§
    ®/$Z|(  ã                   ó"  — d Z ddlmZ ddlZej        dk    rexZZddlZddl	m
Z
 ddlZddlZddlZddlZddlmZmZmZmZ ddlmZ ddlZddlZdd	lmZ d
„ ZdZdZdZdZdZdZ G d„ d¦  «        Z  G d„ de ¦  «        Z!dZ" G d„ d¦  «        Z#dS )zFPythonic simple SOAP Client plugins for WebService Security extensionsé    )Úunicode_literalsNÚ3)ÚDecimalé   )Ú
__author__Ú__copyright__Ú__license__Ú__version__)ÚSimpleXMLElement)Úsha1c                 óZ   — d                      d„ t          | ¦  «        D ¦   «         ¦  «        S )NÚ c              3   ó�   K  — | ]A}t          j        ¦   «                              t          j        t          j        z   ¦  «        V — ŒBd S ©N)ÚrandomÚSystemRandomÚchoiceÚstringÚascii_uppercaseÚdigits)Ú.0Ú_s     ú3/usr/lib/python3/dist-packages/pysimplesoap/wsse.pyú	<genexpr>zrandombytes.<locals>.<genexpr>$   sD   è è € ÐjÐjÐ\]•6Ô&Ñ(Ô(×/Ò/µÔ0FÍÌÑ0VÑWÔWÐjÐjÐjÐjÐjÐjó    )ÚjoinÚrange)ÚNs    r   Úrandombytesr   #   s-   € Ø�7Š7ÐjÐjÕafÐghÑaiÔaiÐjÑjÔjÑjÔjÐjr   zQhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdzRhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdz"http://www.w3.org/2000/09/xmldsig#zUhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3z^http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binaryzahttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigestc                   ó&   — e Zd ZdZdd„Zd„ Zd„ ZdS )ÚUsernameTokenzGWebService Security extension to add a basic credentials to xml requestr   c                 ó   — d||dœi| _         d S )Núwsse:UsernameToken)úwsse:Usernameúwsse:Password)Útoken)ÚselfÚusernameÚpasswords      r   Ú__init__zUsernameToken.__init__3   s"   € à Ø!)Ø!)ð#ð #ðˆŒ
ˆ
ˆ
r   c                 ó¨   —  |d|¬¦  «        }d}	|	|v r||	         | _         |                     |	| j         dd¬¦  «         t           ||	¦  «        d<   dS )z)Add basic credentials to outgoing messageÚHeader©Únsúwsse:SecurityF)r.   Úadd_children_nsú
xmlns:wsseN)r&   ÚmarshallÚWSSE_URI)
r'   ÚclientÚrequestÚmethodÚargsÚkwargsÚheadersÚsoap_uriÚheaderÚks
             r   Ú
preprocesszUsernameToken.preprocess;   se   € ð �˜ hÐ1Ñ1Ô1ˆØˆà�ˆ<ˆ<Ø  œˆDŒJà�Š˜˜4œ:¨%ÀˆÑGÔGÐGÝ"*ˆˆˆq‰	Œ	�,ÑÐÐr   c                 ó   — dS )zAnalyze incoming credentialsN© )r'   r4   Úresponser6   r7   r8   r9   r:   s           r   ÚpostprocesszUsernameToken.postprocessH   s	   € ð 	ˆr   N)r   r   )Ú__name__Ú
__module__Ú__qualname__Ú__doc__r*   r=   rA   r?   r   r   r!   r!   0   sL   € € € € € ØMÐMðð ð ð ð
+ð 
+ð 
+ðð ð ð ð r   r!   c                   ó    — e Zd ZdZdd„Zd„ ZdS )ÚUsernameDigestTokenz¬
    WebService Security extension to add a http digest credentials to xml request
    drift -> time difference from the server in seconds, needed for 'Created' header
    r   r   c                 óV   — || _         || _        t          j        |¬¦  «        | _        d S )N)Úseconds)r(   r)   ÚdatetimeÚ	timedeltaÚdrift)r'   r(   r)   rL   s       r   r*   zUsernameDigestToken.__init__S   s)   € Ø ˆŒØ ˆŒÝÔ'°Ð6Ñ6Ô6ˆŒ
ˆ
ˆ
r   c                 ó  —  |d|¬¦  «        }|                      dd¬¦  «        }	t          |	d<   t          |	d<   |	                      dd¬¦  «        }
|
                      d| j        d¬¦  «         t          j                             ¦   «         | j        z                        ¦   «         d	z   }|
                      d
|d¬¦  «         t          d¦  «        }|
                      d| 	                    d¦  «        d d…         d¬¦  «        }t          |d<   t          ¦   «         }|                     ||z   | j        z   ¦  «         |                     ¦   «         }|
                      d| 	                    d¦  «        d d…         d¬¦  «        }t          |d<   d S )Nr,   r-   r/   Fr1   ú	xmlns:wsur#   r$   ÚZzwsu:Createdé   z
wsse:NonceÚbase64éÿÿÿÿÚEncodingTyper%   ÚType)Ú	add_childr3   ÚWSU_URIr(   rJ   ÚutcnowrL   Ú	isoformatr   ÚencodeÚBase64Binary_URIr   Úupdater)   ÚdigestÚPasswordDigest_URI)r'   r4   r5   r6   r7   r8   r9   r:   r;   ÚwsseÚ	usertokenÚcreatedÚnonceÚ	wssenonceÚsha1objr\   r)   s                    r   r=   zUsernameDigestToken.preprocessX   sy  € Ø�˜ hÐ1Ñ1Ô1ˆØ×Ò °EÐÑ:Ô:ˆÝ%ˆˆ\ÑÝ#ˆˆ[Ñà—N’NÐ#7¸E�NÑBÔBˆ	Ø×Ò˜O¨T¬]¸uÐÑEÔEÐEåÔ$×+Ò+Ñ-Ô-°´
Ñ:×EÒEÑGÔGÈ#ÑMˆØ×Ò˜M¨7°uÐÑ=Ô=Ð=å˜B‘”ˆØ×'Ò'¨°e·l²lÀ8Ñ6LÔ6LÈSÈbÈSÔ6QÐV[Ð'Ñ\Ô\ˆ	Ý$4ˆ	�.Ñ!å‘&”&ˆØ�Š�u˜w‘¨¬Ñ6Ñ7Ô7Ð7Ø—’Ñ!Ô!ˆØ×&Ò& ¸¿ºÀhÑ8OÔ8OÐPSÐQSÐPSÔ8TÐY^Ð&Ñ_Ô_ˆÝ-ˆ�ÑÐÐr   N)r   r   r   )rB   rC   rD   rE   r*   r=   r?   r   r   rG   rG   M   sA   € € € € € ðð ð
7ð 7ð 7ð 7ð
.ð .ð .ð .ð .r   rG   aZ  <?xml version="1.0" encoding="UTF-8"?>
<wsse:Security soapenv:mustUnderstand="1" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="CertId-45851B081998E431E8132880700036719" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
%(certificate)s</wsse:BinarySecurityToken>
    <ds:Signature Id="Signature-13" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        %(signed_info)s
        <ds:SignatureValue>%(signature_value)s</ds:SignatureValue>
        <ds:KeyInfo Id="KeyId-45851B081998E431E8132880700036720">
            <wsse:SecurityTokenReference wsu:Id="STRId-45851B081998E431E8132880700036821" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
                <wsse:Reference URI="#CertId-45851B081998E431E8132880700036719" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
            </wsse:SecurityTokenReference>
        </ds:KeyInfo>
    </ds:Signature>
</wsse:Security>
c                   ó.   — e Zd ZdZd	d„Zd„ Zd„ Zd
d„ZdS )ÚBinaryTokenSignaturezEWebService Security extension to add a basic signature to xml requestr   Nc                 ó’   — d                      d„ t          |¦  «        D ¦   «         ¦  «        | _        || _        || _        || _        d S )Nr   c                 ó<   — g | ]}|                      d ¦  «        °|‘ŒS )z---)Ú
startswith)r   Úlines     r   ú
<listcomp>z1BinaryTokenSignature.__init__.<locals>.<listcomp>„   s?   € ð $Hð $Hð $H¨TØ04·²ÀÑ0FÔ0Fð$H Dð $Hð $Hð $Hr   )r   ÚopenÚcertificateÚprivate_keyr)   Úcacert)r'   rl   rm   r)   rn   s        r   r*   zBinaryTokenSignature.__init__‚   s\   € àŸ7š7ð $Hð $HµT¸+Ñ5FÔ5Fð $Hñ $Hô $Hñ Iô IˆÔà&ˆÔØ ˆŒØˆŒˆˆr   c                 ó†  —  |d|¬¦  «        } |d|¬¦  «        }	d|d<   t           |d<   |dd…         D ]\  }
}|
                     d¦  «        r|||
<   Œ t          |¦  «        }d	d
lm} |                     |d| j        | j        ¦  «        }| j        |d<   t          t          |z  ¦  «        }|	                     |¦  «         dS )zSign the outgoing SOAP requestÚBodyr-   r,   zid-14úwsu:IdrN   NÚxmlnsr   ©Úxmlsecz#id-14rl   )rV   rh   Úreprr   rt   Úrsa_signrm   r)   rl   r   ÚBIN_TOKEN_TMPLÚimport_node)r'   r4   r5   r6   r7   r8   r9   r:   Úbodyr;   ÚattrÚvalueÚref_xmlrt   Úvarsr^   s                   r   r=   zBinaryTokenSignature.preprocessŠ   sñ   € ð ˆw�v (Ð-Ñ-Ô-ˆØ�˜ hÐ1Ñ1Ô1ˆà ˆˆX‰Ý#ˆˆ[Ñà" 1 1 1œ:ð 	#ð 	#‰KˆD�%Ø�Š˜wÑ'Ô'ð #Ø"��T‘
øå�t‘*”*ˆàÐÐÐÐÐØ�Š˜w¨Ø#Ô/°´ñ@ô @ˆà"Ô.ˆˆ]Ñå¥°Ñ 5Ñ6Ô6ˆØ×Ò˜4Ñ Ô Ð Ð Ð r   c                 ó  — ddl m}  |d|¬¦  «        }	 |d|¬¦  «        }
 |
dt          ¬¦  «        } |dt          ¬¦  «        }|                      |d         t          ¦  «         |                      |d	         t
          ¦  «         t          |¦  «                             d
¦  «        }|                     |d¬¦  «        }| j	        st          j        d¦  «         n,|                     | j	        |d¬¦  «        st          d¦  «        ‚|                      |	d         t          ¦  «         |	d         } |dt          ¬¦  «        } |dt          ¬¦  «        } |dt          ¬¦  «        }|                       |dt          ¬¦  «        d         d|z   ¦  «         |                       |dt          ¬¦  «        d         t          dz   ¦  «         |                        |dt          ¬¦  «        dt          ¬¦  «        d         t          dz   ¦  «         |dd…         D ]\  }}|                     d¦  «        r||	|<   Œ |                     t%          |	¦  «        ¦  «        }|                     |¦  «        }t            |dt          ¬¦  «        dt          ¬¦  «        ¦  «        }||k    rt          d¦  «        ‚t          |d<   t%          |¦  «        }|                     |t          |¦  «        |¦  «        }|st          d ¦  «        ‚dS )!z-Verify the signature of the incoming responser   rs   rp   r-   r,   ÚSecurityÚBinarySecurityTokenrS   Ú	ValueTyperQ   T)Úbinaryz/No CA provided, WSSE not validating certificatez"WSSE certificate validation failedrN   rq   Ú	SignatureÚ
SignedInfoÚSignatureValueÚ	ReferenceÚURIú#ÚSignatureMethodÚ	Algorithmzrsa-sha1ÚDigestMethodr   Nrr   ÚDigestValuezWSSE SHA1 hash digests mismatchz+WSSE RSA-SHA1 signature verification failed)r   rt   r3   Ú_BinaryTokenSignature__checkrZ   Ú
X509v3_URIÚstrÚdecodeÚx509_extract_rsa_public_keyrn   ÚwarningsÚwarnÚx509_verifyÚRuntimeErrorrV   ÚXMLDSIG_URIrh   Úcanonicalizeru   Úsha1_hash_digestÚ
rsa_verify)r'   r4   r@   r6   r7   r8   r9   r:   rt   ry   r;   r^   ÚcertÚcert_derÚ
public_keyÚref_uriÚ	signatureÚsigned_infoÚsignature_valuerz   r{   r|   Úcomputed_hashÚdigest_valueÚxmlÚoks                             r   rA   z BinaryTokenSignature.postprocess¡   s%  € àÐÐÐÐÐàˆx˜ 8Ð.Ñ.Ô.ˆØ�˜( xÐ2Ñ2Ô2ˆØˆv�j¥XÐ.Ñ.Ô.ˆØˆtÐ)­hÐ7Ñ7Ô7ˆà�Š�T˜.Ô)Õ+;Ñ<Ô<Ð<Ø�Š�T˜+Ô&­
Ñ3Ô3Ð3å�t‘9”9×#Ò# HÑ-Ô-ˆØ×7Ò7¸ÈÐ7ÑNÔNˆ
àŒ{ð 	EÝŒMÐKÑLÔLÐLÐLØ×#Ò# D¤K°À$Ð#ÑGÔGð 	EÝÐCÑDÔDÐDà�Š�T˜+Ô&­Ñ0Ô0Ð0Ø�x”.ˆØ�D˜­Ð5Ñ5Ô5ˆ	Ø�i µÐ=Ñ=Ô=ˆØ#˜)Ð$4½ÐEÑEÔEˆà�Š�[�[ µÐ=Ñ=Ô=¸eÔDÀcÈGÁmÑTÔTÐTØ�Š�[�[Ð!2µ{ÐCÑCÔCÀKÔPÝ  :Ñ-ñ	/ô 	/ð 	/à�ŠÐ=�[�[ µÐ=Ñ=Ô=¸nÕQ\Ð]Ñ]Ô]Ð^iÔjÝ  6Ñ)ñ	+ô 	+ð 	+ð $ A A Aœ;ð 	#ð 	#‰KˆD�%Ø�Š˜wÑ'Ô'ð #Ø"��T‘
øà×%Ò%¥d¨4¡j¤jÑ1Ô1ˆà×0Ò0°Ñ9Ô9ˆÝÐC˜;˜; {µ{ÐCÑCÔCÀMÕVaÐbÑbÔbÑcÔcˆØ˜LÒ(Ð(ÝÐ@ÑAÔAÐAå*ˆ�GÑÝ�;ÑÔˆà×Ò˜s¥C¨Ñ$8Ô$8¸*ÑEÔEˆØð 	NÝÐLÑMÔMÐMð	Nð 	Nr   úWSSE sanity check failedc                 ó0   — ||k    rt          |¦  «        ‚d S r   )r•   )r'   r{   ÚexpectedÚmsgs       r   Ú__checkzBinaryTokenSignature.__checkÕ   s#   € Ø�HÒÐÝ˜sÑ#Ô#Ð#ð Ðr   )r   r   NN)r¥   )rB   rC   rD   rE   r*   r=   rA   r�   r?   r   r   re   re      sd   € € € € € ØKÐKðð ð ð ð!ð !ð !ð.1Nð 1Nð 1Nðh$ð $ð $ð $ð $ð $r   re   )$rE   Ú
__future__r   ÚsysÚversionr�   Ú
basestringÚunicoderJ   Údecimalr   ÚosÚloggingÚhashlibr’   r   r   r   r	   r
   Ú	simplexmlr   r   r   r   r   r3   rV   r–   rŽ   rZ   r]   r!   rG   rw   re   r?   r   r   ú<module>r´      s¦  ðð MÐ Lð (Ð 'Ð 'Ð 'Ð 'Ð 'Ø 
€
€
€
Ø„;�ÒÐØÐ€J�à €€€Ø Ð Ð Ð Ð Ð Ø 	€	€	€	Ø €€€Ø €€€Ø €€€à AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AÐ AØ 'Ð 'Ð 'Ð 'Ð 'Ð 'à €€€Ø €€€Ø Ð Ð Ð Ð Ð ðkð kð kð
 _€Ø
^€Ø2€Ød€
ØsÐ ØxÐ ðð ð ð ð ñ ô ð ð:.ð .ð .ð .ð .˜-ñ .ô .ð .ðD€ð X$ð X$ð X$ð X$ð X$ñ X$ô X$ð X$ð X$ð X$r   