Edit File: ocsp.cpython-36.pyc
3 گa�: � @ s� d Z ddlmZ ddlmZ ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl m Z dd l m Z dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlmZ ddl m Z ddl m Z ej e!�Z"G dd� d�Z#e$e ee$ ee$ f d�dd�Z%e$e$e$e&e'd�dd�Z(d d e j)e$dd �d d �Z*d e j)e$dd!�d"d#�Z+e$e$e$e'd$�d%d&�Z,dS )'z*Tools for checking certificate revocation.� )�datetime)� timedeltaN)�PIPE)�Optional)�Tuple)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)� serialization)�ocsp)� crypto_util)�errors)�util)�getenv)� RenewableCertc @ s` e Zd ZdZdedd�dd�Zeed�dd �Zdeee ed �d d �Z eeeee ed�dd�Z dS )�RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.FN)� enforce_openssl_binary_usage�returnc C sx d| _ || _| jrttjd�s0tjd� d| _ d S tjdddddgttddtj � d �}d |j krjd d � | _ n d d � | _ d S )NF�opensslz-openssl not installed, can't check revocationTr z-header�var�val)�stdout�stderrZuniversal_newlinesZcheck�envz Missing =c S s d| gS )NzHost=� )�hostr r �/usr/lib/python3.6/ocsp.py�<lambda>1 s z,RevocationChecker.__init__.<locals>.<lambda>c S s d| gS )NZHostr )r r r r r 3 s ) �broken�use_openssl_binaryr Z exe_exists�logger�info� subprocessZrunr Z env_no_snap_for_external_callsr � host_args)�selfr Ztest_host_formatr r r �__init__" s zRevocationChecker.__init__)�certr c C s | j |j|j�S )a Get revoked status for a particular cert version. .. todo:: Make this a non-blocking call :param `.interfaces.RenewableCert` cert: Certificate object :returns: True if revoked; False if valid or the check failed or cert is expired. :rtype: bool )�ocsp_revoked_by_paths� cert_path� chain_path)r& r( r r r � ocsp_revoked5 s z RevocationChecker.ocsp_revoked� )r* r+ �timeoutr c C sn | j r dS tjjtj� �}tj|�|kr,dS t|�\}}| sD| rHdS | j r`| j |||||�S t ||||�S )aE Performs the OCSP revocation check :param str cert_path: Certificate filepath :param str chain_path: Certificate chain :param int timeout: Timeout (in seconds) for the OCSP query :returns: True if revoked; False if valid or the check failed or cert is expired. :rtype: bool F) r �pytzZUTCZfromutcr �utcnowr ZnotAfter�_determine_ocsp_serverr! �_check_ocsp_openssl_bin�_check_ocsp_cryptography)r& r* r+ r. �now�urlr r r r r) A s z'RevocationChecker.ocsp_revoked_by_paths)r* r+ r r5 r. r c C s t d�}t d�}d }|d k s$|d k r4|d k r0|n|}|d krFd|g} n&|jd�r`|td�d � }d|d|g} ddd d |d |d |d |ddt|�dg| j|� | } tjd|� tjdj| �� ytj | tjd�\} } W n" t j k r� tj d|� dS X t || | �S )NZ http_proxyZ HTTP_PROXYz-urlzhttp://z-hostz-pathr r z -no_noncez-issuerz-certz-CAfilez -verify_otherz -trust_otherz-timeoutz-headerzQuerying OCSP for %s� )�logz*OCSP check failed for %s (are we offline?)F)r � startswith�len�strr% r" �debug�joinr Z run_scriptr ZSubprocessErrorr# �_translate_ocsp_query) r& r* r+ r r5 r. Zenv_http_proxyZenv_HTTP_PROXYZ proxy_hostZurl_opts�cmd�output�errr r r r2 ^ s& 4 z)RevocationChecker._check_ocsp_openssl_bin)F)r- ) �__name__� __module__� __qualname__�__doc__�boolr' r r, r: �intr) r2 r r r r r s r )r* r c s� t | d��}tj|j� t� �}W dQ R X y:|jjtj�}tjj � � fdd�|j D �}|d j j }W n& tj t fk r� tjd| � d S X |j� }|jd�d jd �}|r�||fS tjd || � d S ) z�Extract the OCSP server host from a certificate. :param str cert_path: Path to the cert we're checking OCSP for :rtype tuple: :returns: (OCSP server URL or None, OCSP server host or None) �rbNc s g | ]}|j � kr|�qS r )Z access_method)�.0� description)�ocsp_oidr r � <listcomp>� s z*_determine_ocsp_server.<locals>.<listcomp>r z Cannot extract OCSP URI from %sz://� �/z;Cannot process OCSP host from URL (%s) in certificate at %s)NN)NN)�openr �load_pem_x509_certificate�readr � extensions�get_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSP�valueZaccess_location�ExtensionNotFound� IndexErrorr" r# �rstrip� partition)r* � file_handlerr( � extensionZ descriptionsr5 r r )rJ r r1 � s r1 )r* r+ r5 r. r c ' C s t |d��}tj|j� t� �}W d Q R X t | d��}tj|j� t� �}W d Q R X tj� }|j||tj � �}|j � }|j t j j�} ytj|| ddi|d�} W n( tjjk r� tjd| dd� dS X | jd kr�tjd | | j� dS tj| j�} | jtjjk�rtjd | | j� dS yt | ||| � W n� t k �rV } ztjt | �� W Y d d } ~ X n� t j k �r� } ztjt | �� W Y d d } ~ X nt t!k �r� tjd | � Y nT t"k �r� } ztjd | t | �� W Y d d } ~ X n X tj#d| | j$� | j$tj%j&kS dS )NrG z Content-Typezapplication/ocsp-request)�dataZheadersr. z*OCSP check failed for %s (are we offline?)T)�exc_infoF�� z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rN r rO rP r r ZOCSPRequestBuilderZadd_certificater ZSHA1ZbuildZ public_bytesr ZEncodingZDER�requestsZpost� exceptionsZRequestExceptionr" r# Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ SUCCESSFUL�warning�_check_ocsp_responser r: r �Errorr �AssertionErrorr; Zcertificate_statusZOCSPCertStatusZREVOKED)r* r+ r5 r. rX �issuerr( ZbuilderZrequestZrequest_binaryZresponse� response_ocsp�e�errorr r r r3 � sJ $ r3 zocsp.OCSPResponsezocsp.OCSPRequest)rd � request_ocsp� issuer_certr* r c C s� | j |j krtd��t| ||� t| jt|j�� sL| j|jksL| j|jkrTtd��tj � }| j sjtd��| j |t dd� kr�td��| j r�| j |t dd� k r�td��dS ) z2Verify that the OCSP is valid for several criteriazMthe certificate in response does not correspond to the certificate in requestz<the issuer does not correspond to issuer of the certificate.z param thisUpdate is not set.� )Zminutesz"param thisUpdate is in the future.z param nextUpdate is in the past.N) Z serial_numberrb � _check_ocsp_response_signature� isinstanceZhash_algorithm�typeZissuer_key_hashZissuer_name_hashr r0 Z this_updater Z next_update)rd rg rh r* r4 r r r r` � s r` )rd rh r* r c s$ t jtd�dd�� �j|jks,�j� |�kr>tjd|� |}n�tjd|� � �fdd��jD �}|slt d��|d }|j |jkr�t d ��y"|j j t j �}t jjj|jk}W n t jtfk r� d }Y nX |s�t d ��|j}tj|j� |j|j|� �j}|�st d ��tj|j� �j�j|� dS )zIVerify an OCSP response signature against certificate issuer or responder)r( r c S s t jj| j� �jS )N)r ZSubjectKeyIdentifierZfrom_public_key� public_keyZdigest)r( r r r � _key_hash� s z1_check_ocsp_response_signature.<locals>._key_hashzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s* g | ]"}�j |jks"�j� |�kr|�qS r )�responder_name�subject�responder_key_hash)rH r( )rn rd r r rK s z2_check_ocsp_response_signature.<locals>.<listcomp>z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz<responder is not authorized by issuer to sign OCSP responsesz#no signature hash algorithm definedN)r � Certificate�bytesro rp rq r" r; Z certificatesrb rc rQ rR ZExtendedKeyUsageZoidZExtendedKeyUsageOIDZ OCSP_SIGNINGrS rT rU Zsignature_hash_algorithmr Zverify_signed_payloadrm Z signatureZtbs_certificate_bytesZtbs_response_bytes) rd rh r* Zresponder_certZresponder_certsrY Zdelegate_authorizedZchosen_cert_hashZchosen_response_hashr )rn rd r rj � s: rj )r* � ocsp_output� ocsp_errorsr c s� d}� fdd�|D �}�fdd�|D �\}}}|r<|j d�nd }d |ksT|rP|sT|rrtjd � � tjd �|� d S |r�| r�d S |r�|j d�}|r�tjd|� dS tjd�|� d S d S )z7Parse openssl's weird output to work out what it means.�good�revoked�unknownc s g | ]}d j � |��qS )z{0}: (WARNING.*)?{1})�format)rH �s)r* r r rK 3 s z)_translate_ocsp_query.<locals>.<listcomp>c 3 s | ]}t j|� t jd �V qdS ))�flagsN)�re�search�DOTALL)rH �p)rt r r � <genexpr>4 s z(_translate_ocsp_query.<locals>.<genexpr>� NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output: %s stderr: %sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s stderr:%s)rv rw rx )�groupr" r# r; r_ ) r* rt ru ZstatesZpatternsrv rw rx r_ r )r* rt r r= / s$ r= )-rD r r Zloggingr| r$ r Ztypingr r Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr r Zcryptography.x509r r/ r] Zcertbotr r r Zcertbot.compat.osr Zcertbot.interfacesr Z getLoggerrA r" r r: r1 rF rE r3 rr r` rj r= r r r r �<module> s> e 1"8
Back to File Manager