/var/opt/nydus/ops/oscrypto/__pycache__
Edit: /var/opt/nydus/ops/oscrypto/__pycache__/_tls.cpython-312.pyc (17307B)
N jE d dl mZmZmZmZ d dlZd dlmZ ddlmZm Z m
Z
ddl m Z ddl
mZmZmZ g dZd Zd
Zd Zd Zd
Zd Zd Zd Zd Zd Zd Z d Z d Z d Z d Z d Z!d Z"d Z#d Z$d Z%d Z&d Z'd Z(y) )unicode_literalsdivisionabsolute_importprint_functionN)datetime ) Certificateint_from_bytestimezone)CIPHER_SUITE_MAP)TLSVerificationErrorTLSDisconnectErrorTLSError)detect_client_auth_request
extract_chainget_dh_params_length parse_alertparse_handshake_messagesparse_session_infoparse_tls_recordsraise_client_authraise_dh_paramsraise_disconnectionraise_expired_not_yet_validraise_handshakeraise_hostnameraise_no_issuerraise_protocol_error
raise_revokedraise_self_signedraise_verificationraise_weak_signaturec P g }d}t | D ], \ }}}|dk7 r
t | D ] \ }}|dk( s |} n |s, n |red}|t | k rUt |||dz } |dz }
|
| z } | }||
| } |j t j | |t | k rU|S )a
Extracts the X.509 certificates from the server handshake bytes for use
when debugging
:param server_handshake_bytes:
A byte string of the handshake data received from the server
:return:
A list of asn1crypto.x509.Certificate objects
N )r r lenr
appendr load)
server_handshake_bytesoutput chain_bytes record_type_ record_data message_type message_datapointer cert_length
cert_startcert_end
cert_bytess
>/opt/nydus/tmp/pip-target-a90h98xg/lib/python/oscrypto/_tls.pyr r # s FK'89O'P# Q ' ! *B;*O &L,w& * +P (Q K(((WWq[)IJK 1J!K/H G$Z9J MM+**:6 7
K(( M c n t | D ]' \ }}}|dk7 r
t | D ]
\ }}|dk( s y ) y)a)
Determines if a CertificateRequest message is sent from the server asking
the client for a certificate
:param server_handshake_bytes:
A byte string of the handshake data received from the server
:return:
A boolean - if a client certificate request was found
r$
TF)r r )r* r- r. r/ r0 r1 s r7 r r K sL (99O'P# Q ' ! *B;*O &L,w& +P (Q r8 c d}d}t | D ], \ }}}|dk7 r
t | D ] \ }}|dk( s |} n |s, n |rt |dd dz }|S )a
Determines the length of the DH params from the ServerKeyExchange
:param server_handshake_bytes:
A byte string of the handshake data received from the server
:return:
None or an integer of the bit size of the DH parameters
Nr$ r )r r r
)r* r+ dh_params_bytesr- r. r/ r0 r1 s r7 r r ` s~ FO'89O'P# Q ' ! *B;*O &L,w&". +P (Q ! 459 Mr8 c t | D ]9 \ }}}|dk7 r
t | dk7 r yt |dd t |dd fc S y)aV
Parses the handshake for protocol alerts
:param server_handshake_bytes:
A byte string of the handshake data received from the server
:return:
None or an 2-element tuple of integers:
0: 1 (warning) or 2 (fatal)
1: The alert description (see https://tools.ietf.org/html/rfc5246#section-7.2)
r= Nr r )r r' r
)r* r- r. r/ s r7 r r s_ (99O'P# Q ' ! { q {1Q /0.QqAQ2RSS (Q r8 c d}d}d}d}d}d}d}t | D ] \ } }
} | dk7 r
t | D ] \ } }
| dk7 r ddddd d
|
d d }t |
d
d }|d kD r|
dd|z }d|z }|
||d z }t | }|d z }|
||dz dk7 }|dz }|
|d }t | D ] \ }}|dk( s d} n t | D ] \ } }
} | dk7 r
t | D ] \ } }
| dk7 r t |
d
d }|d kD r|
dd|z }d|z }t |
||d z }|d z |z }t |
||dz }|+|)|dz |z }|
|d }t | D ] \ }}|dk( s d} n ||d}n
||k7 rd}nd}|||||dS )a
Parse the TLS handshake from the client to the server to extract information
including the cipher suite selected, if compression is enabled, the
session id and if a new or reused session ticket exists.
:param server_handshake_bytes:
A byte string of the handshake data received from the server
:param client_handshake_bytes:
A byte string of the handshake data sent to the server
:return:
A dict with the following keys:
- "protocol": unicode string
- "cipher_suite": unicode string
- "compression": boolean
- "session_id": "new", "reused" or None
- "session_ticket: "new", "reused" or None
NFr$ SSLv3TLSv1zTLSv1.1zTLSv1.2zTLSv1.3)s s s s s r r= " # r new reused)protocol cipher_suite compression
session_idsession_ticket)r r r
r _parse_hello_extensions)r* client_handshake_bytesrL rM rN rO rP server_session_idclient_session_idr- r. r/ r0 r1 session_id_lengthcipher_suite_startcipher_suite_bytescompression_startextensions_length_startextensions_dataextension_typeextension_datacipher_suite_lengthcompression_lengths r7 r r s * HLKJN '89O'P# Q ' ! *B;*O &L,w& $ $ & & & 1Q
!H !/|Br/B C 1$$0B9J4J$K!!#&7!7 !-.@ASVWAW!X +,>?L 2Q 6 &'89JQ9NOSZZK&7!&; # *+B+C DO2I/2Z.!R'%*N 3[
; +P (QD (99O'P# Q ' ! *B;*O &L,w& .|Br/B C 1$$0B9J4J$K!!#&7!7 "0 >PQcfgQg1h"i 2Q 69L L !/ =NO`cdOd0e!f !(^-C*;a*?BT*T'"./F/G"H6Mo6^2NN%+)1 7_
1 +P (Q: $ $ J $55 "
%
$" ( r8 c # K d}t | }||k rQ| ||dz dk( ryt | |dz |dz }| ||dz | |dz |dz | |dz |dz |z f |d|z z
}||k rPyyw)a
Creates a generator returning tuples of information about each record
in a byte string of data from a TLS client or server. Stops as soon as it
find a ChangeCipherSpec message since all data from then on is encrypted.
:param data:
A byte string of TLS records
:return:
A generator that yields 3-element tuples:
[0] Byte string of record type
[1] Byte string of protocol version
[2] Byte string of record data
r r r& Nr' r
datar2 data_lenlengths r7 r r s G4yH
H
! $ / Wq[1 => 1 % 1Wq[ ) 1Wq[6 1 2
1v: H
s A"A'%A'c # K d}t | }||k r;t | |dz |dz }| ||dz | |dz |dz |z f |d|z z
}||k r:yyw)a`
Creates a generator returning tuples of information about each message in
a byte string of data from a TLS handshake record
:param data:
A byte string of a TLS handshake record data
:return:
A generator that yields 2-element tuples:
[0] Byte string of message type
[1] Byte string of message data
r r Nrb rc s r7 r r # s G4yH
H
Wq[1 => 1 % 1Wq[6 1 2
1v:
H
s A AAc # K | dk( ryt | dd }d}d|z }|}||k rFt | ||dz }t | |dz |dz }|| |dz |dz |z f |d|z z
}||k rEyyw)a
Creates a generator returning tuples of information about each extension
from a byte string of extension data contained in a ServerHello ores
ClientHello message
:param data:
A byte string of a extension data from a TLS ServerHello or ClientHello
message
:return:
A generator that yields 2-element tuples:
[0] Byte string of extension type
[1] Byte string of extension data
r8 Nr r= rh )r
)rd extentions_lengthextensions_startextensions_endr2 r[ extension_lengths r7 rQ rQ < s s{&tAay1**N G
N
"'WWq[(AB)$w{7Q;*GH 1Wq[+; ; <
1''' N
"s A'A,*A,c < t j d| xs |j d dk7 }|rd|z }nd|z }d|z }dj | j }dj | j
}|r|d|z z
}|r|r|d z
}|r|d
|z z
}t
|| ) z
Raises a TLSVerificationError due to a hostname mismatch
:param certificate:
An asn1crypto.x509.Certificate object
:raises:
TLSVerificationError
z^\d+\.\d+\.\d+\.\d+$:z
IP address %szdomain name %sz:Server certificate verification failed - %s does not matchz, z valid domains: %sz orz valid IP addresses: %s)rematchfindjoin valid_ips
valid_domainsr
) certificatehostnameis_ip
hostname_typemessageru rv s r7 r r ^ s
HH2H = Y sASWYAYE '(2
(83
J]ZG +//0IIIk 7 78M'-775,y88
w
44r8 c d}t || )z
Raises a generic TLSVerificationError
:param certificate:
An asn1crypto.x509.Certificate object
:raises:
TLSVerificationError
z&Server certificate verification failedr
rw r{ s r7 r! r! z s 7G
w
44r8 c d}t || )z
Raises a TLSVerificationError when a certificate uses a weak signature
algorithm
:param certificate:
An asn1crypto.x509.Certificate object
:raises:
TLSVerificationError
zMServer certificate verification failed - weak certificate signature algorithmr} r~ s r7 r" r" s ^G
w
44r8 c d} t | )zg
Raises a TLSError indicating client authentication is required
:raises:
TLSError
z5TLS handshake failed - client authentication requiredr )r{ s r7 r r s FG
7
r8 c d}t || )z
Raises a TLSVerificationError due to the certificate being revoked
:param certificate:
An asn1crypto.x509.Certificate object
:raises:
TLSVerificationError
zEServer certificate verification failed - certificate has been revokedr} r~ s r7 r r s VG
w
44r8 c d}t || )z
Raises a TLSVerificationError due to no issuer certificate found in trust
roots
:param certificate:
An asn1crypto.x509.Certificate object
:raises:
TLSVerificationError
zgServer certificate verification failed - certificate issuer not found in trusted root certificate storer} r~ s r7 r r s xG
w
44r8 c d}t || )z
Raises a TLSVerificationError due to a self-signed certificate
roots
:param certificate:
An asn1crypto.x509.Certificate object
:raises:
TLSVerificationError
zCServer certificate verification failed - certificate is self-signedr} r~ s r7 r r s TG
w
44r8 c d}t || )z
Raises a TLSVerificationError due to a certificate lifetime exceeding
the CAB forum certificate lifetime limit
:param certificate:
An asn1crypto.x509.Certificate object
:raises:
TLSVerificationError
zIServer certificate verification failed - certificate lifetime is too longr} r~ s r7 raise_lifetime_too_longr s ZG
w
44r8 c | d d }|d j }|d j }t j t j }||kD r|j d }d|z }n||k r|j d }d|z }t
| )z
Raises a TLSVerificationError due to certificate being expired, or not yet
being valid
:param certificate:
An asn1crypto.x509.Certificate object
:raises:
TLSVerificationError
tbs_certificatevalidity not_after
not_beforez%Y-%m-%d %H:%M:%SZzGServer certificate verification failed - certificate not valid until %sz?Server certificate verification failed - certificate expired %s)nativer nowr utcstrftimer
)rw r r r r formatted_beforer{ formatted_afters r7 r r s ,-j9H%,,I,'..J
,,x||
$CC%../CD[^nn S #,,-ABSVee
w
44r8 c t d )ze
Raises a TLSDisconnectError due to a disconnection
:raises:
TLSDisconnectError
z$The remote end closed the connection)r r8 r7 r r s C
DDr8 c N t | }|rt d|z t d )z
Raises a TLSError due to a protocol error
:param server_handshake_bytes:
A byte string of the handshake data received from the server
:raises:
TLSError
z.TLS protocol error - server responded using %sz@TLS protocol error - server responded using a different protocol)detect_other_protocolr )r* other_protocols r7 r r s/ ++ABNG.XYY
U
VVr8 c t d )zS
Raises a TLSError due to a handshake error
:raises:
TLSError
zTLS handshake failedr r r8 r7 r r s )
**r8 c t d )z_
Raises a TLSError due to a TLS version incompatibility
:raises:
TLSError
z-TLS handshake failed - protocol version errorr r r8 r7 raise_protocol_versionr ) s B
CCr8 c t d )zP
Raises a TLSError due to weak DH params
:raises:
TLSError
z)TLS handshake failed - weak DH parametersr r r8 r7 r r 4 s >
??r8 c | dd dk( ry| dd dk( r't j d| t j ryy | dd d
k( ry| dd d k( ry | dd d
k( s| dd dk( ryy)a
Looks at the server handshake bytes to try and detect a different protocol
:param server_handshake_bytes:
A byte string of the handshake data received from the server
:return:
None, or a unicode string of "ftp", "http", "imap", "pop3", "smtp"
r ra s HTTP/HTTPrh s 220 s
^[^
]*ftpFTPSMTPs 220-s +OK POP3s * OK s * PREAUTHIMAPN)rq rr I)r* s r7 r r ? s a"h. a"g-
88O%;RTT B a"g- a"g- a"g-1G!1LP\1\ r8 ))
__future__r r r r rq r _asn1r r
r _cipher_suitesr errorsr
r r __all__r r r r r r r rQ r r! r" r r r r r r r r r r r r r r8 r7
r s R R 8 8 , F F .%P* >,l^ > 2 (D58 5
5 5
5
5
5 58EW&+D@ r8