File: //lib/python3.6/site-packages/certbot/__pycache__/ocsp.cpython-36.opt-1.pyc
3
ߦ)_�: � @ sr d Z ddlmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z dd l
m Z dd
l
mZ dd lmZ dd lmZ ddlZddlZdd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z y ddl m Z e!e j"d� W n e#e$fk
�r* dZ Y nX ej%e&�Z'G dd� de(�Z)dd� Z*dd� Z+d d � Z,d d � Z-d d!� Z.dS )"z*Tools for checking certificate revocation.� )�datetime)� timedeltaN)�PIPE)�Popen)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)�
serialization)�Optional)�Tuple)� crypto_util)�errors)�util)�getenv)�
RenewableCert)�ocsp�signature_hash_algorithmc @ s4 e Zd ZdZd
dd�Zdd� Zddd �Zd
d � Zd S )�RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.Fc C s� d| _ |pt | _| jr�tjd�s6tjd� d| _ d S tdddddgttdtj � d �}|j
� \}}d
|krvd d � | _ n
d
d � | _ d S )NF�opensslz-openssl not installed, can't check revocationTr z-header�var�val)�stdout�stderrZuniversal_newlines�envz Missing =c S s
d| gS )NzHost=� )�hostr r �/usr/lib/python3.6/ocsp.py�<lambda>: s z,RevocationChecker.__init__.<locals>.<lambda>c S s d| gS )NZHostr )r r r r r < s ) �brokenr �use_openssl_binaryr Z
exe_exists�logger�infor r Z env_no_snap_for_external_callsZ communicate� host_args)�selfZ enforce_openssl_binary_usageZtest_host_formatZ_out�errr r r �__init__* s
zRevocationChecker.__init__c C s | j |j|j�S )a Get revoked status for a particular cert version.
.. todo:: Make this a non-blocking call
:param `.interfaces.RenewableCert` cert: Certificate object
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
)�ocsp_revoked_by_paths� cert_path�
chain_path)r% �certr r r � ocsp_revoked> s z RevocationChecker.ocsp_revoked�
c C sn | j r
dS tjjtj� �}tj|�|kr,dS t|�\}}| sD| rHdS | j r`| j
|||||�S t ||||�S )aE Performs the OCSP revocation check
:param str cert_path: Certificate filepath
:param str chain_path: Certificate chain
:param int timeout: Timeout (in seconds) for the OCSP query
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
F) r �pytzZUTCZfromutcr �utcnowr ZnotAfter�_determine_ocsp_serverr! �_check_ocsp_openssl_bin�_check_ocsp_cryptography)r% r) r* �timeout�now�urlr r r r r( K s z'RevocationChecker.ocsp_revoked_by_pathsc
C s t d�}t d�}d }|d k s$|d k r4|d k r0|n|}|d krFd|g} n&|jd�r`|td�d � }d|d|g} ddd d
|d |d |d
|ddt|�dg| j|� | }
tjd|� tjdj|
�� ytj |
tjd�\} } W n" t
j k
r� tj d|� dS X t
|| | �S )NZ
http_proxyZ
HTTP_PROXYz-urlzhttp://z-hostz-pathr r z -no_noncez-issuerz-certz-CAfilez
-verify_otherz -trust_otherz-timeoutz-headerzQuerying OCSP for %s� )�logz*OCSP check failed for %s (are we offline?)F)r �
startswith�len�strr$ r" �debug�joinr Z
run_scriptr ZSubprocessErrorr# �_translate_ocsp_query)
r% r) r* r r5 r3 Zenv_http_proxyZenv_HTTP_PROXYZ
proxy_hostZurl_opts�cmd�outputr& r r r r1 i s&
4 z)RevocationChecker._check_ocsp_openssl_binN)F)r- )�__name__�
__module__� __qualname__�__doc__r' r, r( r1 r r r r r ' s
r c s� t | d��}tj|j� t� �}W dQ R X y:|jjtj�}tjj � � fdd�|j
D �}|d j j
}W n& tj t
fk
r� tjd| � d S X |j� }|jd�d jd �}|r�||fS tjd
|| � d S )
z�Extract the OCSP server host from a certificate.
:param str cert_path: Path to the cert we're checking OCSP for
:rtype tuple:
:returns: (OCSP server URL or None, OCSP server host or None)
�rbNc s g | ]}|j � kr|�qS r )Z
access_method)�.0� description)�ocsp_oidr r �
<listcomp>� s z*_determine_ocsp_server.<locals>.<listcomp>r z Cannot extract OCSP URI from %sz://� �/z4Cannot process OCSP host from URL (%s) in cert at %s)NN)NN)�openr �load_pem_x509_certificate�readr �
extensions�get_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSP�valueZaccess_location�ExtensionNotFound�
IndexErrorr" r# �rstrip� partition)r) � file_handlerr+ � extensionZ descriptionsr5 r r )rG r r0 � s r0 c ' C s t |d��}tj|j� t� �}W d Q R X t | d��}tj|j� t� �}W d Q R X tj� }|j||tj � �}|j
� }|j t j
j�} ytj|| ddi|d�}
W n( tjjk
r� tjd| dd� dS X |
jd kr�tjd
| |
j� dS tj|
j�} | jtjjk�rtjd | | j� dS yt | ||| � W n� t k
�rV } ztjt | �� W Y d d } ~ X n� t j k
�r� } ztjt | �� W Y d d } ~ X nt t!k
�r� tjd | � Y nT t"k
�r� }
ztjd
| t |
�� W Y d d }
~
X n X tj#d| | j$� | j$tj%j&kS dS )NrD z Content-Typezapplication/ocsp-request)�dataZheadersr3 z*OCSP check failed for %s (are we offline?)T)�exc_infoF�� z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rK r rL rM r r ZOCSPRequestBuilderZadd_certificater
ZSHA1ZbuildZ public_bytesr ZEncodingZDER�requestsZpost�
exceptionsZRequestExceptionr" r# Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ
SUCCESSFUL�error�_check_ocsp_responser r: r �Errorr �AssertionErrorr; Zcertificate_statusZOCSPCertStatusZREVOKED)r) r* r5 r3 rU �issuerr+ ZbuilderZrequestZrequest_binaryZresponse�
response_ocsp�er\ r r r r2 � sJ
$
r2 c C s� | j |j krtd��t| ||� t| jt|j�� sL| j|jksL| j|jkrTtd��tj � }| j
sjtd��| j
|t dd� kr�td��| j r�| j |t dd� k r�td��dS ) z3Verify that the OCSP is valid for serveral criteriazMthe certificate in response does not correspond to the certificate in requestz<the issuer does not correspond to issuer of the certificate.z param thisUpdate is not set.� )Zminutesz"param thisUpdate is in the future.z param nextUpdate is in the past.N)
Z
serial_numberr_ � _check_ocsp_response_signature�
isinstanceZhash_algorithm�typeZissuer_key_hashZissuer_name_hashr r/ Z this_updater Z next_update)ra Z request_ocsp� issuer_certr) r4 r r r r] � s r] c
s dd� � �j |jks"�j� |�kr4tjd|� |}n�tjd|� � �fdd��jD �}|sbtd��|d }|j|jkr~td ��y"|jj t
j �}t
j j
j|jk}W n t
jtfk
r� d
}Y nX |s�td ��|j}tj|j� |j|j|� �j}tj|j� �j�j|� d S )
zIVerify an OCSP response signature against certificate issuer or responderc S s t jj| j� �jS )N)r ZSubjectKeyIdentifierZfrom_public_key�
public_keyZdigest)r+ r r r � _key_hash s z1_check_ocsp_response_signature.<locals>._key_hashzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s* g | ]"}�j |jks"�j� |�kr|�qS r )�responder_name�subject�responder_key_hash)rE r+ )ri ra r r rH s z2_check_ocsp_response_signature.<locals>.<listcomp>z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz<responder is not authorized by issuer to sign OCSP responsesN)rj rk rl r" r; Z certificatesr_ r` rN rO r ZExtendedKeyUsageZoidZExtendedKeyUsageOIDZ OCSP_SIGNINGrP rQ rR r r Zverify_signed_payloadrh Z signatureZtbs_certificate_bytesZtbs_response_bytes)ra rg r) Zresponder_certZresponder_certsrV Zdelegate_authorizedZ chosen_hashr )ri ra r rd s6
rd c s� d}� fdd�|D �}�fdd�|D �\}}}|r<|j d�nd }d
|ksT|rP|sT|rrtjd � � tjd �|� d
S |r�| r�d
S |r�|j d�}|r�tjd|� dS tjd�|� d
S d S )z7Parse openssl's weird output to work out what it means.�good�revoked�unknownc s g | ]}d j � |��qS )z{0}: (WARNING.*)?{1})�format)rE �s)r) r r rH < s z)_translate_ocsp_query.<locals>.<listcomp>c 3 s | ]}t j|� t jd �V qdS ))�flagsN)�re�search�DOTALL)rE �p)� ocsp_outputr r � <genexpr>= s z(_translate_ocsp_query.<locals>.<genexpr>� NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output:
%s
stderr:
%sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s
stderr:%s)rm rn ro )�groupr" r# r; �warning) r) rw Z ocsp_errorsZstatesZpatternsrm rn ro r{ r )r) rw r r= 8 s$
r= )/rC r r Zloggingrs �
subprocessr r Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr
r r. rZ Zacme.magic_typingr r
Zcertbotr r r Zcertbot.compat.osr Zcertbot.interfacesr Zcryptography.x509r �getattrZ OCSPResponse� ImportError�AttributeErrorZ getLoggerr@ r" �objectr r0 r2 r] rd r= r r r r �<module> sB
h 2"6