o
    sDi@                     @  s  d Z ddlmZ ddlZddlZddlZddl	Z
ddlmZ ddlmZ ddlmZmZmZmZmZmZ ddlmZ ddlZddlmZ ddlmZ dd	l m!Z" dd
l m#Z# ddl$m%Z% ddl&m'Z' ddl(m)Z* ddl(m+Z+ ddl,m-Z- er|ddlm.Z. edZ/zddl0Z0dZ1W n e2y   dZ1Y nw ej3Z4ej5Z5ej6Z6ej7Z7e8eddZ9dZ:dZ;ej<Z=ej>ej?ej@ejAejBejAejCB iZDdd eDE D ZFd'ddZGejHejIejJfZKejHZLejIZMejJZNd(dd ZOG d!d" d"ejPZQG d#d$ d$ZRG d%d& d&ZSdS ))zA CPython compatible SSLContext implementation wrapping PyOpenSSL's
context.

Due to limitations of the CPython asyncio.Protocol implementation for SSL, the async API does not support PyOpenSSL.
    )annotationsN)EINTR)
ip_address)TYPE_CHECKINGAnyCallableOptionalTypeVarUnion)SSL)crypto)ConfigurationError)_CertificateError)
_OCSPCache)_ocsp_callback)SocketChecker)_errno_from_exception)validate_boolean)
VerifyMode_TTFOP_NO_RENEGOTIATIONc                 C  s   i | ]\}}||qS  r   ).0keyvaluer   r   W/home/alumno/antzosa8961/venv/lib/python3.10/site-packages/pymongo/pyopenssl_context.py
<dictcomp>N   s    r   addressr   returnboolc              	   C  s(   zt |  W dS  ttfy   Y dS w )NTF)_ip_address
ValueErrorUnicodeError)r   r   r   r   _is_ip_addressS   s   r#   excBaseExceptionc                 C  s
   | j dkS )z<Return True if the OpenSSL.SSL.SysCallError is a ragged EOF.)zUnexpected EOF)args)r$   r   r   r   _ragged_eofc   s   
r(   c                      sb   e Zd Zd  fddZd!ddZd" fddZd# fddZd$ fddZd%d& fddZ  Z	S )'_sslConnctx_SSL.ContextsockOptional[_socket.socket]suppress_ragged_eofsr   c                   s    t  | _|| _t || d S N)_SocketCheckersocket_checkerr.   super__init__)selfr*   r,   r.   	__class__r   r   r3   l   s   z_sslConn.__init__callCallable[..., _T]r'   r   kwargsr   r   c           	   
   O  s   |   }|r
t }	 z||i |W S  tyy } zZ|dkr!||  dkr<|r7t | |kr7tdd tdd t|t	j
rGd}d}nt|t	jrRd}d}nd}d}| j| ||| |rot | |krotdd W Y d }~q
d }~ww )NTr   r&   z	timed outz!Underlying socket has been closedF)
gettimeout_time	monotonicBLOCKING_IO_ERRORSfileno_sockettimeoutSSLError
isinstance_SSLWantReadErrorWantWriteErrorr1   select)	r4   r7   r'   r9   r@   startr$   	want_read
want_writer   r   r   _callv   s6   
z_sslConn._callNonec                   s   | j t jg|R i |S r/   )rJ   r2   do_handshake)r4   r'   r9   r5   r   r   rL      s   z_sslConn.do_handshakebytesc              
     X   z| j t jg|R i |W S  tjy+ } z| jr&t|r&W Y d }~dS  d }~ww )N    )rJ   r2   recvrC   SysCallErrorr.   r(   r4   r'   r9   r$   r5   r   r   rP         z_sslConn.recvintc              
     rN   Nr   )rJ   r2   	recv_intorC   rQ   r.   r(   rR   r5   r   r   rV      rS   z_sslConn.recv_intor   bufflagsc              
     s   t |}t|}d}||k rIz| t j||d  |}W n ty6 } zt|tkr1W Y d }~q
 d }~ww |dkr?td||7 }||k sd S d S )Nr   zconnection closed)
memoryviewlenrJ   r2   sendOSErrorr   _EINTR)r4   rW   rX   viewtotal_length
total_sentsentr$   r5   r   r   sendall   s    z_sslConn.sendall)r*   r+   r,   r-   r.   r   )r7   r8   r'   r   r9   r   r   r   )r'   r   r9   r   r   rK   )r'   r   r9   r   r   rM   )r'   r   r9   r   r   rT   )r   )rW   rM   rX   rT   r   rK   )
__name__
__module____qualname__r3   rJ   rL   rP   rV   rb   __classcell__r   r   r5   r   r)   k   s    

		r)   c                   @  s   e Zd ZdZdddZdS )_CallbackDataz0Data class which is passed to the OCSP callback.r   rK   c                 C  s   d | _ d | _t | _d S r/   )trusted_ca_certscheck_ocsp_endpointr   ocsp_response_cacher4   r   r   r   r3      s   z_CallbackData.__init__Nr   rK   )rc   rd   re   __doc__r3   r   r   r   r   rg      s    rg   c                   @  s   e Zd ZdZdZdDddZedEdd	ZdFddZdGddZ	eee	Z
dHddZdIddZeeeZdJddZdKddZeeeZdEddZdLddZeeeZ	 	 dMdNd'd(Z	 dMdOd+d,ZdPd-d.ZdQd1d2ZdPd3d4ZdPd5d6Z	7	8	8	 	 dRdSdBdCZd S )T
SSLContextzUA CPython compatible SSLContext implementation wrapping PyOpenSSL's
    context.
    )	_protocol_ctx_callback_data_check_hostnameprotocolrT   c                 C  s@   || _ t| j | _t | _d| _d| j_| jjt	| jd d S )NT)callbackdata)
ro   rC   Contextrp   rg   rq   rr   ri   set_ocsp_client_callbackr   )r4   rs   r   r   r   r3      s   zSSLContext.__init__r   c                 C     | j S )zhThe protocol version chosen when constructing the context.
        This attribute is read-only.
        )ro   rk   r   r   r   rs      s   zSSLContext.protocolr   c                 C  s   t | j  S )zWhether to try to verify other peers' certificates and how to
        behave if verification fails. This attribute must be one of
        ssl.CERT_NONE, ssl.CERT_OPTIONAL or ssl.CERT_REQUIRED.
        )_REVERSE_VERIFY_MAPrp   get_verify_moderk   r   r   r   __get_verify_mode   s   zSSLContext.__get_verify_moder   rK   c                 C  s    ddd}| j t| | dS )zSetter for verify_mode._connobj_SSL.Connection_x509obj_crypto.X509_errnumrT   	_errdepthretcoder   r   c                 S  s   t |S r/   )r   )r|   r~   r   r   r   r   r   r   _cb   s   z)SSLContext.__set_verify_mode.<locals>._cbN)r|   r}   r~   r   r   rT   r   rT   r   rT   r   r   )rp   
set_verify_VERIFY_MAP)r4   r   r   r   r   r   __set_verify_mode   s   
zSSLContext.__set_verify_moder   c                 C  rx   r/   )rr   rk   r   r   r   __get_check_hostname   s   zSSLContext.__get_check_hostnamer   c                 C  s   t d| || _d S )Ncheck_hostname)r   rr   r4   r   r   r   r   __set_check_hostname  s   

zSSLContext.__set_check_hostnameOptional[bool]c                 C  s   | j jS r/   )rq   ri   rk   r   r   r   __get_check_ocsp_endpoint  s   z$SSLContext.__get_check_ocsp_endpointc                 C  s   t d| || j_d S )N
check_ocsp)r   rq   ri   r   r   r   r   __set_check_ocsp_endpoint  s   
z$SSLContext.__set_check_ocsp_endpointc                 C  s   | j dS rU   )rp   set_optionsrk   r   r   r   __get_options  s   zSSLContext.__get_optionsc                 C  s   | j t| d S r/   )rp   r   rT   r   r   r   r   __set_options  s   zSSLContext.__set_optionsNcertfileUnion[str, bytes]keyfileUnion[str, bytes, None]passwordOptional[str]c                   sH    rd fd	d
}| j | | j | | j |p| | j   dS )a  Load a private key and the corresponding certificate. The certfile
        string must be the path to a single file in PEM format containing the
        certificate as well as any number of CA certificates needed to
        establish the certificate's authenticity. The keyfile string, if
        present, must point to a file containing the private key. Otherwise
        the private key will be taken from certfile as well.
        _max_lengthrT   _prompt_twicer   
_user_dataOptional[bytes]r   rM   c                   s    d usJ   dS )Nzutf-8)encode)r   r   r   r   r   r   _pwcb1  s   
z)SSLContext.load_cert_chain.<locals>._pwcbN)r   rT   r   r   r   r   r   rM   )rp   set_passwd_cbuse_certificate_chain_fileuse_privatekey_filecheck_privatekey)r4   r   r   r   r   r   r   r   load_cert_chain  s   zSSLContext.load_cert_chaincafilecapathc                 C  s   | j || dS )zLoad a set of "certification authority"(CA) certificates used to
        validate other peers' certificates when `~verify_mode` is other than
        ssl.CERT_NONE.
        N)rp   load_verify_locations)r4   r   r   r   r   r   r   =  s   z SSLContext.load_verify_locationsc                 C  s   t r| t  dS td)z&Attempt to load CA certs from certifi.ztlsAllowInvalidCertificates is False but no system CA certificates could be loaded. Please install the certifi package, or provide a path to a CA file using the tlsCAFile optionN)_HAVE_CERTIFIr   certifiwhere_ConfigurationErrorrk   r   r   r   _load_certifiF  s
   zSSLContext._load_certifistorestrc                 C  sj   | j  }|dusJ tjjj}t|D ]\}}}|dkr2|du s&||v r2|tj	
t| qdS )z2Attempt to load CA certs from Windows trust store.Nx509_asnT)rp   get_cert_store
_stdlibsslPurposeSERVER_AUTHoidenum_certificatesadd_cert_cryptoX509from_cryptographyx509load_der_x509_certificate)r4   r   
cert_storer   certencodingtrustr   r   r   _load_wincertsR  s   

zSSLContext._load_wincertsc                 C  s^   t jdkrzdD ]}| | qW n ty   |   Y n
w t jdkr(|   | j  dS )z7A PyOpenSSL version of load_default_certs from CPython.win32)CAROOTdarwinN)_sysplatformr   PermissionErrorr   rp   set_default_verify_paths)r4   	storenamer   r   r   load_default_certs_  s   

zSSLContext.load_default_certsc                 C  s   | j   dS )zmSpecify that the platform provided CA certificates are to be used
        for verification purposes.
        N)rp   r   rk   r   r   r   r   o  s   z#SSLContext.set_default_verify_pathsFTr,   _socket.socketserver_sidedo_handshake_on_connectr.   server_hostnamesessionOptional[_SSL.Session]r)   c           
   
   C  s   t | j||}|r|| |du r|  n|r%t|s%||d | jtj	kr/|
  |  |rt|  | jrt|durtddlm} zt|rT||| W |S ||| W |S  tjtjfys }	 ztt|	dd}	~	ww |S )zZWrap an existing Python socket connection and return a TLS socket
        object.
        TidnaNr   )	pyopenssl)r)   rp   set_sessionset_accept_stater#   set_tlsext_host_namer   verify_moder   	CERT_NONErequest_ocspset_connect_staterL   r   service_identityr   verify_ip_addressverify_hostnameCertificateErrorVerificationErrorr   r   )
r4   r,   r   r   r.   r   r   ssl_connr   r$   r   r   r   wrap_socketw  s8   

zSSLContext.wrap_socket)rs   rT   )r   rT   )r   r   )r   r   r   rK   )r   r   )r   r   r   rK   )r   r   )r   r   r   rK   )r   rT   r   rK   )NN)r   r   r   r   r   r   r   rK   )r   r   r   r   r   rK   rl   )r   r   r   rK   )FTTNN)r,   r   r   r   r   r   r.   r   r   r   r   r   r   r)   )rc   rd   re   rm   	__slots__r3   propertyrs   _SSLContext__get_verify_mode_SSLContext__set_verify_moder   _SSLContext__get_check_hostname_SSLContext__set_check_hostnamer   $_SSLContext__get_check_ocsp_endpoint$_SSLContext__set_check_ocsp_endpointri   _SSLContext__get_options_SSLContext__set_optionsoptionsr   r   r   r   r   r   r   r   r   r   r   rn      sB    













	


rn   )r   r   r   r   )r$   r%   r   r   )Trm   
__future__r   socketr?   sslr   sysr   timer;   errnor   r]   	ipaddressr   r    typingr   r   r   r   r	   r
   cryptography.x509r   r   OpenSSLr   rC   r   r   pymongo.errorsr   r   r   pymongo.ocsp_cacher   pymongo.ocsp_supportr   pymongo.socket_checkerr   r0   r   pymongo.write_concernr   r   r   r   r   ImportErrorSSLv23_METHODPROTOCOL_SSLv23OP_NO_SSLv2OP_NO_SSLv3OP_NO_COMPRESSIONgetattrr   HAS_SNIIS_PYOPENSSLErrorrA   r   VERIFY_NONECERT_OPTIONALVERIFY_PEERCERT_REQUIREDVERIFY_FAIL_IF_NO_PEER_CERTr   itemsry   r#   rD   rE   WantX509LookupErrorr=   BLOCKING_IO_READ_ERRORBLOCKING_IO_WRITE_ERRORBLOCKING_IO_LOOKUP_ERRORr(   
Connectionr)   rg   rn   r   r   r   r   <module>   sf    


S	