Current File : //usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyc
�
z\Vc @ s� d Z d d d d d g Z d d l m Z m Z m Z d d l Z d d l Z d e f d � � YZ d e f d
� � YZ
d e f d � � YZ d e f d � � YZ d d d
� � YZ
e d k r� d d l Z e j � n d S( s�
SSL peer certificate checking routines
Copyright (c) 2004-2007 Open Source Applications Foundation.
All rights reserved.
Copyright 2008 Heikki Toivonen. All rights reserved.
t SSLVerificationErrort
NoCertificatet WrongCertificatet WrongHostt Checkeri����( t utilt EVPt m2Nc B s e Z RS( ( t __name__t
__module__( ( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR s c B s e Z RS( ( R R ( ( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR s c B s e Z RS( ( R R ( ( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR s c B s e Z d d � Z d � Z RS( t
commonNamec C sG | d k r t d � � n t j | � | | _ | | _ | | _ d S( sz
This exception will be raised if the certificate returned by the
peer was issued for a different host than we tried to connect to.
This could be due to a server misconfiguration or an active attack.
@param expectedHost: The name of the host we expected to find in the
certificate.
@param actualHost: The name of the host we actually found in the
certificate.
@param fieldName: The field name where we noticed the error. This
should be either 'commonName' or 'subjectAltName'.
R
t subjectAltNames@ Unknown fieldName, should be either commonName or subjectAltNameN( s
commonNames subjectAltName( t
ValueErrorR t __init__t expectedHostt
actualHostt fieldName( t selfR R R ( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR
s
c C sA d | j | j | j f } t | t � r= | j d � } n | S( Ns< Peer certificate %s does not match host, expected %s, got %st utf8( R R R t
isinstancet unicodet encode( R t s( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyt __str__0 s
( R R R
R ( ( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR s c B sP e Z e j d � Z d d d d � Z d d � Z d � Z d � Z d � Z
RS( s ^[0-9]+(\.[0-9]+)*$t sha1c C s | | _ | | _ | | _ d S( N( t hostt fingerprintt digest( R R t peerCertHasht peerCertDigest( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR
< s c
C s~ | d k r t d � � n | d k r3 | | _ n | j r"| j d k ra t d | j � � n | j d k r� t | j � d k s� | j d k r� t | j � d k r� t d � � n | j � } t j
| j � } | j | � | j � } t
j | � t | j d � k r"t d � � q"n | j rzt } t | _ ya | j d
� j � } | j | j | � rpt } n* | j r�t d | j d | d
d
� � n Wn t k
r�n X| szt } d } xt | j � j t j � D]Z }
t } |
j � j � } | s| } n | d | 7} | j | j | � r�t } Pq�q�W| sMt d � � n | swt d | j d | d
d � � qwqzn t S( Ns peer did not return certificateR t md5s unsupported digest "%s"i( i s2 peer certificate fingerprint length does not matchi s+ peer certificate fingerprint does not matchR R R R t t ,s! no commonName in peer certificateR
( R R ( t NoneR R R R R t lenR t as_derR t
MessageDigestt updatet finalR t octx_to_numt intt Falset useSubjectAltNameOnlyt get_extt get_valuet _splitSubjectAltNamet TrueR t LookupErrort get_subjectt get_entries_by_nidR t NID_commonNamet get_datat as_textt _match( R t peerCertR t dert mdR t hostValidationPassedR t
hasCommonNamet commonNamest entryR
( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyt __call__A s` $$
!
c C s� t | _ x� | j d � D]� } | j � j � } | d d k rg t | _ | j | | d � r� t Sq | d d k r t | _ | j | | d � r� t Sq q Wt S( sg
>>> check = Checker()
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:my.example.com')
True
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:*.example.com')
True
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*.example.com')
True
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*ample.com')
False
>>> check.useSubjectAltNameOnly
True
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*ample.com, othername:<unsupported>')
False
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*ample.com, DNS:my.example.org')
False
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*ample.com, DNS:my.example.com')
True
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:my.example.com, DNS:my.example.org')
True
>>> check.useSubjectAltNameOnly
True
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='')
False
>>> check._splitSubjectAltName(host='my.example.com', subjectAltName='othername:<unsupported>')
False
>>> check.useSubjectAltNameOnly
False
R i s dns:i s ip address:( R) R* t splitt lowert stripR. R5 t _matchIPAddress( R R R t certHost( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR- � s c C s� | j � } | j � } | | k r( t S| j d � d k rA t S| j j | � sq | j j | j d d � � ru t S| j d � d k r� t S| j d d � } | j d d � } t j d | � j | � r� t St S(
s
>>> check = Checker()
>>> check._match(host='my.example.com', certHost='my.example.com')
True
>>> check._match(host='my.example.com', certHost='*.example.com')
True
>>> check._match(host='my.example.com', certHost='m*.example.com')
True
>>> check._match(host='my.example.com', certHost='m*.EXAMPLE.com')
True
>>> check._match(host='my.example.com', certHost='m*ample.com')
False
>>> check._match(host='my.example.com', certHost='*.*.com')
False
>>> check._match(host='1.2.3.4', certHost='1.2.3.4')
True
>>> check._match(host='1.2.3.4', certHost='*.2.3.4')
False
>>> check._match(host='1234', certHost='1234')
True
t *i R s \i����t .s \.s [^\.]*s ^%s$(
R? R. t countR) t numericIpMatcht matcht replacet findt ret compile( R R RB ( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR5 � s c C sa yL t j | d d t j d t j � } t j | d d t j d t j � } Wn t SX| | k S( ss
>>> check = Checker()
>>> check._matchIPAddress(host='my.example.com', certHost='my.example.com')
False
>>> check._matchIPAddress(host='1.2.3.4', certHost='1.2.3.4')
True
>>> check._matchIPAddress(host='1.2.3.4', certHost='*.2.3.4')
False
>>> check._matchIPAddress(host='1.2.3.4', certHost='1.2.3.40')
False
>>> check._matchIPAddress(host='::1', certHost='::1')
True
>>> check._matchIPAddress(host='::1', certHost='0:0:0:0:0:0:0:1')
True
>>> check._matchIPAddress(host='::1', certHost='::2')
False
i ( t sockett getaddrinfot SOCK_STREAMt AI_NUMERICHOSTR) ( R R RB t canonicalt
certCanonical( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyRA � s N( R R RJ RK RF R! R
R= R- R5 RA ( ( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR 8 s ? , 6t __main__( ( t __doc__t __all__t M2CryptoR R R RL RJ t ExceptionR R R R R R t doctestt testmod( ( ( s: /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyt <module> s �
Mini Shell