/usr/lib/python2.7/dist-packages/tlslite/checker.py is in python-tlslite-ng 0.7.4-1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 | # Author: Trevor Perrin
# See the LICENSE file for legal information regarding use of this file.
"""Class for post-handshake certificate checking."""
from .x509 import X509
from .x509certchain import X509CertChain
from .errors import *
class Checker(object):
"""
This class is passed to a handshake function to check the other
party's certificate chain.
If a handshake function completes successfully, but the Checker
judges the other party's certificate chain to be missing or
inadequate, a subclass of
:py:class:`tlslite.errors.TLSAuthenticationError`
will be raised.
Currently, the Checker can check an X.509 chain.
"""
def __init__(self,
x509Fingerprint=None,
checkResumedSession=False):
"""
Create a new Checker instance.
You must pass in one of these argument combinations:
- x509Fingerprint
:param str x509Fingerprint: A hex-encoded X.509 end-entity
fingerprint which the other party's end-entity certificate must
match.
:param bool checkResumedSession: If resumed sessions should be
checked. This defaults to False, on the theory that if the
session was checked once, we don't need to bother
re-checking it.
"""
self.x509Fingerprint = x509Fingerprint
self.checkResumedSession = checkResumedSession
def __call__(self, connection):
"""Check a TLSConnection.
When a Checker is passed to a handshake function, this will
be called at the end of the function.
:param tlslite.tlsconnection.TLSConnection connection: The
TLSConnection to examine.
:raises tlslite.errors.TLSAuthenticationError: If the other
party's certificate chain is missing or bad.
"""
if not self.checkResumedSession and connection.resumed:
return
if self.x509Fingerprint:
if connection._client:
chain = connection.session.serverCertChain
else:
chain = connection.session.clientCertChain
if self.x509Fingerprint:
if isinstance(chain, X509CertChain):
if self.x509Fingerprint:
if chain.getFingerprint() != self.x509Fingerprint:
raise TLSFingerprintError(\
"X.509 fingerprint mismatch: %s, %s" % \
(chain.getFingerprint(), self.x509Fingerprint))
elif chain:
raise TLSAuthenticationTypeError()
else:
raise TLSNoAuthenticationError()
|