[XMc@sdZddlZyPddlmZddlmZmZmZddlmZddl m Z Wne k runXddl mZddl mZmZmZdd lmZmZdd lmZdd lmZmZdd l mZd ZdZejjZdZ dej!fdYZ"dej!fdYZ#dej$fdYZ%ej&ee'e'krde%_(ndfdYZ)dfdYZ*dfdYZ+dej$fdYZ,ej&ee'e'krde,_(ndS(s+ Tests for L{twisted.internet._sslverify}. iN(tSSL(tPKeytX509tX509Req(tTYPE_RSA(t _sslverify(tunittest(tprotocoltdefertreactor(tobjgreptisSame(tlog(tCertificateErrortConnectionLost(t interfacess -----BEGIN CERTIFICATE----- MIIC2jCCAkMCAjA5MA0GCSqGSIb3DQEBBAUAMIG0MQswCQYDVQQGEwJVUzEiMCAG A1UEAxMZZXhhbXBsZS50d2lzdGVkbWF0cml4LmNvbTEPMA0GA1UEBxMGQm9zdG9u MRwwGgYDVQQKExNUd2lzdGVkIE1hdHJpeCBMYWJzMRYwFAYDVQQIEw1NYXNzYWNo dXNldHRzMScwJQYJKoZIhvcNAQkBFhhub2JvZHlAdHdpc3RlZG1hdHJpeC5jb20x ETAPBgNVBAsTCFNlY3VyaXR5MB4XDTA2MDgxNjAxMDEwOFoXDTA3MDgxNjAxMDEw OFowgbQxCzAJBgNVBAYTAlVTMSIwIAYDVQQDExlleGFtcGxlLnR3aXN0ZWRtYXRy aXguY29tMQ8wDQYDVQQHEwZCb3N0b24xHDAaBgNVBAoTE1R3aXN0ZWQgTWF0cml4 IExhYnMxFjAUBgNVBAgTDU1hc3NhY2h1c2V0dHMxJzAlBgkqhkiG9w0BCQEWGG5v Ym9keUB0d2lzdGVkbWF0cml4LmNvbTERMA8GA1UECxMIU2VjdXJpdHkwgZ8wDQYJ KoZIhvcNAQEBBQADgY0AMIGJAoGBAMzH8CDF/U91y/bdbdbJKnLgnyvQ9Ig9ZNZp 8hpsu4huil60zF03+Lexg2l1FIfURScjBuaJMR6HiMYTMjhzLuByRZ17KW4wYkGi KXstz03VIKy4Tjc+v4aXFI4XdRw10gGMGQlGGscXF/RSoN84VoDKBfOMWdXeConJ VyC4w3iJAgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAviMT4lBoxOgQy32LIgZ4lVCj JNOiZYg8GMQ6y0ugp86X80UjOvkGtNf/R7YgED/giKRN/q/XJiLJDEhzknkocwmO S+4b2XpiaZYxRyKWwL221O7CGmtWYyZl2+92YYmmCiNzWQPfP6BOMlfax0AGLHls fXzCWdG0O/3Lk2SRM0I= -----END CERTIFICATE----- s -----BEGIN CERTIFICATE----- MIIC3jCCAkcCAjA6MA0GCSqGSIb3DQEBBAUAMIG2MQswCQYDVQQGEwJVUzEiMCAG A1UEAxMZZXhhbXBsZS50d2lzdGVkbWF0cml4LmNvbTEPMA0GA1UEBxMGQm9zdG9u MRwwGgYDVQQKExNUd2lzdGVkIE1hdHJpeCBMYWJzMRYwFAYDVQQIEw1NYXNzYWNo dXNldHRzMSkwJwYJKoZIhvcNAQkBFhpzb21lYm9keUB0d2lzdGVkbWF0cml4LmNv bTERMA8GA1UECxMIU2VjdXJpdHkwHhcNMDYwODE2MDEwMTU2WhcNMDcwODE2MDEw MTU2WjCBtjELMAkGA1UEBhMCVVMxIjAgBgNVBAMTGWV4YW1wbGUudHdpc3RlZG1h dHJpeC5jb20xDzANBgNVBAcTBkJvc3RvbjEcMBoGA1UEChMTVHdpc3RlZCBNYXRy aXggTGFiczEWMBQGA1UECBMNTWFzc2FjaHVzZXR0czEpMCcGCSqGSIb3DQEJARYa c29tZWJvZHlAdHdpc3RlZG1hdHJpeC5jb20xETAPBgNVBAsTCFNlY3VyaXR5MIGf MA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCnm+WBlgFNbMlHehib9ePGGDXF+Nz4 CjGuUmVBaXCRCiVjg3kSDecwqfb0fqTksBZ+oQ1UBjMcSh7OcvFXJZnUesBikGWE JE4V8Bjh+RmbJ1ZAlUPZ40bAkww0OpyIRAGMvKG+4yLFTO4WDxKmfDcrOb6ID8WJ e1u+i3XGkIf/5QIDAQABMA0GCSqGSIb3DQEBBAUAA4GBAD4Oukm3YYkhedUepBEA vvXIQhVDqL7mk6OqYdXmNj6R7ZMC8WWvGZxrzDI1bZuB+4aIxxd1FXC3UOHiR/xg i9cDl1y8P/qRp4aEBNF6rI0D4AxTbfnHQx4ERDAOShJdYZs/2zifPJ6va6YvrEyr yqDtGhklsWW3ZwBzEh5VEOUp -----END CERTIFICATE----- cKst}|jtdt}|jd|jd xM|j|jfD]3}x*|jD]\}}t |||qhWqUW|j t |j ||j |d||fS( Niii<iimtmd5iiQi3(Rt generate_keyRRtgmtime_adj_notBeforetgmtime_adj_notAftert get_issuert get_subjecttitemstsetattrtset_serial_numbertcountert set_pubkeytsign(tkwtkeypairt certificatetxnametktv((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pytmakeCertificateJs     tDataCallbackProtocolcBseZdZdZRS(cCs9|jjd}|j_|dk r5|j|ndS(N(tfactorytonDatatNonetcallback(tselftdatatd((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt dataReceived^s cCs9|jjd}|j_|dk r5|j|ndS(N(R$tonLostR&terrback(R(treasonR*((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pytconnectionLostcs (t__name__t __module__R+R/(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyR#]s tWritingProtocolcBs eZdZdZdZRS(txcCs|jj|jdS(N(t transporttwritetbyte(R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pytconnectionMadejscCs|jjj|dS(N(R$R,R-(R(R.((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyR/ms(R0R1R6R7R/(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyR2hs tOpenSSLOptionscBseZdZZdZZdZdZdZ dZ dZ dZ ddddZ dZdZdZdZdZdZd Zd Zd Zd Zd ZdZdZRS(cCsFtdddd\|_|_tdddd\|_|_dS(sK Create class variables of client and server certificates. tOsServer Test CertificatetCNtserversClient Test CertificatetclientN(R"tsKeytsCerttcKeytcCert(R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pytsetUpzs cCs|jdk r|jjn|jdk r>|jjng}|jdk rf|j|jn|jdk r|j|jntj |dt S(Nt consumeErrors( t serverPortR&t stopListeningt clientConnt disconnectt onServerLosttappendt onClientLostRt DeferredListtTrue(R(tL((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttearDownscCs|dkr"tj|_}n|dkrDtj|_}n|dkr_tj}ntj}t|_||_||_ tj }t |_||_t j d|||_t jd|jjj|||_dS(Nis 127.0.0.1(R&RtDeferredRGRIRt ServerFactoryR#R,R%t ClientFactoryR2R t listenSSLRCt connectSSLtgetHosttportRE(R(tserverCertOptstclientCertOptsRGRIR%t serverFactoryt clientFactory((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pytloopbacks            c Cs|jtjddddtjdddd|jtjddddtjddddddtjdd }|jtt|d d |j|j|j d |_|j|j|j d S(sh Check that abbreviations used in certificates correctly map to complete names. R:tatOUthellot commonNametorganizationalUnitNamet emailAddresstxxxtabcdefgtCnR3tbcdefgaN( t assertEqualst sslverifytDNtDistinguishedNametassertNotEqualst assertRaisestAttributeErrorRR:R](R(tdn((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt#test_abbreviatingDistinguishedNamess  cCstjddddddddd d d d d d}|j}x]ddddd d dgD]@}|j||d|f|j|j|d|fq^WdS(NR]s common nametorganizationNamesorganization nameR^sorganizational unit namet localityNames locality nametstateOrProvinceNamesstate or province namet countryNames country nameR_s email addresss%r was not in inspect output.(ReRftinspecttassertInttitle(R(tntsR ((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttestInspectDistinguishedNames$   cCstjdd}|j}xZddddddgD]@}|j||d |f|j|j|d |fq7W|jd||jd |dS( NRns locality names common namesorganization namesorganizational unit namesstate or province names country names email addresss%r was in inspect output.s Locality Name(ReRfRqt assertNotInRsRr(R(RtRuR ((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt,testInspectDistinguishedNameWithoutAllFieldss  $cCsttjjt}|j|jjddddddddd d d ddddddd d d d dgdS(s Test that the C{inspect} method of L{sslverify.Certificate} returns a human-readable string containing some basic information about the certificate. s sCertificate For Subject:s$ Organizational Unit Name: Securitys/ Organization Name: Twisted Matrix Labss5 Common Name: example.twistedmatrix.coms) State Or Province Name: Massachusettss Country Name: USs4 Email Address: nobody@twistedmatrix.coms" Locality Name: BostontsIssuer:sSerial Number: 12345s7Digest: C4:96:11:00:30:C3:EC:EE:A3:55:AA:ED:8C:84:85:18s6Public Key with Hash: ff33994c80812aa95a79cdb85362d054N(Ret CertificatetloadPEMtA_HOST_CERTIFICATE_PEMt assertEqualRqtsplit(R(tc((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttest_inspectCertificates0cCstjd|jd|jdtjdtd|jgdddtd td td td td t }|j}|j }|j t ||t t ||t tj}|j ||j|j|j|j|j|j|j|jtj|j|jt|j|j|jg|j|jd|j|jt|j|jt|j|jt|j|jt|j|jt|j|jtdS(sN Test that __setstate__(__getstate__()) round-trips properly. t privateKeyRtmethodtverifytcaCertst verifyDepthitrequireCertificatet verifyOncetenableSingleUseKeystenableSessionstfixBrokenPeerstenableSessionTicketsN(RetOpenSSLCertificateOptionsR=R>Rt SSLv3_METHODRKtFalset getContextt __getstate__tfailIfR R t __setstate__R}RRRRRRRRRRRR(R(t firstOptstcontexttstatetopts((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt$test_certificateOptionsSerializations>          cCs?tjdt}|j}|jd|jdd@dS(sR Enabling session tickets should not set the OP_NO_TICKET option. Rii@N(ReRRKRRdt set_options(R(Rtctx((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt%test_certificateOptionsSessionTickets)s cCs?tjdt}|j}|jd|jdd@dS(sN Enabling session tickets should set the OP_NO_TICKET option. Ri@iN(ReRRRRdR(R(RR((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt-test_certificateOptionsSessionTicketsDisabled2s csbtj}jtjdjdjdttjdtd||jfdS(sw Check that anonymous connections are allowed when certificates aren't required on the server. RRRR%csj|tjS(N(RdR2R6(tresult(R((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pytHs( RRNRYReRR=R>Rt addCallback(R(R%((R(s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt%test_allowedAnonymousClientConnection;s   c stj}tj}jtjdjdjdtdjgdttjdtd|d|tj ||gdt}fd }|j |S( st Check that anonymous connections are refused when certificates are required on the server. RRRRRRGRIRBcsh|\\}}\}}j|j|j|jtjtfj|jtjdS(N(RtassertIsInstancetvalueRtErrorR(t.0tcSuccesstcResulttsSuccesstsResult(R((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt afterLost]s   ( RRNRYReRR=R>RKRRJR(R(RGRIR*R((R(s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt%test_refusedAnonymousClientConnectionJs      c stj}tj}jtjdjdjdtdttjdtdtdj gd|d|tj ||gdt}fd }|j |S( sg Check that connecting with a certificate not accepted by the server CA fails. RRRRRRGRIRBcs6|\\}}\}}j|j|dS(N(R(RRRRR(R((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRzs ( RRNRYReRR=R>RRKR@RJR(R(RGRIR*R((R(s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt"test_failedCertificateVerificationis   c sztj}jtjdjdjdtdttjdtdtdjgd||j fdS(si Test a successful connection with client certificate validation on server side. RRRRRR%csj|tjS(N(RdR2R6(R(R((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRs( RRNRYReRR=R>RRKR(R(R%((R(s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt&test_successfulCertificateVerifications c stj}jtjdjdjdtdtdjgtjdj djdtdtdjgd||j fdS(sg Test a successful connection with validation on both server and client sides. RRRRRR%csj|tjS(N(RdR2R6(R(R((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRs( RRNRYReRR=R>RKR@R?R(R(R%((R(s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt9test_successfulSymmetricSelfSignedCertificateVerifications cs|tjdd}tjj}|j|}tjdd}tjj}|j|}|j|}|j||dd}|j|} |j|} |j|| dd} |j| } |j||dd } |j| }|j||d d }|j|}tj}|j | }|j | }j ||d ||j fd S(sT Check certificates verification building custom certificates data. R]R<R;cSstS(N(RK(Rk((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRsicSstS(N(RK(Rk((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRsicSstS(N(RK(Rk((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRsicSstS(N(RK(Rk((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRsi*R%csj|tjS(N(RdR2R6(R(R((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRs( ReRgtKeyPairtgeneratetcertificateRequesttsignCertificateRequesttnewCertificateRRNtoptionsRYR(R(tclientDNt clientKeyt clientCertReqtserverDNt serverKeyt serverCertReqtclientSelfCertReqtclientSelfCertDatatclientSelfCerttserverSelfCertReqtserverSelfCertDatatserverSelfCerttclientCertDatat clientCerttserverCertDatat serverCertR%t serverOptst clientOpts((R(s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttest_verifications8  N(R0R1R&RCRERGRIR=R>R?R@RARMRYRlRvRxRRRRRRRRRR(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyR8qs,       (     s2Reactor does not support SSL, cannot run SSL testst_NotSSLTransportcBseZdZRS(cCs|S(N((R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyt getHandles(R0R1R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRst_MaybeSSLTransportcBs#eZdZdZdZRS(cCs|S(N((R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRscCsdS(N(R&(R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pytget_peer_certificatescCsdS(N(R&(R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pytget_host_certificates(R0R1RRR(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRs  t_ActualSSLTransportcBs#eZdZdZdZRS(cCs|S(N((R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRscCstjjtjS(N(ReRzR{R|toriginal(R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRscCstjjtjS(N(ReRzR{tA_PEER_CERTIFICATE_PEMR(R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRs(R0R1RRR(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRs  t ConstructorscBs>eZdZdZdZdZdZdZRS(cCs>|jttjjt}|jt|jddS(s Verify that peerFromTransport raises an exception if the transport passed is not actually an SSL transport. snon-TLSN( RiR ReRztpeerFromTransportRt failUnlesststrt startswith(R(R3((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttest_peerFromNonSSLTransports   cCs>|jttjjt}|jt|jddS(s Verify that peerFromTransport raises an exception if the transport passed is an SSL transport, but doesn't have a peer certificate. tTLSN( RiR ReRzRRRRR(R(R3((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttest_peerFromBlankSSLTransports   cCs>|jttjjt}|jt|jddS(s Verify that hostFromTransport raises an exception if the transport passed is not actually an SSL transport. snon-TLSN( RiR ReRzthostFromTransportRRRR(R(R3((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttest_hostFromNonSSLTransports   cCs>|jttjjt}|jt|jddS(s Verify that hostFromTransport raises an exception if the transport passed is an SSL transport, but doesn't have a host certificate. RN( RiR ReRzRRRRR(R(R3((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttest_hostFromBlankSSLTransport s   cCs)|jtjjtjddS(s Verify that hostFromTransport successfully creates the correct certificate if passed a valid SSL transport. i90N(R}ReRzRRt serialNumber(R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttest_hostFromSSLTransports cCs)|jtjjtjddS(s Verify that peerFromTransport successfully creates the correct certificate if passed a valid SSL transport. i:0N(R}ReRzRRR(R(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyttest_peerFromSSLTransport!s (R0R1RRRRRR(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyRs  (-t__doc__t itertoolstOpenSSLRtOpenSSL.cryptoRRRRttwisted.internetRRet ImportErrort twisted.trialRRRR ttwisted.python.reflectR R ttwisted.pythonR ttwisted.internet.errorR RRR|RtcounttnextRR"tProtocolR#R2tTestCaseR8t IReactorSSLR&tskipRRRR(((s?/usr/lib/python2.7/dist-packages/twisted/test/test_sslverify.pyts<     ^   @