
    Df=@                        d Z ddlZddlZddlZddlmZ 	 ddlZn# e$ r dZY nw xY w	 ddlm	Z	 n # e$ r 	 ddl
m	Z	 n# e$ r dZ	Y nw xY wY nw xY wddlmZ dd	lmZ dd
lmZmZ ddlmZ d Zd Zd Zd Zd Z G d de          ZdS )z
A library for integrating Python's builtin :py:mod:`ssl` library with Cheroot.

The :py:mod:`ssl` module must be importable for SSL functionality.

To use this module, set ``HTTPServer.ssl_adapter`` to an instance of
``BuiltinSSLAdapter``.
    N)suppress)DEFAULT_BUFFER_SIZE   )Adapter   )errorsStreamReaderStreamWriter)
HTTPServerc                     t          |          dk     rt          d          t          |                                           t	          fd|D                       S )zACheck whether SSL exception contains either of messages provided.r   zF_assert_ssl_exc_contains() requires at least one message to be passed.c              3   D   K   | ]}|                                 v V  d S )N)lower).0merr_msg_lowers     B/var/www/media/lib/python3.11/site-packages/cheroot/ssl/builtin.py	<genexpr>z+_assert_ssl_exc_contains.<locals>.<genexpr>*   s0      88aqwwyyM)888888    )len	TypeErrorstrr   any)excmsgsr   s     @r   _assert_ssl_exc_containsr   "   sc    
4yy1}}1
 
 	
 HHNN$$M88884888888r   c                     t          t          j        t                    5  |                     |dd          5 }|                    d           ddd           n# 1 swxY w Y   ddd           dS # 1 swxY w Y   dS )z;Wrap a socket in ssl and perform the server-side handshake.Tdo_handshake_on_connectserver_sides   0000N)r   sslSSLErrorOSErrorwrap_socketsend)contextserverssl_socks      r   _loopback_for_cert_threadr*   -   s    
#,	(	( # #  $ ! 
 
 	#& MM'"""+	# 	# 	# 	# 	# 	# 	# 	# 	# 	# 	# 	# 	# 	# 	## # # # # # # # # # # # # # # # # #s4   A3AA3A	A3"A	#A33A7:A7c                 R   t          j        |          }|                    | |           d|_        t           j        |_        t          j                    \  }}	 t          j	        t          ||f          }	 |                                 |                    |dd          5 }|                    d           |                                cddd           |                                 |                                 |                                 S # 1 swxY w Y   	 |                                 n# |                                 w xY w	 |                                 |                                 dS # |                                 |                                 w xY w)z@Create a loopback connection to parse a cert with a private key.)cafileF)targetargsTr      N)r"   create_default_contextload_cert_chaincheck_hostname	CERT_NONEverify_modesocket
socketpair	threadingThreadr*   startr%   recvgetpeercertjoinclose)certificateprivate_keycertificate_chainr'   clientr(   threadr)   s           r   _loopback_for_certrC   L   s   (0ABBBGK555"G-G &((NFF !,GV3D
 
 
		LLNNN$$D % %   . a   ++--. . . . . . . KKMMM. . . . . . . . . KKMMMMFKKMMMMM 	sN   E< 9,D8 %)DD8 E< DD8 DD8 #E< 8EE< <*F&c                 8   t          t          t          j        t                    5  t          | ||          cddd           S # 1 swxY w Y   t          t                    5  t          j                            |           cddd           S # 1 swxY w Y   i S )zParse a certificate.N)	r   AttributeErrorr"   r#   r$   rC   	Exception_ssl_test_decode_cert)r>   r?   r@   s      r   _parse_certrI   n   s    
.#,	8	8 O O!+{<MNNO O O O O O O O O O O O O O O O 
)		 7 7x))+667 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 Is#   AAA#BBBc                     || _         dS )z7Handle the SNI callback to tag the socket with the SNI.N)sni)sockrK   r'   s      r   _sni_callbackrM      s    DHHHr   c                        e Zd ZdZdZ	 dZ	 dZ	 dZ	 ddddddd	d
ZddddddddddddddZ		 	 d$ fd	Z
ed             Zej        d             Z fdZd Zd Zd Zd  Zd! Zd"efd#Z xZS )%BuiltinSSLAdapterzDWrapper for integrating Python's builtin :py:mod:`ssl` with Cheroot.N	M_VERSIONM_SERIALV_STARTV_ENDS_DNI_DNSAN)versionserialNumber	notBeforenotAftersubjectissuersubjectAltNameCSTLOOUCNTIGSDUIDEmail)countryNamestateOrProvinceNamelocalityNameorganizationNameorganizationalUnitName
commonNametitleinitials	givenNamesurnamedescriptionuseridemailAddressc                 >   t           t          d          t          t          |                               ||||           t          j        t           j        j        |          | _        | j        	                    ||           | j
        | j                            |           |                     dt          ||| j                            | _        | j        sdS d}t!          |d          5 }|                                }ddd           n# 1 swxY w Y   |                    t           j                  }|dk    rdS |                    t           j        |          }|dk    rdS |t+          t           j                  z  }|||         | j        d<   dS )	zASet up context in addition to base class properties if available.Nz-You must install the ssl module to use HTTPS.)purposer,   
SSL_SERVERrt)moder   SSL_SERVER_CERT)r"   ImportErrorsuperrO   __init__r0   PurposeCLIENT_AUTHr'   r1   ciphersset_ciphers_make_env_cert_dictrI   r@   _server_envopenreadfind
PEM_HEADER
PEM_FOOTERr   )
selfr>   r?   r@   r   certf
cert_startcert_end	__class__s
            r   r   zBuiltinSSLAdapter.__init__   s   
 ;MNNN&&//&7	
 	
 	
 1K+$
 
 
 	$$[+>>><#L$$W---33[$2HII
 
  	F+D))) 	Q6688D	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 YYs~..
F99S^Z88r>>FC'''.2:h3F.G*+++s   4DDDc                     | j         S )z>:py:class:`~ssl.SSLContext` that will be used to wrap sockets.)_context)r   s    r   r'   zBuiltinSSLAdapter.context   s     }r   c                     || _         t          t                    5  t          j        r|j        t          |_        ddd           dS # 1 swxY w Y   dS )zSet the ssl ``context`` to use.N)r   r   rE   r"   HAS_SNIsni_callbackrM   )r   r'   s     r   r'   zBuiltinSSLAdapter.context   s       n%% 	5 	5{ 5w3;'4$	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5 	5s    A		AAc                 T    t          t          |                               |          S )z!Wrap and return the given socket.)r   rO   bind)r   rL   r   s     r   r   zBuiltinSSLAdapter.bind  s"    &--224888r   c                    	 | j                             |dd          }n# t          j        t          j        f$ r}t          j        |j         |d}~wt          j        $ rP}|j	        t          j
        k    ot          |d          }|rt
          j        }nt
          j        } ||j         |d}~wt          $ r}t          j        |j         |d}~ww xY w||                     |          fS )z<Wrap and return the given socket, plus WSGI environ entries.Tr   Nzhttp request)r'   r%   r"   SSLEOFErrorSSLZeroReturnErrorr	   FatalSSLAlertr.   r#   errnoSSL_ERROR_SSLr   
NoSSLErrorr$   get_environ)r   rL   stls_connection_drop_errorgeneric_tls_error!peer_speaks_plain_http_over_https reraised_connection_drop_exc_clstcp_connection_drop_errors           r   wrapzBuiltinSSLAdapter.wrap  s;   	-((d )  AA O"
 	- 	- 	- &*/,- | 	% 	% 	%!'3+<< L():NKK . 1 H393D00393G022"'$%  	- 	- 	-&*/,-	-
 $""1%%%%s-     CAC!AB,,C9CCc           
         |                                 }dd|d         |d         d|d         t          j        dt          j        t          j        dd		}t          t                    5  |                                }|||d<   d
d
d
           n# 1 swxY w Y   t          t                    5  |j	        j
                                        |d<   d
d
d
           n# 1 swxY w Y   t          t                    5  |d
d         }|j                                        D ]#}||d         |d         fk    r|d         |d<    n$d
d
d
           n# 1 swxY w Y   t          t                    5  |j        |d<   d
d
d
           n# 1 swxY w Y   | j        r| j        j        t          j        k    r|                                }|rkd|d<   |                    |                     d|                     t	          j        |                    d                                                    |d<   |                    | j                   |S )z;Create WSGI environ entries to be merged into each request.httpsonr   r    r   z Python/NONE)	zwsgi.url_schemeHTTPSSSL_PROTOCOL
SSL_CIPHERSSL_CIPHER_EXPORTSSL_CIPHER_USEKEYSIZESSL_VERSION_INTERFACESSL_VERSION_LIBRARYSSL_CLIENT_VERIFYNSSL_COMPRESS_METHODSSL_SESSION_IDnameprotocolalg_bitsSSL_CIPHER_ALGKEYSIZESSL_TLS_SNISUCCESSr   
SSL_CLIENTT)binary_formSSL_CLIENT_CERT)cipherr   rW   sysr"   OPENSSL_VERSIONr   rE   compressionsessionidhexr'   get_ciphersrK   r4   r3   r;   updater   DER_cert_to_PEM_certstripr   )r   rL   r   ssl_environr   target_ciphercipclient_certs           r   r   zBuiltinSSLAdapter.get_environ(  s}   &"1I )!#%+AY"""CKK& $'#6!'
 
  n%% 	A 	A**,,K&5@12	A 	A 	A 	A 	A 	A 	A 	A 	A 	A 	A 	A 	A 	A 	A n%% 	B 	B,0LO,?,?,A,AK()	B 	B 	B 	B 	B 	B 	B 	B 	B 	B 	B 	B 	B 	B 	Bn%% 	 	"2A2JM|//11   S[#j/$BBB;>z?K 78E C	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 n%% 	2 	2)-K&	2 	2 	2 	2 	2 	2 	2 	2 	2 	2 	2 	2 	2 	2 	2 < 	DL4EE**,,K 	 4=/0"",,\;GG   251I$$$662 2%'' -. 	4+,,, sI   *BBB1"CC#&C#>AEEE1FFFc                 N   |si S i }| j                                         D ]\  }}|d|}|                    |          }|dk    r*|                    |                     ||                     Q|                    d          r*|                    |                     ||                     t          |          ||<   d|v r^t          j	        |d                   }|t          j	        |d                   z  }|dz  }t          t          |                    ||d<   |S )zReturn a dict of WSGI environment variables for a certificate.

        E.g. SSL_CLIENT_M_VERSION, SSL_CLIENT_M_SERIAL, etc.
        See https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#envvars.
        _rV   _DNrY   rZ   iQ 	_V_REMAIN)CERT_KEY_TO_ENVitemsgetr   _make_env_san_dictendswith_make_env_dn_dictr   r"   cert_time_to_secondsint)	r   
env_prefixparsed_certenvcert_keyenv_varkeyvalueremains	            r   r   z%BuiltinSSLAdapter._make_env_cert_dictf  s@     	I!%!5!;!;!=!= 	& 	&Hg'ZZ1COOH--E%

4223>>????!!%(( &

411#u==>>>>u::C +%%-k*.EFFFc.{;/GHHHFl"F14S[[1A1AC-.
r   c                     |si S i }d}d}|D ]0\  }}|dk    r||d||fz  <   |dz  }|dk    r||d||fz  <   |dz  }1|S )zReturn a dict of WSGI environment variables for a certificate DN.

        E.g. SSL_CLIENT_SAN_Email_0, SSL_CLIENT_SAN_DNS_0, etc.
        See SSL_CLIENT_SAN_* at
        https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#envvars.
        r   DNSz	%s_DNS_%ir   rj   z%s_Email_%i )r   r   
cert_valuer   	dns_countemail_count	attr_namevals           r   r   z$BuiltinSSLAdapter._make_env_san_dict  s      	I	( 	! 	!NIsE!!=@K:y"99:Q		g%%ADMZ$==>q  
r   c                    |si S g }i }|D ]t}|D ]o\  }}| j                             |          }|                    |p|d|           |s>|                    |g            ||                             |           pu|d                    |          i}	|                                D ]V\  }}
d                    |
          |	|d|<   t          |
          dk    r6t          |
          D ]\  }}||	d|||fz  <   W|	S )zReturn a dict of WSGI environment variables for a certificate DN.

        E.g. SSL_CLIENT_S_DN_CN, SSL_CLIENT_S_DN_C, etc.
        See SSL_CLIENT_S_DN_x509 at
        https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#envvars.
        =,r   r   z%s_%s_%i)CERT_KEY_TO_LDAP_CODEr   append
setdefaultr<   r   r   	enumerate)r   r   r   dndn_attrsrdnr   r   	attr_coder   valuesis               r   r   z#BuiltinSSLAdapter._make_env_dn_dict  si     	I 	0 	0C"% 0 0	3 6::9EE			Y%;)%;%;SSABBB  ##Ir222#**3////0 
 "*!1!1 	C 	CIv58XXf5E5EC:::yy126{{a#F++ C C3?BJ*i!;;<<C
r   rc                 @    d|v rt           nt          } ||||          S )zReturn socket file object.r   r
   )r   rL   r|   bufsizeclss        r   makefilezBuiltinSSLAdapter.makefile  s'    !Tkkll|s4w'''r   )NN)__name__
__module____qualname____doc__r>   r?   r@   r   r   r   r   propertyr'   setterr   r   r   r   r   r   r   r   __classcell__)r   s   @r   rO   rO      s       NNK6K96G" " O& # "& > ?C&H &H &H &H &H &HP   X ^5 5 ^59 9 9 9 9& & &B< < <|  <  2  @ #&/B ( ( ( ( ( ( ( (r   rO   )r   r5   r   r7   
contextlibr   r"   r~   _pyior   ior   r   r	   r   r   r   r(   r   r   r*   rC   rI   rM   rO   r   r   r   <module>r     s     



          JJJJ   
CCC!))))))) ! ! !!******* ! ! ! !!             1 1 1 1 1 1 1 1      9 9 9# # #>  D  (  x( x( x( x( x( x( x( x( x( x(s;    %%0 A=AAAAAA