JFIF $
d d 7
Viewing File: /usr/lib/python3.9/site-packages/certbot/__pycache__/ocsp.cpython-39.opt-1.pyc
a
}|�ge< � @ s� d Z ddlmZ ddlmZ ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
Z
ddl m Z dd l
mZ dd
l
mZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlm Z ddl m Z ddl m Z e�!e"�Z#G dd� d�Z$e%e ee% ee% f d�dd�Z&e%e%e%e'e(d�dd�Z)d d e j*e%dd �d d �Z+d e j*e%dd!�d"d#�Z,e%e%e%e(d$�d%d&�Z-dS )'z*Tools for checking certificate revocation.� )�datetime)� timedeltaN)�PIPE)�Optional)�Tuple)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)�
serialization)�ocsp)� crypto_util)�errors)�util)�getenv)�
RenewableCertc @ s` e Zd ZdZdedd�dd�Zeed�dd �Zdeee ed �d d
�Z
eeeee ed�dd�Z dS )�RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.FN)� enforce_openssl_binary_usage�returnc C sr d| _ || _| jrnt�d�s0t�d� d| _ d S tjg d�ttddt� � d�}d|j
v rddd � | _ n
d
d � | _ d S ) NF�opensslz-openssl not installed, can't check revocationT)r r
�-header�var�val)�stdout�stderrZuniversal_newlines�check�envz Missing =c S s
d| gS )NzHost=� ��hostr r �0/usr/lib/python3.9/site-packages/certbot/ocsp.py�<lambda>1 � z,RevocationChecker.__init__.<locals>.<lambda>c S s d| gS )NZHostr r r r r! r" 3 r# ) �broken�use_openssl_binaryr Z
exe_exists�logger�info�
subprocess�runr Z env_no_snap_for_external_callsr � host_args)�selfr Ztest_host_formatr r r! �__init__" s
�
zRevocationChecker.__init__��certr c C s | � |j|j�S )a Get revoked status for a particular cert version.
.. todo:: Make this a non-blocking call
:param `.interfaces.RenewableCert` cert: Certificate object
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
)�ocsp_revoked_by_paths� cert_path�
chain_path)r+ r. r r r! � ocsp_revoked5 s
z RevocationChecker.ocsp_revoked�
)r0 r1 �timeoutr c C sf | j r
dS t�tj�}t�|�|kr(dS t|�\}}|r<|s@dS | jrX| � |||||�S t
||||�S )aE Performs the OCSP revocation check
:param str cert_path: Certificate filepath
:param str chain_path: Certificate chain
:param int timeout: Timeout (in seconds) for the OCSP query
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
F) r$ r �now�pytz�UTCr ZnotAfter�_determine_ocsp_serverr% �_check_ocsp_openssl_bin�_check_ocsp_cryptography)r+ r0 r1 r4 r5 �urlr r r r! r/ A s z'RevocationChecker.ocsp_revoked_by_paths)r0 r1 r r; r4 r c
C s t d�}t d�}d }|d us$|d ur4|d ur0|n|}|d u rFd|g} n&|�d�r`|td�d � }d|d|g} ddd d
|d |d |d
|ddt|�dg| �|� | }
t�d|� t�d�|
�� ztj |
tjd�\} } W n" t
j y� t� d|� Y dS 0 t
|| | �S )NZ
http_proxyZ
HTTP_PROXYz-urlzhttp://z-hostz-pathr r
z -no_noncez-issuerz-certz-CAfilez
-verify_otherz -trust_otherz-timeoutr zQuerying OCSP for %s� )�log�*OCSP check failed for %s (are we offline?)F)r �
startswith�len�strr* r& �debug�joinr Z
run_scriptr ZSubprocessErrorr' �_translate_ocsp_query)
r+ r0 r1 r r; r4 Zenv_http_proxyZenv_HTTP_PROXYZ
proxy_hostZurl_opts�cmd�output�errr r r! r9 ^ s@
��� z)RevocationChecker._check_ocsp_openssl_bin)F)r3 ) �__name__�
__module__� __qualname__�__doc__�boolr, r r2 rA �intr/ r9 r r r r! r s �r )r0 r c s� t | d��"}t�|�� t� �}W d � n1 s20 Y z:|j�tj�}tjj � � fdd�|j
D �}|d j j
}W n& tj t
fy� t�d| � Y dS 0 |�� }|�d�d �d
�}|r�||fS t�d || � dS ) z�Extract the OCSP server host from a certificate.
:param str cert_path: Path to the cert we're checking OCSP for
:rtype tuple:
:returns: (OCSP server URL or None, OCSP server host or None)
�rbNc s g | ]}|j � kr|�qS r )Z
access_method)�.0� description�Zocsp_oidr r! �
<listcomp>� s
�z*_determine_ocsp_server.<locals>.<listcomp>r z Cannot extract OCSP URI from %s)NNz://� �/z;Cannot process OCSP host from URL (%s) in certificate at %s)�openr �load_pem_x509_certificate�readr
�
extensions�get_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSP�valueZaccess_location�ExtensionNotFound�
IndexErrorr& r' �rstrip� partition)r0 � file_handlerr. � extensionZ descriptionsr; r r rQ r! r8 � s 0 r8 )r0 r1 r; r4 r c
C s. t |d��"}t�|�� t� �}W d � n1 s20 Y t | d��"}t�|�� t� �}W d � n1 sn0 Y t�� }|�||t� � �}|�
� }|� t j
j�} ztj|| ddi|d�}
W n( tjjy� tjd| dd� Y dS 0 |
jd k�r t�d
| |
j� dS t�|
j�} | jtjjk�r<t�d | | j� dS zt | ||| � W n� t �y� } zt�t | �� W Y d } ~ n�d } ~ 0 t j �y� } zt�t | �� W Y d } ~ n|d } ~ 0 t!�y� t�d | � Y nV t"�y
}
z t�d
| t |
�� W Y d }
~
n(d }
~
0 0 t�#d| | j$� | j$tj%j&kS dS )NrN z Content-Typezapplication/ocsp-request)�dataZheadersr4 r> T)�exc_infoF�� z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rU r rV rW r
r
ZOCSPRequestBuilderZadd_certificater ZSHA1ZbuildZ public_bytesr ZEncodingZDER�requestsZpost�
exceptionsZRequestExceptionr& r' Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ
SUCCESSFUL�warning�_check_ocsp_responser rA r �Errorr �AssertionErrorrB Zcertificate_statusZOCSPCertStatusZREVOKED)r0 r1 r; r4 r_ �issuerr. ZbuilderZrequestZrequest_binaryZresponse�
response_ocsp�e�errorr r r! r: � sP 0 0�
�""(�r: zocsp.OCSPResponsezocsp.OCSPRequest)rk � request_ocsp� issuer_certr0 r c C s� | j |j krtd��t| ||� t| jt|j��rJ| j|jksJ| j|jkrRtd��t� t
j �j dd�}t
�� �j t
jddd� | js�td��| j|td d
� kr�td ��| jr�| j|td d
� k r�td ��W d � n1 s�0 Y dS )
z2Verify that the OCSP is valid for several criteriazMthe certificate in response does not correspond to the certificate in requestz<the issuer does not correspond to issuer of the certificate.N)Ztzinfo�ignorez'Properties that return.*datetime object)�messagez param thisUpdate is not set.� )Zminutesz"param thisUpdate is in the future.z param nextUpdate is in the past.)Z
serial_numberri � _check_ocsp_response_signature�
isinstanceZhash_algorithm�typeZissuer_key_hashZissuer_name_hashr r5 r6 r7 �replace�warnings�catch_warnings�filterwarningsZ this_updater Z next_update)rk rn ro r0 r5 r r r! rg � s$
�
�
rg )rk ro r0 r c s" t jtd�dd�� �j|jks,�j� |�kr>t�d|� |}n�t�d|� � �fdd��jD �}|slt d��|d }|j
|jkr�t d
��z"|j � t j
�}t jjj|jv }W n t jtfy� d }Y n0 |s�t d ��|j}t�|�� |j|j|� �j}|�st d
��t�|�� �j�j|� dS )zIVerify an OCSP response signature against certificate issuer or responderr- c S s t j�| �� �jS )N)r ZSubjectKeyIdentifierZfrom_public_key�
public_keyZdigest)r. r r r! � _key_hash� s z1_check_ocsp_response_signature.<locals>._key_hashzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s* g | ]"}�j |jks"�j� |�kr|�qS r )�responder_name�subject�responder_key_hash)rO r. �r{ rk r r! rR
s �z2_check_ocsp_response_signature.<locals>.<listcomp>z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz<responder is not authorized by issuer to sign OCSP responsesz#no signature hash algorithm definedN)r � Certificate�bytesr| r} r~ r& rB Z certificatesri rj rX rY ZExtendedKeyUsageZoidZExtendedKeyUsageOIDZ OCSP_SIGNINGrZ r[ r\ Zsignature_hash_algorithmr Zverify_signed_payloadrz Z signatureZtbs_certificate_bytesZtbs_response_bytes) rk ro r0 Zresponder_certZresponder_certsr` Zdelegate_authorizedZchosen_cert_hashZchosen_response_hashr r r! rs � sD ���
��rs )r0 � ocsp_output� ocsp_errorsr c s� d}� fdd�|D �}�fdd�|D �\}}}|r<|� d�nd}d|vsT|rP|sT|rrt�d � � t�d
�|� d S |r~|s~d S |r�|� d�}|r�t�d |� d
S t�d�|� d S dS )z7Parse openssl's weird output to work out what it means.)�good�revoked�unknownc s g | ]}d � � |��qS )z{0}: (WARNING.*)?{1})�format)rO �s)r0 r r! rR : r# z)_translate_ocsp_query.<locals>.<listcomp>c 3 s | ]}t j|� t jd �V qdS ))�flagsN)�re�search�DOTALL)rO �p)r� r r! � <genexpr>; r# z(_translate_ocsp_query.<locals>.<genexpr>� NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output:
%s
stderr:
%sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s
stderr:%s)�groupr& r' rB rf ) r0 r� r� Zstates�patternsr� r� r� rf r )r0 r� r! rD 6 s&
�rD ).rK r r Zloggingr� r( r �typingr r rw Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr
Z cryptography.hazmat.primitivesr r Zcryptography.x509r
r6 rd Zcertbotr r r Zcertbot.compat.osr Zcertbot.interfacesr Z getLoggerrH r& r rA r8 rM rL r: r� rg rs rD r r r r! �<module> sD
e 1� )� :Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg