3

���[;+�@s�dZd
ddddgZ
ddlZddlZddlmZmZmZmZ
ej	rPdd	l
mZmZ
Gd
d
�d
e
�ZGdd�de�ZGdd�de�ZGd
d�de�ZGdd�de�Zedkr�ddlZej�
dS)z�
SSL peer certificate checking routines

Copyright (c) 2004-2007 Open Source Applications Foundation.
All rights reserved.

Copyright 2008 Heikki Toivonen. All rights reserved.
�SSLVerificationError�
NoCertificate�WrongCertificate�	WrongHost�Checker�N)�X509�m2�six�util)�AnyStr�Optionalc
@seZ
dZd
S)r
N)�__name__�
__module__�__qualname__�rr�/usr/lib64/python3.6/Checker.pyr
s
c
@seZ
dZd
S)rN)r
rrrrrrrs
c
@seZ
dZd
S)rN)r
rrrrrrrs
c@seZ
dZddd�
Zdd�ZdS)r�
commonNamecCs0|dkrtd�
�
t
j|�

|
|_||_||_dS)ar
        This exception will be raised if the certificate returned by the
        peer was issued for a different host than we tried to connect to.
        This could be due to a server misconfiguration or an active attack.

        :param expectedHost: The name of the host we expected to find in the
                             certificate.
        :param actualHost:   The name of the host we actually found in the
                             certificate.
        :param fieldName:    The field name where we noticed the error. This
                             should be either 'commonName' or 'subjectAltName'.
        r�subjectAltNamez/Unknown fieldName, should be either commonName zor subjectAltNameN)rrz@Unknown fieldName, should be either commonName or subjectAltName)�
ValueErrorr
�__init__�expectedHost�
actualHost�	fieldName)�selfrrrrrrr"s






zWrongHost.__init__c
Csd
|j|j
|jf}
tj|
�
S)Nz<Peer certificate %s does not match host, expected %s, got %s)rrrr	�ensure_text)r�
srrr�__str__:s

zWrongHost.__str__N)
r)r
rrrrrrrrr!s

c@sBeZ
dZejd
�
Zddd�
Zddd�
Zdd	�Zd
d�Z	dd
�Z
dS)rz^[0-9]+(\.[0-9]+)*$N�sha1cCs(|
|_|dk	rt
j|�
}||_||_dS)
N)�hostr	Z
ensure_binary�fingerprint�digest)rrZpeerCertHashZpeerCertDigestrrrrEs





zChecker.__init__c
Cs�
|
dkrtd
�
�
|dk	r||_
|jr�|jdkr<td|j�
�
|jdkrLd}n |jdkr\d}ntdj|j�
�
�
t|j�
|kr�tdj|j|t|j�
��
�
tj	|j�
}|
j
|jd�
}||kr�tdj||��
�
|j
�
r�d}d|_y@|
jd�
j
�}|j|j
|��r�d}n|j�
rt|j
|dd��
Wntk
�
r.


YnX|�
s�d}d}	xX|
j�jtj�
D]D}
d}|
j�j�}|	�
sp|}	n|	d|7}	|j|j
|��
rPd}P�
qPW|�
s�td�
�
|�
s�t|j
|	dd��
dS)Nzpeer did not return certificater�md5zunsupported digest "%s"�(� zUnexpected digest {0}z3peer certificate fingerprint length does not match
z fingerprint: {0}
expected = {1}
zobserved = {2})
Zmdz,peer certificate fingerprint does not match
zexpected = {0},
zobserved = {1}FrT)rrr��
,z!no commonName in peer certificater)rr!zSpeer certificate fingerprint length does not match
fingerprint: {0}
expected = {1}
zapeer certificate fingerprint length does not match
fingerprint: {0}
expected = {1}
observed = {2}z<peer certificate fingerprint does not match
expected = {0},
zJpeer certificate fingerprint does not match
expected = {0},
observed = {1})rrrr r�format�lenrr	rZget_fingerprint�useSubjectAltNameOnlyZget_extZ	get_value�_splitSubjectAltNamer�LookupErrorZget_subjectZget_entries_by_nidrZNID_commonName�get_dataZas_text�_match)rZpeerCertrZexpected_lenZexpected_fingerprintZobserved_fingerprintZhostValidationPassedrZ
hasCommonNameZcommonNames�entryrrrr�__call__Mst













































zChecker.__call__cCs�d
|_x||j
d�
D]n}|j�j�}|dd�dkrRd|_|j|
|dd��r�dSq|dd�dkrd|_|j|
|dd��rdSqWd
S)	a
        >>> check = Checker()
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='DNS:my.example.com')
        True
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='DNS:*.example.com')
        True
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='DNS:m*.example.com')
        True
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='DNS:m*ample.com')
        False
        >>> check.useSubjectAltNameOnly
        True
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='DNS:m*ample.com, othername:<unsupported>')
        False
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='DNS:m*ample.com, DNS:my.example.org')
        False
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='DNS:m*ample.com, DNS:my.example.com')
        True
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='DNS:my.example.com, DNS:my.example.org')
        True
        >>> check.useSubjectAltNameOnly
        True
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='')
        False
        >>> check._splitSubjectAltName(host='my.example.com',
        ...     subjectAltName='othername:<unsupported>')
        False
        >>> check.useSubjectAltNameOnly
        False
        Fr%N�zdns:T�zip address:)r(�split�lower�stripr,�_matchIPAddress)rrr�certHostrrrr)�s)










zChecker._splitSubjectAltNamecCs�|
j�}
|j�}|
|krd
S|j
d�
dkr.dS|jj|
�
sN|jj|jdd��
rRdS|jd�
dkrddS|jdd�}|jdd	�}tjd
|�
j|
�
r�d
SdS)a
        >>> check = Checker()
        >>> check._match(host='my.example.com', certHost='my.example.com')
        True
        >>> check._match(host='my.example.com', certHost='*.example.com')
        True
        >>> check._match(host='my.example.com', certHost='m*.example.com')
        True
        >>> check._match(host='my.example.com', certHost='m*.EXAMPLE.com')
        True
        >>> check._match(host='my.example.com', certHost='m*ample.com')
        False
        >>> check._match(host='my.example.com', certHost='*.*.com')
        False
        >>> check._match(host='1.2.3.4', certHost='1.2.3.4')
        True
        >>> check._match(host='1.2.3.4', certHost='*.2.3.4')
        False
        >>> check._match(host='1234', certHost='1234')
        True
        T�
*�
Fr$�
\�
.z\.z[^\.]*z^%s$���)r2�count�numericIpMatch�match�replace�find�re�compile)rrr5rrrr,�s 





zChecker._matchc
CsHy4tj
|
d
d
tjd
tj�}tj
|d
d
tjd
tj�}Wn



dS||kS)a�
        >>> check = Checker()
        >>> check._matchIPAddress(host='my.example.com',
        ...     certHost='my.example.com')
        False
        >>> check._matchIPAddress(host='1.2.3.4', certHost='1.2.3.4')
        True
        >>> check._matchIPAddress(host='1.2.3.4', certHost='*.2.3.4')
        False
        >>> check._matchIPAddress(host='1.2.3.4', certHost='1.2.3.40')
        False
        >>> check._matchIPAddress(host='::1', certHost='::1')
        True
        >>> check._matchIPAddress(host='::1', certHost='0:0:0:0:0:0:0:1')
        True
        >>> check._matchIPAddress(host='::1', certHost='::2')
        False
        rF)�socketZgetaddrinfoZSOCK_STREAMZAI_NUMERICHOST)rrr5Z	canonicalZ
certCanonicalrrrr4
s








zChecker._matchIPAddress)NNr)
N)r
rrr@rAr<rr.r)r,r4rrrrrAs


N67�__main__)�__doc__�__all__r@rBZM2Cryptorrr	r
Zpy27plusZtypingrr�	Exceptionr
rrr�objectrr
ZdoctestZtestmodrrrr�<module>s 



 g