ó
z\Vc           @   sã   d  Z  d d d d d g Z d d l m Z m Z m Z d d l Z d d l Z d e f d	 „  ƒ  YZ	 d e	 f d
 „  ƒ  YZ
 d e	 f d „  ƒ  YZ d e	 f d „  ƒ  YZ d d d „  ƒ  YZ e d k rß d d l Z e j ƒ  n  d S(   s±   
SSL peer certificate checking routines

Copyright (c) 2004-2007 Open Source Applications Foundation.
All rights reserved.

Copyright 2008 Heikki Toivonen. All rights reserved.
t   SSLVerificationErrort   NoCertificatet   WrongCertificatet	   WrongHostt   Checkeriÿÿÿÿ(   t   utilt   EVPt   m2Nc           B   s   e  Z RS(    (   t   __name__t
   __module__(    (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR       s   c           B   s   e  Z RS(    (   R   R	   (    (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR      s   c           B   s   e  Z RS(    (   R   R	   (    (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR      s   c           B   s   e  Z d  d „ Z d „  Z RS(   t
   commonNamec         C   sG   | d k r t  d ƒ ‚ n  t j |  ƒ | |  _ | |  _ | |  _ d S(   sz  
        This exception will be raised if the certificate returned by the
        peer was issued for a different host than we tried to connect to.
        This could be due to a server misconfiguration or an active attack.
        
        @param expectedHost: The name of the host we expected to find in the
                             certificate.
        @param actualHost:   The name of the host we actually found in the
                             certificate.
        @param fieldName:    The field name where we noticed the error. This
                             should be either 'commonName' or 'subjectAltName'.
        R
   t   subjectAltNames@   Unknown fieldName, should be either commonName or subjectAltNameN(   s
   commonNames   subjectAltName(   t
   ValueErrorR    t   __init__t   expectedHostt
   actualHostt	   fieldName(   t   selfR   R   R   (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR      s    		c         C   sA   d |  j  |  j |  j f } t | t ƒ r= | j d ƒ } n  | S(   Ns<   Peer certificate %s does not match host, expected %s, got %st   utf8(   R   R   R   t
   isinstancet   unicodet   encode(   R   t   s(    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyt   __str__0   s
    (   R   R	   R   R   (    (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR      s   c           B   sP   e  Z e j d  ƒ Z d d d d „ Z d d „ Z d „  Z d „  Z	 d „  Z
 RS(   s   ^[0-9]+(\.[0-9]+)*$t   sha1c         C   s   | |  _  | |  _ | |  _ d  S(   N(   t   hostt   fingerprintt   digest(   R   R   t   peerCertHasht   peerCertDigest(    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR   <   s    		c      
   C   s~  | d  k r t d ƒ ‚ n  | d  k	 r3 | |  _ n  |  j r"|  j d k ra t d |  j ƒ ‚ n  |  j d k r… t |  j ƒ d k s© |  j d k r¸ t |  j ƒ d k r¸ t d ƒ ‚ n  | j ƒ  } t	 j
 |  j ƒ } | j | ƒ | j ƒ  } t j | ƒ t |  j d ƒ k r"t d	 ƒ ‚ q"n  |  j rzt } t |  _ ya | j d
 ƒ j ƒ  } |  j |  j | ƒ rpt } n* |  j ršt d |  j d | d d
 ƒ ‚ n  Wn t k
 r®n X| szt } d }	 xt | j ƒ  j t j ƒ D]Z }
 t } |
 j ƒ  j ƒ  } |	 s| }	 n |	 d | 7}	 |  j |  j | ƒ rÚt } PqÚqÚW| sMt d ƒ ‚ n  | swt d |  j d |	 d d ƒ ‚ qwqzn  t S(   Ns   peer did not return certificateR   t   md5s   unsupported digest "%s"i(   i    s2   peer certificate fingerprint length does not matchi   s+   peer certificate fingerprint does not matchR   R   R   R   t    t   ,s!   no commonName in peer certificateR
   (   R   R   (   t   NoneR   R   R   R   R   t   lenR   t   as_derR   t   MessageDigestt   updatet   finalR   t   octx_to_numt   intt   Falset   useSubjectAltNameOnlyt   get_extt	   get_valuet   _splitSubjectAltNamet   TrueR   t   LookupErrort   get_subjectt   get_entries_by_nidR   t   NID_commonNamet   get_datat   as_textt   _match(   R   t   peerCertR   t   dert   mdR   t   hostValidationPassedR   t   hasCommonNamet   commonNamest   entryR
   (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyt   __call__A   s`    	$$!					c         C   s¥   t  |  _ x• | j d ƒ D]„ } | j ƒ  j ƒ  } | d  d k rg t |  _ |  j | | d ƒ r t Sq | d  d k r t |  _ |  j | | d ƒ r t Sq q Wt  S(   sg  
        >>> check = Checker()
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:my.example.com')
        True
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:*.example.com')
        True
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*.example.com')
        True
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*ample.com')
        False
        >>> check.useSubjectAltNameOnly
        True
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*ample.com, othername:<unsupported>')
        False
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*ample.com, DNS:my.example.org')
        False
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:m*ample.com, DNS:my.example.com')
        True
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='DNS:my.example.com, DNS:my.example.org')
        True
        >>> check.useSubjectAltNameOnly
        True
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='')
        False
        >>> check._splitSubjectAltName(host='my.example.com', subjectAltName='othername:<unsupported>')
        False
        >>> check.useSubjectAltNameOnly
        False
        R    i   s   dns:i   s   ip address:(   R)   R*   t   splitt   lowert   stripR.   R5   t   _matchIPAddress(   R   R   R   t   certHost(    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR-   €   s    			c         C   sÖ   | j  ƒ  } | j  ƒ  } | | k r( t S| j d ƒ d k rA t S|  j j | ƒ sq |  j j | j d d ƒ ƒ ru t S| j d ƒ d k rŽ t S| j d d ƒ } | j d d ƒ } t j	 d	 | ƒ j | ƒ rÒ t St S(
   s  
        >>> check = Checker()
        >>> check._match(host='my.example.com', certHost='my.example.com')
        True
        >>> check._match(host='my.example.com', certHost='*.example.com')
        True
        >>> check._match(host='my.example.com', certHost='m*.example.com')
        True
        >>> check._match(host='my.example.com', certHost='m*.EXAMPLE.com')
        True
        >>> check._match(host='my.example.com', certHost='m*ample.com')
        False
        >>> check._match(host='my.example.com', certHost='*.*.com')
        False
        >>> check._match(host='1.2.3.4', certHost='1.2.3.4')
        True
        >>> check._match(host='1.2.3.4', certHost='*.2.3.4')
        False
        >>> check._match(host='1234', certHost='1234')
        True
        t   *i   R   s   \iÿÿÿÿt   .s   \.s   [^\.]*s   ^%s$(
   R?   R.   t   countR)   t   numericIpMatcht   matcht   replacet   findt   ret   compile(   R   R   RB   (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR5   ¬   s     c         C   sa   yL t  j | d d t  j d t  j ƒ } t  j | d d t  j d t  j ƒ } Wn t SX| | k S(   ss  
        >>> check = Checker()
        >>> check._matchIPAddress(host='my.example.com', certHost='my.example.com')
        False
        >>> check._matchIPAddress(host='1.2.3.4', certHost='1.2.3.4')
        True
        >>> check._matchIPAddress(host='1.2.3.4', certHost='*.2.3.4')
        False
        >>> check._matchIPAddress(host='1.2.3.4', certHost='1.2.3.40')
        False
        >>> check._matchIPAddress(host='::1', certHost='::1')
        True
        >>> check._matchIPAddress(host='::1', certHost='0:0:0:0:0:0:0:1')
        True
        >>> check._matchIPAddress(host='::1', certHost='::2')
        False
        i    (   t   sockett   getaddrinfot   SOCK_STREAMt   AI_NUMERICHOSTR)   (   R   R   RB   t	   canonicalt   certCanonical(    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyRA   â   s    	N(   R   R	   RJ   RK   RF   R!   R   R=   R-   R5   RA   (    (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyR   8   s   ?	,	6t   __main__(    (   t   __doc__t   __all__t   M2CryptoR   R   R   RL   RJ   t	   ExceptionR    R   R   R   R   R   t   doctestt   testmod(    (    (    s:   /usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.pyt   <module>   s   	Ç