a

�,�h�E�@s$
dd
lm
Z
mZmZmZ
ddlZddlmZ
ddlmZm	Z	m
Z

ddlmZ
ddl
mZmZmZ
gd�
Zd	d
�Zdd�Zd
d�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd�Zdd �Zd!d"�Zd#d$�Zd%d&�Z d'd(�Z!d)d*�Z"d+d,�Z#d-d.�Z$d/d0�Z%d1d2�Z&d3d4�Z'd5d6�Z(dS)7�)�unicode_literals�division�absolute_import�print_functionN)
�datetime�
)�Certificate�int_from_bytes�timezone)
�CIPHER_SUITE_MAP)�TLSVerificationError�TLSDisconnectError�TLSError)�detect_client_auth_request�
extract_chain�get_dh_params_length�parse_alert�parse_handshake_messages�parse_session_info�parse_tls_records�raise_client_auth�raise_dh_params�raise_disconnection�raise_expired_not_yet_valid�raise_handshake�raise_hostname�raise_no_issuer�raise_protocol_error�
raise_revoked�raise_self_signed�raise_verification�raise_weak_signaturec

Cs�g}
d
}t|�
D]>\}}}|dkr$qt
|�
D]\}}|dkr,|}
qFq,|r
qPq|r�d}|t|�
kr�t|||d��
}	|d}
|
|	}|}||
|�}|
�t�|�
�

qX|
S)a

    Extracts the X.509 certificates from the server handshake bytes for use
    when debugging

    :param server_handshake_bytes:
        A byte string of the handshake data received from the server

    :return:
        A list of asn1crypto.x509.Certificate objects
    N�
�
�)rr�lenr	�appendr�load)
�server_handshake_bytes�outputZchain_bytes�record_type�
_�record_data�message_type�message_data�pointerZcert_lengthZ
cert_startZcert_endZ
cert_bytes�r0�>/opt/nydus/tmp/pip-target-wkfpz8uv/lib/python/oscrypto/_tls.pyr#s*














rc
CsDt|�
D]6\}
}}|
d
krqt
|�
D]\}}|dkr$

dSq$qdS)a)

    Determines if a CertificateRequest message is sent from the server asking
    the client for a certificate

    :param server_handshake_bytes:
        A byte string of the handshake data received from the server

    :return:
        A boolean - if a client certificate request was found
    r"�

TF)rr)r(r*r+r,r-r.r0r0r1rKs





rc
Csld
}
d
}t|�
D]>\}}}|dkr$qt
|�
D]\}}|dkr,|}
qFq,|r
qPq|rht|dd��
d}
|
S)a

    Determines the length of the DH params from the ServerKeyExchange

    :param server_handshake_bytes:
        A byte string of the handshake data received from the server

    :return:
        None or an integer of the bit size of the DH parameters
    Nr"�
r
��)rrr	)r(r)Zdh_params_bytesr*r+r,r-r.r0r0r1r`s








rc
CsVt|�
D]H\}
}}|
d
krqt
|�
dkr.
dSt|dd��
t|dd��
f
SdS)aV

    Parses the handshake for protocol alerts

    :param server_handshake_bytes:
        A byte string of the handshake data received from the server

    :return:
        None or an 2-element tuple of integers:
         0: 1 (warning) or 2 (fatal)
         1: The alert description (see https://tools.ietf.org/html/rfc5246#section-7.2)
    �
r4Nr
r)rr%r	)r(r*r+r,r0r0r1rs





$
rcCsVd
}d
}d}d
}d
}d
}d
}t|�
D]�\}	}
}|	dkr8q$t
|�
D]�\}}
|dkrRq@ddddd	d
�|
dd�}t|
d
d��
}|dkr�|
dd|�}d|}|
||d�}t|}|d}|
||d�dk}|d}|
|d
�}t|�
D]\}}|dkr�d}
�
q
q�
q$q@q$t|
�
D]�\}	}
}|	dk�
r2�
qt
|�
D]�\}}
|dk�
rP�
q:t|
d
d��
}|dk�
rz|
dd|�}d|}t|
||d��
}|d|}t|
||d��
}|d
u�r
|d
u�r
|d|}|
|d
�}t|�
D]\}}|dk�
r�d}
�q
�
q�
�
q�
q:�
q|d
u
�rF|d
u�r2d}n||k�rBd}nd}|||||d�S)a�
    Parse the TLS handshake from the client to the server to extract information
    including the cipher suite selected, if compression is enabled, the
    session id and if a new or reused session ticket exists.

    :param server_handshake_bytes:
        A byte string of the handshake data received from the server

    :param client_handshake_bytes:
        A byte string of the handshake data sent to the server

    :return:
        A dict with the following keys:
         - "protocol": unicode string
         - "cipher_suite": unicode string
         - "compression": boolean
         - "session_id": "new", "reused" or None
         - "session_ticket: "new", "reused" or None
    NFr"�
�SSLv3�TLSv1zTLSv1.1zTLSv1.2zTLSv1.3)ss
sssr
r4�"�#r�
�new�

Zreused)�protocol�cipher_suite�compression�
session_id�session_ticket)rrr	r�_parse_hello_extensions)r(Zclient_handshake_bytesr?r@rArBrCZserver_session_idZclient_session_idr*r+r,r-r.Zsession_id_lengthZcipher_suite_startZcipher_suite_bytesZcompression_startZextensions_length_startZextensions_data�extension_typeZextension_dataZcipher_suite_lengthZcompression_lengthr0r0r1r�s�












�
�








































�rc
cs�d
}
t|�
}|
|kr�||
|
d�dkr*q�t
||
d|
d��
}||
|
d�||
d|
d�||
d|
d|�fV
|
d|7}
qdS)a�

    Creates a generator returning tuples of information about each record
    in a byte string of data from a TLS client or server. Stops as soon as it
    find a ChangeCipherSpec message since all data from then on is encrypted.

    :param data:
        A byte string of TLS records

    :return:
        A generator that yields 3-element tuples:
        [0] Byte string of record type
        [1] Byte string of protocol version
        [2] Byte string of record data
    r
r�
r$�N�r%r	��datar/�data_len�lengthr0r0r1r
s





�rc
cshd
}
t|�
}|
|krdt
||
d|
d��
}||
|
d�||
d|
d|�fV
|
d|7}
qdS)a`

    Creates a generator returning tuples of information about each message in
    a byte string of data from a TLS handshake record

    :param data:
        A byte string of a TLS handshake record data

    :return:
        A generator that yields 2-element tuples:
        [0] Byte string of message type
        [1] Byte string of message data
    r
r�NrHrIr0r0r1r#
s



�rc
cs�|d
krdSt|dd��
}
d}d|
}|}||kr�t|||d��
}t||d|d��
}|||d|d|�fV
|d|7}q,dS)a�

    Creates a generator returning tuples of information about each extension
    from a byte string of extension data contained in a ServerHello ores
    ClientHello message

    :param data:
        A byte string of a extension data from a TLS ServerHello or ClientHello
        message

    :return:
        A generator that yields 2-element tuples:
        [0] Byte string of extension type
        [1] Byte string of extension data
    �Nr
r4rM)
r	)rJZextentions_lengthZextensions_startZextensions_endr/rEZextension_lengthr0r0r1rD<
s






�rDcCs�t�
d
|
�p|
�d�
dk}|r(d|
}nd|
}d|}d�|j�
}d�|j�
}|r`|d|7}|rp|rp|d	7}|r�|d
|7}t||��
dS)z�
    Raises a TLSVerificationError due to a hostname mismatch

    :param certificate:
        An asn1crypto.x509.Certificate object

    :raises:
        TLSVerificationError
    z^\d+\.\d+\.\d+\.\d+$�
:���z
IP address %szdomain name %sz:Server certificate verification failed - %s does not matchz, z valid domains: %sz orz valid IP addresses: %sN)�re�match�find�join�	valid_ips�
valid_domainsr)�certificate�hostnameZis_ipZ
hostname_type�messagerUrVr0r0r1r^
s












rc
Csd
}
t|
|��
dS)z�
    Raises a generic TLSVerificationError

    :param certificate:
        An asn1crypto.x509.Certificate object

    :raises:
        TLSVerificationError
    z&Server certificate verification failedN�
r�rWrYr0r0r1r z
s
r c
Csd
}
t|
|��
dS)z�
    Raises a TLSVerificationError when a certificate uses a weak signature
    algorithm

    :param certificate:
        An asn1crypto.x509.Certificate object

    :raises:
        TLSVerificationError
    zMServer certificate verification failed - weak certificate signature algorithmNrZr[r0r0r1r!�
s
r!c
Csd
}t|�
�
dS)zg
    Raises a TLSError indicating client authentication is required

    :raises:
        TLSError
    z5TLS handshake failed - client authentication requiredN�
r)
rYr0r0r1r�
s
rc
Csd
}
t|
|��
dS)z�
    Raises a TLSVerificationError due to the certificate being revoked

    :param certificate:
        An asn1crypto.x509.Certificate object

    :raises:
        TLSVerificationError
    zEServer certificate verification failed - certificate has been revokedNrZr[r0r0r1r�
s
rc
Csd
}
t|
|��
dS)z�
    Raises a TLSVerificationError due to no issuer certificate found in trust
    roots

    :param certificate:
        An asn1crypto.x509.Certificate object

    :raises:
        TLSVerificationError
    zgServer certificate verification failed - certificate issuer not found in trusted root certificate storeNrZr[r0r0r1r�
s
rc
Csd
}
t|
|��
dS)z�
    Raises a TLSVerificationError due to a self-signed certificate
    roots

    :param certificate:
        An asn1crypto.x509.Certificate object

    :raises:
        TLSVerificationError
    zCServer certificate verification failed - certificate is self-signedNrZr[r0r0r1r�
s
rc
Csd
}
t|
|��
dS)z�
    Raises a TLSVerificationError due to a certificate lifetime exceeding
    the CAB forum certificate lifetime limit

    :param certificate:
        An asn1crypto.x509.Certificate object

    :raises:
        TLSVerificationError
    zIServer certificate verification failed - certificate lifetime is too longNrZr[r0r0r1�raise_lifetime_too_long�
s
r]c
Csp|d
d}
|
dj}|
dj}t
�tj�
}||krH|�d�
}d|}n||krb|�d�
}d|}t||��
dS)	z�
    Raises a TLSVerificationError due to certificate being expired, or not yet
    being valid

    :param certificate:
        An asn1crypto.x509.Certificate object

    :raises:
        TLSVerificationError
    Ztbs_certificate�validity�	not_after�
not_beforez%Y-%m-%d %H:%M:%SZzGServer certificate verification failed - certificate not valid until %sz?Server certificate verification failed - certificate expired %sN)Znativer�nowr
�utc�strftimer)rWr^r_r`raZformatted_beforerYZformatted_afterr0r0r1r�
s











rcCstd
�
�
dS)ze
    Raises a TLSDisconnectError due to a disconnection

    :raises:
        TLSDisconnectError
    z$The remote end closed the connectionN)
r
r0r0r0r1rsrc
Cs$t|�
}
|
rt
d
|
�
�
t
d�
�
dS)z�
    Raises a TLSError due to a protocol error

    :param server_handshake_bytes:
        A byte string of the handshake data received from the server

    :raises:
        TLSError
    z.TLS protocol error - server responded using %sz@TLS protocol error - server responded using a different protocolN)�detect_other_protocolr)r(Zother_protocolr0r0r1rs
rcCstd
�
�
dS)zS
    Raises a TLSError due to a handshake error

    :raises:
        TLSError
    zTLS handshake failedNr\r0r0r0r1rsrcCstd
�
�
dS)z_
    Raises a TLSError due to a TLS version incompatibility

    :raises:
        TLSError
    z-TLS handshake failed - protocol version errorNr\r0r0r0r1�raise_protocol_version)srecCstd
�
�
dS)zP
    Raises a TLSError due to weak DH params

    :raises:
        TLSError
    z)TLS handshake failed - weak DH parametersNr\r0r0r0r1r4src

Cs�|d
d�dkrdS|d
d�dkr<t�
d|tj�r8dSd	S|d
d�d
krPdS|d
d�dkrddS|d
d�d
ks�|d
d�dkr�dSdS)a

    Looks at the server handshake bytes to try and detect a different protocol

    :param server_handshake_bytes:
        A byte string of the handshake data received from the server

    :return:
        None, or a unicode string of "ftp", "http", "imap", "pop3", "smtp"
    r
rGsHTTP/�HTTPrMs220 s
^[^
]*ftp�FTP�SMTPs220-s+OK ZPOP3s* OK�	s	* PREAUTHZIMAPN)rQrR�
I)
r(r0r0r1rd?s




 
rd))�
__future__rrrrrQrZ_asn1rr	r
Z_cipher_suitesr�errorsrr
r�__all__rrrrrrrrDrr r!rrrrr]rrrrrerrdr0r0r0r1�<module>s:


(o"