Ñò
ìÿÒXc @ s] d d k Z d d k Z d d k Z d d k Z d d k Td d k l Z d d k i Z d d k i
Z
d d k i Z d d k i
Z
d a d „ Z d „ Z h e i e i 6e i e i 6e i e i 6Z d e f d „ ƒ YZ d e i e f d „ ƒ YZ d
e i f d „ ƒ YZ e d j o6e d
d e! d d ƒe" i# d ƒ e$ ou e d d d d ƒZ% e% i& d ƒ e% i' ƒ e% i( d d ƒ e% i) ƒ Z* e* i+ GHe* i, ƒ GHe* i- ƒ Z. e% i/ ƒ n e! oŒ e d d d d ƒZ0 e0 i' ƒ e0 i1 d d ƒ e0 i2 ƒ e0 i3 ƒ \ Z4 Z5 Z6 d e4 e5 f GHd e6 GHe0 i7 ƒ Z8 e8 i- ƒ Z. e8 i/ ƒ qYn d S( iÿÿÿÿN( t *( t NSPRErrorc
C s² t } | i ƒ } t i d | | t | ƒ ƒ | i ƒ } | d j o
d } n | o
t i } n
t i } y | i
| | | | Π} Wn5 t j
o) } t i d | i
| i ƒ t } | SXt i d d i t i | ƒ ƒ d i t i | ƒ ƒ ƒ | | @o
t } n t } | p | o t i d | | i
ƒ | S| i ƒ }
y | i |
ƒ } Wn8 t j
o, } t i d |
| i
| i ƒ t } | SXt i d | | i
ƒ | S( Ns7 auth_certificate_callback: check_sig=%s is_server=%s
%ss$ cert validation failed for "%s" (%s)s' approved_usage = %s intended_usage = %ss , s cert valid %s for "%s"sD failed verifying socket hostname "%s" matches cert subject "%s" (%s)( ( t Falset get_peer_certificatet root_loggert debugt strt get_pkcs11_pin_argt Nonet nsst certificateUsageSSLClientt certificateUsageSSLServert
verify_nowt Exceptiont errort subjectt strerrort joint cert_usage_flagst Truet get_hostnamet verify_hostname( t sockt check_sigt is_servert certdbt
cert_is_validt certt pin_argst intended_usaget approved_usaget et hostname( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyt auth_certificate_callback$ sF
c C só d } | oM y2 t i | | ƒ } t i | | ƒ } | | f SWqï t j
o t SXn– t i | t i ƒ } xy | D]q } yT t i | | ƒ } | i ƒ o1 | i | ƒ o t i | | ƒ } | | f Sn Wqv t j
o t SXqv Wt Sd S( N(
R R t find_cert_from_nicknamet find_key_by_any_certR R t get_cert_nicknamest SEC_CERT_NICKNAMES_USERt check_valid_timest has_signer_in_ca_names( t ca_namest chosen_nicknamet passwordR R t priv_keyt nicknamest nickname( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyt client_auth_data_callbackc s(
t NSSAddressFamilyFallbackc B s, e Z d „ Z d „ Z d „ Z d „ Z RS( c C s" | | _ | i | i ƒ | _ d S( N( t sock_familyt _get_nss_familyt family( t selfR2 ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyt __init__€ s c C s5 y t | SWn" t j
o t d | ƒ ‚ n Xd S( sM
Translate a family from python socket module to nss family.
s Uknown socket family %d
N( t _af_dictt KeyErrort
ValueError( R3 R0 ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyR1 „ s c C s t i d | i ƒ | _ d S( NR2 ( t iot SocketR2 R ( R3 ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyt _create_socket s c C s
y t i | d | i ƒ} Wn; t j
o/ t t i d | t i | i ƒ f ƒ ‚ n Xx– | D]Ž } t i d | ƒ | | _
| i | _ y" | i ƒ | i i
| ƒ d SWqa t j
o2 } t i d | t | ƒ ƒ t i d ƒ qa qa Xqa Wt t i d | ƒ ‚ d S( NR2 s! Cannot resolve %s using family %ss Connecting: %ss) Could not connect socket to %s, error: %ss# Try to continue with next family...s) Could not connect to %s using any address( R8 t AddrInfoR2 R
R R t PR_ADDRESS_NOT_SUPPORTED_ERRORt addr_family_nameR R t portR: R t connectR ( R3 t hostR> t addr_infot net_addrR ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyt connect_socket s,
( t __name__t
__module__R4 R1 R: RC ( ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyR/ s t
NSSConnectionc B se e Z e i i Z d d d e i e d d d „ Z d „ Z
d „ Z d „ Z d „ Z
d d „ Z RS( s tls1.1s tls1.2c
C s t i i | | | | ƒ t i | | ƒ t i d | i i | ƒ | pŒ t i ƒ oQ t
i ƒ y t i ƒ Wq§ t
j
o& } | i t i j o
| ‚ q£ q§ Xn | p t d ƒ ‚ n t i | ƒ | a n t
i ƒ t i | i ƒ t | ƒ | _ t | ƒ | _ d S( s?
:param host: the server to connect to
:param port: the port to use (default is set in HTTPConnection)
:param dbdir: the NSS database directory
:param family: network family to use (default AF_UNSPEC)
:param no_init: do not initialize the NSS database. This requires
that the database has already been initialized or
the request will fail.
:param tls_min_version: mininum version of SSL/TLS supported
:param tls_max_version: maximum version of SSL/TLS supported.
s
%s init %ss dbdir is requiredN( t httplibt HTTPConnectionR4 R/ R R t __class__RD R t nss_is_initializedt sslt clear_session_cachet nss_shutdownR t errnoR t SEC_ERROR_NOT_INITIALIZEDt RuntimeErrort nss_initt
current_dbdirt set_domestic_policyt set_password_callbackt password_callbackR t tls_version_mint tls_version_max(
R3 R@ R> t strictt dbdirR2 t no_initRV RW R ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyR4 s&
c C s4 y t } t } t } Wn d } d } d } n Xt i d | i ƒ | _ | i i t i t ƒ | i i t i
t ƒ y | i i | i | i
ƒ Wn5 t j
o) } t i d | i | i
f ƒ ‚ n X| i i | t ƒ | i i | | ƒ | i i | i ƒ | i i t t i ƒ ƒ | i i | i ƒ d S( Ni i i R2 s! Failed to set TLS range to %s, %s( t SSL_ENABLE_RENEGOTIATIONt SSL_REQUIRE_SAFE_NEGOTIATIONt SSL_RENEGOTIATE_REQUIRES_XTNRK t SSLSocketR2 R t set_ssl_optiont SSL_SECURITYR t SSL_HANDSHAKE_AS_CLIENTt set_ssl_version_rangeRV RW R R R R t set_handshake_callbackt handshake_callbackt set_auth_certificate_callbackR! R t get_default_certdbt set_hostnameR@ ( R3 t ssl_enable_renegotiationt ssl_require_safe_negotiationt ssl_renegotiate_requires_xtnR ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyR: Ø s,
c C s( | o | o | St i d | i ƒ S( Ns Enter password for %s: ( t getpasst
token_name( R3 t slott retryR* ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyRU ø s c C sf | i ƒ } t i | i ƒ } t i d | i ƒ ƒ t i d | i i ƒ ƒ t i d | i ƒ d S( sM
Verify callback. If we get here then the certificate is ok.
s handshake complete, peer = %ss Protocol: %ss
Cipher: %sN(
t get_ssl_channel_infoRK t get_cipher_suite_infot cipher_suiteR R t
get_peer_namet protocol_version_strt uppert cipher_suite_name( R3 R t channelt suite( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyRd ü s
c C s | i | i | i ƒ d S( N( RC R@ R> ( R3 ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyR? s c C s‰ y] t i \ } } } } } | d j o! | d j o t i i | ƒ n t i i | | ƒ Wn% t j
o } | i ƒ | ‚ n Xd S( s'
Explicitly close the connection if an error is returned after the
headers are sent. This will likely mean the initial SSL handshake
failed. If this isn't done then the connection is never closed and
subsequent NSS activities will fail with a BUSY error.
i i N( t syst version_infoRG RH t
endheadersR t close( R3 t messaget majort minort microt releaselevelt serialR ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyRz s
N( RD RE RG t HTTPSConnectiont default_portR t sockett AF_UNSPECR R4 R: RU Rd R? Rz ( ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyRF ª s )
t NSSHTTPSc B s5 e Z e Z d d d d e d d d „ Z d „ Z RS( t s tls1.1s tls1.2c
C sO | d j o
d } n | i | i | | | d | d | d | d | ƒƒ d S( Ni RY RZ RV RW ( R t _setupt _connection_class( R3 R@ R> RX RY RZ RV RW ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyR4 - s
c C sF t i i | ƒ \ } } } | d j o | i i ƒ n | | | f S( s¦
Override so we can close duplicated file connection on non-200
responses. This was causing nss_shutdown() to fail with a busy
error.
iÈ ( RG t HTTPt getreplyt fileR{ ( R3 t statust reasont msg( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyR‹ 8 s
N( RD RE RF R‰ R R R4 R‹ ( ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyR† s
t __main__s
nsslib.logR t filemodet at Starts www.verisign.comi» RY s /etc/pki/nssdbi t GETt /s status = %s %ss headers:
%s(9 Rx RG Rk R„ t ipapython.ipa_log_managert nss.errorR t nss.ioR8 t nss.nssR t nss.sslRK R R RR R! R. t
PR_AF_INETt AF_INETt PR_AF_INET6t AF_INET6t PR_AF_UNSPECR… R5 t objectR/ RH RF RŠ R† RD t standard_logging_setupR R t infoR t connt set_debuglevelR? t requestt getresponset responseR t
getheaderst readt dataR{ t ht
putrequestRz R‹ t http_statust http_reasont headerst getfilet f( ( ( s4 /usr/lib/python2.6/site-packages/ipapython/nsslib.pyt sV
?
+ s(