o
    j<                     @   s:  d Z ddlmZmZmZmZmZ ddlmZ ddl	m
Z
mZmZmZmZ zddlZW n ey>   eer:e
ed edw z
dd	lmZmZ W n eyg   dd
lmZ ddlmZ eeree
ed Y nw zddlmZmZ dZW n ey   dZeere
ed Y nw ddlmZ G dd deZdd ZdS )
   )LDAPSSLNotSupportedErrorLDAPSSLConfigurationErrorLDAPCertificateErrorstart_tls_exception_factoryLDAPStartTLSError   )SEQUENCE_TYPES)loglog_enabledERRORBASICNETWORK    Nz,SSL not supported in this Python interpreter)match_hostnameCertificateError)r   )r   zusing tls_backport)create_default_contextPurposeTFzSSLContext unavailable)pathc                   @   s^   e Zd ZdZddejdddddddddfddZdd Zdd Zdd
dZ	dd Z
dd ZdS )Tlsa  
    tls/ssl configuration for Server object
    Starting from python 2.7.9 and python 3.4 uses the SSLContext object
    that tries to read the CAs defined at system level
    ca_certs_path and ca_certs_data are valid only when using SSLContext
    local_private_key_password is valid only when using SSLContext
    ssl_options is valid only when using SSLContext
    sni is the server name for Server Name Indication (when available)
    Nc                 C   s  |d u rg }|| _ |tjtjtjfv r|| _n|r'ttr#ttd| t	d|r2t
|r2|| _n|rBttr>ttd| t	dd | _|rRtrRt
|rR|| _n$|rctscttr_ttd td|rsttrottd| t	dd | _|	r~tr~|	| _n|	rttrttd tdd | _|
rtr|
| _n|
rttrttd	 td
d | _|| _|| _|| _|| _|| _|| _ttrttd|   d S d S )Nzinvalid validate parameter <%s>zinvalid validate parameterzinvalid CA public key file <%s>zinvalid CA public key filez8cannot use CA public keys path, SSLContext not availablez invalid CA public keys path <%s>zinvalid CA public keys pathz,cannot use CA data, SSLContext not availablez?cannot use local private key password, SSLContext not availablezBcannot use local private key password, SSLContext is not availablezinstantiated Tls: <%r>)ssl_optionsssl	CERT_NONECERT_OPTIONALCERT_REQUIREDvalidater   r   r
   r   r   existsca_certs_fileuse_ssl_contextca_certs_pathr   ca_certs_dataprivate_key_passwordversionprivate_key_filecertificate_filevalid_namescipherssnir   )selflocal_private_key_filelocal_certificate_filer   r"   r   r   r%   r   r    local_private_key_passwordr&   r'    r,   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/ldap3/core/tls.py__init__F   sd   


zTls.__init__c                 C   s   dt | j d| jrdnd d| jrdnd d| jrdnd d| jr$dnd d| jr,dnd d	| jr4dnd d
t | j dt | j	 dt | j
 dt | j g}d|S )Nz
protocol: zclient private key: zpresent znot presentzclient certificate: zprivate key password: zCA certificates file: zCA certificates path: zCA certificates data: zverify mode: zvalid names: z	ciphers: zsni: z - )strr"   r#   r$   r!   r   r   r    r   r%   r&   r'   join)r(   sr,   r,   r-   __str__   s   
zTls.__str__c                 C   s  | j d u rdnd| }|| jd u rdnd| 7 }|| jd u r"dnd| 7 }|| jd u r0dnd| 7 }|| jd u r>dnd| 7 }|| jd u rLdnd| 7 }|| jd u rZdnd| 7 }|| jd u rhdnd	| 7 }|| j	d u rvdnd
| 7 }d|dd   d }|S )N z/, local_private_key_file={0.private_key_file!r}z/, local_certificate_file={0.certificate_file!r}z, validate={0.validate!r}z, version={0.version!r}z#, ca_certs_file={0.ca_certs_file!r}z#, ca_certs_path={0.ca_certs_path!r}z#, ca_certs_data={0.ca_certs_data!r}z, ciphers={0.ciphers!r}z, sni={0.sni!r}zTls(r   ))
r#   formatr$   r   r"   r   r   r    r&   r'   )r(   rr,   r,   r-   __repr__   s   zTls.__repr__Fc                 C   s"  t r| jdu rttj| j| j| jd}n&t	| j}| js#| js#| jr.|
| j| j| j n| jtjkr:|tj | jrH|j| j| j| jd d|_| j|_| jD ]	}| j|O  _qR| jrrz|| j W n
 tjyq   Y nw | jr|j|jd|| jd}n	|j|jd|d}ttrttd| n]| jdu rttdrtj | _| jrztj|j| j| jd| j| j| j|| jd		}W n tjy     t!y   d| _Y nw | jstj|j| j| jd| j| j| j|d
}ttrttd| |r| jtj"ks| jtj#krt||j$j%| j& ||_dS )z3
        Adds TLS to the connection socket
        N)purposecafilecapathcadata)keyfilepasswordF)server_sidedo_handshake_on_connectserver_hostname)r>   r?   z1socket wrapped with SSL using SSLContext for <%s>PROTOCOL_SSLv23)r<   certfiler>   	cert_reqsssl_versionca_certsr?   r&   )r<   rB   r>   rC   rD   rE   r?   z socket wrapped with SSL for <%s>)'r   r"   r   r   SERVER_AUTHr   r   r    r   
SSLContextload_verify_locationsr   r   load_default_certsr$   load_cert_chainr#   r!   check_hostnameverify_moder   optionsr&   set_ciphersSSLErrorr'   wrap_socketsocketr   r   r
   hasattrrA   	TypeErrorr   r   serverhostr%   )r(   
connectiondo_handshakessl_contextoptionwrapped_socketr,   r,   r-   rP      s   


	
"zTls.wrap_socketc                 C   s  |j jrdS |jr|jr|jjs|jrttrt	td|  dS d|_
ttr,t	td| |jjs3d|_|d}|jjs]||}|dkrQttrOt	td| dS ttr[t	td| dS |jd	 d
vrdt|jd	  |_ttrzt	td|j| t|jttrt	td| | |S )NFz;can't start tls because operations are in progress for <%s>Tzstarting tls for <%s>z1.3.6.1.4.1.1466.20037)NNztls started for <%s>ztls not started for <%s>description)successzstartTLS failed - z%s for <%s>)rT   r   tls_started_executing_deferredstrategy_outstandingsasl_in_progressr   r   r
   starting_tlsr   sync_awaiting_for_async_start_tlsextendedget_responseresultr/   
last_errorr   
_start_tls)r(   rV   rg   responser,   r,   r-   	start_tls   s:   



zTls.start_tlsc              
   C   s   z5z	| j |dd W n& ty0 } zdt| |_ttr%ttd|j| t||jd }~ww W d|_nd|_w |j	rE|j
 jd7  _d|_dS )NT)rW   zwrap socket error: z*error <%s> wrapping socket for TLS in <%s>Fr   )rP   	Exceptionr/   rh   r   r   r
   r   rb   usage_usagewrapped_socketsr]   )r(   rV   er,   r,   r-   ri     s   zTls._start_tls)F)__name__
__module____qualname____doc__r   r   r.   r2   r7   rP   rk   ri   r,   r,   r,   r-   r   ;   s(    
H
J%r   c                 C   s   |   }ttrttd| | |r|gt|tr|n|g }n|g}|D ]E}|s)q$|dkr9ttr6ttd  d S zt|| ttrIttd| W  d S  tyi } zttr_ttt| W Y d }~q$d }~ww tt	rstt	d t
d|t|f )Nzcertificate found for %s: %s*zcertificate matches * wildcardz"certificate matches host name <%s>z"hostname doesn't match certificatez,certificate %s doesn't match any name in %s )getpeercertr   r   r
   
isinstancer	   r   r   r/   r   r   )sockserver_nameadditional_namesserver_certificate
host_names	host_namerp   r,   r,   r-   rK   +  s4   


rK   )rt   
exceptionsr   r   r   r   r   r3   r	   	utils.logr
   r   r   r   r   r   ImportErrorr   r   utils.tls_backportr   r   r   osr   objectr   rK   r,   r,   r,   r-   <module>   sB    


 q