
    0Fie+6                        d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	m
Z
 dZej        dk    sej        dk    r	ddZddZnddZddZ G d d          ZdS )    )annotationsN)get_template)Security)   
   )   r   r      ctxssl.SSLContextversionssl.TLSVersionreturnNonec                    || _         d S N)minimum_versionr
   r   s     4lib/python3.11/site-packages/distributed/security.py_set_minimum_versionr          %    c                    || _         d S r   )maximum_versionr   s     r   _set_maximum_versionr      r   r   c                    |t           j        j        urt          d|          | xj        t           j        t           j        z  t           j        z  t           j        z  z  c_        d S NzUnsupported TLS/SSL version: )	ssl
TLSVersionTLSv1_2
ValueErroroptionsOP_NO_SSLv2OP_NO_SSLv3OP_NO_TLSv1OP_NO_TLSv1_1r   s     r   r   r   $   sZ    
 #.000HWHHIIIOco-?#BSS	
r   c                P    |t           j        j        urt          d|          d S r   )r   r   r   r    r   s     r   r   r   /   s3     #.000HWHHIII 10r   c                  l    e Zd ZdZdZddZed             Zd ZddZ	d Z
d	 Zd
 Zd Zd Zd Zd ZdS )r   a4  Security configuration for a Dask cluster.

    Default values are loaded from Dask's configuration files, and can be
    overridden in the constructor.

    Parameters
    ----------
    require_encryption : bool, optional
        Whether TLS encryption is required for all connections.
    tls_ca_file : str, optional
        Path to a CA certificate file encoded in PEM format.
    tls_ciphers : str, optional
        An OpenSSL cipher string of allowed ciphers. If not provided, the
        system defaults will be used.
    tls_min_version : ssl.TLSVersion, optional
        The minimum TLS version to support. Defaults to TLS 1.2.
    tls_max_version : ssl.TLSVersion, optional
        The maximum TLS version to support. Defaults to the maximum version
        supported.
    tls_client_cert : str, optional
        Path to a certificate file for the client, encoded in PEM format.
    tls_client_key : str, optional
        Path to a key file for the client, encoded in PEM format.
        Alternatively, the key may be appended to the cert file, and this
        parameter be omitted.
    tls_scheduler_cert : str, optional
        Path to a certificate file for the scheduler, encoded in PEM format.
    tls_scheduler_key : str, optional
        Path to a key file for the scheduler, encoded in PEM format.
        Alternatively, the key may be appended to the cert file, and this
        parameter be omitted.
    tls_worker_cert : str, optional
        Path to a certificate file for a worker, encoded in PEM format.
    tls_worker_key : str, optional
        Path to a key file for a worker, encoded in PEM format.
        Alternatively, the key may be appended to the cert file, and this
        parameter be omitted.
    extra_conn_args : mapping, optional
        Mapping with keyword arguments to pass down to connections.
    )require_encryptiontls_ca_filetls_cipherstls_min_versiontls_max_versiontls_client_keytls_client_certtls_scheduler_keytls_scheduler_certtls_worker_keytls_worker_certextra_conn_argsNc                   t           j        dk     r(t          j        dt           j         dt
                     t          |                              | j                  }|rt          dt          |          z            |                    di           | _        |t          j                            d          }|t!          |          }|| _        |                     |dd           |                     |d	d
t           j        j                   |                     |dd           |                     |dd           |                     |dd           |                     |dd           |                     |dd           |                     |dd           |                     |dd           |                     |dd           d S )N)r   r   r   zsupport for z7 is deprecated, and will be removed in a future releasezUnknown parameters: %rr3   z#distributed.comm.require-encryptionr*   zdistributed.comm.tls.ciphersr+   z distributed.comm.tls.min-versionr,   z distributed.comm.tls.max-versionr)   zdistributed.comm.tls.ca-filer-   zdistributed.comm.tls.client.keyr.   z distributed.comm.tls.client.certr/   z"distributed.comm.tls.scheduler.keyr0   z#distributed.comm.tls.scheduler.certr1   zdistributed.comm.tls.worker.keyr2   z distributed.comm.tls.worker.cert)r   OPENSSL_VERSION_INFOwarningswarnOPENSSL_VERSIONDeprecationWarningset
difference	__slots__	TypeErrorsortedpopr3   daskconfiggetboolr(   
_set_field_set_tls_version_fieldr   r   )selfr(   kwargsextras       r   __init__zSecurity.__init__r   s   #i//M;s2 ; ; ;"  
 F&&t~66 	F4ve}}DEEE%zz*;R@@%!%1V!W!W%!%f"4/MNNN##.N"		
 	
 	
 	##.	
 	
 	

 	/MNNN 02STTT 13UVVV')M	
 	
 	
 	(*O	
 	
 	
 	 02STTT 13UVVVVVr   c                "   	 ddl m} ddlm} ddlm}m} ddlm} ddl	m
} n# t          $ r t          d          w xY w|                    dd	 |            
          }|                    |j        j        |j        j        |                                                                          }	|                    |                    |j        d          g          }
|                    |                    d          g          }t2          j                            t2          j        j                                      d          }|                                                    |
                               |
          !                    |d          "                    |"                                          #                    |$                                          %                    |          &                    |t3          j'        d          z             (                    ||)                                 |                      }|*                    |j        j                                                  } | dd||	||	||	|d|S )aJ  Create a new temporary Security object.

        This creates a new self-signed key/cert pair suitable for securing
        communication for all roles in a Dask cluster. These keys/certs exist
        only in memory, and are stored in this object.

        This method requires the library ``cryptography`` be installed.
        r   )x509)default_backend)hashesserialization)rsa)NameOIDz_Using `Security.temporary` requires `cryptography`, please install it using either pip or condai  i   )public_exponentkey_sizebackend)encodingformatencryption_algorithmzdask-internal)tzN)tzinfoF)criticalim  )daysT)r(   r)   r-   r.   r/   r0   r1   r2    )+cryptographyrK   cryptography.hazmat.backendsrL   cryptography.hazmat.primitivesrM   rN   )cryptography.hazmat.primitives.asymmetricrO   cryptography.x509.oidrP   ImportErrorgenerate_private_keyprivate_bytesEncodingPEMPrivateFormatPKCS8NoEncryptiondecodeNameNameAttributeCOMMON_NAMESubjectAlternativeNameDNSNamedatetimenowtimezoneutcreplaceCertificateBuildersubject_nameissuer_nameadd_extension
public_keyserial_numberrandom_serial_numbernot_valid_beforenot_valid_after	timedeltasignSHA256public_bytes)clsrG   rK   rL   rM   rN   rO   rP   keykey_contentsdask_internalaltnamesrp   certcert_contentss                  r   	temporaryzSecurity.temporary   s   
	))))))DDDDDDLLLLLLLLEEEEEE5555555 	 	 	7  	
 &&!D//:K:K ' 
 
 (("+/ .4!.!;!;!=!= ) 
 
 &((	 	 		 3_EEF
 
 .._0M0M/NOO##x'8'<#==EETERR##%%\-((['']8e]44Z(())]4446677c""_S8#53#?#?#??@@T#v}}(9(9:: 	 ))-*@*DEELLNNs 

#%')*,')

 

 

 

 
	
s    # =c                    ||v r	||         }nt           j                            |          }t          | ||           d S r   )r@   rA   rB   setattr)rF   rG   fieldconfig_namevals        r   rD   zSecurity._set_field   sA    F??-CC+//+..CeS!!!!!r   c           	        ||v rX||         }d t           j        j        t           j        j        h}||vr$t	          | d|dt          |                     ||}nt|t           j        j        t           j        j        d}t          j                            |          }||v r	||         }n$t	          | d|dt          |                     t          | ||           d S )N=z# is not supported, expected one of )Ng333333?g?)
r   r   r   TLSv1_3r    listr@   rA   rB   r   )rF   rG   r   r   defaultr   valids          r   rE   zSecurity._set_tls_version_field   s	   F??-C3>13>3IJE% VVsVVeVV   { ^+^+ E
 +//+..Ce||Cj "\\S\\tTY{{\\   	eS!!!!!r   c                J   t          | j                  }|                    d           i }|D ]t}t          | |          }|`t	          |t
                    r
d|v rd||<   3t	          |t
                    r'dt          j                            |           d||<   o|||<   u|S )Nr3   
zTemporary (In-memory)zLocal ())	r>   r<   removegetattr
isinstancestrospathabspath)rF   keysattrkr   s        r   _attr_to_dictzSecurity._attr_to_dict   s    dn%%%&&& 	" 	"A$""Cc3'' "DCKK5DGGS)) "?(<(<???DGG!DGr   c                    |                                  }dd                    d |                                D                       z   dz   S )Nz	Security(z, c              3  *   K   | ]\  }}| d | V  dS )r   Nr[   ).0r   values      r   	<genexpr>z$Security.__repr__.<locals>.<genexpr>  s4      HHZS%3((((HHHHHHr   r   )r   joinitems)rF   r   s     r   __repr__zSecurity.__repr__
  sO    !!##iiHH4::<<HHHHHI	
r   c                l    t          d                              |                                           S )Nzsecurity.html.j2)security)r   renderr   )rF   s    r   _repr_html_zSecurity._repr_html_  s.    .//66@R@R@T@T6UUUr   c                    |dvrt          d|          | j        | j        t          | d|z            t          | d|z            dS )zR
        Return the TLS configuration for the given role, as a flat dict.
        >   clientworker	schedulerzunknown role ztls_%s_certz
tls_%s_key)ca_fileciphersr   r   )r    r)   r*   r   )rF   roles     r   get_tls_config_for_rolez Security.get_tls_config_for_role  sf     8885T55666''D-$"6774!455	
 
 	
r   c                t   |                     d          r|                     d          r|d         }|d         x}}|                     d          x}}d|v rt          j        ||          }nt          j        ||          }t          || j                   | j        t          || j                   d|v }	|d uod|v }
|	s|
r t          j                    5 }|	r]t          j
                            |d          }t          |d          5 }|                    |           d d d            n# 1 swxY w Y   |
r]t          j
                            |d	          }t          |d          5 }|                    |           d d d            n# 1 swxY w Y   |                    ||           d d d            n# 1 swxY w Y   n|                    ||           t          j        |_        d
|_        |                     d          r(|                    |                     d                     |S d S d S )Nr   r   r   r   )purposecadata)r   cafilezdask.crtwzdask.pemFr   )rB   r   create_default_contextr   r+   r,   r   tempfileTemporaryDirectoryr   r   r   openwriteload_cert_chainCERT_REQUIREDverify_modecheck_hostnameset_ciphers)rF   tlsr   ca	cert_pathr   key_pathr   r
   cert_in_memorykey_in_memorytempdirfs                r   _get_tls_contextzSecurity._get_tls_context"  s   779 *	#''&// *	YB"6{*I WWU^^+Hsrzz0LLL0LLL !d&:;;;#/$S$*>???!T\NtO;M 9 9022 	=g% *$&GLL*$E$E	!)S11 *QGGDMMM* * * * * * * * * * * * * * *$ )#%7<<#D#D!(C00 )AGGCLLL) ) ) ) ) ) ) ) ) ) ) ) ) ) )''	8<<<	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= 	= ##Ix888 "/CO "'Cwwy!! 4	 2 2333JU*	 *	 *	 *	sZ   3F=D1%F=1D5	5F=8D5	95F=.FF=F	F=F	F==GGc                    |                      |          }|                     |t          j        j                  | j        | j        dS )zh
        Get the *connection_args* argument for a connect() call with
        the given *role*.
        )ssl_contextr(   r3   )r   r   r   PurposeSERVER_AUTHr(   r3   rF   r   r   s      r   get_connection_argszSecurity.get_connection_argsO  sJ    
 **40000ck6MNN"&"9#3
 
 	
r   c                    |                      |          }|                     |t          j        j                  | j        dS )zg
        Get the *connection_args* argument for a listen() call with
        the given *role*.
        )r   r(   )r   r   r   r   CLIENT_AUTHr(   r   s      r   get_listen_argszSecurity.get_listen_args[  sD    
 **40000ck6MNN"&"9
 
 	
r   r   )__name__
__module____qualname____doc__r<   rI   classmethodr   rD   rE   r   r   r   r   r   r   r   r[   r   r   r   r   9   s        ' 'RI&W &W &W &WP :
 :
 [:
x" " "" " " "4  $
 
 
V V V
 
 
+ + +Z

 

 

	
 	
 	
 	
 	
r   r   )r
   r   r   r   r   r   )
__future__r   ro   r   r   sysr   r6   r@   dask.widgetsr   __all__version_infor5   r   r   r   r[   r   r   <module>r      s   " " " " " "  				 



 



    % % % % % %
 w#":l"J"J& & & && & & & &
	
 	
 	
 	
J J J Jk
 k
 k
 k
 k
 k
 k
 k
 k
 k
r   