File: //usr/lib64/python2.7/site-packages/mercurial/sslutil.pyo
�
1�3\c @@ s� d d l m Z d d l Z d d l Z d d l Z d d l Z d d l m Z d d l m Z m
Z
m Z m Z d d l
m Z m Z d d d h Z e e d
e � Z d h Z e j e d � r� e j d � n e j e d � r� e j d � n y% e j Z e Z e j e d
� Z Wn3 e k
rPe Z e Z d e f d � � YZ n Xd � Z d � Z d d � Z d d d e d � Z! d e" f d � � YZ# d d � Z$ d � Z% d � Z& d d g Z' d � Z( d � Z) d S( i ( t absolute_importNi ( t _( t errort nodet pycompatt util( t procutilt
stringutils tls1.0s tls1.1s tls1.2t HAS_SNIt PROTOCOL_TLSv1_1t PROTOCOL_TLSv1_2t load_default_certst
SSLContextc B@ sV e Z d � Z d d d � Z d d � Z d d d d � Z d � Z d e d � Z RS( c C@ sX | | _ t | _ d | _ t j | _ d | _ d | _ d | _
d | _ d | _ d S( Ni (
t protocolt Falset check_hostnamet optionst sslt CERT_NONEt verify_modet Nonet _certfilet _keyfilet
_certpasswordt _cacertst _ciphers( t selfR
( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt __init__A s c C@ s | | _ | | _ | | _ d S( N( R R R ( R t certfilet keyfilet password( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt load_cert_chainO s c C@ s d S( N( ( R t purpose( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyR T s c C@ sI | r t j t d � � � n | r< t j t d � � � n | | _ d S( Ns capath not supporteds cadata not supported( R t AbortR R ( R t cafilet capatht cadata( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt load_verify_locationsW s
c C@ s
| | _ d S( N( R ( R t ciphers( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt set_ciphers_ s c C@ sY i | j d 6| j d 6| d 6| j d 6| j d 6| j d 6| j d 6} t j | | � S( NR R t server_sidet cert_reqst ssl_versiont ca_certsR& ( R R R R
R R R t wrap_socket( R t sockett server_hostnameR( t args( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyR, b s
N(
t __name__t
__module__R R R R R% R' R R, ( ( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyR @ s c
C@ sT t j | � } i
t d 6g d 6d* d 6t d 6t d 6d* d 6d* d 6d* d 6d* d 6d* d
6} d � } d t k ry d } n2 | j d
d � s� | j t d � | � n d } d } | j d
| | � } | | | � d | } | j d
| | � } | | | � | j
rd } n t | � \ | d <| d <| d <| j d
d
� } | j d
d | | � } | | d
<| j d
d | � } x� | D]� }
|
j
d+ � s�t j t d � | |
f d t d � �� n |
j d d � \ } }
|
j d d � j � }
| d j | |
f � q�WxS | j d | � D]? }
|
j d d � j � }
| d j d |
f � t | d <q%W| d r�t j | d <t | d <n- | j
r�t | d <t j | d <t | d <n | j d d! � r�t | d <n | j d
d" | � } | d r| r| j t d# � | � n | d d* k rP| r�t j | � } t j j | � sxt j t d$ � d% | f | f � � n | | d <n� | j d& d' � } | r�t j | � } t j j | � st j t d( � | � � qn3 | d rt | � } | r| j d) | � qn | | d <| s0t r@| d r@t j | d <qPt j | d <n | S(, sh Obtain security settings for a hostname.
Returns a dict of settings relevant to that hostname.
t allowloaddefaultcertst certfingerprintsR" t disablecertverificationt legacyfingerprintR
t
protocoluit
verifymodet
ctxoptionsR& c S@ sQ | t k rM t j t d � | | f d t d � d j t t � � �� n d S( Ns- unsupported protocol from hostsecurity.%s: %st hints valid protocols: %st ( t configprotocolsR R! R t joint sorted( R
t key( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt validateprotocol� s
s tls1.1t hostsecurityt disabletls10warnings� warning: connecting to %s using legacy security technology (TLS 1.0); see https://mercurial-scm.org/wiki/SecureConnections for more info
s tls1.0t minimumprotocols %s:minimumprotocols
%s:cipherss %s:fingerprintss sha1:s sha256:s sha512:s invalid fingerprint for %s: %sR9 s0 must begin with "sha1:", "sha256:", or "sha512:"t :i t t hostfingerprintst sha1t develt disableloaddefaultcertss %s:verifycertsfiless (hostsecurity.%s:verifycertsfile ignored when host fingerprints defined; using host fingerprints for verification)
s' path specified by %s does not exist: %ss hostsecurity.%s:verifycertsfilet webt cacertss could not find web.cacerts: %ss using %s for CA file
N( s sha1:s sha256:s sha512:( R t bytesurlt TrueR R t supportedprotocolst
configboolt warnR t configt insecureconnectionst protocolsettingst
configlistt
startswithR R! t splitt replacet lowert appendR R R t
expandpatht ost patht existst _defaultcacertst debugt _canloaddefaultcertst
CERT_REQUIRED(
t uit hostnamet bhostnamet sR? t defaultprotocolR> R
R& t fingerprintst fingerprintt algR" ( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt
_hostsettingss s�
!
c C@ s | t k r t d | � � n t d h k rr | d k rb t j t d � | d t d � �� n t j d d f St j t j B} | d k r� nT | d k r� | t j
O} n8 | d k r� | t j
t j BO} n t j t d � � � | t t d
d � O} t j
| | f S( s� Resolve the protocol for a config value.
Returns a 3-tuple of (protocol, options, ui value) where the first
2 items are values used by SSLContext and the last is a string value
of the ``minimumprotocol`` config option equivalent.
s protocol value not supported: %ss tls1.0s3 current Python does not support protocol setting %sR9 sA upgrade Python or disable setting since only TLS 1.0 is supportedi s tls1.1s tls1.2s this should not happent OP_NO_COMPRESSION( R; t
ValueErrorRM R R! R R t PROTOCOL_TLSv1t OP_NO_SSLv2t OP_NO_SSLv3t OP_NO_TLSv1t
OP_NO_TLSv1_1t getattrt PROTOCOL_SSLv23( R
R ( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyRR s$
c
@ s: | s t j t d � � � n xd � � f D]V } | r+ t j j | � r+ t j t d � | t j | � f d t d � �� q+ q+ Wt � | � } t | d � } | j
| d O_
| d | _ | d rEy | j t j
| d � � WqEt j k
rA} t j t d � t j | j d
� d t d � | d �� qEXn � d% k r|� � � f d � } | j � � | � n | d
d% k r0y | j d
| d
� Wn� t j k
r&} t | j � d k r�| j d
}
n
| j d }
t j t d � | d
t j |
� f d t d � �� n Xt } n# | d rM| j � t } n t } y | j | d | �} Wn~t j k
r�} yF | r�| d t j k r�t r�| j � r�� j t d � � n Wn t j k
r�n Xt j | d � r�| j! d k r�| d d k rgt" d h k rM� j t d � | d j# t$ t" � � f � q�� j t d � | � q�� j t d � | d | f � � j t d � | � � j t d � � q�| j! d k r�t j% r�� j t d � � q�n � n X| j& � st j t d � � � n i | d! 6| d" 6| d# 6� d$ 6| _' | S(& s� Add SSL/TLS to a socket.
This is a glorified wrapper for ``ssl.wrap_socket()``. It makes sane
choices based on what security options are available.
In addition to the arguments supported by ``ssl.wrap_socket``, we allow
the following additional arguments:
* serverhostname - The expected hostname of the remote server. If the
server (and client) support SNI, this tells the server which certificate
to use.
s# serverhostname argument is requireds: certificate file (%s) does not exist; cannot connect to %sR9 s: restore missing file or fix references in Mercurial configR
R8 R7 R& s could not set ciphers: %si s# change cipher string (%s) in configc @ s& � p � } � j t d � | d � S( Ns passphrase for %s: RD ( t getpassR ( t f( R R Ra ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyR � s R" i s error loading CA file %s: %ss file is empty or malformed?R2 R. s� (an attempt was made to load CA certificates but none were loaded; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error)
t reasont UNSUPPORTED_PROTOCOLR6 s tls1.0s� (could not communicate with %s using security protocols %s; if you are using a modern Mercurial version, consider contacting the operator of this server; see https://mercurial-scm.org/wiki/SecureConnections for more info)
s , s� (could not communicate with %s using TLS 1.0; the likely cause of this is the server no longer supports TLS 1.0 because it has known security vulnerabilities; see https://mercurial-scm.org/wiki/SecureConnections for more info)
s� (could not negotiate a common security protocol (%s+) with %s; the likely cause is Mercurial is configured to be more secure than the server can support)
s� (consider contacting the operator of this server and ask them to support modern TLS protocol versions; or, set hostsecurity.%s:minimumprotocol=tls1.0 to allow use of legacy, less secure protocols when communicating with this server)
sE (see https://mercurial-scm.org/wiki/SecureConnections for more info)
t CERTIFICATE_VERIFY_FAILEDsR (the full certificate chain may not be available locally; see "hg help debugssl")
s ssl connection failedt caloadedRb t settingsRa N(( R R! R RZ R[ R\ R RK Ri R R R R' t sysstrR t SSLErrorR t forcebytestrR/ R R R% t lenRL R R R, R` t modernsslt get_ca_certsRO R t safehasattrRu RM R< R= t iswindowst ciphert _hgstate(
t sockR R Ra t serverhostnameRt Ry t
sslcontextt eR t msgRx t sslsocket( ( R R Ra s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt
wrapsocketO s�
c C@ sC xL | | | f D]; } | r t j j | � r t j t d � | � � q q Wt d � \ } } } | j d d � }
|
d k r� t j } n� |
d k r� d t
k r� t j t d � � � n t j } n^ |
d k rd t
k r� t j t d � � � n t j } n" |
r(t j t d � |
� � n t
r�t | � } | j | O_ | j t t d
d � O_ | j t t d d � O_ t j t d
� r�| j t t d d � O_ | j t j � q�n t t j � } | r�t j | _ n t j | _ | s�| r| j d | d | � n | r0| j d | � n | j | d t �S( s� Wrap a socket for use by servers.
``certfile`` and ``keyfile`` specify the files containing the certificate's
public and private keys, respectively. Both keys can be defined in the same
file via ``certfile`` (the private key must come first in the file).
``cafile`` defines the path to certificate authorities.
``requireclientcert`` specifies whether to require client certificates.
Typically ``cafile`` is only defined if ``requireclientcert`` is true.
s/ referenced certificate file (%s) does not exists tls1.0RG t serverexactprotocols tls1.1s$ TLS 1.1 not supported by this Pythons tls1.2s$ TLS 1.2 not supported by this Pythons) invalid value for serverexactprotocol: %st OP_SINGLE_DH_USEi t OP_SINGLE_ECDH_USEt _RESTRICTED_SERVER_CIPHERSt OP_CIPHER_SERVER_PREFERENCER R R" R( ( RZ R[ R\ R R! R RR RP R Rl RM R R
R~ R R Rq R R� R' R� R` R R R R% R, RL ( R� Ra R R R" t requireclientcertRt R
R t _protocoluit
exactprotocolR� ( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt wrapserversocket� sH
t
wildcarderrorc B@ s e Z d Z RS( s2 Represents an error parsing wildcards in DNS name.( R0 R1 t __doc__( ( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyR� D s c
C@ sv g } | s t St j | � } t j | � } | j d � } | d } | d } | j d � } | | k r� t t d � | � � n | s� | j � | j � k S| d k r� | j d � nY | j d � s� | j d � r� | j t
j | � � n" | j t
j | � j d d � � x$ | D] } | j t
j | � � q Wt
j d
d j | � d t
j � } | j | � d
k S( s� Match DNS names according RFC 6125 section 6.4.3.
This code is effectively copied from CPython's ssl._dnsname_match.
Returns a bool indicating whether the expected hostname matches
the value in ``dn``.
t .i i t *s. too many wildcards in certificate DNS name: %ss [^.]+s xn--s \*s [^.]*s \As \.s \ZN( R R RK RU t countR� R RW RX RT R t reescapeRV t ret compileR< t
IGNORECASEt matchR (
t dnRb t maxwildcardst patst piecest leftmostt remaindert wildcardst fragt pat( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt
_dnsnamematchG s.
"
&c C@ s� | s t d � Sg } | j d g � } xn | D]f \ } } | d k r/ y t | | � r] d SWn$ t k
r� } t j | j d � SX| j | � q/ q/ W| s^x� | j d g � D]� } x� | D]� \ } } | d k r� y | j d � } Wn t k
rt d � SXy t | | � rd SWn$ t k
rB} t j | j d � SX| j | � q� q� Wq� Wn g | D] } t
j | � ^ qe} t | � d
k r�t d � d j
| � St | � d
k r�t d � | d St d
� Sd S( s� Verify that cert (in socket.getpeercert() format) matches hostname.
CRLs is not handled.
Returns error message if any problems are found and None on success.
s no certificate receivedt subjectAltNamet DNSNi t subjectt
commonNamet asciis IDN in certificate not supportedi s certificate is for %ss , s4 no commonName or subjectAltName found in certificate( R t getR� R� R R| R/ RX t encodet UnicodeEncodeErrorR RK R} R< ( t certRb t dnsnamest sanR> t valueR� t subt d( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt _verifycerty s@
"c C@ s[ t j s t j � s t j r$ t St j j t j � j � } | j
d � pZ | j
d � S( s@ return true if this seems to be a pure Apple Python that
* is unfrozen and presumably has the whole mercurial module in the file
system
* presumably is an Apple Python that uses Apple OpenSSL which has patches
for using system certificate store CAs in addition to the provided
cacerts file
s /usr/bin/pythons, /system/library/frameworks/python.framework/( R t isdarwinR t
mainfrozent
sysexecutableR RZ R[ t realpathRW RT ( t exe( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt _plainapplepython� s
s& /etc/pki/tls/certs/ca-bundle.trust.crts" /etc/ssl/certs/ca-certificates.crtc C@ sU y? d d l } | j � } t j j | � r> | j d � | SWn t t f k
rX n Xt j r� t
s~ | j t d � � n d St � r� t j j t j j t j t � � d � } t j j | � r� | Sn t j r� t
s� | j t d � � n d St
sQx; t D]3 } t j j | � r| j t d � | � | SqW| j t d � � n d S( s� return path to default CA certificates or None.
It is assumed this function is called when the returned certificates
file will actually be used to validate connections. Therefore this
function may print warnings or debug messages assuming this usage.
We don't print a message when the Python is able to load default
CA certs because this scenario is detected at socket connect time.
i Ns# using ca certificates from certifi
s� (unable to load Windows CA certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message)
s
dummycert.pems� (unable to load CA certificates; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message)
s� (using CA certificates from %s; if you see this message, your Mercurial install is not properly configured; see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this message)
( t certifit whereRZ R[ R\ R^ t ImportErrort AttributeErrorR R� R_ RO R R R� R< t dirnamet fsencodet __file__R� t _systemcacertpathst isfile( Ra R� t certst dummycertR[ ( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyR] � s:
!
c C@ s� | j d } t j | � } | j d } | j d } y | j t � } | j � } Wn* t k
r� t j t d � | � � n X| s� t j t d � | � � n | d r� | j t d � | � d Si t
j t j
| � j � � d 6t
j t j | � j � � d
6t
j t j | � j � � d 6} d � } d
| | d
� } | d rJx | d D]s \ }
} | |
j � | k r^| j d | |
| | � f � | d r�| j t d � | | | f � n d Sq^W| d r�d } | | d � }
n d } d |
| | |
� f }
t j t d � | |
f d t d � | �� n | j d s�t j t d � | d t d � | | f �� n t | | � } | r�t j t d � | | f d t d � | | f �� n d S( sx Validate a socket meets security requirements.
The passed socket must have been created with ``wrapsocket()``.
Rb Ra Ry s %s ssl connection errors- %s certificate error: no certificate receivedR4 s� warning: connection security to %s is disabled per current settings; communication is susceptible to eavesdropping and tampering
NRF t sha256t sha512c S@ s= d j g t d t | � d � D] } | | | d !^ q � S( NRC i i ( R< t rangeR} ( Rd t x( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt fmtfingerprint= s s sha256:%sR3 s) %s certificate matched fingerprint %s:%s
R5 s� (SHA-1 fingerprint for %s found in legacy [hostfingerprints] section; if you trust this fingerprint, remove the old SHA-1 fingerprint from [hostfingerprints] and add the following entry to the new [hostsecurity] section: %s:fingerprints=%s)
t hostfingerprintR@ s %s:%ss0 certificate for %s has unexpected fingerprint %sR9 s check %s configurationRx sP unable to verify security of %s (no loaded CA certificates); refusing to connects� see https://mercurial-scm.org/wiki/SecureConnections for how to configure Mercurial to avoid this error or set hostsecurity.%s:fingerprints=%s to trust this servers %s certificate error: %ss^ set hostsecurity.%s:certfingerprints=%s config setting or use --insecure to connect insecurely( R� R RK t getpeercertRL R� R R! R RO R t hext hashlibRF t digestR� R� RW R^ R� ( R� t shostt hostRa Ry t peercertt peercert2t peerfingerprintsR� t nicefingerprintt hashRg t sectiont niceR� ( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt validatesocket sd
"
(* t
__future__R R� RZ R� R t i18nR RD R R R R t utilsR R R; Rq R t hassniRM R� t addR RL R~ R_ R� t objectRi RR R R� R� t ExceptionR� R� R� R� R� R] R� ( ( ( s7 /usr/lib64/python2.7/site-packages/mercurial/sslutil.pyt <module>
sJ "
3 � 4 � F 2 2 T