raindancers-cloudfront 0.0.39 → 0.0.41

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/contrib/pyopenssl.py

@@ -40,8 +40,10 @@ like this:
 
 from __future__ import annotations
 
-import OpenSSL.SSL  # type: ignore[import-not-found]
+import OpenSSL.SSL
 from cryptography import x509
+from cryptography.hazmat.primitives.serialization import load_pem_private_key
+from cryptography.x509.oid import NameOID
 
 try:
     from cryptography.x509 import UnsupportedExtension  # type: ignore[attr-defined]
@@ -54,13 +56,12 @@ except ImportError:
 import logging
 import ssl
 import typing
-from io import BytesIO
 from socket import socket as socket_cls
 
 from .. import util
 
 if typing.TYPE_CHECKING:
-    from OpenSSL.crypto import X509  # type: ignore[import-not-found]
+    from OpenSSL.crypto import X509
 
 
 __all__ = ["inject_into_urllib3", "extract_from_urllib3"]
@@ -69,9 +70,11 @@ __all__ = ["inject_into_urllib3", "extract_from_urllib3"]
 _openssl_versions: dict[int, int] = {
     util.ssl_.PROTOCOL_TLS: OpenSSL.SSL.SSLv23_METHOD,  # type: ignore[attr-defined]
     util.ssl_.PROTOCOL_TLS_CLIENT: OpenSSL.SSL.SSLv23_METHOD,  # type: ignore[attr-defined]
-    ssl.PROTOCOL_TLSv1: OpenSSL.SSL.TLSv1_METHOD,
 }
 
+if hasattr(ssl, "PROTOCOL_TLSv1") and hasattr(OpenSSL.SSL, "TLSv1_METHOD"):
+    _openssl_versions[ssl.PROTOCOL_TLSv1] = OpenSSL.SSL.TLSv1_METHOD
+
 if hasattr(ssl, "PROTOCOL_TLSv1_1") and hasattr(OpenSSL.SSL, "TLSv1_1_METHOD"):
     _openssl_versions[ssl.PROTOCOL_TLSv1_1] = OpenSSL.SSL.TLSv1_1_METHOD
 
@@ -270,6 +273,15 @@ def get_subj_alt_name(peer_cert: X509) -> list[tuple[str, str]]:
     return names
 
 
+def _get_common_name(peer_cert: X509) -> str | None:
+    """
+    Given a pyOpenSSL certificate, return the subject's common name.
+    """
+    cert = peer_cert.to_cryptography()
+    names = cert.subject.get_attributes_for_oid(NameOID.COMMON_NAME)
+    return typing.cast(str, names[0].value) if names else None
+
+
 class WrappedSocket:
     """API-compatibility wrapper for Python OpenSSL's Connection-class."""
 
@@ -318,11 +330,11 @@ class WrappedSocket:
         except OpenSSL.SSL.Error as e:
             raise ssl.SSLError(f"read error: {e!r}") from e
         else:
-            return data  # type: ignore[no-any-return]
+            return data
 
     def recv_into(self, *args: typing.Any, **kwargs: typing.Any) -> int:
         try:
-            return self.connection.recv_into(*args, **kwargs)  # type: ignore[no-any-return]
+            return self.connection.recv_into(*args, **kwargs)
         except OpenSSL.SSL.SysCallError as e:
             if self.suppress_ragged_eofs and e.args == (-1, "Unexpected EOF"):
                 return 0
@@ -349,7 +361,7 @@ class WrappedSocket:
     def _send_until_done(self, data: bytes) -> int:
         while True:
             try:
-                return self.connection.send(data)  # type: ignore[no-any-return]
+                return self.connection.send(data)
             except OpenSSL.SSL.WantWriteError as e:
                 if not util.wait_for_write(self.socket, self.socket.gettimeout()):
                     raise TimeoutError() from e
@@ -382,24 +394,32 @@ class WrappedSocket:
         except OpenSSL.SSL.Error:
             return
 
+    @typing.overload
+    def getpeercert(
+        self, binary_form: typing.Literal[False] = False
+    ) -> dict[str, list[typing.Any]] | None: ...
+
+    @typing.overload
+    def getpeercert(self, binary_form: typing.Literal[True]) -> bytes | None: ...
+
     def getpeercert(
         self, binary_form: bool = False
-    ) -> dict[str, list[typing.Any]] | None:
+    ) -> dict[str, list[typing.Any]] | bytes | None:
         x509 = self.connection.get_peer_certificate()
 
-        if not x509:
-            return x509  # type: ignore[no-any-return]
+        if x509 is None:
+            return None
 
         if binary_form:
-            return OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_ASN1, x509)  # type: ignore[no-any-return]
+            return OpenSSL.crypto.dump_certificate(OpenSSL.crypto.FILETYPE_ASN1, x509)
 
         return {
-            "subject": ((("commonName", x509.get_subject().CN),),),  # type: ignore[dict-item]
+            "subject": ((("commonName", _get_common_name(x509)),),),  # type: ignore[dict-item]
             "subjectAltName": get_subj_alt_name(x509),
         }
 
     def version(self) -> str:
-        return self.connection.get_protocol_version_name()  # type: ignore[no-any-return]
+        return self.connection.get_protocol_version_name()
 
     def selected_alpn_protocol(self) -> str | None:
         alpn_proto = self.connection.get_alpn_proto_negotiated()
@@ -441,7 +461,7 @@ class PyOpenSSLContext:
     @verify_flags.setter
     def verify_flags(self, value: int) -> None:
         self._verify_flags = value
-        self._ctx.get_cert_store().set_flags(self._verify_flags)
+        self._ctx.get_cert_store().set_flags(self._verify_flags)  # type: ignore[union-attr]
 
     @property
     def verify_mode(self) -> int:
@@ -472,7 +492,7 @@ class PyOpenSSLContext:
         try:
             self._ctx.load_verify_locations(cafile, capath)
             if cadata is not None:
-                self._ctx.load_verify_locations(BytesIO(cadata))
+                self._ctx.load_verify_locations(cadata)
         except OpenSSL.SSL.Error as e:
             raise ssl.SSLError(f"unable to load trusted certificates: {e!r}") from e
 
@@ -480,21 +500,41 @@ class PyOpenSSLContext:
         self,
         certfile: str,
         keyfile: str | None = None,
-        password: str | None = None,
+        password: str | bytes | None = None,
     ) -> None:
         try:
             self._ctx.use_certificate_chain_file(certfile)
             if password is not None:
                 if not isinstance(password, bytes):
-                    password = password.encode("utf-8")  # type: ignore[assignment]
-                self._ctx.set_passwd_cb(lambda *_: password)
-            self._ctx.use_privatekey_file(keyfile or certfile)
-        except OpenSSL.SSL.Error as e:
+                    password = password.encode("utf-8")
+                # pyOpenSSL added cryptography-key support in 24.3.0.
+                # Keep using the older password-callback path until 2026's
+                # versions because set_passwd_cb() became deprecated in 26.3.0.
+                if int(OpenSSL.__version__.split(".")[0]) >= 26:
+                    with open(keyfile or certfile, "rb") as key_file:
+                        key_data = key_file.read()
+                    try:
+                        private_key = load_pem_private_key(key_data, password)
+                    except TypeError:
+                        # Match SSLContext by ignoring passwords supplied
+                        # for unencrypted keys.
+                        # Incorrect passwords for encrypted keys raise
+                        # ValueError instead.
+                        private_key = load_pem_private_key(key_data, None)
+                    # cryptography's loader returns a wider private-key union
+                    # than pyOpenSSL accepts, so we add `type: ignore` here.
+                    self._ctx.use_privatekey(private_key)  # type: ignore[arg-type]
+                else:
+                    self._ctx.set_passwd_cb(lambda *_: password)
+                    self._ctx.use_privatekey_file(keyfile or certfile)
+            else:
+                self._ctx.use_privatekey_file(keyfile or certfile)
+        except (OpenSSL.SSL.Error, TypeError, ValueError) as e:
             raise ssl.SSLError(f"Unable to load certificate chain: {e!r}") from e
 
     def set_alpn_protocols(self, protocols: list[bytes | str]) -> None:
         protocols = [util.util.to_bytes(p, "ascii") for p in protocols]
-        return self._ctx.set_alpn_protos(protocols)  # type: ignore[no-any-return]
+        return self._ctx.set_alpn_protos(protocols)  # type: ignore[arg-type]
 
     def wrap_socket(
         self,

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/contrib/socks.py

@@ -41,7 +41,7 @@ with the proxy:
 from __future__ import annotations
 
 try:
-    import socks  # type: ignore[import-untyped]
+    import socks
 except ImportError:
     import warnings
 
@@ -111,11 +111,11 @@ class SOCKSConnection(HTTPConnection):
                 (self.host, self.port),
                 proxy_type=self._socks_options["socks_version"],
                 proxy_addr=self._socks_options["proxy_host"],
-                proxy_port=self._socks_options["proxy_port"],
+                proxy_port=self._socks_options["proxy_port"],  # type: ignore[arg-type]
                 proxy_username=self._socks_options["username"],
                 proxy_password=self._socks_options["password"],
                 proxy_rdns=self._socks_options["rdns"],
-                timeout=self.timeout,
+                timeout=self.timeout,  # type: ignore[arg-type]
                 **extra_kw,
             )
 
@@ -192,10 +192,8 @@ class SOCKSProxyManager(PoolManager):
     ):
         parsed = parse_url(proxy_url)
 
-        if username is None and password is None and parsed.auth is not None:
-            split = parsed.auth.split(":")
-            if len(split) == 2:
-                username, password = split
+        if username is None and password is None:
+            username, password = parsed.auth_decoded
         if parsed.scheme == "socks5":
             socks_version = socks.PROXY_TYPE_SOCKS5
             rdns = False

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/http2/connection.py

@@ -127,10 +127,11 @@ class HTTP2Connection(HTTPSConnection):
         self._request_url = url or "/"
         self._validate_path(url)  # type: ignore[attr-defined]
 
+        port = self.port if self.port is not None else 443
         if ":" in self.host:
-            authority = f"[{self.host}]:{self.port or 443}"
+            authority = f"[{self.host}]:{port}"
         else:
-            authority = f"{self.host}:{self.port or 443}"
+            authority = f"{self.host}:{port}"
 
         self._headers.append((b":scheme", b"https"))
         self._headers.append((b":method", method.encode()))

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/poolmanager.py

@@ -47,6 +47,8 @@ SSL_KEYWORDS = (
     "ssl_context",
     "key_password",
     "server_hostname",
+    "assert_hostname",
+    "assert_fingerprint",
 )
 # Default value for `blocksize` - a new parameter introduced to
 # http.client.HTTPConnection & http.client.HTTPSConnection in Python 3.7
@@ -309,7 +311,7 @@ class PoolManager(RequestMethods):
 
         request_context = self._merge_pool_kwargs(pool_kwargs)
         request_context["scheme"] = scheme or "http"
-        if not port:
+        if port is None:
             port = port_by_scheme.get(request_context["scheme"].lower(), 80)
         request_context["port"] = port
         request_context["host"] = host
@@ -452,7 +454,7 @@ class PoolManager(RequestMethods):
             kw["headers"] = self.headers
 
         if self._proxy_requires_url_absolute_form(u):
-            response = conn.urlopen(method, url, **kw)
+            response = conn.urlopen(method, u._replace(fragment=None).url, **kw)
         else:
             response = conn.urlopen(method, u.request_uri, **kw)
 
@@ -468,6 +470,11 @@ class PoolManager(RequestMethods):
             method = "GET"
             # And lose the body not to transfer anything sensitive.
             kw["body"] = None
+            # The body is gone, so the state that describes it has to go too:
+            # there is nothing left to frame with chunked transfer encoding,
+            # and nothing left to rewind.
+            kw["chunked"] = False
+            kw["body_pos"] = None
             kw["headers"] = HTTPHeaderDict(kw["headers"])._prepare_for_method_change()
 
         retries = kw.get("retries", response.retries)
@@ -581,13 +588,30 @@ class ProxyManager(PoolManager):
         if proxy.scheme not in ("http", "https"):
             raise ProxySchemeUnknown(proxy.scheme)
 
-        if not proxy.port:
+        # Keep the deprecated ssl_context fallback on the manager for
+        # compatibility, while passing only explicit proxy policy to connections.
+        self.proxy_ssl_context = proxy_ssl_context
+        if (
+            use_forwarding_for_https
+            and proxy.scheme == "https"
+            and connection_pool_kw.get("ssl_context") is not None
+        ):
+            warnings.warn(
+                "Passing ssl_context when use_forwarding_for_https=True is deprecated "
+                "and will raise an error in urllib3 v3.0. "
+                "Use proxy_ssl_context to configure the TLS connection to the proxy.",
+                FutureWarning,
+                stacklevel=2,
+            )
+            if self.proxy_ssl_context is None:
+                self.proxy_ssl_context = connection_pool_kw.get("ssl_context")
+
+        if proxy.port is None:
             port = port_by_scheme.get(proxy.scheme, 80)
             proxy = proxy._replace(port=port)
 
         self.proxy = proxy
         self.proxy_headers = proxy_headers or {}
-        self.proxy_ssl_context = proxy_ssl_context
         self.proxy_config = ProxyConfig(
             proxy_ssl_context,
             use_forwarding_for_https,

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/response.py

@@ -50,6 +50,16 @@ if typing.TYPE_CHECKING:
 
 log = logging.getLogger(__name__)
 
+# Read in 64 KiB chunks
+_READ_CHUNK_SIZE = 2**16
+
+# Maximum length of a chunk-size line (and the trailing CRLF line) when reading a
+# chunked-transfer-encoded response. Matches ``http.client._MAXLINE`` so urllib3's
+# streaming path bounds these reads exactly like the stdlib ``.read()`` path does,
+# preventing a malicious server from forcing unbounded buffering (memory exhaustion)
+# via an unterminated chunk-size line.
+_MAX_CHUNK_LINE_LENGTH = 2**16
+
 
 class ContentDecoder:
     def decompress(self, data: bytes, max_length: int = -1) -> bytes:
@@ -73,6 +83,10 @@ class DeflateDecoder(ContentDecoder):
     def decompress(self, data: bytes, max_length: int = -1) -> bytes:
         data = self._unfed_data + data
         self._unfed_data = b""
+        # Data received after EOF cannot produce more output from this
+        # Deflate stream.
+        if self._obj.eof:
+            return b""
         if not data and not self._obj.unconsumed_tail:
             return data
         original_max_length = max_length
@@ -115,7 +129,9 @@ class DeflateDecoder(ContentDecoder):
     @property
     def has_unconsumed_tail(self) -> bool:
         return bool(self._unfed_data) or (
-            bool(self._obj.unconsumed_tail) and not self._first_try
+            bool(self._obj.unconsumed_tail)
+            and not self._first_try
+            and not self._obj.eof
         )
 
     def flush(self) -> bytes:
@@ -496,6 +512,8 @@ class BaseHTTPResponse(io.IOBase):
             self.chunked = True
 
         self._decoder: ContentDecoder | None = None
+        # Distinguish an uninitialized decoder from a response needing no decoder.
+        self._decoder_initialized = False
         self.length_remaining: int | None
 
     def get_redirect_location(self) -> str | None | typing.Literal[False]:
@@ -559,7 +577,7 @@ class BaseHTTPResponse(io.IOBase):
         self._retries = retries
 
     def stream(
-        self, amt: int | None = 2**16, decode_content: bool | None = None
+        self, amt: int | None = _READ_CHUNK_SIZE, decode_content: bool | None = None
     ) -> typing.Iterator[bytes]:
         raise NotImplementedError()
 
@@ -601,10 +619,13 @@ class BaseHTTPResponse(io.IOBase):
         """
         Set-up the _decoder attribute if necessary.
         """
-        # Note: content-encoding value should be case-insensitive, per RFC 7230
-        # Section 3.2
-        content_encoding = self.headers.get("content-encoding", "").lower()
+        if self._decoder_initialized:
+            return
+
         if self._decoder is None:
+            # Note: content-encoding value should be case-insensitive, per RFC 7230
+            # Section 3.2
+            content_encoding = self.headers.get("content-encoding", "").lower()
             if content_encoding in self.CONTENT_DECODERS:
                 self._decoder = _get_decoder(content_encoding)
             elif "," in content_encoding:
@@ -616,6 +637,8 @@ class BaseHTTPResponse(io.IOBase):
                 if encodings:
                     self._decoder = _get_decoder(content_encoding)
 
+        self._decoder_initialized = True
+
     def _decode(
         self,
         data: bytes,
@@ -798,7 +821,8 @@ class HTTPResponse(BaseHTTPResponse):
         Unread data in the HTTPResponse connection blocks the connection from being released back to the pool.
         """
         try:
-            self._raw_read()
+            while self._raw_read(_READ_CHUNK_SIZE):
+                pass
         except (HTTPError, OSError, BaseSSLError, HTTPException):
             pass
         if self._has_decoded_content:
@@ -1236,7 +1260,7 @@ class HTTPResponse(BaseHTTPResponse):
         return self._decoded_buffer.get(amt)
 
     def stream(
-        self, amt: int | None = 2**16, decode_content: bool | None = None
+        self, amt: int | None = _READ_CHUNK_SIZE, decode_content: bool | None = None
     ) -> typing.Generator[bytes]:
         """
         A generator wrapper for the read() method. A call will block until
@@ -1340,7 +1364,12 @@ class HTTPResponse(BaseHTTPResponse):
         # we'll try to read it from socket.
         if self.chunk_left is not None:
             return None
-        line = self._fp.fp.readline()  # type: ignore[union-attr]
+        line = self._fp.fp.readline(_MAX_CHUNK_LINE_LENGTH + 1)  # type: ignore[union-attr]
+        if len(line) > _MAX_CHUNK_LINE_LENGTH:
+            self.close()
+            raise ProtocolError(
+                "Response chunk size line exceeded maximum allowed length"
+            ) from None
         line = line.split(b";", 1)[0]
         try:
             self.chunk_left = int(line, 16)
@@ -1451,7 +1480,11 @@ class HTTPResponse(BaseHTTPResponse):
 
             # Chunk content ends with \r\n: discard it.
             while self._fp is not None:
-                line = self._fp.fp.readline()
+                line = self._fp.fp.readline(_MAX_CHUNK_LINE_LENGTH + 1)
+                if len(line) > _MAX_CHUNK_LINE_LENGTH:
+                    raise ProtocolError(
+                        "Response chunk trailer line exceeded maximum allowed length"
+                    )
                 if not line:
                     # Some sites may not end with '\r\n'.
                     break

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/util/request.py

@@ -64,6 +64,9 @@ def make_headers(
     basic_auth: str | None = None,
     proxy_basic_auth: str | None = None,
     disable_cache: bool | None = None,
+    *,
+    basic_auth_encoding: str = "latin-1",
+    proxy_basic_auth_encoding: str = "latin-1",
 ) -> dict[str, str]:
     """
     Shortcuts for generating request headers.
@@ -87,11 +90,42 @@ def make_headers(
 
     :param basic_auth:
         Colon-separated username:password string for 'authorization: basic ...'
-        auth header.
+        auth header. Basic authentication transmits Base64-encoded bytes, not
+        Unicode text, so the string is encoded with ``basic_auth_encoding``
+        before Base64 encoding.
+
+        Must contain decoded credentials (not percent-encoded).
+        For URLs parsed with :func:`parse_url`, use :attr:`Url.auth_decoded_joined`
+        to get the properly formatted string.
+
+    :param basic_auth_encoding:
+        Text encoding used to encode ``basic_auth`` before Base64 encoding.
+        Defaults to "latin-1" for backward compatibility. Use "utf-8" only
+        when the peer expects UTF-8 Basic authentication credentials.
+
+        Must contain decoded credentials (not percent-encoded).
+        For URLs parsed with :func:`parse_url`, use :attr:`Url.auth_decoded_joined`
+        to get the properly formatted string.
 
     :param proxy_basic_auth:
         Colon-separated username:password string for 'proxy-authorization: basic ...'
-        auth header.
+        auth header. Basic authentication transmits Base64-encoded bytes, not
+        Unicode text, so the string is encoded with ``proxy_basic_auth_encoding``
+        before Base64 encoding.
+
+        Must contain decoded credentials (not percent-encoded).
+        For URLs parsed with :func:`parse_url`, use :attr:`Url.auth_decoded_joined`
+        to get the properly formatted string.
+
+    :param proxy_basic_auth_encoding:
+        Text encoding used to encode ``proxy_basic_auth`` before Base64
+        encoding. Defaults to "latin-1" for backward compatibility. Use
+        "utf-8" only when the proxy expects UTF-8 Basic authentication
+        credentials.
+
+        Must contain decoded credentials (not percent-encoded).
+        For URLs parsed with :func:`parse_url`, use :attr:`Url.auth_decoded_joined`
+        to get the properly formatted string.
 
     :param disable_cache:
         If ``True``, adds 'cache-control: no-cache' header.
@@ -125,12 +159,12 @@ def make_headers(
 
     if basic_auth:
         headers["authorization"] = (
-            f"Basic {b64encode(basic_auth.encode('latin-1')).decode()}"
+            f"Basic {b64encode(basic_auth.encode(basic_auth_encoding)).decode()}"
         )
 
     if proxy_basic_auth:
         headers["proxy-authorization"] = (
-            f"Basic {b64encode(proxy_basic_auth.encode('latin-1')).decode()}"
+            f"Basic {b64encode(proxy_basic_auth.encode(proxy_basic_auth_encoding)).decode()}"
         )
 
     if disable_cache:
@@ -183,6 +217,8 @@ def rewind_body(body: typing.IO[typing.AnyStr], body_pos: _TYPE_BODY_POSITION) -
             "Unable to record file position for rewinding "
             "request body during a redirect/retry."
         )
+    elif body_seek is None:
+        raise UnrewindableBodyError("body does not implement seek.")
     else:
         raise ValueError(
             f"body_pos must be of type integer, instead it was {type(body_pos)}."

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/util/retry.py

@@ -6,6 +6,8 @@ import random
 import re
 import time
 import typing
+import warnings
+from collections.abc import Collection
 from itertools import takewhile
 from types import TracebackType
 
@@ -198,7 +200,8 @@ class Retry:
         ["HEAD", "GET", "PUT", "DELETE", "OPTIONS", "TRACE"]
     )
 
-    #: Default status codes to be used for ``status_forcelist``
+    #: Default status codes that trigger a retry when a Retry-After header is
+    #: present and ``respect_retry_after_header`` is enabled.
     RETRY_AFTER_STATUS_CODES = frozenset([413, 429, 503])
 
     #: Default headers to be used for ``remove_headers_on_redirect``
@@ -250,6 +253,15 @@ class Retry:
 
         self.redirect = redirect
         self.status_forcelist = status_forcelist or set()
+        if not allowed_methods and isinstance(allowed_methods, Collection):
+            warnings.warn(
+                "Using an empty collection for 'allowed_methods' option to "
+                "retry on any verb is deprecated and will skip retries for "
+                "all verbs in urllib3 v3.0. Instead use "
+                "Retry(..., allowed_methods=None).",
+                FutureWarning,
+                stacklevel=2,
+            )
         self.allowed_methods = allowed_methods
         self.backoff_factor = backoff_factor
         self.backoff_max = backoff_max

package/lib/cloudfront/lambda-bundled/hmacSecret/urllib3/util/ssl_.py

@@ -7,6 +7,7 @@ import socket
 import sys
 import typing
 import warnings
+from binascii import Error as BinasciiError
 from binascii import unhexlify
 
 from ..exceptions import ProxySchemeUnsupported, SSLError
@@ -91,14 +92,14 @@ try:  # Do we have ssl at all?
 
     from .ssltransport import SSLTransport  # type: ignore[assignment]
 except ImportError:
-    OP_NO_COMPRESSION = 0x20000  # type: ignore[assignment, misc]
-    OP_NO_TICKET = 0x4000  # type: ignore[assignment, misc]
-    OP_NO_SSLv2 = 0x1000000  # type: ignore[assignment, misc]
-    OP_NO_SSLv3 = 0x2000000  # type: ignore[assignment, misc]
-    PROTOCOL_SSLv23 = PROTOCOL_TLS = 2  # type: ignore[assignment, misc]
-    PROTOCOL_TLS_CLIENT = 16  # type: ignore[assignment, misc]
+    OP_NO_COMPRESSION = 0x20000  # type: ignore[assignment,misc]
+    OP_NO_TICKET = 0x4000  # type: ignore[assignment,misc]
+    OP_NO_SSLv2 = 0x1000000  # type: ignore[assignment,misc]
+    OP_NO_SSLv3 = 0x2000000  # type: ignore[assignment,misc]
+    PROTOCOL_SSLv23 = PROTOCOL_TLS = 2  # type: ignore[assignment,misc]
+    PROTOCOL_TLS_CLIENT = 16  # type: ignore[assignment,misc]
     VERIFY_X509_PARTIAL_CHAIN = 0x80000  # type: ignore[assignment,misc]
-    VERIFY_X509_STRICT = 0x20  # type: ignore[assignment, misc]
+    VERIFY_X509_STRICT = 0x20  # type: ignore[assignment,misc]
 
 
 _TYPE_PEER_CERT_RET = typing.Union["_TYPE_PEER_CERT_RET_DICT", bytes, None]
@@ -128,7 +129,10 @@ def assert_fingerprint(cert: bytes | None, fingerprint: str) -> None:
         )
 
     # We need encode() here for py32; works on py2 and p33.
-    fingerprint_bytes = unhexlify(fingerprint.encode())
+    try:
+        fingerprint_bytes = unhexlify(fingerprint.encode())
+    except BinasciiError as e:
+        raise SSLError(e) from e
 
     cert_digest = hashfunc(cert).digest()