
    ԋg:6                        d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	 dZ
ej                  dk\  r	ddZddZnddZdd	Z G d
 d      Zy)    )annotationsN)get_template)Security)   r   r      c                    || _         y N)minimum_versionctxversions     4lib/python3.12/site-packages/distributed/security.py_set_minimum_versionr      
    %    c                    || _         y r	   )maximum_versionr   s     r   _set_maximum_versionr      r   r   c                   |t         j                  j                  urt        d|      | xj                  t         j
                  t         j                  z  t         j                  z  t         j                  z  z  c_        y NzUnsupported TLS/SSL version: )	ssl
TLSVersionTLSv1_2
ValueErroroptionsOP_NO_SSLv2OP_NO_SSLv3OP_NO_TLSv1OP_NO_TLSv1_1r   s     r   r   r   #   s[    
 #..000<WKHIIOOcoo-?#BSBSS	
r   c                X    |t         j                  j                  urt        d|      y r   )r   r   r   r   r   s     r   r   r   .   s.     #..000<WKHII 1r   c                  d    e Zd ZdZdZddZed        Zd ZddZ	d Z
d	 Zd
 Zd Zd Zd Zd Zy)r   a4  Security configuration for a Dask cluster.

    Default values are loaded from Dask's configuration files, and can be
    overridden in the constructor.

    Parameters
    ----------
    require_encryption : bool, optional
        Whether TLS encryption is required for all connections.
    tls_ca_file : str, optional
        Path to a CA certificate file encoded in PEM format.
    tls_ciphers : str, optional
        An OpenSSL cipher string of allowed ciphers. If not provided, the
        system defaults will be used.
    tls_min_version : ssl.TLSVersion, optional
        The minimum TLS version to support. Defaults to TLS 1.2.
    tls_max_version : ssl.TLSVersion, optional
        The maximum TLS version to support. Defaults to the maximum version
        supported.
    tls_client_cert : str, optional
        Path to a certificate file for the client, encoded in PEM format.
    tls_client_key : str, optional
        Path to a key file for the client, encoded in PEM format.
        Alternatively, the key may be appended to the cert file, and this
        parameter be omitted.
    tls_scheduler_cert : str, optional
        Path to a certificate file for the scheduler, encoded in PEM format.
    tls_scheduler_key : str, optional
        Path to a key file for the scheduler, encoded in PEM format.
        Alternatively, the key may be appended to the cert file, and this
        parameter be omitted.
    tls_worker_cert : str, optional
        Path to a certificate file for a worker, encoded in PEM format.
    tls_worker_key : str, optional
        Path to a key file for a worker, encoded in PEM format.
        Alternatively, the key may be appended to the cert file, and this
        parameter be omitted.
    extra_conn_args : mapping, optional
        Mapping with keyword arguments to pass down to connections.
    )require_encryptiontls_ca_filetls_cipherstls_min_versiontls_max_versiontls_client_keytls_client_certtls_scheduler_keytls_scheduler_certtls_worker_keytls_worker_certextra_conn_argsNc                B   t         j                  dk  r,t        j                  dt         j                   dt
               t        |      j                  | j                        }|rt        dt        |      z        |j                  di       | _        |t        j                  j                  d      }|t!        |      }|| _        | j%                  |dd       | j'                  |d	d
t         j(                  j*                         | j'                  |dd       | j%                  |dd       | j%                  |dd       | j%                  |dd       | j%                  |dd       | j%                  |dd       | j%                  |dd       | j%                  |dd       y )N)r   r   r   zsupport for z7 is deprecated, and will be removed in a future releasezUnknown parameters: %rr-   z#distributed.comm.require-encryptionr$   zdistributed.comm.tls.ciphersr%   z distributed.comm.tls.min-versionr&   z distributed.comm.tls.max-versionr#   zdistributed.comm.tls.ca-filer'   zdistributed.comm.tls.client.keyr(   z distributed.comm.tls.client.certr)   z"distributed.comm.tls.scheduler.keyr*   z#distributed.comm.tls.scheduler.certr+   zdistributed.comm.tls.worker.keyr,   z distributed.comm.tls.worker.cert)r   OPENSSL_VERSION_INFOwarningswarnOPENSSL_VERSIONDeprecationWarningset
difference	__slots__	TypeErrorsortedpopr-   daskconfiggetboolr"   
_set_field_set_tls_version_fieldr   r   )selfr"   kwargsextras       r   __init__zSecurity.__init__q   s   ##i/MMs223 4; ;"
 F&&t~~64ve}DEE%zz*;R@%!%1V!W%!%f"4/MN##.NN""		
 	##.	

 	/MN 02ST 13UV')M	
 	(*O	
 	 02ST 13UVr   c                   	 ddl m} ddlm} ddlm}m} ddlm} ddl	m
} |j                  dd	 |       
      }|j                  |j                  j                  |j                   j"                  |j%                               j'                         }	|j)                  |j+                  |j,                  d      g      }
|j/                  |j1                  d      g      }t2        j2                  j5                  t2        j6                  j8                        j;                  d      }|j=                         j?                  |
      jA                  |
      jC                  |d      jE                  |jE                               jG                  |jI                               jK                  |      jM                  |t3        jN                  d      z         jQ                  ||jS                          |             }|jU                  |j                  j                        j'                         } | dd||	||	||	|d|S # t        $ r t        d      w xY w)aJ  Create a new temporary Security object.

        This creates a new self-signed key/cert pair suitable for securing
        communication for all roles in a Dask cluster. These keys/certs exist
        only in memory, and are stored in this object.

        This method requires the library ``cryptography`` be installed.
        r   )x509)default_backend)hashesserialization)rsa)NameOIDz_Using `Security.temporary` requires `cryptography`, please install it using either pip or condai  i   )public_exponentkey_sizebackend)encodingformatencryption_algorithmzdask-internal)tzN)tzinfoF)criticalim  )daysT)r"   r#   r'   r(   r)   r*   r+   r,    )+cryptographyrE   cryptography.hazmat.backendsrF   cryptography.hazmat.primitivesrG   rH   )cryptography.hazmat.primitives.asymmetricrI   cryptography.x509.oidrJ   ImportErrorgenerate_private_keyprivate_bytesEncodingPEMPrivateFormatPKCS8NoEncryptiondecodeNameNameAttributeCOMMON_NAMESubjectAlternativeNameDNSNamedatetimenowtimezoneutcreplaceCertificateBuildersubject_nameissuer_nameadd_extension
public_keyserial_numberrandom_serial_numbernot_valid_beforenot_valid_after	timedeltasignSHA256public_bytes)clsrA   rE   rF   rG   rH   rI   rJ   keykey_contentsdask_internalaltnamesrj   certcert_contentss                  r   	temporaryzSecurity.temporary   s   
	)DLE5 &&!D/:K ' 
 (("++// ..44!.!;!;!= ) 
 &(	 	 		 3 3_EF
 .._0M/NO##x'8'8'<'<#=EETER##%\-([']8e]4Z()]44467c"_S8#5#53#??@T#v}}(9: 	 ))-*@*@*D*DELLN 

#%')*,')

 

 
	
C  	7 	s    H> >Ic                p    ||v r||   }nt         j                  j                  |      }t        | ||       y r	   )r:   r;   r<   setattr)r@   rA   fieldconfig_namevals        r   r>   zSecurity._set_field   s0    F?-C++//+.CeS!r   c           	        ||v r_||   }d t         j                  j                  t         j                  j                  h}||vrt	        | d|dt        |             |~|}n{|t         j                  j                  t         j                  j                  d}t        j                  j                  |      }||v r||   }nt	        | d|dt        |             t        | ||       y )N=z# is not supported, expected one of )Ng333333?g?)
r   r   r   TLSv1_3r   listr:   r;   r<   r   )r@   rA   r   r   defaultr   valids          r   r?   zSecurity._set_tls_version_field   s    F?-C3>>113>>3I3IJE% gQsg%HeV  { ^^++^^++E
 ++//+.Ce|Cj "m1SG+NtTY{m\  	eS!r   c                .   t        | j                        }|j                  d       i }|D ]g  }t        | |      }|t	        |t
              r
d|v rd||<   ,t	        |t
              r'dt        j                  j                  |       d||<   c|||<   i |S )Nr-   
zTemporary (In-memory)zLocal ())	r8   r6   removegetattr
isinstancestrospathabspath)r@   keysattrkr   s        r   _attr_to_dictzSecurity._attr_to_dict   s    dnn%%&A$"Cc3'DCK5DGS) '(<'=Q?DG!DG  r   c                z    | j                         }ddj                  d |j                         D              z   dz   S )Nz	Security(z, c              3  0   K   | ]  \  }}| d |   yw)r   NrU   ).0r|   values      r   	<genexpr>z$Security.__repr__.<locals>.<genexpr>  s      H<ZS%3%q(<s   r   )r   joinitems)r@   r   s     r   __repr__zSecurity.__repr__	  s>    !!#iiH4::<HHI	
r   c                T    t        d      j                  | j                               S )Nzsecurity.html.j2)security)r   renderr   )r@   s    r   _repr_html_zSecurity._repr_html_  s%    ./66@R@R@T6UUr   c                    |dvrt        d|      | j                  | j                  t        | d|z        t        | d|z        dS )zR
        Return the TLS configuration for the given role, as a flat dict.
        >   clientworker	schedulerzunknown role ztls_%s_certz
tls_%s_key)ca_fileciphersr   r|   )r   r#   r$   r   )r@   roles     r   get_tls_config_for_rolez Security.get_tls_config_for_role  sY     88}TH566''''D-$"674!45	
 	
r   c                X   |j                  d      r|j                  d      r|d   }|d   x}}|j                  d      x}}d|v rt        j                  ||      }nt        j                  ||      }t        || j                         | j
                  t        || j
                         d|v }	|d uxr d|v }
|	s|
rt        j                         5 }|	rFt        j                  j                  |d      }t        |d      5 }|j                  |       d d d        |
rFt        j                  j                  |d	      }t        |d      5 }|j                  |       d d d        |j                  ||       d d d        n|j                  ||       t        j                  |_        d
|_        |xj$                  t        j&                   z  c_        |j                  d      r |j)                  |j                  d             |S y y # 1 sw Y   xY w# 1 sw Y   xY w# 1 sw Y   xY w)Nr   r   r|   r   )purposecadata)r   cafilezdask.crtwzdask.pemFr   )r<   r   create_default_contextr   r%   r&   r   tempfileTemporaryDirectoryr   r   r   openwriteload_cert_chainCERT_REQUIREDverify_modecheck_hostnameverify_flagsVERIFY_X509_STRICTset_ciphers)r@   tlsr   ca	cert_pathr   key_pathr|   r   cert_in_memorykey_in_memorytempdirfs                r   _get_tls_contextzSecurity._get_tls_context!  s   779#''&/YB"6{*I WWU^+Hsrz00L00L !d&:&:;##/$S$*>*>?!T\NtO;M002g%$&GGLL*$E	!)S1QGGDM 2$#%77<<#D!(C0AGGCL 1''	8< 32 ##Ix8 "//CO "'C!7!7 77wwy!	 23JY #2, 21 10 32s<   /H H6H HH H	H H	H  H)c                    | j                  |      }| j                  |t        j                  j                        | j
                  | j                  dS )zh
        Get the *connection_args* argument for a connect() call with
        the given *role*.
        )ssl_contextr"   r-   )r   r   r   PurposeSERVER_AUTHr"   r-   r@   r   r   s      r   get_connection_argszSecurity.get_connection_argsP  sJ    
 **4000ckk6M6MN"&"9"9#33
 	
r   c                    | j                  |      }| j                  |t        j                  j                        | j
                  dS )zg
        Get the *connection_args* argument for a listen() call with
        the given *role*.
        )r   r"   )r   r   r   r   CLIENT_AUTHr"   r   s      r   get_listen_argszSecurity.get_listen_args\  sA    
 **4000ckk6M6MN"&"9"9
 	
r   r	   )__name__
__module____qualname____doc__r6   rC   classmethodr   r>   r?   r   r   r   r   r   r   r   rU   r   r   r   r   8   sZ    'RI&WP :
 :
x""4$
V
-^

	
r   r   )r   zssl.SSLContextr   zssl.TLSVersionreturnNone)
__future__r   ri   r   r   r   r0   r:   dask.widgetsr   __all__r/   r   r   r   rU   r   r   <module>r      sS    "  	 
    %
 |+&&
	
Jm
 m
r   