⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
certbot
/
__pycache__
/
View File Name :
crypto_util.cpython-312.pyc
M/e ` d Z ddlZddlZddlZddlZddlmZ ddlmZ ddlmZ ddlm Z ddlm Z ddlm Z dd lm Z dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlm Z ddl m Z ddl m Z ddl!m"Z" ddl!m#Z# ddl!m$Z$ ddl%Z%ddl&m'Z' ddl&m(Z( ddl)Z)ddl*m+Z, ddl-m.Z. dd l-m/Z/ dd l-m0Z0 dd l1m2Z2 e rdd l3m4Z4 dd l5m6Z6 dd!l7m8Z8 dd"l9m:Z: ejv e< Z= dhd#e>d$ee? d%e?d&e?d'e?d(e@d)e0j fd*ZB did+e0j d,e ee? e e? f d-ee? d.e@d(e@d)e0j f d/ZDd0eEd)e@fd1ZFd0eEd+eEd)e@fd2ZGd3e?d4eEd)e e>e0j ee? f fd5ZH djd6e>d%e?d&ee? d)eEfd7ZId+e e?eEf d)e@fd8ZJd9e/j d)dfd:ZLd9e/j d)dfd;ZMd<e ed=d>e e d?d@f dAeEdBeEdCej d)df dDZOdEe?dFe?d)dfdGZPd9e/j d)dfdHZQd4eEd)e e'j e>f fdIZSe'j fdJeEdKee>eEge e'j e'j f f dLe>d)e e'j e'j f fdMZVe'j fdJeEdKee>eEge e'j e'j f f dLe>d)ee? fdNZWe'j fdOeEdLe>d)ee? fdPZXdQeEdKee>eEge e'j e'j f f dLe>d)ee? fdRZYdSe e'j e'j f d)ee? fdTZZe'j fdOeEdLe>d)ee? fdUZ[e'j fd0eEdLe>d)ee? fdVZ\e'j fdWe ee'j ee%j f dXe>d)eEfdYZ^dEe?d)ej fdZZ_dEe?d)ej fd[Z`dEe?d\ee'j geeE f d)ej fd]Zad^e?d)e?fd_Zb ej d`ej Zedae?d)e e?e?f fdbZfdEe?d)e>fdcZg dkddee? dee?dfe@d)e?fdgZhy)lzCertbot client crypto utility functions. .. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server is capable of handling the signatures. N)Callable)List)Optional)Set)Tuple) TYPE_CHECKING)Union)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)hashes)ec) DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15) RSAPublicKey)Encoding) NoEncryption) PrivateFormat)crypto)SSL) crypto_util)errors) interfaces)util)os)Ed448PublicKey)Ed25519PublicKey) X448PublicKey)X25519PublicKeykey_sizekey_dirkey_typeelliptic_curvekeynamestrict_permissionsreturnc D t | |xs d| }d}|rt j |d| t j t j j || d d \ } }| 5 | j | ddd |d k( rt j d | | nt j d | | t j || S # t $ r=}t j dd t j dt | |d}~ww xY w# 1 sw Y xY w)a$ Initializes and saves a privkey. Inits key and saves it in PEM format on the filesystem. .. note:: keyname is the attempted filename, it may be different if a file already exists at the path. :param int key_size: key size in bits if key size is rsa. :param str key_dir: Optional key save directory. :param str key_type: Key Type [rsa, ecdsa] :param str elliptic_curve: Name of the elliptic curve if key type is ecdsa. :param str keyname: Filename of key :param bool strict_permissions: If true and key_dir exists, an exception is raised if the directory doesn't have 0700 permissions or isn't owned by the current user. :returns: Key :rtype: :class:`certbot.util.Key` :raises ValueError: If unable to generate the key given key_size. secp256r1)bitsr& r% Texc_infoz&Encountered error while making key: %sNi i wbrsaz Generating RSA key (%d bits): %sz"Generating ECDSA key (%d bits): %s)make_key ValueErrorloggerdebugerrorstrr make_or_verify_dir unique_filer pathjoinwriteKey) r# r$ r% r& r' r( key_pemerrkey_pathkey_fs 5/usr/lib/python3/dist-packages/certbot/crypto_util.py generate_keyrC 8 s 0.*GKRZ H 0BC ** GGLL' *E49x KK u LL;Xx P LL=x R 88Hg &&% R$ ' =s3xH Us# C )D D8DDD privkeynamesr: must_staplec t j | j || }d}|rt j |d| t j t j j |d dd \ }}|5 |j | ddd t j d| t j ||d S # 1 sw Y 6xY w) aC Initialize a CSR with the given private key. :param privkey: Key to include in the CSR :type privkey: :class:`certbot.util.Key` :param set names: `str` names to include in the CSR :param str path: Optional certificate save directory. :param bool must_staple: If true, include the TLS Feature extension "OCSP Must-Staple" :param bool strict_permissions: If true and path exists, an exception is raised if the directory doesn't have 0755 permissions or isn't owned by the current user. :returns: CSR :rtype: :class:`certbot.util.CSR` )rF Ni zcsr-certbot.pemi r0 zCreating CSR: %spem) acme_crypto_utilmake_csrrH r r8 r9 r r: r; r< r4 r5 CSR)rD rE r: rF r( csr_pem csr_filenamecsr_fs rB generate_csrrO i s '' U 5G L e-?@ " . . GGLL 0 15$ @| KK ' 6 88L'5 11 Us 8B??Ccsrc t j t j | }|j |j S # t j $ r t j dd Y yw xY w)zValidate CSR. Check if `csr` is a valid CSR for the given domains. :param bytes csr: CSR in PEM. :returns: Validity of CSR. :rtype: bool r- Tr. F)r load_certificate_request FILETYPE_PEMverify get_pubkeyErrorr4 r5 )rP reqs rB valid_csrrX s^ -- &zz#..*++ << R$ 's AA *A21A2c t j t j | }t j t j | } |j | S # t j $ r t j dd Y yw xY w)zDoes private key correspond to the subject public key in the CSR? :param bytes csr: CSR in PEM. :param bytes privkey: Private key file contents (PEM) :returns: Correspondence of private key to CSR subject public key. :rtype: bool r- Tr. F)r rR rS load_privatekeyrT rV r4 r5 )rP rD rW pkeys rB csr_matches_pubkeyr\ sq ) )S "C ! !&"5"5w ?Dzz$ << R$ 's A *BBcsrfiledatac t j }t j } |t j | }t | }t j || }|t j | |d |fS # t j $ rI ||| }n;# t j $ r% t j dj | w xY wY w xY w)a1 Import a CSR file, which can be either PEM or DER. :param str csrfile: CSR filename :param bytes data: contents of the CSR file :returns: (`crypto.FILETYPE_PEM`, util.CSR object representing the CSR, list of domains requested in the CSR) :rtype: tuple z Failed to parse CSR file: {0}rH )filer^ form) r rS rR FILETYPE_ASN1rV r format"_get_names_from_loaded_cert_or_reqdump_certificate_requestr rK )r] r^ PEMloadrP domainsdata_pems rB import_csr_filerj s C * *DP6''. 15G..sC8H gH5A7 JJ << P PsD/C|| P,, > E Eg NO O P Ps) A5 5C BC8C CCr, c 4 |dk( r_| dk r$t j dj | t j }|j t j | n5|dk( r |st j d |j }|dv r]t t |j }|st j d| t j | t }n$t j d j | |j t j" t$ j& t) }t j* t j, | }n$t j d j | t j. t j, | S # t $ r% t j d j | t $ r$}|t j t | d }~ww xY w) a Generate PEM encoded RSA|EC key. :param int bits: Number of bits if key_type=rsa. At least 2048 for RSA. :param str key_type: The type of key to generate, but be rsa or ecdsa :param str elliptic_curve: The elliptic curve to use. :returns: new RSA or ECDSA key in PEM form with specified number of bits or of type ec_curve when key_type ecdsa is used. :rtype: str r1 z Unsupported RSA key length: {}ecdsaz3When key_type == ecdsa, elliptic_curve must be set.) SECP256R1 SECP384R1 SECP521R1zInvalid curve type: )curvebackendz Unsupported elliptic curve: {}N)encodingrc encryption_algorithmz0Invalid key_type specified: {}. Use [rsa|ecdsa])r rV rc r PKeyrC TYPE_RSAuppergetattrr generate_private_keyr TypeErrorr r7 private_bytesr rf r TraditionalOpenSSLr rZ rS dump_privatekey) r, r% r& keynamerq _keye_key_pems rB r2 r2 s 5 $;,, ? F Ft LM Mkkm $/ W ,, TU U .!'')D>> N$8$8$:; ,,)=n=M'NOO.. ' + - ll#C#J#J>#Z[[ %% \\ 33!- & $$V%8%8(CllMTTU]^__ ! !&"5"5s ;; X,, ? F F~ VW W# . c!f- - .s BF> >5H3 HHc t j t j | j S # t t j f$ r Y yw xY w)zIs valid RSA private key? :param privkey: Private key file contents in PEM :returns: Validity of private key. :rtype: bool F)r rZ rS checkrz rV )rD s rB valid_privkeyr sG %% **/%' 2 v|| $ s 14 AArenewable_certc p t | t | t | j | j y)a For checking that your certs were not corrupted on disk. Several things are checked: 1. Signature verification for the cert. 2. That fullchain matches cert and chain when concatenated. 3. Check that the private key matches the certificate. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If verification fails. N)verify_renewable_cert_sigverify_fullchain verify_cert_matches_priv_key cert_pathr@ )r s rB verify_renewable_certr s* n-^$ !9!9>;R;RS c t | j d 5 }t j |j t }ddd t | j d 5 }t j |j t }ddd j }j sJ t ||j |j |j y# 1 sw Y xY w# 1 sw Y `xY w# t t t f$ rK}dj | j | }t j# | t% j& | d}~ww xY w)zVerifies the signature of a RenewableCert object. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If signature verification fails. rbNzbverifying the signature of the certificate located at {0} has failed. Details: {1})open chain_pathr load_pem_x509_certificatereadr r public_keysignature_hash_algorithmverify_signed_payload signaturetbs_certificate_bytesIOErrorr3 r rc r4 exceptionr rV )r chain_filechain cert_filecertpkr error_strs rB r r % s & .++T 2j22:??3DoFWXE 3 .**D 1Y11)..2BODUVD 2 ,,,, b$..$2L2L $ = = ? 3 2 1 1 Z!1 2 & $f^%=%=q A #ll9%% &sH C; -C# C; #-C/AC; #C,(C; /C84C; ;EAEEr r r r" r! r payloadr c t | t r | j ||t | yt | t r | j ||t | yt j d )a Check the signature of a payload. :param RSAPublicKey/EllipticCurvePublicKey public_key: the public_key to check signature :param bytes signature: the signature bytes :param bytes payload: the payload bytes :param hashes.HashAlgorithm signature_hash_algorithm: algorithm used to hash the payload :raises InvalidSignature: If signature verification fails. :raises errors.Error: If public key type is not supported z Unsupported public key type.N) isinstancer rT r r r r rV )r r r r s rB r r = sb *l+ w ,D J 6 7 w&> ? ll9::r r r@ c l t j t j }|j | |j | |j y# t t j f$ rB}dj | || }t j | t j | d}~ww xY w)z Verifies that the private key and cert match. :param str cert_path: path to a cert in PEM format :param str key_path: path to a private key file :raises errors.Error: If they don't match. zverifying the certificate located at {0} matches the private key located at {1} has failed. Details: {2}N) r Context SSLv23_METHODuse_certificate_fileuse_privatekey_filecheck_privatekeyr rV rc r4 r r )r r@ contextr r s rB r r X s &++c / /0$$Y/##H- " SYY & $fY ! % #ll9%% &s AA B31=B..B3c t | j 5 }|j }ddd t | j 5 }|j }ddd t | j 5 }|j }ddd z k7 r2d}|j | j }t j | y# 1 sw Y xY w# 1 sw Y ~xY w# 1 sw Y \xY w# t $ r@}dj | }t j | t j | d}~wt j $ r}|d}~ww xY w)z Verifies that fullchain is indeed cert concatenated with chain. :param renewable_cert: cert to verify :type renewable_cert: certbot.interfaces.RenewableCert :raises errors.Error: If cert and chain do not combine to fullchain. Nz.fullchain does not match cert + chain for {0}!z8reading one of cert, chain, or fullchain has failed: {0}) r r r r fullchain_pathrc lineagenamer rV r r4 r ) r r r r r fullchain_file fullchainr r s rB r r n s .++ , OO%E - .** +y >>#D , .// 0N&++-I 1 5LY &HI!(( )C)CDI,,y) ) ' - , + + 0 0 &NUUVWX #ll9%% << sj C+ C C+ C C+ 3C AC+ C C+ C C+ C($C+ + E 4;D//E EE c Z g }t j t j fD ] } t j || |fc S t j dj dj d |D # t j $ r}|j | Y d}~d}~ww xY w)z:Load PEM/DER certificate. :raises errors.Error: NzUnable to load: {0},c 3 2 K | ] }t | y wN)r7 ).0r6 s rB <genexpr>z-pyopenssl_load_certificate.<locals>.<genexpr> s =0 .uE s ) r rS rb load_certificaterV appendr rc r; )r^ openssl_errors file_typer6 s rB pyopenssl_load_certificater s N ))6+?+?@ )**9d;YF F A ,,,33CHH =0 .=0 50 1 2 2 || ) ! !% ( ( )s A<<B*B%%B*cert_or_req_str load_functypc ||| S # t j $ r<}t j dd t j dt | d }~ww xY w)Nr- Tr. z6Encountered error while loading certificate or csr: %s)r rV r4 r5 r6 r7 )r r r r? s rB _load_cert_or_reqr sO o.. << R$ ' MsSVxX s A7AAc B t j t | || S r )rI _pyopenssl_cert_or_req_sanr )r r r s rB _get_sans_from_cert_or_reqr s& 6 67HC8) * *r r c 8 t | t j | S )zGet a list of Subject Alternative Names from a certificate. :param str cert: Certificate (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of Subject Alternative Names. :rtype: list )r r r r r s rB get_sans_from_certr s & f%%s , ,r cert_or_reqc 2 t | || }t | S r )r rd )r r r loaded_cert_or_reqs rB _get_names_from_cert_or_reqr s +; 3G -.@ AAr r c , t j | S r )rI _pyopenssl_cert_or_req_all_names)r s rB rd rd s < <=O PPr c 8 t | t j | S )zGet a list of domains from a cert, including the CN if it is set. :param str cert: Certificate (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of domain names. :rtype: list )r r r r s rB get_names_from_certr s ' f%%s , ,r c 8 t | t j | S )zGet a list of domains from a CSR, including the CN if it is set. :param str csr: CSR (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of domain names. :rtype: list )r r rR )rP r s rB get_names_from_reqr s 'sF,K,KS QQr r filetypec . t j | | S )zDump certificate chain into a bundle. :param list chain: List of `crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). )rI dump_pyopenssl_chain)r r s rB r r s 0 0 AAr c J t | t j j S )zWhen does the cert at cert_path start being valid? :param str cert_path: path to a cert in PEM format :returns: the notBefore value from the cert at cert_path :rtype: :class:`datetime.datetime` )_notAfterBeforer X509 get_notBeforer s rB notBeforer s 9fkk&?&? @@r c J t | t j j S )zWhen does the cert at cert_path stop being valid? :param str cert_path: path to a cert in PEM format :returns: the notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` )r r r get_notAfterr s rB notAfterr s 9fkk&>&> ??r methodc t | d 5 }t j t j |j }ddd | }|st j d |dd d|dd d|dd d |dd d |d d d |d d g }d j | }|j d }t j | S # 1 sw Y ~xY w)aP Internal helper function for finding notbefore/notafter. :param str cert_path: path to a cert in PEM format :param function method: one of ``crypto.X509.get_notBefore`` or ``crypto.X509.get_notAfter`` :returns: the notBefore or notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` r Nz>Error while invoking timestamp method, None has been returned.r - T : r ascii) r r r rS r r rV r; decode pyrfc3339parse)r r fr timestampreformatted_timestamptimestamp_bytes timestamp_strs rB r r s i !&&v':':AFFHE t I ll[\\ &q^T9Qq>4 &q^T9Qr?D &r" -tYrs^ E hh 45O#**73M ??= )) s 3B==Cfilenamec t j }t | d 5 }|j |j j d ddd |j S # 1 sw Y |j S xY w)aN Compute a sha256sum of a file. NB: In given file, platform specific newlines characters will be converted into their equivalent unicode counterparts before calculating the hash. :param str filename: path to the file whose hash will be computed :returns: sha256 digest of the file in hexadecimal :rtype: str rzUTF-8N)hashlibsha256r updater encode hexdigest)r r file_ds rB sha256sumr & sb ^^ F h fkkm**734 s /A((B s@ -----BEGIN CERTIFICATE----- ? .+? ? -----END CERTIFICATE----- ? fullchain_pemc t j | j }t | dk rt j d |D cg c]V }t j t j t j t j | j X }}|d dj |dd fS c c}w )a Split fullchain_pem into cert_pem and chain_pem :param str fullchain_pem: concatenated cert + chain :returns: tuple of string cert_pem and chain_pem :rtype: tuple :raises errors.Error: If there are less than 2 certificates in the chain. zPfailed to parse fullchain into cert and chain: less than 2 certificates in chainr r- N) CERT_PEM_REGEXfindallr lenr rV r dump_certificaterS r r r; )r certsr certs_normalizeds rB cert_and_chain_from_fullchainr A s " "=#7#7#9 :E 5zA~ll ? @ @ RWXQV //0C0C 3 3T:<<BFHEQV X Q )9!")=!> ?? Xs ACc t | d 5 }t j t j |j }ddd j S # 1 sw Y xY w)zRetrieve the serial number of a certificate from certificate path :param str cert_path: path to a cert in PEM format :returns: serial number of the certificate :rtype: int r N)r r r rS r get_serial_number)r r r s rB get_serial_from_certr ] sM i !&&v':':AFFHE !4 ! ! ## s 3AA" fullchains issuer_cnwarn_on_no_matchc j | D ] }t j |j }t j |d t }|j j t j j }|s}|d j |k( s|c S |rt j d| | d S )a' Chooses the first certificate chain from fullchains whose topmost intermediate has an Issuer Common Name matching issuer_cn (in other words the first chain which chains to a root whose name matches issuer_cn). :param fullchains: The list of fullchains in PEM chain format. :type fullchains: `list` of `str` :param `str` issuer_cn: The exact Subject Common Name to match against any issuer in the certificate chain. :returns: The best-matching fullchain, PEM-encoded, or the first if none match. :rtype: `str` r zCertbot has been configured to prefer certificate chains with issuer '%s', but no chain from the CA matched this issuer. Using the default certificate chain instead.) r r r r r r issuerget_attributes_for_oidNameOID COMMON_NAMEvaluer4 warning)r r r r r top_cert top_issuer_cns rB find_chain_with_issuerr k s &&u||~611%)_=NO >>t||?W?WX ]1 - 3 3y @L =>G I a=r )r1 r+ zkey-certbot.pemT)FT)rl r1 N)F)i__doc__datetimer loggingretypingr r r r r r r cryptographyr cryptography.exceptionsr r cryptography.hazmat.backendsr cryptography.hazmat.primitivesr )cryptography.hazmat.primitives.asymmetricr -cryptography.hazmat.primitives.asymmetric.dsar ,cryptography.hazmat.primitives.asymmetric.ecr r 1cryptography.hazmat.primitives.asymmetric.paddingr -cryptography.hazmat.primitives.asymmetric.rsar ,cryptography.hazmat.primitives.serializationr r r josepyOpenSSLr r r acmer rI certbotr r r certbot.compatr /cryptography.hazmat.primitives.asymmetric.ed448r 1cryptography.hazmat.primitives.asymmetric.ed25519r .cryptography.hazmat.primitives.asymmetric.x448r! 0cryptography.hazmat.primitives.asymmetric.x25519r" getLogger__name__r4 intr7 boolr= rC rK rO bytesrX r\ rj r2 r RenewableCertr r HashAlgorithmr r r r r rS X509Reqr r r r rd r r ComparableX509r r r r r compileDOTALLr r r r r rB <module>r9 s 4 8 8 1 8 F > O F F A E F 0 NRLP 8 $ INCT,0.'3 .'# .'# .'!$.'=@.'%).'59XX.'d HL 2$(( 25cCH1D+E 2XVY] 2 " 2@D 2PTPXPX 2J5 T (E E d (KS K K%TXXtCy8P2Q K: 05-1-<3 -< -< %c]-<6;-<` 5e, T**B*B Tt T$&j.F.F &4 &0;eL:LN^,BL,=-O 'P ; &+; 6;; 5;4H4H ; NR ;6&C &3 &4 &,Z%=%= $ 62U 2uV[[#5E/F 2( "(!4!4u !)3,fkk6>>>Y8Z*Z![ 9>v{{FNN?Z9[ +1*=*=* **2C<v{{GM~~HV BW 4W +X* %(* CGs)* 06/B/B ,U , ,tCy , BU B+3S%L% HNIW CX 5X ,YB &)B .2#YBQ5fnnA\;] Q,0IQ 170C0C ,e ,# ,S , /5.A.A RE R Rd3i R *0)<)< Bd6;;&7f>S>S9T&T U B#& BAF B A A!2!2 A @ @ 1 1 @*s * $fkk]HUO%C D*IQIZIZ*8 $ II @ @sCx @8 $C $C $ 5:tCy S -1>Ar