a
}|ge< @ s d Z ddlmZ ddlmZ ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
Z
ddl m Z dd l
mZ dd
l
mZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlm Z ddl m Z ddl m Z e!e"Z#G dd dZ$e%e ee% ee% f dddZ&e%e%e%e'e(dddZ)d d e j*e%dd d d Z+d e j*e%dd!d"d#Z,e%e%e%e(d$d%d&Z-dS )'z*Tools for checking certificate revocation. )datetime) timedeltaN)PIPE)Optional)Tuple)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)hashes)
serialization)ocsp) crypto_util)errors)util)getenv)
RenewableCertc @ s` e Zd ZdZdeddddZeeddd Zdeee ed d d
Z
eeeee edddZ dS )RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.FN) enforce_openssl_binary_usagereturnc C sr d| _ || _| jrntds0td d| _ d S tjg dttddt d}d|j
v rddd | _ n
d
d | _ d S ) NFopensslz-openssl not installed, can't check revocationT)r r
-headervarval)stdoutstderrZuniversal_newlinescheckenvz Missing =c S s
d| gS )NzHost= hostr r 0/usr/lib/python3.9/site-packages/certbot/ocsp.py1 z,RevocationChecker.__init__..c S s d| gS )NZHostr r r r r! r" 3 r# ) brokenuse_openssl_binaryr Z
exe_existsloggerinfo
subprocessrunr Z env_no_snap_for_external_callsr host_args)selfr Ztest_host_formatr r r! __init__" s
zRevocationChecker.__init__certr c C s | |j|jS )a Get revoked status for a particular cert version.
.. todo:: Make this a non-blocking call
:param `.interfaces.RenewableCert` cert: Certificate object
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
)ocsp_revoked_by_paths cert_path
chain_path)r+ r. r r r! ocsp_revoked5 s
z RevocationChecker.ocsp_revoked
)r0 r1 timeoutr c C sf | j r
dS ttj}t||kr(dS t|\}}|r<|s@dS | jrX| |||||S t
||||S )aE Performs the OCSP revocation check
:param str cert_path: Certificate filepath
:param str chain_path: Certificate chain
:param int timeout: Timeout (in seconds) for the OCSP query
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
F) r$ r nowpytzUTCr ZnotAfter_determine_ocsp_serverr% _check_ocsp_openssl_bin_check_ocsp_cryptography)r+ r0 r1 r4 r5 urlr r r r! r/ A s z'RevocationChecker.ocsp_revoked_by_paths)r0 r1 r r; r4 r c
C s t d}t d}d }|d us$|d ur4|d ur0|n|}|d u rFd|g} n&|dr`|tdd }d|d|g} ddd d
|d |d |d
|ddt|dg| | | }
td| td|
ztj |
tjd\} } W n" t
j y t d| Y dS 0 t
|| | S )NZ
http_proxyZ
HTTP_PROXYz-urlzhttp://z-hostz-pathr r
z -no_noncez-issuerz-certz-CAfilez
-verify_otherz -trust_otherz-timeoutr zQuerying OCSP for %s )log*OCSP check failed for %s (are we offline?)F)r
startswithlenstrr* r& debugjoinr Z
run_scriptr ZSubprocessErrorr' _translate_ocsp_query)
r+ r0 r1 r r; r4 Zenv_http_proxyZenv_HTTP_PROXYZ
proxy_hostZurl_optscmdoutputerrr r r! r9 ^ s@
z)RevocationChecker._check_ocsp_openssl_bin)F)r3 ) __name__
__module__ __qualname____doc__boolr, r r2 rA intr/ r9 r r r r! r s r )r0 r c s t | d"}t| t }W d n1 s20 Y z:|jtj}tjj fdd|j
D }|d j j
}W n& tj t
fy td| Y dS 0 | }|dd d
}|r||fS td || dS ) zExtract the OCSP server host from a certificate.
:param str cert_path: Path to the cert we're checking OCSP for
:rtype tuple:
:returns: (OCSP server URL or None, OCSP server host or None)
rbNc s g | ]}|j kr|qS r )Z
access_method).0 descriptionZocsp_oidr r!
s
z*_determine_ocsp_server..r z Cannot extract OCSP URI from %s)NNz:// /z;Cannot process OCSP host from URL (%s) in certificate at %s)openr load_pem_x509_certificatereadr
extensionsget_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSPvalueZaccess_locationExtensionNotFound
IndexErrorr& r' rstrip partition)r0 file_handlerr. extensionZ descriptionsr; r r rQ r! r8 s 0 r8 )r0 r1 r; r4 r c
C s. t |d"}t| t }W d n1 s20 Y t | d"}t| t }W d n1 sn0 Y t }|||t }|
}| t j
j} ztj|| ddi|d}
W n( tjjy tjd| dd Y dS 0 |
jd kr td
| |
j dS t|
j} | jtjjkr T)exc_infoF z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rU r rV rW r
r
ZOCSPRequestBuilderZadd_certificater ZSHA1ZbuildZ public_bytesr ZEncodingZDERrequestsZpost
exceptionsZRequestExceptionr& r' Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ
SUCCESSFULwarning_check_ocsp_responser rA r Errorr AssertionErrorrB Zcertificate_statusZOCSPCertStatusZREVOKED)r0 r1 r; r4 r_ issuerr. ZbuilderZrequestZrequest_binaryZresponse
response_ocspeerrorr r r! r: sP 0 0
""(r: zocsp.OCSPResponsezocsp.OCSPRequest)rk request_ocsp issuer_certr0 r c C s | j |j krtdt| || t| jt|jrJ| j|jksJ| j|jkrRtdt t
j j dd}t
j t
jddd | jstd| j|td d
krtd | jr| j|td d
k rtd W d n1 s0 Y dS )
z2Verify that the OCSP is valid for several criteriazMthe certificate in response does not correspond to the certificate in requestztd| |}ntd| fddjD }|slt d|d }|j
|jkrt d
z"|j t j
}t jjj|jv }W n t jtfy d }Y n0 |st d |j}t| |j|j| j}|st d
t| jj| dS )zIVerify an OCSP response signature against certificate issuer or responderr- c S s t j| jS )N)r ZSubjectKeyIdentifierZfrom_public_key
public_keyZdigest)r. r r r! _key_hash s z1_check_ocsp_response_signature.._key_hashzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s* g | ]"}j |jks"j |kr|qS r )responder_namesubjectresponder_key_hash)rO r. r{ rk r r! rR
s z2_check_ocsp_response_signature..z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz.c 3 s | ]}t j| t jd V qdS ))flagsN)researchDOTALL)rO p)r r r! ; r# z(_translate_ocsp_query.. NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output:
%s
stderr:
%sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s
stderr:%s)groupr& r' rB rf ) r0 r r Zstatespatternsr r r rf r )r0 r r! rD 6 s&
rD ).rK r r Zloggingr r( r typingr r rw Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr
Z cryptography.hazmat.primitivesr r Zcryptography.x509r
r6 rd Zcertbotr r r Zcertbot.compat.osr Zcertbot.interfacesr Z getLoggerrH r& r rA r8 rM rL r: r rg rs rD r r r r! sD
e 1 ) :