o
    'hM                     @  s(  U d Z ddlmZ ddlZddlmZ zddlmZ W n e	y,   G dd de
ZY nw ddlZddlZddlZddlmZ dd	lmZ dd
lmZ ddlmZ ejrZddlmZ ddgZejjejjejjejjejejjiZ de!d< e"edre"ejdrejj#e ej$< e"edre"ejdrejj%e ej&< ej'ejj(ej)ejj*ej+ejj*ejj, iZ-dd e-. D Z/e0ejdde0ejddB Z1de!d< e0ejddZ2de!d< e0ejddZ3de!d< e0ejd dZ4de!d!< e0ejd"dZ5de!d#< ej6j7e1ej6j8e1ej6j9e1e2B ej6j:e1e2B e3B ej6j;e1e2B e3B e4B ej6j<e1e2B e3B e4B iZ=de!d$< ej6j7e1e2B e3B e4B e5B ej6j8e1e3B e4B e5B ej6j9e1e4B e5B ej6j:e1e5B ej6j;e1ej6j<e1iZ>de!d%< d&Z?ejj@ZAeBeCZDdDd)dZEdDd*dZFdDd+d,ZGdEd0d1ZHdFd5d6ZIG d7d8 d8ZJejKeJ_KG d9d: d:ZLdGdBdCZMdS )Ha  
Module for using pyOpenSSL as a TLS backend. This module was relevant before
the standard library ``ssl`` module supported SNI, but now that we've dropped
support for Python 2.7 all relevant Python versions support SNI so
**this module is no longer recommended**.

This needs the following packages installed:

* `pyOpenSSL`_ (tested with 16.0.0)
* `cryptography`_ (minimum 1.3.4, from pyopenssl)
* `idna`_ (minimum 2.0)

However, pyOpenSSL depends on cryptography, so while we use all three directly here we
end up having relatively few packages required.

You can install them with the following command:

.. code-block:: bash

    $ python -m pip install pyopenssl cryptography idna

To activate certificate checking, call
:func:`~urllib3.contrib.pyopenssl.inject_into_urllib3` from your Python code
before you begin making HTTP requests. This can be done in a ``sitecustomize``
module, or at any other time before your application begins using ``urllib3``,
like this:

.. code-block:: python

    try:
        import urllib3.contrib.pyopenssl
        urllib3.contrib.pyopenssl.inject_into_urllib3()
    except ImportError:
        pass

.. _pyopenssl: https://www.pyopenssl.org
.. _cryptography: https://cryptography.io
.. _idna: https://github.com/kjd/idna
    )annotationsN)x509)UnsupportedExtensionc                   @  s   e Zd ZdS )r   N)__name__
__module____qualname__ r   r   U/var/www/html/olx_land/venv/lib/python3.10/site-packages/urllib3/contrib/pyopenssl.pyr   2   s    r   )BytesIO)socket)timeout   )utilX509inject_into_urllib3extract_from_urllib3zdict[int, int]_openssl_versionsPROTOCOL_TLSv1_1TLSv1_1_METHODPROTOCOL_TLSv1_2TLSv1_2_METHODc                 C  s   i | ]\}}||qS r   r   ).0kvr   r   r	   
<dictcomp>Y   s    r   OP_NO_SSLv2OP_NO_SSLv3int_OP_NO_SSLv2_OR_SSLv3OP_NO_TLSv1_OP_NO_TLSv1OP_NO_TLSv1_1_OP_NO_TLSv1_1OP_NO_TLSv1_2_OP_NO_TLSv1_2OP_NO_TLSv1_3_OP_NO_TLSv1_3_openssl_to_ssl_minimum_version_openssl_to_ssl_maximum_versioni @  returnNonec                   C  s&   t   tt_ttj_dt_dtj_dS )z7Monkey-patch urllib3 with PyOpenSSL-backed SSL-support.TN)_validate_dependencies_metPyOpenSSLContextr   
SSLContextssl_IS_PYOPENSSLr   r   r   r	   r      s
   c                   C  s    t t_t tj_dt_dtj_dS )z4Undo monkey-patching by :func:`inject_into_urllib3`.FN)orig_util_SSLContextr   r.   r/   r0   r   r   r   r	   r      s   c                  C  sR   ddl m}  t| dddu rtdddlm} | }t|dddu r'tddS )	z{
    Verifies that PyOpenSSL's package-level dependencies have been met.
    Throws `ImportError` if they are not met.
    r   )
Extensionsget_extension_for_classNzX'cryptography' module missing required functionality.  Try upgrading to v1.3.4 or newer.r   _x509zS'pyOpenSSL' module missing required functionality. Try upgrading to v0.14 or newer.)cryptography.x509.extensionsr2   getattrImportErrorOpenSSL.cryptor   )r2   r   r   r   r   r	   r,      s   r,   namestr
str | Nonec                 C  s4   d
dd}d| v r| S || }|du rdS | d	S )a%  
    Converts a dNSName SubjectAlternativeName field to the form used by the
    standard library on the given Python version.

    Cryptography produces a dNSName as a unicode string that was idna-decoded
    from ASCII bytes. We need to idna-encode that string to get it back, and
    then on Python 3 we also need to convert to unicode via UTF-8 (the stdlib
    uses PyUnicode_FromStringAndSize on it, which decodes via UTF-8).

    If the name cannot be idna-encoded then we return None signalling that
    the name given should be skipped.
    r9   r:   r*   bytes | Nonec                 S  sl   ddl }z%dD ]}| |r#| t|d } |d||    W S q|| W S  |jjy5   Y dS w )z
        Borrowed wholesale from the Python Cryptography Project. It turns out
        that we can't just safely call `idna.encode`: it can explode for
        wildcard names. This avoids that problem.
        r   N)z*..ascii)idna
startswithlenencodecore	IDNAError)r9   r?   prefixr   r   r	   idna_encode   s   
z'_dnsname_to_stdlib.<locals>.idna_encode:Nutf-8)r9   r:   r*   r<   )decode)r9   rF   encoded_namer   r   r	   _dnsname_to_stdlib   s   

rK   	peer_certr   list[tuple[str, str]]c                 C  s   |   }z
|jtjj}W n+ tjy   g  Y S  tjttj	t
fy9 } ztd| g W  Y d}~S d}~ww dd tt|tjD }|dd |tjD  |S )zU
    Given an PyOpenSSL certificate, provides all the subject alternative names.
    zA problem was encountered with the certificate that prevented urllib3 from finding the SubjectAlternativeName field. This can affect certificate validation. The error was %sNc                 S  s   g | ]
}|d urd|fqS )NDNSr   r   r9   r   r   r	   
<listcomp>  s
    z%get_subj_alt_name.<locals>.<listcomp>c                 s  s    | ]	}d t |fV  qdS )z
IP AddressN)r:   rO   r   r   r	   	<genexpr>  s    
z$get_subj_alt_name.<locals>.<genexpr>)to_cryptography
extensionsr3   r   SubjectAlternativeNamevalueExtensionNotFoundDuplicateExtensionr   UnsupportedGeneralNameTypeUnicodeErrorlogwarningmaprK   get_values_for_typeDNSNameextend	IPAddress)rL   certextenamesr   r   r	   get_subj_alt_name   s2   

re   c                   @  s   e Zd ZdZ	d6d7ddZd8ddZd9ddZd:ddZd;ddZd<ddZ	d=dd Z
d>d!d"Zd?d$d%Zd9d&d'Zd9d(d)Z	*d@dAd-d.ZdBd0d1ZdCd3d4Zd5S )DWrappedSocketz@API-compatibility wrapper for Python OpenSSL's Connection-class.T
connectionOpenSSL.SSL.Connectionr   
socket_clssuppress_ragged_eofsboolr*   r+   c                 C  s"   || _ || _|| _d| _d| _d S Nr   F)rg   r   rj   _io_refs_closed)selfrg   r   rj   r   r   r	   __init__  s
   
zWrappedSocket.__init__r   c                 C  
   | j  S N)r   filenoro   r   r   r	   rs   !     
zWrappedSocket.filenoc                 C  s.   | j dkr|  j d8  _ | jr|   d S d S )Nr      )rm   rn   closert   r   r   r	   _decref_socketios%  s
   
zWrappedSocket._decref_socketiosargs
typing.Anykwargsbytesc              
   O  s  z| j j|i |}W |S  tjjy4 } z| jr%|jdkr%W Y d }~dS t|jd t||d }~w tjj	yI   | j 
 tjjkrHY dS   tjjys } zt| j| j satd|| j|i |W  Y d }~S d }~w tjjy } z	td||d }~ww )NzUnexpected EOF    r   The read operation timed outread error: )rg   recvOpenSSLSSLSysCallErrorrj   ry   OSErrorr:   ZeroReturnErrorget_shutdownRECEIVED_SHUTDOWNWantReadErrorr   wait_for_readr   
gettimeoutr   ErrorsslSSLError)ro   ry   r{   datarc   r   r   r	   r   +  s*   
zWrappedSocket.recvc              
   O  s  z
| j j|i |W S  tjjy2 } z| jr#|jdkr#W Y d }~dS t|jd t||d }~w tjj	yG   | j 
 tjjkrFY dS   tjjyq } zt| j| j s_td|| j|i |W  Y d }~S d }~w tjjy } z	td||d }~ww )Nr}   r   r   r   )rg   	recv_intor   r   r   rj   ry   r   r:   r   r   r   r   r   r   r   r   r   r   r   r   )ro   ry   r{   rc   r   r   r	   r   D  s(   
zWrappedSocket.recv_intor   floatc                 C  s   | j |S rr   )r   
settimeout)ro   r   r   r   r	   r   [  s   zWrappedSocket.settimeoutr   c              
   C  s   	 z| j |W S  tjjy* } zt| j| j s t	 |W Y d }~q d }~w tjj
yB } zt|jd t||d }~ww NTr   )rg   sendr   r   WantWriteErrorr   wait_for_writer   r   r   r   r   ry   r:   )ro   r   rc   r   r   r	   _send_until_done^  s   zWrappedSocket._send_until_donec                 C  sB   d}|t |k r| |||t  }||7 }|t |k sd S d S Nr   )rA   r   SSL_WRITE_BLOCKSIZE)ro   r   
total_sentsentr   r   r	   sendalli  s   zWrappedSocket.sendallhowc              
   C  s@   z| j   W d S  tjjy } z	td||d }~ww )Nzshutdown error: )rg   shutdownr   r   r   r   r   )ro   r   rc   r   r   r	   r   q  s   zWrappedSocket.shutdownc                 C  s    d| _ | jdkr|   d S d S r   )rn   rm   _real_closert   r   r   r	   rw   w  s   
zWrappedSocket.closec                 C  s&   z| j  W S  tjjy   Y d S w rr   )rg   rw   r   r   r   rt   r   r   r	   r   |  s
   zWrappedSocket._real_closeFbinary_form"dict[str, list[typing.Any]] | Nonec                 C  sD   | j  }|s	|S |rtjtjj|S d| jffft|dS )N
commonName)subjectsubjectAltName)	rg   get_peer_certificater   cryptodump_certificateFILETYPE_ASN1get_subjectCNre   )ro   r   r   r   r   r	   getpeercert  s   
zWrappedSocket.getpeercertr:   c                 C  rq   rr   )rg   get_protocol_version_namert   r   r   r	   version  ru   zWrappedSocket.versionr;   c                 C  s   | j  }|r| S d S rr   )rg   get_alpn_proto_negotiatedrI   )ro   
alpn_protor   r   r	   selected_alpn_protocol  s   
z$WrappedSocket.selected_alpn_protocolN)T)rg   rh   r   ri   rj   rk   r*   r+   r*   r   r*   r+   )ry   rz   r{   rz   r*   r|   )ry   rz   r{   rz   r*   r   )r   r   r*   r+   )r   r|   r*   r   )r   r|   r*   r+   )r   r   r*   r+   )F)r   rk   r*   r   )r*   r:   )r*   r;   )r   r   r   __doc__rp   rs   rx   r   r   r   r   r   r   rw   r   r   r   r   r   r   r   r	   rf     s$    










rf   c                   @  s  e Zd ZdZdBddZedCdd	ZejdDdd	ZedCddZejdDddZedCddZ	e	jdEddZ	dFddZ
dGddZ			dHdIdd Z		dJdKd%d&ZdLd)d*Z	+	,	,	dMdNd6d7ZdFd8d9ZedCd:d;ZejdOd=d;ZedCd>d?ZejdPdAd?ZdS )Qr-   z
    I am a wrapper class for the PyOpenSSL ``Context`` object. I am responsible
    for translating the interface of the standard library ``SSLContext`` object
    to calls into PyOpenSSL.
    protocolr   r*   r+   c                 C  sF   t | | _tj| j| _d| _d| _tj	j
| _tj	j| _tj| _d S rl   )r   r   r   r   Context_ctx_optionscheck_hostnamer   
TLSVersionMINIMUM_SUPPORTED_minimum_versionMAXIMUM_SUPPORTED_maximum_versionVERIFY_X509_TRUSTED_FIRST_verify_flags)ro   r   r   r   r	   rp     s   


zPyOpenSSLContext.__init__c                 C     | j S rr   )r   rt   r   r   r	   options     zPyOpenSSLContext.optionsrU   c                 C     || _ |   d S rr   )r   _set_ctx_optionsro   rU   r   r   r	   r        c                 C  r   rr   )r   rt   r   r   r	   verify_flags  r   zPyOpenSSLContext.verify_flagsc                 C  s   || _ | j | j  d S rr   )r   r   get_cert_store	set_flagsr   r   r   r	   r     s   c                 C  s   t | j  S rr   )_openssl_to_stdlib_verifyr   get_verify_modert   r   r   r	   verify_mode  s   zPyOpenSSLContext.verify_modessl.VerifyModec                 C  s   | j t| t d S rr   )r   
set_verify_stdlib_to_openssl_verify_verify_callbackr   r   r   r	   r     s   c                 C  s   | j   d S rr   )r   set_default_verify_pathsrt   r   r   r	   r     s   z)PyOpenSSLContext.set_default_verify_pathsciphersbytes | strc                 C  s$   t |tr
|d}| j| d S )NrH   )
isinstancer:   rB   r   set_cipher_list)ro   r   r   r   r	   set_ciphers  s   

zPyOpenSSLContext.set_ciphersNcafiler;   capathcadatar<   c              
   C  s   |d ur	| d}|d ur| d}z| j|| |d ur)| jt| W d S W d S  tjjyB } z	td||d }~ww )NrH   z%unable to load trusted certificates: )	rB   r   load_verify_locationsr
   r   r   r   r   r   )ro   r   r   r   rc   r   r   r	   r     s   

z&PyOpenSSLContext.load_verify_locationscertfiler:   keyfilepasswordc              
     s   z)| j |  d urt ts d | j  fdd | j |p%| W d S  tjj	y@ } z	t
d||d }~ww )NrH   c                    s    S rr   r   )_r   r   r	   <lambda>  s    z2PyOpenSSLContext.load_cert_chain.<locals>.<lambda>z"Unable to load certificate chain: )r   use_certificate_chain_filer   r|   rB   set_passwd_cbuse_privatekey_filer   r   r   r   r   )ro   r   r   r   rc   r   r   r	   load_cert_chain  s   

z PyOpenSSLContext.load_cert_chain	protocolslist[bytes | str]c                 C  s   dd |D }| j |S )Nc                 S  s   g | ]	}t j |d qS )r>   )r   to_bytes)r   pr   r   r	   rP     s    z7PyOpenSSLContext.set_alpn_protocols.<locals>.<listcomp>)r   set_alpn_protos)ro   r   r   r   r	   set_alpn_protocols  s   z#PyOpenSSLContext.set_alpn_protocolsFTsockri   server_siderk   do_handshake_on_connectrj   server_hostnamebytes | str | Nonerf   c              
   C  s   t j| j|}|rtj|st|tr|	d}|
| |  	 z|  W n7 t jjyK } zt|| sAtd|W Y d }~q#d }~w t jjya } z	td||d }~ww 	 t||S )NrH   Tzselect timed outzbad handshake: )r   r   
Connectionr   r   r/   is_ipaddressr   r:   rB   set_tlsext_host_nameset_connect_statedo_handshaker   r   r   r   r   r   r   rf   )ro   r   r   r   rj   r   cnxrc   r   r   r	   wrap_socket  s(   




zPyOpenSSLContext.wrap_socketc                 C  s&   | j | jt| j B t| j B  d S rr   )r   set_optionsr   r(   r   r)   r   rt   r   r   r	   r     s   z!PyOpenSSLContext._set_ctx_optionsc                 C  r   rr   )r   rt   r   r   r	   minimum_version  r   z PyOpenSSLContext.minimum_versionr   c                 C  r   rr   )r   r   )ro   r   r   r   r	   r     r   c                 C  r   rr   )r   rt   r   r   r	   maximum_version#  r   z PyOpenSSLContext.maximum_versionr   c                 C  r   rr   )r   r   )ro   r   r   r   r	   r   '  r   )r   r   r*   r+   r   )rU   r   r*   r+   )rU   r   r*   r+   r   )r   r   r*   r+   )NNN)r   r;   r   r;   r   r<   r*   r+   )NN)r   r:   r   r;   r   r;   r*   r+   )r   r   r*   r+   )FTTN)r   ri   r   rk   r   rk   rj   rk   r   r   r*   rf   )r   r   r*   r+   )r   r   r*   r+   )r   r   r   r   rp   propertyr   setterr   r   r   r   r   r   r   r   r   r   r   r   r   r   r	   r-     sN    
	



r-   r   rh   r   err_no	err_depthreturn_coderk   c                 C  s   |dkS r   r   )r   r   r   r   r   r   r   r	   r   -  s   r   r   )r9   r:   r*   r;   )rL   r   r*   rM   )r   rh   r   r   r   r   r   r   r   r   r*   rk   )Nr   
__future__r   OpenSSL.SSLr   cryptographyr   cryptography.x509r   r7   	Exceptionloggingr   typingior
   r   ri   r    r   TYPE_CHECKINGr8   r   __all__r/   PROTOCOL_TLSr   SSLv23_METHODPROTOCOL_TLS_CLIENTPROTOCOL_TLSv1TLSv1_METHODr   __annotations__hasattrr   r   r   r   	CERT_NONEVERIFY_NONECERT_OPTIONALVERIFY_PEERCERT_REQUIREDVERIFY_FAIL_IF_NO_PEER_CERTr   itemsr   r6   r   r!   r#   r%   r'   r   r   TLSv1TLSv1_1TLSv1_2TLSv1_3r   r(   r)   r   r.   r1   	getLoggerr   rZ   r   r   r,   rK   re   rf   makefiler-   r   r   r   r   r	   <module>   s    (







	

)0 	 