3
گa: @ s d Z ddlmZ ddlmZ ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl
m Z dd l m
Z
dd
l mZ dd lmZ dd lmZ dd
lmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlmZ ddl m Z ddl m Z ej e!Z"G dd dZ#e$e ee$ ee$ f dddZ%e$e$e$e&e'dddZ(d d e j)e$dd d d Z*d e j)e$dd!d"d#Z+e$e$e$e'd$d%d&Z,dS )'z*Tools for checking certificate revocation. )datetime) timedeltaN)PIPE)Optional)Tuple)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)hashes)
serialization)ocsp) crypto_util)errors)util)getenv)
RenewableCertc @ s` e Zd ZdZdeddddZeeddd Zdeee ed d d
Z
eeeee edddZ dS )RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.FN) enforce_openssl_binary_usagereturnc C sx d| _ || _| jrttjds0tjd d| _ d S tjdddddgttddtj d }d
|j
krjd d | _ n
d
d | _ d S )NFopensslz-openssl not installed, can't check revocationTr
z-headervarval)stdoutstderrZuniversal_newlinesZcheckenvz Missing =c S s
d| gS )NzHost= )hostr r /usr/lib/python3.6/ocsp.py1 s z,RevocationChecker.__init__..c S s d| gS )NZHostr )r r r r r 3 s ) brokenuse_openssl_binaryr Z
exe_existsloggerinfo
subprocessZrunr Z env_no_snap_for_external_callsr host_args)selfr Ztest_host_formatr r r __init__" s
zRevocationChecker.__init__)certr c C s | j |j|jS )a Get revoked status for a particular cert version.
.. todo:: Make this a non-blocking call
:param `.interfaces.RenewableCert` cert: Certificate object
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
)ocsp_revoked_by_paths cert_path
chain_path)r& r( r r r ocsp_revoked5 s
z RevocationChecker.ocsp_revoked
)r* r+ timeoutr c C sn | j r
dS tjjtj }tj||kr,dS t|\}}| sD| rHdS | j r`| j
|||||S t ||||S )aE Performs the OCSP revocation check
:param str cert_path: Certificate filepath
:param str chain_path: Certificate chain
:param int timeout: Timeout (in seconds) for the OCSP query
:returns: True if revoked; False if valid or the check failed or cert is expired.
:rtype: bool
F) r pytzZUTCZfromutcr utcnowr ZnotAfter_determine_ocsp_serverr! _check_ocsp_openssl_bin_check_ocsp_cryptography)r& r* r+ r. nowurlr r r r r) A s z'RevocationChecker.ocsp_revoked_by_paths)r* r+ r r5 r. r c
C s t d}t d}d }|d k s$|d k r4|d k r0|n|}|d krFd|g} n&|jdr`|tdd }d|d|g} ddd d
|d |d |d
|ddt|dg| j| | }
tjd| tjdj|
ytj |
tjd\} } W n" t
j k
r tj d| dS X t
|| | S )NZ
http_proxyZ
HTTP_PROXYz-urlzhttp://z-hostz-pathr r
z -no_noncez-issuerz-certz-CAfilez
-verify_otherz -trust_otherz-timeoutz-headerzQuerying OCSP for %s )logz*OCSP check failed for %s (are we offline?)F)r
startswithlenstrr% r" debugjoinr Z
run_scriptr ZSubprocessErrorr# _translate_ocsp_query)
r& r* r+ r r5 r. Zenv_http_proxyZenv_HTTP_PROXYZ
proxy_hostZurl_optscmdoutputerrr r r r2 ^ s&
4 z)RevocationChecker._check_ocsp_openssl_bin)F)r- ) __name__
__module__ __qualname____doc__boolr' r r, r: intr) r2 r r r r r s r )r* r c s t | d}tj|j t }W dQ R X y:|jjtj}tjj fdd|j
D }|d j j
}W n& tj t
fk
r tjd| d S X |j }|jdd jd }|r||fS tjd
|| d S )
zExtract the OCSP server host from a certificate.
:param str cert_path: Path to the cert we're checking OCSP for
:rtype tuple:
:returns: (OCSP server URL or None, OCSP server host or None)
rbNc s g | ]}|j kr|qS r )Z
access_method).0 description)ocsp_oidr r
s z*_determine_ocsp_server..r z Cannot extract OCSP URI from %sz:// /z;Cannot process OCSP host from URL (%s) in certificate at %s)NN)NN)openr load_pem_x509_certificatereadr
extensionsget_extension_for_classZAuthorityInformationAccessZ AuthorityInformationAccessOIDZOCSPvalueZaccess_locationExtensionNotFound
IndexErrorr" r# rstrip partition)r* file_handlerr( extensionZ descriptionsr5 r r )rJ r r1 s r1 )r* r+ r5 r. r c ' C s t |d}tj|j t }W d Q R X t | d}tj|j t }W d Q R X tj }|j||tj }|j
}|j t j
j} ytj|| ddi|d}
W n( tjjk
r tjd| dd dS X |
jd krtjd
| |
j dS tj|
j} | jtjjkrtjd | | j dS yt | ||| W n t k
rV } ztjt | W Y d d } ~ X n t j k
r } ztjt | W Y d d } ~ X nt t!k
r tjd | Y nT t"k
r }
ztjd
| t |
W Y d d }
~
X n X tj#d| | j$ | j$tj%j&kS dS )NrG z Content-Typezapplication/ocsp-request)dataZheadersr. z*OCSP check failed for %s (are we offline?)T)exc_infoF z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.z%OCSP certificate status for %s is: %s)'rN r rO rP r
r
ZOCSPRequestBuilderZadd_certificater ZSHA1ZbuildZ public_bytesr ZEncodingZDERrequestsZpost
exceptionsZRequestExceptionr" r# Z status_codeZload_der_ocsp_responseZcontentZresponse_statusZOCSPResponseStatusZ
SUCCESSFULwarning_check_ocsp_responser r: r Errorr AssertionErrorr; Zcertificate_statusZOCSPCertStatusZREVOKED)r* r+ r5 r. rX issuerr( ZbuilderZrequestZrequest_binaryZresponse
response_ocspeerrorr r r r3 sJ
$
r3 zocsp.OCSPResponsezocsp.OCSPRequest)rd request_ocsp issuer_certr* r c C s | j |j krtdt| || t| jt|j sL| j|jksL| j|jkrTtdtj }| j
sjtd| j
|t dd krtd| j r| j |t dd k rtddS ) z2Verify that the OCSP is valid for several criteriazMthe certificate in response does not correspond to the certificate in requestztjd| |}ntjd| fddjD }|slt d|d }|j
|jkrt d
y"|j j t j
}t jjj|jk}W n t jtfk
r d }Y nX |st d |j}tj|j |j|j| j}|st d
tj|j jj| dS )zIVerify an OCSP response signature against certificate issuer or responder)r( r c S s t jj| j jS )N)r ZSubjectKeyIdentifierZfrom_public_key
public_keyZdigest)r( r r r _key_hash s z1_check_ocsp_response_signature.._key_hashzGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.c s* g | ]"}j |jks"j |kr|qS r )responder_namesubjectresponder_key_hash)rH r( )rn rd r r rK s z2_check_ocsp_response_signature..z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz.c 3 s | ]}t j| t jd V qdS ))flagsN)researchDOTALL)rH p)rt r r 4 s z(_translate_ocsp_query.. NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output:
%s
stderr:
%sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s
stderr:%s)rv rw rx )groupr" r# r; r_ ) r* rt ru ZstatesZpatternsrv rw rx r_ r )r* rt r r= / s$
r= )-rD r r Zloggingr| r$ r Ztypingr r Z cryptographyr Zcryptography.exceptionsr r Z cryptography.hazmat.backendsr
Z cryptography.hazmat.primitivesr r Zcryptography.x509r
r/ r] Zcertbotr r r Zcertbot.compat.osr Zcertbot.interfacesr Z getLoggerrA r" r r: r1 rF rE r3 rr r` rj r= r r r r s>
e 1"8