HEX
Server: Apache/2.4.65 (Debian)
System: Linux kubikelcreative 5.10.0-35-amd64 #1 SMP Debian 5.10.237-1 (2025-05-19) x86_64
User: www-data (33)
PHP: 8.4.13
Disabled: NONE
Upload Files
File: //usr/lib/python3/dist-packages/acme/__pycache__/crypto_util.cpython-39.pyc
a

 O�c1�@s�dZddlZddlZddlZddlZddlZddlZddlZddl	m
Z
ddl	mZddlm
Z
ddlmZddlmZddlmZe�e�ZejZGd	d
�d
e�ZGdd�de�Zd
deddfdd�Zddd�Zdd�Zdd�Zd dd�Ze
jfdd�Z dS)!zCrypto utilities.�N)�crypto)�SSL)�errors)�Callable)�Tuple)�Unionc@seZdZdd�Zdd�ZdS)�_DefaultCertSelectioncCs
||_dS�N)�certs)�selfr
�r�2/usr/lib/python3/dist-packages/acme/crypto_util.py�__init__sz_DefaultCertSelection.__init__cCs|��}|j�|d�Sr	)�get_servernamer
�get)r�
connectionZserver_namerrr
�__call__"sz_DefaultCertSelection.__call__N)�__name__�
__module__�__qualname__rrrrrr
rsrc@sJeZdZdZdeddfdd�Zdd�Zdd�ZGd	d
�d
e�Z	dd�Z
dS)
�	SSLSocketa�SSL wrapper for sockets.

    :ivar socket sock: Original wrapped socket.
    :ivar dict certs: Mapping from domain names (`bytes`) to
        `OpenSSL.crypto.X509`.
    :ivar method: See `OpenSSL.SSL.Context` for allowed values.
    :ivar alpn_selection: Hook to select negotiated ALPN protocol for
        connection.
    :ivar cert_selection: Hook to select certificate for connection. If given,
        `certs` parameter would be ignored, and therefore must be empty.

    NcCsL||_||_||_|s"|s"td��|r2|r2td��|durBt|�}||_dS)Nz*Neither cert_selection or certs specified.z(Both cert_selection and certs specified.)�sock�alpn_selection�method�
ValueErrorr�cert_selection)rrr
rrrrrr
r4szSSLSocket.__init__cCst|j|�Sr	)�getattrr�r�namerrr
�__getattr__BszSSLSocket.__getattr__cCs�|�|�}|dur&t�d|���dS|\}}t�|j�}|�tj�|�tj	�|�
|�|�|�|jdur||�
|j�|�|�dS)a�SNI certificate callback.

        This method will set a new OpenSSL context object for this
        connection when an incoming connection provides an SNI name
        (in order to serve the appropriate certificate, if any).

        :param connection: The TLS connection object on which the SNI
            extension was received.
        :type connection: :class:`OpenSSL.Connection`

        Nz=Certificate selection for server name %s failed, dropping SSL)r�logger�debugrr�Contextr�set_options�OP_NO_SSLv2�OP_NO_SSLv3Zuse_privatekeyZuse_certificater�set_alpn_select_callbackZset_context)rrZpair�key�certZnew_contextrrr
�_pick_certificate_cbEs
�


zSSLSocket._pick_certificate_cbc@s(eZdZdZdd�Zdd�Zdd�ZdS)	zSSLSocket.FakeConnectionzFake OpenSSL.SSL.Connection.cCs
||_dSr	)�_wrapped)rrrrr
resz!SSLSocket.FakeConnection.__init__cCst|j|�Sr	)rr*rrrr
rhsz$SSLSocket.FakeConnection.__getattr__cGs
|j��Sr	)r*�shutdown)rZunused_argsrrr
r+ksz!SSLSocket.FakeConnection.shutdownN)rrr�__doc__rrr+rrrr
�FakeConnection`sr-c
Cs�|j��\}}t�|j�}|�tj�|�tj�|�|j	�|j
durT|�|j
�|�t�
||��}|��t�d|�z|��Wn0tjy�}zt�|��WYd}~n
d}~00||fS)NzPerforming handshake with %s)r�acceptrr"rr#r$r%Zset_tlsext_servername_callbackr)rr&r-�
ConnectionZset_accept_stater r!�do_handshake�Error�socket�error)rrZaddr�contextZssl_sockr3rrr
r.os
 zSSLSocket.accept)rrrr,�_DEFAULT_SSL_METHODrrr)�objectr-r.rrrr
r's�
ri�i,)�rcCsDt�|�}|�|�d|i}zJt�d||t|�rDd�|d|d�nd�||f}	tj|	fi|��}
Wn0tj	y�}zt
�|��WYd}~n
d}~00t�
|
���}t�||�}
|
��|
�|�|dur�|
�|�z|
��|
��Wn2tj�y}zt
�|��WYd}~n
d}~00Wd�n1�s20Y|
��S)aProbe SNI server for SSL certificate.

    :param bytes name: Byte string to send as the server name in the
        client hello message.
    :param bytes host: Host to connect to.
    :param int port: Port to connect to.
    :param int timeout: Timeout in seconds.
    :param method: See `OpenSSL.SSL.Context` for allowed values.
    :param tuple source_address: Enables multi-path probing (selection
        of source interface). See `socket.creation_connection` for more
        info. Available only in Python 2.7+.
    :param alpn_protocols: Protocols to request using ALPN.
    :type alpn_protocols: `list` of `bytes`

    :raises acme.errors.Error: In case of any problems.

    :returns: SSL certificate presented by the server.
    :rtype: OpenSSL.crypto.X509

    �source_addressz!Attempting to connect to %s:%d%s.z
 from {0}:{1}r�r7N)rr"Zset_timeoutr r!�any�formatr2Zcreate_connectionr3rr1�
contextlib�closingr/Zset_connect_stateZset_tlsext_host_nameZset_alpn_protosr0r+Zget_peer_certificate)rZhostZportZtimeoutrr8Zalpn_protocolsr4Z
socket_kwargsZsocket_tuplerr3ZclientZ
client_sslrrr
�	probe_sni�s:

��� 

@r>FcCs�t�tj|�}t��}tjddd�dd�|D���d�d�g}|rX|�tjddd	d��|�|�|�	|�|�
d
�|�|d�t�tj|�S)a�Generate a CSR containing a list of domains as subjectAltNames.

    :param buffer private_key_pem: Private key, in PEM PKCS#8 format.
    :param list domains: List of DNS names to include in subjectAltNames of CSR.
    :param bool must_staple: Whether to include the TLS Feature extension (aka
        OCSP Must Staple: https://tools.ietf.org/html/rfc7633).
    :returns: buffer PEM-encoded Certificate Signing Request.
    �subjectAltNameF�, css|]}d|VqdS)zDNS:Nr��.0�drrr
�	<genexpr>��zmake_csr.<locals>.<genexpr>�ascii�Zcritical�values1.3.6.1.5.5.7.1.24sDER:30:03:02:01:05r�sha256)
rZload_privatekey�FILETYPE_PEMZX509Req�
X509Extension�join�encode�append�add_extensions�
set_pubkey�set_version�sign�dump_certificate_request)Zprivate_key_pem�domainsZmust_stapleZprivate_keyZcsr�
extensionsrrr
�make_csr�s.	����


�rVcs6|��j�t|�}�dur|S�g�fdd�|D�S)Ncsg|]}|�kr|�qSrrrA�Zcommon_namerr
�
<listcomp>�rEz4_pyopenssl_cert_or_req_all_names.<locals>.<listcomp>)�get_subject�CN�_pyopenssl_cert_or_req_san)Zloaded_cert_or_reqZsansrrWr
� _pyopenssl_cert_or_req_all_names�s

r\csxd�d}d��t|tj�r$tj}ntj}|tj|��d�}t�d|�}|durTgn|�	d��
|�}��fdd	�|D�S)
a�Get Subject Alternative Names from certificate or CSR using pyOpenSSL.

    .. todo:: Implement directly in PyOpenSSL!

    .. note:: Although this is `acme` internal API, it is used by
        `letsencrypt`.

    :param cert_or_req: Certificate or CSR.
    :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.

    :returns: A list of Subject Alternative Names.
    :rtype: `list` of `unicode`

    �:r@ZDNSzutf-8z5X509v3 Subject Alternative Name:(?: critical)?\s*(.*)Nr9cs$g|]}|���r|���d�qS)r9)�
startswith�split)rB�part�Zpart_separator�prefixrr
rXs�z._pyopenssl_cert_or_req_san.<locals>.<listcomp>)�
isinstancer�X509�dump_certificaterSZ
FILETYPE_TEXT�decode�re�search�groupr_)Zcert_or_reqZparts_separator�func�text�matchZ
sans_partsrrar
r[�s�r[�:	Tc	Cs�|sJd��t��}|�tt�t�d��d��|�d�|durFg}|�	t�
ddd��|d|��_|�
|���|s�t|�d	kr�|�	tj
d
dd�d
d�|D��d��|�|�|�|dur�dn|�|�|�|�|�|�|d�|S)a*Generate new self-signed certificate.

    :type domains: `list` of `unicode`
    :param OpenSSL.crypto.PKey key:
    :param bool force_san:
    :param extensions: List of additional extensions to include in the cert.
    :type extensions: `list` of `OpenSSL.crypto.X509Extension`

    If more than one domain is provided, all of the domains are put into
    ``subjectAltName`` X.509 extension and first domain is set as the
    subject CN. If only one domain is provided no ``subjectAltName``
    extension is used, unless `force_san` is ``True``.

    z0Must provide one or more hostnames for the cert.��NsbasicConstraintsTsCA:TRUE, pathlen:0rr9r?Fs, css|]}d|��VqdS)sDNS:N)rMrArrr
rD8rEzgen_ss_cert.<locals>.<genexpr>rGrI)rrdZset_serial_number�int�binasciiZhexlify�os�urandomrQrNrKrYrZZ
set_issuer�lenrLrOZgmtime_adj_notBeforeZgmtime_adj_notAfterrPrR)r'rTZ
not_beforeZvalidityZ	force_sanrUr(rrr
�gen_ss_certs2
���


rucs$�fdd��d��fdd�|D��S)z�Dump certificate chain into a bundle.

    :param list chain: List of `OpenSSL.crypto.X509` (or wrapped in
        :class:`josepy.util.ComparableX509`).

    :returns: certificate chain bundle
    :rtype: bytes

    cst|tj�r|j}t��|�Sr	)rc�joseZComparableX509�wrappedrre)r()�filetyperr
�
_dump_certRsz(dump_pyopenssl_chain.<locals>._dump_certrEc3s|]}�|�VqdSr	r)rBr()ryrr
rDYrEz'dump_pyopenssl_chain.<locals>.<genexpr>)rL)�chainrxr)ryrxr
�dump_pyopenssl_chainEs
r{)F)NrmTN)!r,rqr<Zloggingrrrgr2ZjosepyrvZOpenSSLrrZacmerZacme.magic_typingrrrZ	getLoggerrr Z
SSLv23_METHODr5r6rrr>rVr\r[rurJr{rrrr
�<module>s8
		`�
7
!	+�
2