nbixTUddlmZddlZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z ddl Z ddl Z ddlmZddlmZddlmZddlmZddlmZmZd d lmZmZdZdZd Zd gZ eZ!e j"e#e#e#e$e#fZ%d Z&d dDZ'Gdde j(Z)dwdZ*dxdZ+GddZ,e,Z-dydZ.dzd!Z/e j0rdd"l1m2Z2dd#l3m4Z4d d$l5mZ6iZ7d%e8d&< ddl1Z1dd'l1m9Z9mZm:Z:m;Z;mZ>m?Z?m@Z@mAZAmZmBZB dd(l1mCZCn #eD$rdZCYnwxYwe>ZEere/ee>Z?dZCd ZMd ZOYnwxYwd{d8ZSd|d<ZTe jUd=d>d}dBZVe jUd d>d~dDZV dddFZV dddRZWe jU dddjZXe jU dddlZX dddmZXddpZYddrZZ dddsZ[ddvZ\dS)) annotationsN) unhexlify)Path)MOZ_INTERMEDIATE_CIPHERS)load_cert_chain)ProxySchemeUnsupportedSSLError)_BRACELESS_IPV6_ADDRZ_RE_IPV4_REFzhttp/1.1cBi|]\}}|tt|dSN)getattrhashlib).0length algorithms h/var/www/html/mdtn/previsions/meteo_cartes/venv/lib/python3.11/site-packages/urllib3_future/util/ssl_.py r"s:  GGY - -)) md5)(sha1)@sha256ceZdZdZdZdZdS) _KnownCallerRequestsNiquestsOtherN)__name__ __module__ __qualname__REQUESTSNIQUESTSOTHERrrrr,sHH EEErrreturnctjD]G}|j}|jdr$d|vrtjcSd|vrtjcSHtjS)Nz adapters.pyrequestsniquests) traceback extract_stackfilenameendswithrr&r'r()frame module_paths r _caller_idr42sw(**--n > " "= 1 1 -[((#,,,,{**#,,,,  rargsJstr | bytes | int | Path | list[str] | bool | dict[str, typing.Any] | Noneintc d}|D]}||dz } t|ttfr |tt|z }Gt|tr|t|z }|r |tt |jgd| Dz|jz }nX#t$rYnLwxYw |tt |jz }n#t$rYnwxYwt|ttfr|t|z }{t|tr|t|z }t|tr|dz }|D]}||z }|dz }t|S)zdWe want a dedicated hashing technics to cache ssl ctx, so that they are reusable across the runtime.Nc@g|]}|jSr))statst_mtime)rps r z*_compute_key_ctx_build..\s#HHHQqvvxx0HHHr)default()) isinstancestrbyteshashris_dirmaxr<r=iterdirOSErrorr7booldictlist)r5keyargitems r_compute_key_ctx_buildrQ?s C,, ; 6MC        3tCyy>> !C  c4   3s88OCzz||  3 XXZZ01HH#++--HHHI$'HHJJ$7CCD3tCyy~~//8999CCD cC; ' '  3s88OC  c4   3s88OC  c4   3JC  t  3JC 99s%A/C88 DD 6E E  E cReZdZdddZddZejdd Zdd ZddZ dS)_CacheableSSLContextrmaxsize int | Noner*Nonec`||_i|_d|_tj|_dSr)_maxsize _container_cursor threadingRLock_lock)selfrTs r__init__z_CacheableSSLContext.__init__ws* 57#' &/o&7&7 rcb|j5d|_i|_ddddS#1swxYwYdSr)r]rZrYr^s rclearz_CacheableSSLContext.clear}s| Z ! !DL DO ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! ! !s $((r5Jstr | bytes | Path | int | list[str] | bool | dict[str, typing.Any] | Nonetyping.Generator[None]c'Kt|}|j5||_ dVd|_n #d|_wxYw ddddS#1swxYwYdSr)rQr]rZ)r^r5rNs rlockz_CacheableSSLContext.locks%d+ Z $ $DL $# t ####  $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $ $s#A(A 1AA Assl.SSLContext | Nonec|j5|jtd|j|jvr|j|jcdddS ddddS#1swxYwYdSNzYou MUST start WITH lock())r]rZrJrYras rgetz_CacheableSSLContext.gets Z  |#:;;;|t..t|4                           s6A AA Actxssl.SSLContextcx|j5|jtd||j|j<|jrmt |j|jkrP|jt|j ddddS#1swxYwYdSri) r]rZrJrYrXlenpopnextkeys__iter__)r^rks rsavez_CacheableSSLContext.savesZ M M|#:;;;,/DODL )} MT_!5!5 !E!E##D)=)=)?)?)H)H)J)J$K$KLLL M M M M M M M M M M M M M M M M M MsBB//B36B3N)r)rTrUr*rV)r*rV)r5rcr*rd)r*rg)rkrlr*rV) r#r$r%r_rb contextlibcontextmanagerrfrjrsr)rrrSrSvs88888 !!!! $$$$& M M M M M MrrSimplementation_namerD version_info_TYPE_VERSION_INFOrKcr|dkrdS|dd}|d}|dkr|dkp|dko|dkp|d kS) adReturn True for CPython 3.8.9+, 3.9.3+ or 3.10+ where setting SSLContext.hostname_checks_common_name to False works. PyPy 7.3.7 doesn't work as it doesn't ship with OpenSSL 1.1.1l+ so we're waiting for a version of PyPy that works before allowing this function to return 'True'. Outside of CPython and PyPy we don't know which implementations work or not so we conservatively use our hostname matching as we know that works on all implementations. https://github.com/urllib3/urllib3/issues/2192#issuecomment-821832963 https://foss.heptapod.net/pypy/pypy/-/issues/3539# cpythonFNr) )r{r}r{)r{ r))rvrw major_minormicros r_is_bpo_43522_fixedrsd"i''urr"K OE   -5A: " 6 ! 0eqj " ' !ropenssl_versionopenssl_version_numberc`|d}|dk}|o|pt||S)NzOpenSSL i) startswithr)rrrvrw is_opensslis_openssl_issue_14579_fixeds r(_is_has_never_check_common_name_reliablersH!++J77J $:Z#G  $ B 2L A Ar) VerifyMode)Literal) SSLTransportzdict[int, int]_SSL_VERSION_TO_TLS_VERSION) CERT_REQUIREDHAS_NEVER_CHECK_COMMON_NAMEOP_NO_COMPRESSION OP_NO_TICKETOPENSSL_VERSIONOPENSSL_VERSION_NUMBER PROTOCOL_TLSPROTOCOL_TLS_CLIENT OP_NO_SSLv2 OP_NO_SSLv3 SSLContext TLSVersion)OP_NO_RENEGOTIATION)TLSv1TLSv1_1TLSv1_2 PROTOCOL_maximum_versionfipsIS_FIPS FIPS_moderii@iicert bytes | None fingerprintrVc|td|dd}t|}|tvrtd|t|}|td|dt |}||}tj ||s(td|d | d dS) z Checks if given fingerprint matches the supplied certificate. :param cert: Certificate as bytes object. :param fingerprint: Fingerprint as string of hexdigits, can be interspersed by colons. NzNo certificate for the peer.:r9zFingerprint of invalid length: zAHash function implementation unavailable for fingerprint length: zD. Hint: your OpenSSL build may not include it for compliance issues.z&Fingerprints did not match. Expected "z", got "") r replacelowerrn HASHFUNC_MAPrencodedigesthmaccompare_digesthex)rr digest_lengthhashfuncfingerprint_bytes cert_digests rassert_fingerprintr7s, |5666%%c2..4466K $$ML((FFFGGGM*H QP] Q Q Q   "+"4"4"6"677(4..''))K  {,= > >  ^[ ^ ^+//J[J[ ^ ^ ^     r candidateNone | int | strrc|tSt|tr2tt|d}|ttd|z}|S|S)a Resolves the argument to a numeric constant, which can be passed to the wrap_socket function/method from the ssl module. Defaults to :data:`ssl.CERT_REQUIRED`. If given a string it is assumed to be the name of the constant in the :mod:`ssl` module or its abbreviation. (So you can specify `REQUIRED` instead of `CERT_REQUIRED`. If it's neither `None` nor a string we assume it is already the numeric constant which can directly be passed to wrap_socket. NCERT_)rrCrDrssl)rress rresolve_cert_reqsr\sW)S!!c9d++ ;#w233C rT)mitigate_tls_versionrtyping.Literal[True]ssl.TLSVersioncdSrr)rrs rresolve_ssl_versionrss Srtyping.Literal[False]cdSrr)rs rrr{s #rint | ssl.TLSVersioncZ||rtStSt|tr|rgt t drRt t j|d}||St t j|ddd}||S|r|dkrd}t t |d}|t t d|z}tj t|S|rD|tvr t|S|tks |tkrtSt jj S|S)z like resolve_cert_reqs Nrrr9rr)rrrCrDhasattrrrrrtypingcastr7rMAXIMUM_SUPPORTED)rrrs rrrs2   '& &)S!!%  GC$>$> #.)T::C #.)*;*;K*L*LdSSC  .I$?$?-Ic9d++ ;#{Y677C{3$$$0 3 3 3.y9 9 + + +yL/H/H& &~// r ssl_versionrU cert_reqsoptionsciphers str | Nonessl_minimum_versionssl_maximum_version caller_id_KnownCaller | Nonerlcttd|t}|dttfvr||t dt tdrt|tj r|}|}nJt |tj }t |tj }tt}d}tr&|||_ntj|_d}|||_|r||n,|r*||t&jur|t*| tjn|}|zd}|t.z}|t0z}|t2z}|t4z}||t&jur@|duo&|d} t:| dur |t:z}|xj|zc_|tjkst>j d krtC|d d d|_"|tjkr||_#d|_$nd|_$||_# d|_%n#tL$rYnwxYwt |d rVd tNj(vr=tNj)*tNj( d } nd} | r| |_+|S) a^Creates and configures an :class:`ssl.SSLContext` instance for use with urllib3. :param ssl_version: The desired protocol version to use. This will default to PROTOCOL_TLS_CLIENT which will negotiate the highest protocol that both the server and your installation of OpenSSL support. :param ssl_minimum_version: The minimum version of TLS to be used. Use the 'ssl.TLSVersion' enum for specifying the value. By default, it is assigned to 'ssl.TLSVersion.TLSv1_2'. :param ssl_maximum_version: The maximum version of TLS to be used. Use the 'ssl.TLSVersion' enum for specifying the value. Not recommended to set to anything other than 'ssl.TLSVersion.MAXIMUM_SUPPORTED' which is the default value. :param cert_reqs: Whether to require the certificate verification. This defaults to ``ssl.CERT_REQUIRED``. :param options: Specific OpenSSL options. These default to ``ssl.OP_NO_SSLv2``, ``ssl.OP_NO_SSLv3``, ``ssl.OP_NO_COMPRESSION``, and ``ssl.OP_NO_TICKET``. :param ciphers: Which cipher suites to allow the server to select. Defaults to either system configured ciphers if OpenSSL 1.1.1+, otherwise uses a secure default set of ciphers. :returns: Constructed SSLContext object with specified options :rtype: SSLContext Nz7Can't create an SSLContext object without an ssl modulezZCan't specify both 'ssl_version' and either 'ssl_minimum_version' or 'ssl_maximum_version'rFTrz @SECLEVEL=0)r{post_handshake_authkeylog_filename SSLKEYLOGFILE),r TypeErrorr4rr ValueErrorrrrCrrrjMINIMUM_SUPPORTEDrSUPPORT_MIN_MAX_TLS_VERSIONminimum_versionrr set_ciphersrr'rrrrrrupperr1rrsysrwrr verify_modecheck_hostnamehostname_checks_common_nameAttributeErrorosenvironpath expandvarsr) rrrrrrrcontextdefault_tlsv1_2weak_security_set sslkeylogfiles rcreate_urllib3_contextrsFFQRRRLL 4/BCCC  *.A.MA  sL)) jcn.U.U &1#&1##'B&E&E!=''#'B&E&E!=''# ,--G!O":  *&9G # #&0&8G #"O  *&9G # :G$$$$ :   \-B B B    8 9 9 9&/%6!!II;; $$ <   \-B B B!(t 3! 8P8P99  $/4E4N4N.. OOwOO S&&&#*:i*G*GW&NN N'+#C%%%'!%!&' .3++      w)**4 bj ( (G..rz~~o/N/NOOMM M  4&3G # NsI I('I(.sock socket.socketkeyfilecertfileca_certsserver_hostname ssl_contextrg ca_cert_dir key_password ca_cert_dataNone | str | bytes tls_in_tlsLiteral[False]alpn_protocolslist[str] | Nonecertdatastr | bytes | Nonekeydatar bool | None ssl.SSLSocketcdSrr)rrrrrrrrrrrrrrrrrrrs rssl_wrap_socketrWs *Cr ssl.SSLSocket | SSLTransportTypecdSrr)rs rrros *(+srcB|}|du}t|||nt|||||| | nt| | ||| | tjdd|||5|stnd}||!t |||t||}|||_|||_ |s| s| rf| r)t| tr| } | || | nf#t$r}t||d}~wwxYwt!|dr4|}d|vs|ds||r | t'|rtd|r1| |||nj|||| nR|rP|rN t+|||| n:#t,j$r(}t1jd|dt4Yd}~nd}~wwxYw || pt8n#t:$rYnwxYw|r|||st|n|}dddn #1swxYwYtA||| |}|S) a. All arguments except for server_hostname, ssl_context, and ca_cert_dir have the same meaning as they do when using :func:`ssl.wrap_socket`. :param server_hostname: When SNI is supported, the expected hostname of the certificate :param ssl_context: A pre-made :class:`SSLContext` object. If none is provided, one will be created using :func:`create_urllib3_context`. :param ciphers: A string of ciphers we wish the client to support. :param ca_cert_dir: A directory containing CA certificates in multiple separate files, as supported by OpenSSL's -CApath flag or the capath argument to SSLContext.load_verify_locations(). :param key_password: Optional password if the keyfile is encrypted. :param ca_cert_data: Optional string containing CA certificates in PEM format suitable for passing as the cadata parameter to SSLContext.load_verify_locations() :param tls_in_tls: Use SSLTransport to wrap the existing socket. :param alpn_protocols: Manually specify other protocols to be announced during tls handshake. :param certdata: Specify an in-memory client intermediary certificate for mTLS. :param keydata: Specify an in-memory client intermediary key for mTLS. Nr)rrrrload_default_certsx509_caz5Client private key is encrypted, password is requiredz|Passing in-memory client/intermediary certificate for mTLS is unsupported on your platform. Reason: z<. It will be picked out if you upgrade to a QUIC connection.)!_SSLContextCacherfrrgetenvrjrr4rrrCrEdecodeload_verify_locationsrJr rcert_store_statsr_is_key_file_encryptedr_ctx_load_cert_chainioUnsupportedOperationwarningswarn UserWarningset_alpn_protocolsALPN_PROTOCOLSNotImplementedErrorrrs_ssl_wrap_socket_impl)rrrrrrrrrrrrrrrrrrrrcache_disabled cached_ctxe store_statsssl_socks rrrsdG"$.N   $$x.."* [0A0A /4((!  Y!Y!$4BK%))+++t  1#(ll(;(; $&/#))7& 1; 1, 19J|U$C$C9#/#6#6#8#8L-11(KVVVV---"1++1,-"677 1%6688 K//{97M/..000  X</4J74S4S/VWWW '++Hg>>>>++Hg|LLLL g ((G\RRRR.Mc!"ccc# **>+K^LLLL#      -##G,,,! / %%g... GsY!Y!Y!Y!Y!Y!Y!Y!Y!Y!Y!Y!Y!Y!Y!v%T7JPPH Os%BJ-DJ D$DD$$B JGJH'H J HJH0/J0 H=:J<H==9JJ Jhostname str | bytesct|tr|d}tt j|pt j|S)zDetects whether the hostname given is an IPv4 or IPv6 address. Also detects IPv6 addresses with Zone IDs. :param str hostname: Hostname to examine. :return: True if the hostname is an IP address, False otherwise. ascii)rCrEr rKr matchr )rs r is_ipaddressr$sP(E"",??7++ x((T,D,J8,T,T U UUrkey_filect|5}|D]}d|vrddddS dddn #1swxYwYdS)z*Detects if a key file is encrypted or not. ENCRYPTEDNTF)open)r%flines rrr(s h1  Dd"" #  5s 5599c|r;tstdtj|t|||S|||S)Nz0TLS in TLS requires support for the 'ssl' module)r)rr $_validate_ssl_context_for_tls_in_tls wrap_socket)rrrrs rrr3sh @ (B  9+FFFD+???  " "4 " I IIrrkssl.TLSVersion | int | Nonec&d}|rtj|jvrd}n\trUt |jtjr6|jtjjkr|jtjjkrd}|r|tjjkrd}| S)z Quickly uncover if passed parameters for HTTPSConnection does not exclude QUIC. Some parameters may defacto exclude HTTP/3 over QUIC. -> TLS 1.3 required -> One of the three supported ciphers (listed bellow) FNT) r OP_NO_TLSv1_3rrrCrrrr)rkr quic_disables ris_capable_for_quicr2FsL    + +LL ( $Z  . .  $#s~'GGG'3>+AAA# 2cn6LLL  r)r*r)r5r6r*r7)rvrDrwrxr*rK) rrDrr7rvrDrwrxr*rK)rrrrDr*rV)rrr*r)rrrrr*r)rrrrr*r7)F)rrrrKr*r)NNNNNNN)rrUrrUrrUrrrrUrrUrrr*rl)..................)(rrrrrrrrUrrrrrrUrrrrgrrrrrrrrrrrrrrrrrrUrrUr*r)(rrrrrrrrUrrrrrrUrrrrgrrrrrrrrKrrrrrrrrrrUrrUr*r)NNNNNNNNNNNFNNNNNN)rr r*rK)r%rDr*rKr) rrrrlrrKrrr*r)rkrgrr.r*rK)] __future__rrtrrrrsocketrr[rrenumr.binasciirpathlibr _constantr contrib.imccrr exceptionsr r urlr r rrrrDEFAULT_CIPHERSTupler7rDrx IS_PYOPENSSLrEnumrr4rQrSr rr TYPE_CHECKINGrrtyping_extensionsr ssltransportSSLTransportTyper__annotations__rrrrrrrrrrr ImportErrorPROTOCOL_SSLv23implementationnamerwattrrrrrrrcallablerrKrroverloadrrrr$rrr2r)rrrLsb"""""""   000000BBBBBB9999999933333333   #*\#sCc"9:  49    4444n5M5M5M5M5M5M5M5Mp(')):* ?))))))>>>>>>/10000FJJJ                            #+++++++ ###"##O#,+S+S   ,,, ',#0 LSGDMM '5G5G5G(H(H I I    H +***** #*'#.:K"L"L3o3555G5555% 73 $ $ -#-)@)@ -d=3=??++GG ,G   LKK%&&Ol&"'GGG " " " " J.2638?D&&&&&T# &*&*%)hhhhhV"%!),!"'*!$'*#&"%"%&)&)'."%!),!"'*'*#&"%"%&)&)'+++++2 "&")-"#'+'+#'"&"&&*&*'QQQQQh V V V V#' JJJJJ&s[& GD GDGD*GE G E(%G'E((A-GG21G2