File: //lib/python3.9/site-packages/acme/__pycache__/crypto_util.cpython-39.pyc
a
}|�gD � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZddlm Z ddlm
Z
ddlm Z ddlm Z ddlm
Z
ddlmZ dd lmZ dd
lmZ dd lmZ dd lmZ dd
lmZmZ ddlmZmZmZmZm Z ddl Z ddl m Z ddl m!Z! ddl"m#Z# e�$e%�Z&e!j'Z(G dd� dej)�Z*G dd� d�Z+G dd� d�Z,dde(ddfe-e-e.e.e.ee/e.f e
ee- e j0d�d d �Z1d3e-e
eee/ e e/ f e2e
e eej3ej4f e-d �d d!�Z5ej6ej7e e/ d"�d#d$�Z8ee j0e j9f e e/ d%�d&d'�Z:ee j0e j9f e e/ d(�d)d*�Z;d4e j<e
e e/ e
e. e.e2e
e e j= e
e eej3ej4f e j0d-�d.d/�Z>e*j?fee e j@ e e j0 f ee*e.f e-d0�d1d2�ZAdS )5zCrypto utilities.� N)�Any)�Callable)�List)�Mapping)�Optional)�Sequence)�Set)�Tuple)�Union)�x509)�hashes�
serialization)�dsa�rsa�ec�ed25519�ed448)�crypto)�SSL)�errorsc @ s, e Zd ZdZejZejZe j
d�dd�Z dS )�Formatz�File format to be used when parsing or serializing X.509 structures.
Backwards compatible with the `FILETYPE_ASN1` and `FILETYPE_PEM` constants
from pyOpenSSL.
��returnc C s | t jkrtjjS tjjS dS )zJConverts the Format to the corresponding cryptography `Encoding`.
N)r �DERr
�Encoding�PEM)�self� r �4/usr/lib/python3.9/site-packages/acme/crypto_util.py�to_cryptography_encoding2 s
z Format.to_cryptography_encodingN) �__name__�
__module__� __qualname__�__doc__r Z
FILETYPE_ASN1r Z FILETYPE_PEMr r
r r r r r r r ) s r c @ sP e Zd Zeeeejejf f d�dd�Z e
j e eejejf d�dd�Z
dS )�_DefaultCertSelection��certsc C s
|| _ d S �Nr% )r r& r r r �__init__< s z _DefaultCertSelection.__init__��
connectionr c C s |� � }|r| j�|d �S d S r' )�get_servernamer& �get)r r* Z server_namer r r �__call__? s z _DefaultCertSelection.__call__N)r r! r" r �bytesr r �PKey�X509r( r �
Connectionr r- r r r r r$ ; s "r$ c @ s� e Zd ZdZdeddfejeeee e
j e
j f f e
eeejee gef eeejgee e
j e
j f f dd�dd�Zeed�dd�Zejdd �d
d �ZG d d
� d
�Ze eef d�dd�ZdS )� SSLSocketa� SSL wrapper for sockets.
:ivar socket sock: Original wrapped socket.
:ivar dict certs: Mapping from domain names (`bytes`) to
`OpenSSL.crypto.X509`.
:ivar method: See `OpenSSL.SSL.Context` for allowed values.
:ivar alpn_selection: Hook to select negotiated ALPN protocol for
connection.
:ivar cert_selection: Hook to select certificate for connection. If given,
`certs` parameter would be ignored, and therefore must be empty.
N)�sockr& �method�alpn_selection�cert_selectionr c C sT || _ || _|| _|s"|s"td��|r2|r2td��|d u rJt|rD|ni �}|| _d S )Nz*Neither cert_selection or certs specified.z(Both cert_selection and certs specified.)r3 r5 r4 �
ValueErrorr$ r6 )r r3 r& r4 r5 r6 r r r r( S s zSSLSocket.__init__��namer c C s t | j|�S r' )�getattrr3 �r r9 r r r � __getattr__f s zSSLSocket.__getattr__r) c C s� | � |�}|du r&t�d|�� � dS |\}}t�| j�}|�tj� |�tj � |�
|� |� |� | j dur||�
| j � |�|� dS )a� SNI certificate callback.
This method will set a new OpenSSL context object for this
connection when an incoming connection provides an SNI name
(in order to serve the appropriate certificate, if any).
:param connection: The TLS connection object on which the SNI
extension was received.
:type connection: :class:`OpenSSL.Connection`
Nz=Certificate selection for server name %s failed, dropping SSL)r6 �logger�debugr+ r �Contextr4 � set_options� OP_NO_SSLv2� OP_NO_SSLv3Zuse_privatekeyZuse_certificater5 �set_alpn_select_callbackZ set_context)r r* Zpair�key�certZ new_contextr r r �_pick_certificate_cbi s
�
z SSLSocket._pick_certificate_cbc @ sB e Zd ZdZejdd�dd�Zeed�dd�Z ee
d �d
d �Z dS ) zSSLSocket.FakeConnectionz Fake OpenSSL.SSL.Connection.Nr) c C s
|| _ d S r' )�_wrapped)r r* r r r r( � s z!SSLSocket.FakeConnection.__init__r8 c C s t | j|�S r' )r: rG r; r r r r< � s z$SSLSocket.FakeConnection.__getattr__)� unused_argsr c
G s@ z | j �� W S tjy: } zt|��W Y d }~n
d }~0 0 d S r' )rG �shutdownr �Error�OSError)r rH �errorr r r rI � s z!SSLSocket.FakeConnection.shutdown) r r! r" r# r r1 r( �strr r< �boolrI r r r r �FakeConnection� s rO r c
C s� | j �� \}}z�t�| j�}|�tj� |�tj� |�| j � | j
d urV|� | j
� | � t�
||��}|�� t�d|� z |�� W n. tjy� } zt|��W Y d }~n
d }~0 0 ||fW S |�� � Y n0 d S )Nz Performing handshake with %s)r3 �acceptr r? r4 r@ rA rB Z set_tlsext_servername_callbackrF r5 rC rO r1 Zset_accept_stater= r> � do_handshakerJ rK �close)r r3 �addr�contextZssl_sockrL r r r rP � s&
zSSLSocket.accept)r r! r" r# �_DEFAULT_SSL_METHOD�socketr r r. r r r/ r0 �intr r r1 r r( rM r r< rF rO rP r r r r r2 F s(
�
��� r2 i� i, )� r )r9 �host�port�timeoutr4 �source_address�alpn_protocolsr c C sP t �|�}|�|� d|i}zJt�d||t|�rDd�|d |d �nd� ||f} tj| fi |��}
W n. t y� } zt
� | ��W Y d} ~ n
d} ~ 0 0 t �
|
���} t �|| �}
|
�� |
�| � |dur�|
�|� z|
�� |
�� W n2 t j �y } zt
� | ��W Y d} ~ n
d} ~ 0 0 W d � n1 �s00 Y |
�� }|�sLJ �|S )a Probe SNI server for SSL certificate.
:param bytes name: Byte string to send as the server name in the
client hello message.
:param bytes host: Host to connect to.
:param int port: Port to connect to.
:param int timeout: Timeout in seconds.
:param method: See `OpenSSL.SSL.Context` for allowed values.
:param tuple source_address: Enables multi-path probing (selection
of source interface). See `socket.creation_connection` for more
info. Available only in Python 2.7+.
:param alpn_protocols: Protocols to request using ALPN.
:type alpn_protocols: `Sequence` of `bytes`
:raises acme.errors.Error: In case of any problems.
:returns: SSL certificate presented by the server.
:rtype: OpenSSL.crypto.X509
r\ z!Attempting to connect to %s:%d%s.z
from {0}:{1}r � rX N)r r? Z set_timeoutr= r> �any�formatrV Zcreate_connectionrK r rJ �
contextlib�closingr1 Zset_connect_stateZset_tlsext_host_nameZset_alpn_protosrQ rI Zget_peer_certificate)r9 rY rZ r[ r4 r\ r] rT Z
socket_kwargsZ socket_tupler3 rL ZclientZ
client_sslrE r r r � probe_sni� s>
���
@
rc F)�private_key_pem�domains� must_staple�ipaddrsr c C s� t j| dd�}t|tjtjtjt j
t j f�s>t
dt|�� ���|du rJg }|du rVg }t|�t|� dkrrt
d��t�� �t�g ��jt�dd� |D �dd� |D � �d d
�}|r�|jt�tjjg�d d
�}|�|t�� �}|� t j j �S ) a� Generate a CSR containing domains or IPs as subjectAltNames.
Parameters are ordered this way for backwards compatibility when called using positional
arguments.
:param buffer private_key_pem: Private key, in PEM PKCS#8 format.
:param list domains: List of DNS names to include in subjectAltNames of CSR.
:param bool must_staple: Whether to include the TLS Feature extension (aka
OCSP Must Staple: https://tools.ietf.org/html/rfc7633).
:param list ipaddrs: List of IPaddress(type ipaddress.IPv4Address or ipaddress.IPv6Address)
names to include in subbjectAltNames of CSR.
:returns: buffer PEM-encoded Certificate Signing Request.
N)�passwordzInvalid private key type: r zAAt least one of domains or ipaddrs parameter need to be not emptyc S s g | ]}t �|��qS r )r �DNSName��.0�dr r r �
<listcomp>$ � z make_csr.<locals>.<listcomp>c S s g | ]}t �|��qS r )r Z IPAddress)rk �ir r r rm % rn F)�critical) r
Zload_pem_private_key�
isinstancer Z
DSAPrivateKeyr Z
RSAPrivateKeyr ZEllipticCurvePrivateKeyr ZEd25519PrivateKeyr ZEd448PrivateKeyr7 �type�lenr Z CertificateSigningRequestBuilderZ subject_name�Name�
add_extension�SubjectAlternativeNameZ
TLSFeatureZTLSFeatureTypeZstatus_request�signr ZSHA256� public_bytesr r )rd re rf rg Z private_keyZbuilderZcsrr r r �make_csr� sJ ��
�� ���� �ry )�subject�extsr c sx dd� | � tjj�D �� z|�tj�}W n tjy@ g }Y n0 |j�tj �}� sX|S � d g� fdd�|D � S dS )a� Gets all DNS SAN names as well as the first Common Name from subject.
:param subject: Name of the x509 object, which may include Common Name
:type subject: `cryptography.x509.Name`
:param exts: Extensions of the x509 object, which may include SANs
:type exts: `cryptography.x509.Extensions`
:returns: List of DNS Subject Alternative Names and first Common Name
:rtype: `list` of `str`
c S s g | ]}t �t|j��qS r )�typing�castrM �value)rk �cr r r rm E s �z9get_names_from_subject_and_extensions.<locals>.<listcomp>r c s g | ]}|� d kr|�qS )r r rj �Zcnsr r rm U rn N)
Zget_attributes_for_oidr ZNameOIDZ COMMON_NAME�get_extension_for_classrv �ExtensionNotFoundr~ �get_values_for_typeri )rz r{ �san_extZ dns_namesr r� r �%get_names_from_subject_and_extensions6 s �
r� )�loaded_cert_or_reqr c C s | � � }t|j|j�S r' )�to_cryptographyr� rz �
extensions)r� � cert_or_reqr r r � _pyopenssl_cert_or_req_all_namesX s �r� )r� r c C sB | � � j}z|�tj�}W n tjy2 g Y S 0 |j�tj�S )ay Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
.. note:: Although this is `acme` internal API, it is used by
`letsencrypt`.
:param cert_or_req: Certificate or CSR.
:type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
:returns: A list of Subject Alternative Names that is DNS.
:rtype: `list` of `str`
) r� r� r� r rv r� r~ r� ri )r� r{ r� r r r �_pyopenssl_cert_or_req_san` s
r� �: T)rD re �
not_before�validity� force_sanr� �ipsr c C sb |s|sJ d��t �� }|�tt�t�d��d�� |�d� |du rJg }|du rVg }|du rbg }|� t �
ddd�� t |�dkr�|d |� � _
|�|� � � g }|D ]} |� d | � q�|D ]}
|� d
|
j � q�d �|��d �} |�st |�d
k�st |�dk�r |� t j
dd| d�� |�|� |�|du �r8dn|� |�|� |�| � |�| d� |S )at Generate new self-signed certificate.
:type domains: `list` of `str`
:param OpenSSL.crypto.PKey key:
:param bool force_san:
:param extensions: List of additional extensions to include in the cert.
:type extensions: `list` of `OpenSSL.crypto.X509Extension`
:type ips: `list` of (`ipaddress.IPv4Address` or `ipaddress.IPv6Address`)
If more than one domain is provided, all of the domains are put into
``subjectAltName`` X.509 extension and first domain is set as the
subject CN. If only one domain is provided no ``subjectAltName``
extension is used, unless `force_san` is ``True``.
z7Must provide one or more hostnames or IPs for the cert.� � Ns basicConstraintsTs CA:TRUE, pathlen:0r zDNS:zIP:z, �asciir^ s subjectAltNameF)rp r~ Zsha256)r r0 Zset_serial_numberrW �binasciiZhexlify�os�urandomZ set_version�append�
X509Extensionrs Z get_subjectZCNZ
set_issuer�exploded�join�encodeZadd_extensionsZgmtime_adj_notBeforeZgmtime_adj_notAfterZ
set_pubkeyrw ) rD re r� r� r� r� r� rE Zsanlist�address�ipZ
san_stringr r r � gen_ss_certv sH
�� "�
r� )�chain�filetyper c s@ t ���ttjtjf td��fdd� � d�� fdd�| D ��S )z�Dump certificate chain into a bundle.
:param list chain: List of `OpenSSL.crypto.X509` (or wrapped in
:class:`josepy.util.ComparableX509`).
:returns: certificate chain bundle
:rtype: bytes
)rE r c s< t | tj�r*t | jtj�r$t�d��| j} | �� � � �
� �S )NzUnexpected CSR provided.) rq �jose�ComparableX509�wrappedr �X509Reqr rJ r� rx r )rE )r� r r �
_dump_cert� s
z(dump_pyopenssl_chain.<locals>._dump_certrn c 3 s | ]}� |�V qd S r' r )rk rE )r� r r � <genexpr>� rn z'dump_pyopenssl_chain.<locals>.<genexpr>)r r
r� r� r r0 r. r� )r� r� r )r� r� r �dump_pyopenssl_chain� s
r� )NFN)NNr� TNN)Br# r� ra �enum� ipaddressZloggingr� rV r| r r r r r r r r r
Z cryptographyr Z cryptography.hazmat.primitivesr r
Z)cryptography.hazmat.primitives.asymmetricr r r r r Zjosepyr� ZOpenSSLr r Zacmer Z getLoggerr r= Z
SSLv23_METHODrU �IntEnumr r$ r2 r. rW rM r0 rc rN � IPv4Address� IPv6Addressry rt Z
Extensionsr� r� r� r� r/ r� r� r r� r� r r r r �<module> s�
t�
� ; �� D� "� � � C� �