File: //usr/lib/python3/dist-packages/service_identity/__pycache__/pyopenssl.cpython-38.pyc
U
��\" � @ s� d Z ddlmZmZmZ ddlZddlZddlmZ ddl m
Z
ddl m Z ddl
mZ dd lmZmZmZmZmZmZmZmZ dd
lmZ d gZd d � Zd
d� Z e d�Z dd� Z dS )zA
`pyOpenSSL <https://github.com/pyca/pyopenssl>`_-specific code.
� )�absolute_import�division�print_functionN)�decode)� IA5String)�ObjectIdentifier)� GeneralNames� )�DNS_ID�CertificateError�
DNSPattern� IPAddress_ID�IPAddressPattern�
SRVPattern�
URIPattern�verify_service_identity)�SubjectAltNameWarning�verify_hostnamec C s t t| �� �t|�gg d� dS )a?
Verify whether the certificate of *connection* is valid for *hostname*.
:param OpenSSL.SSL.Connection connection: A pyOpenSSL connection object.
:param unicode hostname: The hostname that *connection* should be connected
to.
:raises service_identity.VerificationError: If *connection* does not
provide a certificate that is valid for *hostname*.
:raises service_identity.CertificateError: If the certificate chain of
*connection* contains a certificate that contains invalid/unexpected
data.
:returns: ``None``
�Z
cert_patternsZobligatory_idsZ optional_idsN)r � extract_ids�get_peer_certificater
)�
connectionZhostname� r �</usr/lib/python3/dist-packages/service_identity/pyopenssl.pyr s
�c C s t t| �� �t|�gg d� dS )a�
Verify whether the certificate of *connection* is valid for *ip_address*.
:param OpenSSL.SSL.Connection connection: A pyOpenSSL connection object.
:param unicode ip_address: The IP address that *connection* should be
connected to. Can be an IPv4 or IPv6 address.
:raises service_identity.VerificationError: If *connection* does not
provide a certificate that is valid for *ip_address*.
:raises service_identity.CertificateError: If the certificate chain of
*connection* contains a certificate that contains invalid/unexpected
data.
:returns: ``None``
.. versionadded:: 18.1.0
r N)r r r r
)r Z
ip_addressr r r �verify_ip_address7 s
�r z1.3.6.1.5.5.7.8.7c
C sv g }t j�| �� �D �]}| �|�}|�� dkrt|�� t� d�\}}|D ]�}|� � }|dkrv|�
t |� � �
� �� qJ|dkr�|�
t�|� � �
� �� qJ|dkr�|�
t|� � �
� �� qJ|dkrJ|� � }|�d�} | tk�rt|�d��\}
}t|
t��r|�
t|
�
� �� ntd ��n qJqJq|�srd
d � | �� �� D �} tt| �d �} d
d � | D �}tj d| �d�f t dd� |S )a
Extract all valid IDs from a certificate for service verification.
If *cert* doesn't contain any identifiers, the ``CN``s are used as DNS-IDs
as fallback.
:param OpenSSL.SSL.X509 cert: The certificate to be dissected.
:return: List of IDs.
s subjectAltName)Zasn1SpecZdNSNameZ iPAddressZuniformResourceIdentifierZ otherNamer r z Unexpected certificate content.c S s g | ]}|d dkr|d �qS )r s CNr r ��.0�cr r r �
<listcomp>� s z extract_ids.<locals>.<listcomp>s <not given>c S s g | ] }t |��qS r )r r r r r r � s z�Certificate with CN '%s' has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. service_identity will remove the support for it in mid-2018.zutf-8� )�
stacklevel) �sixZmoves�rangeZget_extension_countZ
get_extensionZget_short_namer �get_datar ZgetName�appendr Z getComponentZasOctetsr �
from_bytesr ZgetComponentByPosition�
ID_ON_DNS_SRV�
isinstancer r r Z get_subjectZget_components�next�iter�warnings�warnr )
ZcertZids�iZext�names�_�nZ name_string�compZoidZsrvZ
componentsZcnr r r r S sV
��
�
�
�� r ) �__doc__Z
__future__r r r r* r! Zpyasn1.codec.der.decoderr Zpyasn1.type.charr Zpyasn1.type.univr Zpyasn1_modules.rfc2459r Z_commonr
r r r
r r r r �
exceptionsr �__all__r r r& r r r r r �<module> s (