session.py 文件源码

def _get_client_identity(self):
        certificate_data = self._connection.getpeercert(binary_form=True)
        try:
            certificate = x509.load_der_x509_certificate(
                certificate_data,
                backends.default_backend()
            )
        except Exception:
            # This should never get raised "in theory," as the ssl socket
            # should fail to connect non-TLS connections before the session
            # gets created. This is a failsafe in case that protection fails.
            raise exceptions.PermissionDenied(
                "Failure loading the client certificate from the session "
                "connection. Could not retrieve client identity."
            )

        try:
            extended_key_usage = certificate.extensions.get_extension_for_oid(
                x509.oid.ExtensionOID.EXTENDED_KEY_USAGE
            ).value
        except x509.ExtensionNotFound:
            raise exceptions.PermissionDenied(
                "The extended key usage extension is missing from the client "
                "certificate. Session client identity unavailable."
            )

        if x509.oid.ExtendedKeyUsageOID.CLIENT_AUTH in extended_key_usage:
            client_identities = certificate.subject.get_attributes_for_oid(
                x509.oid.NameOID.COMMON_NAME
            )
            if len(client_identities) > 0:
                if len(client_identities) > 1:
                    self._logger.warning(
                        "Multiple client identities found. Using the first "
                        "one processed."
                    )
                client_identity = client_identities[0].value
                self._logger.info(
                    "Session client identity: {0}".format(client_identity)
                )
                return client_identity
            else:
                raise exceptions.PermissionDenied(
                    "The client certificate does not define a subject common "
                    "name. Session client identity unavailable."
                )

        raise exceptions.PermissionDenied(
            "The extended key usage extension is not marked for client "
            "authentication in the client certificate. Session client "
            "identity unavailable."
        )