shell bypass 403
l
��bc @ s� d Z d d l Z d d l Z d d l Z d d l m Z m Z m Z d d l m Z m Z d d l m Z m
Z
m Z d d l m Z m
Z
m Z m Z d d l m Z m Z m Z d d l m Z m Z m Z m Z m Z m Z m Z m Z m Z d d l m Z d d
l m Z m Z m Z d d l m Z i d e 6d
e 6d e 6Z! y d d l m" Z" e" Z# Wn e$ k
r�e% Z# Yn Xd e! e" <d d l& m' Z( d d l& m) Z* d d l& m& Z& m+ Z+ m, Z, d d l- Z- d d l. Z. d d l/ Z/ d Z0 Gd � d e1 � Z2 d d � Z3 d � Z4 Gd � d e � Z5 Gd � d e& � Z6 e% e% e7 e e e% e8 e8 e% d � Z9 d � Z: d Z; d! Z< d" � Z= d# � Z> e e% d$ � Z? d% � Z@ d S(& u This module provides some more Pythonic support for SSL.
Object types:
SSLSocket -- subtype of socket.socket which does SSL over the socket
Exceptions:
SSLError -- exception raised for I/O errors
Functions:
cert_time_to_seconds -- convert time string used for certificate
notBefore and notAfter functions to integer
seconds past the Epoch (the time values
returned from time.time())
fetch_server_certificate (HOST, PORT) -- fetch the certificate provided
by the server running on HOST at port PORT. No
validation of the certificate is performed.
Integer constants:
SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT
SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE
The following group define certificate requirements that one side is
allowing/requiring from the other side:
CERT_NONE - no certificates from the other side are required (or will
be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
validated, and if validation fails, the connection will
also fail
CERT_REQUIRED - certificates are required, and will be validated, and
if validation fails, the connection will also fail
The following constants identify various SSL protocol variants:
PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLSv1
i N( u OPENSSL_VERSION_NUMBERu OPENSSL_VERSION_INFOu OPENSSL_VERSION( u _SSLContextu SSLError( u CERT_NONEu
CERT_OPTIONALu
CERT_REQUIRED( u OP_ALLu OP_NO_SSLv2u OP_NO_SSLv3u OP_NO_TLSv1( u RAND_statusu RAND_egdu RAND_add( u SSL_ERROR_ZERO_RETURNu SSL_ERROR_WANT_READu SSL_ERROR_WANT_WRITEu SSL_ERROR_WANT_X509_LOOKUPu SSL_ERROR_SYSCALLu
SSL_ERROR_SSLu SSL_ERROR_WANT_CONNECTu
SSL_ERROR_EOFu SSL_ERROR_INVALID_ERROR_CODE( u HAS_SNI( u PROTOCOL_SSLv3u PROTOCOL_SSLv23u PROTOCOL_TLSv1( u _OPENSSL_API_VERSIONu TLSv1u SSLv23u SSLv3( u PROTOCOL_SSLv2u SSLv2( u getnameinfo( u error( u socketu AF_INETu SOCK_STREAMu) DEFAULT:!aNULL:!eNULL:!LOW:!EXPORT:!SSLv2c B s | Ee Z d S( N( u __name__u
__module__( u
__locals__( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu CertificateErrork s
u CertificateErrori c C s� g } x� | j d � D]x } | j d � | k rJ t d t | � � � n | d k rf | j d � q t j | � } | j | j d d � � q Wt j d d j | � d t j
� S(
Nu .u *u, too many wildcards in certificate DNS name: u [^.]+u \*u [^.]*u \Au \.u \Z( u splitu countu CertificateErroru repru appendu reu escapeu replaceu compileu joinu
IGNORECASE( u dnu
max_wildcardsu patsu frag( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu _dnsname_to_pato s c C sg | s t d � � n g } | j d d
� } xI | D]A \ } } | d k r4 t | � j | � re d S| j | � q4 q4 W| s� xi | j d d � D]R } xI | D]A \ } } | d k r� t | � j | � r� d S| j | � q� q� Wq� Wn t | � d k r(t d | d j t t | � � f � � n; t | � d k rWt d
| | d f � � n t d � � d S( u# Verify that *cert* (in decoded format as returned by
SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 rules
are mostly followed, but IP addresses are not accepted for *hostname*.
CertificateError is raised on failure. On success, the function
returns nothing.
u empty or no certificateu subjectAltNameu DNSNu subjectu
commonNamei u& hostname %r doesn't match either of %su , u hostname %r doesn't match %ri u= no appropriate commonName or subjectAltName fields were found( ( (
u
ValueErroru getu _dnsname_to_patu matchu appendu lenu CertificateErroru joinu mapu repr( u certu hostnameu dnsnamesu sanu keyu valueu sub( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu match_hostname� s. %c B sA | Ee Z d Z d Z d � Z d � Z d d d d d � Z d S( u| An SSLContext holds various SSL-related configuration options and
data, such as certificates and possibly a private key.u protocolc O s2 t j | | � } | t k r. | j t � n | S( N( u _SSLContextu __new__u _SSLv2_IF_EXISTSu set_ciphersu _DEFAULT_CIPHERS( u clsu protocolu argsu kwargsu self( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu __new__� s c C s
| | _ d S( N( u protocol( u selfu protocol( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu __init__� s c
C s+ t d | d | d | d | d | d | � S( Nu socku server_sideu do_handshake_on_connectu suppress_ragged_eofsu server_hostnameu _context( u SSLSocket( u selfu socku server_sideu do_handshake_on_connectu suppress_ragged_eofsu server_hostname( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu wrap_socket� s
N( u protocolFT(
u __name__u
__module__u __doc__u __slots__u __new__u __init__u Falseu Trueu Noneu wrap_socket( u
__locals__( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu
SSLContext� s
u
SSLContextc B sL | Ee Z d Z d d d d e e d d e e d d d d d d d � Z
d � Z d d � Z d d d � Z
d � Z d d � Z d � Z d d � Z d d
� Z d d � Z d d d
� Z d d d � Z d d d � Z d d d � Z d � Z d � Z d � Z d � Z d d � Z d � Z d � Z d � Z d � Z d � Z! d S( u� This class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel.i c " C s� | r | | _ n� | r. | r. t d � � n | rJ | rJ t d � � n | r` | r` | } n t | � | _ | | j _ | r� | j j | � n | r� | j j | | � n | r� | j j | � n | | _ | | _ | | _ | | _
| | _ | | _ | r| rt d � � n | | _
| | _ | | _ |
| _ d
} | d k r�t j | d | j d | j d | j d | j � �| j | j � � y | j � Wn= t k
r�} z | j t j k r�� n WYd d } ~ Xn Xd } | j � nA | d k rt j | d | �n t j | d | d |
d | �d
| _! d | _" | | _# | r�yY | j j$ | | | � | _" | r�| j � } | d k r�t d � � n | j% � n Wq�t k
r�} z | j& � | � WYd d } ~ Xq�Xn d S( Nu5 certfile must be specified for server-side operationsu certfile must be specifiedu4 server_hostname can only be specified in client modeu familyu typeu protou filenog uH do_handshake_on_connect should not be specified for non-blocking socketsFT(' u contextu
ValueErroru
SSLContextu verify_modeu load_verify_locationsu load_cert_chainu set_ciphersu keyfileu certfileu cert_reqsu ssl_versionu ca_certsu ciphersu server_sideu server_hostnameu do_handshake_on_connectu suppress_ragged_eofsu Falseu Noneu socketu __init__u familyu typeu protou filenou
settimeoutu
gettimeoutu getpeernameu socket_erroru errnou ENOTCONNu Trueu detachu _closedu _sslobju
_connectedu _wrap_socketu do_handshakeu close( u selfu socku keyfileu certfileu server_sideu cert_reqsu ssl_versionu ca_certsu do_handshake_on_connectu familyu typeu protou filenou suppress_ragged_eofsu ciphersu server_hostnameu _contextu connectedu eu timeoutu x( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu __init__� sz
c C s t d | j j � � d S( Nu Can't dup() %s instances( u NotImplementedu __class__u __name__( u self( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu dup s c C s d S( N( ( u selfu msg( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu _checkClosed! s c C s� | j � yD | d k r1 | j j | | � } n | j j | pC d � } | SWn[ t k
r� } z; | j d t k r� | j r� | d k r� d Sd Sn � WYd d } ~ Xn Xd S( uO Read up to LEN bytes and return them.
Return zero-length string on EOF.i i s N( u _checkClosedu Noneu _sslobju readu SSLErroru argsu
SSL_ERROR_EOFu suppress_ragged_eofs( u selfu lenu bufferu vu x( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu read% s
c C s | j � | j j | � S( uh Write DATA to the underlying SSL channel. Returns
number of bytes of DATA actually transmitted.( u _checkClosedu _sslobju write( u selfu data( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu write9 s
c C s | j � | j j | � S( u� Returns a formatted version of the data in the
certificate provided by the other end of the SSL channel.
Return None if no certificate was provided, {} if a
certificate was provided, but not validated.( u _checkClosedu _sslobju peer_certificate( u selfu binary_form( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu getpeercert@ s
c C s( | j � | j s d S| j j � Sd S( N( u _checkClosedu _sslobju Noneu cipher( u self( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu cipherI s
c C s� | j � | j r� | d k r5 t d | j � � n x� y | j j | � } WnV t k
r� } z6 | j d t k rz d S| j d t k r� d S� WYd d } ~ Xq8 X| Sq8 n t j
| | | � Sd S( Ni u3 non-zero flags not allowed in calls to send() on %s( u _checkClosedu _sslobju
ValueErroru __class__u writeu SSLErroru argsu SSL_ERROR_WANT_READu SSL_ERROR_WANT_WRITEu socketu send( u selfu datau flagsu vu x( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu sendP s"
c C sb | j � | j r) t d | j � � n5 | d k rH t j | | | � St j | | | | � Sd S( Nu% sendto not allowed on instances of %s( u _checkClosedu _sslobju
ValueErroru __class__u Noneu socketu sendto( u selfu datau
flags_or_addru addr( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu sendtof s
c C s� | j � | j r� | d k r5 t d | j � � n t | � } d } x3 | | k r| | j | | d � � } | | 7} qJ W| St j | | | � Sd S( Ni u6 non-zero flags not allowed in calls to sendall() on %s( u _checkClosedu _sslobju
ValueErroru __class__u lenu sendu socketu sendall( u selfu datau flagsu amountu countu v( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu sendallp s
i c C sY | j � | j rB | d k r5 t d | j � � n | j | � St j | | | � Sd S( Ni u3 non-zero flags not allowed in calls to recv() on %s( u _checkClosedu _sslobju
ValueErroru __class__u readu socketu recv( u selfu buflenu flags( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu recv� s
c C s� | j � | r+ | d k r+ t | � } n | d k r@ d } n | j r{ | d k rk t d | j � � n | j | | � St j | | | | � Sd S( Ni i u8 non-zero flags not allowed in calls to recv_into() on %s( u _checkClosedu Noneu lenu _sslobju
ValueErroru __class__u readu socketu recv_into( u selfu bufferu nbytesu flags( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu recv_into� s
c C s@ | j � | j r) t d | j � � n t j | | | � Sd S( Nu' recvfrom not allowed on instances of %s( u _checkClosedu _sslobju
ValueErroru __class__u socketu recvfrom( u selfu buflenu flags( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu recvfrom� s
c C sC | j � | j r) t d | j � � n t j | | | | � Sd S( Nu, recvfrom_into not allowed on instances of %s( u _checkClosedu _sslobju
ValueErroru __class__u socketu
recvfrom_into( u selfu bufferu nbytesu flags( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu
recvfrom_into� s
c C s( | j � | j r | j j � Sd Sd S( Ni ( u _checkClosedu _sslobju pending( u self( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu pending� s
c C s' | j � d | _ t j | | � d S( N( u _checkClosedu Noneu _sslobju socketu shutdown( u selfu how( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu shutdown� s
c C s? | j r% | j j � } d | _ | St d t | � � � d S( Nu No SSL wrapper around ( u _sslobju shutdownu Noneu
ValueErroru str( u selfu s( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu unwrap� s
c C s d | _ t j | � d S( N( u Noneu _sslobju socketu _real_close( u self( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu _real_close� s c C sT | j � } z3 | d k r1 | r1 | j d � n | j j � Wd | j | � Xd S( u Perform a TLS/SSL handshake.g N( u
gettimeoutu
settimeoutu Noneu _sslobju do_handshake( u selfu blocku timeout( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu do_handshake� s c C s� | j r t d � � n | j r0 t d � � n | j j | d | j � | _ ya | rl t j | | � } n d } t j | | � | s� | j r� | j
� n d | _ n | SWn t k
r� d | _ � Yn Xd S( Nu! can't connect in server-side modeu/ attempt to connect already-connected SSLSocket!FT( u server_sideu
ValueErroru
_connectedu contextu _wrap_socketu Falseu server_hostnameu _sslobju socketu
connect_exu Noneu connectu do_handshake_on_connectu do_handshakeu Trueu socket_error( u selfu addru
connect_exu rc( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu
_real_connect� s$
c C s | j | d � d S( uQ Connects to remote ADDR, and then wraps the connection in
an SSL channel.NF( u
_real_connectu False( u selfu addr( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu connect� s c C s | j | d � S( uQ Connects to remote ADDR, and then wraps the connection in
an SSL channel.T( u
_real_connectu True( u selfu addr( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu
connect_ex� s c C sI t j | � \ } } | j j | d | j d | j d d �} | | f S( u� Accepts a new connection from a remote client, and returns
a tuple containing that new connection wrapped with a server-side
SSL channel, and the address of the remote client.u do_handshake_on_connectu suppress_ragged_eofsu server_sideT( u socketu acceptu contextu wrap_socketu do_handshake_on_connectu suppress_ragged_eofsu True( u selfu newsocku addr( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu accept� s c C s | j � d S( N( u _real_close( u self( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu __del__� s NFT(" u __name__u
__module__u __doc__u Noneu Falseu CERT_NONEu PROTOCOL_SSLv23u Trueu AF_INETu SOCK_STREAMu __init__u dupu _checkClosedu readu writeu getpeercertu cipheru sendu sendtou sendallu recvu recv_intou recvfromu
recvfrom_intou pendingu shutdownu unwrapu _real_closeu do_handshakeu
_real_connectu connectu
connect_exu acceptu __del__( u
__locals__( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu SSLSocket� s@
J
u SSLSocketc
C sC t d | d | d | d | d | d | d | d | d | d
| �
S( Nu socku keyfileu certfileu server_sideu cert_reqsu ssl_versionu ca_certsu do_handshake_on_connectu suppress_ragged_eofsu ciphers( u SSLSocket(
u socku keyfileu certfileu server_sideu cert_reqsu ssl_versionu ca_certsu do_handshake_on_connectu suppress_ragged_eofsu ciphers( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu wrap_socket s c C s% d d l } | j | j | d � � S( u� Takes a date-time string in standard ASN1_print form
("MON DAY 24HOUR:MINUTE:SEC YEAR TIMEZONE") and return
a Python time value in seconds past the epoch.i Nu %b %d %H:%M:%S %Y GMT( u timeu mktimeu strptime( u cert_timeu time( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu cert_time_to_seconds s u -----BEGIN CERTIFICATE-----u -----END CERTIFICATE-----c C s? t t j | � d d � } t d t j | d � d t d S( u[ Takes a certificate in binary DER format and returns the
PEM version of it as a string.u ASCIIu strictu
i@ ( u stru base64u standard_b64encodeu
PEM_HEADERu textwrapu fillu
PEM_FOOTER( u der_cert_bytesu f( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu DER_cert_to_PEM_cert s c C s� | j t � s" t d t � � n | j � j t � sJ t d t � � n | j � t t � t t � � } t j | j d d � � S( uh Takes a certificate in ASCII PEM format and returns the
DER-encoded version of it as a byte sequenceu( Invalid PEM encoding; must start with %su& Invalid PEM encoding; must end with %su ASCIIu strict(
u
startswithu
PEM_HEADERu
ValueErroru stripu endswithu
PEM_FOOTERu lenu base64u decodebytesu encode( u pem_cert_stringu d( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu PEM_cert_to_DER_cert# s
#c C sx | \ } } | d k r! t } n t } t t � d | d | d | �} | j | � | j d � } | j � t | � S( u� Retrieve the certificate from the server at the specified address,
and return it as a PEM-encoded string.
If 'ca_certs' is specified, validate the server cert against it.
If 'ssl_version' is specified, use it in the connection attempt.u ssl_versionu cert_reqsu ca_certsNT(
u Noneu
CERT_REQUIREDu CERT_NONEu wrap_socketu socketu connectu getpeercertu Trueu closeu DER_cert_to_PEM_cert( u addru ssl_versionu ca_certsu hostu portu cert_reqsu su dercert( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu get_server_certificate0 s
c C s t j | d � S( Nu <unknown>( u _PROTOCOL_NAMESu get( u
protocol_code( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu get_protocol_nameB s (A u __doc__u textwrapu reu _sslu OPENSSL_VERSION_NUMBERu OPENSSL_VERSION_INFOu OPENSSL_VERSIONu _SSLContextu SSLErroru CERT_NONEu
CERT_OPTIONALu
CERT_REQUIREDu OP_ALLu OP_NO_SSLv2u OP_NO_SSLv3u OP_NO_TLSv1u RAND_statusu RAND_egdu RAND_addu SSL_ERROR_ZERO_RETURNu SSL_ERROR_WANT_READu SSL_ERROR_WANT_WRITEu SSL_ERROR_WANT_X509_LOOKUPu SSL_ERROR_SYSCALLu
SSL_ERROR_SSLu SSL_ERROR_WANT_CONNECTu
SSL_ERROR_EOFu SSL_ERROR_INVALID_ERROR_CODEu HAS_SNIu PROTOCOL_SSLv3u PROTOCOL_SSLv23u PROTOCOL_TLSv1u _OPENSSL_API_VERSIONu _PROTOCOL_NAMESu PROTOCOL_SSLv2u _SSLv2_IF_EXISTSu ImportErroru Noneu socketu getnameinfou _getnameinfou erroru socket_erroru AF_INETu SOCK_STREAMu base64u tracebacku errnou _DEFAULT_CIPHERSu
ValueErroru CertificateErroru _dnsname_to_patu match_hostnameu
SSLContextu SSLSocketu Falseu Trueu wrap_socketu cert_time_to_secondsu
PEM_HEADERu
PEM_FOOTERu DER_cert_to_PEM_certu PEM_cert_to_DER_certu get_server_certificateu get_protocol_name( ( ( u* /usr/local/python-3.2/lib/python3.2/ssl.pyu <module>7 s^ " @
)� :