File: //opt/saltstack/salt/lib/python3.10/site-packages/urllib3/util/__pycache__/ssl_.cpython-310.pyc
o
;jNE � @ s� U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z
ddl m Z m
Z
ddlmZmZ dZdZdZdZd gZeeeeeef Zd
d � d D �Zd]dd�Zej rxd dl m Z d dlm Z ddl mZ! G dd� de dd�Z"i Z#de$d< zQd dl Z d dl m%Z%mZm&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.mZm/Z/ e)Z0er�ee(�s�dZd D ]Z1ze2e/e1�e#e2e d e1� ��< W q� e3y� Y q�w ddl mZ W n e4y� d Z&d Z'd Z-d!Z.d Z0Z)d"Z*d#Z+d$Z,Y nw ej5de6df Z7d^d)d*�Z8d_d.d/�Z9d`d1d2�Z: dadbd=d>�Z;ej< ? ? ? ? ? ? ? ? ? ? ? ?dcdddOdP��Z=ej< ? ? ? ? ? ? ? ? ? ? ? ?dcdedRdP��Z= dfdedSdP�Z=dgdVdW�Z>dhdYdZ�Z? didjd[d\�Z@dS )k� )� annotationsN)� unhexlify� )�ProxySchemeUnsupported�SSLError� )�_BRACELESS_IPV6_ADDRZ_RE�_IPV4_REFzhttp/1.1c C s i | ] \}}|t t|d ��qS �N)�getattr�hashlib)�.0�length� algorithm� r �E/opt/saltstack/salt/lib/python3.10/site-packages/urllib3/util/ssl_.py�
<dictcomp> s ��r ))� �md5)�( �sha1)�@ �sha256�openssl_version�str�return�boolc C s | � d�}|S )NzOpenSSL )�
startswith)r Z
is_opensslr r r �(_is_has_never_check_common_name_reliable s
r )�
VerifyMode)� TypedDict)� SSLTransportc @ s& e Zd ZU ded< ded< ded< dS )�_TYPE_PEER_CERT_RET_DICTztuple[tuple[str, str], ...]�subjectAltNamez'tuple[tuple[tuple[str, str], ...], ...]�subjectr Z serialNumberN)�__name__�
__module__� __qualname__�__annotations__r r r r r" . s
r" )�totalzdict[int, int]�_SSL_VERSION_TO_TLS_VERSION)
�
CERT_REQUIRED�HAS_NEVER_CHECK_COMMON_NAME�OP_NO_COMPRESSION� OP_NO_TICKET�OPENSSL_VERSION� PROTOCOL_TLS�PROTOCOL_TLS_CLIENT�VERIFY_X509_PARTIAL_CHAIN�VERIFY_X509_STRICT� OP_NO_SSLv2� OP_NO_SSLv3�
SSLContext�
TLSVersion)�TLSv1�TLSv1_1�TLSv1_2� PROTOCOL_i i @ i i � i r �cert� bytes | None� fingerprint�Nonec C s� | du rt d��|�dd��� }t|�}|tvr t d|� ���t�|�}|du r/t d|� ���t|�� �}|| ��� }t �
||�sNt d|� d|� � � d ���dS )
z�
Checks if given fingerprint matches the supplied certificate.
:param cert:
Certificate as bytes object.
:param fingerprint:
Fingerprint as string of hexdigits, can be interspersed by colons.
Nz No certificate for the peer.�:� z Fingerprint of invalid length: zAHash function implementation unavailable for fingerprint length: z&Fingerprints did not match. Expected "z", got "�") r �replace�lower�len� HASHFUNC_MAP�getr �encode�digest�hmac�compare_digest�hex)r= r? Z
digest_lengthZhashfuncZfingerprint_bytesZ cert_digestr r r �assert_fingerprintk s$
� ��rN � candidate�None | int | strr c C s@ | du rt S t| t�r tt| d�}|du r ttd| �}|S | S )a�
Resolves the argument to a numeric constant, which can be passed to
the wrap_socket function/method from the ssl module.
Defaults to :data:`ssl.CERT_REQUIRED`.
If given a string it is assumed to be the name of the constant in the
:mod:`ssl` module or its abbreviation.
(So you can specify `REQUIRED` instead of `CERT_REQUIRED`.
If it's neither `None` nor a string we assume it is already the numeric
constant which can directly be passed to wrap_socket.
NZCERT_)r+ �
isinstancer r �ssl�rO �resr r r �resolve_cert_reqs� s
rU �intc C sH | du rt S t| t�r"tt| d�}|du r ttd| �}t�t|�S | S )z
like resolve_cert_reqs
Nr; )r0 rQ r r rR �typing�castrV rS r r r �resolve_ssl_version� s
rY � ssl_version�
int | None� cert_reqs�options�ciphers�
str | None�ssl_minimum_version�ssl_maximum_version� verify_flags�ssl.SSLContextc C s� t du rtd��| dttfvr1|dus|durtd��t�| tj�}t�| tj �}t
j dt dd� t t�}|dur=||_
ntj|_
|durH||_|rO|�|� |du rVtjn|}|du rnd}|tO }|tO }|tO }|tO }| j|O _|du r�d}tjdkr�|tO }|tO }| j |O _ t |d d�dur�d
|_ |tjkr�t s�||_ d
|_!nd |_!||_ d |_"d t#j$v r�t#j%�&t#j$�d ��}nd}|r�||_'|S )
a# Creates and configures an :class:`ssl.SSLContext` instance for use with urllib3.
:param ssl_version:
The desired protocol version to use. This will default to
PROTOCOL_SSLv23 which will negotiate the highest protocol that both
the server and your installation of OpenSSL support.
This parameter is deprecated instead use 'ssl_minimum_version'.
:param ssl_minimum_version:
The minimum version of TLS to be used. Use the 'ssl.TLSVersion' enum for specifying the value.
:param ssl_maximum_version:
The maximum version of TLS to be used. Use the 'ssl.TLSVersion' enum for specifying the value.
Not recommended to set to anything other than 'ssl.TLSVersion.MAXIMUM_SUPPORTED' which is the
default value.
:param cert_reqs:
Whether to require the certificate verification. This defaults to
``ssl.CERT_REQUIRED``.
:param options:
Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2``,
``ssl.OP_NO_SSLv3``, ``ssl.OP_NO_COMPRESSION``, and ``ssl.OP_NO_TICKET``.
:param ciphers:
Which cipher suites to allow the server to select. Defaults to either system configured
ciphers if OpenSSL 1.1.1+, otherwise uses a secure default set of ciphers.
:param verify_flags:
The flags for certificate verification operations. These default to
``ssl.VERIFY_X509_PARTIAL_CHAIN`` and ``ssl.VERIFY_X509_STRICT`` for Python 3.13+.
:returns:
Constructed SSLContext object with specified options
:rtype: SSLContext
Nz7Can't create an SSLContext object without an ssl modulezZCan't specify both 'ssl_version' and either 'ssl_minimum_version' or 'ssl_maximum_version'zi'ssl_version' option is deprecated and will be removed in urllib3 v3.0. Instead use 'ssl_minimum_version'r )�category�
stacklevelr )� �
�post_handshake_authTF�
SSLKEYLOGFILE)(r6 � TypeErrorr0 r1 �
ValueErrorr* rH r7 �MINIMUM_SUPPORTED�MAXIMUM_SUPPORTED�warnings�warn�
FutureWarning�minimum_versionr: �maximum_version� set_ciphersrR r+ r4 r5 r- r. r] �sys� version_infor2 r3 rb r rh � IS_PYOPENSSL� verify_mode�check_hostname�hostname_checks_common_name�os�environ�path�
expandvars�keylog_filename) rZ r\ r] r^ r` ra rb �contextZ
sslkeylogfiler r r �create_urllib3_context� sl '����
r� .�sock�
socket.socket�keyfile�certfile�ca_certs�server_hostname� ssl_context�ssl.SSLContext | None� ca_cert_dir� key_password� ca_cert_data�None | str | bytes�
tls_in_tls�typing.Literal[False]�
ssl.SSLSocketc
C � d S r
r �
r� r� r� r\ r� r� rZ r^ r� r� r� r� r� r r r �ssl_wrap_socketG � r� � ssl.SSLSocket | SSLTransportTypec
C r� r
r r� r r r r� Y r� c
C s� |}
|
du r
t |||d�}
|s| s| r.z |
�|| | � W n ty- } zt|�|�d}~ww |du r;t|
d�r;|
�� |rI|
du rIt|�rItd��|r]|
du rV|
�||� n|
�|||
� |
�t � t
| |
| |�}|S )a�
All arguments except for server_hostname, ssl_context, tls_in_tls, ca_cert_data and
ca_cert_dir have the same meaning as they do when using
:func:`ssl.create_default_context`, :meth:`ssl.SSLContext.load_cert_chain`,
:meth:`ssl.SSLContext.set_ciphers` and :meth:`ssl.SSLContext.wrap_socket`.
:param server_hostname:
When SNI is supported, the expected hostname of the certificate
:param ssl_context:
A pre-made :class:`SSLContext` object. If none is provided, one will
be created using :func:`create_urllib3_context`.
:param ciphers:
A string of ciphers we wish the client to support.
:param ca_cert_dir:
A directory containing CA certificates in multiple separate files, as
supported by OpenSSL's -CApath flag or the capath argument to
SSLContext.load_verify_locations().
:param key_password:
Optional password if the keyfile is encrypted.
:param ca_cert_data:
Optional string containing CA certificates in PEM format suitable for
passing as the cadata parameter to SSLContext.load_verify_locations()
:param tls_in_tls:
Use SSLTransport to wrap the existing socket.
N)r^ �load_default_certsz5Client private key is encrypted, password is required) r� �load_verify_locations�OSErrorr �hasattrr� �_is_key_file_encrypted�load_cert_chain�set_alpn_protocols�ALPN_PROTOCOLS�_ssl_wrap_socket_impl)r� r� r� r\ r� r� rZ r^ r� r� r� r� r� r �eZssl_sockr r r r� k s* (
��
�hostname� str | bytesc C s, t | t�r
| �d�} tt�| �pt�| ��S )z�Detects whether the hostname given is an IPv4 or IPv6 address.
Also detects IPv6 addresses with Zone IDs.
:param str hostname: Hostname to examine.
:return: True if the hostname is an IP address, False otherwise.
�ascii)rQ �bytes�decoder r �matchr )r� r r r � is_ipaddress� s
r� �key_filec C sR t | ��}|D ]}d|v r W d � dS qW d � dS 1 s"w Y dS )z*Detects if a key file is encrypted or not.Z ENCRYPTEDNTF)�open)r� �f�liner r r r� � s
��
��r� c C s4 |rt std��t �|� t | ||�S |j| |d�S )Nz0TLS in TLS requires support for the 'ssl' module)r� )r! r Z$_validate_ssl_context_for_tls_in_tls� wrap_socket)r� r� r� r� r r r r� � s �
r� )r r r r )r= r> r? r r r@ )rO rP r r )rO rP r rV )NNNNNNN)rZ r[ r\ r[ r] r[ r^ r_ r` r[ ra r[ rb r[ r rc ) ............) r� r� r� r_ r� r_ r\ r[ r� r_ r� r_ rZ r[ r^ r_ r� r� r� r_ r� r_ r� r� r� r� r r� ) r� r� r� r_ r� r_ r\ r[ r� r_ r� r_ rZ r[ r^ r_ r� r� r� r_ r� r_ r� r� r� r r r� ) NNNNNNNNNNNF)r� r� r r )r� r r r r
)
r� r� r� rc r� r r� r_ r r� )A�
__future__r r rK rz �socketrt rW rn �binasciir �
exceptionsr r �urlr r r6 r! r, rv r� �tuplerV r Z_TYPE_VERSION_INFOrG r �
TYPE_CHECKINGrR r r Z ssltransportZSSLTransportTyper" r* r( r+ r- r. r/ r0 r1 r2 r3 r4 r5 r7 �PROTOCOL_SSLv23�attrr �AttributeError� ImportError�Unionr� Z_TYPE_PEER_CERT_RETrN rU rY r� �overloadr� r� r� r� r r r r �<module> s� �
<�� � �
"
� �� �
J
�