o 6aT_@sdZddlZddlZddlZddlmZddlmZddlZddlm Z ddl m Z ddl m Z ddl mZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlmZddlmZddlmZddlmZddlZddl Z!ddl"m#Z$ddl%m&Z&ddl%m'Z'ddl%m(Z(ddl)m*Z*e+e,Z-   dhde.de/de/de/d e/d!e0d"e(j1fd#d$Z2  did%d&Z3 djd(e(j1d)ee/d*e/d+e0d!e0d"e(j4f d,d-Z5d.d/Z6d0d1Z7d2d3Z8d4d5Z9dkd7d8Z:d9d:Z;d;d<ZZ=d?d@Z>dAdBZ?dCdDZ@dEdFZAejBfdGdHZCejBfdIdJZDejBfdKdLZEdMdNZFdOdPZGejBfdQdRZHejBfdSe/dTe.d"ee/fdUdVZIejBfdWdXZJdYdZZKd[d\ZLd]d^ZMd_d`ZNeOdaejPZQdbdcZRdddeZSdldfdgZTdS)mzCertbot client crypto utility functions. .. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server is capable of handling the signatures. N)List)Set)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)ec)ECDSA)EllipticCurvePublicKey)PKCS1v15) RSAPublicKey)Encoding) NoEncryption) PrivateFormat)crypto)SSL) crypto_util)errors) interfaces)util)osrsa secp256r1key-certbot.pemTkey_sizekey_dirkey_typeelliptic_curvekeynamestrict_permissionsreturnc Csz t||pd|d}Wnty(}ztjdddtdt||d}~wwt|d|tt j ||d d \}} | | |Wdn1sPwY|d kratd || ntd || t | |S)aInitializes and saves a privkey. Inits key and saves it in PEM format on the filesystem. .. note:: keyname is the attempted filename, it may be different if a file already exists at the path. :param int key_size: key size in bits if key size is rsa. :param str key_dir: Key save directory. :param str key_type: Key Type [rsa, ecdsa] :param str elliptic_curve: Name of the elliptic curve if key type is ecdsa. :param str keyname: Filename of key :param bool strict_permissions: If true and key_dir exists, an exception is raised if the directory doesn't have 0700 permissions or isn't owned by the current user. :returns: Key :rtype: :class:`certbot.util.Key` :raises ValueError: If unable to generate the key given key_size. r)bitsrrTexc_infoz&Encountered error while making key: %sNiiwbrz Generating RSA key (%d bits): %sz"Generating ECDSA key (%d bits): %s)make_key ValueErrorloggerdebugerrorstrrmake_or_verify_dir unique_filerpathjoinwriteKey) rrrrrrkey_pemerrkey_fkey_pathr65/usr/lib/python3/dist-packages/certbot/crypto_util.py generate_key*s*    r8cCs0tdttjtj}t||||||j dS)aInitializes and saves a privkey. Inits key and saves it in PEM format on the filesystem. .. note:: keyname is the attempted filename, it may be different if a file already exists at the path. .. deprecated:: 1.16.0 Use :func:`generate_key` instead. :param int key_size: key size in bits if key size is rsa. :param str key_dir: Key save directory. :param str key_type: Key Type [rsa, ecdsa] :param str elliptic_curve: Name of the elliptic curve if key type is ecdsa. :param str keyname: Filename of key :returns: Key :rtype: :class:`certbot.util.Key` :raises ValueError: If unable to generate the key given key_size. zecertbot.crypto_util.init_save_key is deprecated, please use certbot.crypto_util.generate_key instead.)rrrr) warningswarnDeprecationWarningzope component getUtilityrIConfigr8r)rrrrrconfigr6r6r7 init_save_keyZs rAFprivkeynamesr. must_staplecCstj|j||d}t|d|ttj|ddd\}}| | |Wdn1s0wYt d|t ||dS) a:Initialize a CSR with the given private key. :param privkey: Key to include in the CSR :type privkey: :class:`certbot.util.Key` :param set names: `str` names to include in the CSR :param str path: Certificate save directory. :param bool must_staple: If true, include the TLS Feature extension "OCSP Must Staple" :param bool strict_permissions: If true and path exists, an exception is raised if the directory doesn't have 0755 permissions or isn't owned by the current user. :returns: CSR :rtype: :class:`certbot.util.CSR` )rDizcsr-certbot.pemir%NzCreating CSR: %spem) acme_crypto_utilmake_csrrErr,r-rr.r/r0r(r)CSR)rBrCr.rDrcsr_pemcsr_f csr_filenamer6r6r7 generate_csr{s  rLcCs0tdttjtj}t||||j |j dS)awInitialize a CSR with the given private key. .. deprecated:: 1.16.0 Use :func:`generate_csr` instead. :param privkey: Key to include in the CSR :type privkey: :class:`certbot.util.Key` :param set names: `str` names to include in the CSR :param str path: Certificate save directory. :returns: CSR :rtype: :class:`certbot.util.CSR` zecertbot.crypto_util.init_save_csr is deprecated, please use certbot.crypto_util.generate_csr instead.)rDr) r9r:r;r<r=r>rr?rLrDr)rBrCr.r@r6r6r7 init_save_csrs rMcCsDzttj|}||WStjy!tjdddYdSw)zValidate CSR. Check if `csr` is a valid CSR for the given domains. :param str csr: CSR in PEM. :returns: Validity of CSR. :rtype: bool r"Tr#F)rload_certificate_request FILETYPE_PEMverify get_pubkeyErrorr(r))csrreqr6r6r7 valid_csrs rUcCsNttj|}ttj|}z||WStjy&tjdddYdSw)zDoes private key correspond to the subject public key in the CSR? :param str csr: CSR in PEM. :param str privkey: Private key file contents (PEM) :returns: Correspondence of private key to CSR subject public key. :rtype: bool r"Tr#F)rrNrOload_privatekeyrPrRr(r))rSrBrTpkeyr6r6r7csr_matches_pubkeys  rXc Cstj}tj}z|tj|}Wn"tjy0z|||}Wntjy-td|wYnwt|}t||}|t j ||dd|fS)a/Import a CSR file, which can be either PEM or DER. :param str csrfile: CSR filename :param str data: contents of the CSR file :returns: (`crypto.FILETYPE_PEM`, util.CSR object representing the CSR, list of domains requested in the CSR) :rtype: tuple zFailed to parse CSR file: {0}rE)filedataform) rrOrN FILETYPE_ASN1rRrformat"_get_names_from_loaded_cert_or_reqdump_certificate_requestrrH)csrfilerZPEMloadrSdomainsdata_pemr6r6r7import_csr_files  rec Cs|dkr|dkrtd|t}|tj|nd|dkrxz"|}|dvr9tj t t|dt d}ntd|Wn"t yQtd|t yd}z|tt|d}~ww|jtjtjtd }ttj|}ntd |ttj|S) aDGenerate PEM encoded RSA|EC key. :param int bits: Number of bits if key_type=rsa. At least 1024 for RSA. :param str ec_curve: The elliptic curve to use. :returns: new RSA or ECDSA key in PEM form with specified number of bits or of type ec_curve when key_type ecdsa is used. :rtype: str rrfzUnsupported RSA key length: {}ecdsa) SECP256R1 SECP384R1 SECP521R1N)curvebackendzUnsupported elliptic curve: {})encodingr]encryption_algorithmz0Invalid key_type specified: {}. Use [rsa|ecdsa])rrRr]rPKeyr8TYPE_RSAupperrgenerate_private_keygetattrr TypeErrorrr+ private_bytesr rarTraditionalOpenSSLrrVrOdump_privatekey)r!rrkeyname_keye_key_pemr6r6r7r&s:  r&c Cs0z ttj|WSttjfyYdSw)zIs valid RSA private key? :param str privkey: Private key file contents in PEM :returns: Validity of private key. :rtype: bool F)rrVrOcheckrtrR)rBr6r6r7 valid_privkey,s r~cCs"t|t|t|j|jdS)aFor checking that your certs were not corrupted on disk. Several things are checked: 1. Signature verification for the cert. 2. That fullchain matches cert and chain when concatenated. 3. Check that the private key matches the certificate. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If verification fails. N)verify_renewable_cert_sigverify_fullchainverify_cert_matches_priv_key cert_pathr5)renewable_certr6r6r7verify_renewable_cert<s rc Cs zet|jd}t|t}Wdn1swYt|jd}t|t}Wdn1s:wY|}t t ||j |j |j WdWdS1s^wYWdStttfy}zd|j|}t|t|d}~ww)zVerifies the signature of a RenewableCert object. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If signature verification fails. rbNzbverifying the signature of the certificate located at {0} has failed. Details: {1})open chain_pathrload_pem_x509_certificatereadrr public_keyr9catch_warningsverify_signed_payload signaturetbs_certificate_bytessignature_hash_algorithmIOErrorr'rr]r( exceptionrrR)r chain_filechain cert_filecertpkr{ error_strr6r6r7rNs*  &   rcCstItdt|tr!||t|}|||nt|t r8||t |}|||n t dWddSWddS1sPwYdS)aCheck the signature of a payload. :param RSAPublicKey/EllipticCurvePublicKey public_key: the public_key to check signature :param bytes signature: the signature bytes :param bytes payload: the payload bytes :param cryptography.hazmat.primitives.hashes.HashAlgorithm signature_hash_algorithm: algorithm used to hash the payload :raises InvalidSignature: If signature verification fails. :raises errors.Error: If public key type is not supported ignorezUnsupported public key typeN) r9r simplefilter isinstancer verifierr updaterPr r rrR)rrpayloadrrr6r6r7rfs&         "rc Cspzttj}|||||WdSttjfy7}zd|||}t |t |d}~ww)z Verifies that the private key and cert match. :param str cert_path: path to a cert in PEM format :param str key_path: path to a private key file :raises errors.Error: If they don't match. zverifying the certificate located at {0} matches the private key located at {1} has failed. Details: {2}N) rContext SSLv23_METHODuse_certificate_fileuse_privatekey_filecheck_privatekeyrrRr]r(rr)rr5contextr{rr6r6r7rs     rc Cszat|j }|}Wdn1swYt|j }|}Wdn1s.wYt|j }|}Wdn1sGwY|||kr_d}||j}t|WdSt y|}zd|}t |t|d}~wtjy}z|d}~ww)z Verifies that fullchain is indeed cert concatenated with chain. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If cert and chain do not combine to fullchain. Nz.fullchain does not match cert + chain for {0}!z8reading one of cert, chain, or fullchain has failed: {0}) rrrrfullchain_pathr] lineagenamerrRrr(r) rrrrrfullchain_file fullchainrr{r6r6r7rs0            rc Cs|g}tjtjfD]%}z t|||fWStjy-}z ||WYd}~qd}~wwtdddd|D)z:Load PEM/DER certificate. :raises errors.Error: NzUnable to load: {0},css|]}t|VqdSN)r+).0r*r6r6r7 s z-pyopenssl_load_certificate..) rrOr\load_certificaterRappendrr]r/)rZopenssl_errors file_typer*r6r6r7pyopenssl_load_certificates rc CsHz|||WStjy#}ztjdddtdt|d}~ww)Nr"Tr#z6Encountered error while loading certificate or csr: %s)rrRr(r)r*r+)cert_or_req_str load_functypr3r6r6r7_load_cert_or_reqs rcCstt|||Sr)rF_pyopenssl_cert_or_req_sanr)rrrr6r6r7_get_sans_from_cert_or_reqsrcCt|tj|S)zGet a list of Subject Alternative Names from a certificate. :param str cert: Certificate (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of Subject Alternative Names. :rtype: list )rrr)rrr6r6r7get_sans_from_cert rcCst|||}t|Sr)rr^) cert_or_reqrrloaded_cert_or_reqr6r6r7_get_names_from_cert_or_reqs rcCs t|Sr)rF _pyopenssl_cert_or_req_all_names)rr6r6r7r^s r^cCr)zGet a list of domains from a cert, including the CN if it is set. :param str cert: Certificate (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of domain names. :rtype: list )rrrrSrr6r6r7get_names_from_certrrrSrcCr)zGet a list of domains from a CSR, including the CN if it is set. :param str cert: CSR (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of domain names. :rtype: list )rrrNrr6r6r7get_names_from_req rcCs t||S)zDump certificate chain into a bundle. :param list chain: List of `crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). )rFdump_pyopenssl_chain)rfiletyper6r6r7r s rcCt|tjjS)zWhen does the cert at cert_path start being valid? :param str cert_path: path to a cert in PEM format :returns: the notBefore value from the cert at cert_path :rtype: :class:`datetime.datetime` )_notAfterBeforerX509 get_notBeforerr6r6r7 notBeforerrcCr)zWhen does the cert at cert_path stop being valid? :param str cert_path: path to a cert in PEM format :returns: the notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` )rrr get_notAfterrr6r6r7notAfter"rrc Cst|d}ttj|}Wdn1swY||}|ddd|ddd|ddd|dd d |d d d |d dg }d |}|d }t|S)aPInternal helper function for finding notbefore/notafter. :param str cert_path: path to a cert in PEM format :param function method: one of ``crypto.X509.get_notBefore`` or ``crypto.X509.get_notAfter`` :returns: the notBefore or notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` rNr-T : ascii) rrrrOrr/decode pyrfc3339parse)rmethodfr timestampreformatted_timestamptimestamp_bytes timestamp_strr6r6r7r.s    rcCsTt}t|d}||dWd|S1s!wY|S)aNCompute a sha256sum of a file. NB: In given file, platform specific newlines characters will be converted into their equivalent unicode counterparts before calculating the hash. :param str filename: path to the file whose hash will be computed :returns: sha256 digest of the file in hexadecimal :rtype: str rzUTF-8N)hashlibsha256rrrencode hexdigest)filenamerfile_dr6r6r7 sha256sumGs  rs@-----BEGIN CERTIFICATE----- ? .+? ? -----END CERTIFICATE----- ? cCsLt|}t|dkrtddd|D}|dd|ddfS) aSplit fullchain_pem into cert_pem and chain_pem :param str fullchain_pem: concatenated cert + chain :returns: tuple of string cert_pem and chain_pem :rtype: tuple :raises errors.Error: If there are less than 2 certificates in the chain. zPfailed to parse fullchain into cert and chain: less than 2 certificates in chainc Ss(g|]}ttjttj|qSr6)rdump_certificaterOrr)rrr6r6r7 ws z1cert_and_chain_from_fullchain..rr"N)CERT_PEM_REGEXfindallrlenrrRr/) fullchain_pemcertscerts_normalizedr6r6r7cert_and_chain_from_fullchainbs  rcCsJt|d}ttj|}Wd|S1swY|S)zRetrieve the serial number of a certificate from certificate path :param str cert_path: path to a cert in PEM format :returns: serial number of the certificate :rtype: int rN)rrrrOrget_serial_number)rrrr6r6r7get_serial_from_cert~s  rcCsl|D]'}t|}t|dt}|jtjj }|r)|dj |kr)|Sq|r2t d||dS)a'Chooses the first certificate chain from fullchains whose topmost intermediate has an Issuer Common Name matching issuer_cn (in other words the first chain which chains to a root whose name matches issuer_cn). :param fullchains: The list of fullchains in PEM chain format. :type fullchains: `list` of `str` :param `str` issuer_cn: The exact Subject Common Name to match against any issuer in the certificate chain. :returns: The best-matching fullchain, PEM-encoded, or the first if none match. :rtype: `str` rzCertbot has been configured to prefer certificate chains with issuer '%s', but no chain from the CA matched this issuer. Using the default certificate chain instead.) rrrrrrissuerget_attributes_for_oidNameOID COMMON_NAMEvaluer(warning) fullchains issuer_cnwarn_on_no_matchrrtop_cert top_issuer_cnr6r6r7find_chain_with_issuers r)rrrT)rrr)FT)rfrN)F)U__doc__rloggingretypingrrr9 cryptographyrcryptography.exceptionsrrcryptography.hazmat.backendsr)cryptography.hazmat.primitives.asymmetricr,cryptography.hazmat.primitives.asymmetric.ecr r 1cryptography.hazmat.primitives.asymmetric.paddingr -cryptography.hazmat.primitives.asymmetric.rsar ,cryptography.hazmat.primitives.serializationr rrOpenSSLrrrzope.componentr<acmerrFcertbotrrrcertbot.compatr getLogger__name__r(intr+boolr1r8rArHrLrMrUrXrer&r~rrrrrrrOrrrrr^rrrrrrrcompileDOTALLrrrrr6r6r6r7s                       0 "  .