File: //usr/lib/python3/dist-packages/acme/__pycache__/crypto_util.cpython-38.pyc
U
�*Pd�+ � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl m
Z
ddl m Z ddl m
Z
ddlmZ ddlmZ ddlmZ dd lmZ e�e�Ze jZG d
d � d e�Zd d
edfdd�Zd dd�Zdd� Z dd� Z d dd�Z e
j fd d �Z dS ) zCrypto utilities.� N)�crypto)�SSL)�errors)�Callable)�Optional)�Tuple)�Unionc @ sD e Zd ZdZefdd�Zdd� Zdd� ZG dd � d e�Z d
d � Z
d S )
� SSLSocketz�SSL wrapper for sockets.
:ivar socket sock: Original wrapped socket.
:ivar dict certs: Mapping from domain names (`bytes`) to
`OpenSSL.crypto.X509`.
:ivar method: See `OpenSSL.SSL.Context` for allowed values.
c C s || _ || _|| _d S �N)�sock�certs�method)�selfr r r
� r �2/usr/lib/python3/dist-packages/acme/crypto_util.py�__init__( s zSSLSocket.__init__c C s t | j|�S r
)�getattrr �r �namer r r � __getattr__- s zSSLSocket.__getattr__c C s� |� � }z| j| \}}W n" tk
r< t�d|� Y dS X t�| j�}|�tj � |�tj
� |� |� |� |� |�
|� dS )a� SNI certificate callback.
This method will set a new OpenSSL context object for this
connection when an incoming connection provides an SNI name
(in order to serve the appropriate certificate, if any).
:param connection: The TLS connection object on which the SNI
extension was received.
:type connection: :class:`OpenSSL.Connection`
z-Server name (%s) not recognized, dropping SSLN)Zget_servernamer �KeyError�logger�debugr �Contextr
� set_options� OP_NO_SSLv2� OP_NO_SSLv3Zuse_privatekeyZuse_certificateZ set_context)r �
connectionZ server_name�key�certZ new_contextr r r �_pick_certificate_cb0 s �
z SSLSocket._pick_certificate_cbc @ s( e Zd ZdZdd� Zdd� Zdd� ZdS ) zSSLSocket.FakeConnectionz Fake OpenSSL.SSL.Connection.c C s
|| _ d S r
)�_wrapped)r r r r r r O s z!SSLSocket.FakeConnection.__init__c C s t | j|�S r
)r r! r r r r r R s z$SSLSocket.FakeConnection.__getattr__c G s
| j �� S r
)r! �shutdown)r Z unused_argsr r r r" U s z!SSLSocket.FakeConnection.shutdownN)�__name__�
__module__� __qualname__�__doc__r r r" r r r r �FakeConnectionJ s r' c
C s� | j �� \}}t�| j�}|�tj� |�tj� |�| j � | �
t� ||��}|� � t
�d|� z |�� W n. tjk
r� } zt�|��W 5 d }~X Y nX ||fS )Nz Performing handshake with %s)r �acceptr r r
r r r Z set_tlsext_servername_callbackr r' �
ConnectionZset_accept_stater r � do_handshake�Error�socket�error)r r Zaddr�contextZssl_sockr- r r r r( Y s zSSLSocket.acceptN) r# r$ r% r& �_DEFAULT_SSL_METHODr r r �objectr' r( r r r r r s r i� i, )� r c
C s t �|�}|�|� d|i}zBt�d|||r@d�|d |d �nd� ||f}tj|f|�} W n. tjk
r� }
zt �
|
��W 5 d}
~
X Y nX t � | ��h} t �
|| �} | �� | �| � z| �� | �� W n. t j
k
r� }
zt �
|
��W 5 d}
~
X Y nX W 5 Q R X | �� S )a� Probe SNI server for SSL certificate.
:param bytes name: Byte string to send as the server name in the
client hello message.
:param bytes host: Host to connect to.
:param int port: Port to connect to.
:param int timeout: Timeout in seconds.
:param method: See `OpenSSL.SSL.Context` for allowed values.
:param tuple source_address: Enables multi-path probing (selection
of source interface). See `socket.creation_connection` for more
info. Available only in Python 2.7+.
:raises acme.errors.Error: In case of any problems.
:returns: SSL certificate presented by the server.
:rtype: OpenSSL.crypto.X509
�source_addressz!Attempting to connect to %s:%d%s.z
from {0}:{1}r � r1 N)r r Z set_timeoutr r �formatr, Zcreate_connectionr- r r+ �
contextlib�closingr) Zset_connect_stateZset_tlsext_host_namer* r" Zget_peer_certificate)
r ZhostZportZtimeoutr
r2 r. Z
socket_kwargsZ socket_tupler r- ZclientZ
client_sslr r r � probe_snio s:
���
&r7 Fc C s� t �t j| �}t �� }t jddd�dd� |D ���d�d�g}|rX|�t jddd d�� |�|� |� |� |�
d
� |� |d � t � t j|�S ) a� Generate a CSR containing a list of domains as subjectAltNames.
:param buffer private_key_pem: Private key, in PEM PKCS#8 format.
:param list domains: List of DNS names to include in subjectAltNames of CSR.
:param bool must_staple: Whether to include the TLS Feature extension (aka
OCSP Must Staple: https://tools.ietf.org/html/rfc7633).
:returns: buffer PEM-encoded Certificate Signing Request.
� subjectAltNameF�, c s s | ]}d | V qdS )zDNS:Nr ��.0�dr r r � <genexpr>� s zmake_csr.<locals>.<genexpr>�ascii�Zcritical�values 1.3.6.1.5.5.7.1.24s DER:30:03:02:01:05r �sha256)
r Zload_privatekey� FILETYPE_PEMZX509Req�
X509Extension�join�encode�append�add_extensions�
set_pubkey� set_version�sign�dump_certificate_request)Zprivate_key_pem�domainsZ must_stapleZ private_keyZcsr�
extensionsr r r �make_csr� s2 ����
�rN c s6 | � � j� t| �}� d kr |S � g� fdd�|D � S )Nc s g | ]}|� kr|�qS r r r: �Z common_namer r �
<listcomp>� s z4_pyopenssl_cert_or_req_all_names.<locals>.<listcomp>)� get_subject�CN�_pyopenssl_cert_or_req_san)Zloaded_cert_or_reqZsansr rO r � _pyopenssl_cert_or_req_all_names� s
rT c sx d� d}d� �t | tj�r$tj}ntj}|tj| ��d�}t�d|�}|dkrTg n|� d��
|�}� �fdd �|D �S )
a� Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
.. todo:: Implement directly in PyOpenSSL!
.. note:: Although this is `acme` internal API, it is used by
`letsencrypt`.
:param cert_or_req: Certificate or CSR.
:type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
:returns: A list of Subject Alternative Names.
:rtype: `list` of `unicode`
�:r9 ZDNSzutf-8z5X509v3 Subject Alternative Name:(?: critical)?\s*(.*)Nr3 c s$ g | ] }|� ��r|�� �d �qS )r3 )�
startswith�split)r; �part�Zpart_separator�prefixr r rP � s
�z._pyopenssl_cert_or_req_san.<locals>.<listcomp>) �
isinstancer �X509�dump_certificaterK Z
FILETYPE_TEXT�decode�re�search�grouprW )Z cert_or_reqZparts_separator�func�text�matchZ
sans_partsr rY r rS � s �rS �: Tc C s� |s t d��t�� }|�tt�t�d��d�� |� d� t�
ddd�g}|d |� � _ |�
|� � � |svt|�dkr�|�tj
d d
d �d d
� |D ��d�� |�|� |�|dkr�dn|� |�|� |�| � |�| d� |S )a� Generate new self-signed certificate.
:type domains: `list` of `unicode`
:param OpenSSL.crypto.PKey key:
:param bool force_san:
If more than one domain is provided, all of the domains are put into
``subjectAltName`` X.509 extension and first domain is set as the
subject CN. If only one domain is provided no ``subjectAltName``
extension is used, unless `force_san` is ``True``.
z0Must provide one or more hostnames for the cert.� � s basicConstraintsTs CA:TRUE, pathlen:0r r3 r8 Fs , c s s | ]}d |� � V qdS )s DNS:N)rE r: r r r r= s z gen_ss_cert.<locals>.<genexpr>r? NrA )�AssertionErrorr r\ Zset_serial_number�int�binasciiZhexlify�os�urandomrI rC rQ rR Z
set_issuer�lenrF rD rG Zgmtime_adj_notBeforeZgmtime_adj_notAfterrH rJ )r rL Z
not_beforeZvalidityZ force_sanr rM r r r � gen_ss_cert� s0
���
rn c s$ �fdd�� d� � fdd�| D ��S )z�Dump certificate chain into a bundle.
:param list chain: List of `OpenSSL.crypto.X509` (or wrapped in
:class:`josepy.util.ComparableX509`).
:returns: certificate chain bundle
:rtype: bytes
c s t | tj�r| j} t�� | �S r
)r[ �joseZComparableX509�wrappedr r] )r )�filetyper r �
_dump_cert, s z(dump_pyopenssl_chain.<locals>._dump_cert� c 3 s | ]}� |�V qd S r
r )r; r )rr r r r= 4 s z'dump_pyopenssl_chain.<locals>.<genexpr>)rD )�chainrq r )rr rq r �dump_pyopenssl_chain s
ru )F)Nre T)!r& rj r5 Zloggingrk r_ r, Zjosepyro ZOpenSSLr r Zacmer Zacme.magic_typingr r r r Z getLoggerr# r Z
SSLv23_METHODr/ r0 r r7 rN rT rS rn rB ru r r r r �<module> s:
P �
1
+ �
,