
    /$Z|(                     "   d Z ddlmZ ddlZej        dk    rexZZddlZddl	m
Z
 ddlZddlZddlZddlZddlmZmZmZmZ ddlmZ ddlZddlZdd	lmZ d
 ZdZdZdZdZdZdZ G d d          Z  G d de           Z!dZ" G d d          Z#dS )zFPythonic simple SOAP Client plugins for WebService Security extensions    )unicode_literalsN3)Decimal   )
__author____copyright____license____version__)SimpleXMLElement)sha1c                 Z    d                     d t          |           D                       S )N c              3      K   | ]A}t          j                                        t          j        t          j        z             V  Bd S N)randomSystemRandomchoicestringascii_uppercasedigits).0_s     3/usr/lib/python3/dist-packages/pysimplesoap/wsse.py	<genexpr>zrandombytes.<locals>.<genexpr>$   sD      jj\]6&((//0F0VWWjjjjjj    )joinrange)Ns    r   randombytesr   #   s-    77jjafghaiaijjjjjjr   zQhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdzRhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdz"http://www.w3.org/2000/09/xmldsig#zUhttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3z^http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binaryzahttp://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigestc                   &    e Zd ZdZddZd Zd ZdS )UsernameTokenzGWebService Security extension to add a basic credentials to xml requestr   c                     d||di| _         d S )Nwsse:UsernameToken)wsse:Usernamewsse:Password)token)selfusernamepasswords      r   __init__zUsernameToken.__init__3   s"     !)!)# #


r   c                      |d|          }d}	|	|v r||	         | _         |                    |	| j         dd           t           ||	          d<   dS )z)Add basic credentials to outgoing messageHeadernswsse:SecurityF)r.   add_children_ns
xmlns:wsseN)r&   marshallWSSE_URI)
r'   clientrequestmethodargskwargsheaderssoap_uriheaderks
             r   
preprocesszUsernameToken.preprocess;   se     h111<< DJ4:%GGG"*q		,r   c                     dS )zAnalyze incoming credentialsN )r'   r4   responser6   r7   r8   r9   r:   s           r   postprocesszUsernameToken.postprocessH   s	     	r   N)r   r   )__name__
__module____qualname____doc__r*   r=   rA   r?   r   r   r!   r!   0   sL        MM   
+ 
+ 
+    r   r!   c                        e Zd ZdZddZd ZdS )UsernameDigestTokenz
    WebService Security extension to add a http digest credentials to xml request
    drift -> time difference from the server in seconds, needed for 'Created' header
    r   r   c                 V    || _         || _        t          j        |          | _        d S )N)seconds)r(   r)   datetime	timedeltadrift)r'   r(   r)   rL   s       r   r*   zUsernameDigestToken.__init__S   s)      '666


r   c                     |d|          }|                     dd          }	t          |	d<   t          |	d<   |	                     dd          }
|
                     d| j        d           t          j                                        | j        z                                   d	z   }|
                     d
|d           t          d          }|
                     d|	                    d          d d         d          }t          |d<   t                      }|                    ||z   | j        z              |                                }|
                     d|	                    d          d d         d          }t          |d<   d S )Nr,   r-   r/   Fr1   	xmlns:wsur#   r$   Zzwsu:Created   z
wsse:Noncebase64EncodingTyper%   Type)	add_childr3   WSU_URIr(   rJ   utcnowrL   	isoformatr   encodeBase64Binary_URIr   updater)   digestPasswordDigest_URI)r'   r4   r5   r6   r7   r8   r9   r:   r;   wsse	usertokencreatednonce	wssenoncesha1objr\   r)   s                    r   r=   zUsernameDigestToken.preprocessX   sy   h111E::%\#[NN#7ENBB	OT]uEEE$++--
:EEGG#MM7u===B''ell86L6LSbS6QV['\\	$4	.!&&uw6777!!&&h8O8OPSQSPS8TY^&__-r   N)r   r   r   )rB   rC   rD   rE   r*   r=   r?   r   r   rG   rG   M   sA         
7 7 7 7
. . . . .r   rG   aZ  <?xml version="1.0" encoding="UTF-8"?>
<wsse:Security soapenv:mustUnderstand="1" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
    <wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="CertId-45851B081998E431E8132880700036719" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
%(certificate)s</wsse:BinarySecurityToken>
    <ds:Signature Id="Signature-13" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
        %(signed_info)s
        <ds:SignatureValue>%(signature_value)s</ds:SignatureValue>
        <ds:KeyInfo Id="KeyId-45851B081998E431E8132880700036720">
            <wsse:SecurityTokenReference wsu:Id="STRId-45851B081998E431E8132880700036821" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
                <wsse:Reference URI="#CertId-45851B081998E431E8132880700036719" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3"/>
            </wsse:SecurityTokenReference>
        </ds:KeyInfo>
    </ds:Signature>
</wsse:Security>
c                   .    e Zd ZdZd	dZd Zd Zd
dZdS )BinaryTokenSignaturezEWebService Security extension to add a basic signature to xml requestr   Nc                     d                     d t          |          D                       | _        || _        || _        || _        d S )Nr   c                 <    g | ]}|                     d           |S )z---)
startswith)r   lines     r   
<listcomp>z1BinaryTokenSignature.__init__.<locals>.<listcomp>   s?     $H $H $HT040F0F$HD $H $H $Hr   )r   opencertificateprivate_keyr)   cacert)r'   rl   rm   r)   rn   s        r   r*   zBinaryTokenSignature.__init__   s\    77 $H $HT+5F5F $H $H $H I I& r   c                     |d|          } |d|          }	d|d<   t           |d<   |dd         D ]\  }
}|
                    d          r|||
<    t          |          }d	d
lm} |                    |d| j        | j                  }| j        |d<   t          t          |z            }|	                    |           dS )zSign the outgoing SOAP requestBodyr-   r,   zid-14wsu:IdrN   Nxmlnsr   xmlsecz#id-14rl   )rV   rh   reprr   rt   rsa_signrm   r)   rl   r   BIN_TOKEN_TMPLimport_node)r'   r4   r5   r6   r7   r8   r9   r:   bodyr;   attrvalueref_xmlrt   varsr^   s                   r   r=   zBinaryTokenSignature.preprocess   s     wv(---h111 X#["111: 	# 	#KD%w'' #"T
t**w#/@ @".] 5664     r   c                    ddl m}  |d|          }	 |d|          }
 |
dt                    } |dt                    }|                     |d         t                     |                     |d	         t
                     t          |                              d
          }|                    |d          }| j	        st          j        d           n,|                    | j	        |d          st          d          |                     |	d         t                     |	d         } |dt                    } |dt                    } |dt                    }|                      |dt                    d         d|z              |                      |dt                    d         t          dz              |                       |dt                    dt                    d         t          dz              |dd         D ]\  }}|                    d          r||	|<    |                    t%          |	                    }|                    |          }t            |dt                    dt                              }||k    rt          d          t          |d<   t%          |          }|                    |t          |          |          }|st          d           dS )!z-Verify the signature of the incoming responser   rs   rp   r-   r,   SecurityBinarySecurityTokenrS   	ValueTyperQ   T)binaryz/No CA provided, WSSE not validating certificatez"WSSE certificate validation failedrN   rq   	Signature
SignedInfoSignatureValue	ReferenceURI#SignatureMethod	Algorithmzrsa-sha1DigestMethodr   Nrr   DigestValuezWSSE SHA1 hash digests mismatchz+WSSE RSA-SHA1 signature verification failed)r   rt   r3   _BinaryTokenSignature__checkrZ   
X509v3_URIstrdecodex509_extract_rsa_public_keyrn   warningswarnx509_verifyRuntimeErrorrV   XMLDSIG_URIrh   canonicalizeru   sha1_hash_digest
rsa_verify)r'   r4   r@   r6   r7   r8   r9   r:   rt   ry   r;   r^   certcert_der
public_keyref_uri	signaturesigned_infosignature_valuerz   r{   r|   computed_hashdigest_valuexmloks                             r   rA   z BinaryTokenSignature.postprocess   s%   x8...(x222vjX...t)h777T.)+;<<<T+&
333t99##H--777NN
{ 	EMKLLLL##DK$#GG 	ECDDDT+&000x.D555	i===#)$4EEE[[===eDcGmTTT[[!2{CCCKP :-	/ 	/ 	/=[[===nQ\]]]^ij 6)	+ 	+ 	+ $AAA; 	# 	#KD%w'' #"T
%%d4jj110099C;;{{CCCMVabbbccL((@AAA*G;sC$8$8*EE 	NLMMM	N 	Nr   WSSE sanity check failedc                 0    ||k    rt          |          d S r   )r   )r'   r{   expectedmsgs       r   __checkzBinaryTokenSignature.__check   s#    Hs### r   )r   r   NN)r   )rB   rC   rD   rE   r*   r=   rA   r   r?   r   r   re   re      sd        KK   ! ! !.1N 1N 1Nh$ $ $ $ $ $r   re   )$rE   
__future__r   sysversionr   
basestringunicoderJ   decimalr   oslogginghashlibr   r   r   r   r	   r
   	simplexmlr   r   r   r   r   r3   rV   r   r   rZ   r]   r!   rG   rw   re   r?   r   r   <module>r      s   M L ( ' ' ' ' ' 



;J        				    A A A A A A A A A A A A ' ' ' ' ' '        k k k
 _
^2d
s x        :. . . . .- . . .D X$ X$ X$ X$ X$ X$ X$ X$ X$ X$r   