File: //opt/saltstack/salt/lib/python3.10/site-packages/cheroot/ssl/__pycache__/pyopenssl.cpython-310.pyc
o
�N�g4 � @ s< d Z ddlmZmZmZ eZddlZddlZddl Z ddl
Z
ddl Z z$ddl Z
ddl
mZ ddl
mZ zejZW n eyD ejZY nw W n eyQ dZY nw ddlmZ dd lmZmZ dd
lmZm Z G d d � d �Z G d
d� de e�Z G dd� de e �Z G dd� d�Z e �!e �G dd� d��Z"G dd� de�Z#dS )a�
A library for integrating :doc:`pyOpenSSL <pyopenssl:index>` with Cheroot.
The :py:mod:`OpenSSL <pyopenssl:OpenSSL>` module must be importable
for SSL/TLS/HTTPS functionality.
You can obtain it from `here <https://github.com/pyca/pyopenssl>`_.
To use this module, set :py:attr:`HTTPServer.ssl_adapter
<cheroot.server.HTTPServer.ssl_adapter>` to an instance of
:py:class:`ssl.Adapter <cheroot.ssl.Adapter>`.
There are two ways to use :abbr:`TLS (Transport-Level Security)`:
Method One
----------
* :py:attr:`ssl_adapter.context
<cheroot.ssl.pyopenssl.pyOpenSSLAdapter.context>`: an instance of
:py:class:`SSL.Context <pyopenssl:OpenSSL.SSL.Context>`.
If this is not None, it is assumed to be an :py:class:`SSL.Context
<pyopenssl:OpenSSL.SSL.Context>` instance, and will be passed to
:py:class:`SSL.Connection <pyopenssl:OpenSSL.SSL.Connection>` on bind().
The developer is responsible for forming a valid :py:class:`Context
<pyopenssl:OpenSSL.SSL.Context>` object. This
approach is to be preferred for more flexibility, e.g. if the cert and
key are streams instead of files, or need decryption, or
:py:data:`SSL.SSLv3_METHOD <pyopenssl:OpenSSL.SSL.SSLv3_METHOD>`
is desired instead of the default :py:data:`SSL.SSLv23_METHOD
<pyopenssl:OpenSSL.SSL.SSLv3_METHOD>`, etc. Consult
the :doc:`pyOpenSSL <pyopenssl:api/ssl>` documentation for
complete options.
Method Two (shortcut)
---------------------
* :py:attr:`ssl_adapter.certificate
<cheroot.ssl.pyopenssl.pyOpenSSLAdapter.certificate>`: the file name
of the server's TLS certificate.
* :py:attr:`ssl_adapter.private_key
<cheroot.ssl.pyopenssl.pyOpenSSLAdapter.private_key>`: the file name
of the server's private key file.
Both are :py:data:`None` by default. If :py:attr:`ssl_adapter.context
<cheroot.ssl.pyopenssl.pyOpenSSLAdapter.context>` is :py:data:`None`,
but ``.private_key`` and ``.certificate`` are both given and valid, they
will be read, and the context will be automatically created from them.
.. spelling::
pyopenssl
� )�absolute_import�division�print_functionN)�SSL)�crypto� )�Adapter� )�errors�server)� StreamReader� StreamWriterc sV e Zd ZdZdZdZdd� Z� fdd�Zd� fd d
� Z� fd d �Z � fd
d�Z
� Z S )�SSLFileobjectMixinz#Base mixin for a TLS socket stream.� g{�G�z�?c O sZ t � � } z||i |��W S tjy t �| j� Y n� tjy, t �| j� Y nr tjy^ } z&|rB|jdkrBW Y d}~dS |jd }|rU|tj v rUW Y d}~dS t
� |��d}~w tj y� } z3|rt|jdkrtW Y d}~dS d}z |jd d d }W n t
y� Y nw |dkr�t�� �tj|j� �d}~ww t � � | | jkr�t
�d��q) z�Wrap the given call with TLS error-trapping.
is_reader: if False EOF errors will be raised. If True, EOF errors
will return "" (to emulate normal sockets).
T)���zUnexpected EOFN� r r z http requestz timed out)�timer Z
WantReadError�sleep� ssl_retryZWantWriteErrorZ SysCallError�argsr
Zsocket_errors_to_ignore�socket�error�Error�
IndexErrorZ
NoSSLErrorZ
FatalSSLAlert� ssl_timeout�timeout) �selfZ is_reader�callr �kwargs�start�eZerrnumZthirdarg� r! �I/opt/saltstack/salt/lib/python3.10/site-packages/cheroot/ssl/pyopenssl.py�
_safe_callW sB
� � ��
�z SSLFileobjectMixin._safe_callc � | � dtt| �j|�S )z*Receive message of a size from the socket.T)r# �superr �recv�r �size�� __class__r! r" r& � s
�zSSLFileobjectMixin.recvr c r$ )z�Receive message of a size from the socket.
Matches the following interface:
https://docs.python.org/3/library/io.html#io.IOBase.readline
T)r# r% r �readliner' r) r! r" r+ � s
�zSSLFileobjectMixin.readlinec �" | j dtt| �jg|�R i |��S )z!Send whole message to the socket.F)r# r% r �sendall�r r r r) r! r" r- � �
���zSSLFileobjectMixin.sendallc r, )z(Send some part of message to the socket.F)r# r% r �sendr. r) r! r" r0 � r/ zSSLFileobjectMixin.send)r ) �__name__�
__module__� __qualname__�__doc__r r r# r& r+ r- r0 �
__classcell__r! r! r) r" r P s . r c @ � e Zd ZdZdS )�SSLFileobjectStreamReader�,SSL file object attached to a socket object.N�r1 r2 r3 r4 r! r! r! r" r7 � � r7 c @ r6 )�SSLFileobjectStreamWriterr8 Nr9 r! r! r! r" r; � r: r; c @ � e Zd ZdZdd� ZdS )�SSLConnectionProxyMetaz2Metaclass for generating a bunch of proxy methods.c
sb d}d� d}� fdd�}|D ]
}||�||< ||| _ qdd� }|D ]} || �|| < q"t|||�S )z.Attach a list of proxy methods to a new class.)"� get_context�pendingr0 �writer& �readZ renegotiate�bind�listen�connect�accept� setblocking�fileno�closeZget_cipher_list� getpeername� getsockname�
getsockopt�
setsockopt�makefileZ get_app_dataZ set_app_dataZ state_stringZ
sock_shutdownZget_peer_certificateZ want_readZ
want_writeZset_connect_stateZset_accept_state�
connect_exr- �
settimeout�
gettimeout�shutdown)rQ )�familyc s � �fdd�}|S )�&Create a proxy method for a new class.c sL | j �� z� �vr|d d � ng }t| j� �|� W | j �� S | j �� w �N)�_lock�acquire�getattr� _ssl_conn�release)r r �new_args)�method�proxy_methods_no_argsr! r" �
proxy_wrapper� s
�zMSSLConnectionProxyMeta.__new__.<locals>.lock_decorator.<locals>.proxy_wrapperr! )r[ r] �r\ )r[ r" �lock_decorator� s z6SSLConnectionProxyMeta.__new__.<locals>.lock_decoratorc s � fdd�}� |_ t|�S )rS c s t | j� �S rT )rW rX )r �� property_r! r" �proxy_prop_wrapper� s zQSSLConnectionProxyMeta.__new__.<locals>.make_property.<locals>.proxy_prop_wrapper)r1 �property)ra rb r! r` r" �
make_property� s z5SSLConnectionProxyMeta.__new__.<locals>.make_property)r1 �type)
Zmcl�name�basesZnmspcZ
proxy_methodsZ proxy_propsr_ �mrd �pr! r^ r" �__new__� s z SSLConnectionProxyMeta.__new__N)r1 r2 r3 r4 rj r! r! r! r" r= � s r= c @ r< )�
SSLConnectionz�A thread-safe wrapper for an ``SSL.Connection``.
:param tuple args: the arguments to create the wrapped \
:py:class:`SSL.Connection(*args) \
<pyopenssl:OpenSSL.SSL.Connection>`
c G s t j|� | _t�� | _dS )z"Initialize SSLConnection instance.N)r �
ConnectionrX � threading�RLockrU )r r r! r! r" �__init__� s zSSLConnection.__init__N)r1 r2 r3 r4 ro r! r! r! r" rk � s rk c sn e Zd ZdZdZ dZ dZ dZ dZ d� fdd� Z dd� Z
dd� Z d d
� Z d d � Z
ddd�Z� ZS )�pyOpenSSLAdapterz1A wrapper for integrating pyOpenSSL with Cheroot.Nc s0 t du rtd��tt| ��||||� d| _dS )z$Initialize OpenSSL Adapter instance.Nz(You must install pyOpenSSL to use HTTPS.)r � ImportErrorr% rp ro �_environ)r � certificate� private_key�certificate_chain�ciphersr) r! r" ro s
�
zpyOpenSSLAdapter.__init__c C s. | j du r
| �� | _ t| j |�}| �� | _|S )z!Wrap and return the given socket.N)�contextr> rk � get_environrr )r �sock�connr! r! r" rB s
zpyOpenSSLAdapter.bindc C s || j �� fS )z<Wrap and return the given socket, plus WSGI environ entries.)rr �copy)r ry r! r! r" �wrap$ s zpyOpenSSLAdapter.wrapc C s: t �t j�}|�| j� | jr|�| j� |�| j� |S )z~Return an ``SSL.Context`` from self attributes.
Ref: :py:class:`SSL.Context <pyopenssl:OpenSSL.SSL.Context>`
) r ZContextZ
SSLv23_METHODZuse_privatekey_filert ru �load_verify_locationsZuse_certificate_filers )r �cr! r! r" r> + s z pyOpenSSLAdapter.get_contextc C sJ dddt jjtjjtjjtjf t�tj ��
� d�}| j r�t | j d��}t
�t
j|�� �}W d � n1 s7w Y |�|�� |�� d�� d|�� fd |�� ffD ]N\}}t|�d
d � }d | }|||< |r�|�d
�}|d|� ||d d� }} |�d�}|d|� ||d d� }}
|
r�| r�d||
f }| ||< |sjqT|S )z;Return WSGI environ entries to be merged into each request.�https�onz%s %s/%s Python/%s)zwsgi.url_schemeZHTTPSZSSL_VERSION_INTERFACEZSSL_VERSION_LIBRARY�rbN)ZSSL_SERVER_M_VERSIONZSSL_SERVER_M_SERIAL�I�S� ���zSSL_SERVER_%s_DN�=r �/zSSL_SERVER_%s_DN_%s)�cheroot_serverZ
HTTPServer�version�OpenSSLZ __title__� __version__�sysr ZSSLeay_versionZSSLEAY_VERSION�decoders �openr Zload_certificateZ FILETYPE_PEMrA �updateZ get_versionZget_serial_numberZ
get_issuerZ get_subject�str�rfind) r Z ssl_environ� cert_file�cert�prefix�dnZdnstrZwsgikey�pos�value�keyr! r! r" rx 8 sN ���
� ��
�
�� z pyOpenSSLAdapter.get_environ�rr c C sF d|v rt nt}tr t|t�r ||||�}|�� |_|S t�|||�S )zReturn socket file object.r� ) r7 r; r �
isinstance�
ssl_conn_typerP r r� Z
CP_fileobject)r ry �mode�bufsize�clsZwrapped_socketr! r! r" rM p s ��
zpyOpenSSLAdapter.makefile)NN)r� r )r1 r2 r3 r4 rs rt ru rw rv ro rB r| r> rx rM r5 r! r! r) r" rp � s( �
8rp )$r4 Z
__future__r r r re Z
__metaclass__r r� rm r ZsixZOpenSSL.versionr� r r rl r� �AttributeErrorZConnectionTyperq � r r
r r� rM r r
r r7 r; r= Z
add_metaclassrk rp r! r! r! r" �<module> s> 4
�� � Z6