a
}|gD @ s d Z ddlZddlZddlZddlZddlZddlZddlZddlZddlm Z ddlm
Z
ddlm Z ddlm Z ddlm
Z
ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lmZmZ ddlmZmZmZmZm Z ddl Z ddl m Z ddl m!Z! ddl"m#Z# e$e%Z&e!j'Z(G dd dej)Z*G dd dZ+G dd dZ,dde(ddfe-e-e.e.e.ee/e.f e
ee- e j0dd d Z1d3e-e
eee/ e e/ f e2e
e eej3ej4f e-d d d!Z5ej6ej7e e/ d"d#d$Z8ee j0e j9f e e/ d%d&d'Z:ee j0e j9f e e/ d(d)d*Z;d4e je*j?fee e j@ e e j0 f ee*e.f e-d0d1d2ZAdS )5zCrypto utilities. N)Any)Callable)List)Mapping)Optional)Sequence)Set)Tuple)Union)x509)hashes
serialization)dsarsaeced25519ed448)crypto)SSL)errorsc @ s, e Zd ZdZejZejZe j
dddZ dS )FormatzFile format to be used when parsing or serializing X.509 structures.
Backwards compatible with the `FILETYPE_ASN1` and `FILETYPE_PEM` constants
from pyOpenSSL.
returnc C s | t jkrtjjS tjjS dS )zJConverts the Format to the corresponding cryptography `Encoding`.
N)r DERr
EncodingPEM)self r 4/usr/lib/python3.9/site-packages/acme/crypto_util.pyto_cryptography_encoding2 s
z Format.to_cryptography_encodingN) __name__
__module__ __qualname____doc__r Z
FILETYPE_ASN1r Z FILETYPE_PEMr r
r r r r r r r ) s r c @ sP e Zd Zeeeejejf f dddZ e
j e eejejf dddZ
dS )_DefaultCertSelectioncertsc C s
|| _ d S Nr% )r r& r r r __init__< s z _DefaultCertSelection.__init__
connectionr c C s | }|r| j|d S d S r' )get_servernamer& get)r r* Z server_namer r r __call__? s z _DefaultCertSelection.__call__N)r r! r" r bytesr r PKeyX509r( r
Connectionr r- r r r r r$ ; s "r$ c @ s e Zd ZdZdeddfejeeee e
j e
j f f e
eeejee gef eeejgee e
j e
j f f ddddZeedddZejdd d
d ZG d d
d
Ze eef dddZdS ) SSLSocketa SSL wrapper for sockets.
:ivar socket sock: Original wrapped socket.
:ivar dict certs: Mapping from domain names (`bytes`) to
`OpenSSL.crypto.X509`.
:ivar method: See `OpenSSL.SSL.Context` for allowed values.
:ivar alpn_selection: Hook to select negotiated ALPN protocol for
connection.
:ivar cert_selection: Hook to select certificate for connection. If given,
`certs` parameter would be ignored, and therefore must be empty.
N)sockr& methodalpn_selectioncert_selectionr c C sT || _ || _|| _|s"|s"td|r2|r2td|d u rJt|rD|ni }|| _d S )Nz*Neither cert_selection or certs specified.z(Both cert_selection and certs specified.)r3 r5 r4
ValueErrorr$ r6 )r r3 r& r4 r5 r6 r r r r( S s zSSLSocket.__init__namer c C s t | j|S r' )getattrr3 r r9 r r r __getattr__f s zSSLSocket.__getattr__r) c C s | |}|du r&td| dS |\}}t| j}|tj |tj |
| | | | j dur||
| j || dS )a SNI certificate callback.
This method will set a new OpenSSL context object for this
connection when an incoming connection provides an SNI name
(in order to serve the appropriate certificate, if any).
:param connection: The TLS connection object on which the SNI
extension was received.
:type connection: :class:`OpenSSL.Connection`
Nz=Certificate selection for server name %s failed, dropping SSL)r6 loggerdebugr+ r Contextr4 set_options OP_NO_SSLv2 OP_NO_SSLv3Zuse_privatekeyZuse_certificater5 set_alpn_select_callbackZ set_context)r r* ZpairkeycertZ new_contextr r r _pick_certificate_cbi s
z SSLSocket._pick_certificate_cbc @ sB e Zd ZdZejddddZeedddZ ee
d d
d Z dS ) zSSLSocket.FakeConnectionz Fake OpenSSL.SSL.Connection.Nr) c C s
|| _ d S r' )_wrapped)r r* r r r r( s z!SSLSocket.FakeConnection.__init__r8 c C s t | j|S r' )r: rG r; r r r r< s z$SSLSocket.FakeConnection.__getattr__) unused_argsr c
G s@ z | j W S tjy: } zt|W Y d }~n
d }~0 0 d S r' )rG shutdownr ErrorOSError)r rH errorr r r rI s z!SSLSocket.FakeConnection.shutdown) r r! r" r# r r1 r( strr r< boolrI r r r r FakeConnection s rO r c
C s | j \}}zt| j}|tj |tj || j | j
d urV| | j
| t
||}| td| z | W n. tjy } zt|W Y d }~n
d }~0 0 ||fW S | Y n0 d S )Nz Performing handshake with %s)r3 acceptr r? r4 r@ rA rB Z set_tlsext_servername_callbackrF r5 rC rO r1 Zset_accept_stater= r> do_handshakerJ rK close)r r3 addrcontextZssl_sockrL r r r rP s&
zSSLSocket.accept)r r! r" r# _DEFAULT_SSL_METHODsocketr r r. r r r/ r0 intr r r1 r r( rM r r< rF rO rP r r r r r2 F s(
r2 i i, ) r )r9 hostporttimeoutr4 source_addressalpn_protocolsr c C sF t |}|| d|i}zJtd||t|rDd|d |d nd ||f} tj| fi |}
W n. t y } zt
| W Y d} ~ n
d} ~ 0 0 t
|
} t || }
|
|
| |dur|
| z|
|
W n2 t j y } zt
| W Y d} ~ n
d} ~ 0 0 W d n1 s00 Y |
}|S )a Probe SNI server for SSL certificate.
:param bytes name: Byte string to send as the server name in the
client hello message.
:param bytes host: Host to connect to.
:param int port: Port to connect to.
:param int timeout: Timeout in seconds.
:param method: See `OpenSSL.SSL.Context` for allowed values.
:param tuple source_address: Enables multi-path probing (selection
of source interface). See `socket.creation_connection` for more
info. Available only in Python 2.7+.
:param alpn_protocols: Protocols to request using ALPN.
:type alpn_protocols: `Sequence` of `bytes`
:raises acme.errors.Error: In case of any problems.
:returns: SSL certificate presented by the server.
:rtype: OpenSSL.crypto.X509
r\ z!Attempting to connect to %s:%d%s.z
from {0}:{1}r rX N)r r? Z set_timeoutr= r> anyformatrV Zcreate_connectionrK r rJ
contextlibclosingr1 Zset_connect_stateZset_tlsext_host_nameZset_alpn_protosrQ rI Zget_peer_certificate)r9 rY rZ r[ r4 r\ r] rT Z
socket_kwargsZ socket_tupler3 rL ZclientZ
client_sslrE r r r probe_sni s<
@rc F)private_key_pemdomains must_stapleipaddrsr c C s t j| dd}t|tjtjtjt j
t j fs>t
dt| |du rJg }|du rVg }t|t| dkrrt
dt tg jtdd |D dd |D d d
}|r|jttjjgd d
}||t }| t j j S ) a Generate a CSR containing domains or IPs as subjectAltNames.
Parameters are ordered this way for backwards compatibility when called using positional
arguments.
:param buffer private_key_pem: Private key, in PEM PKCS#8 format.
:param list domains: List of DNS names to include in subjectAltNames of CSR.
:param bool must_staple: Whether to include the TLS Feature extension (aka
OCSP Must Staple: https://tools.ietf.org/html/rfc7633).
:param list ipaddrs: List of IPaddress(type ipaddress.IPv4Address or ipaddress.IPv6Address)
names to include in subbjectAltNames of CSR.
:returns: buffer PEM-encoded Certificate Signing Request.
N)passwordzInvalid private key type: r zAAt least one of domains or ipaddrs parameter need to be not emptyc S s g | ]}t |qS r )r DNSName.0dr r r
$ z make_csr..c S s g | ]}t |qS r )r Z IPAddress)rk ir r r rm % rn F)critical) r
Zload_pem_private_key
isinstancer Z
DSAPrivateKeyr Z
RSAPrivateKeyr ZEllipticCurvePrivateKeyr ZEd25519PrivateKeyr ZEd448PrivateKeyr7 typelenr Z CertificateSigningRequestBuilderZ subject_nameName
add_extensionSubjectAlternativeNameZ
TLSFeatureZTLSFeatureTypeZstatus_requestsignr ZSHA256 public_bytesr r )rd re rf rg Z private_keyZbuilderZcsrr r r make_csr sJ
ry )subjectextsr c sx dd | tjjD z|tj}W n tjy@ g }Y n0 |jtj } sX|S d g fdd|D S dS )a Gets all DNS SAN names as well as the first Common Name from subject.
:param subject: Name of the x509 object, which may include Common Name
:type subject: `cryptography.x509.Name`
:param exts: Extensions of the x509 object, which may include SANs
:type exts: `cryptography.x509.Extensions`
:returns: List of DNS Subject Alternative Names and first Common Name
:rtype: `list` of `str`
c S s g | ]}t t|jqS r )typingcastrM value)rk cr r r rm E s z9get_names_from_subject_and_extensions..r c s g | ]}| d kr|qS )r r rj Zcnsr r rm U rn N)
Zget_attributes_for_oidr ZNameOIDZ COMMON_NAMEget_extension_for_classrv ExtensionNotFoundr~ get_values_for_typeri )rz r{ san_extZ dns_namesr r r %get_names_from_subject_and_extensions6 s
r )loaded_cert_or_reqr c C s | }t|j|jS r' )to_cryptographyr rz
extensions)r cert_or_reqr r r _pyopenssl_cert_or_req_all_namesX s r )r r c C sB | j}z|tj}W n tjy2 g Y S 0 |jtjS )ay Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
.. note:: Although this is `acme` internal API, it is used by
`letsencrypt`.
:param cert_or_req: Certificate or CSR.
:type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
:returns: A list of Subject Alternative Names that is DNS.
:rtype: `list` of `str`
) r r r r rv r r~ r ri )r r{ r r r r _pyopenssl_cert_or_req_san` s
r : T)rD re
not_beforevalidity force_sanr ipsr c C sN t }|tttdd |d |du r:g }|du rFg }|du rRg }| t
ddd t |dkr|d | _
|| g }|D ]} | d| q|D ]}
| d |
j qd
|d } |st |d kst |dkr| t j
d
d| d || ||du r$dn| || || || d |S )at Generate new self-signed certificate.
:type domains: `list` of `str`
:param OpenSSL.crypto.PKey key:
:param bool force_san:
:param extensions: List of additional extensions to include in the cert.
:type extensions: `list` of `OpenSSL.crypto.X509Extension`
:type ips: `list` of (`ipaddress.IPv4Address` or `ipaddress.IPv6Address`)
If more than one domain is provided, all of the domains are put into
``subjectAltName`` X.509 extension and first domain is set as the
subject CN. If only one domain is provided no ``subjectAltName``
extension is used, unless `force_san` is ``True``.
Ns basicConstraintsTs CA:TRUE, pathlen:0r zDNS:zIP:z, asciir^ s subjectAltNameF)rp r~ Zsha256)r r0 Zset_serial_numberrW binasciiZhexlifyosurandomZ set_versionappend
X509Extensionrs Z get_subjectZCNZ
set_issuerexplodedjoinencodeZadd_extensionsZgmtime_adj_notBeforeZgmtime_adj_notAfterZ
set_pubkeyrw ) rD re r r r r r rE ZsanlistaddressipZ
san_stringr r r gen_ss_certv sF
r )chainfiletyper c s@ t ttjtjf tdfdd d fdd| D S )zDump certificate chain into a bundle.
:param list chain: List of `OpenSSL.crypto.X509` (or wrapped in
:class:`josepy.util.ComparableX509`).
:returns: certificate chain bundle
:rtype: bytes
)rE r c s< t | tjr*t | jtjr$td| j} |
S )NzUnexpected CSR provided.) rq joseComparableX509wrappedr X509Reqr rJ r rx r )rE )r r r
_dump_cert s
z(dump_pyopenssl_chain.._dump_certrn c 3 s | ]} |V qd S r' r )rk rE )r r r rn z'dump_pyopenssl_chain..)r r
r r r r0 r. r )r r r )r r r dump_pyopenssl_chain s
r )NFN)NNr TNN)Br# r ra enum ipaddressZloggingr rV r| r r r r r r r r r
Z cryptographyr Z cryptography.hazmat.primitivesr r
Z)cryptography.hazmat.primitives.asymmetricr r r r r Zjosepyr ZOpenSSLr r Zacmer Z getLoggerr r= Z
SSLv23_METHODrU IntEnumr r$ r2 r. rW rM r0 rc rN IPv4Address IPv6Addressry rt Z
Extensionsr r r r r/ r r r r r r r r r s
t
; D " C