← Back
Editing: ocsp.cpython-38.pyc
U �]Q3 � @ sD d Z ddlZddlZddlmZmZ ddlmZmZ z ddlm Z e e j d� W n e e fk rl dZ Y nX ddlmZ ddlmZ dd lmZ dd lmZ dd lmZmZ ddlZddlZdd lmZm Z dd l m Z ddl m Z ddl m!Z! ddl m"Z" e�#e$�Z%G dd� de&�Z'dd� Z(dd� Z)dd� Z*dd� Z+dd � Z,dS ) z*Tools for checking certificate revocation.� N)�datetime� timedelta)�Popen�PIPE)�ocsp�signature_hash_algorithm)�x509)�default_backend)� serialization)�hashes)�UnsupportedAlgorithm�InvalidSignature)�Optional�Tuple)� crypto_util)�errors)� RenewableCert)�utilc @ s* e Zd ZdZd dd�Zdd� Zdd� Zd S ) �RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.Fc C s~ d| _ |pt | _| jrzt�d�s6t�d� d| _ d S tdddddgttdd �}|� � \}}d |krpd d � | _ n d d � | _ d S )NF�opensslz-openssl not installed, can't check revocationTr �-header�var�val)�stdout�stderrZuniversal_newlinesz Missing =c S s d| gS )NzHost=� ��hostr r �./usr/lib/python3/dist-packages/certbot/ocsp.py�<lambda>1 � z,RevocationChecker.__init__.<locals>.<lambda>c S s d| gS )NZHostr r r r r r 3 r ) �brokenr �use_openssl_binaryr Z exe_exists�logger�infor r Z communicate� host_args)�selfZ enforce_openssl_binary_usageZtest_host_formatZ_out�errr r r �__init__" s � zRevocationChecker.__init__c C sp |j |j }}| jrdS tj�t�� �}|j|kr6dS t |�\}}|rJ|sNdS | j rd| � ||||�S t |||�S )a Get revoked status for a particular cert version. .. todo:: Make this a non-blocking call :param `.storage.RenewableCert` cert: Certificate object :returns: True if revoked; False if valid or the check failed or cert is expired. :rtype: bool F) �cert�chainr! �pytzZUTCZfromutcr �utcnowZ target_expiry�_determine_ocsp_serverr" �_check_ocsp_openssl_bin�_check_ocsp_cryptography)r& r) � cert_path� chain_path�now�urlr r r r � ocsp_revoked5 s z RevocationChecker.ocsp_revokedc C s� dddd|d|d|d|d|d d g| � |� }t�d |� t�d �|�� ztj|tjd �\}}W n$ tjk r� t�d|� Y dS X t |||�S )Nr r z -no_noncez-issuerz-certz-urlz-CAfilez -verify_otherz -trust_otherr zQuerying OCSP for %s� )�log�*OCSP check failed for %s (are we offline?)F) r% r# �debug�joinr Z run_scriptr ZSubprocessErrorr$ �_translate_ocsp_query)r& r0 r1 r r3 �cmd�outputr' r r r r. T s2 �� z)RevocationChecker._check_ocsp_openssl_binN)F)�__name__� __module__� __qualname__�__doc__r( r4 r. r r r r r s r c s� t | d��}t�|�� t� �}W 5 Q R X z:|j�tj�}tjj � � fdd�|j D �}|d j j }W n( tj t fk r� t�d| � Y dS X |�� }|�d�d �d �}|r�||fS t�d || � dS ) z�Extract the OCSP server host from a certificate. :param str cert_path: Path to the cert we're checking OCSP for :rtype tuple: :returns: (OCSP server URL or None, OCSP server host or None) �rbc s g | ]}|j � kr|�qS r )Z access_method)�.0Z description�Zocsp_oidr r � <listcomp>x s �z*_determine_ocsp_server.<locals>.<listcomp>r z Cannot extract OCSP URI from %s)NNz://� �/z4Cannot process OCSP host from URL (%s) in cert at %s)�openr �load_pem_x509_certificate�readr � extensions�get_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSP�valueZaccess_location�ExtensionNotFound� IndexErrorr# r$ �rstrip� partition)r0 � file_handlerr) � extensionZ descriptionsr3 r r rC r r- j s r- c C s t |d��}t�|�� t� �}W 5 Q R X t | d��}t�|�� t� �}W 5 Q R X t�� }|�||t� � �}|� � }|� t j j�}ztj||ddid�} W n* tjjk r� tjd| dd� Y dS X | jd kr�t�d | | j� dS t�| j�} | jtjjk�rt�d | | j� dS zt | ||| � W n� t k �rV } zt�t | �� W 5 d } ~ X Y n� t j k �r� } zt�t | �� W 5 d } ~ X Y nt t!k �r� t�d | � Y nT t"k �r� } zt�d | t | �� W 5 d } ~ X Y n X t�#d| | j$� | j$tj%j&kS dS )NrA z Content-Typezapplication/ocsp-request)�dataZheadersr7 T)�exc_infoF�� z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rG r rH rI r r ZOCSPRequestBuilderZadd_certificater ZSHA1ZbuildZ public_bytesr ZEncodingZDER�requestsZpost� exceptionsZRequestExceptionr# r$ Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ SUCCESSFUL�error�_check_ocsp_responser �strr �Errorr �AssertionErrorr8 Zcertificate_statusZOCSPCertStatusZREVOKED) r0 r1 r3 rQ �issuerr) ZbuilderZrequestZrequest_binaryZresponse� response_ocsp�erX r r r r/ � sR � � $ �r/ c C s� | j |j krtd��t| ||� t| jt|j��rJ| j|jksJ| j|jkrRtd��t� � }| j shtd��| j |t dd� kr�td��| j r�| j |t dd� k r�td��dS ) z4Verify that the OCSP is valid for serveral criteriaszMthe certificate in response does not correspond to the certificate in requestz<the issuer does not correspond to issuer of the certificate.z param thisUpdate is not set.� )Zminutesz"param thisUpdate is in the future.z param nextUpdate is in the past.N) Z serial_numberr\ � _check_ocsp_response_signature� isinstanceZhash_algorithm�typeZissuer_key_hashZissuer_name_hashr r, Z this_updater Z next_update)r^ Z request_ocsp� issuer_certr0 r2 r r r rY � s � � rY c s� � j |jkr t�d|� |}n�t�d|� � fdd�� jD �}|sJtd��|d }|j|jkrftd��z"|j�t j �}t j j j |jk}W n t jtfk r� d}Y nX |s�td ��|j}t�|�� |j|j|� � j}t�|�� � j� j|� d S ) zIVerify an OCSP response signature against certificate issuer or responderzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s g | ]}|j � jkr|�qS r )�subject�responder_name)rB r) �r^ r r rD � s �z2_check_ocsp_response_signature.<locals>.<listcomp>z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz<responder is not authorized by issuer to sign OCSP responsesN)rf re r# r8 Z certificatesr\ r] rJ rK r ZExtendedKeyUsageZoidZExtendedKeyUsageOIDZ OCSP_SIGNINGrL rM rN r r Zverify_signed_payloadZ public_keyZ signatureZtbs_certificate_bytesZtbs_response_bytes)r^ rd r0 Zresponder_certZresponder_certsrR Zdelegate_authorizedZ chosen_hashr rg r ra � s> �� � �ra c s� d}� fdd�|D �}�fdd�|D �\}}}|r<|� d�nd}d|ksT|rP|sT|rrt�d � � t�d �|� d S |r~|s~d S |r�|� d�}|r�t�d |� d S t�d�|� d S dS )z7Parse openssl's weird output to work out what it means.)�good�revoked�unknownc s g | ]}d � � |��qS )z{0}: (WARNING.*)?{1})�format)rB �s)r0 r r rD s z)_translate_ocsp_query.<locals>.<listcomp>c 3 s | ]}t j|� t jd �V qdS ))�flagsN)�re�search�DOTALL)rB �p)� ocsp_outputr r � <genexpr> s z(_translate_ocsp_query.<locals>.<genexpr>� NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output: %s stderr: %sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s stderr:%s)�groupr# r$ r8 �warning) r0 rr Z ocsp_errorsZstatesZpatternsrh ri rj rv r )r0 rr r r: s( �r: )-r@ Zloggingrn r r � subprocessr r Zcryptography.x509r �getattrZ OCSPResponse� ImportError�AttributeErrorZ cryptographyr Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr r Zcryptography.exceptionsr r r+ rV Zacme.magic_typingr r Zcertbotr r Zcertbot.storager r Z getLoggerr= r# �objectr r- r/ rY ra r: r r r r �<module> s8 K 1"1
Save File
Cancel