/usr/share/cagefs-skeleton/lib/python3.9/site-packages/certbot/__pycache__
a }|�g�] � @ s` d Z ddlZddlZddlZddlZddlZddlmZ ddlmZ ddlm Z ddlm Z ddlm Z ddlm Z dd l mZ dd lmZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl m Z ddl m Z ddl m Z ddl!m"Z" ddl#m$Z$ ddl#m%Z% ddl#m&Z& ddl'Z'ddl(m)Z) ddl(m*Z* ddl+m,Z- dd l.m/Z/ dd l.m0Z0 dd l.m1Z1 dd l2m3Z3 e �r�dd l4m5Z5 dd!l6m7Z7 dd"l8m9Z9 dd#l:m;Z; e�<e=�Z>doe?ee@ e@e@e@eAe1jBd(�d)d*�ZCdpe1jBe ee@ e e@ f ee@ eAeAe1jDd,�d-d.�ZEeFeAd/�d0d1�ZGeFeFeAd2�d3d4�ZHe@eFe e-jIe1jDee@ f d5�d6d7�ZJdqe?e@ee@ eFd9�d:d;�ZKe e@eFf eAd<�d=d>�ZLe0jMdd?�d@dA�ZNe0jMdd?�dBdC�ZOe edDdEe e"dFdGf eFeFejPddH�dIdJ�ZQe@e@ddK�dLdM�ZRe0jMdd?�dNdO�ZSeFe e)jTe?f dP�dQdR�ZUe-jIjVfeFe e-jIe?f ee@ dS�dTdU�ZWe-jIjVfeFe e-jIe?f ee@ dS�dVdW�ZXe-jIjVfeFe e-jIe?f ee@ dX�dYdZ�ZYe-jIjVfe ee)jT ee'jZ f e e-jIe?f eFd[�d\d]�Z[e@ejd^�d_d`�Z\e@ejd^�dadb�Z]e@e@dc�ddde�Z^e�_dfej`�Zae@e e@e@f dg�dhdi�Zbe@e?d^�djdk�Zcdree@ e@eAe@dl�dmdn�ZddS )sz�Certbot client crypto utility functions. .. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server is capable of handling the signatures. � N)�List)�Optional)�Set)�Tuple)� TYPE_CHECKING)�Union)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)� serialization)�ec)�rsa)� DSAPublicKey)�ECDSA)�EllipticCurvePublicKey)�PKCS1v15)� RSAPublicKey)�Encoding)� NoEncryption)� PrivateFormat)�crypto)�SSL)� crypto_util)�errors)� interfaces)�util)�os)�Ed448PublicKey)�Ed25519PublicKey)� X448PublicKey)�X25519PublicKeyr � secp256r1�key-certbot.pemT)�key_size�key_dir�key_type�elliptic_curve�keyname�strict_permissions�returnc C s� zt | |p d|d�}W nF ty\ } z.tjddd� t�dt|�� |�W Y d}~n d}~0 0 d}|r�t�|d|� t�t j � ||�d d �\} }| � | � |� W d � n1 s�0 Y |d kr�t�d | |� nt�d | |� t� ||�S )a$ Initializes and saves a privkey. Inits key and saves it in PEM format on the filesystem. .. note:: keyname is the attempted filename, it may be different if a file already exists at the path. :param int key_size: key size in bits if key size is rsa. :param str key_dir: Optional key save directory. :param str key_type: Key Type [rsa, ecdsa] :param str elliptic_curve: Name of the elliptic curve if key type is ecdsa. :param str keyname: Filename of key :param bool strict_permissions: If true and key_dir exists, an exception is raised if the directory doesn't have 0700 permissions or isn't owned by the current user. :returns: Key :rtype: :class:`certbot.util.Key` :raises ValueError: If unable to generate the key given key_size. r# )�bitsr( r' � T��exc_infoz&Encountered error while making key: %sNi� i� �wbr z Generating RSA key (%d bits): %sz"Generating ECDSA key (%d bits): %s)�make_key� ValueError�logger�debug�error�strr �make_or_verify_dir� unique_filer �path�join�write�Key) r% r& r' r( r) r* Zkey_pem�err�key_pathZkey_f� r? �7/usr/lib/python3.9/site-packages/certbot/crypto_util.py� generate_key9 s( � �(rA F)�privkey�namesr9 � must_stapler* r+ c C s� t j| j||d�}d}|r~t�|d|� t�tj�|d�dd�\}}|� |� |� W d � n1 sh0 Y t � d|� t� ||d�S ) aC Initialize a CSR with the given private key. :param privkey: Key to include in the CSR :type privkey: :class:`certbot.util.Key` :param set names: `str` names to include in the CSR :param str path: Optional certificate save directory. :param bool must_staple: If true, include the TLS Feature extension "OCSP Must-Staple" :param bool strict_permissions: If true and path exists, an exception is raised if the directory doesn't have 0755 permissions or isn't owned by the current user. :returns: CSR :rtype: :class:`certbot.util.CSR` )rD Ni� zcsr-certbot.pemi� r0 zCreating CSR: %s�pem) �acme_crypto_utilZmake_csrrE r r7 r8 r r9 r: r; r3 r4 �CSR)rB rC r9 rD r* Zcsr_pemZ csr_filenameZcsr_fr? r? r@ � generate_csrj s ��( rH )�csrr+ c C s> zt �| �}|jW S ttfy8 tjddd� Y dS 0 dS )z�Validate CSR. Check if `csr` is a valid CSR with a correct self-signed signature. :param bytes csr: CSR in PEM. :returns: Validity of CSR. :rtype: bool r- Tr. FN)r �load_pem_x509_csr�is_signature_validr2 � TypeErrorr3 r4 )rI �reqr? r? r@ � valid_csr� s rN )rI rB r+ c C sN t �| �}tj|dd�}|joL|�� �tjjtj j �|�� �tjjtj j �kS )z�Does private key correspond to the subject public key in the CSR? :param bytes csr: CSR in PEM. :param bytes privkey: Private key file contents (PEM) :returns: Correspondence of private key to CSR subject public key. :rtype: bool N��password) r rJ r �load_pem_private_keyrK � public_key� public_bytesr �DERZ PublicFormatZSubjectPublicKeyInfo)rI rB rM Zpkeyr? r? r@ �csr_matches_pubkey� s � ��rU )�csrfile�datar+ c C s� zt �|�}W nD tyR zt �|�}W n" tyL t�d�| ���Y n0 Y n0 t�|j |j �}|� t j j�}tjjtj| |dd�|fS )a9 Import a CSR file, which can be either PEM or DER. :param str csrfile: CSR filename :param bytes data: contents of the CSR file :returns: (`acme_crypto_util.Format.PEM`, util.CSR object representing the CSR, list of domains requested in the CSR) :rtype: tuple z Failed to parse CSR file: {0}rE )�filerW Zform)r �load_der_x509_csrr2 rJ r �Error�formatrF �%get_names_from_subject_and_extensions�subject� extensionsrS r r �PEM�Formatr rG )rV rW rI ZdomainsZdata_pemr? r? r@ �import_csr_file� s �ra � )r, r' r( r+ c C s |dkr0| dk r t �d�| ���tjd| d�}n�|dkr�|sFt �d��zZ|�� }|dv r�tt|�� �}|szt �d |� ���tj|� t� d �}nt �d �|���W nT t y� t �d �|���Y n4 t y� } z |t �t |���W Y d }~n d }~0 0 nt �d �|���|j t jtjt� d�S )a� Generate PEM encoded RSA|EC key. :param int bits: Number of bits if key_type=rsa. At least 2048 for RSA. :param str key_type: The type of key to generate, but be rsa or ecdsa :param str elliptic_curve: The elliptic curve to use. :returns: new RSA or ECDSA key in PEM form with specified number of bits or of type ec_curve when key_type ecdsa is used. :rtype: str r rb z Unsupported RSA key length: {}i )Zpublic_exponentr% Zecdsaz3When key_type == ecdsa, elliptic_curve must be set.)Z SECP256R1Z SECP384R1Z SECP521R1zInvalid curve type: )�curveZbackendz Unsupported elliptic curve: {}Nz0Invalid key_type specified: {}. Use [rsa|ecdsa])�encodingr[ Zencryption_algorithm)r rZ r[ r Zgenerate_private_key�upper�getattrr r rL r r6 Z private_bytesr r_ r ZTraditionalOpenSSLr )r, r' r( �key�namerc �er? r? r@ r1 � s8 � (�r1 )rB r+ c C sB t | t�r| �� } ztj| dd� W n ty8 Y dS 0 dS dS )z�Is valid RSA private key? :param privkey: Private key file contents in PEM :returns: Validity of private key. :rtype: bool NrO FT)� isinstancer6 �encoder rQ r2 )rB r? r? r@ � valid_privkey s rl )�renewable_certr+ c C s" t | � t| � t| j| j� dS )a� For checking that your certs were not corrupted on disk. Several things are checked: 1. Signature verification for the cert. 2. That fullchain matches cert and chain when concatenated. 3. Check that the private key matches the certificate. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If verification fails. N)�verify_renewable_cert_sig�verify_fullchain� verify_cert_matches_priv_key� cert_pathr> )rm r? r? r@ �verify_renewable_cert s rr c C s� z�t | jd��"}t�|�� t� �}W d � n1 s60 Y t | jd��"}t�|�� t� �}W d � n1 st0 Y |�� }|js�J �t ||j |j |j� W nL t t tfy� } z.d�| j|�}t�|� t�|��W Y d}~n d}~0 0 dS )z�Verifies the signature of a RenewableCert object. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If signature verification fails. �rbNzbverifying the signature of the certificate located at {0} has failed. Details: {1})�open� chain_pathr �load_pem_x509_certificate�readr rq rR �signature_hash_algorithm�verify_signed_payload� signatureZtbs_certificate_bytes�OSErrorr2 r r[ r3 � exceptionr rZ )rm � chain_file�chain� cert_file�certZpkri � error_strr? r? r@ rn + s 00 �� rn r r r" r! )rR rz �payloadrx r+ c C sJ t | t�r | �||t� |� n(t | t�r<| �||t|�� n t�d��dS )a� Check the signature of a payload. :param RSAPublicKey/EllipticCurvePublicKey public_key: the public_key to check signature :param bytes signature: the signature bytes :param bytes payload: the payload bytes :param hashes.HashAlgorithm signature_hash_algorithm: algorithm used to hash the payload :raises InvalidSignature: If signature verification fails. :raises errors.Error: If public key type is not supported z Unsupported public key type.N)rj r Zverifyr r r r rZ )rR rz r� rx r? r? r@ ry C s � �ry )rq r> r+ c C s~ z,t �t j�}|�| � |�|� |�� W nL tt jfyx } z.d�| ||�}t � |� t �|��W Y d}~n d}~0 0 dS )z� Verifies that the private key and cert match. :param str cert_path: path to a cert in PEM format :param str key_path: path to a private key file :raises errors.Error: If they don't match. z�verifying the certificate located at {0} matches the private key located at {1} has failed. Details: {2}N) r ZContextZ SSLv23_METHODZuse_certificate_fileZuse_privatekey_fileZcheck_privatekeyr{ rZ r[ r3 r| r )rq r> �contextri r� r? r? r@ rp ^ s � rp c C s4 z�t | j��}|�� }W d � n1 s*0 Y t | j��}|�� }W d � n1 s\0 Y t | j��}|�� }W d � n1 s�0 Y || |kr�d}|�| j�}t�|��W nn t �y } z*d�|�}t � |� t�|��W Y d}~n4d}~0 tj�y. } z|�W Y d}~n d}~0 0 dS )z� Verifies that fullchain is indeed cert concatenated with chain. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If cert and chain do not combine to fullchain. Nz.fullchain does not match cert + chain for {0}!z8reading one of cert, chain, or fullchain has failed: {0}) rt ru rw rq Zfullchain_pathr[ Z lineagenamer rZ r{ r3 r| ) rm r} r~ r r� Zfullchain_fileZ fullchainr� ri r? r? r@ ro t s" & & & ro )rW r+ c C s� g }t jt jfD ]L}zt �|| �|fW S t jyZ } z|�|� W Y d}~qd}~0 0 qt�d�d�dd� |D �����dS )z:Load PEM/DER certificate. :raises errors.Error: NzUnable to load: {0}�,c s s | ]}t |�V qd S )N)r6 )�.0r5 r? r? r@ � <genexpr>� s z-pyopenssl_load_certificate.<locals>.<genexpr>) r Z FILETYPE_PEMZ FILETYPE_ASN1Zload_certificaterZ �appendr r[ r: )rW Zopenssl_errorsZ file_typer5 r? r? r@ �pyopenssl_load_certificate� s "�r� )r� �typr+ c C sv t �|�}|t jjkr"t�| �}n|t jjks2J �t�| �}z|j�tj �}W n tj yf g Y S 0 |j � tj �S )z�Get a list of Subject Alternative Names from a certificate. :param str cert: Certificate (encoded). :param Format typ: Which format the `cert` bytes are in. :returns: A list of Subject Alternative Names. :rtype: list )rF r` r_ r rv rT �load_der_x509_certificater^ Zget_extension_for_classZSubjectAlternativeNameZExtensionNotFound�valueZget_values_for_typeZDNSName)r� r� � x509_certZsan_extr? r? r@ �get_sans_from_cert� s � r� c C sL t �|�}|t jjkr"t�| �}n|t jjks2J �t�| �}t �|j|j �S )z�Get a list of domains from a cert, including the CN if it is set. :param str cert: Certificate (encoded). :param Format typ: Which format the `cert` bytes are in. :returns: A list of domain names. :rtype: list ) rF r` r_ r rv rT r� r\ r] r^ )r� r� r� r? r? r@ �get_names_from_cert� s �r� )rI r� r+ c C sL t �|�}|t jjkr"t�| �}n|t jjks2J �t�| �}t �|j|j �S )z�Get a list of domains from a CSR, including the CN if it is set. :param str csr: CSR (encoded). :param acme_crypto_util.Format typ: Which format the `csr` bytes are in. :returns: A list of domain names. :rtype: list ) rF r` r_ r rJ rT rY r\ r] r^ )rI r� Zx509_reqr? r? r@ �get_names_from_req� s �r� )r~ �filetyper+ c C s t �| |�S )z�Dump certificate chain into a bundle. :param list chain: List of `crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). )rF �dump_pyopenssl_chain)r~ r� r? r? r@ r� � s r� )rq r+ c C s� t | d�� }t�|�� �}W d � n1 s.0 Y t�� �0 tjddd� |jjt j j d�W d � S 1 sv0 Y dS )z�When does the cert at cert_path start being valid? :param str cert_path: path to a cert in PEM format :returns: the notBefore value from the cert at cert_path :rtype: :class:`datetime.datetime` rs N�ignore�'Properties that return.*datetime object��message�Ztzinfo) rt r rv rw �warnings�catch_warnings�filterwarningsZnot_valid_before�replace�datetime�timezone�utc�rq �fr� r? r? r@ � notBefore� s , r� c C s� t | d�� }t�|�� �}W d � n1 s.0 Y t�� �0 tjddd� |jjt j j d�W d � S 1 sv0 Y dS )z�When does the cert at cert_path stop being valid? :param str cert_path: path to a cert in PEM format :returns: the notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` rs Nr� r� r� r� ) rt r rv rw r� r� r� Znot_valid_afterr� r� r� r� r� r? r? r@ �notAfter s , r� )�filenamer+ c C sN t �� }t| d��$}|�|�� �d�� W d � n1 s<0 Y |�� S )aN Compute a sha256sum of a file. NB: In given file, platform specific newlines characters will be converted into their equivalent unicode counterparts before calculating the hash. :param str filename: path to the file whose hash will be computed :returns: sha256 digest of the file in hexadecimal :rtype: str �rzUTF-8N)�hashlib�sha256rt �updaterw rk Z hexdigest)r� r� Zfile_dr? r? r@ � sha256sum s 2r� s@ -----BEGIN CERTIFICATE----- ? .+? ? -----END CERTIFICATE----- ? )� fullchain_pemr+ c C sp t �| �� �}t|�dk r$t�d��g }|D ](}t�|�}|�t j �}|� |� � � q,|d d� |dd� �fS )a Split fullchain_pem into cert_pem and chain_pem :param str fullchain_pem: concatenated cert + chain :returns: tuple of string cert_pem and chain_pem :rtype: tuple :raises errors.Error: If there are less than 2 certificates in the chain. � zPfailed to parse fullchain into cert and chain: less than 2 certificates in chainr r- � N)�CERT_PEM_REGEX�findallrk �lenr rZ r rv rS r r_ r� �decoder: )r� �certsZcerts_normalizedZcert_pemr� r? r? r@ � cert_and_chain_from_fullchain; s r� c C s> t | d�� }t�|�� �}W d � n1 s.0 Y |jS )z�Retrieve the serial number of a certificate from certificate path :param str cert_path: path to a cert in PEM format :returns: serial number of the certificate :rtype: int rs N)rt r rv rw Z serial_numberr� r? r? r@ �get_serial_from_certZ s ,r� )� fullchains� issuer_cn�warn_on_no_matchr+ c C sl | D ]N}t �|�� �}t�|d t� �}|j�tjj �}|r|d j |kr| S q|rdt � d|� | d S )a' Chooses the first certificate chain from fullchains whose topmost intermediate has an Issuer Common Name matching issuer_cn (in other words the first chain which chains to a root whose name matches issuer_cn). :param fullchains: The list of fullchains in PEM chain format. :type fullchains: `list` of `str` :param `str` issuer_cn: The exact Subject Common Name to match against any issuer in the certificate chain. :returns: The best-matching fullchain, PEM-encoded, or the first if none match. :rtype: `str` ���r z�Certbot has been configured to prefer certificate chains with issuer '%s', but no chain from the CA matched this issuer. Using the default certificate chain instead.) r� r� rk r rv r ZissuerZget_attributes_for_oidZNameOIDZ COMMON_NAMEr� r3 Zwarning)r� r� r� r~ r� Ztop_certZ top_issuer_cnr? r? r@ �find_chain_with_issuerg s �r� )r r# r$ T)FT)rb r N)F)e�__doc__r� r� Zlogging�rer� �typingr r r r r r Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr r Z)cryptography.hazmat.primitives.asymmetricr r Z-cryptography.hazmat.primitives.asymmetric.dsar Z,cryptography.hazmat.primitives.asymmetric.ecr r Z1cryptography.hazmat.primitives.asymmetric.paddingr Z-cryptography.hazmat.primitives.asymmetric.rsar Z,cryptography.hazmat.primitives.serializationr r r ZjosepyZOpenSSLr r Zacmer rF Zcertbotr r r Zcertbot.compatr Z/cryptography.hazmat.primitives.asymmetric.ed448r Z1cryptography.hazmat.primitives.asymmetric.ed25519r Z.cryptography.hazmat.primitives.asymmetric.x448r! Z0cryptography.hazmat.primitives.asymmetric.x25519r" Z getLogger�__name__r3 �intr6 �boolr< rA rG rH �bytesrN rU r` ra r1 rl Z RenewableCertrr rn Z HashAlgorithmry rp ro ZX509r� r_ r� r� r� ZComparableX509r� r� r� r� �compile�DOTALLr� r� r� r� r? r? r? r@ �<module> s� � � 2 � � %� ! �� .�� �� �� �� � � � � �
.
Edit
..
Edit
__init__.cpython-39.opt-1.pyc
Edit
__init__.cpython-39.pyc
Edit
achallenges.cpython-39.opt-1.pyc
Edit
achallenges.cpython-39.pyc
Edit
configuration.cpython-39.opt-1.pyc
Edit
configuration.cpython-39.pyc
Edit
crypto_util.cpython-39.opt-1.pyc
Edit
crypto_util.cpython-39.pyc
Edit
errors.cpython-39.opt-1.pyc
Edit
errors.cpython-39.pyc
Edit
interfaces.cpython-39.opt-1.pyc
Edit
interfaces.cpython-39.pyc
Edit
main.cpython-39.opt-1.pyc
Edit
main.cpython-39.pyc
Edit
ocsp.cpython-39.opt-1.pyc
Edit
ocsp.cpython-39.pyc
Edit
reverter.cpython-39.opt-1.pyc
Edit
reverter.cpython-39.pyc
Edit
util.cpython-39.opt-1.pyc
Edit
util.cpython-39.pyc
Edit