File: //usr/lib/python3/dist-packages/acme/__pycache__/crypto_util.cpython-39.pyc
a
O�c1 � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl m
Z
ddl m Z ddl m
Z
ddlmZ ddlmZ ddlmZ e�e�Ze jZG d d
� d
e�ZG d d � d e�Zd
deddfdd�Zd dd�Zdd� Z dd� Z d dd �Z e
j fd d �Z dS )!zCrypto utilities.� N)�crypto)�SSL)�errors)�Callable)�Tuple)�Unionc @ s e Zd Zdd� Zdd� ZdS )�_DefaultCertSelectionc C s
|| _ d S �N)�certs)�selfr
� r �2/usr/lib/python3/dist-packages/acme/crypto_util.py�__init__ s z _DefaultCertSelection.__init__c C s |� � }| j�|d �S r )�get_servernamer
�get)r �
connectionZ server_namer r r
�__call__" s z _DefaultCertSelection.__call__N)�__name__�
__module__� __qualname__r r r r r r
r s r c @ sJ e Zd ZdZdeddfdd�Zdd� Zdd� ZG d d
� d
e�Z d d � Z
dS )
� SSLSocketa� SSL wrapper for sockets.
:ivar socket sock: Original wrapped socket.
:ivar dict certs: Mapping from domain names (`bytes`) to
`OpenSSL.crypto.X509`.
:ivar method: See `OpenSSL.SSL.Context` for allowed values.
:ivar alpn_selection: Hook to select negotiated ALPN protocol for
connection.
:ivar cert_selection: Hook to select certificate for connection. If given,
`certs` parameter would be ignored, and therefore must be empty.
Nc C sL || _ || _|| _|s"|s"td��|r2|r2td��|d u rBt|�}|| _d S )Nz*Neither cert_selection or certs specified.z(Both cert_selection and certs specified.)�sock�alpn_selection�method�
ValueErrorr �cert_selection)r r r
r r r r r r
r 4 s zSSLSocket.__init__c C s t | j|�S r )�getattrr �r �namer r r
� __getattr__B s zSSLSocket.__getattr__c C s� | � |�}|du r&t�d|�� � dS |\}}t�| j�}|�tj� |�tj � |�
|� |� |� | j dur||�
| j � |�|� dS )a� SNI certificate callback.
This method will set a new OpenSSL context object for this
connection when an incoming connection provides an SNI name
(in order to serve the appropriate certificate, if any).
:param connection: The TLS connection object on which the SNI
extension was received.
:type connection: :class:`OpenSSL.Connection`
Nz=Certificate selection for server name %s failed, dropping SSL)r �logger�debugr r �Contextr � set_options� OP_NO_SSLv2� OP_NO_SSLv3Zuse_privatekeyZuse_certificater �set_alpn_select_callbackZ set_context)r r Zpair�key�certZ new_contextr r r
�_pick_certificate_cbE s
�
z SSLSocket._pick_certificate_cbc @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) zSSLSocket.FakeConnectionz Fake OpenSSL.SSL.Connection.c C s
|| _ d S r )�_wrapped)r r r r r
r e s z!SSLSocket.FakeConnection.__init__c C s t | j|�S r )r r* r r r r
r h s z$SSLSocket.FakeConnection.__getattr__c G s
| j �� S r )r* �shutdown)r Z unused_argsr r r
r+ k s z!SSLSocket.FakeConnection.shutdownN)r r r �__doc__r r r+ r r r r
�FakeConnection` s r- c
C s� | j �� \}}t�| j�}|�tj� |�tj� |�| j � | j
d urT|� | j
� | � t�
||��}|�� t�d|� z |�� W n0 tjy� } zt�|��W Y d }~n
d }~0 0 ||fS )Nz Performing handshake with %s)r �acceptr r" r r# r$ r% Z set_tlsext_servername_callbackr) r r& r- �
ConnectionZset_accept_stater r! � do_handshake�Error�socket�error)r r Zaddr�contextZssl_sockr3 r r r
r. o s
zSSLSocket.accept) r r r r, �_DEFAULT_SSL_METHODr r r) �objectr- r. r r r r
r ' s �
r i� i, )� r c C sD t �|�}|�|� d|i}zJt�d||t|�rDd�|d |d �nd� ||f} tj| fi |��}
W n0 tj y� } zt
� | ��W Y d} ~ n
d} ~ 0 0 t �
|
���} t �|| �}
|
�� |
�| � |dur�|
�|� z|
�� |
�� W n2 t j �y } zt
� | ��W Y d} ~ n
d} ~ 0 0 W d � n1 �s20 Y |
�� S )a Probe SNI server for SSL certificate.
:param bytes name: Byte string to send as the server name in the
client hello message.
:param bytes host: Host to connect to.
:param int port: Port to connect to.
:param int timeout: Timeout in seconds.
:param method: See `OpenSSL.SSL.Context` for allowed values.
:param tuple source_address: Enables multi-path probing (selection
of source interface). See `socket.creation_connection` for more
info. Available only in Python 2.7+.
:param alpn_protocols: Protocols to request using ALPN.
:type alpn_protocols: `list` of `bytes`
:raises acme.errors.Error: In case of any problems.
:returns: SSL certificate presented by the server.
:rtype: OpenSSL.crypto.X509
�source_addressz!Attempting to connect to %s:%d%s.z
from {0}:{1}r � r7 N)r r" Z set_timeoutr r! �any�formatr2 Zcreate_connectionr3 r r1 �
contextlib�closingr/ Zset_connect_stateZset_tlsext_host_nameZset_alpn_protosr0 r+ Zget_peer_certificate)r ZhostZportZtimeoutr r8 Zalpn_protocolsr4 Z
socket_kwargsZ socket_tupler r3 ZclientZ
client_sslr r r
� probe_sni� s:
���
@r> Fc C s� t �t j| �}t �� }t jddd�dd� |D ���d�d�g}|rX|�t jddd d�� |�|� |� |� |�
d
� |� |d � t � t j|�S ) a� Generate a CSR containing a list of domains as subjectAltNames.
:param buffer private_key_pem: Private key, in PEM PKCS#8 format.
:param list domains: List of DNS names to include in subjectAltNames of CSR.
:param bool must_staple: Whether to include the TLS Feature extension (aka
OCSP Must Staple: https://tools.ietf.org/html/rfc7633).
:returns: buffer PEM-encoded Certificate Signing Request.
� subjectAltNameF�, c s s | ]}d | V qdS )zDNS:Nr ��.0�dr r r
� <genexpr>� � zmake_csr.<locals>.<genexpr>�ascii�Zcritical�values 1.3.6.1.5.5.7.1.24s DER:30:03:02:01:05r �sha256)
r Zload_privatekey� FILETYPE_PEMZX509Req�
X509Extension�join�encode�append�add_extensions�
set_pubkey� set_version�sign�dump_certificate_request)Zprivate_key_pem�domainsZ must_stapleZ private_keyZcsr�
extensionsr r r
�make_csr� s. ����
�rV c s6 | � � j� t| �}� d u r |S � g� fdd�|D � S )Nc s g | ]}|� kr|�qS r r rA �Z common_namer r
�
<listcomp>� rE z4_pyopenssl_cert_or_req_all_names.<locals>.<listcomp>)� get_subject�CN�_pyopenssl_cert_or_req_san)Zloaded_cert_or_reqZsansr rW r
� _pyopenssl_cert_or_req_all_names� s
r\ c sx d� d}d� �t | tj�r$tj}ntj}|tj| ��d�}t�d|�}|du rTg n|� d��
|�}� �fdd �|D �S )
a� Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
.. todo:: Implement directly in PyOpenSSL!
.. note:: Although this is `acme` internal API, it is used by
`letsencrypt`.
:param cert_or_req: Certificate or CSR.
:type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
:returns: A list of Subject Alternative Names.
:rtype: `list` of `unicode`
�:r@ ZDNSzutf-8z5X509v3 Subject Alternative Name:(?: critical)?\s*(.*)Nr9 c s$ g | ] }|� ��r|�� �d �qS )r9 )�
startswith�split)rB �part�Zpart_separator�prefixr r
rX s �z._pyopenssl_cert_or_req_san.<locals>.<listcomp>) �
isinstancer �X509�dump_certificaterS Z
FILETYPE_TEXT�decode�re�search�groupr_ )Z cert_or_reqZparts_separator�func�text�matchZ
sans_partsr ra r
r[ � s �r[ �: Tc C s� |s J d��t �� }|�tt�t�d��d�� |�d� |du rFg }|� t �
ddd�� |d |� � _ |�
|� � � |s�t|�d kr�|� t j
d
d d �d
d� |D ��d�� |�|� |�|du r�dn|� |�|� |�| � |�| d� |S )a* Generate new self-signed certificate.
:type domains: `list` of `unicode`
:param OpenSSL.crypto.PKey key:
:param bool force_san:
:param extensions: List of additional extensions to include in the cert.
:type extensions: `list` of `OpenSSL.crypto.X509Extension`
If more than one domain is provided, all of the domains are put into
``subjectAltName`` X.509 extension and first domain is set as the
subject CN. If only one domain is provided no ``subjectAltName``
extension is used, unless `force_san` is ``True``.
z0Must provide one or more hostnames for the cert.� � Ns basicConstraintsTs CA:TRUE, pathlen:0r r9 r? Fs , c s s | ]}d |� � V qdS )s DNS:N)rM rA r r r
rD 8 rE z gen_ss_cert.<locals>.<genexpr>rG rI )r rd Zset_serial_number�int�binasciiZhexlify�os�urandomrQ rN rK rY rZ Z
set_issuer�lenrL rO Zgmtime_adj_notBeforeZgmtime_adj_notAfterrP rR )r' rT Z
not_beforeZvalidityZ force_sanrU r( r r r
� gen_ss_cert s2
���
ru c s$ �fdd�� d� � fdd�| D ��S )z�Dump certificate chain into a bundle.
:param list chain: List of `OpenSSL.crypto.X509` (or wrapped in
:class:`josepy.util.ComparableX509`).
:returns: certificate chain bundle
:rtype: bytes
c s t | tj�r| j} t�� | �S r )rc �joseZComparableX509�wrappedr re )r( )�filetyper r
�
_dump_certR s z(dump_pyopenssl_chain.<locals>._dump_certrE c 3 s | ]}� |�V qd S r r )rB r( )ry r r
rD Y rE z'dump_pyopenssl_chain.<locals>.<genexpr>)rL )�chainrx r )ry rx r
�dump_pyopenssl_chainE s
r{ )F)Nrm TN)!r, rq r< Zloggingrr rg r2 Zjosepyrv ZOpenSSLr r Zacmer Zacme.magic_typingr r r Z getLoggerr r Z
SSLv23_METHODr5 r6 r r r> rV r\ r[ ru rJ r{ r r r r
�<module> s8
`�
7
! + �
2