gdata.tlslite.Checker | index /build/buildd/python-gdata-2.0.18+dfsg/src/gdata/tlslite/Checker.py

`Class for post-handshake certificate checking.`

Classes

``

Checker

class Checker

``

`This class is passed to a handshake function to check the other
party's certificate chain.
If a handshake function completes successfully, but the Checker
judges the other party's certificate chain to be missing or
inadequate, a subclass of
L{tlslite.errors.TLSAuthenticationError} will be raised.
Currently, the Checker can check either an X.509 or a cryptoID
chain (for the latter, cryptoIDlib must be installed).
`

Methods defined here:

__call__(self, connection)
  `Check a TLSConnection.
  When a Checker is passed to a handshake function, this will
  be called at the end of the function.
  @type connection: L{tlslite.TLSConnection.TLSConnection}
  @param connection: The TLSConnection to examine.
  @raise tlslite.errors.TLSAuthenticationError: If the other
  party's certificate chain is missing or bad.`

__init__(self, cryptoID=None, protocol=None, x509Fingerprint=None, x509TrustList=None, x509CommonName=None, checkResumedSession=False)
  `Create a new Checker instance.
  You must pass in one of these argument combinations:
  - cryptoID[, protocol] (requires cryptoIDlib)
  - x509Fingerprint
  - x509TrustList[, x509CommonName] (requires cryptlib_py)
  @type cryptoID: str
  @param cryptoID: A cryptoID which the other party's certificate
  chain must match. The cryptoIDlib module must be installed.
  Mutually exclusive with all of the 'x509...' arguments.
  @type protocol: str
  @param protocol: A cryptoID protocol URI which the other
  party's certificate chain must match. Requires the 'cryptoID'
  argument.
  @type x509Fingerprint: str
  @param x509Fingerprint: A hex-encoded X.509 end-entity
  fingerprint which the other party's end-entity certificate must
  match. Mutually exclusive with the 'cryptoID' and
  'x509TrustList' arguments.
  @type x509TrustList: list of L{tlslite.X509.X509}
  @param x509TrustList: A list of trusted root certificates. The
  other party must present a certificate chain which extends to
  one of these root certificates. The cryptlib_py module must be
  installed. Mutually exclusive with the 'cryptoID' and
  'x509Fingerprint' arguments.
  @type x509CommonName: str
  @param x509CommonName: The end-entity certificate's 'CN' field
  must match this value. For a web server, this is typically a
  server name such as 'www.amazon.com'. Mutually exclusive with
  the 'cryptoID' and 'x509Fingerprint' arguments. Requires the
  'x509TrustList' argument.
  @type checkResumedSession: bool
  @param checkResumedSession: If resumed sessions should be
  checked. This defaults to False, on the theory that if the
  session was checked once, we don't need to bother
  re-checking it.`