o [PdA@sdZddlZddlZddlZddlZddlZddlZddlZddlm Z ddlm Z ddlm Z ddlm Z ddlm Z ddlmZdd lmZdd lmZddlZdd lmZdd lmZdd lmZeeZejZGdddZGdddZddeddfdedede de de dee!e fde e e!dej"fddZ#   d>d ed!e eee!e e!fd"e$d#e e eej%ej&fdef d$d%Z'd&eej"ej(fde e!fd'd(Z)d)eej"ej(fde e!fd*d+Z*d)eej"ej(fde e!fd,d-Z+d)eej"ej(fde e!fd.d/Z,   1  d?d2ej-d!e e e!d3e e d4e d5e$d6e e ej.d7e e eej%ej%fdej"fd8d9Z/ej0fd:e ej"d;e defd| |j ||dS)aSNI certificate callback. This method will set a new OpenSSL context object for this connection when an incoming connection provides an SNI name (in order to serve the appropriate certificate, if any). :param connection: The TLS connection object on which the SNI extension was received. :type connection: :class:`OpenSSL.Connection` Nz=Certificate selection for server name %s failed, dropping SSL)r'loggerdebugrr Contextr% set_options OP_NO_SSLv2 OP_NO_SSLv3use_privatekeyuse_certificater&set_alpn_select_callback set_context)rrpairkeycert new_contextrrr_pick_certificate_cbSs        zSSLSocket._pick_certificate_cbc@sHeZdZdZdejddfddZdedefdd Z d ede fd d Z dS) zSSLSocket.FakeConnectionzFake OpenSSL.SSL.Connection.rrNcCrr)_wrapped)rrrrrrsrz!SSLSocket.FakeConnection.__init__r*cCr+r)r,r?r-rrrr.vr/z$SSLSocket.FakeConnection.__getattr__ unused_argscGs |jSr)r?shutdown)rr@rrrrAys z!SSLSocket.FakeConnection.shutdown) rrr__doc__r r"rstrrr.boolrArrrrFakeConnectionns rEc Cs|j\}}t|j}|tj|tj||j |j dur*| |j | t ||}|td|z |W||fStjyX}zt|d}~ww)NzPerforming handshake with %s)r$acceptr r2r%r3r4r5set_tlsext_servername_callbackr>r&r8rEr"set_accept_stater0r1 do_handshakeErrorsocketerror)rr$addrcontextssl_sockrLrrrrF}s"         zSSLSocket.accept)rrrrB_DEFAULT_SSL_METHODrKrrrrr r r!intrr r"rrrCrr.r>rErFrrrrr#-s.    r#ii,)rr*hostporttimeoutr%source_addressalpn_protocolsrc Cs.t|}||d|i}z%td||t|r"d|d|dnd||f} tj| fi|} Wntj yE} zt | d} ~ wwt | @} t|| } | | ||durd| |z | | Wntj y} zt | d} ~ wwWd| S1swY| S)aProbe SNI server for SSL certificate. :param bytes name: Byte string to send as the server name in the client hello message. :param bytes host: Host to connect to. :param int port: Port to connect to. :param int timeout: Timeout in seconds. :param method: See `OpenSSL.SSL.Context` for allowed values. :param tuple source_address: Enables multi-path probing (selection of source interface). See `socket.creation_connection` for more info. Available only in Python 2.7+. :param alpn_protocols: Protocols to request using ALPN. :type alpn_protocols: `list` of `str` :raises acme.errors.Error: In case of any problems. :returns: SSL certificate presented by the server. :rtype: OpenSSL.crypto.X509 rVz!Attempting to connect to %s:%d%s.z from {0}:{1}rrRN)r r2 set_timeoutr0r1anyformatrKcreate_connectionrLr rJ contextlibclosingr"set_connect_stateset_tlsext_host_nameset_alpn_protosrIrAget_peer_certificate)r*rSrTrUr%rVrWrN socket_kwargs socket_tupler$rLclient client_sslrrr probe_snisJ            rgFprivate_key_pemdomains must_stapleipaddrsc Csttj|}t}g}|durg}|durg}t|t|dkr'td|D] }|d|q)|D] }|d|jq5d| d} tj dd | d g} |r^| tj d d d d | | | || d||d ttj|S)aGenerate a CSR containing domains or IPs as subjectAltNames. :param buffer private_key_pem: Private key, in PEM PKCS#8 format. :param list domains: List of DNS names to include in subjectAltNames of CSR. :param bool must_staple: Whether to include the TLS Feature extension (aka OCSP Must Staple: https://tools.ietf.org/html/rfc7633). :param list ipaddrs: List of IPaddress(type ipaddress.IPv4Address or ipaddress.IPv6Address) names to include in subbjectAltNames of CSR. params ordered this way for backward competablity when called by positional argument. :returns: buffer PEM-encoded Certificate Signing Request. NrzAAt least one of domains or ipaddrs parameter need to be not emptyDNS:IP:, asciisubjectAltNameFcriticalvalues1.3.6.1.5.5.7.1.24sDER:30:03:02:01:05sha256)r load_privatekey FILETYPE_PEMX509Reqlenr(appendexplodedjoinencode X509Extensionadd_extensions set_pubkey set_versionsigndump_certificate_request) rhrirjrk private_keycsrsanlistaddressips san_string extensionsrrrmake_csrsF    rloaded_cert_or_reqcs6|jt|}dur|Sgfdd|DS)Ncsg|]}|kr|qSrr).0d common_namerr sz4_pyopenssl_cert_or_req_all_names..) get_subjectCN_pyopenssl_cert_or_req_san)rsansrrr _pyopenssl_cert_or_req_all_namess r cert_or_reqcs(ddt|}fdd|DS)aGet Subject Alternative Names from certificate or CSR using pyOpenSSL. .. todo:: Implement directly in PyOpenSSL! .. note:: Although this is `acme` internal API, it is used by `letsencrypt`. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: A list of Subject Alternative Names that is DNS. :rtype: `list` of `unicode` :DNScs$g|]}|r|dqS)rX) startswithsplitrpartpart_separatorprefixrrr%s z._pyopenssl_cert_or_req_san.._pyopenssl_extract_san_list_raw)r sans_partsrrrrs  rcs&d}d|t|}fdd|DS)aiGet Subject Alternative Names IPs from certificate or CSR using pyOpenSSL. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: A list of Subject Alternative Names that are IP Addresses. :rtype: `list` of `unicode`. note that this returns as string, not IPaddress object rz IP Addresscs&g|]}|r|tdqSr)rrxrrrrr:s&z1_pyopenssl_cert_or_req_san_ip..r)rrrrrr_pyopenssl_cert_or_req_san_ip)s rcCsjt|tjrttj|d}n ttj|d}td|}d}|dur+g}|S| d |}|S)aGet raw SAN string from cert or csr, parse it as UTF-8 and return. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: raw san strings, parsed byte as utf-8 :rtype: `list` of `unicode` zutf-8z5X509v3 Subject Alternative Name:(?: critical)?\s*(.*)rnNrX) isinstancer r!dump_certificate FILETYPE_TEXTdecoderresearchgroupr)rtextraw_sanparts_separatorrrrrr=s   r: Tr; not_beforevalidity force_sanrrc CsZ|s|sJdt}|tttdd|d|dur%g}|dur+g}|dur1g}| t dddt |dkrH|d| _ || g}|D] } | d | qS|D] } | d | jq_d |d } |st |d kst |dkr| tj dd| d||||durdn|||||||d|S)axGenerate new self-signed certificate. :type domains: `list` of `unicode` :param OpenSSL.crypto.PKey key: :param bool force_san: :param extensions: List of additional extensions to include in the cert. :type extensions: `list` of `OpenSSL.crypto.X509Extension` :type ips: `list` of (`ipaddress.IPv4Address` or `ipaddress.IPv6Address`) If more than one domain is provided, all of the domains are put into ``subjectAltName`` X.509 extension and first domain is set as the subject CN. If only one domain is provided no ``subjectAltName`` extension is used, unless `force_san` is ``True``. z7Must provide one or more hostnames or IPs for the cert.NsbasicConstraintsTsCA:TRUE, pathlen:0rrlrmrnrorXrpFrqrt)r r!set_serial_numberrQbinasciihexlifyosurandomrryr}rxrr set_issuerrzr{r|r~gmtime_adj_notBeforegmtime_adj_notAfterrr) r;rirrrrrr<rriprrrr gen_ss_cert\sH      rchainfiletypecs:dttjtjfdtffdd dfdd|DS)zDump certificate chain into a bundle. :param list chain: List of `OpenSSL.crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). :returns: certificate chain bundle :rtype: bytes r<rcst|tjr |j}t|Sr)rjoseComparableX509wrappedr r)r<)rrr _dump_certs  z(dump_pyopenssl_chain.._dump_certc3s|]}|VqdSrr)rr<)rrr sz'dump_pyopenssl_chain..)r rrr r!rr{)rrr)rrrdump_pyopenssl_chains" r)NFN)NNrTNN)2rBrr] ipaddressloggingrrrKtypingrrrrrrrr josepyrOpenSSLr r acmer getLoggerrr0 SSLv23_METHODrPr r#rrQrCr!rgrD IPv4Address IPv6Addressrrwrrrrr r}rrvrrrrrs              h   7  7 " ""  &B