| Server IP : 35.236.43.222 / Your IP : 216.73.216.143 Web Server : Apache System : Linux order-form-vm-001 5.10.0-37-cloud-amd64 #1 SMP Debian 5.10.247-1 (2025-12-11) x86_64 User : deploy ( 1002) PHP Version : 8.1.31 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /lib/python3/dist-packages/certbot/__pycache__/ |
Upload File : |
a
�`�: � @ sp d Z ddlmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z dd l
m Z dd
l
mZ dd lmZ dd lmZ ddlZddlZdd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z z ddl m Z e!e j"d� W n e#e$f�y( dZ Y n0 e�%e&�Z'G dd� de(�Z)dd� Z*dd� Z+d d � Z,d d � Z-d d!� Z.dS )"z*Tools for checking certificate revocation.� )�datetime)� timedeltaN)�PIPE)�Popen)�x509)�InvalidSignature)�UnsupportedAlgorithm)�default_backend)�hashes)�
serialization)�Optional)�Tuple)� crypto_util)�errors)�util)�getenv)�
RenewableCert)�ocsp�signature_hash_algorithmc @ s4 e Zd ZdZd
dd�Zdd� Zddd �Zd
d � Zd S )�RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.Fc C s~ d| _ |pt | _| jrzt�d�s6t�d� d| _ d S tg d�ttdt� � d�}|�
� \}}d|v rpdd � | _ n
d
d � | _ d S ) NF�opensslz-openssl not installed, can't check revocationT)r r �-header�var�val)�stdout�stderrZuniversal_newlines�envz Missing =c S s
d| gS )NzHost=� ��hostr r �./usr/lib/python3/dist-packages/certbot/ocsp.py�<lambda>: � z,RevocationChecker.__init__.<locals>.<lambda>c S s d| gS )NZHostr r r r r r! < r" ) �brokenr �use_openssl_binaryr Z
exe_exists�logger�infor r Z env_no_snap_for_external_callsZ communicate� host_args)�selfZ enforce_openssl_binary_usageZtest_host_formatZ_out�errr r r �__init__* s
� zRevocationChecker.__init__c C s | � |j|j�S )a Get revoked status for a particular cert version.
.. todo:: Make this a non-blocking call
:param `.interfaces.RenewableCert` cert: Certificate object
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
)�ocsp_revoked_by_paths� cert_path�
chain_path)r( �certr r r � ocsp_revoked> s z RevocationChecker.ocsp_revoked�
c C sj | j r
dS tj�t�� �}t�|�|kr,dS t|�\}}|r@|sDdS | j r\| �
|||||�S t ||||�S )aE Performs the OCSP revocation check
:param str cert_path: Certificate filepath
:param str chain_path: Certificate chain
:param int timeout: Timeout (in seconds) for the OCSP query
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
F) r# �pytzZUTCZfromutcr �utcnowr ZnotAfter�_determine_ocsp_serverr$ �_check_ocsp_openssl_bin�_check_ocsp_cryptography)r( r, r- �timeout�now�urlr r r r r+ K s z'RevocationChecker.ocsp_revoked_by_pathsc
C s t d�}t d�}d }|d us$|d ur4|d ur0|n|}|d u rFd|g} n&|�d�r`|td�d � }d|d|g} ddd d
|d |d |d
|ddt|�dg| �|� | }
t�d|� t�d�|
�� ztj |
tjd�\} } W n" t
j y� t� d|� Y dS 0 t
|| | �S )NZ
http_proxyZ
HTTP_PROXYz-urlzhttp://z-hostz-pathr r z -no_noncez-issuerz-certz-CAfilez
-verify_otherz -trust_otherz-timeoutr zQuerying OCSP for %s� )�log�*OCSP check failed for %s (are we offline?)F)r �
startswith�len�strr' r% �debug�joinr Z
run_scriptr ZSubprocessErrorr& �_translate_ocsp_query)
r( r, r- r r8 r6 Zenv_http_proxyZenv_HTTP_PROXYZ
proxy_hostZurl_opts�cmd�outputr) r r r r4 i s@
��� z)RevocationChecker._check_ocsp_openssl_binN)F)r0 )�__name__�
__module__� __qualname__�__doc__r* r/ r+ r4 r r r r r ' s
r c s� t | d��"}t�|�� t� �}W d � n1 s20 Y z:|j�tj�}tjj � � fdd�|j
D �}|d j j
}W n& tj t
fy� t�d| � Y dS 0 |�� }|�d�d �d
�}|r�||fS t�d || � dS ) z�Extract the OCSP server host from a certificate.
:param str cert_path: Path to the cert we're checking OCSP for
:rtype tuple:
:returns: (OCSP server URL or None, OCSP server host or None)
�rbNc s g | ]}|j � kr|�qS r )Z
access_method)�.0Z description�Zocsp_oidr r �
<listcomp>� s
�z*_determine_ocsp_server.<locals>.<listcomp>r z Cannot extract OCSP URI from %s)NNz://� �/z;Cannot process OCSP host from URL (%s) in certificate at %s)�openr �load_pem_x509_certificate�readr �
extensions�get_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSP�valueZaccess_location�ExtensionNotFound�
IndexErrorr% r& �rstrip� partition)r, � file_handlerr. � extensionZ descriptionsr8 r r rJ r r3 � s 0 r3 c
C s. t |d��"}t�|�� t� �}W d � n1 s20 Y t | d��"}t�|�� t� �}W d � n1 sn0 Y t�� }|�||t� � �}|�
� }|� t j
j�} ztj|| ddi|d�}
W n( tjjy� tjd| dd� Y dS 0 |
jd k�r t�d
| |
j� dS t�|
j�} | jtjjk�r<t�d | | j� dS zt | ||| � W n� t �y� } zt�t | �� W Y d } ~ n�d } ~ 0 t j �y� } zt�t | �� W Y d } ~ n|d } ~ 0 t!�y� t�d | � Y nV t"�y
}
z t�d
| t |
�� W Y d }
~
n(d }
~
0 0 t�#d| | j$� | j$tj%j&kS dS )NrH z Content-Typezapplication/ocsp-request)�dataZheadersr6 r; T)�exc_infoF�� z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rN r rO rP r r ZOCSPRequestBuilderZadd_certificater
ZSHA1ZbuildZ public_bytesr ZEncodingZDER�requestsZpost�
exceptionsZRequestExceptionr% r& Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ
SUCCESSFUL�error�_check_ocsp_responser r> r �Errorr �AssertionErrorr? Zcertificate_statusZOCSPCertStatusZREVOKED)r, r- r8 r6 rX �issuerr. ZbuilderZrequestZrequest_binaryZresponse�
response_ocsp�er_ r r r r5 � sP 0 0�
�""(�r5 c C s� | j |j krtd��t| ||� t| jt|j��rJ| j|jksJ| j|jkrRtd��t� � }| j
shtd��| j
|t dd� kr�td��| j r�| j |t dd� k r�td��dS ) z2Verify that the OCSP is valid for several criteriazMthe certificate in response does not correspond to the certificate in requestz<the issuer does not correspond to issuer of the certificate.z param thisUpdate is not set.� )Zminutesz"param thisUpdate is in the future.z param nextUpdate is in the past.N)
Z
serial_numberrb � _check_ocsp_response_signature�
isinstanceZhash_algorithm�typeZissuer_key_hashZissuer_name_hashr r2 Z this_updater Z next_update)rd Z request_ocsp� issuer_certr, r7 r r r r` � s
�
� r` c s
dd� � �j |jks"�j� |�kr4t�d|� |}n�t�d|� � �fdd��jD �}|sbtd��|d }|j|jkr~td ��z"|j� t
j �}t
j j
j|jv }W n t
jtfy� d
}Y n0 |s�td ��|j}t�|�� |j|j|� �j}t�|�� �j�j|� d S )
zIVerify an OCSP response signature against certificate issuer or responderc S s t j�| �� �jS )N)r ZSubjectKeyIdentifierZfrom_public_key�
public_keyZdigest)r. r r r � _key_hash s z1_check_ocsp_response_signature.<locals>._key_hashzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s* g | ]"}�j |jks"�j� |�kr|�qS r )�responder_name�subject�responder_key_hash)rI r. �rl rd r r rK s �z2_check_ocsp_response_signature.<locals>.<listcomp>z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz<responder is not authorized by issuer to sign OCSP responsesN)rm rn ro r% r? Z certificatesrb rc rQ rR r ZExtendedKeyUsageZoidZExtendedKeyUsageOIDZ OCSP_SIGNINGrS rT rU r r Zverify_signed_payloadrk Z signatureZtbs_certificate_bytesZtbs_response_bytes)rd rj r, Zresponder_certZresponder_certsrY Zdelegate_authorizedZ chosen_hashr rp r rg s@ ���
��rg c s� d}� fdd�|D �}�fdd�|D �\}}}|r<|� d�nd}d|vsT|rP|sT|rrt�d � � t�d
�|� d S |r~|s~d S |r�|� d�}|r�t�d |� d
S t�d�|� d S dS )z7Parse openssl's weird output to work out what it means.)�good�revoked�unknownc s g | ]}d � � |��qS )z{0}: (WARNING.*)?{1})�format)rI �s)r, r r rK < r" z)_translate_ocsp_query.<locals>.<listcomp>c 3 s | ]}t j|� t jd �V qdS ))�flagsN)�re�search�DOTALL)rI �p)� ocsp_outputr r � <genexpr>= r" z(_translate_ocsp_query.<locals>.<genexpr>� NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output:
%s
stderr:
%sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s
stderr:%s)�groupr% r& r? �warning) r, r{ Z ocsp_errorsZstatesZpatternsrq rr rs r r )r, r{ r rA 8 s&
�rA )/rG r r Zloggingrw �
subprocessr r Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr
r r1 r] Zacme.magic_typingr r
Zcertbotr r r Zcertbot.compat.osr Zcertbot.interfacesr Zcryptography.x509r �getattrZ OCSPResponse� ImportError�AttributeErrorZ getLoggerrD r% �objectr r3 r5 r` rg rA r r r r �<module> sB
h 2"6