Файловый менеджер - Редактировать - /home/skymarketplace/public_html/uploads/truststore.zip
Назад
PK |�Z�Rt� � __init__.pynu �[��� """Verify certificates using native system trust stores""" import sys as _sys if _sys.version_info < (3, 10): raise ImportError("truststore requires Python 3.10 or later") # Detect Python runtimes which don't implement SSLObject.get_unverified_chain() API # This API only became public in Python 3.13 but was available in CPython and PyPy since 3.10. if _sys.version_info < (3, 13): try: import ssl as _ssl except ImportError: raise ImportError("truststore requires the 'ssl' module") else: _sslmem = _ssl.MemoryBIO() _sslobj = _ssl.create_default_context().wrap_bio( _sslmem, _sslmem, ) try: while not hasattr(_sslobj, "get_unverified_chain"): _sslobj = _sslobj._sslobj # type: ignore[attr-defined] except AttributeError: raise ImportError( "truststore requires peer certificate chain APIs to be available" ) from None del _ssl, _sslobj, _sslmem # noqa: F821 from ._api import SSLContext, extract_from_ssl, inject_into_ssl # noqa: E402 del _api, _sys # type: ignore[name-defined] # noqa: F821 __all__ = ["SSLContext", "inject_into_ssl", "extract_from_ssl"] __version__ = "0.10.0" PK |�Z��.�� � $ __pycache__/__init__.cpython-311.pycnu �[��� � ]�bg� � � � d Z ddlZej dk r ed� � �ej dk r� ddlZ ej � � Z ej � � � ee� � Z e e d� � se j Z e e d� � �n# e $ r ed� � d�w xY w[[ [n# e$ r ed� � �w xY wd d lmZmZmZ [[g d �Zd ZdS ) z4Verify certificates using native system trust stores� N)� � z(truststore requires Python 3.10 or later)r � �get_unverified_chainz?truststore requires peer certificate chain APIs to be availablez$truststore requires the 'ssl' module� )� SSLContext�extract_from_ssl�inject_into_ssl)r r r z0.10.0)�__doc__�sys�_sys� version_info� ImportError�ssl�_ssl� MemoryBIO�_sslmem�create_default_context�wrap_bio�_sslobj�hasattr�AttributeError�_apir r r �__all__� __version__� � �p/builddir/build/BUILD/cloudlinux-venv-1.0.7/venv/lib/python3.11/site-packages/pip/_vendor/truststore/__init__.py�<module>r ss �� :� :� � � � ���w� � � �+�@� A� A�A� ��w� � �#����� !�$�.�"�"��-�$�-�/�/�8�8� � � � �� � �g�g�'=�>�>� *�!�/�� �g�g�'=�>�>� *��� � � � � �+�Q�� �� � ���� �'�7�7��! � B� B� B��k�@�A�A�A�B����$ @� ?� ?� ?� ?� ?� ?� ?� ?� ?��$� ?� ?� ?��� � � s �B � B � B�B*PK |�Z��Z�,F ,F __pycache__/_api.cpython-311.pycnu �[��� � ]�bg;) � �P � U d dl Z d dlZd dlZd dlZd dlZd dlZd dlZddlmZm Z m Z m Z ej � � dk r ddl mZmZ n$ ej � � dk r ddlmZmZ nddlmZmZ ej rd dlmZ eez e j e z e j e z Zej ed< eez ej g eez f z Z ej ed < dd �Z dd �Z G d � de � � Z ej dk rdej! d e"e fd�Z#ndej! d e"e fd�Z#dej$ ej! z dedz d dfd�Z%dS )� N� )�_original_SSLContext�_original_super_SSLContext�#_truststore_SSLContext_dunder_class�"_truststore_SSLContext_super_class�Windows)�_configure_context�_verify_peercerts_impl�Darwin)�Buffer�_StrOrBytesPath� _PasswordType�returnc � � t t dt � � ddlmc mc mc m} t | dt � � dS # t $ r Y dS w xY w)zqInjects the :class:`truststore.SSLContext` into the ``ssl`` module by replacing :class:`ssl.SSLContext`. � SSLContextr N) �setattr�sslr � pip._vendor.urllib3.util.ssl_�_vendor�urllib3�util�ssl_� ImportError�� urllib3_ssls �l/builddir/build/BUILD/cloudlinux-venv-1.0.7/venv/lib/python3.11/site-packages/pip/_vendor/truststore/_api.py�inject_into_sslr s� � � �C� �z�*�*�*� �;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�� �\�:�6�6�6�6�6�� � � � � ��� ���s �%A � A�Ac � � t t dt � � ddlmc mc mc m} t | _ dS # t $ r Y dS w xY w)z@Restores the :class:`ssl.SSLContext` class to its original stater r N) r r r r r r r r r r r s r �extract_from_sslr / sw � � �C� � 3�4�4�4� �;�;�;�;�;�;�;�;�;�;�;�;�;�;�;�!5� � � � �� � � � � ��� ���s �: � A�Ac � � e Zd ZdZedefd�� � ZdCdeddfd�Z dDd e j d e d e d e d e dz de j dz de j fd�Z dEde j de j d e d e dz de j dz de j f d�Z dFde ez ej e z ej e z dz de ez ej e z ej e z dz dej e ddf ddfd�Z dGdededz dedz ddfd�Ze j j fd e j ddfd �Z d ej e ddfd �Z d ej e ddfd!�Z!d"e ddfd#�Z"dej# fd$�Z$de%e ef fd%�Z&de%e ef fd&�Z'dHd'�Z(ej) dId)ej* d de+ej# fd*�� � Z,ej) dId)ej* d de+e fd+�� � Z,ej) dId)e dej# fd,�� � Z,dJd)e de+ej# e+e z fd-�Z,ede fd.�� � Z-e-j. d/e ddfd0�� � Z-ede fd1�� � Z/e/j. d/e ddfd2�� � Z/ede fd3�� � Z0e0j. d/e ddfd4�� � Z0ede j1 fd5�� � Z2e2j. d/e j1 ddfd6�� � Z2ede j1 fd7�� � Z3e3j. d/e j1 ddfd8�� � Z3ede j4 fd9�� � Z5e5j. d/e j4 ddfd:�� � Z5ede fd;�� � Z6e6j. d/e ddfd<�� � Z6ede j7 fd=�� � Z8edefd>�� � Z9ede j: fd?�� � Z;e;j. d/e j: ddfd@�� � Z;ede j< fdA�� � Z=e=j. d/e j< ddfdB�� � Z=dS )Kr z=SSLContext API that uses system certificates on all platformsr c � � t pt S �N)r r ��selfs r � __class__zSSLContext.__class__= s � � 3�@�j�@� N�protocolc �v � t |� � | _ G d� dt j � � }|| j _ d S )Nc � � � e Zd Zd� fd� Z� xZS )�0SSLContext.__init__.<locals>.TruststoreSSLObjectr Nc �t �� t � � � � � }t | | j �� � |S )N��server_hostname)�super� do_handshake�_verify_peercertsr- )r$ �retr% s �r r/ z=SSLContext.__init__.<locals>.TruststoreSSLObject.do_handshakeL s3 �� ��g�g�*�*�,�,��!�$��8L�M�M�M�M�� r& �r N)�__name__� __module__� __qualname__r/ � __classcell__)r% s @r �TruststoreSSLObjectr* G s= �� � � � � � � � � � � � � � � r& r7 )r �_ctxr � SSLObject�sslobject_class)r$ r' r7 s r �__init__zSSLContext.__init__D sO � �(��2�2�� � � � � � �#�-� � � � %8�� �!�!�!r& FT�sock� server_side�do_handshake_on_connect�suppress_ragged_eofsr- �sessionc � � t | j � � 5 | j � ||||||�� � }d d d � � n # 1 swxY w Y t ||�� � n## t $ r |� � � � w xY w|S )N)r= r- r> r? r@ r, )r r8 � wrap_socketr0 � Exception�close)r$ r< r= r> r? r- r@ �ssl_socks r rB zSSLContext.wrap_socketS s� � � �� � *� *� � ��y�,�,�� '� /�(?�%9� � -� � �H� � � � � � � � � � � ���� � � � � � �h�� H� H� H� H� H��� � � � �N�N� � � � � ���� �s �!A�A� A�A � B �incoming�outgoingc � � t | j � � 5 | j � |||||�� � }d d d � � n # 1 swxY w Y |S )N)r- r= r@ )r r8 �wrap_bio)r$ rF rG r= r- r@ �ssl_objs r rI zSSLContext.wrap_bioo s� � � �� � *� *� � ��i�(�(��� /� '� � )� � �G� � � � � � � � � � � ���� � � � � �s � A�A�A�cafile�capath�cadatar c �< � | j � |||�� � S )N)rK rL rM )r8 �load_verify_locations)r$ rK rL rM s r rO z SSLContext.load_verify_locations� s* � � �y�.�.��&�� /� � � r& �certfile�keyfile�passwordc �< � | j � |||�� � S )N)rP rQ rR )r8 �load_cert_chain)r$ rP rQ rR s r rT zSSLContext.load_cert_chain� s* � � �y�(�(� �w�� )� � � r& �purposec �6 � | j � |� � S r" )r8 �load_default_certs)r$ rU s r rW z SSLContext.load_default_certs� s � � �y�+�+�G�4�4�4r& �alpn_protocolsc �6 � | j � |� � S r" )r8 �set_alpn_protocols)r$ rX s r rZ z SSLContext.set_alpn_protocols� s � ��y�+�+�N�;�;�;r& � npn_protocolsc �6 � | j � |� � S r" )r8 �set_npn_protocols)r$ r[ s r r] z SSLContext.set_npn_protocols� s � ��y�*�*�=�9�9�9r& �_SSLContext__cipherlistc �6 � | j � |� � S r" )r8 � set_ciphers)r$ r^ s r r` zSSLContext.set_ciphers� s � ��y�$�$�\�2�2�2r& c �4 � | j � � � S r" )r8 � get_ciphersr# s r rb zSSLContext.get_ciphers� s � ��y�$�$�&�&�&r& c �4 � | j � � � S r" )r8 � session_statsr# s r rd zSSLContext.session_stats� s � ��y�&�&�(�(�(r& c � � t � � �r" ��NotImplementedErrorr# s r �cert_store_statszSSLContext.cert_store_stats� � � �!�#�#�#r& c �8 � | j � � � d S r" )r8 �set_default_verify_pathsr# s r rk z#SSLContext.set_default_verify_paths� s � � � �*�*�,�,�,�,�,r& .� binary_formc � � d S r" � �r$ rl s r � get_ca_certszSSLContext.get_ca_certs� s � � �3r& c � � d S r" rn ro s r rp zSSLContext.get_ca_certs� s � �TW�TWr& c � � d S r" rn ro s r rp zSSLContext.get_ca_certs� s � �CF�3r& c � � t � � �r" rf ro s r rp zSSLContext.get_ca_certs� ri r& c � � | j j S r" �r8 �check_hostnamer# s r rv zSSLContext.check_hostname� � � ��y�'�'r& �valuec � � || j _ d S r" ru �r$ rx s r rv zSSLContext.check_hostname� s � �#(�� � � � r& c � � | j j S r" �r8 �hostname_checks_common_namer# s r r} z&SSLContext.hostname_checks_common_name� s � ��y�4�4r& c � � || j _ d S r" r| rz s r r} z&SSLContext.hostname_checks_common_name� s � �05�� �-�-�-r& c � � | j j S r" �r8 �keylog_filenamer# s r r� zSSLContext.keylog_filename� � � ��y�(�(r& c � � || j _ d S r" r� rz s r r� zSSLContext.keylog_filename� s � �$)�� �!�!�!r& c � � | j j S r" )r8 �maximum_versionr# s r r� zSSLContext.maximum_version� r� r& c �P � t j � | j |� � d S r" )r r� �__set__r8 rz s r r� zSSLContext.maximum_version� �. � �"�2�:�:� �I�u� � � � � r& c � � | j j S r" )r8 �minimum_versionr# s r r� zSSLContext.minimum_version� r� r& c �P � t j � | j |� � d S r" )r r� r� r8 rz s r r� zSSLContext.minimum_version� r� r& c � � | j j S r" )r8 �optionsr# s r r� zSSLContext.options� s � ��y� � r& c �P � t j � | j |� � d S r" )r r� r� r8 rz s r r� zSSLContext.options� s. � �"�*�2�2� �I�u� � � � � r& c � � | j j S r" �r8 �post_handshake_authr# s r r� z SSLContext.post_handshake_auth� s � ��y�,�,r& c � � || j _ d S r" r� rz s r r� z SSLContext.post_handshake_auth� s � �(-�� �%�%�%r& c � � | j j S r" )r8 r' r# s r r' zSSLContext.protocol� s � ��y�!�!r& c � � | j j S r" )r8 �security_levelr# s r r� zSSLContext.security_level� rw r& c � � | j j S r" )r8 � verify_flagsr# s r r� zSSLContext.verify_flags s � ��y�%�%r& c �P � t j � | j |� � d S r" )r r� r� r8 rz s r r� zSSLContext.verify_flags s. � �"�/�7�7� �I�u� � � � � r& c � � | j j S r" )r8 � verify_moder# s r r� zSSLContext.verify_mode s � ��y�$�$r& c �P � t j � | j |� � d S r" )r r� r� r8 rz s r r� zSSLContext.verify_mode s. � �"�.�6�6� �I�u� � � � � r& r" )FTTNN)FNN)NNN)NNr2 ).)F)>r3 r4 r5 �__doc__�property�typer% �intr; �socket�bool�strr � SSLSession� SSLSocketrB � MemoryBIOr9 rI �bytes�os�PathLike�typing�UnionrO r r rT �Purpose� SERVER_AUTHrW �IterablerZ r] r` �Anyrb �dictrd rh rk �overload�Literal�listrp rv �setterr} r� � TLSVersionr� r� �Optionsr� r� � _SSLMethodr' r� � VerifyFlagsr� � VerifyModer� rn r& r r r : s� � � � � � �G�G� �A�4� A� A� A� �X�A� 8� 8�� 8�� 8� 8� 8� 8�$ "�(,�%)�&*�)-�� ��m�� �� "&� � #� � �t�� � � �$�&�� � �� � � �@ "�&*�)-� � ��-�� �-�� � � �t�� � � �$�&� � � �� � � �( NR�MQ�48� � ��e� �b�k�#� .�.���U�1C�C�d�J� � �e� �b�k�#� .�.���U�1C�C�d�J� � � �S�(�D� 0�1� � � � � � � +/�)-� � �!� � !�4�'� � �$�&� � � � � � � &)�[�%<�5� 5��{�5� �5� 5� 5� 5� <�� ��1E� <�$� <� <� <� <�:�v��s�/C� :�� :� :� :� :�3�� 3�� 3� 3� 3� 3�'�V�Z� '� '� '� '�)�t�C��H�~� )� )� )� )�$�$�s�C�x�.� $� $� $� $�-� -� -� -� �_�36� � �!�>�%�0� � �f�j� � � � � �_� � �_�W�W���t�(<�W�t�E�{�W�W�W� �_�W� �_�F�F��F�v�z�F�F�F� �_�F�$� $�� $��f�j�9I�D�QV�K�9W� $� $� $� $� �(�� (� (� (� �X�(� ��)�D� )�T� )� )� )� ��)� �5�T� 5� 5� 5� �X�5� !�'�6�� 6�$� 6� 6� 6� (�'�6� �)�� )� )� )� �X�)� ��*�S� *�T� *� *� *� ��*� �)�� � )� )� )� �X�)� �� �S�^� �� � � � �� � �)�� � )� )� )� �X�)� �� �S�^� �� � � � �� � �!��� !� !� !� �X�!� �^� �S�[� �T� � � � �^� � �-�T� -� -� -� �X�-� � �.�� .�$� .� .� .� � �.� �"�#�.� "� "� "� �X�"� �(�� (� (� (� �X�(� �&�c�o� &� &� &� �X�&� �� �#�/� �d� � � � �� � �%�S�^� %� %� %� �X�%� �� �� � �D� � � � �� � � r& r )� � �sslobjc �F � | � � � pd}d� |D � � S )Nrn c �z � g | ]8}t |t � � r|n |� t j � � ��9S rn )� isinstancer� � public_bytes�_ssl� ENCODING_DER��.0�certs r � <listcomp>z/_get_unverified_chain_bytes.<locals>.<listcomp> sL � � � � �� �t�U�+�+� U�D�D��1B�1B�4�CT�1U�1U� � � r& ��get_unverified_chain�r� �unverified_chains r �_get_unverified_chain_bytesr� s: � �!�6�6�8�8�>�B�� � �(� � � � r& c �F � | � � � pd}d� |D � � S )Nrn c �L � g | ]!}|� t j � � ��"S rn )r� r� r� r� s r r� z/_get_unverified_chain_bytes.<locals>.<listcomp>( s) � �R�R�R���!�!�$�"3�4�4�R�R�Rr& r� r� s r r� r� & s. � �!�6�6�8�8�>�B��R�R�AQ�R�R�R�Rr& �sock_or_sslobjr- c �� � | } t |d� � s|j }t |d� � �n# t $ r Y nw xY wt |� � }t | j ||�� � dS )z{ Verifies the peer certificates from an SSLSocket or SSLObject against the certificates in the OS trust store. r� r, N)�hasattr�_sslobj�AttributeErrorr� r �context)r� r- r� � cert_bytess r r0 r0 + s� � � +�F� ��&�"8�9�9� $��^�F� �&�"8�9�9� $��� � � � � �� ���� -�V�4�4�J��� � �O�� � � � � s �', � 9�9r2 )&r� �platformr� r �sysr� r� �_ssl_constantsr r r r �system�_windowsr r �_macos�_openssl� TYPE_CHECKING� pip._vendor.typing_extensionsr r� r� r� r � TypeAlias�__annotations__�Callabler r r r � version_infor9 r� r� r� r0 rn r& r �<module>r� s� �� � � � � � ���� � � � � � � � � � � � � � � � � � � � �� � � � � � � � � � � � �8�?��� �!�!�D�D�D�D�D�D�D�D�D��X�_���(�"�"�B�B�B�B�B�B�B�B�B�D�D�D�D�D�D�D�D� �� 5�4�4�4�4�4�4� %(�%�K�"�+�c�2B�$B�R�[�QV�EW�$W���!� W� W� W�"%��+����C�%�K��0P�"P� �v� � P� P� P� � � � � � � � �[ � [ � [ � [ � [ �3� [ � [ � [ �B ��w� � � �C�M� �d�5�k� � � � � �S�C�M� S�d�5�k� S� S� S� S� ��M�C�M�1��DG�$�J�� �� � � � � r& PK |�Z!���M �M " __pycache__/_macos.cpython-311.pycnu �[��� � ]�bgP � �\ � d dl Z d dlZd dlZd dlZd dlZd dlmZmZmZmZm Z m Z m Z m Z m Z d dlmZ ddlmZ ej � � d Z e eee� d� � � � � � Zedk r eded � ded � �� � �ed k Zd ed ed efd �Z e dd� � Z e dd� � Z eZ e Z e Z!e Z"e Z#e Z$e Z%e Z&e Z'e Z( ee'� � Z)e Z*e Z+ ee&� � Z, ee"� � Z- ee#� � Z. ee$� � Z/ ee%� � Z0e Z1e Z2 ee � � Z3 ee � � Z4 ee � � Z5e Z6e Z7 e*e-ge j8 _9 e3e j8 _: e3ge j; _9 e-e j; _: e+e ge j< _9 e.e j< _: e5e/ge j= _9 e+e j= _: e5e ge j> _9 e+e j> _: e2ge j? _9 e4e j? _: e e.ge j@ _9 e4e j@ _: e)e) ee5� � ge jA _9 e+e jA _: e5 ee6� � ge jB _9 e+e jB _: e5 ee6� � ge jC _9 e+e jC _: e5e _5 e6e _6 e+e _+ dZDdZEe)ge jF _9 de jF _: e)ge jG _9 e(e jG _: e*ee!ge jH _9 e.e jH _: e.e!ge jI _9 ee jI _: e.ee e!ge jJ _9 ee jJ _: e*ee ge jK _9 e-e jK _: e-ge jL _9 e e jL _: e-ge jM _9 e e jM _: e* ee)� � e e1ge jN _9 e/e jN _: e*e e1ge jO _9 e0e jO _: e0e ge jP _9 de jP _: e/ge jQ _9 e e jQ _: e/e ge jR _9 e e jR _: e,ge jS _9 e e jS _: e,ge jT _9 e.e jT _: e*�U e d� � e _V e jU e d� � e _W e)e _) e/e _/ e.e _. e,e _, n # eX$ rZY edeY� �� � d�dZY[Yww xY werA e5 ee,� � ge jZ _9 ee jZ _: n # eX$ rZY edeY� �� � d�dZY[Yww xY wde+dej[ dej[ d ej[ fd�Z\e\e jA _] e\e j= _] e\e j> _] e\e jB _] e\e jC _] G d� d � � Z^d e_d e-fd �Z`d e_d e#fd �Zad e.d edz fd!�Zbd"ece_ d e0fd#�Zde je d$ejf d ejg d fd%�� � Zh d-d&ejf d'ece_ d(edz d dfd)�Zid&ejf d*ej[ d dfd+�Zjd&ejf d*ej[ d dfd,�ZkdS ).� N) �CDLL�POINTER�c_bool�c_char_p�c_int32�c_long�c_uint32�c_ulong�c_void_p)� find_library� )� _set_ssl_context_verify_mode�.)� � z,Only OS X 10.8 and newer are supported, not )r � �name�macos10_16_path�returnc � � t dk r|}nt | � � }|st �t |d�� � S # t $ r t d| � d�� � d�w xY w)z:Loads a CDLL by name, falling back to known path on 10.16+)r � T)� use_errnoz The library z failed to loadN)�_mac_version_infor �OSErrorr � ImportError)r r �paths �n/builddir/build/BUILD/cloudlinux-venv-1.0.7/venv/lib/python3.11/site-packages/pip/_vendor/truststore/_macos.py� _load_cdllr s� � � J� �� (� (�"�D�D� ��%�%�D�� ��M��D�D�)�)�)�)�� � J� J� J��>��>�>�>�?�?�T�I�J���s �69 � A�Securityz6/System/Library/Frameworks/Security.framework/Security�CoreFoundationzB/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation� r �kCFAllocatorDefault�kCFTypeArrayCallBackszError initializing ctypes: �result�_�argsc �~ � t | � � dk r|S d} t � | d� � }t j |t j t j � � � � }t � |t j � � }|�St j d� � }t � ||dt j � � } | st d� � �|j }|�t � |� � n"# |�t � |� � w w xY w|�|dk rd| � �}t! j |� � �)z< Raises an error if the OSStatus value is non-zero. r N� �'Error copying C string from CFStringRef� z8SecureTransport operation returned a non-zero OSStatus: )�intr �SecCopyErrorMessageString�ctypes�castr r r �CFStringGetCStringPtr�CFConst�kCFStringEncodingUTF8�create_string_buffer�CFStringGetCStringr �value� CFRelease�ssl�SSLError)r$ r% r& �error_message_cfstring� error_message_cfstring_c_void_p�message�buffers r �_handle_osstatusr< � sP � � �6�{�{�a���� � "��!=�!)�!C�!C�F�D�!Q�!Q� � +1�+� "�F�N�6�?�$C�$C�+ � + �'� !�6�6� +�W�-J� � �� �?��0��6�6�F�#�6�6�/����-� � �F� � I� � G�H�H�H� �l�G� "� -� � $� $�%;� <� <� <��� "� -� � $� $�%;� <� <� <� <� .���� ��'�R�-�-�U�V�U�U�� �,�w� � � s �CC< �< Dc �8 � e Zd ZdZ ed� � ZdZdZdZdZ dS )r0 zCoreFoundation constantsi i���i��i���i����N) �__name__� __module__� __qualname__�__doc__�CFStringEncodingr1 �#errSecIncompleteCertRevocationCheck�errSecHostNameMismatch�errSecCertificateExpired�errSecNotTrusted� � r r0 r0 s? � � � � � �"�"� ,� ,�Z� 8� 8��*0�'� #�� %� � ���rH r0 r4 c �h � t � t j | t | � � � � S �N)r � CFDataCreater" �len)r4 s r �_bytes_to_cf_data_refrM & s* � � � &� &��*�E�3�u�:�:� � � rH c � � t j | � � }t � t j |t j � � }|S )zi Given a Python binary data, create a CFString. The string must be CFReleased by the caller. )r- r r �CFStringCreateWithCStringr" r0 r1 )r4 �c_str�cf_strs r �_bytes_to_cf_stringrR , s> � � �O�E� "� "�E� � 5� 5��*� ��%�� �F� �MrH � cf_string_refc �( � t � | t j � � }|�St j d� � }t � | |dt j � � }|st d� � �|j }|�|� d� � }|S )z� Creates a Unicode string from a CFString object. Used entirely for error reporting. Yes, it annoys me quite a lot that this function is this complex. Nr( r) zutf-8) r r/ r0 r1 r- r2 r3 r r4 �decode)rS �stringr; r$ s r �_cf_string_ref_to_strrW : s� � � � 1� 1��w�4�� �F� �~��,�T�2�2�� �2�2� �6�4��)F� � �� � E��C�D�D� D�� �� ��� � �w�'�'�� �MrH �certsc �J � t � t j dt j t j � � � � }|st d� � �| D ]�}d}d} t |� � }t � t j |� � }t � ||� � |rt � |� � |rt � |� � ��# |rt � |� � |rt � |� � w w xY w|S )z�Builds a CFArray of SecCertificateRefs from a list of DER-encoded certificates. Responsibility of the caller to call CoreFoundation.CFRelease on the CFArray. r zUnable to allocate memory!N) r �CFArrayCreateMutabler" r- �byrefr# � MemoryErrorrM r � SecCertificateCreateWithData�CFArrayAppendValuer5 )rX �cf_array� cert_data�cf_data� sec_cert_refs r �_der_certs_to_cf_cert_arrayrc Q s1 � � �2�2��*� �� �^�9�:�:�� �H� � 8��6�7�7�7�� 7� 7� ���� � 7�+�I�6�6�G�#�@�@� �2�G� � �L� � -� -�h� � E� E� E�� 2� �(�(��1�1�1�� 7� �(�(� �6�6�6��� � 2� �(�(��1�1�1�� 7� �(�(� �6�6�6�6� 7���� �Os � AC%�%;D �ctxc # �� K � | j }| j }d| _ t | t j � � d V � || _ t | |� � d S # || _ t | |� � w xY w)NF)�check_hostname� verify_moder r6 � CERT_NONE)rd rf rg s r �_configure_contextri o s| � � � ��'�N��/�K� �C�� ��c�m�4�4�4�7� ���� +���$�S�+�6�6�6�6�6�� ,���$�S�+�6�6�6�6���s �A �A)� ssl_context� cert_chain�server_hostnamec �" � d }d }d } |��| j rd } t |� d� � � � }t � d|� � }|rt � |� � n=# |rt � |� � w w xY wt � dd � � }|}| j t j z r�t � t j dt j t j � � � � }t � ||� � t � |� � t � t" t$ z � � }t � ||� � t � |� � n#| j t j z rt) d� � �d } t+ |� � }t � � � }t � ||t j |� � � � |rt � |� � n"# |rt � |� � w w xY w| � d�� � } | rld } t+ | � � } t � || � � | rt � | � � n"# | rt � | � � w w xY wt � |d� � t6 rt9 | |� � nt; | |� � |rt � |� � |r t � |� � d S d S # |rt � |� � |rt � |� � w w xY w)N�asciiTr z/VERIFY_CRL_CHECK_LEAF not implemented for macOS)� binary_formF) rf rR �encoder �SecPolicyCreateSSLr r5 � verify_flagsr6 �VERIFY_CRL_CHECK_CHAINrZ r" r- r[ r# r^ �SecPolicyCreateRevocation�#kSecRevocationUseAnyAvailableMethod�%kSecRevocationRequirePositiveResponse�VERIFY_CRL_CHECK_LEAF�NotImplementedErrorrc � SecTrustRef� SecTrustCreateWithCertificates� get_ca_certs� SecTrustSetAnchorCertificates�!SecTrustSetAnchorCertificatesOnly� _is_macos_version_10_14_or_later�"_verify_peercerts_impl_macos_10_14�"_verify_peercerts_impl_macos_10_13) rj rk rl rX �policies�trust�cf_str_hostname� ssl_policy�revocation_policy�ctx_ca_certs_der� ctx_ca_certss r �_verify_peercerts_implr� | s� � � �E��H� �E�N,� � &�;�+E� &� "�O� >�"5�o�6L�6L�W�6U�6U�"V�"V�� %� 8� 8��� O� O� �"� >�"�,�,�_�=�=�=��� #� >�"�,�,�_�=�=�=�=�>���� "�4�4�T�4�@�@�J� �� � #�c�&@� @� Y�%�:�:� �2��� �^� A�B�B�� �H� � -� -�h� � C� C� C� � $� $�Z� 0� 0� 0� (� B� B�3�7�8�!� !� � � -� -�h�8I� J� J� J� � $� $�%6� 7� 7� 7� 7� � %��(A� A� Y�%�&W�X�X� X��� 0�/� �;�;�E� �(�(�*�*�E� � 3� 3��x�� �e�!4�!4� � � � � 0� �(�(��/�/�/��� � 0� �(�(��/�/�/�/� 0���� 0;�/G�/G� � 0H� 0 � 0 �� � ;� �L� ;� :�;K� L� L� ��6�6�u�l�K�K�K� � ;�"�,�,�\�:�:�:��� � ;�"�,�,�\�:�:�:�:�;���� �2�2�5�%�@�@�@� ,� C� .�{�E� B� B� B� B� .�{�E� B� B� B� � /� � $� $�X� .� .� .� � ,� � $� $�U� +� +� +� +� +� ,� ,�� � /� � $� $�X� .� .� .� � ,� � $� $�U� +� +� +� +� ,���sU � M �=A. � M �. B � D-M �;AH. � M �. I � M �+*J2 � M �2 K�AM �;N� sec_trust_refc � � t � � � }t � |t j |� � � � t |j � � }n# t t f$ r d}Y nw xY w| j t j k rJ|dvrHddddddd �}|� |d |� �� � }t j |� � }||_ ||_ |�d S d S ) z�Verify using 'SecTrustEvaluate' API for macOS 10.13 and earlier. macOS 10.14 added the 'SecTrustEvaluateWithError' API. ���)r � zInvalid trust result typezUser confirmation requiredz.User specified that certificate is not trustedz"Recoverable trust failure occurredz Fatal trust failure occurredz0Other error occurred, certificate may be revoked)r � r! � � � zUnknown trust result: N)r �SecTrustResultType�SecTrustEvaluater- r[ r+ r4 � ValueError� TypeErrorrg r6 � CERT_REQUIRED�get�SSLCertVerificationError�verify_message� verify_code)rj r� �sec_trust_result_type� sec_trust_result_type_as_int� sec_trust_result_type_to_message� error_message�errs r r� r� � s � � %� 7� 7� 9� 9�� � � �m�V�\�:O�-P�-P�Q�Q�Q�*�'*�+@�+F�'G�'G�$�$�� � � "� *� *� *�')�$�$�$�*���� � �3�#4�4�4� (�� 6� 6� +�+�?�3�-�A� , � , �(� 9�<�<� (� C�%A� C� C� � � � �*�=�9�9�� *���6���� �1 5�4� 6� 6s �A � A3�2A3c � � t � � � }t � |t j |� � � � }|dk rd}n |dk rd}nt j d|��� � �d}|sQt � |� � }| j t j k r"|t j k s|t j k rd}|s�d} t � |� � }t |� � pd}t � � � }t � |t j |� � � � t j |� � } || _ || _ | �# |rt � |� � w w xY wdS )z>Verify using 'SecTrustEvaluateWithError' API for macOS 10.14+.r Tr Fz8Unknown result from Security.SecTrustEvaluateWithError: Nz Certificate verification failed)r � CFErrorRefr �SecTrustEvaluateWithErrorr- r[ r6 r7 �CFErrorGetCoderg r� r0 rF rE �CFErrorCopyDescriptionrW r� �SecTrustGetTrustResultr� r� r� r5 ) rj r� �cf_error�sec_trust_eval_result� is_trusted� cf_error_code�cf_error_string_ref�cf_error_messager� r� s r r r s� � � �(�(�*�*�H� $� >� >��v�|�H�-�-� � �� ��!�!�� � � �!� #� #�� � ��l� `�G\� `� `� � � � �M� � �&�5�5�h�?�?� � � "�c�&7� 7� 7� �W� 5� 5� 5� �� @�@�@� �J� � >� "�� >�"0�"G�"G��"Q�"Q� � &�&9�:�:� 5�4� � %-�$?�$?�$A�$A� !� � +� +� �v�|�,A� B� B� � � � �.�/?�@�@�C�!1�C� � +�C�O��I��"� >� �(�(�)<�=�=�=�=� >����/>� >s � BE � E>rJ )l� contextlibr- �platformr6 �typingr r r r r r r r r � ctypes.utilr �_ssl_constantsr �mac_ver� _mac_version�tuple�mapr+ �splitr r r~ �strr r r �Boolean�CFIndexrB �CFData�CFString�CFArray�CFMutableArray�CFError�CFType�CFTypeID� CFTypeRef�CFAllocatorRef�OSStatusr� � CFDataRef� CFStringRef� CFArrayRef�CFMutableArrayRef�CFArrayCallBacks� CFOptionFlags�SecCertificateRef� SecPolicyRefry r� �SecTrustOptionFlagsr] �argtypes�restype�SecCertificateCopyDatar, r| r} rt rq rz r� r� ru rv r5 � CFGetTypeIDrO r/ r3 rK �CFDataGetLength�CFDataGetBytePtr� CFArrayCreaterZ r^ �CFArrayGetCount�CFArrayGetValueAtIndexr� r� �in_dllr" r# �AttributeError�er� �Anyr< �errcheckr0 �bytesrM rR rW �listrc �contextmanager� SSLContext�Iteratorri r� r� r rG rH r �<module>r� s� �� � � � � � � � � ���� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � %� $� $� $� $� $� 8� 8� 8� 8� 8� 8� �x� �!�!�!�$� ��E�#�#�c�<�#5�#5�c�#:�#:�;�;�<�<� ��w� � � �+�d�7H��7K�d�d�N_�`a�Nb�d�d� � � � $5��#@� �J�S� J�3� J�4� J� J� J� J�" �:��H� � �� ���H�� �� �� ��� � �� �� ���� �� �� �� �G�F�O�O� ��� �� �W�W� � � � �G�F�O�O� ��g�h� � � � �W�W� � � ��G�N�+�+� �� �� ��G�H�%�%� ��w�x� � � ��g�h� � � � � � � �|C�6D�i�5P�H�)�2�4E�H�)�1�0A�/B�H�#�,�.7�H�#�+�3;�X�2F�H�&�/�1<�H�&�.�7B�J�6O�H�*�3�5=�H�*�2�;F��:P�H�.�7�9A�H�.�6�3@�/�H�&�/�1=�H�&�.�,3�[�+A�H� �(�*6�H� �'� ���� � � �8�H�+�4� 7?�H�+�3� ���"�#�#�0�H�#�,� /7�H�#�+� ���"�#�#�*�H� �&� )1�H� �%�&�H��"4�H� � �H��*+�'�,-�)�)2� �N� �%�'+�N� �$�+4�+�N� �'�)1�N� �&� ���9�N�,�5� 8C�N�,�4�5@�BR�4S�N�(�1�3;�N�(�0� ���� 2�N�%�.� 17�N�%�-�,:�H�g�+N�N� �(�*3�N� �'�/8�k�N�"�+�-4�N�"�*�09�{�N�#�,�.6�N�#�+� ��� ����� -�N� �)� ,6�N� �(� ���4�N�'�0� 3D�N�'�/�2C�X�1N�N�%�.�04�N�%�-�/9�l�N�"�+�-4�N�"�*�6@�'�5J�N�)�2�4<�N�)�1�.8�\�N�!�*�,3�N�!�)�6@�\�N�)�2�4?�N�)�1�)7�)>�)>��-�*� *�N�&� ,;�8�?��/�,� ,�N�(� )�N� � *�N� �!,�N� � *�N� � ��� C� C� C� �+�7�A�7�7� 8� 8�d�B�����C���� $� G�G� � �G�J� � �7 ��*�3� 6<��*�2�2�� � G� G� G��k�;��;�;�<�<�$�F�����G����2 �X� 2 �&�*� 2 �F�J� 2 �6�:� 2 � 2 � 2 � 2 �j 4D�� '� 0�2B�� &� /�6F�� *� 3�+;�� � (�%5�� � "� � � � � � � � ��� �9� � � � � �u� �� � � � � �� ��t�� � � � �.�t�E�{� �7H� � � � �< �� 7�C�N� 7�v��t�/D� 7� 7� 7� �� 7� #'�V,� V,�� �V,��U� �V,� �4�Z�V,� � V,� V,� V,� V,�r)�� �)�06� �)� �)� )� )� )�X:>�� �:>�06� �:>� �:>� :>� :>� :>� :>� :>s1 �LQ �Q0� Q+�+Q0�6#R �R3� R.�.R3PK |�Z~�n;> > $ __pycache__/_openssl.cpython-311.pycnu �[��� � ]�bg � �� � d dl Z d dlZd dlZd dlZd dlZg d�Z ej d� � Ze j dej dej d fd�� � Z de de fd�Z d d ej d ee d e dz ddfd �ZdS )� N)z/etc/ssl/cert.pemz/etc/pki/tls/cert.pemz"/etc/ssl/certs/ca-certificates.crtz/etc/ssl/ca-bundle.pemz^[0-9a-fA-F]{8}\.[0-9]$�ctx�returnc # �( K � t j � � }|j s|j r)t |j � � r| � � � nAt D ]9}t j � |� � r| � |�� � n�:d V � d S )N)�cafile) �ssl�get_default_verify_pathsr �capath�_capath_contains_certs�set_default_verify_paths�_CA_FILE_CANDIDATES�os�path�isfile�load_verify_locations)r �defaultsr s �p/builddir/build/BUILD/cloudlinux-venv-1.0.7/venv/lib/python3.11/site-packages/pip/_vendor/truststore/_openssl.py�_configure_contextr s� � � � � �+�-�-�H��� �8�?� �/E�h�o�/V�/V� � �$�$�&�&�&�&� *� � �F��w�~�~�f�%�%� ��)�)��)�8�8�8��� � �E�E�E�E�E� r c � � t j � | � � sdS t j | � � D ] }t � |� � r dS � dS )zFCheck whether capath exists and contains certs in the expected format.FT)r r �isdir�listdir�_HASHED_CERT_FILENAME_RE�match)r �names r r r 1 s] � � �7�=�=�� � � ��u�� �6�"�"� � �� #� )� )�$� /� /� ��4�4� � �5r � ssl_context� cert_chain�server_hostnamec � � d S �N� )r r r s r �_verify_peercerts_implr! ; s � � �Dr r )� contextlibr �rer �typingr �compiler �contextmanager� SSLContext�Iteratorr �str�boolr �list�bytesr! r r r �<module>r- s �� � � � � � � � � � � � � � � � � � � � � � � � � &�2�:�&@�A�A� � �� �C�N� �v��t�/D� � � � �� �4�3� �4� � � � � #'� � �� � ��U� � � �4�Z� � � � � � � � r PK |�Zy.�u u * __pycache__/_ssl_constants.cpython-311.pycnu �[��� � ]�bgj � �� � U d dl Z d dlZd dlZe j Z eee� � Zej e e d< ee d< ej j dk reZ dZ neZ eZ de j de j ddfd�ZdS ) � N�#_truststore_SSLContext_dunder_class�"_truststore_SSLContext_super_class�cpython� ssl_context� verify_mode�returnc �F � t j � | |� � d S )N)�_original_super_SSLContextr �__set__)r r s �v/builddir/build/BUILD/cloudlinux-venv-1.0.7/venv/lib/python3.11/site-packages/pip/_vendor/truststore/_ssl_constants.py� _set_ssl_context_verify_moder s# � � �*�2�2�;� �L�L�L�L�L� )�ssl�sys�typing� SSLContext�_original_SSLContext�superr �Optional�type�__annotations__�implementation�namer r �object� VerifyModer � r r �<module>r s� �� � � � � � � � � � � � � � �~� � "�U�#7�9M� N� N� � &,�_�T�%:� :� :� :� %)� (� (� (����i�'�'�)=�&�*.�'�'�)/�&�*>�'�M�� �M�.1�n�M� �M� M� M� M� M� Mr PK |�Z8�̜D �D $ __pycache__/_windows.cpython-311.pycnu �[��� � ]�bgIF � �> � d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZmZmZm Z m Z m Z m Z m Z mZmZ d dlmZmZmZmZmZmZmZmZmZmZ d dlmZm Z ddl m Z eZ eZ eZ! G d � d e� � Z" ee"� � Z# ee#� � Z$ G d � d e� � Z% ee%� � Z& G d � de� � Z' G d� de� � Z(er ee( Z)n ee(� � Z) G d� de� � Z* G d� de� � Z+ ee+� � Z, G d� de� � Z- ee-� � Z. G d� de� � Z/ ee/� � Z0 ee0� � Z1 G d� de� � Z2 G d� d e� � Z3 ee3� � Z4 G d � d e� � Z5 ee5� � Z6 G d � d e� � Z7 ee7� � Z8 ee � � Z9dZ:d!Z;d"Z<d#Z=dZ> ed$� � Z?d%Z@d&ZAd'ZBd(ZCd)ZDd*ZEd+ZFd,ZGd-ZHd.ZId/ZJd0ZKd#ZLd1ZMd0ZNd2ZOeBeCz eDz eEz eFz eGz eHz eIz eJz ZP ed3� � ZQ ed4� � ZRd5eSd6e d7e d8e fd9�ZTeQjU ZUe8e9feU_V eTeU_W eQjX ZXeee!ee feX_V e eX_Y eTeX_W eQjZ ZZe eeeee$feZ_V eeZ_Y eQj[ Z[eeefe[_V e#e[_Y eTe[_W eQj\ Z\e e#ee e)ee e1fe\_V ee\_Y eTe\_W eQj] Z]e e0e4e6fe]_V ee]_Y eQj^ Z^e efe^_V ee^_Y eTe^_W eQj_ Z_e0fe__V eQj` Z`e#fe`_V eQja Zae fea_V eRjb Zbeeeeeee feb_V eeb_Y dHd:ejc d;edee d<efdz d8dfd=�Zgd:ejc d>e dz d?e d@e dAe)d<efdz dBehd8dfdC�Zid:ejc dDedee d?e d@e dAe)d<efdz dBehd8dfdE�Zje jk dFejc d8ejl d fdG�� � ZmdS )I� N)�WinDLL��WinError) �POINTER� Structure�c_char_p�c_ulong�c_void_p� c_wchar_p�cast�create_unicode_buffer�pointer�sizeof) �BOOL�DWORD�HANDLE�LONG�LPCSTR�LPCVOID�LPCWSTR� LPFILETIME�LPSTR�LPWSTR)� TYPE_CHECKING�Any� )� _set_ssl_context_verify_modec �0 � e Zd ZdefdefdefdefdeffZdS )� CERT_CONTEXT�dwCertEncodingType� pbCertEncoded� cbCertEncoded� pCertInfo� hCertStoreN)�__name__� __module__� __qualname__r r � HCERTSTORE�_fields_� � �p/builddir/build/BUILD/cloudlinux-venv-1.0.7/venv/lib/python3.11/site-packages/pip/_vendor/truststore/_windows.pyr r ' s= � � � � � � �u�%� �(�#� �%� � �h� � �z�"� �H�H�Hr+ r c �0 � e Zd Zdefd ee� � ffZdS )�CERT_ENHKEY_USAGE�cUsageIdentifier�rgpszUsageIdentifierN)r% r& r' r r r r) r* r+ r, r. r. 5 s- � � � � � � �U�#� ���� � �0��H�H�Hr+ r. c � � e Zd ZdefdeffZdS )�CERT_USAGE_MATCH�dwType�UsageN)r% r& r' r r. r) r* r+ r, r2 r2 ? s& � � � � � � �5�� �#�$��H�H�Hr+ r2 c �H � e Zd Zdefdefdefdefdefdefdefdefd eff Zd S ) �CERT_CHAIN_PARA�cbSize�RequestedUsage�RequestedIssuancePolicy�dwUrlRetrievalTimeout� fCheckRevocationFreshnessTime�dwRevocationFreshnessTime�pftCacheResync�pStrongSignPara�dwStrongSignFlagsN) r% r& r' r r2 r r r r) r* r+ r, r6 r6 F s_ � � � � � � �5�� �+�,� "�$4�5� �%�(� (�$�/� $�e�,� �:�&� �H�%� �e�$� �H�H�Hr+ r6 c � � e Zd ZdefdeffZdS )�CERT_TRUST_STATUS� dwErrorStatus� dwInfoStatusN)r% r& r' r r) r* r+ r, rA rA Z s% � � � � � � �%� � �� ��H�H�Hr+ rA c �< � e Zd ZdefdefdefdefdefdefdeffZ dS ) �CERT_CHAIN_ELEMENTr7 � pCertContext� TrustStatus�pRevocationInfo�pIssuanceUsage�pApplicationUsage�pwszExtendedErrorInfoN) r% r& r' r � PCERT_CONTEXTrA r �PCERT_ENHKEY_USAGEr r) r* r+ r, rE rE a sP � � � � � � �5�� � �'� �)�*� �H�%� �-�.� � 0�1� �'�*��H�H�Hr+ rE c �N � e Zd Zdefdefdefd ee� � fdefdefdeffZ dS ) �CERT_SIMPLE_CHAINr7 rG �cElement� rgpElement�pTrustListInfo�fHasRevocationFreshnessTimer< N) r% r& r' r rA r �PCERT_CHAIN_ELEMENTr r r) r* r+ r, rO rO p sY � � � � � � �5�� �)�*� �U�� �w�w� 2�3�3�4� �8�$� &��-� $�e�,��H�H�Hr+ rO c �T � e Zd Zdefdefdefd ee� � fdefdefdefdeffZ d S ) �CERT_CHAIN_CONTEXTr7 rG �cChain�rgpChain�cLowerQualityChainContext�rgpLowerQualityChainContextrS r< N) r% r& r' r rA r �PCERT_SIMPLE_CHAINr r r) r* r+ r, rV rV sa � � � � � � �5�� �)�*� �5�� �W�W� /�0�0�1� $�e�,� &��1� &��-� $�e�,� �H�H�Hr+ rV c �* � e Zd ZdefdefdefdeffZdS )� SSL_EXTRA_CERT_CHAIN_POLICY_PARAr7 � dwAuthType� fdwChecks�pwszServerNameN)r% r& r' r r r) r* r+ r, r] r] � s5 � � � � � � �5�� �u� � �e� � �7�#� �H�H�Hr+ r] c �$ � e Zd ZdefdefdeffZdS )�CERT_CHAIN_POLICY_PARAr7 �dwFlags�pvExtraPolicyParaN)r% r& r' r r r) r* r+ r, rb rb � s- � � � � � � �5�� �E�� �h�'��H�H�Hr+ rb c �0 � e Zd ZdefdefdefdefdeffZdS )�CERT_CHAIN_POLICY_STATUSr7 �dwError� lChainIndex� lElementIndex�pvExtraPolicyStatusN)r% r& r' r r r r) r* r+ r, rf rf � s= � � � � � � �5�� �E�� �� � �$� � ��)� �H�H�Hr+ rf c �` � e Zd Zdefdefdefdefdefdefdefdefd efd efd efd efd eff ZdS )�CERT_CHAIN_ENGINE_CONFIGr7 �hRestrictedRoot�hRestrictedTrust�hRestrictedOther�cAdditionalStore�rghAdditionalStorerc r: �MaximumCachedCertificates�CycleDetectionModulus�hExclusiveRoot�hExclusiveTrustedPeople�dwExclusiveFlagsN)r% r& r' r r( r r) r* r+ r, rl rl � s} � � � � � � �5�� �J�'� �Z�(� �Z�(� �U�#� �x�(� �E�� �%�(� $�e�,� �%�(� �:�&� "�J�/� �U�#��H�H�Hr+ rl i s Memory� s 1.3.6.1.5.5.7.3.1i i � � � �@ � � i i � i @ i � i z crypt32.dllz kernel32.dll�result�_�args�returnc �& � | st � � �|S �Nr )r r� r� s r, �_handle_win_errorr� � s � � � ��j�j�� �Kr+ � ssl_context� cert_chain�server_hostnamec �H � |st j d� � �d}t t dddd� � } |dd� D ]5}t |t t z |t |� � t d� � �6|d }t t t z |t |� � � � }t � � }d|_ t dz t � � |_ t � � }||_ t# � � } || _ t' | � � | _ t+ | � � } | j t j z rt0 } n | j t j z rt4 } nd} t7 | d||| || �� � nc# t j $ rQ} | � d�� � } | r. t; | | ||| || �� � n# t j $ r | d�w xY w� Y d} ~ nd} ~ ww xY wt= |d� � |rt? |� � dS dS # t= |d� � |rt? |� � w w xY w)z9Verify the cert_chain from the server using Windows APIs.z#Peer sent no certificates to verifyNr r )� chain_flagsT)� binary_form) �ssl�SSLCertVerificationError� CertOpenStore�CERT_STORE_PROV_MEMORY� CertAddEncodedCertificateToStore�X509_ASN_ENCODING�PKCS_7_ASN_ENCODING�len�CERT_STORE_ADD_USE_EXISTING� CertCreateCertificateContextr. r/ r �OID_PKIX_KP_SERVER_AUTHr0 r2 r4 r6 r8 r r7 r � verify_flags�VERIFY_CRL_CHECK_CHAIN�!CERT_CHAIN_REVOCATION_CHECK_CHAIN�VERIFY_CRL_CHECK_LEAF�$CERT_CHAIN_REVOCATION_CHECK_END_CERT�_get_and_verify_cert_chain� get_ca_certs� _verify_using_custom_ca_certs�CertCloseStore�CertFreeCertificateContext)r� r� r� rF �hIntermediateCertStore� cert_bytes� leaf_cert�cert_enhkey_usage�cert_usage_match� chain_params� pChainParar� �e�custom_ca_certss r, �_verify_peercerts_implr� C s� � � � R��*�+P�Q�Q�Q��L� *�+A�1�d�A�t� T� T��K5�$�Q�R�R�.� � �J� ,�&�!�$7�7���J���+�� � � � � �q�M� �3� � 3� 3�Y��I��� � � � .� /� /��-.��*�2:�Q�,�@W�1X�1X��.�+�-�-��!2�� �&�(�(� �&6� �#� $�\� 2� 2� �� �\�*�*� � � #�c�&@� @� �;�K�K� � %��(A� A� �>�K�K��K�# � '���&� �� � '� � � � � �� �+� � � � 3>�2J�2J� � 3K� 3� 3�O� � � &�1�#�'�.�$�"�'�$/�� � � � �� �3� &� &� &���%�&���� �� � � � ����� ����2 �-�q�1�1�1� � 5� &�|� 4� 4� 4� 4� 4� 5� 5�� �-�q�1�1�1� � 5� &�|� 4� 4� 4� 4� 5���sN �D+G= � E5 �4G= �5G�G� F4�3G�4G�G� G= �G�G= �=$H!� hChainEnginer� �pPeerCertContextr� r� c �p � d } t t � � � � }t ||d |||d |� � |j }t � � } t | � � | _ t | _ d| _ | j du r t | _ |rt |� � | _ t � � } t t | � � t � � | _ | j t& j k r| xj t, z c_ t | � � | _ t | � � } t/ � � } t | � � | _ t | � � } t1 t2 || | � � | j }|r�t7 d� � }t9 t: t< z d |d|t |� � d � � }|dk rd|d�d| j � d�}n|j �! � � }t' j" |� � }||_# ||_$ |d � |rtK |j � � d S d S # |rtK |j � � w w xY w)Nr Fi z Certificate chain policy error z#xz [�])&r �PCERT_CHAIN_CONTEXT�CertGetCertificateChain�contentsr] r r7 �AUTHTYPE_SERVERr^ r_ �check_hostname�$SECURITY_FLAG_IGNORE_CERT_CN_INVALIDr r` rb r r rd � verify_moder� � CERT_NONErc �(CERT_CHAIN_POLICY_VERIFY_MODE_NONE_FLAGSrf � CertVerifyCertificateChainPolicy�CERT_CHAIN_POLICY_SSLrg r �FormatMessageW�FORMAT_MESSAGE_FROM_SYSTEM� FORMAT_MESSAGE_IGNORE_INSERTSri �value�stripr� �verify_message� verify_code�CertFreeCertificateChain)r� r� r� r� r� r� r� �ppChainContext� pChainContext� ssl_extra_cert_chain_policy_para� chain_policy� pPolicyPara� policy_status� pPolicyStatus� error_code�error_message_buf�error_message_chars� error_message�errs r, r� r� � s� � � �N�M>� �!4�!6�!6�7�7�� � � � � "� � � � � � � � '�/� � ,L�+M�+M�(�28� ,�3 � 3 �(�/� 7F�(�3�56�(�2� � %�� .� .�4� -� 6� � Y�>G��>X�>X� ,� ;�-�/�/� �)-� �4� 5� 5�x�* � * � �&� � "�c�m� 3� 3� � � �$L� L� � � $�\� 2� 2� �� �l�+�+� �0�2�2� � %�m� 4� 4� � � � �.�.� �(� !� � � � � � � #�*� � � � 5�d� ;� ;� �"0�*�-J�J����!��(�)�)��#� #� � #�a�'�'� q�*� q� q� q�S`�Sn� q� q� q� � � 1� 7� =� =� ?� ?� ��.�}�=�=�C�!.�C� � (�C�O��4� �1 �4 � >� $�^�%<� =� =� =� =� =� >� >��>� >� $�^�%<� =� =� =� =� >���s �G=H � H5r� c �8 � d }t t dd dd � � } |D ]5} t |t t z | t | � � t d � � �6t � � } t | � � | _ || _ t | � � } t t � � � � } t | | � � | j }t | ||||||� � |rt! |� � t# |d� � d S # |rt! |� � t# |d� � w xY w)Nr )r� r� r� r� r� r� r� rl r r7 rt r �HCERTCHAINENGINE� CertCreateCertificateChainEnginer� r� � CertFreeCertificateChainEnginer� ) r� r� r� r� r� r� r� r� �hRootCertStorer� �cert_chain_engine_config�pConfig� phChainEngines r, r� r� � s[ � � �L�"�#9�1�d�A�t�L�L�N�&*�)� � �J� ,� �!�$7�7���J���+�� � � � � $<�#=�#=� �*0�1I�*J�*J� �'�2@� �/��2�3�3�� � 0� 2� 2�3�3� �(� � � � � � %�-� � #� � � "� � � � � � � � � 9� *�<� 8� 8� 8��~�q�)�)�)�)�)�� � 9� *�<� 8� 8� 8��~�q�)�)�)�)���s �B7C6 �6#D�ctxc # �� K � | j }| j }d| _ t | t j � � d V � || _ t | |� � d S # || _ t | |� � w xY w)NF)r� r� r r� r� )r� r� r� s r, �_configure_contextr� - s| � � � ��'�N��/�K� �C�� ��c�m�4�4�4�7� ���� +���$�S�+�6�6�6�6�6�� ,���$�S�+�6�6�6�6���s �A �A)r� )n� contextlibr� �typing�ctypesr r r r r r r r r r r r �ctypes.wintypesr r r r r r r r r r r r �_ssl_constantsr r� r( �HCRYPTPROV_LEGACYr rL �PCCERT_CONTEXTr. rM r2 r6 �PCERT_CHAIN_PARArA rE rT rO r[ rV r� �PCCERT_CHAIN_CONTEXTr] rb �PCERT_CHAIN_POLICY_PARArf �PCERT_CHAIN_POLICY_STATUSrl �PCERT_CHAIN_ENGINE_CONFIG�PHCERTCHAINENGINEr� r� r� r� �USAGE_MATCH_TYPE_ORr� r� r� �1CERT_CHAIN_POLICY_IGNORE_ALL_NOT_TIME_VALID_FLAGS�7CERT_CHAIN_POLICY_IGNORE_INVALID_BASIC_CONSTRAINTS_FLAG�'CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAG�*CERT_CHAIN_POLICY_IGNORE_INVALID_NAME_FLAG�)CERT_CHAIN_POLICY_IGNORE_WRONG_USAGE_FLAG�,CERT_CHAIN_POLICY_IGNORE_INVALID_POLICY_FLAG�.CERT_CHAIN_POLICY_IGNORE_ALL_REV_UNKNOWN_FLAGS�%CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG�%CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAGr� r� r� r� r� r� �wincrypt�kernel32�boolr� r� �argtypes�errcheckr� �restyper� r� r� r� r� r� r� r� r� � SSLContext�list�bytes�strr� �intr� r� �contextmanager�Iteratorr� r* r+ r, �<module>r� s� �� � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � � &� %� %� %� %� %� %� %� 8� 8� 8� 8� 8� 8�� � � �� �� � � � �9� � � � �� �%�%� ��� �'�'��� � � � � � � � � �W� .�/�/� �� � � � �y� � � � � � � � �i� � � � � 0� ��/��� �w��/�/��� � � � � � � � � � � � � �� � � � �g� 0�1�1� � � � � � � � � � � �W� .�/�/� � � � � � �� � � � �g� 0�1�1� � �w� 2�3�3� �� � � � �y� � � �� � � � �Y� � � � "�'�"8�9�9� �� � � � �y� � � � $�G�$<� =� =� �� � � � �y� � � �$ $�G�$<� =� =� ��G� ,�-�-� � � � � �"� � � �� �"�(�#7�8�8� �'1� $�$.� !�4>� 1�:D� 7�*4� '�-7� *�,6� )�/9� ,�1;� .�(2� %�(2� %�'1� $���� � '� � *� � 6�=�>�-�.� 1�1� 0� 0� 3� 3� 5� 5� ,�,� ,�,� )� �6�-� � �� �6�.� !� !���d� �s� �#� �#� � � � � $,�#L� � ��-� � )� ->� � )��&� � �%�):�E�8�L� � �"� � �*� � �#+�#L� �� � � � �� -� � )� ,0� � (� '� D� �).��%�(@� � %�'4� � $�(9� � %�"�:� ������ � �� $� � � #'� � �#4� � �#+�#L� � ��� � -� � )� ,0� � (��(��%�u�-�� � �� �+�� �#�<� �%8�$:� � !� %� @� �'4�&6� � #�!)�!H� �+;�*=� � '��(�� � � � � � � ��� � �� � #'�Y5� Y5�� �Y5��U� �Y5� �4�Z�Y5� � Y5� Y5� Y5� Y5�xW>�� �W>�"�T�)�W>� '�W>� � W>� !� W>� �4�Z� W>� �W>� �W>� W>� W>� W>�t1*�� �1*��%�[�1*� '�1*� � 1*� !� 1*� �4�Z� 1*� �1*� �1*� 1*� 1*� 1*�h �� 7�C�N� 7�v��t�/D� 7� 7� 7� �� 7� 7� 7r+ PK |�Z�*;) ;) _api.pynu �[��� import os import platform import socket import ssl import sys import typing import _ssl # type: ignore[import-not-found] from ._ssl_constants import ( _original_SSLContext, _original_super_SSLContext, _truststore_SSLContext_dunder_class, _truststore_SSLContext_super_class, ) if platform.system() == "Windows": from ._windows import _configure_context, _verify_peercerts_impl elif platform.system() == "Darwin": from ._macos import _configure_context, _verify_peercerts_impl else: from ._openssl import _configure_context, _verify_peercerts_impl if typing.TYPE_CHECKING: from pip._vendor.typing_extensions import Buffer # From typeshed/stdlib/ssl.pyi _StrOrBytesPath: typing.TypeAlias = str | bytes | os.PathLike[str] | os.PathLike[bytes] _PasswordType: typing.TypeAlias = str | bytes | typing.Callable[[], str | bytes] def inject_into_ssl() -> None: """Injects the :class:`truststore.SSLContext` into the ``ssl`` module by replacing :class:`ssl.SSLContext`. """ setattr(ssl, "SSLContext", SSLContext) # urllib3 holds on to its own reference of ssl.SSLContext # so we need to replace that reference too. try: import pip._vendor.urllib3.util.ssl_ as urllib3_ssl setattr(urllib3_ssl, "SSLContext", SSLContext) except ImportError: pass def extract_from_ssl() -> None: """Restores the :class:`ssl.SSLContext` class to its original state""" setattr(ssl, "SSLContext", _original_SSLContext) try: import pip._vendor.urllib3.util.ssl_ as urllib3_ssl urllib3_ssl.SSLContext = _original_SSLContext # type: ignore[assignment] except ImportError: pass class SSLContext(_truststore_SSLContext_super_class): # type: ignore[misc] """SSLContext API that uses system certificates on all platforms""" @property # type: ignore[misc] def __class__(self) -> type: # Dirty hack to get around isinstance() checks # for ssl.SSLContext instances in aiohttp/trustme # when using non-CPython implementations. return _truststore_SSLContext_dunder_class or SSLContext def __init__(self, protocol: int = None) -> None: # type: ignore[assignment] self._ctx = _original_SSLContext(protocol) class TruststoreSSLObject(ssl.SSLObject): # This object exists because wrap_bio() doesn't # immediately do the handshake so we need to do # certificate verifications after SSLObject.do_handshake() def do_handshake(self) -> None: ret = super().do_handshake() _verify_peercerts(self, server_hostname=self.server_hostname) return ret self._ctx.sslobject_class = TruststoreSSLObject def wrap_socket( self, sock: socket.socket, server_side: bool = False, do_handshake_on_connect: bool = True, suppress_ragged_eofs: bool = True, server_hostname: str | None = None, session: ssl.SSLSession | None = None, ) -> ssl.SSLSocket: # Use a context manager here because the # inner SSLContext holds on to our state # but also does the actual handshake. with _configure_context(self._ctx): ssl_sock = self._ctx.wrap_socket( sock, server_side=server_side, server_hostname=server_hostname, do_handshake_on_connect=do_handshake_on_connect, suppress_ragged_eofs=suppress_ragged_eofs, session=session, ) try: _verify_peercerts(ssl_sock, server_hostname=server_hostname) except Exception: ssl_sock.close() raise return ssl_sock def wrap_bio( self, incoming: ssl.MemoryBIO, outgoing: ssl.MemoryBIO, server_side: bool = False, server_hostname: str | None = None, session: ssl.SSLSession | None = None, ) -> ssl.SSLObject: with _configure_context(self._ctx): ssl_obj = self._ctx.wrap_bio( incoming, outgoing, server_hostname=server_hostname, server_side=server_side, session=session, ) return ssl_obj def load_verify_locations( self, cafile: str | bytes | os.PathLike[str] | os.PathLike[bytes] | None = None, capath: str | bytes | os.PathLike[str] | os.PathLike[bytes] | None = None, cadata: typing.Union[str, "Buffer", None] = None, ) -> None: return self._ctx.load_verify_locations( cafile=cafile, capath=capath, cadata=cadata ) def load_cert_chain( self, certfile: _StrOrBytesPath, keyfile: _StrOrBytesPath | None = None, password: _PasswordType | None = None, ) -> None: return self._ctx.load_cert_chain( certfile=certfile, keyfile=keyfile, password=password ) def load_default_certs( self, purpose: ssl.Purpose = ssl.Purpose.SERVER_AUTH ) -> None: return self._ctx.load_default_certs(purpose) def set_alpn_protocols(self, alpn_protocols: typing.Iterable[str]) -> None: return self._ctx.set_alpn_protocols(alpn_protocols) def set_npn_protocols(self, npn_protocols: typing.Iterable[str]) -> None: return self._ctx.set_npn_protocols(npn_protocols) def set_ciphers(self, __cipherlist: str) -> None: return self._ctx.set_ciphers(__cipherlist) def get_ciphers(self) -> typing.Any: return self._ctx.get_ciphers() def session_stats(self) -> dict[str, int]: return self._ctx.session_stats() def cert_store_stats(self) -> dict[str, int]: raise NotImplementedError() def set_default_verify_paths(self) -> None: self._ctx.set_default_verify_paths() @typing.overload def get_ca_certs( self, binary_form: typing.Literal[False] = ... ) -> list[typing.Any]: ... @typing.overload def get_ca_certs(self, binary_form: typing.Literal[True] = ...) -> list[bytes]: ... @typing.overload def get_ca_certs(self, binary_form: bool = ...) -> typing.Any: ... def get_ca_certs(self, binary_form: bool = False) -> list[typing.Any] | list[bytes]: raise NotImplementedError() @property def check_hostname(self) -> bool: return self._ctx.check_hostname @check_hostname.setter def check_hostname(self, value: bool) -> None: self._ctx.check_hostname = value @property def hostname_checks_common_name(self) -> bool: return self._ctx.hostname_checks_common_name @hostname_checks_common_name.setter def hostname_checks_common_name(self, value: bool) -> None: self._ctx.hostname_checks_common_name = value @property def keylog_filename(self) -> str: return self._ctx.keylog_filename @keylog_filename.setter def keylog_filename(self, value: str) -> None: self._ctx.keylog_filename = value @property def maximum_version(self) -> ssl.TLSVersion: return self._ctx.maximum_version @maximum_version.setter def maximum_version(self, value: ssl.TLSVersion) -> None: _original_super_SSLContext.maximum_version.__set__( # type: ignore[attr-defined] self._ctx, value ) @property def minimum_version(self) -> ssl.TLSVersion: return self._ctx.minimum_version @minimum_version.setter def minimum_version(self, value: ssl.TLSVersion) -> None: _original_super_SSLContext.minimum_version.__set__( # type: ignore[attr-defined] self._ctx, value ) @property def options(self) -> ssl.Options: return self._ctx.options @options.setter def options(self, value: ssl.Options) -> None: _original_super_SSLContext.options.__set__( # type: ignore[attr-defined] self._ctx, value ) @property def post_handshake_auth(self) -> bool: return self._ctx.post_handshake_auth @post_handshake_auth.setter def post_handshake_auth(self, value: bool) -> None: self._ctx.post_handshake_auth = value @property def protocol(self) -> ssl._SSLMethod: return self._ctx.protocol @property def security_level(self) -> int: return self._ctx.security_level @property def verify_flags(self) -> ssl.VerifyFlags: return self._ctx.verify_flags @verify_flags.setter def verify_flags(self, value: ssl.VerifyFlags) -> None: _original_super_SSLContext.verify_flags.__set__( # type: ignore[attr-defined] self._ctx, value ) @property def verify_mode(self) -> ssl.VerifyMode: return self._ctx.verify_mode @verify_mode.setter def verify_mode(self, value: ssl.VerifyMode) -> None: _original_super_SSLContext.verify_mode.__set__( # type: ignore[attr-defined] self._ctx, value ) # Python 3.13+ makes get_unverified_chain() a public API that only returns DER # encoded certificates. We detect whether we need to call public_bytes() for 3.10->3.12 # Pre-3.13 returned None instead of an empty list from get_unverified_chain() if sys.version_info >= (3, 13): def _get_unverified_chain_bytes(sslobj: ssl.SSLObject) -> list[bytes]: unverified_chain = sslobj.get_unverified_chain() or () # type: ignore[attr-defined] return [ cert if isinstance(cert, bytes) else cert.public_bytes(_ssl.ENCODING_DER) for cert in unverified_chain ] else: def _get_unverified_chain_bytes(sslobj: ssl.SSLObject) -> list[bytes]: unverified_chain = sslobj.get_unverified_chain() or () # type: ignore[attr-defined] return [cert.public_bytes(_ssl.ENCODING_DER) for cert in unverified_chain] def _verify_peercerts( sock_or_sslobj: ssl.SSLSocket | ssl.SSLObject, server_hostname: str | None ) -> None: """ Verifies the peer certificates from an SSLSocket or SSLObject against the certificates in the OS trust store. """ sslobj: ssl.SSLObject = sock_or_sslobj # type: ignore[assignment] try: while not hasattr(sslobj, "get_unverified_chain"): sslobj = sslobj._sslobj # type: ignore[attr-defined] except AttributeError: pass cert_bytes = _get_unverified_chain_bytes(sslobj) _verify_peercerts_impl( sock_or_sslobj.context, cert_bytes, server_hostname=server_hostname ) PK |�Z�7�NP P _macos.pynu �[��� import contextlib import ctypes import platform import ssl import typing from ctypes import ( CDLL, POINTER, c_bool, c_char_p, c_int32, c_long, c_uint32, c_ulong, c_void_p, ) from ctypes.util import find_library from ._ssl_constants import _set_ssl_context_verify_mode _mac_version = platform.mac_ver()[0] _mac_version_info = tuple(map(int, _mac_version.split("."))) if _mac_version_info < (10, 8): raise ImportError( f"Only OS X 10.8 and newer are supported, not {_mac_version_info[0]}.{_mac_version_info[1]}" ) _is_macos_version_10_14_or_later = _mac_version_info >= (10, 14) def _load_cdll(name: str, macos10_16_path: str) -> CDLL: """Loads a CDLL by name, falling back to known path on 10.16+""" try: # Big Sur is technically 11 but we use 10.16 due to the Big Sur # beta being labeled as 10.16. path: str | None if _mac_version_info >= (10, 16): path = macos10_16_path else: path = find_library(name) if not path: raise OSError # Caught and reraised as 'ImportError' return CDLL(path, use_errno=True) except OSError: raise ImportError(f"The library {name} failed to load") from None Security = _load_cdll( "Security", "/System/Library/Frameworks/Security.framework/Security" ) CoreFoundation = _load_cdll( "CoreFoundation", "/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation", ) Boolean = c_bool CFIndex = c_long CFStringEncoding = c_uint32 CFData = c_void_p CFString = c_void_p CFArray = c_void_p CFMutableArray = c_void_p CFError = c_void_p CFType = c_void_p CFTypeID = c_ulong CFTypeRef = POINTER(CFType) CFAllocatorRef = c_void_p OSStatus = c_int32 CFErrorRef = POINTER(CFError) CFDataRef = POINTER(CFData) CFStringRef = POINTER(CFString) CFArrayRef = POINTER(CFArray) CFMutableArrayRef = POINTER(CFMutableArray) CFArrayCallBacks = c_void_p CFOptionFlags = c_uint32 SecCertificateRef = POINTER(c_void_p) SecPolicyRef = POINTER(c_void_p) SecTrustRef = POINTER(c_void_p) SecTrustResultType = c_uint32 SecTrustOptionFlags = c_uint32 try: Security.SecCertificateCreateWithData.argtypes = [CFAllocatorRef, CFDataRef] Security.SecCertificateCreateWithData.restype = SecCertificateRef Security.SecCertificateCopyData.argtypes = [SecCertificateRef] Security.SecCertificateCopyData.restype = CFDataRef Security.SecCopyErrorMessageString.argtypes = [OSStatus, c_void_p] Security.SecCopyErrorMessageString.restype = CFStringRef Security.SecTrustSetAnchorCertificates.argtypes = [SecTrustRef, CFArrayRef] Security.SecTrustSetAnchorCertificates.restype = OSStatus Security.SecTrustSetAnchorCertificatesOnly.argtypes = [SecTrustRef, Boolean] Security.SecTrustSetAnchorCertificatesOnly.restype = OSStatus Security.SecPolicyCreateRevocation.argtypes = [CFOptionFlags] Security.SecPolicyCreateRevocation.restype = SecPolicyRef Security.SecPolicyCreateSSL.argtypes = [Boolean, CFStringRef] Security.SecPolicyCreateSSL.restype = SecPolicyRef Security.SecTrustCreateWithCertificates.argtypes = [ CFTypeRef, CFTypeRef, POINTER(SecTrustRef), ] Security.SecTrustCreateWithCertificates.restype = OSStatus Security.SecTrustGetTrustResult.argtypes = [ SecTrustRef, POINTER(SecTrustResultType), ] Security.SecTrustGetTrustResult.restype = OSStatus Security.SecTrustEvaluate.argtypes = [ SecTrustRef, POINTER(SecTrustResultType), ] Security.SecTrustEvaluate.restype = OSStatus Security.SecTrustRef = SecTrustRef # type: ignore[attr-defined] Security.SecTrustResultType = SecTrustResultType # type: ignore[attr-defined] Security.OSStatus = OSStatus # type: ignore[attr-defined] kSecRevocationUseAnyAvailableMethod = 3 kSecRevocationRequirePositiveResponse = 8 CoreFoundation.CFRelease.argtypes = [CFTypeRef] CoreFoundation.CFRelease.restype = None CoreFoundation.CFGetTypeID.argtypes = [CFTypeRef] CoreFoundation.CFGetTypeID.restype = CFTypeID CoreFoundation.CFStringCreateWithCString.argtypes = [ CFAllocatorRef, c_char_p, CFStringEncoding, ] CoreFoundation.CFStringCreateWithCString.restype = CFStringRef CoreFoundation.CFStringGetCStringPtr.argtypes = [CFStringRef, CFStringEncoding] CoreFoundation.CFStringGetCStringPtr.restype = c_char_p CoreFoundation.CFStringGetCString.argtypes = [ CFStringRef, c_char_p, CFIndex, CFStringEncoding, ] CoreFoundation.CFStringGetCString.restype = c_bool CoreFoundation.CFDataCreate.argtypes = [CFAllocatorRef, c_char_p, CFIndex] CoreFoundation.CFDataCreate.restype = CFDataRef CoreFoundation.CFDataGetLength.argtypes = [CFDataRef] CoreFoundation.CFDataGetLength.restype = CFIndex CoreFoundation.CFDataGetBytePtr.argtypes = [CFDataRef] CoreFoundation.CFDataGetBytePtr.restype = c_void_p CoreFoundation.CFArrayCreate.argtypes = [ CFAllocatorRef, POINTER(CFTypeRef), CFIndex, CFArrayCallBacks, ] CoreFoundation.CFArrayCreate.restype = CFArrayRef CoreFoundation.CFArrayCreateMutable.argtypes = [ CFAllocatorRef, CFIndex, CFArrayCallBacks, ] CoreFoundation.CFArrayCreateMutable.restype = CFMutableArrayRef CoreFoundation.CFArrayAppendValue.argtypes = [CFMutableArrayRef, c_void_p] CoreFoundation.CFArrayAppendValue.restype = None CoreFoundation.CFArrayGetCount.argtypes = [CFArrayRef] CoreFoundation.CFArrayGetCount.restype = CFIndex CoreFoundation.CFArrayGetValueAtIndex.argtypes = [CFArrayRef, CFIndex] CoreFoundation.CFArrayGetValueAtIndex.restype = c_void_p CoreFoundation.CFErrorGetCode.argtypes = [CFErrorRef] CoreFoundation.CFErrorGetCode.restype = CFIndex CoreFoundation.CFErrorCopyDescription.argtypes = [CFErrorRef] CoreFoundation.CFErrorCopyDescription.restype = CFStringRef CoreFoundation.kCFAllocatorDefault = CFAllocatorRef.in_dll( # type: ignore[attr-defined] CoreFoundation, "kCFAllocatorDefault" ) CoreFoundation.kCFTypeArrayCallBacks = c_void_p.in_dll( # type: ignore[attr-defined] CoreFoundation, "kCFTypeArrayCallBacks" ) CoreFoundation.CFTypeRef = CFTypeRef # type: ignore[attr-defined] CoreFoundation.CFArrayRef = CFArrayRef # type: ignore[attr-defined] CoreFoundation.CFStringRef = CFStringRef # type: ignore[attr-defined] CoreFoundation.CFErrorRef = CFErrorRef # type: ignore[attr-defined] except AttributeError as e: raise ImportError(f"Error initializing ctypes: {e}") from None # SecTrustEvaluateWithError is macOS 10.14+ if _is_macos_version_10_14_or_later: try: Security.SecTrustEvaluateWithError.argtypes = [ SecTrustRef, POINTER(CFErrorRef), ] Security.SecTrustEvaluateWithError.restype = c_bool except AttributeError as e: raise ImportError(f"Error initializing ctypes: {e}") from None def _handle_osstatus(result: OSStatus, _: typing.Any, args: typing.Any) -> typing.Any: """ Raises an error if the OSStatus value is non-zero. """ if int(result) == 0: return args # Returns a CFString which we need to transform # into a UTF-8 Python string. error_message_cfstring = None try: error_message_cfstring = Security.SecCopyErrorMessageString(result, None) # First step is convert the CFString into a C string pointer. # We try the fast no-copy way first. error_message_cfstring_c_void_p = ctypes.cast( error_message_cfstring, ctypes.POINTER(ctypes.c_void_p) ) message = CoreFoundation.CFStringGetCStringPtr( error_message_cfstring_c_void_p, CFConst.kCFStringEncodingUTF8 ) # Quoting the Apple dev docs: # # "A pointer to a C string or NULL if the internal # storage of theString does not allow this to be # returned efficiently." # # So we need to get our hands dirty. if message is None: buffer = ctypes.create_string_buffer(1024) result = CoreFoundation.CFStringGetCString( error_message_cfstring_c_void_p, buffer, 1024, CFConst.kCFStringEncodingUTF8, ) if not result: raise OSError("Error copying C string from CFStringRef") message = buffer.value finally: if error_message_cfstring is not None: CoreFoundation.CFRelease(error_message_cfstring) # If no message can be found for this status we come # up with a generic one that forwards the status code. if message is None or message == "": message = f"SecureTransport operation returned a non-zero OSStatus: {result}" raise ssl.SSLError(message) Security.SecTrustCreateWithCertificates.errcheck = _handle_osstatus # type: ignore[assignment] Security.SecTrustSetAnchorCertificates.errcheck = _handle_osstatus # type: ignore[assignment] Security.SecTrustSetAnchorCertificatesOnly.errcheck = _handle_osstatus # type: ignore[assignment] Security.SecTrustGetTrustResult.errcheck = _handle_osstatus # type: ignore[assignment] Security.SecTrustEvaluate.errcheck = _handle_osstatus # type: ignore[assignment] class CFConst: """CoreFoundation constants""" kCFStringEncodingUTF8 = CFStringEncoding(0x08000100) errSecIncompleteCertRevocationCheck = -67635 errSecHostNameMismatch = -67602 errSecCertificateExpired = -67818 errSecNotTrusted = -67843 def _bytes_to_cf_data_ref(value: bytes) -> CFDataRef: # type: ignore[valid-type] return CoreFoundation.CFDataCreate( # type: ignore[no-any-return] CoreFoundation.kCFAllocatorDefault, value, len(value) ) def _bytes_to_cf_string(value: bytes) -> CFString: """ Given a Python binary data, create a CFString. The string must be CFReleased by the caller. """ c_str = ctypes.c_char_p(value) cf_str = CoreFoundation.CFStringCreateWithCString( CoreFoundation.kCFAllocatorDefault, c_str, CFConst.kCFStringEncodingUTF8, ) return cf_str # type: ignore[no-any-return] def _cf_string_ref_to_str(cf_string_ref: CFStringRef) -> str | None: # type: ignore[valid-type] """ Creates a Unicode string from a CFString object. Used entirely for error reporting. Yes, it annoys me quite a lot that this function is this complex. """ string = CoreFoundation.CFStringGetCStringPtr( cf_string_ref, CFConst.kCFStringEncodingUTF8 ) if string is None: buffer = ctypes.create_string_buffer(1024) result = CoreFoundation.CFStringGetCString( cf_string_ref, buffer, 1024, CFConst.kCFStringEncodingUTF8 ) if not result: raise OSError("Error copying C string from CFStringRef") string = buffer.value if string is not None: string = string.decode("utf-8") return string # type: ignore[no-any-return] def _der_certs_to_cf_cert_array(certs: list[bytes]) -> CFMutableArrayRef: # type: ignore[valid-type] """Builds a CFArray of SecCertificateRefs from a list of DER-encoded certificates. Responsibility of the caller to call CoreFoundation.CFRelease on the CFArray. """ cf_array = CoreFoundation.CFArrayCreateMutable( CoreFoundation.kCFAllocatorDefault, 0, ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks), ) if not cf_array: raise MemoryError("Unable to allocate memory!") for cert_data in certs: cf_data = None sec_cert_ref = None try: cf_data = _bytes_to_cf_data_ref(cert_data) sec_cert_ref = Security.SecCertificateCreateWithData( CoreFoundation.kCFAllocatorDefault, cf_data ) CoreFoundation.CFArrayAppendValue(cf_array, sec_cert_ref) finally: if cf_data: CoreFoundation.CFRelease(cf_data) if sec_cert_ref: CoreFoundation.CFRelease(sec_cert_ref) return cf_array # type: ignore[no-any-return] @contextlib.contextmanager def _configure_context(ctx: ssl.SSLContext) -> typing.Iterator[None]: check_hostname = ctx.check_hostname verify_mode = ctx.verify_mode ctx.check_hostname = False _set_ssl_context_verify_mode(ctx, ssl.CERT_NONE) try: yield finally: ctx.check_hostname = check_hostname _set_ssl_context_verify_mode(ctx, verify_mode) def _verify_peercerts_impl( ssl_context: ssl.SSLContext, cert_chain: list[bytes], server_hostname: str | None = None, ) -> None: certs = None policies = None trust = None try: # Only set a hostname on the policy if we're verifying the hostname # on the leaf certificate. if server_hostname is not None and ssl_context.check_hostname: cf_str_hostname = None try: cf_str_hostname = _bytes_to_cf_string(server_hostname.encode("ascii")) ssl_policy = Security.SecPolicyCreateSSL(True, cf_str_hostname) finally: if cf_str_hostname: CoreFoundation.CFRelease(cf_str_hostname) else: ssl_policy = Security.SecPolicyCreateSSL(True, None) policies = ssl_policy if ssl_context.verify_flags & ssl.VERIFY_CRL_CHECK_CHAIN: # Add explicit policy requiring positive revocation checks policies = CoreFoundation.CFArrayCreateMutable( CoreFoundation.kCFAllocatorDefault, 0, ctypes.byref(CoreFoundation.kCFTypeArrayCallBacks), ) CoreFoundation.CFArrayAppendValue(policies, ssl_policy) CoreFoundation.CFRelease(ssl_policy) revocation_policy = Security.SecPolicyCreateRevocation( kSecRevocationUseAnyAvailableMethod | kSecRevocationRequirePositiveResponse ) CoreFoundation.CFArrayAppendValue(policies, revocation_policy) CoreFoundation.CFRelease(revocation_policy) elif ssl_context.verify_flags & ssl.VERIFY_CRL_CHECK_LEAF: raise NotImplementedError("VERIFY_CRL_CHECK_LEAF not implemented for macOS") certs = None try: certs = _der_certs_to_cf_cert_array(cert_chain) # Now that we have certificates loaded and a SecPolicy # we can finally create a SecTrust object! trust = Security.SecTrustRef() Security.SecTrustCreateWithCertificates( certs, policies, ctypes.byref(trust) ) finally: # The certs are now being held by SecTrust so we can # release our handles for the array. if certs: CoreFoundation.CFRelease(certs) # If there are additional trust anchors to load we need to transform # the list of DER-encoded certificates into a CFArray. ctx_ca_certs_der: list[bytes] | None = ssl_context.get_ca_certs( binary_form=True ) if ctx_ca_certs_der: ctx_ca_certs = None try: ctx_ca_certs = _der_certs_to_cf_cert_array(ctx_ca_certs_der) Security.SecTrustSetAnchorCertificates(trust, ctx_ca_certs) finally: if ctx_ca_certs: CoreFoundation.CFRelease(ctx_ca_certs) # We always want system certificates. Security.SecTrustSetAnchorCertificatesOnly(trust, False) # macOS 10.13 and earlier don't support SecTrustEvaluateWithError() # so we use SecTrustEvaluate() which means we need to construct error # messages ourselves. if _is_macos_version_10_14_or_later: _verify_peercerts_impl_macos_10_14(ssl_context, trust) else: _verify_peercerts_impl_macos_10_13(ssl_context, trust) finally: if policies: CoreFoundation.CFRelease(policies) if trust: CoreFoundation.CFRelease(trust) def _verify_peercerts_impl_macos_10_13( ssl_context: ssl.SSLContext, sec_trust_ref: typing.Any ) -> None: """Verify using 'SecTrustEvaluate' API for macOS 10.13 and earlier. macOS 10.14 added the 'SecTrustEvaluateWithError' API. """ sec_trust_result_type = Security.SecTrustResultType() Security.SecTrustEvaluate(sec_trust_ref, ctypes.byref(sec_trust_result_type)) try: sec_trust_result_type_as_int = int(sec_trust_result_type.value) except (ValueError, TypeError): sec_trust_result_type_as_int = -1 # Apple doesn't document these values in their own API docs. # See: https://github.com/xybp888/iOS-SDKs/blob/master/iPhoneOS13.0.sdk/System/Library/Frameworks/Security.framework/Headers/SecTrust.h#L84 if ( ssl_context.verify_mode == ssl.CERT_REQUIRED and sec_trust_result_type_as_int not in (1, 4) ): # Note that we're not able to ignore only hostname errors # for macOS 10.13 and earlier, so check_hostname=False will # still return an error. sec_trust_result_type_to_message = { 0: "Invalid trust result type", # 1: "Trust evaluation succeeded", 2: "User confirmation required", 3: "User specified that certificate is not trusted", # 4: "Trust result is unspecified", 5: "Recoverable trust failure occurred", 6: "Fatal trust failure occurred", 7: "Other error occurred, certificate may be revoked", } error_message = sec_trust_result_type_to_message.get( sec_trust_result_type_as_int, f"Unknown trust result: {sec_trust_result_type_as_int}", ) err = ssl.SSLCertVerificationError(error_message) err.verify_message = error_message err.verify_code = sec_trust_result_type_as_int raise err def _verify_peercerts_impl_macos_10_14( ssl_context: ssl.SSLContext, sec_trust_ref: typing.Any ) -> None: """Verify using 'SecTrustEvaluateWithError' API for macOS 10.14+.""" cf_error = CoreFoundation.CFErrorRef() sec_trust_eval_result = Security.SecTrustEvaluateWithError( sec_trust_ref, ctypes.byref(cf_error) ) # sec_trust_eval_result is a bool (0 or 1) # where 1 means that the certs are trusted. if sec_trust_eval_result == 1: is_trusted = True elif sec_trust_eval_result == 0: is_trusted = False else: raise ssl.SSLError( f"Unknown result from Security.SecTrustEvaluateWithError: {sec_trust_eval_result!r}" ) cf_error_code = 0 if not is_trusted: cf_error_code = CoreFoundation.CFErrorGetCode(cf_error) # If the error is a known failure that we're # explicitly okay with from SSLContext configuration # we can set is_trusted accordingly. if ssl_context.verify_mode != ssl.CERT_REQUIRED and ( cf_error_code == CFConst.errSecNotTrusted or cf_error_code == CFConst.errSecCertificateExpired ): is_trusted = True # If we're still not trusted then we start to # construct and raise the SSLCertVerificationError. if not is_trusted: cf_error_string_ref = None try: cf_error_string_ref = CoreFoundation.CFErrorCopyDescription(cf_error) # Can this ever return 'None' if there's a CFError? cf_error_message = ( _cf_string_ref_to_str(cf_error_string_ref) or "Certificate verification failed" ) # TODO: Not sure if we need the SecTrustResultType for anything? # We only care whether or not it's a success or failure for now. sec_trust_result_type = Security.SecTrustResultType() Security.SecTrustGetTrustResult( sec_trust_ref, ctypes.byref(sec_trust_result_type) ) err = ssl.SSLCertVerificationError(cf_error_message) err.verify_message = cf_error_message err.verify_code = cf_error_code raise err finally: if cf_error_string_ref: CoreFoundation.CFRelease(cf_error_string_ref) PK |�Z7F� _openssl.pynu �[��� import contextlib import os import re import ssl import typing # candidates based on https://github.com/tiran/certifi-system-store by Christian Heimes _CA_FILE_CANDIDATES = [ # Alpine, Arch, Fedora 34+, OpenWRT, RHEL 9+, BSD "/etc/ssl/cert.pem", # Fedora <= 34, RHEL <= 9, CentOS <= 9 "/etc/pki/tls/cert.pem", # Debian, Ubuntu (requires ca-certificates) "/etc/ssl/certs/ca-certificates.crt", # SUSE "/etc/ssl/ca-bundle.pem", ] _HASHED_CERT_FILENAME_RE = re.compile(r"^[0-9a-fA-F]{8}\.[0-9]$") @contextlib.contextmanager def _configure_context(ctx: ssl.SSLContext) -> typing.Iterator[None]: # First, check whether the default locations from OpenSSL # seem like they will give us a usable set of CA certs. # ssl.get_default_verify_paths already takes care of: # - getting cafile from either the SSL_CERT_FILE env var # or the path configured when OpenSSL was compiled, # and verifying that that path exists # - getting capath from either the SSL_CERT_DIR env var # or the path configured when OpenSSL was compiled, # and verifying that that path exists # In addition we'll check whether capath appears to contain certs. defaults = ssl.get_default_verify_paths() if defaults.cafile or (defaults.capath and _capath_contains_certs(defaults.capath)): ctx.set_default_verify_paths() else: # cafile from OpenSSL doesn't exist # and capath from OpenSSL doesn't contain certs. # Let's search other common locations instead. for cafile in _CA_FILE_CANDIDATES: if os.path.isfile(cafile): ctx.load_verify_locations(cafile=cafile) break yield def _capath_contains_certs(capath: str) -> bool: """Check whether capath exists and contains certs in the expected format.""" if not os.path.isdir(capath): return False for name in os.listdir(capath): if _HASHED_CERT_FILENAME_RE.match(name): return True return False def _verify_peercerts_impl( ssl_context: ssl.SSLContext, cert_chain: list[bytes], server_hostname: str | None = None, ) -> None: # This is a no-op because we've enabled SSLContext's built-in # verification via verify_mode=CERT_REQUIRED, and don't need to repeat it. pass PK |�Zi�\�j j _ssl_constants.pynu �[��� import ssl import sys import typing # Hold on to the original class so we can create it consistently # even if we inject our own SSLContext into the ssl module. _original_SSLContext = ssl.SSLContext _original_super_SSLContext = super(_original_SSLContext, _original_SSLContext) # CPython is known to be good, but non-CPython implementations # may implement SSLContext differently so to be safe we don't # subclass the SSLContext. # This is returned by truststore.SSLContext.__class__() _truststore_SSLContext_dunder_class: typing.Optional[type] # This value is the superclass of truststore.SSLContext. _truststore_SSLContext_super_class: type if sys.implementation.name == "cpython": _truststore_SSLContext_super_class = _original_SSLContext _truststore_SSLContext_dunder_class = None else: _truststore_SSLContext_super_class = object _truststore_SSLContext_dunder_class = _original_SSLContext def _set_ssl_context_verify_mode( ssl_context: ssl.SSLContext, verify_mode: ssl.VerifyMode ) -> None: _original_super_SSLContext.verify_mode.__set__(ssl_context, verify_mode) # type: ignore[attr-defined] PK |�ZQ� �IF IF _windows.pynu �[��� import contextlib import ssl import typing from ctypes import WinDLL # type: ignore from ctypes import WinError # type: ignore from ctypes import ( POINTER, Structure, c_char_p, c_ulong, c_void_p, c_wchar_p, cast, create_unicode_buffer, pointer, sizeof, ) from ctypes.wintypes import ( BOOL, DWORD, HANDLE, LONG, LPCSTR, LPCVOID, LPCWSTR, LPFILETIME, LPSTR, LPWSTR, ) from typing import TYPE_CHECKING, Any from ._ssl_constants import _set_ssl_context_verify_mode HCERTCHAINENGINE = HANDLE HCERTSTORE = HANDLE HCRYPTPROV_LEGACY = HANDLE class CERT_CONTEXT(Structure): _fields_ = ( ("dwCertEncodingType", DWORD), ("pbCertEncoded", c_void_p), ("cbCertEncoded", DWORD), ("pCertInfo", c_void_p), ("hCertStore", HCERTSTORE), ) PCERT_CONTEXT = POINTER(CERT_CONTEXT) PCCERT_CONTEXT = POINTER(PCERT_CONTEXT) class CERT_ENHKEY_USAGE(Structure): _fields_ = ( ("cUsageIdentifier", DWORD), ("rgpszUsageIdentifier", POINTER(LPSTR)), ) PCERT_ENHKEY_USAGE = POINTER(CERT_ENHKEY_USAGE) class CERT_USAGE_MATCH(Structure): _fields_ = ( ("dwType", DWORD), ("Usage", CERT_ENHKEY_USAGE), ) class CERT_CHAIN_PARA(Structure): _fields_ = ( ("cbSize", DWORD), ("RequestedUsage", CERT_USAGE_MATCH), ("RequestedIssuancePolicy", CERT_USAGE_MATCH), ("dwUrlRetrievalTimeout", DWORD), ("fCheckRevocationFreshnessTime", BOOL), ("dwRevocationFreshnessTime", DWORD), ("pftCacheResync", LPFILETIME), ("pStrongSignPara", c_void_p), ("dwStrongSignFlags", DWORD), ) if TYPE_CHECKING: PCERT_CHAIN_PARA = pointer[CERT_CHAIN_PARA] # type: ignore[misc] else: PCERT_CHAIN_PARA = POINTER(CERT_CHAIN_PARA) class CERT_TRUST_STATUS(Structure): _fields_ = ( ("dwErrorStatus", DWORD), ("dwInfoStatus", DWORD), ) class CERT_CHAIN_ELEMENT(Structure): _fields_ = ( ("cbSize", DWORD), ("pCertContext", PCERT_CONTEXT), ("TrustStatus", CERT_TRUST_STATUS), ("pRevocationInfo", c_void_p), ("pIssuanceUsage", PCERT_ENHKEY_USAGE), ("pApplicationUsage", PCERT_ENHKEY_USAGE), ("pwszExtendedErrorInfo", LPCWSTR), ) PCERT_CHAIN_ELEMENT = POINTER(CERT_CHAIN_ELEMENT) class CERT_SIMPLE_CHAIN(Structure): _fields_ = ( ("cbSize", DWORD), ("TrustStatus", CERT_TRUST_STATUS), ("cElement", DWORD), ("rgpElement", POINTER(PCERT_CHAIN_ELEMENT)), ("pTrustListInfo", c_void_p), ("fHasRevocationFreshnessTime", BOOL), ("dwRevocationFreshnessTime", DWORD), ) PCERT_SIMPLE_CHAIN = POINTER(CERT_SIMPLE_CHAIN) class CERT_CHAIN_CONTEXT(Structure): _fields_ = ( ("cbSize", DWORD), ("TrustStatus", CERT_TRUST_STATUS), ("cChain", DWORD), ("rgpChain", POINTER(PCERT_SIMPLE_CHAIN)), ("cLowerQualityChainContext", DWORD), ("rgpLowerQualityChainContext", c_void_p), ("fHasRevocationFreshnessTime", BOOL), ("dwRevocationFreshnessTime", DWORD), ) PCERT_CHAIN_CONTEXT = POINTER(CERT_CHAIN_CONTEXT) PCCERT_CHAIN_CONTEXT = POINTER(PCERT_CHAIN_CONTEXT) class SSL_EXTRA_CERT_CHAIN_POLICY_PARA(Structure): _fields_ = ( ("cbSize", DWORD), ("dwAuthType", DWORD), ("fdwChecks", DWORD), ("pwszServerName", LPCWSTR), ) class CERT_CHAIN_POLICY_PARA(Structure): _fields_ = ( ("cbSize", DWORD), ("dwFlags", DWORD), ("pvExtraPolicyPara", c_void_p), ) PCERT_CHAIN_POLICY_PARA = POINTER(CERT_CHAIN_POLICY_PARA) class CERT_CHAIN_POLICY_STATUS(Structure): _fields_ = ( ("cbSize", DWORD), ("dwError", DWORD), ("lChainIndex", LONG), ("lElementIndex", LONG), ("pvExtraPolicyStatus", c_void_p), ) PCERT_CHAIN_POLICY_STATUS = POINTER(CERT_CHAIN_POLICY_STATUS) class CERT_CHAIN_ENGINE_CONFIG(Structure): _fields_ = ( ("cbSize", DWORD), ("hRestrictedRoot", HCERTSTORE), ("hRestrictedTrust", HCERTSTORE), ("hRestrictedOther", HCERTSTORE), ("cAdditionalStore", DWORD), ("rghAdditionalStore", c_void_p), ("dwFlags", DWORD), ("dwUrlRetrievalTimeout", DWORD), ("MaximumCachedCertificates", DWORD), ("CycleDetectionModulus", DWORD), ("hExclusiveRoot", HCERTSTORE), ("hExclusiveTrustedPeople", HCERTSTORE), ("dwExclusiveFlags", DWORD), ) PCERT_CHAIN_ENGINE_CONFIG = POINTER(CERT_CHAIN_ENGINE_CONFIG) PHCERTCHAINENGINE = POINTER(HCERTCHAINENGINE) X509_ASN_ENCODING = 0x00000001 PKCS_7_ASN_ENCODING = 0x00010000 CERT_STORE_PROV_MEMORY = b"Memory" CERT_STORE_ADD_USE_EXISTING = 2 USAGE_MATCH_TYPE_OR = 1 OID_PKIX_KP_SERVER_AUTH = c_char_p(b"1.3.6.1.5.5.7.3.1") CERT_CHAIN_REVOCATION_CHECK_END_CERT = 0x10000000 CERT_CHAIN_REVOCATION_CHECK_CHAIN = 0x20000000 CERT_CHAIN_POLICY_IGNORE_ALL_NOT_TIME_VALID_FLAGS = 0x00000007 CERT_CHAIN_POLICY_IGNORE_INVALID_BASIC_CONSTRAINTS_FLAG = 0x00000008 CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAG = 0x00000010 CERT_CHAIN_POLICY_IGNORE_INVALID_NAME_FLAG = 0x00000040 CERT_CHAIN_POLICY_IGNORE_WRONG_USAGE_FLAG = 0x00000020 CERT_CHAIN_POLICY_IGNORE_INVALID_POLICY_FLAG = 0x00000080 CERT_CHAIN_POLICY_IGNORE_ALL_REV_UNKNOWN_FLAGS = 0x00000F00 CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG = 0x00008000 CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG = 0x00004000 SECURITY_FLAG_IGNORE_CERT_CN_INVALID = 0x00001000 AUTHTYPE_SERVER = 2 CERT_CHAIN_POLICY_SSL = 4 FORMAT_MESSAGE_FROM_SYSTEM = 0x00001000 FORMAT_MESSAGE_IGNORE_INSERTS = 0x00000200 # Flags to set for SSLContext.verify_mode=CERT_NONE CERT_CHAIN_POLICY_VERIFY_MODE_NONE_FLAGS = ( CERT_CHAIN_POLICY_IGNORE_ALL_NOT_TIME_VALID_FLAGS | CERT_CHAIN_POLICY_IGNORE_INVALID_BASIC_CONSTRAINTS_FLAG | CERT_CHAIN_POLICY_ALLOW_UNKNOWN_CA_FLAG | CERT_CHAIN_POLICY_IGNORE_INVALID_NAME_FLAG | CERT_CHAIN_POLICY_IGNORE_WRONG_USAGE_FLAG | CERT_CHAIN_POLICY_IGNORE_INVALID_POLICY_FLAG | CERT_CHAIN_POLICY_IGNORE_ALL_REV_UNKNOWN_FLAGS | CERT_CHAIN_POLICY_ALLOW_TESTROOT_FLAG | CERT_CHAIN_POLICY_TRUST_TESTROOT_FLAG ) wincrypt = WinDLL("crypt32.dll") kernel32 = WinDLL("kernel32.dll") def _handle_win_error(result: bool, _: Any, args: Any) -> Any: if not result: # Note, actually raises OSError after calling GetLastError and FormatMessage raise WinError() return args CertCreateCertificateChainEngine = wincrypt.CertCreateCertificateChainEngine CertCreateCertificateChainEngine.argtypes = ( PCERT_CHAIN_ENGINE_CONFIG, PHCERTCHAINENGINE, ) CertCreateCertificateChainEngine.errcheck = _handle_win_error CertOpenStore = wincrypt.CertOpenStore CertOpenStore.argtypes = (LPCSTR, DWORD, HCRYPTPROV_LEGACY, DWORD, c_void_p) CertOpenStore.restype = HCERTSTORE CertOpenStore.errcheck = _handle_win_error CertAddEncodedCertificateToStore = wincrypt.CertAddEncodedCertificateToStore CertAddEncodedCertificateToStore.argtypes = ( HCERTSTORE, DWORD, c_char_p, DWORD, DWORD, PCCERT_CONTEXT, ) CertAddEncodedCertificateToStore.restype = BOOL CertCreateCertificateContext = wincrypt.CertCreateCertificateContext CertCreateCertificateContext.argtypes = (DWORD, c_char_p, DWORD) CertCreateCertificateContext.restype = PCERT_CONTEXT CertCreateCertificateContext.errcheck = _handle_win_error CertGetCertificateChain = wincrypt.CertGetCertificateChain CertGetCertificateChain.argtypes = ( HCERTCHAINENGINE, PCERT_CONTEXT, LPFILETIME, HCERTSTORE, PCERT_CHAIN_PARA, DWORD, c_void_p, PCCERT_CHAIN_CONTEXT, ) CertGetCertificateChain.restype = BOOL CertGetCertificateChain.errcheck = _handle_win_error CertVerifyCertificateChainPolicy = wincrypt.CertVerifyCertificateChainPolicy CertVerifyCertificateChainPolicy.argtypes = ( c_ulong, PCERT_CHAIN_CONTEXT, PCERT_CHAIN_POLICY_PARA, PCERT_CHAIN_POLICY_STATUS, ) CertVerifyCertificateChainPolicy.restype = BOOL CertCloseStore = wincrypt.CertCloseStore CertCloseStore.argtypes = (HCERTSTORE, DWORD) CertCloseStore.restype = BOOL CertCloseStore.errcheck = _handle_win_error CertFreeCertificateChain = wincrypt.CertFreeCertificateChain CertFreeCertificateChain.argtypes = (PCERT_CHAIN_CONTEXT,) CertFreeCertificateContext = wincrypt.CertFreeCertificateContext CertFreeCertificateContext.argtypes = (PCERT_CONTEXT,) CertFreeCertificateChainEngine = wincrypt.CertFreeCertificateChainEngine CertFreeCertificateChainEngine.argtypes = (HCERTCHAINENGINE,) FormatMessageW = kernel32.FormatMessageW FormatMessageW.argtypes = ( DWORD, LPCVOID, DWORD, DWORD, LPWSTR, DWORD, c_void_p, ) FormatMessageW.restype = DWORD def _verify_peercerts_impl( ssl_context: ssl.SSLContext, cert_chain: list[bytes], server_hostname: str | None = None, ) -> None: """Verify the cert_chain from the server using Windows APIs.""" # If the peer didn't send any certificates then # we can't do verification. Raise an error. if not cert_chain: raise ssl.SSLCertVerificationError("Peer sent no certificates to verify") pCertContext = None hIntermediateCertStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, None, 0, None) try: # Add intermediate certs to an in-memory cert store for cert_bytes in cert_chain[1:]: CertAddEncodedCertificateToStore( hIntermediateCertStore, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, cert_bytes, len(cert_bytes), CERT_STORE_ADD_USE_EXISTING, None, ) # Cert context for leaf cert leaf_cert = cert_chain[0] pCertContext = CertCreateCertificateContext( X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, leaf_cert, len(leaf_cert) ) # Chain params to match certs for serverAuth extended usage cert_enhkey_usage = CERT_ENHKEY_USAGE() cert_enhkey_usage.cUsageIdentifier = 1 cert_enhkey_usage.rgpszUsageIdentifier = (c_char_p * 1)(OID_PKIX_KP_SERVER_AUTH) cert_usage_match = CERT_USAGE_MATCH() cert_usage_match.Usage = cert_enhkey_usage chain_params = CERT_CHAIN_PARA() chain_params.RequestedUsage = cert_usage_match chain_params.cbSize = sizeof(chain_params) pChainPara = pointer(chain_params) if ssl_context.verify_flags & ssl.VERIFY_CRL_CHECK_CHAIN: chain_flags = CERT_CHAIN_REVOCATION_CHECK_CHAIN elif ssl_context.verify_flags & ssl.VERIFY_CRL_CHECK_LEAF: chain_flags = CERT_CHAIN_REVOCATION_CHECK_END_CERT else: chain_flags = 0 try: # First attempt to verify using the default Windows system trust roots # (default chain engine). _get_and_verify_cert_chain( ssl_context, None, hIntermediateCertStore, pCertContext, pChainPara, server_hostname, chain_flags=chain_flags, ) except ssl.SSLCertVerificationError as e: # If that fails but custom CA certs have been added # to the SSLContext using load_verify_locations, # try verifying using a custom chain engine # that trusts the custom CA certs. custom_ca_certs: list[bytes] | None = ssl_context.get_ca_certs( binary_form=True ) if custom_ca_certs: try: _verify_using_custom_ca_certs( ssl_context, custom_ca_certs, hIntermediateCertStore, pCertContext, pChainPara, server_hostname, chain_flags=chain_flags, ) # Raise the original error, not the new error. except ssl.SSLCertVerificationError: raise e from None else: raise finally: CertCloseStore(hIntermediateCertStore, 0) if pCertContext: CertFreeCertificateContext(pCertContext) def _get_and_verify_cert_chain( ssl_context: ssl.SSLContext, hChainEngine: HCERTCHAINENGINE | None, hIntermediateCertStore: HCERTSTORE, pPeerCertContext: c_void_p, pChainPara: PCERT_CHAIN_PARA, # type: ignore[valid-type] server_hostname: str | None, chain_flags: int, ) -> None: ppChainContext = None try: # Get cert chain ppChainContext = pointer(PCERT_CHAIN_CONTEXT()) CertGetCertificateChain( hChainEngine, # chain engine pPeerCertContext, # leaf cert context None, # current system time hIntermediateCertStore, # additional in-memory cert store pChainPara, # chain-building parameters chain_flags, None, # reserved ppChainContext, # the resulting chain context ) pChainContext = ppChainContext.contents # Verify cert chain ssl_extra_cert_chain_policy_para = SSL_EXTRA_CERT_CHAIN_POLICY_PARA() ssl_extra_cert_chain_policy_para.cbSize = sizeof( ssl_extra_cert_chain_policy_para ) ssl_extra_cert_chain_policy_para.dwAuthType = AUTHTYPE_SERVER ssl_extra_cert_chain_policy_para.fdwChecks = 0 if ssl_context.check_hostname is False: ssl_extra_cert_chain_policy_para.fdwChecks = ( SECURITY_FLAG_IGNORE_CERT_CN_INVALID ) if server_hostname: ssl_extra_cert_chain_policy_para.pwszServerName = c_wchar_p(server_hostname) chain_policy = CERT_CHAIN_POLICY_PARA() chain_policy.pvExtraPolicyPara = cast( pointer(ssl_extra_cert_chain_policy_para), c_void_p ) if ssl_context.verify_mode == ssl.CERT_NONE: chain_policy.dwFlags |= CERT_CHAIN_POLICY_VERIFY_MODE_NONE_FLAGS chain_policy.cbSize = sizeof(chain_policy) pPolicyPara = pointer(chain_policy) policy_status = CERT_CHAIN_POLICY_STATUS() policy_status.cbSize = sizeof(policy_status) pPolicyStatus = pointer(policy_status) CertVerifyCertificateChainPolicy( CERT_CHAIN_POLICY_SSL, pChainContext, pPolicyPara, pPolicyStatus, ) # Check status error_code = policy_status.dwError if error_code: # Try getting a human readable message for an error code. error_message_buf = create_unicode_buffer(1024) error_message_chars = FormatMessageW( FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, None, error_code, 0, error_message_buf, sizeof(error_message_buf), None, ) # See if we received a message for the error, # otherwise we use a generic error with the # error code and hope that it's search-able. if error_message_chars <= 0: error_message = f"Certificate chain policy error {error_code:#x} [{policy_status.lElementIndex}]" else: error_message = error_message_buf.value.strip() err = ssl.SSLCertVerificationError(error_message) err.verify_message = error_message err.verify_code = error_code raise err from None finally: if ppChainContext: CertFreeCertificateChain(ppChainContext.contents) def _verify_using_custom_ca_certs( ssl_context: ssl.SSLContext, custom_ca_certs: list[bytes], hIntermediateCertStore: HCERTSTORE, pPeerCertContext: c_void_p, pChainPara: PCERT_CHAIN_PARA, # type: ignore[valid-type] server_hostname: str | None, chain_flags: int, ) -> None: hChainEngine = None hRootCertStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, None, 0, None) try: # Add custom CA certs to an in-memory cert store for cert_bytes in custom_ca_certs: CertAddEncodedCertificateToStore( hRootCertStore, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, cert_bytes, len(cert_bytes), CERT_STORE_ADD_USE_EXISTING, None, ) # Create a custom cert chain engine which exclusively trusts # certs from our hRootCertStore cert_chain_engine_config = CERT_CHAIN_ENGINE_CONFIG() cert_chain_engine_config.cbSize = sizeof(cert_chain_engine_config) cert_chain_engine_config.hExclusiveRoot = hRootCertStore pConfig = pointer(cert_chain_engine_config) phChainEngine = pointer(HCERTCHAINENGINE()) CertCreateCertificateChainEngine( pConfig, phChainEngine, ) hChainEngine = phChainEngine.contents # Get and verify a cert chain using the custom chain engine _get_and_verify_cert_chain( ssl_context, hChainEngine, hIntermediateCertStore, pPeerCertContext, pChainPara, server_hostname, chain_flags, ) finally: if hChainEngine: CertFreeCertificateChainEngine(hChainEngine) CertCloseStore(hRootCertStore, 0) @contextlib.contextmanager def _configure_context(ctx: ssl.SSLContext) -> typing.Iterator[None]: check_hostname = ctx.check_hostname verify_mode = ctx.verify_mode ctx.check_hostname = False _set_ssl_context_verify_mode(ctx, ssl.CERT_NONE) try: yield finally: ctx.check_hostname = check_hostname _set_ssl_context_verify_mode(ctx, verify_mode) PK |�Z py.typednu �[��� PK |�Z�Rt� � __init__.pynu �[��� PK |�Z��.�� � $ + __pycache__/__init__.cpython-311.pycnu �[��� PK |�Z��Z�,F ,F V __pycache__/_api.cpython-311.pycnu �[��� PK |�Z!���M �M " �Q __pycache__/_macos.cpython-311.pycnu �[��� PK |�Z~�n;> > $ �� __pycache__/_openssl.cpython-311.pycnu �[��� PK |�Zy.�u u * 9� __pycache__/_ssl_constants.cpython-311.pycnu �[��� PK |�Z8�̜D �D $ � __pycache__/_windows.cpython-311.pycnu �[��� PK |�Z�*;) ;) �� _api.pynu �[��� PK |�Z�7�NP P j _macos.pynu �[��� PK |�Z7F� �l _openssl.pynu �[��� PK |�Zi�\�j j v _ssl_constants.pynu �[��� PK |�ZQ� �IF IF �z _windows.pynu �[��� PK |�Z 8� py.typednu �[��� PK b p�
| ver. 1.4 |
Github
|
.
| PHP 8.1.31 | Генерация страницы: 0 |
proxy
|
phpinfo
|
Настройка