File: //usr/lib/python3/dist-packages/certbot/__pycache__/crypto_util.cpython-39.pyc
a
�`�R � @ s$ d Z ddlZddlZddlZddlZddlmZ ddlmZm Z ddl
m Z ddl m
Z
ddlmZmZ ddlmZ dd lmZ dd
lmZmZmZ dd lmZ dd lmZ ddl Z ddl Z ddl Z dd
l m!Z" ddl#m$Z$ ddl%m&Z& ddl%m'Z' ddl%m(Z( ddl)m*Z* e�+e,�Z-dOdd�Z.dd� Z/dd� Z0d d � Z1d d � Z2dPd!d"�Z3d#d$� Z4d%d&� Z5d'd(� Z6d)d*� Z7d+d,� Z8d-d.� Z9d/d0� Z:ej;fd1d2�Z<ej;fd3d4�Z=ej;fd5d6�Z>d7d8� Z?d9d:� Z@ej;fd;d<�ZAej;fd=d>�ZBd?d@� ZCdAdB� ZDdCdD� ZEdEdF� ZFe�GdGejH�ZIdHdI� ZJdJdK� ZKdQdMdN�ZLdS )Rz�Certbot client crypto utility functions.
.. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server
is capable of handling the signatures.
� N)�x509)�InvalidSignature�UnsupportedAlgorithm)�default_backend)�ec)�ECDSA�EllipticCurvePublicKey)�PKCS1v15)� RSAPublicKey)�Encoding� NoEncryption�
PrivateFormat)�crypto)�SSL)� crypto_util)�IO)�errors)�
interfaces)�util)�os�rsa� secp256r1�key-certbot.pemc
C s� zt | |p d|d�}W n6 tyL } z tjddd� |�W Y d}~n
d}~0 0 tj�tj�}t �
|d|j � t � t
j�||�dd �\}} |� |�|� W d � n1 s�0 Y |d
kr�t�d | | � nt�d | | � t �| |�S )
ai Initializes and saves a privkey.
Inits key and saves it in PEM format on the filesystem.
.. note:: keyname is the attempted filename, it may be different if a file
already exists at the path.
:param int key_size: key size in bits if key size is rsa.
:param str key_dir: Key save directory.
:param str key_type: Key Type [rsa, ecdsa]
:param str elliptic_curve: Name of the elliptic curve if key type is ecdsa.
:param str keyname: Filename of key
:returns: Key
:rtype: :class:`certbot.util.Key`
:raises ValueError: If unable to generate the key given key_size.
r )�bits�elliptic_curve�key_type� T��exc_infoNi� i� �wbr z Generating RSA key (%d bits): %sz"Generating ECDSA key (%d bits): %s)�make_key�
ValueError�logger�error�zope� component�
getUtilityr �IConfigr �make_or_verify_dir�strict_permissions� unique_filer �path�join�write�debugZKey)
Zkey_sizeZkey_dirr r ZkeynameZkey_pem�err�configZkey_f�key_path� r2 �5/usr/lib/python3/dist-packages/certbot/crypto_util.py�
init_save_key' s$
�
�(r4 c C s� t j�tj�}tj| j||jd�}t �
|d|j � t � t
j�|d�dd�\}}|� |�|� W d � n1 sr0 Y t�d|� t �||d�S ) a2 Initialize a CSR with the given private key.
:param privkey: Key to include in the CSR
:type privkey: :class:`certbot.util.Key`
:param set names: `str` names to include in the CSR
:param str path: Certificate save directory.
:returns: CSR
:rtype: :class:`certbot.util.CSR`
)� must_staplei� zcsr-certbot.pemi� r NzCreating CSR: %s�pem)r$ r% r& r r' �acme_crypto_utilZmake_csrr6 r5 r r( r) r* r r+ r, r- r" r. �CSR)�privkey�namesr+ r0 Zcsr_pemZcsr_fZ csr_filenamer2 r2 r3 �
init_save_csrT s
��( r; c C sH z t �t j| �}|�|�� �W S t jyB tjddd� Y dS 0 dS )z�Validate CSR.
Check if `csr` is a valid CSR for the given domains.
:param str csr: CSR in PEM.
:returns: Validity of CSR.
:rtype: bool
r Tr FN)r �load_certificate_request� FILETYPE_PEM�verifyZ
get_pubkey�Errorr" r. )�csr�reqr2 r2 r3 � valid_csrw s �rB c C sR t �t j| �}t �t j|�}z |�|�W S t jyL tjddd� Y dS 0 dS )z�Does private key correspond to the subject public key in the CSR?
:param str csr: CSR in PEM.
:param str privkey: Private key file contents (PEM)
:returns: Correspondence of private key to CSR subject public key.
:rtype: bool
r Tr FN)r r< r= �load_privatekeyr> r? r" r. )r@ r9 rA Zpkeyr2 r2 r3 �csr_matches_pubkey� s
� rD c C s� t j}t j}z|t j|�}W nH t jyd z|||�}W n$ t jy^ t�d�| ���Y n0 Y n0 t|�}t �||�}|t j
| |dd�|fS )a/ Import a CSR file, which can be either PEM or DER.
:param str csrfile: CSR filename
:param str data: contents of the CSR file
:returns: (`crypto.FILETYPE_PEM`,
util.CSR object representing the CSR,
list of domains requested in the CSR)
:rtype: tuple
z Failed to parse CSR file: {0}r6 )�file�dataZform) r r= r< �
FILETYPE_ASN1r? r �format�"_get_names_from_loaded_cert_or_reqZdump_certificate_requestr r8 )ZcsrfilerF �PEM�loadr@ ZdomainsZdata_pemr2 r2 r3 �import_csr_file� s rL � c
C s& |dkr8| dk r t �d�| ���t�� }|�tj| � n�|dk�rzD|�� }|dv rttj t
t|�� d�� t � d�}nt �d�|���W nZ t y� t �d�|���Y n: t
y� } z"t�|t �t|����W Y d}~n
d}~0 0 |jtjtjt� d �}t�tj|�}nt �d
�|���t�tj|�S ) aD Generate PEM encoded RSA|EC key.
:param int bits: Number of bits if key_type=rsa. At least 1024 for RSA.
:param str ec_curve: The elliptic curve to use.
:returns: new RSA or ECDSA key in PEM form with specified number of bits
or of type ec_curve when key_type ecdsa is used.
:rtype: str
r rM z Unsupported RSA key length: {}Zecdsa)Z SECP256R1Z SECP384R1Z SECP521R1N)ZcurveZbackendz Unsupported elliptic curve: {})�encodingrH Zencryption_algorithmz0Invalid key_type specified: {}. Use [rsa|ecdsa])r r? rH r ZPKeyZ generate_keyZTYPE_RSA�upperr Zgenerate_private_key�getattrr � TypeErrorr �sixZ
raise_from�strZ
private_bytesr rJ r
ZTraditionalOpenSSLr rC r= Zdump_privatekey)r r r �key�nameZ_key�eZ_key_pemr2 r2 r3 r � s4
� ,�r c C s4 zt �t j| ��� W S tt jfy. Y dS 0 dS )z�Is valid RSA private key?
:param str privkey: Private key file contents in PEM
:returns: Validity of private key.
:rtype: bool
FN)r rC r= ZcheckrQ r? )r9 r2 r2 r3 �
valid_privkey� s �
rW c C s" t | � t| � t| j| j� dS )a� For checking that your certs were not corrupted on disk.
Several things are checked:
1. Signature verification for the cert.
2. That fullchain matches cert and chain when concatenated.
3. Check that the private key matches the certificate.
:param renewable_cert: cert to verify
:type renewable_cert: certbot.interfaces.RenewableCert
:raises errors.Error: If verification fails.
N)�verify_renewable_cert_sig�verify_fullchain� verify_cert_matches_priv_key� cert_pathr1 )�renewable_certr2 r2 r3 �verify_renewable_cert� s
r] c
C s z�t | jd��"}t�|�� t� �}W d � n1 s60 Y t | jd��"}t�|�� t� �}W d � n1 st0 Y |�� }t� � �$ t
||j |j |j
� W d � n1 s�0 Y W nN tttf�y } z.d�| j|�}t�|� t�|��W Y d}~n
d}~0 0 dS )z�Verifies the signature of a RenewableCert object.
:param renewable_cert: cert to verify
:type renewable_cert: certbot.interfaces.RenewableCert
:raises errors.Error: If signature verification fails.
�rbNzbverifying the signature of the certificate located at {0} has failed. Details: {1})�open�
chain_pathr �load_pem_x509_certificate�readr r[ �
public_key�warnings�catch_warnings�verify_signed_payload� signatureZtbs_certificate_bytes�signature_hash_algorithm�IOErrorr! r rH r" � exceptionr r? )r\ �
chain_file�chain� cert_file�certZpkrV � error_strr2 r2 r3 rX s 00
�&�
rX c C s� t �� �� t �d� t| t�rB| �|t� |�}|�|� |�� n8t| t �rp| �|t
|��}|�|� |�� n
t � d��W d � n1 s�0 Y dS )a� Check the signature of a payload.
:param RSAPublicKey/EllipticCurvePublicKey public_key: the public_key to check signature
:param bytes signature: the signature bytes
:param bytes payload: the payload bytes
:param cryptography.hazmat.primitives.hashes.HashAlgorithm signature_hash_algorithm: algorithm used to hash the payload
:raises InvalidSignature: If signature verification fails.
:raises errors.Error: If public key type is not supported
�ignorezUnsupported public key typeN)
rd re � simplefilter�
isinstancer
�verifierr �updater> r r r r? )rc rg Zpayloadrh rs r2 r2 r3 rf s
�
�
rf c
C s~ z,t �t j�}|�| � |�|� |�� W nL tt jfyx } z.d�| ||�}t �
|� t �|��W Y d}~n
d}~0 0 dS )z� Verifies that the private key and cert match.
:param str cert_path: path to a cert in PEM format
:param str key_path: path to a private key file
:raises errors.Error: If they don't match.
z�verifying the certificate located at {0} matches the private key located at {1} has failed. Details: {2}N) r ZContextZ
SSLv23_METHODZuse_certificate_fileZuse_privatekey_fileZcheck_privatekeyri r? rH r" rj r )r[ r1 �contextrV ro r2 r2 r3 rZ ? s
�
rZ c
C s4 z�t | j��}|�� }W d � n1 s*0 Y t | j��}|�� }W d � n1 s\0 Y t | j��}|�� }W d � n1 s�0 Y || |kr�d}|�| j�}t�|��W nn t �y } z*d�|�}t
� |� t�|��W Y d}~n4d}~0 tj�y. } z|�W Y d}~n
d}~0 0 dS )z� Verifies that fullchain is indeed cert concatenated with chain.
:param renewable_cert: cert to verify
:type renewable_cert: certbot.interfaces.RenewableCert
:raises errors.Error: If cert and chain do not combine to fullchain.
Nz.fullchain does not match cert + chain for {0}!z8reading one of cert, chain, or fullchain has failed: {0}) r_ r` rb r[ Zfullchain_pathrH Z lineagenamer r? ri r" rj ) r\ rk rl rm rn Zfullchain_fileZ fullchainro rV r2 r2 r3 rY U s" & & &
rY c C s� g }t jt jfD ]L}zt �|| �|fW S t jyZ } z|�|� W Y d}~qd}~0 0 qt�d�d�dd� |D �����dS )z:Load PEM/DER certificate.
:raises errors.Error:
NzUnable to load: {0}�,c s s | ]}t |�V qd S �N)rS )�.0r# r2 r2 r3 � <genexpr>~ s z-pyopenssl_load_certificate.<locals>.<genexpr>) r r= rG �load_certificater? �appendr rH r, )rF Zopenssl_errorsZ file_typer# r2 r2 r3 �pyopenssl_load_certificatep s "�r| c C s6 z ||| �W S t jy0 tjddd� � Y n0 d S )Nr Tr )r r? r" r# �Zcert_or_req_str� load_func�typr2 r2 r3 �_load_cert_or_req� s
r� c C s t �t| ||��S rw )r7 Z_pyopenssl_cert_or_req_sanr� r} r2 r2 r3 �_get_sans_from_cert_or_req� s �r� c C s t | tj|�S )z�Get a list of Subject Alternative Names from a certificate.
:param str cert: Certificate (encoded).
:param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1`
:returns: A list of Subject Alternative Names.
:rtype: list
)r� r rz )rn r r2 r2 r3 �get_sans_from_cert� s
�r� c C s t | ||�}t|�S rw )r� rI )Z cert_or_reqr~ r �loaded_cert_or_reqr2 r2 r3 �_get_names_from_cert_or_req� s r� c C s
t �| �S rw )r7 Z _pyopenssl_cert_or_req_all_names)r� r2 r2 r3 rI � s rI c C s t | tj|�S )z�Get a list of domains from a cert, including the CN if it is set.
:param str cert: Certificate (encoded).
:param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1`
:returns: A list of domain names.
:rtype: list
)r� r rz )r@ r r2 r2 r3 �get_names_from_cert� s
�r� c C s t �| |�S )z�Dump certificate chain into a bundle.
:param list chain: List of `crypto.X509` (or wrapped in
:class:`josepy.util.ComparableX509`).
)r7 �dump_pyopenssl_chain)rl Zfiletyper2 r2 r3 r� � s r� c C s t | tjj�S )z�When does the cert at cert_path start being valid?
:param str cert_path: path to a cert in PEM format
:returns: the notBefore value from the cert at cert_path
:rtype: :class:`datetime.datetime`
)�_notAfterBeforer �X509Z
get_notBefore�r[ r2 r2 r3 � notBefore� s r� c C s t | tjj�S )z�When does the cert at cert_path stop being valid?
:param str cert_path: path to a cert in PEM format
:returns: the notAfter value from the cert at cert_path
:rtype: :class:`datetime.datetime`
)r� r r� Z get_notAfterr� r2 r2 r3 �notAfter� s r� c
C s� t | d��"}t�tj|�� �}W d � n1 s20 Y ||�}|dd� d|dd� d|dd� d|dd � d
|d d � d
|d d� g }d �|�}tjr�|�d
�}n|}t �
|�S )aP Internal helper function for finding notbefore/notafter.
:param str cert_path: path to a cert in PEM format
:param function method: one of ``crypto.X509.get_notBefore``
or ``crypto.X509.get_notAfter``
:returns: the notBefore or notAfter value from the cert at cert_path
:rtype: :class:`datetime.datetime`
r^ Nr � � -� � � T�
� :� � �ascii) r_ r rz r= rb r, rR ZPY3�decode� pyrfc3339�parse)r[ �method�fr Z timestampZreformatted_timestampZtimestamp_bytesZ
timestamp_strr2 r2 r3 r� � s 0�
r� c C sN t �� }t| d��$}|�|�� �d�� W d � n1 s<0 Y |�� S )aN Compute a sha256sum of a file.
NB: In given file, platform specific newlines characters will be converted
into their equivalent unicode counterparts before calculating the hash.
:param str filename: path to the file whose hash will be computed
:returns: sha256 digest of the file in hexadecimal
:rtype: str
�rzUTF-8N)�hashlib�sha256r_ rt rb �encodeZ hexdigest)�filenamer� Zfile_dr2 r2 r3 � sha256sum� s 2r� s@ -----BEGIN CERTIFICATE-----
?
.+?
?
-----END CERTIFICATE-----
?
c C sL t �| �� �}t|�dk r$t�d��dd� |D �}|d d�|dd� �fS ) a Split fullchain_pem into cert_pem and chain_pem
:param str fullchain_pem: concatenated cert + chain
:returns: tuple of string cert_pem and chain_pem
:rtype: tuple
:raises errors.Error: If there are less than 2 certificates in the chain.
� zPfailed to parse fullchain into cert and chain: less than 2 certificates in chainc S s( g | ] }t �t jt �t j|���� �qS r2 )r Zdump_certificater= rz r� )rx rn r2 r2 r3 �
<listcomp>* s � �z1cert_and_chain_from_fullchain.<locals>.<listcomp>r r � N)�CERT_PEM_REGEX�findallr� �lenr r? r, )Z
fullchain_pem�certsZcerts_normalizedr2 r2 r3 � cert_and_chain_from_fullchain s
�r� c C sD t | d��"}t�tj|�� �}W d � n1 s20 Y |�� S )z�Retrieve the serial number of a certificate from certificate path
:param str cert_path: path to a cert in PEM format
:returns: serial number of the certificate
:rtype: int
r^ N)r_ r rz r= rb Zget_serial_number)r[ r� r r2 r2 r3 �get_serial_from_cert1 s 0r� Fc C sl | D ]N}t �|�� �}t�|d t� �}|j�tjj �}|r|d j
|kr| S q|rdt � d|� | d S )a' Chooses the first certificate chain from fullchains whose topmost
intermediate has an Issuer Common Name matching issuer_cn (in other words
the first chain which chains to a root whose name matches issuer_cn).
:param fullchains: The list of fullchains in PEM chain format.
:type fullchains: `list` of `str`
:param `str` issuer_cn: The exact Subject Common Name to match against any
issuer in the certificate chain.
:returns: The best-matching fullchain, PEM-encoded, or the first if none match.
:rtype: `str`
���r z�Certbot has been configured to prefer certificate chains with issuer '%s', but no chain from the CA matched this issuer. Using the default certificate chain instead.)
r� r� r� r ra r ZissuerZget_attributes_for_oidZNameOIDZ COMMON_NAME�valuer" �info)Z
fullchainsZ issuer_cnZwarn_on_no_matchrl r� Ztop_certZ
top_issuer_cnr2 r2 r3 �find_chain_with_issuer? s
�r� )r r r )rM r N)F)M�__doc__r� Zloggingrd �reZ cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z)cryptography.hazmat.primitives.asymmetricr Z,cryptography.hazmat.primitives.asymmetric.ecr r Z1cryptography.hazmat.primitives.asymmetric.paddingr Z-cryptography.hazmat.primitives.asymmetric.rsar
Z,cryptography.hazmat.primitives.serializationr r r
ZOpenSSLr r r� rR Zzope.componentr$ Zacmer r7 Zacme.magic_typingr Zcertbotr r r Zcertbot.compatr Z getLogger�__name__r" r4 r; rB rD rL r rW r] rX rf rZ rY r| r= r� r� r� r� rI r� r� r� r� r� r� �compile�DOTALLr� r� r� r� r2 r2 r2 r3 �<module> st
�
-#
* �
�
�