← Back
Editing: pyopenssl.cpython-38.pyc
U ��\" � @ s� d Z ddlmZmZmZ ddlZddlZddlmZ ddl m Z ddl m Z ddl mZ dd lmZmZmZmZmZmZmZmZ dd lmZ d gZd d � Zd d� Z e d�Z dd� Z dS )zA `pyOpenSSL <https://github.com/pyca/pyopenssl>`_-specific code. � )�absolute_import�division�print_functionN)�decode)� IA5String)�ObjectIdentifier)� GeneralNames� )�DNS_ID�CertificateError� DNSPattern� IPAddress_ID�IPAddressPattern� SRVPattern� URIPattern�verify_service_identity)�SubjectAltNameWarning�verify_hostnamec C s t t| �� �t|�gg d� dS )a? Verify whether the certificate of *connection* is valid for *hostname*. :param OpenSSL.SSL.Connection connection: A pyOpenSSL connection object. :param unicode hostname: The hostname that *connection* should be connected to. :raises service_identity.VerificationError: If *connection* does not provide a certificate that is valid for *hostname*. :raises service_identity.CertificateError: If the certificate chain of *connection* contains a certificate that contains invalid/unexpected data. :returns: ``None`` �Z cert_patternsZobligatory_idsZ optional_idsN)r � extract_ids�get_peer_certificater )� connectionZhostname� r �</usr/lib/python3/dist-packages/service_identity/pyopenssl.pyr s �c C s t t| �� �t|�gg d� dS )a� Verify whether the certificate of *connection* is valid for *ip_address*. :param OpenSSL.SSL.Connection connection: A pyOpenSSL connection object. :param unicode ip_address: The IP address that *connection* should be connected to. Can be an IPv4 or IPv6 address. :raises service_identity.VerificationError: If *connection* does not provide a certificate that is valid for *ip_address*. :raises service_identity.CertificateError: If the certificate chain of *connection* contains a certificate that contains invalid/unexpected data. :returns: ``None`` .. versionadded:: 18.1.0 r N)r r r r )r Z ip_addressr r r �verify_ip_address7 s �r z1.3.6.1.5.5.7.8.7c C sv g }t j�| �� �D �]}| �|�}|�� dkrt|�� t� d�\}}|D ]�}|� � }|dkrv|� t |� � � � �� qJ|dkr�|� t�|� � � � �� qJ|dkr�|� t|� � � � �� qJ|dkrJ|� � }|�d�} | tk�rt|�d��\} }t| t��r|� t| � � �� ntd ��n qJqJq|�srd d � | �� �� D �} tt| �d �} d d � | D �}tj d| �d�f t dd� |S )a Extract all valid IDs from a certificate for service verification. If *cert* doesn't contain any identifiers, the ``CN``s are used as DNS-IDs as fallback. :param OpenSSL.SSL.X509 cert: The certificate to be dissected. :return: List of IDs. s subjectAltName)Zasn1SpecZdNSNameZ iPAddressZuniformResourceIdentifierZ otherNamer r z Unexpected certificate content.c S s g | ]}|d dkr|d �qS )r s CNr r ��.0�cr r r � <listcomp>� s z extract_ids.<locals>.<listcomp>s <not given>c S s g | ] }t |��qS r )r r r r r r � s z�Certificate with CN '%s' has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. service_identity will remove the support for it in mid-2018.zutf-8� )� stacklevel) �sixZmoves�rangeZget_extension_countZ get_extensionZget_short_namer �get_datar ZgetName�appendr Z getComponentZasOctetsr � from_bytesr ZgetComponentByPosition� ID_ON_DNS_SRV� isinstancer r r Z get_subjectZget_components�next�iter�warnings�warnr ) ZcertZids�iZext�names�_�nZ name_string�compZoidZsrvZ componentsZcnr r r r S sV �� � � �� r ) �__doc__Z __future__r r r r* r! Zpyasn1.codec.der.decoderr Zpyasn1.type.charr Zpyasn1.type.univr Zpyasn1_modules.rfc2459r Z_commonr r r r r r r r � exceptionsr �__all__r r r& r r r r r �<module> s (
Save File
Cancel