aboutsummaryrefslogtreecommitdiffstats
path: root/contrib/tools/python3/src/Lib/ssl.py
diff options
context:
space:
mode:
authorshadchin <shadchin@yandex-team.ru>2022-02-10 16:44:30 +0300
committerDaniil Cherednik <dcherednik@yandex-team.ru>2022-02-10 16:44:30 +0300
commit2598ef1d0aee359b4b6d5fdd1758916d5907d04f (patch)
tree012bb94d777798f1f56ac1cec429509766d05181 /contrib/tools/python3/src/Lib/ssl.py
parent6751af0b0c1b952fede40b19b71da8025b5d8bcf (diff)
downloadydb-2598ef1d0aee359b4b6d5fdd1758916d5907d04f.tar.gz
Restoring authorship annotation for <shadchin@yandex-team.ru>. Commit 1 of 2.
Diffstat (limited to 'contrib/tools/python3/src/Lib/ssl.py')
-rw-r--r--contrib/tools/python3/src/Lib/ssl.py440
1 files changed, 220 insertions, 220 deletions
diff --git a/contrib/tools/python3/src/Lib/ssl.py b/contrib/tools/python3/src/Lib/ssl.py
index e95e4cf5e9..e278e7e10d 100644
--- a/contrib/tools/python3/src/Lib/ssl.py
+++ b/contrib/tools/python3/src/Lib/ssl.py
@@ -119,32 +119,32 @@ from _ssl import (
from _ssl import _DEFAULT_CIPHERS, _OPENSSL_API_VERSION
-_IntEnum._convert_(
+_IntEnum._convert_(
'_SSLMethod', __name__,
lambda name: name.startswith('PROTOCOL_') and name != 'PROTOCOL_SSLv23',
source=_ssl)
-_IntFlag._convert_(
+_IntFlag._convert_(
'Options', __name__,
lambda name: name.startswith('OP_'),
source=_ssl)
-_IntEnum._convert_(
+_IntEnum._convert_(
'AlertDescription', __name__,
lambda name: name.startswith('ALERT_DESCRIPTION_'),
source=_ssl)
-_IntEnum._convert_(
+_IntEnum._convert_(
'SSLErrorNumber', __name__,
lambda name: name.startswith('SSL_ERROR_'),
source=_ssl)
-_IntFlag._convert_(
+_IntFlag._convert_(
'VerifyFlags', __name__,
lambda name: name.startswith('VERIFY_'),
source=_ssl)
-_IntEnum._convert_(
+_IntEnum._convert_(
'VerifyMode', __name__,
lambda name: name.startswith('CERT_'),
source=_ssl)
@@ -165,94 +165,94 @@ class TLSVersion(_IntEnum):
MAXIMUM_SUPPORTED = _ssl.PROTO_MAXIMUM_SUPPORTED
-class _TLSContentType(_IntEnum):
- """Content types (record layer)
-
- See RFC 8446, section B.1
- """
- CHANGE_CIPHER_SPEC = 20
- ALERT = 21
- HANDSHAKE = 22
- APPLICATION_DATA = 23
- # pseudo content types
- HEADER = 0x100
- INNER_CONTENT_TYPE = 0x101
-
-
-class _TLSAlertType(_IntEnum):
- """Alert types for TLSContentType.ALERT messages
-
- See RFC 8466, section B.2
- """
- CLOSE_NOTIFY = 0
- UNEXPECTED_MESSAGE = 10
- BAD_RECORD_MAC = 20
- DECRYPTION_FAILED = 21
- RECORD_OVERFLOW = 22
- DECOMPRESSION_FAILURE = 30
- HANDSHAKE_FAILURE = 40
- NO_CERTIFICATE = 41
- BAD_CERTIFICATE = 42
- UNSUPPORTED_CERTIFICATE = 43
- CERTIFICATE_REVOKED = 44
- CERTIFICATE_EXPIRED = 45
- CERTIFICATE_UNKNOWN = 46
- ILLEGAL_PARAMETER = 47
- UNKNOWN_CA = 48
- ACCESS_DENIED = 49
- DECODE_ERROR = 50
- DECRYPT_ERROR = 51
- EXPORT_RESTRICTION = 60
- PROTOCOL_VERSION = 70
- INSUFFICIENT_SECURITY = 71
- INTERNAL_ERROR = 80
- INAPPROPRIATE_FALLBACK = 86
- USER_CANCELED = 90
- NO_RENEGOTIATION = 100
- MISSING_EXTENSION = 109
- UNSUPPORTED_EXTENSION = 110
- CERTIFICATE_UNOBTAINABLE = 111
- UNRECOGNIZED_NAME = 112
- BAD_CERTIFICATE_STATUS_RESPONSE = 113
- BAD_CERTIFICATE_HASH_VALUE = 114
- UNKNOWN_PSK_IDENTITY = 115
- CERTIFICATE_REQUIRED = 116
- NO_APPLICATION_PROTOCOL = 120
-
-
-class _TLSMessageType(_IntEnum):
- """Message types (handshake protocol)
-
- See RFC 8446, section B.3
- """
- HELLO_REQUEST = 0
- CLIENT_HELLO = 1
- SERVER_HELLO = 2
- HELLO_VERIFY_REQUEST = 3
- NEWSESSION_TICKET = 4
- END_OF_EARLY_DATA = 5
- HELLO_RETRY_REQUEST = 6
- ENCRYPTED_EXTENSIONS = 8
- CERTIFICATE = 11
- SERVER_KEY_EXCHANGE = 12
- CERTIFICATE_REQUEST = 13
- SERVER_DONE = 14
- CERTIFICATE_VERIFY = 15
- CLIENT_KEY_EXCHANGE = 16
- FINISHED = 20
- CERTIFICATE_URL = 21
- CERTIFICATE_STATUS = 22
- SUPPLEMENTAL_DATA = 23
- KEY_UPDATE = 24
- NEXT_PROTO = 67
- MESSAGE_HASH = 254
- CHANGE_CIPHER_SPEC = 0x0101
-
-
+class _TLSContentType(_IntEnum):
+ """Content types (record layer)
+
+ See RFC 8446, section B.1
+ """
+ CHANGE_CIPHER_SPEC = 20
+ ALERT = 21
+ HANDSHAKE = 22
+ APPLICATION_DATA = 23
+ # pseudo content types
+ HEADER = 0x100
+ INNER_CONTENT_TYPE = 0x101
+
+
+class _TLSAlertType(_IntEnum):
+ """Alert types for TLSContentType.ALERT messages
+
+ See RFC 8466, section B.2
+ """
+ CLOSE_NOTIFY = 0
+ UNEXPECTED_MESSAGE = 10
+ BAD_RECORD_MAC = 20
+ DECRYPTION_FAILED = 21
+ RECORD_OVERFLOW = 22
+ DECOMPRESSION_FAILURE = 30
+ HANDSHAKE_FAILURE = 40
+ NO_CERTIFICATE = 41
+ BAD_CERTIFICATE = 42
+ UNSUPPORTED_CERTIFICATE = 43
+ CERTIFICATE_REVOKED = 44
+ CERTIFICATE_EXPIRED = 45
+ CERTIFICATE_UNKNOWN = 46
+ ILLEGAL_PARAMETER = 47
+ UNKNOWN_CA = 48
+ ACCESS_DENIED = 49
+ DECODE_ERROR = 50
+ DECRYPT_ERROR = 51
+ EXPORT_RESTRICTION = 60
+ PROTOCOL_VERSION = 70
+ INSUFFICIENT_SECURITY = 71
+ INTERNAL_ERROR = 80
+ INAPPROPRIATE_FALLBACK = 86
+ USER_CANCELED = 90
+ NO_RENEGOTIATION = 100
+ MISSING_EXTENSION = 109
+ UNSUPPORTED_EXTENSION = 110
+ CERTIFICATE_UNOBTAINABLE = 111
+ UNRECOGNIZED_NAME = 112
+ BAD_CERTIFICATE_STATUS_RESPONSE = 113
+ BAD_CERTIFICATE_HASH_VALUE = 114
+ UNKNOWN_PSK_IDENTITY = 115
+ CERTIFICATE_REQUIRED = 116
+ NO_APPLICATION_PROTOCOL = 120
+
+
+class _TLSMessageType(_IntEnum):
+ """Message types (handshake protocol)
+
+ See RFC 8446, section B.3
+ """
+ HELLO_REQUEST = 0
+ CLIENT_HELLO = 1
+ SERVER_HELLO = 2
+ HELLO_VERIFY_REQUEST = 3
+ NEWSESSION_TICKET = 4
+ END_OF_EARLY_DATA = 5
+ HELLO_RETRY_REQUEST = 6
+ ENCRYPTED_EXTENSIONS = 8
+ CERTIFICATE = 11
+ SERVER_KEY_EXCHANGE = 12
+ CERTIFICATE_REQUEST = 13
+ SERVER_DONE = 14
+ CERTIFICATE_VERIFY = 15
+ CLIENT_KEY_EXCHANGE = 16
+ FINISHED = 20
+ CERTIFICATE_URL = 21
+ CERTIFICATE_STATUS = 22
+ SUPPLEMENTAL_DATA = 23
+ KEY_UPDATE = 24
+ NEXT_PROTO = 67
+ MESSAGE_HASH = 254
+ CHANGE_CIPHER_SPEC = 0x0101
+
+
if sys.platform == "win32":
from _ssl import enum_certificates, enum_crls
-from socket import socket, SOCK_STREAM, create_connection
+from socket import socket, SOCK_STREAM, create_connection
from socket import SOL_SOCKET, SO_TYPE
import socket as _socket
import base64 # for DER-to-PEM translation
@@ -327,22 +327,22 @@ def _inet_paton(ipname):
Supports IPv4 addresses on all platforms and IPv6 on platforms with IPv6
support.
"""
- # inet_aton() also accepts strings like '1', '127.1', some also trailing
- # data like '127.0.0.1 whatever'.
- try:
- addr = _socket.inet_aton(ipname)
- except OSError:
- # not an IPv4 address
- pass
- else:
- if _socket.inet_ntoa(addr) == ipname:
- # only accept injective ipnames
- return addr
- else:
- # refuse for short IPv4 notation and additional trailing data
- raise ValueError(
- "{!r} is not a quad-dotted IPv4 address.".format(ipname)
- )
+ # inet_aton() also accepts strings like '1', '127.1', some also trailing
+ # data like '127.0.0.1 whatever'.
+ try:
+ addr = _socket.inet_aton(ipname)
+ except OSError:
+ # not an IPv4 address
+ pass
+ else:
+ if _socket.inet_ntoa(addr) == ipname:
+ # only accept injective ipnames
+ return addr
+ else:
+ # refuse for short IPv4 notation and additional trailing data
+ raise ValueError(
+ "{!r} is not a quad-dotted IPv4 address.".format(ipname)
+ )
try:
return _socket.inet_pton(_socket.AF_INET6, ipname)
@@ -356,15 +356,15 @@ def _inet_paton(ipname):
raise ValueError("{!r} is not an IPv4 address.".format(ipname))
-def _ipaddress_match(cert_ipaddress, host_ip):
+def _ipaddress_match(cert_ipaddress, host_ip):
"""Exact matching of IP addresses.
RFC 6125 explicitly doesn't define an algorithm for this
(section 1.7.2 - "Out of Scope").
"""
- # OpenSSL may add a trailing newline to a subjectAltName's IP address,
- # commonly woth IPv6 addresses. Strip off trailing \n.
- ip = _inet_paton(cert_ipaddress.rstrip())
+ # OpenSSL may add a trailing newline to a subjectAltName's IP address,
+ # commonly woth IPv6 addresses. Strip off trailing \n.
+ ip = _inet_paton(cert_ipaddress.rstrip())
return ip == host_ip
@@ -637,83 +637,83 @@ class SSLContext(_SSLContext):
return True
@property
- def _msg_callback(self):
- """TLS message callback
-
- The message callback provides a debugging hook to analyze TLS
- connections. The callback is called for any TLS protocol message
- (header, handshake, alert, and more), but not for application data.
- Due to technical limitations, the callback can't be used to filter
- traffic or to abort a connection. Any exception raised in the
- callback is delayed until the handshake, read, or write operation
- has been performed.
-
- def msg_cb(conn, direction, version, content_type, msg_type, data):
- pass
-
- conn
- :class:`SSLSocket` or :class:`SSLObject` instance
- direction
- ``read`` or ``write``
- version
- :class:`TLSVersion` enum member or int for unknown version. For a
- frame header, it's the header version.
- content_type
- :class:`_TLSContentType` enum member or int for unsupported
- content type.
- msg_type
- Either a :class:`_TLSContentType` enum number for a header
- message, a :class:`_TLSAlertType` enum member for an alert
- message, a :class:`_TLSMessageType` enum member for other
- messages, or int for unsupported message types.
- data
- Raw, decrypted message content as bytes
- """
- inner = super()._msg_callback
- if inner is not None:
- return inner.user_function
- else:
- return None
-
- @_msg_callback.setter
- def _msg_callback(self, callback):
- if callback is None:
- super(SSLContext, SSLContext)._msg_callback.__set__(self, None)
- return
-
- if not hasattr(callback, '__call__'):
- raise TypeError(f"{callback} is not callable.")
-
- def inner(conn, direction, version, content_type, msg_type, data):
- try:
- version = TLSVersion(version)
- except ValueError:
- pass
-
- try:
- content_type = _TLSContentType(content_type)
- except ValueError:
- pass
-
- if content_type == _TLSContentType.HEADER:
- msg_enum = _TLSContentType
- elif content_type == _TLSContentType.ALERT:
- msg_enum = _TLSAlertType
- else:
- msg_enum = _TLSMessageType
- try:
- msg_type = msg_enum(msg_type)
- except ValueError:
- pass
-
- return callback(conn, direction, version,
- content_type, msg_type, data)
-
- inner.user_function = callback
-
- super(SSLContext, SSLContext)._msg_callback.__set__(self, inner)
-
- @property
+ def _msg_callback(self):
+ """TLS message callback
+
+ The message callback provides a debugging hook to analyze TLS
+ connections. The callback is called for any TLS protocol message
+ (header, handshake, alert, and more), but not for application data.
+ Due to technical limitations, the callback can't be used to filter
+ traffic or to abort a connection. Any exception raised in the
+ callback is delayed until the handshake, read, or write operation
+ has been performed.
+
+ def msg_cb(conn, direction, version, content_type, msg_type, data):
+ pass
+
+ conn
+ :class:`SSLSocket` or :class:`SSLObject` instance
+ direction
+ ``read`` or ``write``
+ version
+ :class:`TLSVersion` enum member or int for unknown version. For a
+ frame header, it's the header version.
+ content_type
+ :class:`_TLSContentType` enum member or int for unsupported
+ content type.
+ msg_type
+ Either a :class:`_TLSContentType` enum number for a header
+ message, a :class:`_TLSAlertType` enum member for an alert
+ message, a :class:`_TLSMessageType` enum member for other
+ messages, or int for unsupported message types.
+ data
+ Raw, decrypted message content as bytes
+ """
+ inner = super()._msg_callback
+ if inner is not None:
+ return inner.user_function
+ else:
+ return None
+
+ @_msg_callback.setter
+ def _msg_callback(self, callback):
+ if callback is None:
+ super(SSLContext, SSLContext)._msg_callback.__set__(self, None)
+ return
+
+ if not hasattr(callback, '__call__'):
+ raise TypeError(f"{callback} is not callable.")
+
+ def inner(conn, direction, version, content_type, msg_type, data):
+ try:
+ version = TLSVersion(version)
+ except ValueError:
+ pass
+
+ try:
+ content_type = _TLSContentType(content_type)
+ except ValueError:
+ pass
+
+ if content_type == _TLSContentType.HEADER:
+ msg_enum = _TLSContentType
+ elif content_type == _TLSContentType.ALERT:
+ msg_enum = _TLSAlertType
+ else:
+ msg_enum = _TLSMessageType
+ try:
+ msg_type = msg_enum(msg_type)
+ except ValueError:
+ pass
+
+ return callback(conn, direction, version,
+ content_type, msg_type, data)
+
+ inner.user_function = callback
+
+ super(SSLContext, SSLContext)._msg_callback.__set__(self, inner)
+
+ @property
def protocol(self):
return _SSLMethod(super().protocol)
@@ -766,11 +766,11 @@ def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
# CERT_OPTIONAL or CERT_REQUIRED. Let's try to load default system
# root CA certificates for the given purpose. This may fail silently.
context.load_default_certs(purpose)
- # OpenSSL 1.1.1 keylog file
- if hasattr(context, 'keylog_filename'):
- keylogfile = os.environ.get('SSLKEYLOGFILE')
- if keylogfile and not sys.flags.ignore_environment:
- context.keylog_filename = keylogfile
+ # OpenSSL 1.1.1 keylog file
+ if hasattr(context, 'keylog_filename'):
+ keylogfile = os.environ.get('SSLKEYLOGFILE')
+ if keylogfile and not sys.flags.ignore_environment:
+ context.keylog_filename = keylogfile
return context
def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=CERT_NONE,
@@ -812,11 +812,11 @@ def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=CERT_NONE,
# CERT_OPTIONAL or CERT_REQUIRED. Let's try to load default system
# root CA certificates for the given purpose. This may fail silently.
context.load_default_certs(purpose)
- # OpenSSL 1.1.1 keylog file
- if hasattr(context, 'keylog_filename'):
- keylogfile = os.environ.get('SSLKEYLOGFILE')
- if keylogfile and not sys.flags.ignore_environment:
- context.keylog_filename = keylogfile
+ # OpenSSL 1.1.1 keylog file
+ if hasattr(context, 'keylog_filename'):
+ keylogfile = os.environ.get('SSLKEYLOGFILE')
+ if keylogfile and not sys.flags.ignore_environment:
+ context.keylog_filename = keylogfile
return context
# Used by http.client if no context is explicitly passed.
@@ -891,7 +891,7 @@ class SSLObject:
@property
def server_hostname(self):
"""The currently set server hostname (for SNI), or ``None`` if no
- server hostname is set."""
+ server hostname is set."""
return self._sslobj.server_hostname
def read(self, len=1024, buffer=None):
@@ -980,12 +980,12 @@ class SSLObject:
return self._sslobj.verify_client_post_handshake()
-def _sslcopydoc(func):
- """Copy docstring from SSLObject to SSLSocket"""
- func.__doc__ = getattr(SSLObject, func.__name__).__doc__
- return func
-
-
+def _sslcopydoc(func):
+ """Copy docstring from SSLObject to SSLSocket"""
+ func.__doc__ = getattr(SSLObject, func.__name__).__doc__
+ return func
+
+
class SSLSocket(socket):
"""This class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
@@ -1062,7 +1062,7 @@ class SSLSocket(socket):
return self
@property
- @_sslcopydoc
+ @_sslcopydoc
def context(self):
return self._context
@@ -1072,7 +1072,7 @@ class SSLSocket(socket):
self._sslobj.context = ctx
@property
- @_sslcopydoc
+ @_sslcopydoc
def session(self):
if self._sslobj is not None:
return self._sslobj.session
@@ -1084,7 +1084,7 @@ class SSLSocket(socket):
self._sslobj.session = session
@property
- @_sslcopydoc
+ @_sslcopydoc
def session_reused(self):
if self._sslobj is not None:
return self._sslobj.session_reused
@@ -1135,13 +1135,13 @@ class SSLSocket(socket):
raise ValueError("Write on closed or unwrapped SSL socket.")
return self._sslobj.write(data)
- @_sslcopydoc
+ @_sslcopydoc
def getpeercert(self, binary_form=False):
self._checkClosed()
self._check_connected()
return self._sslobj.getpeercert(binary_form)
- @_sslcopydoc
+ @_sslcopydoc
def selected_npn_protocol(self):
self._checkClosed()
if self._sslobj is None or not _ssl.HAS_NPN:
@@ -1149,7 +1149,7 @@ class SSLSocket(socket):
else:
return self._sslobj.selected_npn_protocol()
- @_sslcopydoc
+ @_sslcopydoc
def selected_alpn_protocol(self):
self._checkClosed()
if self._sslobj is None or not _ssl.HAS_ALPN:
@@ -1157,7 +1157,7 @@ class SSLSocket(socket):
else:
return self._sslobj.selected_alpn_protocol()
- @_sslcopydoc
+ @_sslcopydoc
def cipher(self):
self._checkClosed()
if self._sslobj is None:
@@ -1165,7 +1165,7 @@ class SSLSocket(socket):
else:
return self._sslobj.cipher()
- @_sslcopydoc
+ @_sslcopydoc
def shared_ciphers(self):
self._checkClosed()
if self._sslobj is None:
@@ -1173,7 +1173,7 @@ class SSLSocket(socket):
else:
return self._sslobj.shared_ciphers()
- @_sslcopydoc
+ @_sslcopydoc
def compression(self):
self._checkClosed()
if self._sslobj is None:
@@ -1284,7 +1284,7 @@ class SSLSocket(socket):
raise NotImplementedError("recvmsg_into not allowed on instances of "
"%s" % self.__class__)
- @_sslcopydoc
+ @_sslcopydoc
def pending(self):
self._checkClosed()
if self._sslobj is not None:
@@ -1297,7 +1297,7 @@ class SSLSocket(socket):
self._sslobj = None
super().shutdown(how)
- @_sslcopydoc
+ @_sslcopydoc
def unwrap(self):
if self._sslobj:
s = self._sslobj.shutdown()
@@ -1306,7 +1306,7 @@ class SSLSocket(socket):
else:
raise ValueError("No SSL wrapper around " + str(self))
- @_sslcopydoc
+ @_sslcopydoc
def verify_client_post_handshake(self):
if self._sslobj:
return self._sslobj.verify_client_post_handshake()
@@ -1317,7 +1317,7 @@ class SSLSocket(socket):
self._sslobj = None
super()._real_close()
- @_sslcopydoc
+ @_sslcopydoc
def do_handshake(self, block=False):
self._check_connected()
timeout = self.gettimeout()
@@ -1376,7 +1376,7 @@ class SSLSocket(socket):
server_side=True)
return newsock, addr
- @_sslcopydoc
+ @_sslcopydoc
def get_channel_binding(self, cb_type="tls-unique"):
if self._sslobj is not None:
return self._sslobj.get_channel_binding(cb_type)
@@ -1387,7 +1387,7 @@ class SSLSocket(socket):
)
return None
- @_sslcopydoc
+ @_sslcopydoc
def version(self):
if self._sslobj is not None:
return self._sslobj.version()