/usr/lib/python2.6/site-packages/ndg/httpsclient
Edit: /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyc (9164B)
Ńņ
KVc
@ sŅ d Z d Z d Z d Z d Z d Z d Z d d k Z d d k Z e i e
Z y* d d k l
Z
d d
k l Z e Z Wn: e j
o. Z e Z d Z d d k Z e i e n Xd e f d
YZ d S( sA ndg_httpsclient - module containing SSL peer verification class.
s P J Kershaw (STFC)s 09/12/11s2 (C) 2012 Science and Technology Facilities Councils- BSD - see LICENSE file in top-level directorys Philip.Kershaw@stfc.ac.uks $Id$i’’’’N( t SubjectAltName( t decodersP SubjectAltName support is disabled - check pyasn1 package installation to enablet ServerSSLCertVerificationc B s1 e Z d Z h
d d 6d d 6d d 6d d 6d d
6d d 6d
d 6d d 6d d 6d d 6Z d Z d d i e e i e e i Z e
i e Z d( Z
d) d) e d Z d Z d Z e d Z d Z d Z e d! e d" e d# d$ Z d% Z d& Z e d! e d" e d# d' Z RS(* sy Check server identity. If hostname doesn't match, allow match of
host's Distinguished Name against server DN settingt CNt
commonNamet OUt organisationalUnitNamet Ot organisationt Ct countryNamet EMAILADDRESSt emailAddresst Lt localityNamet STt stateOrProvinceNamet STREETt
streetAddresst DCt domainComponentt UIDt useridt subjectAltNames /(%s)=t |t
__hostnamet __certDNt __subj_alt_name_matchc C s d | _ d | _ | d j o
| | _ n | d j o
| | _ n | o. t p t i d t | _ q t
| _ n t i d t | _ d S( s¼ Override parent class __init__ to enable setting of certDN
setting
@type certDN: string
@param certDN: Set the expected Distinguished Name of the
server to avoid errors matching hostnames. This is useful
where the hostname is not fully qualified
@type hostname: string
@param hostname: hostname to match against peer certificate
subjectAltNames or subject common name
@type subj_alt_name_match: bool
@param subj_alt_name_match: flag to enable/disable matching of hostname
against peer certificate subjectAltNames. Nb. A setting of True will
be ignored if the pyasn1 package is not installed
sd Overriding "subj_alt_name_match" keyword setting: peer verification with subjectAltNames is disableds9 Disabling peer verification with subject subjectAltNames!N( t Nonet" _ServerSSLCertVerification__certDNt$ _ServerSSLCertVerification__hostnamet certDNt hostnamet SUBJ_ALT_NAME_SUPPORTt logt warningt Falset/ _ServerSSLCertVerification__subj_alt_name_matcht Truet debug( t selfR R t subj_alt_name_match( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt __init__1 s
c C s/ | i o t i d | i t S| d j oņ | i } | i } | i | i d j o | i d j o t i d t S| i
o( | i | } | i | j o | Sn | i | i j o | St i d | i | i t Sq+| | i j o | St i d | | i t Sn | Sd S( s
Verify server certificate
@type connection: OpenSSL.SSL.Connection
@param connection: SSL connection object
@type peerCert: basestring
@param peerCert: server host certificate as OpenSSL.crypto.X509
instance
@type errorStatus: int
@param errorStatus: error status passed from caller. This is the value
returned by the OpenSSL C function X509_STORE_CTX_get_error(). Look-up
x509_vfy.h in the OpenSSL source to get the meanings of the different
codes. PyOpenSSL doesn't help you!
@type errorDepth: int
@param errorDepth: a non-negative integer representing where in the
certificate chain the error occurred. If it is zero it occured in the
end entity certificate, one if it is the certificate which signed the
end entity certificate and so on.
@type preverifyOK: int
@param preverifyOK: the error status - 0 = Error, 1 = OK of the current
SSL context irrespective of any verification checks done here. If this
function yields an OK status, it should enforce the preverifyOK value
so that any error set upstream overrides and is honoured.
@rtype: int
@return: status code - 0/False = Error, 1/True = OK
s4 Certificate %r in peer certificate chain has expiredi s? No "hostname" or "certDN" set to check peer certificate againsts7 Peer certificate CN %r doesn't match the expected CN %rs7 Peer certificate DN %r doesn't match the expected DN %rN(
t has_expiredR" t errort get_subjectR$ t get_componentst sortR R R R% t _get_subj_alt_nameR ( R( t
connectiont peerCertt errorStatust
errorDeptht preverifyOKt peerCertSubjt
peerCertDNt dns_names( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt __call__V s8
c s f d } | S( Nc s i | | | | | S( N( R9 ( R1 R2 R3 R4 R5 ( R( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt verify_server_cert s ( ( R( R: ( ( R( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt get_verify_server_cert_func s c C sź g } t } xŌ t | i D]Ą } | i | } | i } | | i j o | i } t i | d | } xk | D]_ } t | t oI xF t t
| D]. }
| i |
} | i t
| i q¤ Wq{ q{ Wq" q" W| S( s Extract subjectAltName DNS name settings from certificate extensions
@param peer_cert: peer certificate in SSL connection. subjectAltName
settings if any will be extracted from this
@type peer_cert: OpenSSL.crypto.X509
t asn1Spec( R t ranget get_extension_countt
get_extensiont get_short_namet SUBJ_ALT_NAME_EXT_NAMEt get_datat der_decodert decodet
isinstancet lent getComponentByPositiont appendt strt getComponent( t clst peer_certt dns_namet
general_namest it extt ext_namet ext_datt decoded_datt namet entryt component( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyR0 § s$ -c C s | i S( N( R ( R( ( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt
_getCertDNĆ s c C s’ t | t o | i d } | i i i | } t | d j o t d | n t t | d d d
| d d d
| _
| i
i n^ t | t pA x1 | D]) } t | d j p t d qµ qµ W| | _
n
t d d S( Nt "i s Error parsing DN string: "%s"i sS Expecting list of two element DN field, DN field value pairs for "certDN" attributes4 Expecting list or string type for "certDN" attribute( RE RI t stript __class__t PARSER_REt splitRF t TypeErrort listt zipR R/ ( R( t valR t dnFieldsRO ( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt
_setCertDNĘ s 2
t fgett fsett docs) Distinguished Name for Server Certificatec C s | i S( N( R ( R( ( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt _getHostnameā s c C s- t | t p t d n | | _ d S( Ns, Expecting string type for hostname attribute( RE RI R] R ( R( R` ( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt _setHostnameå s s hostname of server( s
__hostnames __certDNs __subj_alt_name_matchN( t __name__t
__module__t __doc__t DN_LUTRA t joinR^ t keyst valuest
PARSER_RE_STRt ret compileR[ t __slots__R R& R* R9 R; t classmethodR0 RW Rb t propertyR Rf Rg R ( ( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyR s<
/% I ( Rj t
__author__t __date__t
__copyright__t __license__t __contact__t __revision__Rp t loggingt getLoggerRh R" t ndg.httpsclient.subj_alt_nameR t pyasn1.codec.derR RC R& R! t ImportErrort eR$ t SUBJ_ALT_NAME_SUPPORT_MSGt warningst warnt objectR ( ( ( sI /usr/lib/python2.6/site-packages/ndg/httpsclient/ssl_peer_verification.pyt
s&