| Current File : //proc/self/root/lib/python3.6/site-packages/certbot/__pycache__/ocsp.cpython-36.pyc |
3
گa�: � @ s� d Z ddlmZ ddlmZ ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z dd l m
Z
dd
l mZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlmZ ddl m Z ddl m Z ej e!�Z"G dd� d�Z#e$e ee$ ee$ f d�dd�Z%e$e$e$e&e'd�dd�Z(d d e j)e$dd �d d �Z*d e j)e$dd!�d"d#�Z+e$e$e$e'd$�d%d&�Z,dS )'z*Tools for checking certificate revocation.� )�datetime)� timedeltaN)�PIPE)�Optional)�Tuple)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)�
serialization)�ocsp)� crypto_util)�errors)�util)�getenv)�
RenewableCertc @ s` e Zd ZdZdedd�dd�Zeed�dd �Zdeee ed �d d
�Z
eeeee ed�dd�Z dS )�RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.FN)� enforce_openssl_binary_usage�returnc C sx d| _ || _| jrttjd�s0tjd� d| _ d S tjdddddgttddtj � d �}d
|j
krjd d � | _ n
d
d � | _ d S )NF�opensslz-openssl not installed, can't check revocationTr
z-header�var�val)�stdout�stderrZuniversal_newlinesZcheck�envz Missing =c S s
d| gS )NzHost=� )�hostr r �/usr/lib/python3.6/ocsp.py�<lambda>1 s z,RevocationChecker.__init__.<locals>.<lambda>c S s d| gS )NZHostr )r r r r r 3 s ) �broken�use_openssl_binaryr Z
exe_exists�logger�info�
subprocessZrunr Z env_no_snap_for_external_callsr � host_args)�selfr Ztest_host_formatr r r �__init__" s
zRevocationChecker.__init__)�certr c C s | j |j|j�S )a Get revoked status for a particular cert version.
.. todo:: Make this a non-blocking call
:param `.interfaces.RenewableCert` cert: Certificate object
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
)�ocsp_revoked_by_paths� cert_path�
chain_path)r& r( r r r � ocsp_revoked5 s
z RevocationChecker.ocsp_revoked�
)r* r+ �timeoutr c C sn | j r
dS tjjtj� �}tj|�|kr,dS t|�\}}| sD| rHdS | j r`| j
|||||�S t ||||�S )aE Performs the OCSP revocation check
:param str cert_path: Certificate filepath
:param str chain_path: Certificate chain
:param int timeout: Timeout (in seconds) for the OCSP query
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
F) r �pytzZUTCZfromutcr �utcnowr ZnotAfter�_determine_ocsp_serverr! �_check_ocsp_openssl_bin�_check_ocsp_cryptography)r& r* r+ r. �now�urlr r r r r) A s z'RevocationChecker.ocsp_revoked_by_paths)r* r+ r r5 r. r c
C s t d�}t d�}d }|d k s$|d k r4|d k r0|n|}|d krFd|g} n&|jd�r`|td�d � }d|d|g} ddd d
|d |d |d
|ddt|�dg| j|� | }
tjd|� tjdj|
�� ytj |
tjd�\} } W n" t
j k
r� tj d|� dS X t
|| | �S )NZ
http_proxyZ
HTTP_PROXYz-urlzhttp://z-hostz-pathr r
z -no_noncez-issuerz-certz-CAfilez
-verify_otherz -trust_otherz-timeoutz-headerzQuerying OCSP for %s� )�logz*OCSP check failed for %s (are we offline?)F)r �
startswith�len�strr% r" �debug�joinr Z
run_scriptr ZSubprocessErrorr# �_translate_ocsp_query)
r& r* r+ r r5 r. Zenv_http_proxyZenv_HTTP_PROXYZ
proxy_hostZurl_opts�cmd�output�errr r r r2 ^ s&
4 z)RevocationChecker._check_ocsp_openssl_bin)F)r- ) �__name__�
__module__� __qualname__�__doc__�boolr' r r, r: �intr) r2 r r r r r s r )r* r c s� t | d��}tj|j� t� �}W dQ R X y:|jjtj�}tjj � � fdd�|j
D �}|d j j
}W n& tj t
fk
r� tjd| � d S X |j� }|jd�d jd �}|r�||fS tjd
|| � d S )
z�Extract the OCSP server host from a certificate.
:param str cert_path: Path to the cert we're checking OCSP for
:rtype tuple:
:returns: (OCSP server URL or None, OCSP server host or None)
�rbNc s g | ]}|j � kr|�qS r )Z
access_method)�.0� description)�ocsp_oidr r �
<listcomp>� s z*_determine_ocsp_server.<locals>.<listcomp>r z Cannot extract OCSP URI from %sz://� �/z;Cannot process OCSP host from URL (%s) in certificate at %s)NN)NN)�openr �load_pem_x509_certificate�readr
�
extensions�get_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSP�valueZaccess_location�ExtensionNotFound�
IndexErrorr" r# �rstrip� partition)r* � file_handlerr( � extensionZ descriptionsr5 r r )rJ r r1 � s r1 )r* r+ r5 r. r c ' C s t |d��}tj|j� t� �}W d Q R X t | d��}tj|j� t� �}W d Q R X tj� }|j||tj � �}|j
� }|j t j
j�} ytj|| ddi|d�}
W n( tjjk
r� tjd| dd� dS X |
jd kr�tjd
| |
j� dS tj|
j�} | jtjjk�rtjd | | j� dS yt | ||| � W n� t k
�rV } ztjt | �� W Y d d } ~ X n� t j k
�r� } ztjt | �� W Y d d } ~ X nt t!k
�r� tjd | � Y nT t"k
�r� }
ztjd
| t |
�� W Y d d }
~
X n X tj#d| | j$� | j$tj%j&kS dS )NrG z Content-Typezapplication/ocsp-request)�dataZheadersr. z*OCSP check failed for %s (are we offline?)T)�exc_infoF�� z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rN r rO rP r
r
ZOCSPRequestBuilderZadd_certificater ZSHA1ZbuildZ public_bytesr ZEncodingZDER�requestsZpost�
exceptionsZRequestExceptionr" r# Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ
SUCCESSFUL�warning�_check_ocsp_responser r: r �Errorr �AssertionErrorr; Zcertificate_statusZOCSPCertStatusZREVOKED)r* r+ r5 r. rX �issuerr( ZbuilderZrequestZrequest_binaryZresponse�
response_ocsp�e�errorr r r r3 � sJ
$
r3 zocsp.OCSPResponsezocsp.OCSPRequest)rd � request_ocsp� issuer_certr* r c C s� | j |j krtd��t| ||� t| jt|j�� sL| j|jksL| j|jkrTtd��tj � }| j
sjtd��| j
|t dd� kr�td��| j r�| j |t dd� k r�td��dS ) z2Verify that the OCSP is valid for several criteriazMthe certificate in response does not correspond to the certificate in requestz<the issuer does not correspond to issuer of the certificate.z param thisUpdate is not set.� )Zminutesz"param thisUpdate is in the future.z param nextUpdate is in the past.N)
Z
serial_numberrb � _check_ocsp_response_signature�
isinstanceZhash_algorithm�typeZissuer_key_hashZissuer_name_hashr r0 Z this_updater Z next_update)rd rg rh r* r4 r r r r` � s r` )rd rh r* r c
s$ t jtd�dd�� �j|jks,�j� |�kr>tjd|� |}n�tjd|� � �fdd��jD �}|slt d��|d }|j
|jkr�t d
��y"|j j t j
�}t jjj|jk}W n t jtfk
r� d }Y nX |s�t d ��|j}tj|j� |j|j|� �j}|�st d
��tj|j� �j�j|� dS )zIVerify an OCSP response signature against certificate issuer or responder)r( r c S s t jj| j� �jS )N)r ZSubjectKeyIdentifierZfrom_public_key�
public_keyZdigest)r( r r r � _key_hash� s z1_check_ocsp_response_signature.<locals>._key_hashzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s* g | ]"}�j |jks"�j� |�kr|�qS r )�responder_name�subject�responder_key_hash)rH r( )rn rd r r rK s z2_check_ocsp_response_signature.<locals>.<listcomp>z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz<responder is not authorized by issuer to sign OCSP responsesz#no signature hash algorithm definedN)r � Certificate�bytesro rp rq r" r; Z certificatesrb rc rQ rR ZExtendedKeyUsageZoidZExtendedKeyUsageOIDZ OCSP_SIGNINGrS rT rU Zsignature_hash_algorithmr Zverify_signed_payloadrm Z signatureZtbs_certificate_bytesZtbs_response_bytes) rd rh r* Zresponder_certZresponder_certsrY Zdelegate_authorizedZchosen_cert_hashZchosen_response_hashr )rn rd r rj � s:
rj )r* � ocsp_output� ocsp_errorsr c s� d}� fdd�|D �}�fdd�|D �\}}}|r<|j d�nd }d
|ksT|rP|sT|rrtjd � � tjd �|� d
S |r�| r�d
S |r�|j d�}|r�tjd|� dS tjd�|� d
S d S )z7Parse openssl's weird output to work out what it means.�good�revoked�unknownc s g | ]}d j � |��qS )z{0}: (WARNING.*)?{1})�format)rH �s)r* r r rK 3 s z)_translate_ocsp_query.<locals>.<listcomp>c 3 s | ]}t j|� t jd �V qdS ))�flagsN)�re�search�DOTALL)rH �p)rt r r � <genexpr>4 s z(_translate_ocsp_query.<locals>.<genexpr>� NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output:
%s
stderr:
%sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s
stderr:%s)rv rw rx )�groupr" r# r; r_ ) r* rt ru ZstatesZpatternsrv rw rx r_ r )r* rt r r= / s$
r= )-rD r r Zloggingr| r$ r Ztypingr r Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr
Z cryptography.hazmat.primitivesr r Zcryptography.x509r
r/ r] Zcertbotr r r Zcertbot.compat.osr Zcertbot.interfacesr Z getLoggerrA r" r r: r1 rF rE r3 rr r` rj r= r r r r �<module> s>
e 1"8