Bfi%dZdZdZdZdZdZdZddlZddlZeje Z dd l m Z dd lmZd ZGddeZy#e$r$Zd Zd ZddlZej,eYdZ[0dZ[wwxYw)zAndg_httpsclient - module containing SSL peer verification class. zP J Kershaw (STFC)z09/12/11z2(C) 2012 Science and Technology Facilities Councilz-BSD - see LICENSE file in top-level directoryzPhilip.Kershaw@stfc.ac.ukz$Id$N)SubjectAltName)decoderTFzPSubjectAltName support is disabled - check pyasn1 package installation to enablec <eZdZdZdddddddd d d d Zd Zddj eejeejzzZ e je Z dZddZdZdZedZdZdZeeedZdZdZeeedZy)ServerSSLCertVerificationzyCheck server identity. If hostname doesn't match, allow match of host's Distinguished Name against server DN settingCNOUOC EMAILADDRESSLSTSTREETDCUID) commonNameorganisationalUnitName organisation countryName emailAddress localityNamestateOrProvinceName streetAddressdomainComponentuseridssubjectAltNamez/(%s)=|) __hostname__certDN__subj_alt_name_matchNcd|_d|_|||_|||_|r+tst j dd|_yd|_yt jdd|_y)aOverride parent class __init__ to enable setting of certDN setting @type certDN: string @param certDN: Set the expected Distinguished Name of the server to avoid errors matching hostnames. This is useful where the hostname is not fully qualified @type hostname: string @param hostname: hostname to match against peer certificate subjectAltNames or subject common name @type subj_alt_name_match: bool @param subj_alt_name_match: flag to enable/disable matching of hostname against peer certificate subjectAltNames. Nb. A setting of True will be ignored if the pyasn1 package is not installed NzdOverriding "subj_alt_name_match" keyword setting: peer verification with subjectAltNames is disabledFTz9Disabling peer verification with subject subjectAltNames!) "_ServerSSLCertVerification__certDN$_ServerSSLCertVerification__hostnamecertDNhostnameSUBJ_ALT_NAME_SUPPORTlogwarning/_ServerSSLCertVerification__subj_alt_name_matchdebug)selfr"r#subj_alt_name_matchs w/var/www/html/BankruptcyAI-uat/bankruptcy-ai/venv/lib/python3.12/site-packages/ndg/httpsclient/ssl_peer_verification.py__init__z"ServerSSLCertVerification.__init__2sn     DK  $DM ( QR-2*-1* II) *).D &c|jr%tjd|jy|dk(r|j}|j }|j |j |jtjdy|jr!|j|}|j|vr|S|j|jk(r|Stjd|j|jy||j k(r|Stjd||j y|S)a Verify server certificate @type connection: OpenSSL.SSL.Connection @param connection: SSL connection object @type peerCert: basestring @param peerCert: server host certificate as OpenSSL.crypto.X509 instance @type errorStatus: int @param errorStatus: error status passed from caller. This is the value returned by the OpenSSL C function X509_STORE_CTX_get_error(). Look-up x509_vfy.h in the OpenSSL source to get the meanings of the different codes. PyOpenSSL doesn't help you! @type errorDepth: int @param errorDepth: a non-negative integer representing where in the certificate chain the error occurred. If it is zero it occured in the end entity certificate, one if it is the certificate which signed the end entity certificate and so on. @type preverifyOK: int @param preverifyOK: the error status - 0 = Error, 1 = OK of the current SSL context irrespective of any verification checks done here. If this function yields an OK status, it should enforce the preverifyOK value so that any error set upstream overrides and is honoured. @rtype: int @return: status code - 0/False = Error, 1/True = OK z4Certificate %r in peer certificate chain has expiredFrz?No "hostname" or "certDN" set to check peer certificate againstz7Peer certificate CN %r doesn't match the expected CN %rz7Peer certificate DN %r doesn't match the expected DN %r) has_expiredr%error get_subjectget_componentssortr"r#r'_get_subj_alt_namer) r) connectionpeerCert errorStatus errorDepth preverifyOK peerCertSubj peerCertDN dns_namess r+__call__z"ServerSSLCertVerification.__call__Ws*8    ! IIL**, . 1_$//1L%446J OO {{"==(II45 -- $ 7 7 AI}} 1** **dmm;&&II/0<0G0G"mm-!,&&II/0:DKKI  r-cfd}|S)Nc.j|||||SN)r=)r5r6r7r8r9r)s r+verify_server_certzQServerSSLCertVerification.get_verify_server_cert_func..verify_server_certs==X{!+[: :r-)r)rAs` r+get_verify_server_cert_funcz5ServerSSLCertVerification.get_verify_server_cert_funcs : "!r-c g}t}t|jD]}|j|}|j }||j k(s4|j }tj||}|D]e} t| tstt| D];} | j| } |jt| j=g|S)aExtract subjectAltName DNS name settings from certificate extensions @param peer_cert: peer certificate in SSL connection. subjectAltName settings if any will be extracted from this @type peer_cert: OpenSSL.crypto.X509 )asn1Spec)rrangeget_extension_count get_extensionget_short_nameSUBJ_ALT_NAME_EXT_NAMEget_data der_decoderdecode isinstancelengetComponentByPositionappendstr getComponent) cls peer_certdns_name general_namesiextext_nameext_dat decoded_datnameentry components r+r4z,ServerSSLCertVerification._get_subj_alt_names&( y4467 KA))!,C))+H3555,,.)00:GI (KD!$7%*3t9%5KE(,(C(CE(JI$OOC 0F0F0H,IJKK Kr-c|jSr@)r r)s r+ _getCertDNz$ServerSSLCertVerification._getCertDNs }}r-c t|tr|jd}|jjj |}t |dkrtd|ztt|ddd|ddd|_ |jjyt|ts(|D]}t |dk(rtd||_ ytd)N"zError parsing DN string: "%s"zSExpecting list of two element DN field, DN field value pairs for "certDN" attributez4Expecting list or string type for "certDN" attribute) rNrRstrip __class__ PARSER_REsplitrO TypeErrorlistzipr r3)r)valr"dnFieldsrXs r+ _setCertDNz$ServerSSLCertVerification._setCertDNs c3 YYs^F~~//55f=H8}q  ?& HII Xadd^Xadd^!DEDM MM   C& 11v{#%011 1  DM() )r-z)Distinguished Name for Server Certificate)fgetfsetdocc|jSr@)r!ras r+ _getHostnamez&ServerSSLCertVerification._getHostnames r-cHt|ts td||_y)Nz,Expecting string type for hostname attribute)rNrRrkr!)r)rns r+ _setHostnamez&ServerSSLCertVerification._setHostnames%#s#-. .r-zhostname of server)NNT)__name__ __module__ __qualname____doc__DN_LUTrJjoinrlkeysvalues PARSER_RE_STRrecompileri __slots__r,r=rC classmethodr4rbrppropertyr"rurwr#rBr-r+rrs;%)$($'$'$2$'$($,$($) F/sxxV[[](;(,V]]_(=)> ??M =)ICI#/JGR"6).:%EGF  \)02Hr-r)r{ __author____date__ __copyright__ __license__ __contact__ __revision__rlogging getLoggerrxr%ndg.httpsclient.subj_alt_namerpyasn1.codec.derrrLr$ ImportErroreSUBJ_ALT_NAME_SUPPORT_MSGwarningswarnobjectrrBr-r+rs ! D = )  g! -<7 R2R2-! !HMM+,,-sAA- A((A-