File: //usr/lib/python3/dist-packages/twisted/test/__pycache__/test_sslverify.cpython-38.pyc
U
s�@g�� � @ s� d Z ddlmZmZ ddlZddlZddlZddlmZ ddl m
Z
dZ dZ dZ
dZe
d��rxddlZddlmZ ddlmZ dd lmZ dd
lmZmZ dd lmZmZ dd lmZ dd
l m Z ddl m Z ddl m!Z! ddl"m#Z#m$Z$ ddl%m&Z& ddl"m'Z' z e�(ej)�Z*e*�+dd� � W n e,k
�r: dZ
Y nX z e�(ej)�Z*e*�-dd� � W n e,k
�rt dZY nX ndZ e Z e Z
e Zddl.m/Z/ ddl0m1Z1 ddl2m3Z3 dd l4m5Z5 dd l6m7Z7 dd l8m9Z9 dd l:m;Z;m<Z< dd lm=Z=m>Z>m?Z? dd!l@mAZA dd"l2mBZBmCZC dd#lmDZD dd$lEmFZF e �sVdd%lGmHZHmIZI dd&lmJZK dd'lLmMZM d(ZNd)ZOe9eP�jQ�Rd*��S� ZTe�U� fd+d,�ZVd-d.� ZWdzd0d1�ZXd2d3� ZYd{d4d5�ZZd|d6d7�Z[d8d9� Z\G d:d;� d;e=j]�Z^G d<d=� d=e=j]�Z_G d>d?� d?e`�ZaG d@dA� dAe;jb�ZcG dBdC� dCe`�ZdG dDdE� dEe`�ZeG dFdG� dGeee;jf�ZgG dHdI� dIe;jb�ZhG dJdK� dKe;jf�ZiG dLdM� dMe;jb�Zjd}dNdO�ZkG dPdQ� dQe;jf�ZlG dRdS� dSe;jf�ZmG dTdU� dUe;jf�ZnG dVdW� dW�ZoG dXdY� dY�ZpG dZd[� d[�ZqG d\d]� d]e;jf�ZrG d^d_� d_e;jf�ZsG d`da� dae;jf�ZtG dbdc� dce;jf�ZuG ddde� dee;jf�ZvG dfdg� dge;jf�ZwG dhdi� die`�ZxG djdk� dke`�ZyG dldm� dme;jf�ZzG dndo� doe`�Z{G dpdq� dqe`�Z|G drds� dse;jb�Z}G dtdu� due;jb�Z~G dvdw� dwe;jf�ZG dxdy� dye;jb�Z�dS )~z+
Tests for L{twisted.internet._sslverify}.
� )�division�absolute_importN)� implementer)�
requireModule�OpenSSL)�ssl)�SSL)�get_elliptic_curves)�PKey�X509)�TYPE_RSA� FILETYPE_PEM)�x509)�default_backend)�hashes)�rsa)�
PrivateFormat� NoEncryption)�NameOID)�Encodingc C s d S �N� ��cr r �=/usr/lib/python3/dist-packages/twisted/test/test_sslverify.py�<lambda>. � r z1OpenSSL 1.0.1 or greater required for NPN supportc C s d S r r r r r r r 4 r z2OpenSSL 1.0.2 or greater required for ALPN supportz"OpenSSL is required for SSL tests.)�SetAsideModule)�connectedServerAndClient)�ConnectionClosed)� nativeString)�FilePath)� getModule)�unittest�util)�protocol�defer�reactor)� _idnaText)�CertificateError�ConnectionLost)�
interfaces)�Version)�
platformTrust�VerificationError)�
_sslverify)�TLSMemoryBIOFactorya�
-----BEGIN CERTIFICATE-----
MIIC2jCCAkMCAjA5MA0GCSqGSIb3DQEBBAUAMIG0MQswCQYDVQQGEwJVUzEiMCAG
A1UEAxMZZXhhbXBsZS50d2lzdGVkbWF0cml4LmNvbTEPMA0GA1UEBxMGQm9zdG9u
MRwwGgYDVQQKExNUd2lzdGVkIE1hdHJpeCBMYWJzMRYwFAYDVQQIEw1NYXNzYWNo
dXNldHRzMScwJQYJKoZIhvcNAQkBFhhub2JvZHlAdHdpc3RlZG1hdHJpeC5jb20x
ETAPBgNVBAsTCFNlY3VyaXR5MB4XDTA2MDgxNjAxMDEwOFoXDTA3MDgxNjAxMDEw
OFowgbQxCzAJBgNVBAYTAlVTMSIwIAYDVQQDExlleGFtcGxlLnR3aXN0ZWRtYXRy
aXguY29tMQ8wDQYDVQQHEwZCb3N0b24xHDAaBgNVBAoTE1R3aXN0ZWQgTWF0cml4
IExhYnMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxJzAlBgkqhkiG9w0BCQEWGG5v
Ym9keUB0d2lzdGVkbWF0cml4LmNvbTERMA8GA1UECxMIU2VjdXJpdHkwgZ8wDQYJ
KoZIhvcNAQEBBQADgY0AMIGJAoGBAMzH8CDF/U91y/bdbdbJKnLgnyvQ9Ig9ZNZp
8hpsu4huil60zF03+Lexg2l1FIfURScjBuaJMR6HiMYTMjhzLuByRZ17KW4wYkGi
KXstz03VIKy4Tjc+v4aXFI4XdRw10gGMGQlGGscXF/RSoN84VoDKBfOMWdXeConJ
VyC4w3iJAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAviMT4lBoxOgQy32LIgZ4lVCj
JNOiZYg8GMQ6y0ugp86X80UjOvkGtNf/R7YgED/giKRN/q/XJiLJDEhzknkocwmO
S+4b2XpiaZYxRyKWwL221O7CGmtWYyZl2+92YYmmCiNzWQPfP6BOMlfax0AGLHls
fXzCWdG0O/3Lk2SRM0I=
-----END CERTIFICATE-----
a�
-----BEGIN CERTIFICATE-----
MIIC3jCCAkcCAjA6MA0GCSqGSIb3DQEBBAUAMIG2MQswCQYDVQQGEwJVUzEiMCAG
A1UEAxMZZXhhbXBsZS50d2lzdGVkbWF0cml4LmNvbTEPMA0GA1UEBxMGQm9zdG9u
MRwwGgYDVQQKExNUd2lzdGVkIE1hdHJpeCBMYWJzMRYwFAYDVQQIEw1NYXNzYWNo
dXNldHRzMSkwJwYJKoZIhvcNAQkBFhpzb21lYm9keUB0d2lzdGVkbWF0cml4LmNv
bTERMA8GA1UECxMIU2VjdXJpdHkwHhcNMDYwODE2MDEwMTU2WhcNMDcwODE2MDEw
MTU2WjCBtjELMAkGA1UEBhMCVVMxIjAgBgNVBAMTGWV4YW1wbGUudHdpc3RlZG1h
dHJpeC5jb20xDzANBgNVBAcTBkJvc3RvbjEcMBoGA1UEChMTVHdpc3RlZCBNYXRy
aXggTGFiczEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEpMCcGCSqGSIb3DQEJARYa
c29tZWJvZHlAdHdpc3RlZG1hdHJpeC5jb20xETAPBgNVBAsTCFNlY3VyaXR5MIGf
MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnm+WBlgFNbMlHehib9ePGGDXF+Nz4
CjGuUmVBaXCRCiVjg3kSDecwqfb0fqTksBZ+oQ1UBjMcSh7OcvFXJZnUesBikGWE
JE4V8Bjh+RmbJ1ZAlUPZ40bAkww0OpyIRAGMvKG+4yLFTO4WDxKmfDcrOb6ID8WJ
e1u+i3XGkIf/5QIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAD4Oukm3YYkhedUepBEA
vvXIQhVDqL7mk6OqYdXmNj6R7ZMC8WWvGZxrzDI1bZuB+4aIxxd1FXC3UOHiR/xg
i9cDl1y8P/qRp4aEBNF6rI0D4AxTbfnHQx4ERDAOShJdYZs/2zifPJ6va6YvrEyr
yqDtGhklsWW3ZwBzEh5VEOUp
-----END CERTIFICATE-----
z
server.pemc C s t | �S )zQ
Each time we're called, return the next integer in the natural numbers.
)�next)�counterr r r r2 � s r2 c K s� t � }|�td� t� }|�d� |�d� |�� |�� fD ]&}| �� D ]\}}t ||t
|�� qHq<|� t � � |�
|� |�|d� ||fS )Ni r i�3�Zmd5)r
Z generate_keyr r Zgmtime_adj_notBeforeZgmtime_adj_notAfterZ
get_issuer� get_subject�items�setattrr Zset_serial_numberr2 Z
set_pubkey�sign)�kwZkeypair� certificateZxname�k�vr r r �makeCertificate� s
r; � example.comc C s� t �t �tjd�g�}t �t �tjd�g�}t�ddd�}tjddt � d�}|�
� }t � � � |��
|��tj�� | ��tj�� | ��t �� ��
|�jt jdd d
�dd �j|t�� t � d �}tjddt � d�}|�
� }zt�| �} W n" tk
�r t �| �g}
Y nX t � | �g}
t � � � |��
|��tj�� | ��tj�� | ��t �� ��
|�jt jd
dd
�dd �jt � |
�dd �j|t�� t � d �} t j � |�!t"j#��} t j$� d�%|�&t"j#t'j(t)� �| �!t"j#�g��}
| |
fS )a~
Create a self-signed CA certificate and server certificate signed by the
CA.
@param serviceIdentity: The identity (hostname) of the server.
@type serviceIdentity: L{unicode}
@return: a 2-tuple of C{(certificate_authority_certificate,
server_certificate)}
@rtype: L{tuple} of (L{sslverify.Certificate},
L{sslverify.PrivateCertificate})
zTesting Example CAzTesting Example Server� r i i )Zpublic_exponentZkey_size�backendT� )ZcaZ path_length)Zcritical)Z private_key� algorithmr> FN�
)*r �NameZ
NameAttributer Z COMMON_NAME�datetimeZ timedeltar Zgenerate_private_keyr Z
public_keyZCertificateBuilderZ subject_nameZ issuer_nameZnot_valid_beforeZtodayZnot_valid_afterZ
serial_numberZrandom_serial_number�
add_extensionZBasicConstraintsr6 r ZSHA256� ipaddressZ
ip_address�
ValueErrorZDNSNameZ IPAddressZSubjectAlternativeName� sslverify� Certificate�loadPEMZ public_bytesr ZPEM�PrivateCertificate�joinZ
private_bytesr ZTraditionalOpenSSLr )ZserviceIdentityZcommonNameForCAZcommonNameForServerZoneDayZprivateKeyForCAZpublicKeyForCA�
caCertificateZprivateKeyForServerZpublicKeyForServerZ ipAddressZsubjectAlternativeNames�serverCertificate�
caSelfCert�
serverCertr r r �!certificatesForAuthorityAndServer� s�
����� � ��� � ��� �� � ��� � �� ��
��
�� rP c s� G dd� dt j�}G dd� dt j�}|� �|� �t �� }�fdd�|_ t �� }�fdd�|_ t|d|d �� t| d
|d ��t�fd d�� fd d��\}}}||��|fS )
a�
Common implementation code for both L{loopbackTLSConnection} and
L{loopbackTLSConnectionInMemory}. Creates a loopback TLS connection
using the provided server and client context factories.
@param serverOpts: An OpenSSL context factory for the server.
@type serverOpts: C{OpenSSLCertificateOptions}, or any class with an
equivalent API.
@param clientOpts: An OpenSSL context factory for the client.
@type clientOpts: C{OpenSSLCertificateOptions}, or any class with an
equivalent API.
@return: 5-tuple of server-tls-protocol, server-inner-protocol,
client-tls-protocol, client-inner-protocol and L{IOPump}
@rtype: L{tuple}
c @ s e Zd ZdZdd� ZdS )z._loopbackTLSConnection.<locals>.GreetingServer�
greetings!c S s | j �| j� d S r �� transport�write�greeting��selfr r r �connectionMade s z=_loopbackTLSConnection.<locals>.GreetingServer.connectionMadeN)�__name__�
__module__� __qualname__rU rX r r r r �GreetingServer
s r\ c @ s$ e Zd ZdZdZdd� Zdd� ZdS )z/_loopbackTLSConnection.<locals>.ListeningClientr Nc S s | j |7 _ d S r ��data�rW r^ r r r � dataReceived s z<_loopbackTLSConnection.<locals>.ListeningClient.dataReceivedc S s
|| _ d S r ��
lostReason�rW �reasonr r r �connectionLost s z>_loopbackTLSConnection.<locals>.ListeningClient.connectionLost)rY rZ r[ r^ rb r` re r r r r �ListeningClient s rf c s � S r r r ��clientWrappedProtor r r r z(_loopbackTLSConnection.<locals>.<lambda>c s � S r r r ��serverWrappedProtor r r r T�ZisClientZwrappedFactoryFc s
� � d �S r �Z
buildProtocolr )�
serverFactoryr r r , r c s
� � d �S r rl r )�
clientFactoryr r r - r )r% �Protocol�Factoryr0 r ) �
serverOpts�
clientOptsr\ rf ZplainClientFactoryZplainServerFactory�sProto�cProto�pumpr )rn rh rm rj r �_loopbackTLSConnection� s. � �
�
rv c s2 G � �fdd�dt �}|� }tj| d�}t||�S )aF
Create a loopback TLS connection with the given trust and keys.
@param trustRoot: the C{trustRoot} argument for the client connection's
context.
@type trustRoot: L{sslverify.IOpenSSLTrustRoot}
@param privateKeyFile: The name of the file containing the private key.
@type privateKeyFile: L{str} (native string; file name)
@param chainedCertFile: The name of the chained certificate file.
@type chainedCertFile: L{str} (native string; file name)
@return: 3-tuple of server-protocol, client-protocol, and L{IOPump}
@rtype: L{tuple}
c s e Zd Z� �fdd�ZdS )z-loopbackTLSConnection.<locals>.ContextFactoryc s4 t �t j�}� dk r |�� � |��� |�� |S )z�
Create a context for the server side of the connection.
@return: an SSL context using a certificate and key.
@rtype: C{OpenSSL.SSL.Context}
N)r �Context� TLSv1_METHODZuse_certificate_chain_fileZuse_privatekey_file�check_privatekey�rW �ctx��chainedCertFile�privateKeyFiler r �
getContextE s
z8loopbackTLSConnection.<locals>.ContextFactory.getContextN)rY rZ r[ r r r| r r �ContextFactoryD s r� �� trustRoot)�objectrG �OpenSSLCertificateOptionsrv )r� r~ r} r� rq rr r r| r �loopbackTLSConnection3 s r� c C s4 |dkrt j}|| |d�}t j|||d�}t||�S )a�
Create a loopback TLS connection with the given trust and keys. Like
L{loopbackTLSConnection}, but using in-memory certificates and keys rather
than writing them to disk.
@param trustRoot: the C{trustRoot} argument for the client connection's
context.
@type trustRoot: L{sslverify.IOpenSSLTrustRoot}
@param privateKey: The private key.
@type privateKey: L{str} (native string)
@param serverCertificate: The certificate used by the server.
@type chainedCertFile: L{str} (native string)
@param clientProtocols: The protocols the client is willing to negotiate
using NPN/ALPN.
@param serverProtocols: The protocols the server is willing to negotiate
using NPN/ALPN.
@param clientOptions: The type of C{OpenSSLCertificateOptions} class to
use for the client. Defaults to C{OpenSSLCertificateOptions}.
@return: 3-tuple of server-protocol, client-protocol, and L{IOPump}
@rtype: L{tuple}
N)r� �acceptableProtocols)�
privateKeyr8 r� )rG r� rv )r� r� rM �clientProtocols�serverProtocols�
clientOptions�clientCertOpts�serverCertOptsr r r � loopbackTLSConnectionInMemory[ s ��r� c G s< | � � }t|d�� }|D ]}|�|�t�� qW 5 Q R X |S )a�
Create a temporary file to store some serializable-as-PEM objects in, and
return its name.
@param testCase: a test case to use for generating a temporary directory.
@type testCase: L{twisted.trial.unittest.TestCase}
@param dumpables: arguments are objects from pyOpenSSL with a C{dump}
method, taking a pyOpenSSL file-type constant, such as
L{OpenSSL.crypto.FILETYPE_PEM} or L{OpenSSL.crypto.FILETYPE_ASN1}.
@type dumpables: L{tuple} of L{object} with C{dump} method taking L{int}
returning L{bytes}
@return: the path to a file where all of the dumpables were dumped in PEM
format.
@rtype: L{str}
�wb)Zmktemp�openrT �dumpr
)ZtestCaseZ dumpables�fname�fZdumpabler r r �pathContainingDumpOf� s
r� c @ s e Zd Zdd� Zdd� ZdS )�DataCallbackProtocolc C s( | j jd }| j _|d k r$|�|� d S r )�factory�onData�callback)rW r^ �dr r r r` � s z!DataCallbackProtocol.dataReceivedc C s( | j jd }| j _|d k r$|�|� d S r �r� �onLostZerrback)rW rd r� r r r re � s z#DataCallbackProtocol.connectionLostN)rY rZ r[ r` re r r r r r� � s r� c @ s e Zd ZdZdd� Zdd� ZdS )�WritingProtocol� xc C s | j �| j� d S r )rS rT �byterV r r r rX � s z WritingProtocol.connectionMadec C s | j j�|� d S r r� rc r r r re � s z WritingProtocol.connectionLostN)rY rZ r[ r� rX re r r r r r� � s r� c @ s� e Zd ZdZdZdd� Zdd� Zdd� Zd d
� Zd d � Z d
d� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zdd � Zd d � Zd S ) � FakeContexta�
Introspectable fake of an C{OpenSSL.SSL.Context}.
Saves call arguments for later introspection.
Necessary because C{Context} offers poor introspection. cf. this
U{pyOpenSSL bug<https://bugs.launchpad.net/pyopenssl/+bug/1173899>}.
@ivar _method: See C{method} parameter of L{__init__}.
@ivar _options: L{int} of C{OR}ed values from calls of L{set_options}.
@ivar _certificate: Set by L{use_certificate}.
@ivar _privateKey: Set by L{use_privatekey}.
@ivar _verify: Set by L{set_verify}.
@ivar _verifyDepth: Set by L{set_verify_depth}.
@ivar _mode: Set by L{set_mode}.
@ivar _sessionID: Set by L{set_session_id}.
@ivar _extraCertChain: Accumulated L{list} of all extra certificates added
by L{add_extra_chain_cert}.
@ivar _cipherList: Set by L{set_cipher_list}.
@ivar _dhFilename: Set by L{load_tmp_dh}.
@ivar _defaultVerifyPathsSet: Set by L{set_default_verify_paths}
@ivar _ecCurve: Set by L{set_tmp_ecdh}
r c C s || _ g | _d| _d | _d S )NF)�_method�_extraCertChain�_defaultVerifyPathsSet�_ecCurve)rW �methodr r r �__init__� s zFakeContext.__init__c C s | j |O _ d S r )�_options�rW �optionsr r r � set_options� s zFakeContext.set_optionsc C s
|| _ d S r )� _certificate)rW r8 r r r �use_certificate� s zFakeContext.use_certificatec C s
|| _ d S r )� _privateKey)rW r� r r r �use_privatekey� s zFakeContext.use_privatekeyc C s d S r r rV r r r ry � s z FakeContext.check_privatekeyc C s
|| _ dS )zo
Set the mode. See L{SSL.Context.set_mode}.
@param mode: See L{SSL.Context.set_mode}.
N)�_mode)rW �moder r r �set_mode� s zFakeContext.set_modec C s ||f| _ d S r )Z_verify)rW �flagsr� r r r �
set_verify s zFakeContext.set_verifyc C s
|| _ d S r )Z _verifyDepth)rW Zdepthr r r �set_verify_depth s z FakeContext.set_verify_depthc C s
|| _ d S r )Z
_sessionID)rW Z sessionIDr r r �set_session_id s zFakeContext.set_session_idc C s | j �|� d S r )r� �append�rW �certr r r �add_extra_chain_cert s z FakeContext.add_extra_chain_certc C s
|| _ d S r )� _cipherList)rW Z
cipherListr r r �set_cipher_list s zFakeContext.set_cipher_listc C s
|| _ d S r )� _dhFilename)rW Z
dhfilenamer r r � load_tmp_dh s zFakeContext.load_tmp_dhc C s
d| _ dS )z9
Set the default paths for the platform.
TN)r� rV r r r �set_default_verify_paths s z$FakeContext.set_default_verify_pathsc C s
|| _ dS )z�
Set an ECDH curve. Should only be called by OpenSSL 1.0.1
code.
@param curve: See L{OpenSSL.SSL.Context.set_tmp_ecdh}
N)r� �rW �curver r r � set_tmp_ecdh s zFakeContext.set_tmp_ecdhN)rY rZ r[ �__doc__r� r� r� r� r� ry r� r� r� r� r� r� r� r� r� r r r r r� � s # r� c @ s@ e Zd ZdZereZdd� Zdd� Zdd� Zdd � Z d
d � Z
d S )
�ClientOptionsTestsz5
Tests for L{sslverify.optionsForClientTLS}.
c C s( | j ttjddd�}| �t|�d� dS )z�
When passed a keyword parameter other than C{extraCertificateOptions},
L{sslverify.optionsForClientTLS} raises an exception just like a
normal Python function would.
ZalphaZbeta)�hostnameZsomeRandomThingzJoptionsForClientTLS() got an unexpected keyword argument 'someRandomThing'N)� assertRaises� TypeErrorrG �optionsForClientTLS� assertEqual�str)rW �errorr r r �test_extraKeywords1 s ��z%ClientOptionsTests.test_extraKeywordsc C s. | � ttjd�}dtj }| �t|�|� dS )z�
If you pass L{bytes} as the hostname to
L{sslverify.optionsForClientTLS} it immediately raises a L{TypeError}.
s not-actually-a-hostname.comz6optionsForClientTLS requires text for host names, not N)r� r� rG r� �bytesrY r� r� )rW r� Z expectedTextr r r �test_bytesFailFastC s ���z%ClientOptionsTests.test_bytesFailFastc C s t �d�}| �|j� dS )zl
If you pass a dNSName to L{sslverify.optionsForClientTLS}
L{_sendSNI} will be True
r< N)rG r� �
assertTrue�_sendSNIr� r r r �test_dNSNameHostnameS s
z'ClientOptionsTests.test_dNSNameHostnamec C s t �d�}| �|j� dS )zs
If you pass an IPv4 address to L{sslverify.optionsForClientTLS}
L{_sendSNI} will be False
� 127.0.0.1N�rG r� � assertFalser� r� r r r �test_IPv4AddressHostname\ s
z+ClientOptionsTests.test_IPv4AddressHostnamec C s t �d�}| �|j� dS )zs
If you pass an IPv6 address to L{sslverify.optionsForClientTLS}
L{_sendSNI} will be False
z::1Nr� r� r r r �test_IPv6AddressHostnamee s
z+ClientOptionsTests.test_IPv6AddressHostnameN) rY rZ r[ r� �skipSSL�skipr� r� r� r� r� r r r r r� * s r� c @ s e Zd ZdZdd� Zdd� ZdS )�$FakeChooseDiffieHellmanEllipticCurvezG
A fake implementation of L{_ChooseDiffieHellmanEllipticCurve}
c C s dS )z&
A no-op constructor.
Nr )rW Z
versionNumber�
openSSLlib�
openSSLcryptor r r r� t s z-FakeChooseDiffieHellmanEllipticCurve.__init__c C s dS )z|
A null configuration.
@param ctx: An L{OpenSSL.SSL.Context} that would be
configured.
Nr rz r r r �configureECDHCurvez s z7FakeChooseDiffieHellmanEllipticCurve.configureECDHCurveN)rY rZ r[ r� r� r� r r r r r� o s r� c @ sB e Zd ZdZereZd ZZd ZZ dd� Z
dd� Z d dd�Z dS )
�OpenSSLOptionsTestsMixinz�
A mixin for L{OpenSSLOptions} test cases creates client and server
certificates, signs them with a CA, and provides a L{loopback}
that creates TLS a connections with them.
Nc C sf t ddd�\| _| _t ddd�\| _| _t ddd�d | _t d d
d�d | _| j| jg| _| j| _d S ) zK
Create class variables of client and server certificates.
� Server Test Certificate� server��O�CNs Client Test Certificates clients CA Test Certificate 1s ca1r= � CA Test Certificates ca2N) r; �sKey�sCert�cKey�cCertZcaCert1ZcaCert2�caCerts�extraCertChainrV r r r �setUp� s, ������z OpenSSLOptionsTestsMixin.setUpc C sf | j d k r| j �� | jd k r(| j�� g }| jd k rB|�| j� | jd k rX|�| j� tj|dd�S )NT�Z
consumeErrors) �
serverPortZ
stopListening�
clientConnZ
disconnect� onServerLostr� � onClientLostr& � DeferredList)rW �Lr r r �tearDown� s
z!OpenSSLOptionsTestsMixin.tearDownc C s� |d krt �� | _}|d kr,t �� | _}|d kr<t �� }t�� }t|_||_||_t� � }t
|_||_t � d||�| _
t �d| j
�� j||�| _d S )Nr r� )r& �Deferredr� r� r% Z
ServerFactoryr� r� r� Z
ClientFactoryr� r' Z listenSSLr� Z
connectSSLZgetHostZportr� )rW r� r� r� r� r� rm rn r r r �loopback� s&
�z!OpenSSLOptionsTestsMixin.loopback)NNN)
rY rZ r[ r� r� r� r� r� r� r� r� r� r� r r r r r� � s �r� c s� e Zd ZdZ� fdd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zdd� Zd d � Zd d � Zd d!� Zd"d#� Zd$d%� Zd&d'� Zd(d)� Zd*d+� Zd,d-� Zd.d/� Zd0d1� Zd2d3� Z d4d5� Z d6d7� Z d8d9� Z d:d;� Z d<d=� Z!d>d?� Z"d@dA� Z#dBdC� Z$dDdE� Z%dFdG� Z&dHdI� Z'dJdK� Z(dLdM� Z)dNdO� Z*dPdQ� Z+dRdS� Z,dTdU� Z-e.j/e0dVdW�ge-_/dXdY� Z1dZd[� Z2d\d]� Z3d^d_� Z4d`da� Z5dbdc� Z6ddde� Z7dfdg� Z8� Z9S )h�OpenSSLOptionsTestsz0
Tests for L{sslverify.OpenSSLOptions}.
c s t t| ��� | �tdt� dS )z�
Same as L{OpenSSLOptionsTestsMixin.setUp}, but it also patches
L{sslverify._ChooseDiffieHellmanEllipticCurve}.
�!_ChooseDiffieHellmanEllipticCurveN)�superr� r� �patchrG r� rV �� __class__r r r� � s �zOpenSSLOptionsTests.setUpc C s | j ttj| jd� dS )�S
C{privateKey} and C{certificate} make only sense if both are set.
)r� N)r� rF rG r� r� rV r r r �"test_constructorWithOnlyPrivateKey� s
�z6OpenSSLOptionsTests.test_constructorWithOnlyPrivateKeyc C s | j ttj| jd� dS )r� )r8 N)r� rF rG r� r� rV r r r �#test_constructorWithOnlyCertificate� s
�z7OpenSSLOptionsTests.test_constructorWithOnlyCertificatec C sD t j| j| jd�}| �|j| j� | �|j| j� | �|jg � dS )zT
Specifying C{privateKey} and C{certificate} initializes correctly.
�r� r8 N)rG r� r� r� r� r� r8 r� �rW �optsr r r �,test_constructorWithCertificateAndPrivateKey� s �z@OpenSSLOptionsTests.test_constructorWithCertificateAndPrivateKeyc C s | j ttj| j| jdd� dS )zN
C{verify} must not be C{True} without specifying C{caCerts}.
T)r� r8 �verifyN)r� rF rG r� r� r� rV r r r �0test_constructorDoesNotAllowVerifyWithoutCACerts� s �zDOpenSSLOptionsTests.test_constructorDoesNotAllowVerifyWithoutCACertsc C s@ | j ttj| j| jdd| jd� | j ttj| j| jddd� dS )z�
C{verify}, C{requireCertificate}, and C{caCerts} must not be specified
by the caller (to be I{any} value, even the default!) when specifying
C{trustRoot}.
TN)r� r8 r� r� r� )r� r8 r� �requireCertificate)r� r� rG r� r� r� r� rV r r r �/test_constructorDoesNotAllowLegacyWithTrustRoot s" � �zCOpenSSLOptionsTests.test_constructorDoesNotAllowLegacyWithTrustRootc C s6 t j| j| j| jd�}| �|j� | �| j|j� dS )z2
It's currently a NOP, but valid.
)r� r8 r� N)rG r� r� r� r� r� r� r� r� r r r �*test_constructorAllowsCACertsWithoutVerify s � z>OpenSSLOptionsTests.test_constructorAllowsCACertsWithoutVerifyc C s8 t j| j| jd| jd�}| �|j� | �| j|j� dS )zL
Specifying C{verify} and C{caCerts} initializes correctly.
T)r� r8 r� r� N)rG r� r� r� r� r� r� r� r� r r r �$test_constructorWithVerifyAndCACerts$ s � z8OpenSSLOptionsTests.test_constructorWithVerifyAndCACertsc C s* t j| j| j| jd�}| �| j|j� dS )zt
Setting C{extraCertChain} works if C{certificate} and C{privateKey} are
set along with it.
�r� r8 r� N)rG r� r� r� r� r� r� r r r � test_constructorSetsExtraChain0 s �z2OpenSSLOptionsTests.test_constructorSetsExtraChainc C s | j ttj| j| jd� dS )zl
A C{extraCertChain} without C{privateKey} doesn't make sense and is
thus rejected.
)r8 r� N)r� rF rG r� r� r� rV r r r �7test_constructorDoesNotAllowExtraChainWithoutPrivateKey= s �zKOpenSSLOptionsTests.test_constructorDoesNotAllowExtraChainWithoutPrivateKeyc C s | j ttj| j| jd� dS )zm
A C{extraCertChain} without C{certificate} doesn't make sense and is
thus rejected.
)r� r� N)r� rF rG r� r� r� rV r r r �7test_constructorDoesNotAllowExtraChainWithOutPrivateKeyJ s �zKOpenSSLOptionsTests.test_constructorDoesNotAllowExtraChainWithOutPrivateKeyc C sX t j| j| j| jd�}t|_|�� }| �| j|j � | �| j|j
� | �| j|j � dS )z�
If C{extraCertChain} is set and all prerequisites are met, the
specified chain certificates are added to C{Context}s that get
created.
r N) rG r� r� r� r� r� �_contextFactoryr r� r� r� r� �rW r� r{ r r r �&test_extraChainFilesAreAddedIfSuppliedW s �z:OpenSSLOptionsTests.test_extraChainFilesAreAddedIfSuppliedc C s0 t j| j| j| jd�}|�� }| �|tj� dS )zR
C{extraCertChain} doesn't break C{OpenSSL.SSL.Context} creation.
r N) rG r� r� r� r� r �assertIsInstancer rw r
r r r �$test_extraChainDoesNotBreakPyOpenSSLi s �z8OpenSSLOptionsTests.test_extraChainDoesNotBreakPyOpenSSLc C s: t j| j| jd�}t|_|�� }| �|j� d�|j
� dS )z�
If the user doesn't supply custom acceptable ciphers, a shipped secure
default is used. We can't check directly for it because the effective
cipher string we set varies with platforms.
r� �asciiN) rG r� r� r� r� r r r� Z
_cipherString�encoder� r
r r r �"test_acceptableCiphersAreAlwaysSetv s �z6OpenSSLOptionsTests.test_acceptableCiphersAreAlwaysSetc C sP t tj�G dd� dt��}tj| j| j|� d�}t|_ |�
� }| � d|j � dS )zB
If acceptable ciphers are passed, they are used.
c @ s e Zd Zdd� ZdS )zWOpenSSLOptionsTests.test_honorsAcceptableCiphersArgument.<locals>.FakeAcceptableCiphersc S s t �d�gS )N�sentinel)rG �
OpenSSLCipher)rW �_r r r �
selectCiphers� s zeOpenSSLOptionsTests.test_honorsAcceptableCiphersArgument.<locals>.FakeAcceptableCiphers.selectCiphersN)rY rZ r[ r r r r r �FakeAcceptableCiphers� s r )r� r8 ZacceptableCipherss sentinelN)
r r+ ZIAcceptableCiphersr� rG r� r� r� r� r r r� r� )rW r r� r{ r r r �$test_honorsAcceptableCiphersArgument� s �z8OpenSSLOptionsTests.test_honorsAcceptableCiphersArgumentc C sH t j| j| jd�}t|_|�� }tjtj B tj
B }| � ||j |@ � dS )z
Every context must have C{OP_NO_SSLv2}, C{OP_NO_COMPRESSION}, and
C{OP_CIPHER_SERVER_PREFERENCE} set.
r� N)
rG r� r� r� r� r r r � OP_NO_SSLv2�OP_NO_COMPRESSION�OP_CIPHER_SERVER_PREFERENCEr� r� �rW r� r{ r� r r r � test_basicSecurityOptionsAreSet� s �
�z3OpenSSLOptionsTests.test_basicSecurityOptionsAreSetc C s4 t j| j| jd�}t|_|�� }| �tj |j
� dS )zH
Every context must be in C{MODE_RELEASE_BUFFERS} mode.
r� N) rG r� r� r� r� r r r� r ZMODE_RELEASE_BUFFERSr� r
r r r �test_modeIsSet� s �z"OpenSSLOptionsTests.test_modeIsSetc C sD t j| j| jdd�}t|_|�� }tjtj B }| �
||j |@ � dS )z�
If C{singleUseKeys} is set, every context must have
C{OP_SINGLE_DH_USE} and C{OP_SINGLE_ECDH_USE} set.
T)r� r8 �enableSingleUseKeysN) rG r� r� r� r� r r r ZOP_SINGLE_DH_USEZOP_SINGLE_ECDH_USEr� r� r r r r �test_singleUseKeys� s � z&OpenSSLOptionsTests.test_singleUseKeysc C sd t j| j| jtjd� d}| �| jg�}| �dt |�� | �t
|d d � | �||d d � dS )zd
Passing C{method} to L{sslverify.OpenSSLCertificateOptions} is
deprecated.
)r� r8 r� z�Passing method to twisted.internet.ssl.CertificateOptions was deprecated in Twisted 17.1.0. Please use a combination of insecurelyLowerMinimumTo, raiseMinimumTo, and lowerMaximumSecurityTo instead, as Twisted will correctly configure the method.r= r �category�messageN) rG r� r� r� r �
SSLv23_METHOD�
flushWarnings�test_methodIsDeprecatedr� �len�DeprecationWarning)rW r �warningsr r r r# � s �z+OpenSSLOptionsTests.test_methodIsDeprecatedc C sN t j| j| jd�}t|_|�� }tjtj B tj
B tj B }| � ||j
|@ � dS )z�
L{sslverify.OpenSSLCertificateOptions} will make the default minimum
TLS version v1.0, if no C{method}, or C{insecurelyLowerMinimumTo} is
given.
r� N)rG r� r� r� r� r r r r r r � OP_NO_SSLv3r� r� r r r r �test_tlsv1ByDefault� s �
��z'OpenSSLOptionsTests.test_tlsv1ByDefaultc C sH | � t��$}tj| j| jtjjtjjd� W 5 Q R X | �|j j
d� dS )z�
Passing C{insecurelyLowerMinimumTo} along with C{raiseMinimumTo} to
L{sslverify.OpenSSLCertificateOptions} will cause it to raise an
exception.
)r� r8 �raiseMinimumTo�insecurelyLowerMinimumTo�ZnopeN) r� r� rG r� r� r� �
TLSVersion�TLSv1_2r� � exception�args�rW �er r r �#test_tlsProtocolsAtLeastWithMinimum� s �z7OpenSSLOptionsTests.test_tlsProtocolsAtLeastWithMinimumc C sF | � t��"}tj| j| jtjtjj d� W 5 Q R X | �
|j j d� dS )z�
Passing C{raiseMinimumTo} along with C{method} to
L{sslverify.OpenSSLCertificateOptions} will cause it to raise an
exception.
)r� r8 r� r) r+ N�
r� r� rG r� r� r� r r! r, r- r� r. r/ r0 r r r �$test_tlsProtocolsNoMethodWithAtLeast� s �z8OpenSSLOptionsTests.test_tlsProtocolsNoMethodWithAtLeastc C sF | � t��"}tj| j| jtjtjj d� W 5 Q R X | �
|j j d� dS )z�
Passing C{insecurelyLowerMinimumTo} along with C{method} to
L{sslverify.OpenSSLCertificateOptions} will cause it to raise an
exception.
)r� r8 r� r* r+ Nr3 r0 r r r �$test_tlsProtocolsNoMethodWithMinimum s �z8OpenSSLOptionsTests.test_tlsProtocolsNoMethodWithMinimumc C sF | � t��"}tj| j| jtjtjj d� W 5 Q R X | �
|j j d� dS )z�
Passing C{lowerMaximumSecurityTo} along with C{method} to
L{sslverify.OpenSSLCertificateOptions} will cause it to raise an
exception.
)r� r8 r� �lowerMaximumSecurityTor+ Nr3 r0 r r r �$test_tlsProtocolsNoMethodWithMaximum# s �z8OpenSSLOptionsTests.test_tlsProtocolsNoMethodWithMaximumc C sH | � t��$}tj| j| jtjjtjjd� W 5 Q R X | � |j
j d� dS )z�
Passing out of order TLS versions to C{insecurelyLowerMinimumTo} and
C{lowerMaximumSecurityTo} will cause it to raise an exception.
�r� r8 r* r6 )zFinsecurelyLowerMinimumTo needs to be lower than lowerMaximumSecurityToN� r� rF rG r� r� r� r, �TLSv1_0�SSLv3r� r. r/ r0 r r r �test_tlsVersionRangeInOrder5 s �z/OpenSSLOptionsTests.test_tlsVersionRangeInOrderc C sH | � t��$}tj| j| jtjjtjjd� W 5 Q R X | � |j
j d� dS )z�
Passing out of order TLS versions to C{raiseMinimumTo} and
C{lowerMaximumSecurityTo} will cause it to raise an exception.
)r� r8 r) r6 )z<raiseMinimumTo needs to be lower than lowerMaximumSecurityToNr9 r0 r r r �"test_tlsVersionRangeInOrderAtLeastF s �z6OpenSSLOptionsTests.test_tlsVersionRangeInOrderAtLeastc C sf t j| j| jt jjd�}t|_|�� }t j
t j B t j B t j
B t jB t jB |jB }| �||j|@ � dS )a
When calling L{sslverify.OpenSSLCertificateOptions} with
C{lowerMaximumSecurityTo} but no C{raiseMinimumTo} or
C{insecurelyLowerMinimumTo} set, and C{lowerMaximumSecurityTo} is
below the minimum default, the minimum will be made the new maximum.
)r� r8 r6 N�rG r� r� r� r, r; r� r r r r r r � OP_NO_TLSv1�
OP_NO_TLSv1_1�
OP_NO_TLSv1_2�_OP_NO_TLSv1_3r� r� r r r r �&test_tlsProtocolsreduceToMaxWithoutMinW s& �
�����z:OpenSSLOptionsTests.test_tlsProtocolsreduceToMaxWithoutMinc C sl t j| j| jt jjt jjd�}t|_|�� }t j
t j B t j B t j
B t jB t jB |jB }| �||j|@ � dS )z�
When calling L{sslverify.OpenSSLCertificateOptions} with
C{insecurelyLowerMinimumTo} and C{lowerMaximumSecurityTo} set to
SSLv3, it will exclude all others.
r8 Nr> r r r r �test_tlsProtocolsSSLv3Onlyk s( �
�����z.OpenSSLOptionsTests.test_tlsProtocolsSSLv3Onlyc C sl t j| j| jt jjt jjd�}t|_|�� }t j
t j B t j B t j
B t jB t jB |jB }| �||j|@ � dS )z�
When calling L{sslverify.OpenSSLCertificateOptions} with
C{insecurelyLowerMinimumTo} and C{lowerMaximumSecurityTo} set to v1.0,
it will exclude all others.
r8 N)rG r� r� r� r, r: r� r r r r r r r' r@ rA rB r� r� r r r r � test_tlsProtocolsTLSv1Point0Only s( �
�����z4OpenSSLOptionsTests.test_tlsProtocolsTLSv1Point0Onlyc C sl t j| j| jt jjt jjd�}t|_|�� }t j
t j B t j B t j
B t jB t jB |jB }| �||j|@ � dS )z�
When calling L{sslverify.OpenSSLCertificateOptions} with
C{insecurelyLowerMinimumTo} and C{lowerMaximumSecurityTo} set to v1.1,
it will exclude all others.
r8 N)rG r� r� r� r, ZTLSv1_1r� r r r r r r r' r? rA rB r� r� r r r r � test_tlsProtocolsTLSv1Point1Only� s( �
�����z4OpenSSLOptionsTests.test_tlsProtocolsTLSv1Point1Onlyc C sl t j| j| jt jjt jjd�}t|_|�� }t j
t j B t j B t j
B t jB t jB |jB }| �||j|@ � dS )z�
When calling L{sslverify.OpenSSLCertificateOptions} with
C{insecurelyLowerMinimumTo} and C{lowerMaximumSecurityTo} set to v1.2,
it will exclude all others.
r8 N)rG r� r� r� r, r- r� r r r r r r r' r? r@ rB r� r� r r r r � test_tlsProtocolsTLSv1Point2Only� s( �
�����z4OpenSSLOptionsTests.test_tlsProtocolsTLSv1Point2Onlyc C s` t j| j| jt jjt jjd�}t|_|� � }t
j t
j B t
j
B t
jB |jB }| �||j|@ � dS )z�
When calling L{sslverify.OpenSSLCertificateOptions} with
C{insecurelyLowerMinimumTo} set to TLSv1.0 and
C{lowerMaximumSecurityTo} to TLSv1.2, it will exclude both SSLs and
the (unreleased) TLSv1.3.
r8 N)rG r� r� r� r, r: r- r� r r r r r r r' rB r� r� r r r r � test_tlsProtocolsAllModernTLS� s �
���z1OpenSSLOptionsTests.test_tlsProtocolsAllModernTLSc C s` t j| j| jt jjd�}t|_|�� }t j
t j B t j B t j
B t jB t jB }| �||j|@ � dS )z�
When calling L{sslverify.OpenSSLCertificateOptions} with
C{raiseMinimumTo} set to TLSv1.2, it will ignore all TLSs below
1.2 and SSL.
�r� r8 r) N�rG r� r� r� r, r- r� r r r r r r r' r? r@ r� r� r r r r �$test_tlsProtocolsAtLeastAllSecureTLS� s" �
����z8OpenSSLOptionsTests.test_tlsProtocolsAtLeastAllSecureTLSc C sf t j| j| jt jjd�}t|_|�� }t j
t j B t j B t j
B }| �||j|@ � | �|jt jj� dS )z�
When calling L{sslverify.OpenSSLCertificateOptions} with
C{raiseMinimumTo} set to a value lower than Twisted's default will
cause it to use the more secure default.
rI N)rG r� r� r� r, r; r� r r r r r r r' r� r� Z_defaultMinimumTLSVersionr: r r r r �/test_tlsProtocolsAtLeastWillAcceptHigherDefault� s �
���zCOpenSSLOptionsTests.test_tlsProtocolsAtLeastWillAcceptHigherDefaultc C s` t j| j| jt jjd�}t|_|�� }t j
t j B t j B t j
B t jB t jB }| �||j|@ � dS )z�
When calling L{sslverify.OpenSSLCertificateOptions} with
C{insecurelyLowerMinimumTo} set to TLSv1.2, it will ignore all TLSs below
1.2 and SSL.
)r� r8 r* NrJ r r r r � test_tlsProtocolsAllSecureTLS� s" �
����z1OpenSSLOptionsTests.test_tlsProtocolsAllSecureTLSc C sN G dd� dt �}|� }tj| j| j|d�}t|_|�� }| �|j j
|j � dS )zO
If C{dhParams} is set, they are loaded into each new context.
c @ s e Zd Zed�ZdS )zFOpenSSLOptionsTests.test_dhParams.<locals>.FakeDiffieHellmanParameters� dh.paramsN)rY rZ r[ r! �_dhFiler r r r �FakeDiffieHellmanParameters s rP )r� r8 Z dhParametersN) r� rG r� r� r� r� r r r� rO �pathr� )rW rP ZdhParamsr� r{ r r r �
test_dhParams
s ��z!OpenSSLOptionsTests.test_dhParamsc C s� | � tjddd�tjddd�� | �tjddd�tjdddd�� tjdd�}| �tt|d d
� | � |j|j � d |_| � |j|j � d S )
zh
Check that abbreviations used in certificates correctly map to
complete names.
� as hello)r� �OU)�
commonName�organizationalUnitNames xxx)r� rT � emailAddresss abcdefg)r� ZCnr� s bcdefgaN)
r� rG �DN�DistinguishedName�assertNotEqualr� �AttributeErrorr5 r� rU )rW �dnr r r �#test_abbreviatingDistinguishedNames" s �� � z7OpenSSLOptionsTests.test_abbreviatingDistinguishedNamesc C sZ t jdddddddd�}|�� }d D ]0}| �||d
|f � | �|�� |d
|f � q$d S ) Ns common names organization names organizational unit name�
locality names state or province names country names
email address)rU ZorganizationNamerV � localityNameZstateOrProvinceNameZ countryNamerW )� common name�organization name�organizational unit name�
locality name�state or province name� country name�
email addressz %r was not in inspect output.)rG rX �inspect�assertIn�title�rW �n�sr9 r r r � testInspectDistinguishedName5 s �z0OpenSSLOptionsTests.testInspectDistinguishedNamec C sf t jdd�}|�� }dD ]0}| �||d|f � | �|�� |d|f � q| �d|� | �d|� d S )Nr^ )r_ )r` ra rb rd re rf z%r was in inspect output.rc z
Locality Name)rG rX rg � assertNotInri rh rj r r r �,testInspectDistinguishedNameWithoutAllFieldsJ s z@OpenSSLOptionsTests.testInspectDistinguishedNameWithoutAllFieldsc C sd t j�t�}|�� }|�� }| �|�� �d�dddddddd d
d ddddddd d
d d
d| g� dS )z�
Test that the C{inspect} method of L{sslverify.Certificate} returns
a human-readable string containing some basic information about the
certificate.
�
zCertificate For Subject:z5 Common Name: example.twistedmatrix.comz Country Name: USz4 Email Address: nobody@twistedmatrix.comz" Locality Name: Bostonz/ Organization Name: Twisted Matrix Labsz$ Organizational Unit Name: Securityz) State Or Province Name: Massachusetts� zIssuer:zSerial Number: 12345z7Digest: C4:96:11:00:30:C3:EC:EE:A3:55:AA:ED:8C:84:85:18zPublic Key with Hash: N) rG rH rI �A_HOST_CERTIFICATE_PEM� getPublicKey�keyHashr� rg �split)rW r Zpkrt r r r �test_inspectCertificateZ s8 ��z+OpenSSLOptionsTests.test_inspectCertificatec C sX t j�t�}t j�t�}t j�t�}| �|�� �|�� �� | �|�� �|�� �� dS )z�
L{PublicKey.matches} returns L{True} for keys from certificates with
the same key, and L{False} for keys from certificates with different
keys.
N) rG rH rI rr �A_PEER_CERTIFICATE_PEMr� rs Zmatchesr� )rW ZhostAZhostBZpeerAr r r �test_publicKeyMatching� s
z*OpenSSLOptionsTests.test_publicKeyMatchingc C s t j| j| jtjd| jgdddddddd� }|�� }| �||j� | � |� |�
� }| � d|� t �� }|� |� | �
|j| j� | �
|j| j� | �
|jtj� | �|j� | �
|j| jg� | �
|jd� | �|j� | �|j� | �|j� | �|j� | �|j� | �|j� dS )zN
Test that __setstate__(__getstate__()) round-trips properly.
T� F) r� r8 r� r� r� � verifyDepthr �
verifyOncer �enableSessions�fixBrokenPeers�enableSessionTickets�_contextN) rG r� r� r� r r! r �assertIsr ZassertIsNotNone� __getstate__rn � __setstate__r� r� r8 r� r� r� r� rz r� r r{ r r| r} r~ )rW Z firstOpts�context�stater� r r r �$test_certificateOptionsSerialization� sB �
z8OpenSSLOptionsTests.test_certificateOptionsSerializationz/twisted\.internet\._sslverify\.*__[gs]etstate__)r r c C s. t jdd�}|�� }| �d|�d�d@ � dS )zR
Enabling session tickets should not set the OP_NO_TICKET option.
T�r~ r � @ N�rG r� r r� r� r
r r r �%test_certificateOptionsSessionTickets� s z9OpenSSLOptionsTests.test_certificateOptionsSessionTicketsc C s. t jdd�}|�� }| �d|�d�d@ � dS )zN
Enabling session tickets should set the OP_NO_TICKET option.
Fr� r� r Nr� r
r r r �-test_certificateOptionsSessionTicketsDisabled� s zAOpenSSLOptionsTests.test_certificateOptionsSessionTicketsDisabledc sB t �� }� jtj� j� jdd�tjdd�|d� |�� fdd��S )zw
Check that anonymous connections are allowed when certificates aren't
required on the server.
F)r� r8 r �r �r� c s � � | tj�S r �r� r� r� ��resultrV r r r � r zKOpenSSLOptionsTests.test_allowedAnonymousClientConnection.<locals>.<lambda>�r& r� r� rG r� r� r� � addCallback�rW r� r rV r �%test_allowedAnonymousClientConnection� s ���
�z9OpenSSLOptionsTests.test_allowedAnonymousClientConnectionc sj t �� }t �� }� jtj� j� jd� jgdd�tjdd�||d� t j||gdd�}� fdd�}|�|�S ) zt
Check that anonymous connections are refused when certificates are
required on the server.
T)r� r8 r� r� r Fr� �r� r� r� c sL | \\}}\}}� � |� � � |� � �|jtjtf� � �|jtj� d S r )r� r �valuer �Errorr* �r� ZcSuccessZcResultZsSuccessZsResultrV r r � afterLost� s
zLOpenSSLOptionsTests.test_refusedAnonymousClientConnection.<locals>.afterLost) r& r� r� rG r� r� r� r� r� �rW r� r� r� r� r rV r �%test_refusedAnonymousClientConnection� s& ���
�
z9OpenSSLOptionsTests.test_refusedAnonymousClientConnectionc sl t �� }t �� }� jtj� j� jddd�tjdd� jgd�||d� t j||gdd�}� fdd�}|� |�S ) zg
Check that connecting with a certificate not accepted by the server CA
fails.
F�r� r8 r� r T�r� r r� r� r� c s( | \\}}\}}� � |� � � |� d S r )r� r� rV r r r� s
zIOpenSSLOptionsTests.test_failedCertificateVerification.<locals>.afterLost)
r& r� r� rG r� r� r� r� r� r� r� r rV r �"test_failedCertificateVerification� s& � ��
� z6OpenSSLOptionsTests.test_failedCertificateVerificationc sL t �� }� jtj� j� jddd�tjdd� jgd�|d� |�� fdd��S )zi
Test a successful connection with client certificate validation on
server side.
Fr� Tr� r� c s � � | tj�S r r� r� rV r r r # r zLOpenSSLOptionsTests.test_successfulCertificateVerification.<locals>.<lambda>r� r� r rV r �&test_successfulCertificateVerification s � ��
�z:OpenSSLOptionsTests.test_successfulCertificateVerificationc sZ t �� }� jtj� j� jdd� jgd�tj� j� jdd� jgd�|d� |� � fdd��S )zg
Test a successful connection with validation on both server and client
sides.
T)r� r8 r� r r� r� c s � � | tj�S r r� r� rV r r r 4 r z_OpenSSLOptionsTests.test_successfulSymmetricSelfSignedCertificateVerification.<locals>.<lambda>)
r& r� r� rG r� r� r� r� r� r� r� r rV r �9test_successfulSymmetricSelfSignedCertificateVerification% s$ � ��
�zMOpenSSLOptionsTests.test_successfulSymmetricSelfSignedCertificateVerificationc s
t jdd�}t j�� }|�|�}t jdd�}t j�� }|�|�}|�|�}|�||dd� d�}|�|�} |�|�}
|�||
dd� d�} |�| �} |�||d d� d
�}
|�|
�}|�||d d� d �}|�|�}t�� }|� | �}|� | �}� j
|||d
� |� � fdd��S )zT
Check certificates verification building custom certificates data.
�client)rU Zserverc S s dS �NTr �r\ r r r r D r z7OpenSSLOptionsTests.test_verification.<locals>.<lambda>� c S s dS r� r r� r r r r I r i c S s dS r� r r� r r r r M r � c S s dS r� r r� r r r r Q r �* r� c s � � | tj�S r r� r� rV r r r ^ r ) rG rY �KeyPairZgenerateZcertificateRequestZsignCertificateRequestZnewCertificater& r� r� r� r� )rW ZclientDNZ clientKeyZ
clientCertReqZserverDNZ serverKeyZ
serverCertReqZclientSelfCertReqZclientSelfCertDataZclientSelfCertZserverSelfCertReqZserverSelfCertDataZserverSelfCertZclientCertData�
clientCertZserverCertDatarO r� rq rr r rV r �test_verification6 s\
�
�
�
�
�
�z%OpenSSLOptionsTests.test_verification):rY rZ r[ r� r� r� r� r� r r r r r r r r r
r r r r r r# r( r2 r4 r5 r7 r< r= rC rD rE rF rG rH rK rL rM rR r] rm ro rv rx r� r$ �suppressr% r� r� r� r� r� r� r� r� �
__classcell__r r r� r r� � sn
)'�� r� c @ s( e Zd ZdZereZdd� Zdd� ZdS )�DeprecationTestszo
Tests for deprecation of L{sslverify.OpenSSLCertificateOptions}'s support
of the pickle protocol.
c C s$ | � tdddd�dft�� j� dS )zT
L{sslverify.OpenSSLCertificateOptions.__getstate__} is deprecated.
�Twisted� r �a real persistence systemN)�callDeprecatedr, rG r� r� rV r r r �test_getstateDeprecationj s �z)DeprecationTests.test_getstateDeprecationc C s& | � tdddd�dft�� ji � dS )zT
L{sslverify.OpenSSLCertificateOptions.__setstate__} is deprecated.
r� r� r r� N)r� r, rG r� r� rV r r r �test_setstateDeprecations s
�z)DeprecationTests.test_setstateDeprecationN)rY rZ r[ r� r� r� r� r� r r r r r� b s
r� c @ s8 e Zd ZdZereZdd� Zdd� Zdd� Zdd � Z d
S ) �TrustRootTestsz�
Tests for L{sslverify.OpenSSLCertificateOptions}' C{trustRoot} argument,
L{sslverify.platformTrust}, and their interactions.
c C s | � tdt� dS )zG
Patch L{sslverify._ChooseDiffieHellmanEllipticCurve}.
r� N)r� rG r� rV r r r r� � s �zTrustRootTests.setUpc s@ t jt �� d�}ttj�� � fdd�|_|�� | �� j � dS )z�
Specifying a C{trustRoot} of L{sslverify.OpenSSLDefaultPaths} when
initializing L{sslverify.OpenSSLCertificateOptions} loads the
platform-provided trusted certificates via C{set_default_verify_paths}.
r� c s � S r r )r� �Zfcr r r � r z=TrustRootTests.test_caCertsPlatformDefaults.<locals>.<lambda>N)
rG r� ZOpenSSLDefaultPathsr� r rx r r r� r� r� r r� r � test_caCertsPlatformDefaults� s �
z+TrustRootTests.test_caCertsPlatformDefaultsc C s� t � \}}t| ||�}t| |j�}tt� ||d�\}}}}} | �|jd� | �|jjt j
� |jj }
| �|
j d d d d� dS )a-
Specifying a C{trustRoot} of L{platformTrust} when initializing
L{sslverify.OpenSSLCertificateOptions} causes certificates issued by a
newly created CA to be rejected by an SSL connection using these
options.
Note that this test should I{always} pass, even on platforms where the
CA certificates are not installed, as long as L{platformTrust} rejects
completely invalid / unknown root CA certificates. This is simply a
smoke test to make sure that verification is happening at all.
�r� r~ r} r r ry �tlsv1 alert unknown caN)
rP r� r� r� r- r� r^ rb �typer r� r� r/ ) rW rN rO Z chainedCertr� rs rt �sWrapped�cWrappedru �errr r r �(test_trustRootPlatformRejectsUntrustedCA� s
�z7TrustRootTests.test_trustRootPlatformRejectsUntrustedCAc
C sb t � \}}t � \}}t|t| |j�t| |�d�\}}}}} | �� | �|j� | �|j|j � dS )z�
Specifying a L{Certificate} object for L{trustRoot} will result in that
certificate being the only trust root for a client.
r� N)
rP r� r� r� �flush� assertIsNonerb r� r^ rU )
rW �caCertrO ZotherCa� otherServerrs rt r� r� ru r r r �!test_trustRootSpecificCertificate� s
� �z0TrustRootTests.test_trustRootSpecificCertificateN)
rY rZ r[ r� r� r� r� r� r� r� r r r r r� } s r� c @ s� e Zd ZdZereZdd� dddddddfdd�Zdd � Zd
d � Zd d
� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zedk r�ee_dd� Zedk r�ee_dd � Zd d � ZdS ) �ServiceIdentityTestsz�
Tests for the verification of the peer's service's identity via the
C{hostname} argument to L{sslverify.OpenSSLCertificateOptions}.
c C s d S r r �r{ r r r r � r z ServiceIdentityTests.<lambda>TFc s� t |�\�} i } d}
t d�\}}|r0| j|d� |rN|r>|}
nt d�\}}|}
tjf | jj| jd�| ��}||�� � |s�t |�\�}|r�dd� }| �tjd|� d|i}|
r�|j|
d � |
s�|j�d� | r�| �td
�fd d �� tj f |�}G d
d� dt
j �}G dd� dt
j �}|� �|� �t
� � }�fdd �|_
t
� � }�fdd �|_
|| _
|| _t|d|d�� t|d|d��t�fdd �� fdd ��\}} } || ��| fS )a�
Connect a server and a client.
@param clientHostname: The I{client's idea} of the server's hostname;
passed as the C{hostname} to the
L{sslverify.OpenSSLCertificateOptions} instance.
@type clientHostname: L{unicode}
@param serverHostname: The I{server's own idea} of the server's
hostname; present in the certificate presented by the server.
@type serverHostname: L{unicode}
@param serverContextSetup: a 1-argument callable invoked with the
L{OpenSSL.SSL.Context} after it's produced.
@type serverContextSetup: L{callable} taking L{OpenSSL.SSL.Context}
returning L{None}.
@param validCertificate: Is the server's certificate valid? L{True} if
so, L{False} otherwise.
@type validCertificate: L{bool}
@param clientPresentsCertificate: Should the client present a
certificate to the server? Defaults to 'no'.
@type clientPresentsCertificate: L{bool}
@param validClientCertificate: If the client presents a certificate,
should it actually be a valid one, i.e. signed by the same CA that
the server is checking? Defaults to 'yes'.
@type validClientCertificate: L{bool}
@param serverVerifies: Should the server verify the client's
certificate? Defaults to 'no'.
@type serverVerifies: L{bool}
@param buggyInfoCallback: Should we patch the implementation so that
the C{info_callback} passed to OpenSSL to have a bug and raise an
exception (L{ZeroDivisionError})? Defaults to 'no'.
@type buggyInfoCallback: L{bool}
@param fakePlatformTrust: Should we fake the platformTrust to be the
same as our fake server certificate authority, so that we can test
it's being used? Defaults to 'no' and we just pass platform trust.
@type fakePlatformTrust: L{bool}
@param useDefaultTrust: Should we avoid passing the C{trustRoot} to
L{ssl.optionsForClientTLS}? Defaults to 'no'.
@type useDefaultTrust: L{bool}
@return: the client TLS protocol, the client wrapped protocol,
the server TLS protocol, the server wrapped protocol and
an L{IOPump} which, when its C{pump} and C{flush} methods are
called, will move data between the created client and server
protocol instances
@rtype: 5-L{tuple} of 4 L{IProtocol}s and L{IOPump}
Nr� r� r� c _ s dd dS )z�
Raise an exception.
@param a: Arguments for an C{info_callback}
@param k: Keyword arguments for an C{info_callback}
r= r Nr )�ar9 r r r �broken4 s z9ServiceIdentityTests.serviceIdentitySetup.<locals>.brokenZ _identityVerifyingInfoCallbackr� )ZclientCertificater- c s � S r r r )�serverCAr r r H r z;ServiceIdentityTests.serviceIdentitySetup.<locals>.<lambda>c @ s0 e Zd ZdZdZdZdd� Zdd� Zdd � ZdS )
zAServiceIdentityTests.serviceIdentitySetup.<locals>.GreetingServerrQ Nr c S s | j �| j� d S r rR rV r r r rX P s zPServiceIdentityTests.serviceIdentitySetup.<locals>.GreetingServer.connectionMadec S s | j |7 _ d S r r] r_ r r r r` R s zNServiceIdentityTests.serviceIdentitySetup.<locals>.GreetingServer.dataReceivedc S s
|| _ d S r ra rc r r r re T s zPServiceIdentityTests.serviceIdentitySetup.<locals>.GreetingServer.connectionLost) rY rZ r[ rU rb r^ rX r` re r r r r r\ L s r\ c @ s0 e Zd ZdZdZdZdd� Zdd� Zdd � ZdS )
zAServiceIdentityTests.serviceIdentitySetup.<locals>.GreetingClients cheerio!r Nc S s | j �| j� d S r rR rV r r r rX [ s zPServiceIdentityTests.serviceIdentitySetup.<locals>.GreetingClient.connectionMadec S s | j |7 _ d S r r] r_ r r r r` ] s zNServiceIdentityTests.serviceIdentitySetup.<locals>.GreetingClient.dataReceivedc S s
|| _ d S r ra rc r r r re _ s zPServiceIdentityTests.serviceIdentitySetup.<locals>.GreetingClient.connectionLost) rY rZ r[ rU r^ rb rX r` re r r r r �GreetingClientW s r� c s � S r r r rg r r r f r c s � S r r r ri r r r h r Trk Fc s
� � d �S r rl r )�serverTLSFactoryr r r w r c s
� � d �S r rl r )�clientTLSFactoryr r r x r )rP �updaterG r� r� �originalr r� ZClientTLSOptionsr� r% ro rp rq rr r0 r ) rW ZclientHostnameZserverHostnameZserverContextSetup�validCertificate�clientPresentsCertificate�validClientCertificate�serverVerifies�buggyInfoCallback�fakePlatformTrust�useDefaultTrustrO �otherZpassClientCertZclientCAr� ZbogusCA�bogusrq r� r� Z signaturerr r\ r� rn rm rt rs ru r )r� rh r� r� rj r �serviceIdentitySetup� s� @� �� � � � �
�
z)ServiceIdentityTests.serviceIdentitySetupc C s^ | � dd�\}}}}}| �|jd� | �|jd� |jj}|jj}| �|t� | �|t� dS )z�
When a certificate containing an invalid hostname is received from the
server, the connection is immediately dropped.
zwrong-host.example.com�correct-host.example.comr N)r� r� r^ rb r� r r. r �rW rt rs r� r� ru �cErr�sErrr r r �test_invalidHostname} s � z)ServiceIdentityTests.test_invalidHostnamec C sH | � dd�\}}}}}| �|jd� |j}|j}| �|� | �|� dS )z}
Whenever a valid certificate containing a valid hostname is received,
connection proceeds normally.
�valid.example.comrQ N�r� r� r^ rb r� r� r r r �test_validHostname� s ��
z'ServiceIdentityTests.test_validHostnamec C sf | j dddd�\}}}}}| �|jd� | �|jd� |jj}|jj}| �|tj� | �|tj� dS )z�
When an invalid certificate containing a perfectly valid hostname is
received, the connection is aborted with an OpenSSL error.
r� F)r� r N�r� r� r^ rb r� r r r� r� r r r �$test_validHostnameInvalidCertificate� s �z9ServiceIdentityTests.test_validHostnameInvalidCertificatec C sh | j ddddd�\}}}}}| �|jd� | �|jd� |jj}|jj}| �|tj� | �|tj� dS )zu
If we use the default trust from the platform, our dinky certificate
should I{really} fail.
r� FT)r� r� r Nr� r� r r r �*test_realCAsBetterNotSignOurBogusTestCerts� s �z?ServiceIdentityTests.test_realCAsBetterNotSignOurBogusTestCertsc C sN | j ddddd�\}}}}}| �|jd� |j}|j}| �|� | �|� dS )z�
L{ssl.optionsForClientTLS} should be using L{ssl.platformTrust} by
default, so if we fake that out then it should trust ourselves again.
r� T)r� r� rQ Nr� r� r r r � test_butIfTheyDidItWouldWork� s ��
z1ServiceIdentityTests.test_butIfTheyDidItWouldWorkc C sP | j dddddd�\}}}}}| �|jd� |j}|j}| �|� | �|� dS )z�
When the server verifies and the client presents a valid certificate
for that verification by passing it to
L{sslverify.optionsForClientTLS}, communication proceeds.
r� T)r� r� r� rQ Nr� r� r r r � test_clientPresentsCertificate� s ��
z3ServiceIdentityTests.test_clientPresentsCertificatec C s^ | j ddddddd�\}}}}}| �|jd� |jj}|jj}| �|tj� | �|tj� dS )z�
When the server verifies and the client presents an invalid certificate
for that verification by passing it to
L{sslverify.optionsForClientTLS}, the connection cannot be established
with an SSL error.
r� TF)r� r� r� r� r Nr� r� r r r �!test_clientPresentsBadCertificate� s � �z6ServiceIdentityTests.test_clientPresentsBadCertificatec s: g � � fdd�}| � dd|�\}}}}}| �� dg� dS )z�
Specifying the C{hostname} argument to L{CertificateOptions} also sets
the U{Server Name Extension
<https://en.wikipedia.org/wiki/Server_Name_Indication>} TLS indication
field to the correct value.
c s � fdd�}| � |� d S )Nc s � � | �� �d�� d S )Nr )r� �get_servername�decode)�conn��namesr r �servername_received s zfServiceIdentityTests.test_hostnameIsIndicated.<locals>.setupServerContext.<locals>.servername_received�Z set_tlsext_servername_callback�r{ r� r� r r �setupServerContext s zIServiceIdentityTests.test_hostnameIsIndicated.<locals>.setupServerContextr� N)r� r� )rW r� rt rs r� r� ru r r� r �test_hostnameIsIndicated s �z-ServiceIdentityTests.test_hostnameIsIndicatedNc
sl g � d}� fdd�}| � |||�\}}}}}| �� |g� | �|jd� |j}|j} | �|� | �| � dS )z0
Hostnames are encoded as IDNA.
u hállo.example.comc s � fdd�}| � |� d S )Nc s t | �� �}� �|� d S r )r( r� r� )r� Z
serverIDNAr� r r r� 0 s zcServiceIdentityTests.test_hostnameEncoding.<locals>.setupServerContext.<locals>.servername_receivedr� r� r� r r r� / s zFServiceIdentityTests.test_hostnameEncoding.<locals>.setupServerContextrQ Nr� )
rW Zhellor� rt rs r� r� ru r� r� r r� r �test_hostnameEncoding) s ��
z*ServiceIdentityTests.test_hostnameEncodingc sJ d� G � fdd�dt �}|� }| �t�|d�d� | �tjtj|d� dS )z�
L{sslverify.simpleVerifyHostname} checks string equality on the
commonName of a connection's certificate's subject, doing nothing if it
matches and raising L{VerificationError} if it doesn't.
zsomething.example.comc s e Zd Z� fdd�ZdS )z6ServiceIdentityTests.test_fallback.<locals>.Connectionc s t � }� |�� _|S )z�
Fake of L{OpenSSL.SSL.Connection.get_peer_certificate}.
@return: A certificate with a known common name.
@rtype: L{OpenSSL.crypto.X509}
)r r3 rU r� ��namer r �get_peer_certificateL s
zKServiceIdentityTests.test_fallback.<locals>.Connection.get_peer_certificateN)rY rZ r[ r� r r� r r �
ConnectionK s r� NZnonsense)r� r� rG �simpleVerifyHostnamer� �SimpleVerificationError)rW r� r� r r� r �
test_fallbackD s
� �z"ServiceIdentityTests.test_fallbackc C s| | j dddd�\}}}}}| �|jd� | �|jd� |jj}|jj}| �|t� | �|ttj f� | �
t�}| � |� dS )a,
pyOpenSSL isn't always so great about reporting errors. If one occurs
in the verification info callback, it should be logged and the
connection should be shut down (if possible, anyway; the app_data could
be clobbered but there's no point testing for that).
r� T)r� r N) r� r� r^ rb r� r �ZeroDivisionErrorr r r� ZflushLoggedErrorsr� ) rW rt rs r� r� ru r� r� �errorsr r r � test_surpriseFromInfoCallback` s �
z2ServiceIdentityTests.test_surpriseFromInfoCallback)rY rZ r[ r� r� r� r� r� r� r� r� r� r� r� r� �skipSNIr� r� r� r r r r r� � s8 �
% r� c C sP t � \}}t�|jg�}t||jj|j|| |d�\}}}} }
|
�� |j| jfS )a�
Create the TLS connection and negotiate a next protocol.
@param serverProtocols: The protocols the server is willing to negotiate.
@param clientProtocols: The protocols the client is willing to negotiate.
@param clientOptions: The type of C{OpenSSLCertificateOptions} class to
use for the client. Defaults to C{OpenSSLCertificateOptions}.
@return: A L{tuple} of the negotiated protocol and the reason the
connection was lost.
)r� r� rM r� r� r� ) rP rG Z OpenSSLCertificateAuthoritiesr� r� r� r� �negotiatedProtocolrb ) r� r� r� rL rM r� rs rt r� r� ru r r r �negotiateProtocolz s
��r� c @ sJ e Zd ZdZereZner eZdd� Zdd� Zdd� Z dd � Z
d
d � Z d S )
�NPNOrALPNTestsz�
NPN and ALPN protocol selection.
These tests only run on platforms that have a PyOpenSSL version >= 0.15,
and OpenSSL version 1.0.1 or later.
c C s t �� }| �t jj|k� dS )z
When at least NPN is available on the platform, NPN is in the set of
supported negotiation protocols.
N)rG � protocolNegotiationMechanismsr� �ProtocolNegotiationSupportZNPN�rW ZsupportedProtocolsr r r �)test_nextProtocolMechanismsNPNIsSupported� s
�z8NPNOrALPNTests.test_nextProtocolMechanismsNPNIsSupportedc C s2 ddg}t ||d�\}}| �|d� | �|� dS )z�
When both ALPN and NPN are used, and both the client and server have
overlapping protocol choices, a protocol is successfully negotiated.
Further, the negotiated protocol is the first one in the list.
� h2� http/1.1�r� r� N�r� r� r� �rW � protocolsr� rb r r r �test_NPNAndALPNSuccess� s �
z%NPNOrALPNTests.test_NPNAndALPNSuccessc C s< dddg}ddg}t ||d�\}}| �|d� | �|� dS )zm
Client and server have different protocol lists: only the common
element is chosen.
r r s spdy/2� spdy/3r Nr �rW r� r� r� rb r r r �test_NPNAndALPNDifferent� s
�
z'NPNOrALPNTests.test_NPNAndALPNDifferentc C s0 ddg}t |g d�\}}| �|� | �|� dS )zy
When one peer does not advertise any protocols, the connection is set
up with no next protocol.
r r r N�r� r� r r r r �test_NPNAndALPNNoAdvertise� s �
z)NPNOrALPNTests.test_NPNAndALPNNoAdvertisec C s< ddg}dg}t ||d�\}}| �|� | �|jtj� dS )zh
When the client and server have no overlap of protocols, the connection
fails.
r r r �r� r� N)r� r� r� r� r r� )rW r� r� r� rb r r r �test_NPNAndALPNNoOverlap� s �
z'NPNOrALPNTests.test_NPNAndALPNNoOverlapN) rY rZ r[ r� r� r� �skipNPNr� r r r r
r r r r r� � s r� c @ s* e Zd ZdZereZner eZdd� ZdS )� ALPNTestsa.
ALPN protocol selection.
These tests only run on platforms that have a PyOpenSSL version >= 0.15,
and OpenSSL version 1.0.2 or later.
This covers only the ALPN specific logic, as any platform that has ALPN
will also have NPN and so will run the NPNAndALPNTest suite as well.
c C s t �� }| �t jj|k� dS )z�
When ALPN is available on a platform, protocolNegotiationMechanisms
includes ALPN in the suported protocols.
N)rG r� r� r� ZALPNr� r r r �*test_nextProtocolMechanismsALPNIsSupported� s ��z4ALPNTests.test_nextProtocolMechanismsALPNIsSupportedN)rY rZ r[ r� r� r� �skipALPNr r r r r r � s r c @ s: e Zd ZdZereZnes dZdd� Zdd� Zdd� Z d S )
�NPNAndALPNAbsentTestsz�
NPN/ALPN operations fail on platforms that do not support them.
These tests only run on platforms that have a PyOpenSSL version < 0.15,
or an OpenSSL version earlier than 1.0.1
z$NPN/ALPN is present on this platformc C s t �� }| �|� dS )z}
When neither NPN or ALPN are available on a platform, there are no
supported negotiation protocols.
N)rG r� r� r� r r r �1test_nextProtocolMechanismsNoNegotiationSupported s zGNPNAndALPNAbsentTests.test_nextProtocolMechanismsNoNegotiationSupportedc C s ddg}| j tt||d� dS )z�
A NotImplementedError is raised when using acceptableProtocols on a
platform that does not support either NPN or ALPN.
r r r N)r� �NotImplementedErrorr� )rW r r r r � test_NPNAndALPNNotImplemented s �z3NPNAndALPNAbsentTests.test_NPNAndALPNNotImplementedc C s0 d}d}t ||d�\}}| �|� | �|� dS )z�
negotiatedProtocol return L{None} even when NPN/ALPN aren't supported.
This works because, as neither are supported, negotiation isn't even
attempted.
Nr r
r r r r �"test_NegotiatedProtocolReturnsNone. s �
z8NPNAndALPNAbsentTests.test_NegotiatedProtocolReturnsNoneN)
rY rZ r[ r� r� r� r r r r r r r r r
s r c @ s e Zd Zdd� ZdS )�_NotSSLTransportc C s | S r r rV r r r � getHandle@ s z_NotSSLTransport.getHandleN)rY rZ r[ r r r r r r ? s r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�_MaybeSSLTransportc C s | S r r rV r r r r F s z _MaybeSSLTransport.getHandlec C s d S r r rV r r r r� I s z'_MaybeSSLTransport.get_peer_certificatec C s d S r r rV r r r �get_host_certificateL s z'_MaybeSSLTransport.get_host_certificateN)rY rZ r[ r r� r r r r r r E s r c @ s$ e Zd Zdd� Zdd� Zdd� ZdS )�_ActualSSLTransportc C s | S r r rV r r r r R s z _ActualSSLTransport.getHandlec C s t j�t�jS r )rG rH rI rr r� rV r r r r U s z(_ActualSSLTransport.get_host_certificatec C s t j�t�jS r )rG rH rI rw r� rV r r r r� X s z(_ActualSSLTransport.get_peer_certificateN)rY rZ r[ r r r� r r r r r Q s r c @ sD e Zd ZereZdd� Zdd� Zdd� Zdd� Zd d
� Z d d � Z
d
S )�ConstructorsTestsc C s, | � ttjjt� �}| �t|��d�� dS )z�
Verify that peerFromTransport raises an exception if the transport
passed is not actually an SSL transport.
�non-TLSN) r� r) rG rH �peerFromTransportr r� r� �
startswith�rW �xr r r � test_peerFromNonSSLTransporta s
�z.ConstructorsTests.test_peerFromNonSSLTransportc C s, | � ttjjt� �}| �t|��d�� dS )z�
Verify that peerFromTransport raises an exception if the transport
passed is an SSL transport, but doesn't have a peer certificate.
�TLSN) r� r) rG rH r r r� r� r r r r r � test_peerFromBlankSSLTransportl s
�z0ConstructorsTests.test_peerFromBlankSSLTransportc C s, | � ttjjt� �}| �t|��d�� dS )z�
Verify that hostFromTransport raises an exception if the transport
passed is not actually an SSL transport.
r N) r� r) rG rH �hostFromTransportr r� r� r r r r r � test_hostFromNonSSLTransportw s
�z.ConstructorsTests.test_hostFromNonSSLTransportc C s, | � ttjjt� �}| �t|��d�� dS )z�
Verify that hostFromTransport raises an exception if the transport
passed is an SSL transport, but doesn't have a host certificate.
r# N) r� r) rG rH r% r r� r� r r r r r � test_hostFromBlankSSLTransport� s
�z0ConstructorsTests.test_hostFromBlankSSLTransportc C s | � tj�t� ��� d� dS )z�
Verify that hostFromTransport successfully creates the correct
certificate if passed a valid SSL transport.
i90 N)r� rG rH r% r � serialNumberrV r r r �test_hostFromSSLTransport� s ��z+ConstructorsTests.test_hostFromSSLTransportc C s | � tj�t� ��� d� dS )z�
Verify that peerFromTransport successfully creates the correct
certificate if passed a valid SSL transport.
i:0 N)r� rG rH r r r( rV r r r �test_peerFromSSLTransport� s ��z+ConstructorsTests.test_peerFromSSLTransportN) rY rZ r[ r� r� r" r$ r& r' r) r* r r r r r ] s r c @ s@ e Zd ZdZereZdd� Zdd� Zdd� Zdd � Z d
d � Z
d S )
�!MultipleCertificateTrustRootTestszH
Test the behavior of the trustRootFromCertificates() API call.
c C sb t j�t�}t j�t�}t �||g�}t||jj |j d�\}}}}}| �
|j d� | � |j
� dS )z�
L{trustRootFromCertificates} accepts either a L{sslverify.Certificate}
or a L{sslverify.PrivateCertificate} instance.
�r� r� rM rQ N)rG rJ rI � A_KEYPAIRrH rr �trustRootFromCertificatesr� r� r� r� r^ r� rb ) rW Z privateCertr� Zmtrs rt �sWrap�cWrapru r r r �+test_trustRootFromCertificatesPrivatePublic� s �zMMultipleCertificateTrustRootTests.test_trustRootFromCertificatesPrivatePublicc
C sr t ddd�\}}tj�t�|�t�|��}t�|g�}t||jj |j d�\}}}}} | �
|j d� | � |j
� dS )z�
L{trustRootFromCertificates} called with a single self-signed
certificate will cause L{optionsForClientTLS} to accept client
connections to a server with that certificate.
r� r� r� r, rQ N)r; rG rJ �fromCertificateAndKeyPairrH r� r. r� r� r� r� r^ r� rb )
rW �keyr� Z
selfSigned�trustrs rt r/ r0 ru r r r �)test_trustRootSelfSignedServerCertificate� s � �zKMultipleCertificateTrustRootTests.test_trustRootSelfSignedServerCertificatec C sR t � \}}t�|g�}t||jj|jd�\}}}}}| �|jd� | �|j � dS )z�
L{trustRootFromCertificates} called with certificate A will cause
L{optionsForClientTLS} to accept client connections to a server with
certificate B where B is signed by A.
r, rQ N)
rP rG r. r� r� r� r� r^ r� rb ) rW r� rO r4 rs rt r/ r0 ru r r r �2test_trustRootCertificateAuthorityTrustsConnection� s
�zTMultipleCertificateTrustRootTests.test_trustRootCertificateAuthorityTrustsConnectionc C s� t ddd�\}}tj�t�|�t�|��}t�t ddd�d �}t�|g�}t||jj |j d�\}}}} }
| �
| j d� | �
| j j
tj� | j j} | �
| jd d d
d � d S )
z�
L{trustRootFromCertificates} called with certificate A will cause
L{optionsForClientTLS} to disallow any connections to a server with
certificate B where B is not signed by A.
r� r� r� r� s
unknown CAr= r, r r ry r� N)r; rG rJ r2 rH r� r. r� r� r� r� r^ rb r� r r� r� r/ ) rW r3 r� rO Z
untrustedCertr4 rs rt r/ r0 ru r� r r r �'test_trustRootFromCertificatesUntrusted� s$ �� �zIMultipleCertificateTrustRootTests.test_trustRootFromCertificatesUntrustedc C s: t j�t�}|j}| �tt j|g�}| �d|j d � dS )z}
L{trustRootFromCertificates} rejects any L{OpenSSL.crypto.X509}
instances in the list passed to it.
zBcertificates items must be twisted.internet.ssl.CertBase instancesr N)
rG rJ rI r- r� r� r� r. r� r/ )rW ZprivateZcertX509r. r r r �,test_trustRootFromCertificatesOpenSSLObjects
s ��zNMultipleCertificateTrustRootTests.test_trustRootFromCertificatesOpenSSLObjectsN) rY rZ r[ r� r� r� r1 r5 r6 r7 r8 r r r r r+ � s $r+ c @ s< e Zd ZdZereZdZdd� Zdd� Zdd� Z d d
� Z
d S ) �OpenSSLCipherTestsz>
Tests for twisted.internet._sslverify.OpenSSLCipher.
z
CIPHER-STRINGc C s | � | jt�| j�j� dS )zU
The first argument passed to the constructor becomes the full name.
N)r� �
cipherNamerG r �fullNamerV r r r � test_constructorSetsFullName3
s �z/OpenSSLCipherTests.test_constructorSetsFullNamec C s, t �| j�}| �|tt|�dt ji�� dS )zC
C{repr(cipher)} returns a valid constructor call.
r N)rG r r: r� �eval�repr)rW Zcipherr r r � test_repr=
s
�z OpenSSLCipherTests.test_reprc C s( t �| j�}t �| j�}| �||� dS )zN
Equal type and C{fullName} means that the objects are equal.
N)rG r r: r� )rW Zcipher1Zcipher2r r r �test_eqSameClassH
s z#OpenSSLCipherTests.test_eqSameClassc s. G � fdd�dt �}� �t�� j�|� � dS )ze
If ciphers have the same name but different types, they're still
different.
c s e Zd Z� jZdS )zHOpenSSLCipherTests.test_eqSameNameDifferentType.<locals>.DifferentCipherN)rY rZ r[ r: r; r rV r r �DifferentCipherV
s rA N)r� rZ rG r r: )rW rA r rV r � test_eqSameNameDifferentTypeQ
s
�z/OpenSSLCipherTests.test_eqSameNameDifferentTypeN) rY rZ r[ r� r� r� r: r< r? r@ rB r r r r r9 *
s
r9 c @ s0 e Zd ZdZereZdd� Zdd� Zdd� ZdS ) �ExpandCipherStringTestszD
Tests for twisted.internet._sslverify._expandCipherString.
c C s | � g t�dtjd�� dS )zU
If the expanded cipher list is empty, an empty L{list} is returned.
rq r N)r� rG �_expandCipherStringr r! rV r r r �!_test_doesNotStumbleOverEmptyListg
s �z9ExpandCipherStringTests._test_doesNotStumbleOverEmptyListc sL dd� }t tj�� |� _| �tjd� fdd�� | �tjtjdtjd� dS ) zf
Only no cipher matches get swallowed, every other SSL error gets
propagated.
c S s t �dddgg��d S )Nrq )r r� �r r r r �raiserv
s zIExpandCipherStringTests.test_doesNotSwallowOtherSSLErrors.<locals>.raiserrw c s � S r r rF r� r r r |
r zKExpandCipherStringTests.test_doesNotSwallowOtherSSLErrors.<locals>.<lambda>�ALLr N) r� r r! r� r� rG r� r� rD )rW rG r r� r �!test_doesNotSwallowOtherSSLErrorsq
s
�z9ExpandCipherStringTests.test_doesNotSwallowOtherSSLErrorsc C sP t �dtjd�}| �|t� g }|D ]}tj�|�s$|� |� q$| �
g |� dS )zm
L{sslverify._expandCipherString} always returns a L{list} of
L{interfaces.ICipher}.
rH r N) rG rD r r! r �listr+ �ICipher�
providedByr� r� )rW Zciphersr� r r r r �test_returnsListOfICiphers�
s z2ExpandCipherStringTests.test_returnsListOfICiphersN) rY rZ r[ r� r� r� rE rI rM r r r r rC `
s
rC c @ s0 e Zd ZdZereZdd� Zdd� Zdd� ZdS ) �AcceptableCiphersTestszI
Tests for twisted.internet._sslverify.OpenSSLAcceptableCiphers.
c C s t �g �}| �g |�g �� dS )zG
If no ciphers are available, nothing can be selected.
N)rG �OpenSSLAcceptableCiphersr� r �rW Zacr r r �&test_selectOnEmptyListReturnsEmptyList�
s
z=AcceptableCiphersTests.test_selectOnEmptyListReturnsEmptyListc C sH t �t �d�t �d�g�}| �t �d�g|�t �d�t �d�g�� dS )zi
Select only returns a cross section of what is available and what is
desirable.
�A�B�CN)rG rO r r� r rP r r r �#test_selectReturnsOnlyFromAvailable�
s � ��z:AcceptableCiphersTests.test_selectReturnsOnlyFromAvailablec C s8 t j�d�}| �|jt� | �tdd� |jD ��� dS )z�
If L{sslverify.OpenSSLAcceptableCiphers.fromOpenSSLCipherString} is
called it expands the string to a list of ciphers.
rH c s s | ]}t j�|�V qd S r )rG rK rL )�.0r r r r � <genexpr>�
s �z\AcceptableCiphersTests.test_fromOpenSSLCipherStringExpandsToListOfCiphers.<locals>.<genexpr>N)rG rO ZfromOpenSSLCipherStringr Z_ciphersrJ r� �allrP r r r �2test_fromOpenSSLCipherStringExpandsToListOfCiphers�
s
�zIAcceptableCiphersTests.test_fromOpenSSLCipherStringExpandsToListOfCiphersN) rY rZ r[ r� r� r� rQ rU rY r r r r rN �
s rN c @ s( e Zd ZdZereZed�Zdd� ZdS )� DiffieHellmanParametersTestszD
Tests for twisted.internet._sslverify.OpenSSLDHParameters.
rN c C s" t j�| j�}| �| j|j� dS )zl
Calling C{fromFile} with a filename returns an instance with that file
name saved.
N)rG Z OpenSSLDiffieHellmanParametersZfromFile�filePathr� rO )rW Zparamsr r r �
test_fromFile�
s �z*DiffieHellmanParametersTests.test_fromFileN) rY rZ r[ r� r� r� r! r[ r\ r r r r rZ �
s
rZ c @ s e Zd ZdZdZdd� ZdS )� FakeLibStatea�
State for L{FakeLib}
@param setECDHAutoRaises: An exception
L{FakeLib.SSL_CTX_set_ecdh_auto} should raise; if L{None},
nothing is raised.
@ivar ecdhContexts: A list of SSL contexts with which
L{FakeLib.SSL_CTX_set_ecdh_auto} was called
@type ecdhContexts: L{list} of L{OpenSSL.SSL.Context}s
@ivar ecdhValues: A list of boolean values with which
L{FakeLib.SSL_CTX_set_ecdh_auto} was called
@type ecdhValues: L{list} of L{boolean}s
��setECDHAutoRaises� ecdhContexts�
ecdhValuesc C s || _ g | _g | _d S r r^ )rW r_ r r r r� �
s zFakeLibState.__init__N�rY rZ r[ r� � __slots__r� r r r r r] �
s r] c @ s e Zd ZdZdd� Zdd� ZdS )�FakeLibz�
An introspectable fake of cryptography's lib object.
@param state: A L{FakeLibState} instance that contains this fake's
state.
c C s
|| _ d S r ��_state�rW r� r r r r� �
s zFakeLib.__init__c C s4 | j j�|� | j j�|� | j jdk r0| j j�dS )a
Record the context and value under in the C{_state} instance
variable.
@see: L{FakeLibState}
@param ctx: An SSL context.
@type ctx: L{OpenSSL.SSL.Context}
@param value: A boolean value
@type value: L{bool}
N)rf r` r� ra r_ )rW r{ r� r r r �SSL_CTX_set_ecdh_auto�
s
z FakeLib.SSL_CTX_set_ecdh_autoN)rY rZ r[ r� r� rh r r r r rd �
s rd c @ s e Zd ZdZdd� Zdd� ZdS )� FakeLibTestsz
Tests for L{FakeLib}.
c C sb t dd�}t|�}| �|j� | �|j� d\}}|�||� | �|j|g� | �|jdg� dS )zh
L{FakeLib.SSL_CTX_set_ecdh_auto} records context and value it
was called with.
N�r_ �ZCONTEXTTT)r] rd � assertNotr` ra rh r� �rW r� �libr� r� r r r �test_SSL_CTX_set_ecdh_auto
s
z'FakeLibTests.test_SSL_CTX_set_ecdh_autoc C sh t td�}t|�}| �|j� | �|j� d\}}| �t|j||� | �|j|g� | �|jdg� dS )z�
L{FakeLib.SSL_CTX_set_ecdh_auto} raises the exception provided
by its state, while still recording its arguments.
rj rk TN) r] rF rd rl r` ra r� rh r� rm r r r � test_SSL_CTX_set_ecdh_autoRaises s
�z-FakeLibTests.test_SSL_CTX_set_ecdh_autoRaisesN)rY rZ r[ r� ro rp r r r r ri s ri c @ s e Zd ZdZdZdd� ZdS )�FakeCryptoStatea�
State for L{FakeCrypto}
@param getEllipticCurveRaises: What
L{FakeCrypto.get_elliptic_curve} should raise; L{None} and it
won't raise anything
@param getEllipticCurveReturns: What
L{FakeCrypto.get_elliptic_curve} should return.
@ivar getEllipticCurveCalls: The arguments with which
L{FakeCrypto.get_elliptic_curve} has been called.
@type getEllipticCurveCalls: L{list}
��getEllipticCurveRaises�getEllipticCurveReturns�getEllipticCurveCallsc C s || _ || _g | _d S r rr )rW rs rt r r r r� E s zFakeCryptoState.__init__Nrb r r r r rq 0 s rq c @ s e Zd ZdZdd� Zdd� ZdS )�
FakeCryptozy
An introspectable fake of pyOpenSSL's L{OpenSSL.crypto} module.
@ivar state: A L{FakeCryptoState} instance
c C s
|| _ d S r re rg r r r r� W s zFakeCrypto.__init__c C s* | j j�|� | j jdk r"| j j�| j jS )a
A fake that records the curve with which it was called.
@param curve: see L{crypto.get_elliptic_curve}
@return: see L{FakeCryptoState.getEllipticCurveReturns}
@raises: see L{FakeCryptoState.getEllipticCurveRaises}
N)rf ru r� rs rt r� r r r �get_elliptic_curve[ s z FakeCrypto.get_elliptic_curveN)rY rZ r[ r� r� rw r r r r rv P s rv c @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) �FakeCryptoTestsz"
Tests for L{FakeCrypto}.
c C s2 t ddd�}t|�}|�d� | �|jdg� dS )zk
L{FakeCrypto.test_get_elliptic_curve} records the curve with
which it was called.
N�rs rt z a curve name)rq rv rw r� ru �rW r� �cryptor r r �&test_get_elliptic_curveRecordsArgumentp s �
z6FakeCryptoTests.test_get_elliptic_curveRecordsArgumentc C s> d}t d|d�}t|�}| �|�d�|� | �|jdg� dS )z�
L{FakeCrypto.test_get_elliptic_curve} returns the value
specified by its state object and records what it was called
with.
r� Nry zanother curve name)rq rv r� rw r� ru )rW Z returnValuer� r{ r r r � test_get_elliptic_curveReturns~ s ���z.FakeCryptoTests.test_get_elliptic_curveReturnsc C s8 t tdd�}t|�}| �t|jd� | �|jdg� dS )zs
L{FakeCrypto.test_get_elliptic_curve} raises the exception
specified by its state object.
Nry zyet another curve name)rq rF rv r� rw r� ru rz r r r � test_get_elliptic_curveRaises� s � ��z-FakeCryptoTests.test_get_elliptic_curveRaisesN)rY rZ r[ r� r| r} r~ r r r r rx k s rx c @ s\ e Zd ZdZereZdZdZdZdd� Z dd� Z
d d
� Z d d � Z d
d� Z
dd� Zdd� ZdS )�%ChooseDiffieHellmanEllipticCurveTestsaN
Tests for L{sslverify._ChooseDiffieHellmanEllipticCurve}.
@cvar OPENSSL_110: A version number for OpenSSL 1.1.0
@cvar OPENSSL_102: A version number for OpenSSL 1.0.2
@cvar OPENSSL_101: A version number for OpenSSL 1.0.1
@see:
U{https://wiki.openssl.org/index.php/Manual:OPENSSL_VERSION_NUMBER(3)}
i i� iO c C sB t dd�| _t| j�| _td d d�| _t| j�| _tt j
�| _ d S )NFrj )rt rs ) r] �libStaterd rn rq � cryptoStaterv r{ r� r r! r� rV r r r r� � s � z+ChooseDiffieHellmanEllipticCurveTests.setUpc C s^ t j| j| j| jd�}|�| j� | �| jj � | �| jj
� | �| j j � | �
| jj� dS )z�
No configuration of contexts occurs under OpenSSL 1.1.0 and
later, because they create contexts with secure ECDH curves.
@see: U{http://twistedmatrix.com/trac/ticket/9210}
�r� r� N)rG r� � OPENSSL_110rn r{ r� r� r� r� r` ra r� ru r� r� �rW �chooserr r r �test_openSSL110� s � z5ChooseDiffieHellmanEllipticCurveTests.test_openSSL110c C sr t �t j�}tj| j| j| jd�}|�|� | � | j
j |j g� | � | j
j
dg� | �| jj� | �| jj� dS )z�
OpenSSL 1.0.2 does not set ECDH curves by default, but
C{SSL_CTX_set_ecdh_auto} requests that a context choose a
secure set curves automatically.
r� TN)r rw r! rG r� � OPENSSL_102rn r{ r� r� r� r` r ra r� r� ru r� r� r� �rW r� r� r r r �test_openSSL102� s �
z5ChooseDiffieHellmanEllipticCurveTests.test_openSSL102c C sl t | j_t�tj�}tj| j| j | j
d�}|� |� | � | jj
|jg� | � | jjdg� | �| jj� dS )z�
An exception raised by C{SSL_CTX_set_ecdh_auto} under OpenSSL
1.0.2 is suppressed because ECDH is best-effort.
r� TN)�
BaseExceptionr� r_ r rw r! rG r� r� rn r{ r� r� r` r ra r� r� ru r� r r r � test_openSSL102SetECDHAutoRaises� s �
zFChooseDiffieHellmanEllipticCurveTests.test_openSSL102SetECDHAutoRaisesc C sr d | j _}tj| j| j| jd�}|�| j� | � | j
j � | � | j
j � | �
| j jtjg� | �| jj|� dS )z�
OpenSSL 1.0.1 does not set ECDH curves by default, nor does
it expose L{SSL_CTX_set_ecdh_auto}. Instead, a single ECDH
curve can be set with L{OpenSSL.SSL.Context.set_tmp_ecdh}.
z curve objectr� N)r� rt rG r� � OPENSSL_101rn r{ r� r� r� r� r` ra r� ru �_defaultCurveNamer� r� )rW r� r� r r r �test_openSSL101 s � �z5ChooseDiffieHellmanEllipticCurveTests.test_openSSL101c C sf dd� }|| j _tj| j| j| jd�}|�| j � | �| j j
� | �| j j � | � | j
jtjg� dS )z�
An exception raised by L{OpenSSL.SSL.Context.set_tmp_ecdh}
under OpenSSL 1.0.1 is suppressed because ECHDE is best-effort.
c S s t �d S r )r� r� r r r r� ! s zXChooseDiffieHellmanEllipticCurveTests.test_openSSL101SetECDHRaises.<locals>.set_tmp_ecdhr� N)r� r� rG r� r� rn r{ r� r� r� r` ra r� r� ru r� )rW r� r� r r r � test_openSSL101SetECDHRaises s � �zBChooseDiffieHellmanEllipticCurveTests.test_openSSL101SetECDHRaisesc C sX t | j_tj| j| j| jd�}|�| j � | �
| j j � | �
| j j
� | �| j j� dS )zy
Contexts created under an OpenSSL 1.0.1 that doesn't support
ECC have no configuration applied.
r� N)rF r� rs rG r� r� rn r{ r� r� r� r� r` ra r� r� r� r r r �test_openSSL101NoECC5 s � z:ChooseDiffieHellmanEllipticCurveTests.test_openSSL101NoECCN)rY rZ r[ r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r � s r c @ s8 e Zd ZdZereZdd� Zdd� Zdd� Zdd � Z d
S ) � KeyPairTestsz)
Tests for L{sslverify.KeyPair}.
c C s t ddd�d | _dS )z*
Create test certificate.
r� r� r� r N)r; r� rV r r r r� O s ��zKeyPairTests.setUpc C s( | � tdddd�dft�| j�j� dS )zB
L{sslverify.KeyPair.__getstate__} is deprecated.
r� r� r r� N)r� r, rG r� r� r� rV r r r r� X s �z%KeyPairTests.test_getstateDeprecationc C s: t �| j��� }| �tdddd�dft �| j�j|� dS )zA
{sslverify.KeyPair.__setstate__} is deprecated.
r� r� r r� N)rG r� r� r� r� r, r� rg r r r r� a s �z%KeyPairTests.test_setstateDeprecationc C s( t d�j�d�}|�� }tj�|� d S )Nz twisted.testz cert.pem.no_trailing_newline)r" r[ �sibling�
getContentr rH rI )rW ZnoTrailingNewlineKeyPemPathZcertPEMr r r � test_noTrailingNewlinePemCertk s ��z*KeyPairTests.test_noTrailingNewlinePemCertN)
rY rZ r[ r� r� r� r� r� r� r� r r r r r� H s
r� c @ s< e Zd ZdZedk reZdd� Zejdd�ge_dd� Z dS ) � SelectVerifyImplementationTestsz3
Tests for L{_selectVerifyImplementation}.
Nc C sB t d��0 dtjd< t�� }tjtjf}| �||� W 5 Q R X dS )z�
If I{service_identity} cannot be imported then
L{_selectVerifyImplementation} returns L{simpleVerifyHostname} and
L{SimpleVerificationError}.
�service_identityN)r �sys�modulesrG �_selectVerifyImplementationr� r� r� )rW r� Zexpectedr r r �test_dependencyMissing} s
�z6SelectVerifyImplementationTests.test_dependencyMissingzEYou do not have a working installation of the service_identity module�r c C s� t d�� dtjd< t�� W 5 Q R X tdd� | �� D ��\}dddg}g }|D ]}|�dj|d �� qP| � |d
|� | �
|d d � | �
|d
d� dS )z�
If I{service_identity} cannot be imported then
L{_selectVerifyImplementation} emits a L{UserWarning} advising the user
of the exact error.
r� Nc s s | ]}|d t kr|V qdS )r N)� UserWarning)rV �warningr r r rW � s �zPSelectVerifyImplementationTests.test_dependencyMissingWarning.<locals>.<genexpr>z8'import of service_identity halted; None in sys.modules'z:'import of 'service_identity' halted; None in sys.modules'z"'No module named service_identity'av You do not have a working installation of the service_identity module: {message}. Please install it from <https://pypi.python.org/pypi/service_identity> and make sure all of its dependencies are satisfied. Without the service_identity module, Twisted can perform only rudimentary TLS client hostname verification. Many valid certificate/hostname mappings may be rejected.r� r �filenamerq �linenor ) r r� r� rG r� rJ r" r� �formatrh r� )rW r� Z importErrorsZexpectedMessagesZ importErrorr r r � test_dependencyMissingWarning� s(
�
� ��
z=SelectVerifyImplementationTests.test_dependencyMissingWarning)
rY rZ r[ r� r� r� r� r$ r� r� r r r r r� u s �� r� )r< )N)NNN)N)�r� Z
__future__r r r� � itertoolsrC Zzope.interfacer Ztwisted.python.reflectr r� r� r r rE Ztwisted.internetr r r ZOpenSSL.cryptor r
r r r
Z cryptographyr Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Z)cryptography.hazmat.primitives.asymmetricr Z,cryptography.hazmat.primitives.serializationr r Zcryptography.x509.oidr r rw r! r{ Zset_npn_advertise_callbackr Zset_alpn_select_callbackZtwisted.test.test_twistedr Ztwisted.test.iosimr Ztwisted.internet.errorr Ztwisted.python.compatr Ztwisted.python.filepathr! Ztwisted.python.modulesr" Z
twisted.trialr# r$ r% r& r' Ztwisted.internet._idnar( r) r* r+ Z incrementalr, Ztwisted.internet.sslr- r. r/ rG Ztwisted.protocols.tlsr0 rr rw rY r[ r� r� r- �countr2 r; rP rv r� r� r� ro r� r� r� r� ZSynchronousTestCaser� r� r� ZTestCaser� r� r� r� r� r� r r r r r r r+ r9 rC rN rZ r] rd ri rq rv rx r r� r� r r r r �<module> s�
_8
) �
0
pEH S / �
S 5 G 63) ( > -