|
jpayne@7
|
1 """The match_hostname() function from Python 3.5, essential when using SSL."""
|
|
jpayne@7
|
2
|
|
jpayne@7
|
3 # Note: This file is under the PSF license as the code comes from the python
|
|
jpayne@7
|
4 # stdlib. http://docs.python.org/3/license.html
|
|
jpayne@7
|
5 # It is modified to remove commonName support.
|
|
jpayne@7
|
6
|
|
jpayne@7
|
7 from __future__ import annotations
|
|
jpayne@7
|
8
|
|
jpayne@7
|
9 import ipaddress
|
|
jpayne@7
|
10 import re
|
|
jpayne@7
|
11 import typing
|
|
jpayne@7
|
12 from ipaddress import IPv4Address, IPv6Address
|
|
jpayne@7
|
13
|
|
jpayne@7
|
14 if typing.TYPE_CHECKING:
|
|
jpayne@7
|
15 from .ssl_ import _TYPE_PEER_CERT_RET_DICT
|
|
jpayne@7
|
16
|
|
jpayne@7
|
17 __version__ = "3.5.0.1"
|
|
jpayne@7
|
18
|
|
jpayne@7
|
19
|
|
jpayne@7
|
20 class CertificateError(ValueError):
|
|
jpayne@7
|
21 pass
|
|
jpayne@7
|
22
|
|
jpayne@7
|
23
|
|
jpayne@7
|
24 def _dnsname_match(
|
|
jpayne@7
|
25 dn: typing.Any, hostname: str, max_wildcards: int = 1
|
|
jpayne@7
|
26 ) -> typing.Match[str] | None | bool:
|
|
jpayne@7
|
27 """Matching according to RFC 6125, section 6.4.3
|
|
jpayne@7
|
28
|
|
jpayne@7
|
29 http://tools.ietf.org/html/rfc6125#section-6.4.3
|
|
jpayne@7
|
30 """
|
|
jpayne@7
|
31 pats = []
|
|
jpayne@7
|
32 if not dn:
|
|
jpayne@7
|
33 return False
|
|
jpayne@7
|
34
|
|
jpayne@7
|
35 # Ported from python3-syntax:
|
|
jpayne@7
|
36 # leftmost, *remainder = dn.split(r'.')
|
|
jpayne@7
|
37 parts = dn.split(r".")
|
|
jpayne@7
|
38 leftmost = parts[0]
|
|
jpayne@7
|
39 remainder = parts[1:]
|
|
jpayne@7
|
40
|
|
jpayne@7
|
41 wildcards = leftmost.count("*")
|
|
jpayne@7
|
42 if wildcards > max_wildcards:
|
|
jpayne@7
|
43 # Issue #17980: avoid denials of service by refusing more
|
|
jpayne@7
|
44 # than one wildcard per fragment. A survey of established
|
|
jpayne@7
|
45 # policy among SSL implementations showed it to be a
|
|
jpayne@7
|
46 # reasonable choice.
|
|
jpayne@7
|
47 raise CertificateError(
|
|
jpayne@7
|
48 "too many wildcards in certificate DNS name: " + repr(dn)
|
|
jpayne@7
|
49 )
|
|
jpayne@7
|
50
|
|
jpayne@7
|
51 # speed up common case w/o wildcards
|
|
jpayne@7
|
52 if not wildcards:
|
|
jpayne@7
|
53 return bool(dn.lower() == hostname.lower())
|
|
jpayne@7
|
54
|
|
jpayne@7
|
55 # RFC 6125, section 6.4.3, subitem 1.
|
|
jpayne@7
|
56 # The client SHOULD NOT attempt to match a presented identifier in which
|
|
jpayne@7
|
57 # the wildcard character comprises a label other than the left-most label.
|
|
jpayne@7
|
58 if leftmost == "*":
|
|
jpayne@7
|
59 # When '*' is a fragment by itself, it matches a non-empty dotless
|
|
jpayne@7
|
60 # fragment.
|
|
jpayne@7
|
61 pats.append("[^.]+")
|
|
jpayne@7
|
62 elif leftmost.startswith("xn--") or hostname.startswith("xn--"):
|
|
jpayne@7
|
63 # RFC 6125, section 6.4.3, subitem 3.
|
|
jpayne@7
|
64 # The client SHOULD NOT attempt to match a presented identifier
|
|
jpayne@7
|
65 # where the wildcard character is embedded within an A-label or
|
|
jpayne@7
|
66 # U-label of an internationalized domain name.
|
|
jpayne@7
|
67 pats.append(re.escape(leftmost))
|
|
jpayne@7
|
68 else:
|
|
jpayne@7
|
69 # Otherwise, '*' matches any dotless string, e.g. www*
|
|
jpayne@7
|
70 pats.append(re.escape(leftmost).replace(r"\*", "[^.]*"))
|
|
jpayne@7
|
71
|
|
jpayne@7
|
72 # add the remaining fragments, ignore any wildcards
|
|
jpayne@7
|
73 for frag in remainder:
|
|
jpayne@7
|
74 pats.append(re.escape(frag))
|
|
jpayne@7
|
75
|
|
jpayne@7
|
76 pat = re.compile(r"\A" + r"\.".join(pats) + r"\Z", re.IGNORECASE)
|
|
jpayne@7
|
77 return pat.match(hostname)
|
|
jpayne@7
|
78
|
|
jpayne@7
|
79
|
|
jpayne@7
|
80 def _ipaddress_match(ipname: str, host_ip: IPv4Address | IPv6Address) -> bool:
|
|
jpayne@7
|
81 """Exact matching of IP addresses.
|
|
jpayne@7
|
82
|
|
jpayne@7
|
83 RFC 9110 section 4.3.5: "A reference identity of IP-ID contains the decoded
|
|
jpayne@7
|
84 bytes of the IP address. An IP version 4 address is 4 octets, and an IP
|
|
jpayne@7
|
85 version 6 address is 16 octets. [...] A reference identity of type IP-ID
|
|
jpayne@7
|
86 matches if the address is identical to an iPAddress value of the
|
|
jpayne@7
|
87 subjectAltName extension of the certificate."
|
|
jpayne@7
|
88 """
|
|
jpayne@7
|
89 # OpenSSL may add a trailing newline to a subjectAltName's IP address
|
|
jpayne@7
|
90 # Divergence from upstream: ipaddress can't handle byte str
|
|
jpayne@7
|
91 ip = ipaddress.ip_address(ipname.rstrip())
|
|
jpayne@7
|
92 return bool(ip.packed == host_ip.packed)
|
|
jpayne@7
|
93
|
|
jpayne@7
|
94
|
|
jpayne@7
|
95 def match_hostname(
|
|
jpayne@7
|
96 cert: _TYPE_PEER_CERT_RET_DICT | None,
|
|
jpayne@7
|
97 hostname: str,
|
|
jpayne@7
|
98 hostname_checks_common_name: bool = False,
|
|
jpayne@7
|
99 ) -> None:
|
|
jpayne@7
|
100 """Verify that *cert* (in decoded format as returned by
|
|
jpayne@7
|
101 SSLSocket.getpeercert()) matches the *hostname*. RFC 2818 and RFC 6125
|
|
jpayne@7
|
102 rules are followed, but IP addresses are not accepted for *hostname*.
|
|
jpayne@7
|
103
|
|
jpayne@7
|
104 CertificateError is raised on failure. On success, the function
|
|
jpayne@7
|
105 returns nothing.
|
|
jpayne@7
|
106 """
|
|
jpayne@7
|
107 if not cert:
|
|
jpayne@7
|
108 raise ValueError(
|
|
jpayne@7
|
109 "empty or no certificate, match_hostname needs a "
|
|
jpayne@7
|
110 "SSL socket or SSL context with either "
|
|
jpayne@7
|
111 "CERT_OPTIONAL or CERT_REQUIRED"
|
|
jpayne@7
|
112 )
|
|
jpayne@7
|
113 try:
|
|
jpayne@7
|
114 # Divergence from upstream: ipaddress can't handle byte str
|
|
jpayne@7
|
115 #
|
|
jpayne@7
|
116 # The ipaddress module shipped with Python < 3.9 does not support
|
|
jpayne@7
|
117 # scoped IPv6 addresses so we unconditionally strip the Zone IDs for
|
|
jpayne@7
|
118 # now. Once we drop support for Python 3.9 we can remove this branch.
|
|
jpayne@7
|
119 if "%" in hostname:
|
|
jpayne@7
|
120 host_ip = ipaddress.ip_address(hostname[: hostname.rfind("%")])
|
|
jpayne@7
|
121 else:
|
|
jpayne@7
|
122 host_ip = ipaddress.ip_address(hostname)
|
|
jpayne@7
|
123
|
|
jpayne@7
|
124 except ValueError:
|
|
jpayne@7
|
125 # Not an IP address (common case)
|
|
jpayne@7
|
126 host_ip = None
|
|
jpayne@7
|
127 dnsnames = []
|
|
jpayne@7
|
128 san: tuple[tuple[str, str], ...] = cert.get("subjectAltName", ())
|
|
jpayne@7
|
129 key: str
|
|
jpayne@7
|
130 value: str
|
|
jpayne@7
|
131 for key, value in san:
|
|
jpayne@7
|
132 if key == "DNS":
|
|
jpayne@7
|
133 if host_ip is None and _dnsname_match(value, hostname):
|
|
jpayne@7
|
134 return
|
|
jpayne@7
|
135 dnsnames.append(value)
|
|
jpayne@7
|
136 elif key == "IP Address":
|
|
jpayne@7
|
137 if host_ip is not None and _ipaddress_match(value, host_ip):
|
|
jpayne@7
|
138 return
|
|
jpayne@7
|
139 dnsnames.append(value)
|
|
jpayne@7
|
140
|
|
jpayne@7
|
141 # We only check 'commonName' if it's enabled and we're not verifying
|
|
jpayne@7
|
142 # an IP address. IP addresses aren't valid within 'commonName'.
|
|
jpayne@7
|
143 if hostname_checks_common_name and host_ip is None and not dnsnames:
|
|
jpayne@7
|
144 for sub in cert.get("subject", ()):
|
|
jpayne@7
|
145 for key, value in sub:
|
|
jpayne@7
|
146 if key == "commonName":
|
|
jpayne@7
|
147 if _dnsname_match(value, hostname):
|
|
jpayne@7
|
148 return
|
|
jpayne@7
|
149 dnsnames.append(value)
|
|
jpayne@7
|
150
|
|
jpayne@7
|
151 if len(dnsnames) > 1:
|
|
jpayne@7
|
152 raise CertificateError(
|
|
jpayne@7
|
153 "hostname %r "
|
|
jpayne@7
|
154 "doesn't match either of %s" % (hostname, ", ".join(map(repr, dnsnames)))
|
|
jpayne@7
|
155 )
|
|
jpayne@7
|
156 elif len(dnsnames) == 1:
|
|
jpayne@7
|
157 raise CertificateError(f"hostname {hostname!r} doesn't match {dnsnames[0]!r}")
|
|
jpayne@7
|
158 else:
|
|
jpayne@7
|
159 raise CertificateError("no appropriate subjectAltName fields were found")
|
