RNZ|[f=Y@k88neAK:RN<5;l?7ݹu^]q#Gv%z ÀqD׵/#44/8wl_]1?ω[!0.eYƪF|NQp/9r< !#ӟ3x~+5-qꦴ ~7 [4ß`,PΥN{aE+Nz캡/ qu-=,P54 wjNN>xުQz<ߟ2u킚}7wú< 8m}h_(0:oƭˑ=WO|}lmk<߄ ^7gowCw&}-ꂲoKʎv068zϞOx0u{'ׇ&{vwk@>j^+Cs{ g>p-cyo<-xvXtQt>czLv< O0oG={î[Ÿ_{{j)kgdA_e`C{RuF##׌b:r T#Q|#ՌT]`a93p c y08y9pΜ3Rp 3ͼox7;x;o]8ü<`FfF)`C>RT<`TT3r͠04h~s/\V#׌6R]o.VP8 9*>Q(F#$p Mi%kU~n>{^`?e+;w@{Q'V_?ߵ_?a=;|2u'J 9¨_bōޱ7zXcwnޱ!\59h'B|qY:L!F޵!%t^/'}f_Xԅ]=S~ DŽaP&\q`fv ; D-dYt w%BGPo}7_$|Fq%?)t^n5+WCXF|CNO.'{|[xxkGDV0YvBjx]rw˱|Б݀7gZ#6o ۈ/>Uh8\d< ߭ .gS#H+`#ՒUF4/7۳7\:R8f!*P* OP0LHw͢h>q2}+vO Fxrt3,. |N8PrKi#͑SG}%+$ bQȟ2F_qU ʩG |uZe7~LK.DUN'..M}ґGNݳiwksDxce{/pk 7ރ P*P1A ֨.I=͠#PLuV 1-+$$-?4 At1jS>s}?rU?K>7N8d7=I%_B.)tN0VUӇaP'\ꈱqBC!=r_ ]da_~Uu4 xP$wr)Ǯ&vP-"A"ˏzIʡZe<lyؔvѶRWD%6*v}U^|r5g$Ut朹Zd ٩9ӹvܒ-m"o6NaZ?¯0;_# $6B$nEyCΓN}Qi~5z }[foQ6Ped z0鱫 }g,n&aM>hj89So1Mxx]Qe? FbPB28eJZ^sjFYk~4WUj1fx[܏H8k*1tMҐ%bo Zl];MS򐋋0eBk2L2owS@z MgʔKNJ7=<,̏Udpg\fI9ZEE7PW$Z6 (0{k f/@\7q'_Yg$QII 1fj\jX dxi0}a$XWIIaԢpHI"HM6"doJoUvsB4 )ZlEc˝r=ݢ$/:yX4owQʖ# axӦ7?$W:+Gm)80Bj&"r_p*rᣤF>>e'q|H~20^pSx=Ŗ_( wdê0oBG]$-#|YzWrF<V?m^и/J:5.7c'~AL^['uz (CeI}MK!x.|u>\Օ>sbTKB(OGs{h+gAtW&ߧ?6<1 yE2q|5?*_FӒڻw S :̽b%h,r*A&0;@2j+rteΠEXIFExifII*V^(ifHH02100100XMP a DOg2 @sdZddlZddlZddlmZddlmZmZ m Z ddl Z ddl m Z mZmZddl mZmZmZddl mZmZmZmZmZmZmZddl mZmZdd l mZmZm Z m!Z!zdd l m"Z"Wne#yYn0dd l m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-dd l m.Z.m/Z/e j0d e1dde de j0de1dde de j0de1dde de j0de1dde de j0de1dde de j0de1dde de2j3Z4e2_4dde2j56DZ7e8e2ddZ9Gddde Z:Gd d!d!e Z;Gd"d#d#e Zd&kr dd'l m?Z?m@Z@dd(lAmAZAmBZBmCZCdd)lAmDZDmEZEddlAZFddlGZGddlHZHddlIZIeJZKd*gZLeMe d+ZNe.ZOeZPd,d-ZQd.d/ZRd0d1ZSd2d3ZTed4d5ZUd6d7ZVGd8d9d9ed9d:ZWGd;d<dd>eZYeXjZfdddd?d@dAZ[e3fe\dBeXjZddddddCdDdEZ]e[Z^e]Z_GdFdGdGZ`dHdIZaGdJdKdKeAZbebeY_ce`eY_ddddBe\e3ddLdLdf dMdNZedOdPZfdQZgdRZhdSdTZidUdVZje3dfdWdXZkdYdZZldS)[a This module provides some more Pythonic support for SSL. Object types: SSLSocket -- subtype of socket.socket which does SSL over the socket Exceptions: SSLError -- exception raised for I/O errors Functions: cert_time_to_seconds -- convert time string used for certificate notBefore and notAfter functions to integer seconds past the Epoch (the time values returned from time.time()) get_server_certificate (addr, ssl_version, ca_certs, timeout) -- Retrieve the certificate from the server at the specified address and return it as a PEM-encoded string Integer constants: SSL_ERROR_ZERO_RETURN SSL_ERROR_WANT_READ SSL_ERROR_WANT_WRITE SSL_ERROR_WANT_X509_LOOKUP SSL_ERROR_SYSCALL SSL_ERROR_SSL SSL_ERROR_WANT_CONNECT SSL_ERROR_EOF SSL_ERROR_INVALID_ERROR_CODE The following group define certificate requirements that one side is allowing/requiring from the other side: CERT_NONE - no certificates from the other side are required (or will be looked at if provided) CERT_OPTIONAL - certificates are not required, but if provided will be validated, and if validation fails, the connection will also fail CERT_REQUIRED - certificates are required, and will be validated, and if validation fails, the connection will also fail The following constants identify various SSL protocol variants: PROTOCOL_SSLv2 PROTOCOL_SSLv3 PROTOCOL_SSLv23 PROTOCOL_TLS PROTOCOL_TLS_CLIENT PROTOCOL_TLS_SERVER PROTOCOL_TLSv1 PROTOCOL_TLSv1_1 PROTOCOL_TLSv1_2 The following constants identify various SSL alert message descriptions as per http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6 ALERT_DESCRIPTION_CLOSE_NOTIFY ALERT_DESCRIPTION_UNEXPECTED_MESSAGE ALERT_DESCRIPTION_BAD_RECORD_MAC ALERT_DESCRIPTION_RECORD_OVERFLOW ALERT_DESCRIPTION_DECOMPRESSION_FAILURE ALERT_DESCRIPTION_HANDSHAKE_FAILURE ALERT_DESCRIPTION_BAD_CERTIFICATE ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE ALERT_DESCRIPTION_CERTIFICATE_REVOKED ALERT_DESCRIPTION_CERTIFICATE_EXPIRED ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN ALERT_DESCRIPTION_ILLEGAL_PARAMETER ALERT_DESCRIPTION_UNKNOWN_CA ALERT_DESCRIPTION_ACCESS_DENIED ALERT_DESCRIPTION_DECODE_ERROR ALERT_DESCRIPTION_DECRYPT_ERROR ALERT_DESCRIPTION_PROTOCOL_VERSION ALERT_DESCRIPTION_INSUFFICIENT_SECURITY ALERT_DESCRIPTION_INTERNAL_ERROR ALERT_DESCRIPTION_USER_CANCELLED ALERT_DESCRIPTION_NO_RENEGOTIATION ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE ALERT_DESCRIPTION_UNRECOGNIZED_NAME ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY N) namedtuple)EnumIntEnumIntFlag)OPENSSL_VERSION_NUMBEROPENSSL_VERSION_INFOOPENSSL_VERSION) _SSLContext MemoryBIO SSLSession)SSLErrorSSLZeroReturnErrorSSLWantReadErrorSSLWantWriteErrorSSLSyscallError SSLEOFErrorSSLCertVerificationError)txt2objnid2obj) RAND_statusRAND_add RAND_bytesRAND_pseudo_bytes)RAND_egd) HAS_SNIHAS_ECDHHAS_NPNHAS_ALPN HAS_SSLv2 HAS_SSLv3 HAS_TLSv1 HAS_TLSv1_1 HAS_TLSv1_2 HAS_TLSv1_3)_DEFAULT_CIPHERS_OPENSSL_API_VERSION _SSLMethodcCs|do|dkS)NZ PROTOCOL_PROTOCOL_SSLv23 startswithnamer,/usr/lib64/python3.9/ssl.py}r.)sourceOptionscCs |dS)NZOP_r(r*r,r,r-r.r/ZAlertDescriptioncCs |dS)NZALERT_DESCRIPTION_r(r*r,r,r-r.r/ZSSLErrorNumbercCs |dS)NZ SSL_ERROR_r(r*r,r,r-r.r/ VerifyFlagscCs |dS)NZVERIFY_r(r*r,r,r-r.r/ VerifyModecCs |dS)NZCERT_r(r*r,r,r-r.r/cCsi|]\}}||qSr,r,).0r+valuer,r,r- r/r6ZPROTOCOL_SSLv2c@s6eZdZejZejZejZ ej Z ej Z ejZejZdS) TLSVersionN)__name__ __module__ __qualname___sslZPROTO_MINIMUM_SUPPORTEDZMINIMUM_SUPPORTEDZ PROTO_SSLv3SSLv3Z PROTO_TLSv1ZTLSv1Z PROTO_TLSv1_1ZTLSv1_1Z PROTO_TLSv1_2ZTLSv1_2Z PROTO_TLSv1_3ZTLSv1_3ZPROTO_MAXIMUM_SUPPORTEDZMAXIMUM_SUPPORTEDr,r,r,r-r7sr7c@s(eZdZdZdZdZdZdZdZdZ dS) _TLSContentTypez@Content types (record layer) See RFC 8446, section B.1 N) r8r9r:__doc__CHANGE_CIPHER_SPECALERTZ HANDSHAKEZAPPLICATION_DATAHEADERZINNER_CONTENT_TYPEr,r,r,r-r=sr=c@seZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#d"Z$d#Z%d$S)% _TLSAlertTypezQAlert types for TLSContentType.ALERT messages See RFC 8466, section B.2 r r>r?r@()*+,-./0123<FGPVZdmnopqrstxN)&r8r9r:rDZ CLOSE_NOTIFYZUNEXPECTED_MESSAGEZBAD_RECORD_MACZDECRYPTION_FAILEDZRECORD_OVERFLOWZDECOMPRESSION_FAILUREZHANDSHAKE_FAILUREZNO_CERTIFICATEZBAD_CERTIFICATEZUNSUPPORTED_CERTIFICATEZCERTIFICATE_REVOKEDZCERTIFICATE_EXPIREDZCERTIFICATE_UNKNOWNZILLEGAL_PARAMETERZ UNKNOWN_CAZ ACCESS_DENIEDZ DECODE_ERRORZ DECRYPT_ERRORZEXPORT_RESTRICTIONZPROTOCOL_VERSIONZINSUFFICIENT_SECURITYZINTERNAL_ERRORZINAPPROPRIATE_FALLBACKZ USER_CANCELEDZNO_RENEGOTIATIONZMISSING_EXTENSIONZUNSUPPORTED_EXTENSIONZCERTIFICATE_UNOBTAINABLEZUNRECOGNIZED_NAMEZBAD_CERTIFICATE_STATUS_RESPONSEZBAD_CERTIFICATE_HASH_VALUEZUNKNOWN_PSK_IDENTITYZCERTIFICATE_REQUIREDZNO_APPLICATION_PROTOCOLr,r,r,r-rHsFrHc@sheZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd ZdZdZdZdZdZdZdZdZdZdZdS)_TLSMessageTypezFMessage types (handshake protocol) See RFC 8446, section B.3 r r>r?r@rACrCN)r8r9r:rDZ HELLO_REQUESTZ CLIENT_HELLOZ SERVER_HELLOZHELLO_VERIFY_REQUESTZNEWSESSION_TICKETZEND_OF_EARLY_DATAZHELLO_RETRY_REQUESTZENCRYPTED_EXTENSIONSZ CERTIFICATEZSERVER_KEY_EXCHANGEZCERTIFICATE_REQUESTZ SERVER_DONEZCERTIFICATE_VERIFYZCLIENT_KEY_EXCHANGEFINISHEDZCERTIFICATE_URLZCERTIFICATE_STATUSZSUPPLEMENTAL_DATAZ KEY_UPDATEZ NEXT_PROTOZ MESSAGE_HASHrEr,r,r,r-rgs.rgwin32)enum_certificates enum_crls)socket SOCK_STREAMcreate_connection) SOL_SOCKETSO_TYPE tls-uniqueHOSTFLAG_NEVER_CHECK_SUBJECTcCs|sdS|d}|s&||kS|dkrsole wildcard without additional labels are not support: {!r}.z.shim_cb)Z sni_callbackcallable TypeError)rrrr,rr-set_servername_callbacks z"SSLContext.set_servername_callbackcCs`t}|D]F}t|d}t|dks0t|dkr8td|t|||q ||dS)Nrrrz)ALPN protocols must be 1 to 255 in length)rrrr rrZ_set_alpn_protocols)rZalpn_protocolsrrrr,r,r-set_alpn_protocols!s  zSSLContext.set_alpn_protocolscCstt}zYn0|tjkrPt}n|tjkr`t}nt}z ||}WntyYn0||||||Sr)r7rr=rGrFrHrg)conn directionversionZ content_typeZmsg_typedataZmsg_enumcallbackr,r-rs(        z'SSLContext._msg_callback..inner)rrrrhasattrrr)rrrrrr-rs  cs ttjSr)r&rrrrr,r-rszSSLContext.protocolcs ttjSr)r2r verify_flagsrrr,r-r szSSLContext.verify_flagscstttj||dSr)rrr rrrr,r-r scs.tj}z t|WSty(|YS0dSr)r verify_moder3rrrr,r-r s   zSSLContext.verify_modecstttj||dSr)rrr rrrr,r-r s)FTTNN)FNN)!r8r9r:rDrrr PROTOCOL_TLSrrrrrrrrrrrrr propertyrsetterrrr;rrrr r rr,r,rr-rsj           &%r)rrrcCst|tst|tt}|tjkr0t|_d|_ |s<|s<|rL| |||n|jt kr`| |t |drtjd}|rtjjs||_|S)zCreate a SSLContext object with default settings. NOTE: The protocol and settings may change anytime without prior deprecation. The values represent a fair balance between maximum compatibility and security. Tkeylog_filename SSLKEYLOGFILE)rrrrr rr CERT_REQUIREDr check_hostnamer CERT_NONErrrrrrflagsignore_environmentr)rrrrr keylogfiler,r,r-create_default_contexts        rF) cert_reqsrrcertfilekeyfilerrrc Cst|tst|t|} |s$d| _|dur2|| _|rsz&SSLObject.verify_client_post_handshake)FNNN)r*N)F)r)r8r9r:rDr rrr rr rr)rrr+r.r0r2r3r4r5r6r7r8r:r;rr>r,r,r,r-r-sD           rcCstt|jj|_|S)z*Copy docstring from SSLObject to SSLSocket)getattrrr8rD)funcr,r,r- _sslcopydocsrAcseZdZdZddZedXfdd Zeed d Z e j d d Z eed d Z e j dd Z eeddZ ddZ dYddZddZdZddZddZed[ddZeddZed d!Zed"d#Zed$d%Zed&d'Zd\fd)d* Zd]fd+d, Zd-d.Zd^fd/d0 Zd_fd1d2 Zd`fd3d4 Zdafd5d6 Zdbfd7d8 Zdcfd9d: Z d;d<Z!d=d>Z"ed?d@Z#fdAdBZ$edCdDZ%edEdFZ&fdGdHZ'edddIdJZ(fdKdLZ)dMdNZ*dOdPZ+fdQdRZ,ededTdUZ-edVdWZ.Z/S)f SSLSocketzThis class implements a subtype of socket.socket that wraps the underlying OS socket in an SSL context when necessary, and provides read and write methods over that channel. cOst|jjddS)NzX does not have a public constructor. Instances are returned by SSLContext.wrap_socket().rrr,r,r-r s zSSLSocket.__init__FTNc sf|tttkrtd|r8|r(td|dur8td|jrJ|sJtdt|j|j |j | d}|j |fi|} t t| jfi||} ||| _|| _d| _d| _|| _||| _|| _|| _z | Wnty} z| jtjkrd} | } | dz| !d}Wn@tyb} z&| jtjtj"fvrJd}WYd} ~ n d} ~ 00| | |rd }t#| j|}||_$d|_%z | &WntyYn0z |Wd}nd}0WYd} ~ nd} ~ 00d } | '| | | _(| rbzH| jj)| || j| | jd | _|r<| }|d kr4td | *Wn"ttfy`| &Yn0| S)Nz!only stream sockets are supportedz4server_hostname can only be specified in client modez,session can only be specified in client modez'check_hostname requires server_hostname)familytypeprotofilenoFrhr/z5Closed before TLS handshake with data in recv buffer.Tr!rzHdo_handshake_on_connect should not be specified for non-blocking sockets)+ getsockoptrrr}NotImplementedErrorrrdictrCrDrErFrrrBr  gettimeoutdetach_context_session_closedr"rrrrr getpeernamererrnoZENOTCONN getblocking setblockingrecvEINVALr reasonZlibraryclose settimeout _connected _wrap_socketr8)rrrrrrrrrrZ sock_timeouteZ connectedblockingZnotconn_pre_handshake_datarWZ notconn_pre_handshake_data_errortimeoutrr,r-rs         "   zSSLSocket._createcCs|jSr)rNrr,r,r-r8szSSLSocket.contextcCs||_||j_dSr)rNr"rr$r,r,r-r=scCs|jdur|jjSdSrr&rr,r,r-rBs zSSLSocket.sessioncCs||_|jdur||j_dSr)rOr"rr'r,r,r-rHs cCs|jdur|jjSdSrr(rr,r,r-r)Ns zSSLSocket.session_reusedcCstd|jjdS)NzCan't dup() %s instances)rJrr8rr,r,r-dupTsz SSLSocket.dupcCsdSrr,)rmsgr,r,r- _checkClosedXszSSLSocket._checkClosedcCs|js|dSr)rZrQrr,r,r-_check_connected\szSSLSocket._check_connectedr*c Cs||jdurtdz*|dur4|j||WS|j|WSWn`ty}zH|jdtkr|jr|dur~WYd}~dSWYd}~dSnWYd}~n d}~00dS)zORead up to LEN bytes and return them. Return zero-length string on EOF.Nz'Read on closed or unwrapped SSL socket.rr/)rar"rr+r rZ SSL_ERROR_EOFr)rrr,xr,r,r-r+ds zSSLSocket.readcCs&||jdurtd|j|S)zhWrite DATA to the underlying SSL channel. Returns number of bytes of DATA actually transmitted.Nz(Write on closed or unwrapped SSL socket.)rar"rr.r/r,r,r-r.ys zSSLSocket.writecCs|||j|Sr)rarbr"r0r1r,r,r-r0szSSLSocket.getpeercertcCs*||jdustjsdS|jSdSr)rar"r;rr2rr,r,r-r2szSSLSocket.selected_npn_protocolcCs*||jdustjsdS|jSdSr)rar"r;rr3rr,r,r-r3sz SSLSocket.selected_alpn_protocolcCs$||jdurdS|jSdSr)rar"r4rr,r,r-r4s zSSLSocket.ciphercCs$||jdurdS|jSdSr)rar"r5rr,r,r-r5s zSSLSocket.shared_cipherscCs$||jdurdS|jSdSr)rar"r6rr,r,r-r6s zSSLSocket.compressionrcsF||jdur4|dkr(td|j|j|St||SdS)Nrz3non-zero flags not allowed in calls to send() on %s)rar"rrr.rsend)rrrrr,r-rds  zSSLSocket.sendcsL||jdur"td|jn&|dur8t||St|||SdS)Nz%sendto not allowed on instances of %s)rar"rrrsendto)rrZ flags_or_addrrrr,r-res zSSLSocket.sendtocOstd|jdS)Nz&sendmsg not allowed on instances of %srJrrr,r,r-sendmsgszSSLSocket.sendmsgc s||jdur|dkr(td|jd}t|f}|d<}t|}||krn|||d}||7}qJWdn1s0YWdq1s0Ynt ||SdS)Nrz6non-zero flags not allowed in calls to sendall() on %sB) rar"rr memoryviewcastrrdrsendall)rrrrview byte_viewamountr-rr,r-rks HzSSLSocket.sendallcs,|jdur||||St|||SdS)zSend a file, possibly by using os.sendfile() if this is a clear-text socket. Return the total number of bytes sent. N)r"_sendfile_use_sendrsendfile)rfileoffsetrrr,r-rps zSSLSocket.sendfilecsD||jdur2|dkr(td|j||St||SdS)Nrz3non-zero flags not allowed in calls to recv() on %s)rar"rrr+rrUrbuflenrrr,r-rUs  zSSLSocket.recvcsj||r|durt|}n |dur*d}|jdurV|dkrJtd|j|||St|||SdS)Nr*rz8non-zero flags not allowed in calls to recv_into() on %s)rarr"rrr+r recv_intorr,nbytesrrr,r-rus    zSSLSocket.recv_intocs4||jdur"td|jnt||SdS)Nz'recvfrom not allowed on instances of %s)rar"rrrrecvfromrsrr,r-rxs  zSSLSocket.recvfromcs6||jdur"td|jnt|||SdS)Nz,recvfrom_into not allowed on instances of %s)rar"rrr recvfrom_intorvrr,r-rys  zSSLSocket.recvfrom_intocOstd|jdS)Nz&recvmsg not allowed on instances of %srfrr,r,r-recvmsgszSSLSocket.recvmsgcOstd|jdS)Nz+recvmsg_into not allowed on instances of %srfrr,r,r- recvmsg_intoszSSLSocket.recvmsg_intocCs$||jdur|jSdSdS)Nr)rar"r7rr,r,r-r7s  zSSLSocket.pendingcs|d|_t|dSr)rar"rr9)rhowrr,r-r9szSSLSocket.shutdowncCs.|jr|j}d|_|Stdt|dSNzNo SSL wrapper around )r"r9rr)rsr,r,r-r:$s  zSSLSocket.unwrapcCs$|jr|jStdt|dSr})r"r>rrrr,r,r-r>-s z&SSLSocket.verify_client_post_handshakecsd|_tdSr)r"r _real_closerrr,r-r4szSSLSocket._real_closec CsP||}z.|dkr(|r(|d|jW||n ||0dS)NrH)rbrLrYr"r8)rblockr^r,r,r-r88s   zSSLSocket.do_handshakec s|jrtd|js|jdur&td|jj|d|j||jd|_z@|rVt |}nd}t ||s~d|_|j r~| |WSt tfyd|_Yn0dS)Nz!can't connect in server-side modez/attempt to connect already-connected SSLSocket!FrGT)rrrZr"rr[rrOr connect_exconnectrr8r)rrrrcrr,r- _real_connectCs* zSSLSocket._real_connectcCs||ddS)QConnects to remote ADDR, and then wraps the connection in an SSL channel.FNrrrr,r,r-r]szSSLSocket.connectcCs ||dS)rTrrr,r,r-rbszSSLSocket.connect_excs.t\}}|jj||j|jdd}||fS)zAccepts a new connection from a remote client, and returns a tuple containing that new connection wrapped with a server-side SSL channel, and the address of the remote client.T)rrr)racceptrrrr)rZnewsockrrr,r-rgszSSLSocket.acceptrcCs4|jdur|j|S|tvr,td|dSdS)Nz({0} channel binding type not implemented)r"r;CHANNEL_BINDING_TYPESrrr<r,r,r-r;ss  zSSLSocket.get_channel_bindingcCs|jdur|jSdSdSrr=rr,r,r-r~s  zSSLSocket.version)FTTNNN)N)r*N)F)r)N)r)rN)r*r)Nr)r*r)Nr)F)r)0r8r9r:rDr rrr rArr rr)r_rarbr+r.r0r2r3r4r5r6rdrergrkrprUrurxryrzr{r7r9r:r>rr8rrrrr;rrr,r,rr-rBs_                          rBTc Csl|r|std|r |s tdt|} || _|r<| ||rL| ||| rZ| | | j||||dS)Nz5certfile must be specified for server-side operationsr)rrrr)rrr rrZ set_ciphersr) rrrrr ssl_versionca_certsrrZciphersrr,r,r-rs"   rcCsddlm}ddlm}d}d}z||ddd}Wn"ty`td ||fYn00||dd|}||d|f|d d SdS) aReturn the time in seconds since the Epoch, given the timestring representing the "notBefore" or "notAfter" date from a certificate in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale). "notBefore" or "notAfter" dates must use UTC (RFC 5280). Month is one of: Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec UTC should be specified as GMT (see ASN1_TIME_print()) r)strptime)timegm) ZJanZFebZMarZAprZMayZJunZJulZAugZSepZOctZNovZDecz %d %H:%M:%S %Y GMTNrjrhz*time data %r does not match format "%%b%s"rirm)timerZcalendarrindextitler)Z cert_timerrZmonthsZ time_formatZ month_numberttr,r,r-cert_time_to_secondss    rz-----BEGIN CERTIFICATE-----z-----END CERTIFICATE-----csRtt|ddtg}|fddtdtdD7}|tdd|S)z[Takes a certificate in binary DER format and returns the PEM version of it as a string.ASCIIstrictcsg|]}||dqS)@r,)r4ifr,r- r/z(DER_cert_to_PEM_cert..rr ) rbase64Zstandard_b64encode PEM_HEADERrangerr PEM_FOOTERr)Zder_cert_bytesssr,rr-DER_cert_to_PEM_certs "rcCs\|tstdt|ts0tdt|tttt }t| ddS)zhTakes a certificate in ASCII PEM format and returns the DER-encoded version of it as a byte sequencez(Invalid PEM encoding; must start with %sz&Invalid PEM encoding; must end with %srr) r)rrstripendswithrrrZ decodebytesr)Zpem_cert_stringdr,r,r-PEM_cert_to_DER_certs rc Cs|\}}|durt}nt}t|||d}t|D}||}|d} Wdn1s\0YWdn1sz0Yt| S)zRetrieve the certificate from the server at the specified address, and return it as a PEM-encoded string. If 'ca_certs' is specified, validate the server cert against it. If 'ssl_version' is specified, use it in the connection attempt.N)rrT)rr_create_stdlib_contextr~rr0r) rrrhostportrrrZsslsockZdercertr,r,r-get_server_certificates  FrcCs t|dS)Nz )_PROTOCOL_NAMESr)Z protocol_coder,r,r-get_protocol_namesr)mrDrr collectionsrenumrZ_Enumr_IntEnumrZ_IntFlagr;rrrr r r r r rrrrrrrrrrrrrr ImportErrorrrrrrrr r!r"r#r$r% _convert_r8r&r r' __members__itemsrr?Z_SSLv2_IF_EXISTSr7r=rHrgrrzr{r|r}r~rrrrrRrrZ socket_errorrrZHAS_NEVER_CHECK_COMMON_NAMEZ_RESTRICTED_SERVER_CIPHERSrrrrrrrrrrrrrrZ_create_default_https_contextrrrArBrrrrrrrrrrr,r,r,r-sZ $ 0   )  1# 9z # />