/usr/share/cagefs-skeleton/usr/lib/python3.9/site-packages/certbot/__pycache__
a }|�ge< � @ s� d Z ddlmZ ddlmZ ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl Z ddl m Z dd l mZ dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlm Z ddl m Z ddl m Z e�!e"�Z#G dd� d�Z$e%e ee% ee% f d�dd�Z&e%e%e%e'e(d�dd�Z)d d e j*e%dd �d d �Z+d e j*e%dd!�d"d#�Z,e%e%e%e(d$�d%d&�Z-dS )'z*Tools for checking certificate revocation.� )�datetime)� timedeltaN)�PIPE)�Optional)�Tuple)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)� serialization)�ocsp)� crypto_util)�errors)�util)�getenv)� RenewableCertc @ s` e Zd ZdZdedd�dd�Zeed�dd �Zdeee ed �d d �Z eeeee ed�dd�Z dS )�RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.FN)� enforce_openssl_binary_usage�returnc C sr d| _ || _| jrnt�d�s0t�d� d| _ d S tjg d�ttddt� � d�}d|j v rddd � | _ n d d � | _ d S ) NF�opensslz-openssl not installed, can't check revocationT)r r �-header�var�val)�stdout�stderrZuniversal_newlines�check�envz Missing =c S s d| gS )NzHost=� ��hostr r �0/usr/lib/python3.9/site-packages/certbot/ocsp.py�<lambda>1 � z,RevocationChecker.__init__.<locals>.<lambda>c S s d| gS )NZHostr r r r r! r" 3 r# ) �broken�use_openssl_binaryr Z exe_exists�logger�info� subprocess�runr Z env_no_snap_for_external_callsr � host_args)�selfr Ztest_host_formatr r r! �__init__" s � zRevocationChecker.__init__��certr c C s | � |j|j�S )a Get revoked status for a particular cert version. .. todo:: Make this a non-blocking call :param `.interfaces.RenewableCert` cert: Certificate object :returns: True if revoked; False if valid or the check failed or cert is expired. :rtype: bool )�ocsp_revoked_by_paths� cert_path� chain_path)r+ r. r r r! � ocsp_revoked5 s z RevocationChecker.ocsp_revoked� )r0 r1 �timeoutr c C sf | j r dS t�tj�}t�|�|kr(dS t|�\}}|r<|s@dS | jrX| � |||||�S t ||||�S )aE Performs the OCSP revocation check :param str cert_path: Certificate filepath :param str chain_path: Certificate chain :param int timeout: Timeout (in seconds) for the OCSP query :returns: True if revoked; False if valid or the check failed or cert is expired. :rtype: bool F) r$ r �now�pytz�UTCr ZnotAfter�_determine_ocsp_serverr% �_check_ocsp_openssl_bin�_check_ocsp_cryptography)r+ r0 r1 r4 r5 �urlr r r r! r/ A s z'RevocationChecker.ocsp_revoked_by_paths)r0 r1 r r; r4 r c C s t d�}t d�}d }|d us$|d ur4|d ur0|n|}|d u rFd|g} n&|�d�r`|td�d � }d|d|g} ddd d |d |d |d |ddt|�dg| �|� | } t�d|� t�d�| �� ztj | tjd�\} } W n" t j y� t� d|� Y dS 0 t || | �S )NZ http_proxyZ HTTP_PROXYz-urlzhttp://z-hostz-pathr r z -no_noncez-issuerz-certz-CAfilez -verify_otherz -trust_otherz-timeoutr zQuerying OCSP for %s� )�log�*OCSP check failed for %s (are we offline?)F)r � startswith�len�strr* r& �debug�joinr Z run_scriptr ZSubprocessErrorr' �_translate_ocsp_query) r+ r0 r1 r r; r4 Zenv_http_proxyZenv_HTTP_PROXYZ proxy_hostZurl_opts�cmd�output�errr r r! r9 ^ s@ ��� z)RevocationChecker._check_ocsp_openssl_bin)F)r3 ) �__name__� __module__� __qualname__�__doc__�boolr, r r2 rA �intr/ r9 r r r r! r s �r )r0 r c s� t | d��"}t�|�� t� �}W d � n1 s20 Y z:|j�tj�}tjj � � fdd�|j D �}|d j j }W n& tj t fy� t�d| � Y dS 0 |�� }|�d�d �d �}|r�||fS t�d || � dS ) z�Extract the OCSP server host from a certificate. :param str cert_path: Path to the cert we're checking OCSP for :rtype tuple: :returns: (OCSP server URL or None, OCSP server host or None) �rbNc s g | ]}|j � kr|�qS r )Z access_method)�.0� description�Zocsp_oidr r! � <listcomp>� s �z*_determine_ocsp_server.<locals>.<listcomp>r z Cannot extract OCSP URI from %s)NNz://� �/z;Cannot process OCSP host from URL (%s) in certificate at %s)�openr �load_pem_x509_certificate�readr � extensions�get_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSP�valueZaccess_location�ExtensionNotFound� IndexErrorr& r' �rstrip� partition)r0 � file_handlerr. � extensionZ descriptionsr; r r rQ r! r8 � s 0 r8 )r0 r1 r; r4 r c C s. t |d��"}t�|�� t� �}W d � n1 s20 Y t | d��"}t�|�� t� �}W d � n1 sn0 Y t�� }|�||t� � �}|� � }|� t j j�} ztj|| ddi|d�} W n( tjjy� tjd| dd� Y dS 0 | jd k�r t�d | | j� dS t�| j�} | jtjjk�r<t�d | | j� dS zt | ||| � W n� t �y� } zt�t | �� W Y d } ~ n�d } ~ 0 t j �y� } zt�t | �� W Y d } ~ n|d } ~ 0 t!�y� t�d | � Y nV t"�y } z t�d | t | �� W Y d } ~ n(d } ~ 0 0 t�#d| | j$� | j$tj%j&kS dS )NrN z Content-Typezapplication/ocsp-request)�dataZheadersr4 r> T)�exc_infoF�� z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rU r rV rW r r ZOCSPRequestBuilderZadd_certificater ZSHA1ZbuildZ public_bytesr ZEncodingZDER�requestsZpost� exceptionsZRequestExceptionr& r' Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ SUCCESSFUL�warning�_check_ocsp_responser rA r �Errorr �AssertionErrorrB Zcertificate_statusZOCSPCertStatusZREVOKED)r0 r1 r; r4 r_ �issuerr. ZbuilderZrequestZrequest_binaryZresponse� response_ocsp�e�errorr r r! r: � sP 0 0� �""(�r: zocsp.OCSPResponsezocsp.OCSPRequest)rk � request_ocsp� issuer_certr0 r c C s� | j |j krtd��t| ||� t| jt|j��rJ| j|jksJ| j|jkrRtd��t� t j �j dd�}t �� �j t jddd� | js�td��| j|td d � kr�td ��| jr�| j|td d � k r�td ��W d � n1 s�0 Y dS ) z2Verify that the OCSP is valid for several criteriazMthe certificate in response does not correspond to the certificate in requestz<the issuer does not correspond to issuer of the certificate.N)Ztzinfo�ignorez'Properties that return.*datetime object)�messagez param thisUpdate is not set.� )Zminutesz"param thisUpdate is in the future.z param nextUpdate is in the past.)Z serial_numberri � _check_ocsp_response_signature� isinstanceZhash_algorithm�typeZissuer_key_hashZissuer_name_hashr r5 r6 r7 �replace�warnings�catch_warnings�filterwarningsZ this_updater Z next_update)rk rn ro r0 r5 r r r! rg � s$ � � rg )rk ro r0 r c s" t jtd�dd�� �j|jks,�j� |�kr>t�d|� |}n�t�d|� � �fdd��jD �}|slt d��|d }|j |jkr�t d ��z"|j � t j �}t jjj|jv }W n t jtfy� d }Y n0 |s�t d ��|j}t�|�� |j|j|� �j}|�st d ��t�|�� �j�j|� dS )zIVerify an OCSP response signature against certificate issuer or responderr- c S s t j�| �� �jS )N)r ZSubjectKeyIdentifierZfrom_public_key� public_keyZdigest)r. r r r! � _key_hash� s z1_check_ocsp_response_signature.<locals>._key_hashzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s* g | ]"}�j |jks"�j� |�kr|�qS r )�responder_name�subject�responder_key_hash)rO r. �r{ rk r r! rR s �z2_check_ocsp_response_signature.<locals>.<listcomp>z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz<responder is not authorized by issuer to sign OCSP responsesz#no signature hash algorithm definedN)r � Certificate�bytesr| r} r~ r& rB Z certificatesri rj rX rY ZExtendedKeyUsageZoidZExtendedKeyUsageOIDZ OCSP_SIGNINGrZ r[ r\ Zsignature_hash_algorithmr Zverify_signed_payloadrz Z signatureZtbs_certificate_bytesZtbs_response_bytes) rk ro r0 Zresponder_certZresponder_certsr` Zdelegate_authorizedZchosen_cert_hashZchosen_response_hashr r r! rs � sD ��� ��rs )r0 � ocsp_output� ocsp_errorsr c s� d}� fdd�|D �}�fdd�|D �\}}}|r<|� d�nd}d|vsT|rP|sT|rrt�d � � t�d �|� d S |r~|s~d S |r�|� d�}|r�t�d |� d S t�d�|� d S dS )z7Parse openssl's weird output to work out what it means.)�good�revoked�unknownc s g | ]}d � � |��qS )z{0}: (WARNING.*)?{1})�format)rO �s)r0 r r! rR : r# z)_translate_ocsp_query.<locals>.<listcomp>c 3 s | ]}t j|� t jd �V qdS ))�flagsN)�re�search�DOTALL)rO �p)r� r r! � <genexpr>; r# z(_translate_ocsp_query.<locals>.<genexpr>� NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output: %s stderr: %sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s stderr:%s)�groupr& r' rB rf ) r0 r� r� Zstates�patternsr� r� r� rf r )r0 r� r! rD 6 s& �rD ).rK r r Zloggingr� r( r �typingr r rw Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr r Zcryptography.x509r r6 rd Zcertbotr r r Zcertbot.compat.osr Zcertbot.interfacesr Z getLoggerrH r& r rA r8 rM rL r: r� rg rs rD r r r r! �<module> sD e 1� )� :
.
Edit
..
Edit
__init__.cpython-39.opt-1.pyc
Edit
__init__.cpython-39.pyc
Edit
achallenges.cpython-39.opt-1.pyc
Edit
achallenges.cpython-39.pyc
Edit
configuration.cpython-39.opt-1.pyc
Edit
configuration.cpython-39.pyc
Edit
crypto_util.cpython-39.opt-1.pyc
Edit
crypto_util.cpython-39.pyc
Edit
errors.cpython-39.opt-1.pyc
Edit
errors.cpython-39.pyc
Edit
interfaces.cpython-39.opt-1.pyc
Edit
interfaces.cpython-39.pyc
Edit
main.cpython-39.opt-1.pyc
Edit
main.cpython-39.pyc
Edit
ocsp.cpython-39.opt-1.pyc
Edit
ocsp.cpython-39.pyc
Edit
reverter.cpython-39.opt-1.pyc
Edit
reverter.cpython-39.pyc
Edit
util.cpython-39.opt-1.pyc
Edit
util.cpython-39.pyc
Edit