Your IP : 172.28.240.42

Current Path : /usr/lib/python2.7/dist-packages/twisted/internet/
Upload File :
Current File : //usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyc


[XMc@sddlZddlmZmZddlmZmZddlmZddl	m
Z
ddlmZm
Z
ejjZi
dd6dd6d	d
6d	d	6dd6dd6d
d6d
d
6dd6dd6dd6dd6dd6ZdefdYZeZdd%dYZdZdefdYZdefdYZdefdYZdd&d YZd!efd"YZd#efd$YZdS('iN(tSSLtcrypto(treflecttutil(tmd5(tDeferred(tVerifyErrortCertificateErrort
commonNametCNtorganizationNametOtorganizationalUnitNametOUtlocalityNametLtstateOrProvinceNametSTtcountryNametCtemailAddresstDistinguishedNamecBsSeZdZdZdZdZdZdZdZdZ	dZ
RS(	s
    Identify and describe an entity.

    Distinguished names are used to provide a minimal amount of identifying
    information about a certificate issuer or subject.  They are commonly
    created with one or more of the following fields::

        commonName (CN)
        organizationName (O)
        organizationalUnitName (OU)
        localityName (L)
        stateOrProvinceName (ST)
        countryName (C)
        emailAddress
    cKs1x*|jD]\}}t|||q
WdS(N(t	iteritemstsetattr(tselftkwtktv((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt__init__;scCsLi}x?tD]7}t||d}|dk	r
t|||q
q
WdS(N(t
_x509namestgetattrtNoneR(Rtx509nametdtnametvalue((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt	_copyFrom@s

cCs1x*|jD]\}}t|||q
WdS(N(RR(RR RR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt	_copyIntoHscCsdtj|dd!S(Ns<DN %s>ii(tdictt__repr__(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR'MscCs4y|t|SWntk
r/t|nXdS(N(RtKeyErrortAttributeError(Rtattr((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt__getattr__Qs
cCsyt|tkst|tkr:td|fnt|}|jd}t|tkskt|||<dS(Ns)%s is not a valid OpenSSL X509 name fieldtascii(ttypetstrtAssertionErrorRR)tencode(RR*R#trealAttr((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt__setattr__Xs
c	Csg}d}d}xl|tD]^}tj|}tt||}t||d}|dk	r"|j||fq"q"W|d7}x;t|D]-\}\}}|j	|d|||<qWdj
|S(sP
        Return a multi-line, human-readable representation of this DN.
        icSstj|jjS(N(R&tfromkeyst
itervaluestkeys(tmapping((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytuniqueValueshsis: s
N(RRtnameToLabeltmaxtlenRRtappendt	enumeratetrjusttjoin(	RtltlablenR7RtlabelRtnR*((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytinspectbs	
((t__name__t
__module__t__doc__t	__slots__RR$R%R'R+R2RC(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR)s						
tCertBasecBs#eZdZdZdZRS(cCs
||_dS(N(toriginal(RRI((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRyscCs-t}|jt|jd||S(Ntget_(RR$RRI(Rtsuffixtdn((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt	_copyName|s	 cCs
|jdS(s
        Retrieve the subject of this certificate.

        @rtype: L{DistinguishedName}
        @return: A copy of the subject of this certificate.
        tsubject(RM(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt
getSubjects(RDRERRMRO(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRHxs		cCs|t|jd|fd}|dkrDtd||fn|}|dkrrtd||fn||S(s
    (private) Helper for L{Certificate.peerFromTransport} and
    L{Certificate.hostFromTransport} which checks for incompatible handle types
    and null certificates and raises the appropriate exception or returns the
    appropriate certificate object.
    sget_%s_certificates0non-TLS transport %r did not have %s certificates,TLS transport %r did not have %s certificateN(Rt	getHandleRR(tClasst	transportt
methodNametmethodtcert((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt_handleattrhelpers	tCertificatecBseZdZdZdZdZejddZe	eZeZ
dZdZe	eZdZ
e	e
Z
dZe	eZd	Zejd
ZdZdd
ZdZdZdZdZRS(s
    An x509 certificate.
    cCs)d|jj|jj|jjfS(Ns<%s Subject=%s Issuer=%s>(t	__class__RDRORt	getIssuer(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR'scCs)t|tr%|j|jkStS(N(t
isinstanceRWtdumptFalse(Rtother((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt__eq__scCs|j|S(N(R^(RR]((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt__ne__scCs|tj|||S(sc
        Load a certificate from an ASN.1- or PEM-format string.

        @rtype: C{Class}
        (Rtload_certificate(RQtrequestDatatformattargs((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytloadscCs|jtjS(s\
        Dump this certificate to a PEM-format data string.

        @rtype: C{str}
        (R[RtFILETYPE_PEM(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytdumpPEMscCs|j|tjS(s]
        Load a certificate from a PEM-format data string.

        @rtype: C{Class}
        (RdRRe(RQtdata((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytloadPEMscCst||dS(s
        Get the certificate for the remote end of the given transport.

        @type: L{ISystemHandle}
        @rtype: C{Class}

        @raise: L{CertificateError}, if the given transport does not have a peer
        certificate.
        tpeer(RV(RQRR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytpeerFromTransports
cCst||dS(s
        Get the certificate for the local end of the given transport.

        @param transport: an L{ISystemHandle} provider; the transport we will

        @rtype: C{Class}

        @raise: L{CertificateError}, if the given transport does not have a host
        certificate.
        thost(RV(RQRR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pythostFromTransportscCst|jjS(sX
        Get the public key for this certificate.

        @rtype: L{PublicKey}
        (t	PublicKeyRIt
get_pubkey(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytgetPublicKeyscCstj||jS(N(Rtdump_certificateRI(RRb((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR[scCs
|jjS(sY
        Retrieve the serial number of this certificate.

        @rtype: C{int}
        (RItget_serial_number(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytserialNumbersRcCs|jj|S(s
        Return a digest hash of this certificate using the specified hash
        algorithm.

        @param method: One of C{'md5'} or C{'sha'}.
        @rtype: C{str}
        (RItdigest(RRT((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRsscCsKdjd|jjd|jjd|jd|jgS(Ns
sCertificate For Subject:s
Issuer:s
Serial Number: %ds
Digest: %s(R>RORCRYRrRs(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt_inspects	
cCs%dj|j|jjfS(s
        Return a multi-line, human-readable representation of this
        Certificate, including information about the subject, issuer, and
        public key.
        s
(R>RtRoRC(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRCscCs
|jdS(s
        Retrieve the issuer of this certificate.

        @rtype: L{DistinguishedName}
        @return: A copy of the issuer of this certificate.
        tissuer(RM(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRY scGstddS(Ns'Possible, but doubtful we need this yet(tNotImplementedError(Rtauthorities((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytoptions*s((RDRERFR'R^R_Rt
FILETYPE_ASN1Rdtclassmethodt_loadRfRhRjRlRoR[RrRsRtRCRYRx(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRWs,																	
tCertificateRequestcBs8eZdZejdZeeZejdZRS(s
    An x509 certificate request.

    Certificate requests are given to certificate authorities to be signed and
    returned resulting in an actual certificate.
    cCsctj||}t}|j|j|j|jsYtd|fn||S(Ns0Can't verify that request for %r is self-signed.(Rtload_certificate_requestRR$tget_subjecttverifyRnR(RQRat
requestFormattreqRL((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRd6s	cCstj||jS(N(Rtdump_certificate_requestRI(RRb((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR[@s(RDRERFRRyRdRzR[(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR|/stPrivateCertificatecBseZdZdZdZejdZejdZe	eZdZ
dZdZe	eZdZ
e	e
Z
d	Zejd
dZejejdZdd
dZRS(s.
    An x509 certificate and private key.
    cCstj|dt|jS(Ns with (RWR'treprt
privateKey(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR'IscCs1|j|js$tdn||_|S(Ns1Certificate public and private keys do not match.(tmatchesRoRR(RR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt_setPrivateKeyMs
	cCs|j||j|S(s}
        Create a new L{PrivateCertificate} from the given certificate data and
        this instance's private key.
        (RdR(RtnewCertDataRb((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytnewCertificateUscCs|j||j|S(N(R{R(RQRgRRb((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRd]scCs%djtj||jjgS(Ns
(R>RWRtRRC(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRCbscCs#|jtj|jjtjS(si
        Dump both public and private parts of a private certificate to
        PEM-format data.
        (R[RReR(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRfgscCs%|j|tj|tjtjS(sv
        Load both private and public parts of a private certificate from a
        chunk of PEM-format data.
        (RdtKeyPairRRe(RQRg((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRhoscCs||j}|j|S(N(RIR(RQtcertificateInstanceRtprivcert((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytfromCertificateAndKeyPairysc
Gsitd|jjd|j}|r_|jtdtdtdg|D]}|j^qCnt|S(NRtcertificateRtrequireCertificatetcaCerts(R&RRItupdatetTruetOpenSSLCertificateOptions(RRwRxtauth((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRxs#RcCs|jj|j||S(N(RtcertificateRequestRO(RRbtdigestAlgorithm((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRs		cCs+|j}|jj||||||S(N(RORtsignCertificateRequest(RRatverifyDNCallbackRrRtcertificateFormatRu((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRs	i<iimcCs"|jj|j||||S(N(RtsignRequestObjectRO(RRRrtsecondsToExpiryR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRs
iiQi3(RDRERFR'RRRyRRdRzRCRfRhRRxRRR(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyREs&							
RmcBs5eZdZdZdZdZdZRS(cCs>||_tj}|j|tjtj||_dS(N(RIRtX509Reqt
set_pubkeyRRyt	_emptyReq(Rtosslpkeytreq1((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRs	
cCs|j|jkS(N(R(RtotherKey((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRscCsd|jj|jfS(Ns<%s %s>(RXRDtkeyHash(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR'scCst|jjS(sd
        MD5 hex digest of signature on an empty certificate request with this
        key.
        (RRt	hexdigest(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRscCsd|jfS(NsPublic Key with Hash: %s(R(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRCs(RDRERRR'RRC(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRms
				RcBseZejdZeeZejdZdZdZdZ	ej
ddZejdZeeZdd	Z
ejdd
ZejejdddZdddZdZRS(cCs|tj||S(N(Rtload_privatekey(RQRgRb((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRdscCstj||jS(N(Rtdump_privatekeyRI(RRb((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR[scCs
|jS(N(R[(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt__getstate__scCs |jtjtj|dS(N(RRRRy(Rtstate((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt__setstate__scCsk|jj}|tjkr'd}n|tjkr?d}nd}|jj||jf}d|S(NtRSAtDSAs(Unknown Type!)s %s-bit %s Key Pair with Hash: %s(RIR-RtTYPE_RSAtTYPE_DSAtbitsR(RttttsR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRCs		icCs&tj}|j||||S(N(RtPKeytgenerate_key(RQtkindtsizetpkey((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytgeneratescCstj|||S(N(RRd(RRRb((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRsRcCsLtj}|j|j|j|j|j|j|t|S(N(RRRRIR%R~tsignR|(RtdistinguishedNameRR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt
requestObjects
cCs|j||j|S(sCreate a certificate request signed with this key.

        @return: a string, formatted according to the 'format' argument.
        (RR[(RRRbR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRsi<iimc		s{tj||j}	f	d}
t|	trm|	j|
S|
|	SdS(s&
        Given a blob of certificate request data and a certificate authority's
        DistinguishedName, return a blob of signed certificate data.

        If verifyDNCallback returns a Deferred, I will return a Deferred which
        fires the data when that Deferred has completed.
        csA|stdfnjjS(Ns%DN callback %r rejected request DN %r(RRR[(R#(	RLtissuerDistinguishedNameRRRRrRthlreqR(s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytverified#sN(R|RdRORZRtaddCallback(RRRaRRrRRRRtvvalR((	RRRRRrRLRRRs?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRs'
c	Cs|j}|j}tj}|j|j|j|j|j|j	|j
d|j||j||j
|j|t|S(sW
        Sign a CertificateRequest instance, returning a Certificate instance.
        i(RIRORtX509R%t
get_issuertset_subjectR~RRntgmtime_adj_notBeforetgmtime_adj_notAftertset_serial_numberRRW(	RRRRrRRRRLRU((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyR/s		


cKs4t|}tj|j||j|||S(N(tDNRRRR(RRrRRL((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pytselfSignedCertEsiiQi3iiQi3(RDRERRyRdRzR[RRRCRRRRRRRR(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRs&				
Rc
BseZdZd
ZeeddZdZej	Z
d
d
d
ed
deeeeeedZ
dZdZdZd	ZRS(sM
    A factory for SSL context objects for both SSL servers and clients.
    tOP_ALLii@i	c

Cs|dk|dkks$td||_||_|dk	rN||_n||_|rc|sv|svtd||_||_||_||_	|	|_
|
|_||_||_
dS(s
        Create an OpenSSL context SSL connection context factory.

        @param privateKey: A PKey object holding the private key.

        @param certificate: An X509 object holding the certificate.

        @param method: The SSL protocol to use, one of SSLv23_METHOD,
        SSLv2_METHOD, SSLv3_METHOD, TLSv1_METHOD.  Defaults to TLSv1_METHOD.

        @param verify: If True, verify certificates received from the peer and
        fail the handshake if verification fails.  Otherwise, allow anonymous
        sessions and sessions with certificates which fail validation.  By
        default this is False.

        @param caCerts: List of certificate authority certificate objects to
            use to verify the peer's certificate.  Only used if verify is
            C{True}, and if verify is C{True}, this must be specified.  Since
            verify is C{False} by default, this is C{None} by default.

        @type caCerts: C{list} of L{OpenSSL.crypto.X509}

        @param verifyDepth: Depth in certificate chain down to which to verify.
        If unspecified, use the underlying default (9).

        @param requireCertificate: If True, do not allow anonymous sessions.

        @param verifyOnce: If True, do not re-verify the certificate
        on session resumption.

        @param enableSingleUseKeys: If True, generate a new key whenever
        ephemeral DH parameters are used to prevent small subgroup attacks.

        @param enableSessions: If True, set a session ID on each context.  This
        allows a shortened handshake to be used when a known client reconnects.

        @param fixBrokenPeers: If True, enable various non-spec protocol fixes
        for broken SSL implementations.  This should be entirely safe,
        according to the OpenSSL documentation, but YMMV.  This option is now
        off by default, because it causes problems with connections between
        peers using OpenSSL 0.9.8a.

        @param enableSessionTickets: If True, enable session ticket extension
        for session resumption per RFC 5077. Note there is no support for
        controlling session tickets. This option is off by default, as some
        server implementations don't correctly process incoming empty session
        ticket extensions in the hello.
        s5Specify neither or both of privateKey and certificatesZSpecify client CA certificate information if and only if enabling certificate verificationN(RR/RRRTRRtverifyDepthRt
verifyOncetenableSingleUseKeystenableSessionstfixBrokenPeerstenableSessionTickets(
RRRRTRRRRRRRRR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRZs >$										cCs2|jj}y|d=Wntk
r-nX|S(Nt_context(t__dict__tcopyR((RR!((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRs
cCs
||_dS(N(R(RR((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRscCs(|jdkr!|j|_n|jS(s%Return a SSL.Context object.
        N(RRt_makeContext(R((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt
getContextscCstj|j}|jdk	r]|jdk	r]|j|j|j|j|jntj	}|j
rtj}|jr|tj
O}n|jr|tjO}n|jr|j}x!|jD]}|j|qWqnd}|j|||jdk	r!|j|jn|jr=|jtjn|jrY|j|jn|jrtdtj|jt fj!}|j"|n|j#s|j|j$n|S(NcSs|S(N((tconnRUterrnotdepthtpreverify_ok((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt_verifyCallbackss%s-%d(%RtContextRTRRRtuse_certificatetuse_privatekeytcheck_privatekeytVERIFY_NONERtVERIFY_PEERRtVERIFY_FAIL_IF_NO_PEER_CERTRtVERIFY_CLIENT_ONCERtget_cert_storetadd_certt
set_verifyRtset_verify_depthRtset_optionstOP_SINGLE_DH_USERt_OP_ALLRRRtqualRXt_sessionCounterRtset_session_idRt
_OP_NO_TICKET(RtctxtverifyFlagststoreRURtsessionName((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRs<
										+	N(RDRERFRRRRRRtTLSv1_METHODRTR\RRRRRR(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyRMs*	F				(((t	itertoolstOpenSSLRRttwisted.pythonRRttwisted.python.hashlibRttwisted.internet.deferRttwisted.internet.errorRRtcounttnextRRR&RRRHRVRWR|RRmRtobjectR(((s?/usr/lib/python2.7/dist-packages/twisted/internet/_sslverify.pyt<module>s<
L	f'{