⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
usr
/
lib
/
python3
/
dist-packages
/
acme
/
__pycache__
/
View File Name :
crypto_util.cpython-312.pyc
M/eF n d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddlm Z ddlm Z ddlm Z ddlm Z ddlmZ dd lmZ dd lmZ dd lmZ ddlZdd lmZ dd lmZ ddlmZ ej2 e Zej8 Z G d d Z G d d Z dde ddfde de de!de!de!dee"e!f d e ee d ejF fd Z$ d4d e d e eee" e e" f d!e%d"e e eejL ejN f d e f d#Z(d$eejF ejR f d e e" fd%Z*d&eejF ejR f d e e" fd'Z+d&eejF ejR f d e e" fd(Z,d&eejF ejR f d e e" fd)Z- d5d*ej\ d e e e" d+e e! d,e!d-e%d.e e ej^ d/e e eejL ejN f d ejF fd0Z0ejb fd1ee ejd e ejF f d2e!d e fd3Z3y)6zCrypto utilities. N)Any)Callable)List)Mapping)Optional)Sequence)Set)Tuple)Union)crypto)SSL)errorsc e Zd Zdeeeej ej f f fdZ de j de eej ej f fdZ y)_DefaultCertSelectioncertsc || _ y N)r )selfr s 2/usr/lib/python3/dist-packages/acme/crypto_util.py__init__z _DefaultCertSelection.__init__& s connectionreturnc ` |j }|r | j j |d S y r )get_servernamer get)r r server_names r __call__z _DefaultCertSelection.__call__) s+ //1 ::>>+t4 4r N)__name__ __module__ __qualname__r bytesr r PKeyX509r r Connectionr r r r r r % s[ geU6;; 3K-L&L M 3>> huV[[RXR]R]E]?^6_ r r c z e Zd ZdZdeddfdej deeee e j e j f f de deeej ee gef deeej gee e j e j f f ddf d Zd edefd Zd ej ddfd Z G d d Zde eef fdZy) SSLSocketa SSL wrapper for sockets. :ivar socket sock: Original wrapped socket. :ivar dict certs: Mapping from domain names (`bytes`) to `OpenSSL.crypto.X509`. :ivar method: See `OpenSSL.SSL.Context` for allowed values. :ivar alpn_selection: Hook to select negotiated ALPN protocol for connection. :ivar cert_selection: Hook to select certificate for connection. If given, `certs` parameter would be ignored, and therefore must be empty. Nsockr methodalpn_selectioncert_selectionr c || _ || _ || _ |s |s t d |r |r t d |}|t |r|ni }|| _ y )Nz*Neither cert_selection or certs specified.z(Both cert_selection and certs specified.)r) r+ r* ValueErrorr r, )r r) r r* r+ r, actual_cert_selections r r zSSLSocket.__init__= sg , e IJ J e GH H Tb ! ($95%b$Q ! 3r namec . t | j | S r )getattrr) r r0 s r __getattr__zSSLSocket.__getattr__T s tyy$''r r c | j | }|%t j d|j y|\ }}t j | j }|j t j |j t j |j | |j | | j |j | j |j | y)a SNI certificate callback. This method will set a new OpenSSL context object for this connection when an incoming connection provides an SNI name (in order to serve the appropriate certificate, if any). :param connection: The TLS connection object on which the SNI extension was received. :type connection: :class:`OpenSSL.Connection` Nz=Certificate selection for server name %s failed, dropping SSL)r, loggerdebugr r Contextr* set_options OP_NO_SSLv2 OP_NO_SSLv3use_privatekeyuse_certificater+ set_alpn_select_callback set_context)r r pairkeycert new_contexts r _pick_certificate_cbz SSLSocket._pick_certificate_cbW s "":. < LLX#224 6 Tkk$++. 0 0""3'##D) * 0 01D1D E {+r c T e Zd ZdZdej ddfdZdedefdZ dede fd Z y) SSLSocket.FakeConnectionz Fake OpenSSL.SSL.Connection.r r Nc || _ y r )_wrapped)r r s r r z!SSLSocket.FakeConnection.__init__w s &DMr r0 c . t | j | S r )r2 rH r3 s r r4 z$SSLSocket.FakeConnection.__getattr__z s 4==$/ /r unused_argsc | j j S # t j $ r}t j | d }~ww xY wr )rH shutdownr Errorsocketerror)r rJ rO s r rL z!SSLSocket.FakeConnection.shutdown} s? *}}--//99 * ll5)) *s A AA ) r r r! __doc__r r% r strr r4 boolrL r& r r FakeConnectionrF r sB * 's~~ '$ ' 0C 0C 0 * * *r rS c | j j \ }} t j | j }|j t j |j t j |j | j | j |j | j | j t j || }|j t j! d| |j# ||fS # t j$ $ r}t' j( | d }~ww xY w# |j+ xY w)Nz Performing handshake with %s)r) acceptr r8 r* r9 r: r; set_tlsext_servername_callbackrD r+ r> rS r% set_accept_stater6 r7 do_handshakerM rN rO close)r r) addrcontextssl_sockrO s r rU zSSLSocket.accept s YY%%' d kk$++.G 0 0 2 243L3L M"".001D1DE**3>>'4+HIH % % ' LL7 > *%%' T> ! 99 * ll5)) * JJL s0 C*E D E E 1EE E E!)r r r! rP _DEFAULT_SSL_METHODrN r r r" r r r# r$ intr r r% r r rQ r r4 rD rS rU r& r r r( r( 0 s# UY 2\` UY 4V]] 4 fkk6;;6N0O)O!PQ4 4 "*(CNNDK3PRW3W*X!Y4 "*(CNN3C3;E&++BH++CN =O 4P4P +Q "R 4 4.( ( (,s~~ ,$ ,6* *, nc 12 r r( i i, ) r r0 hostporttimeoutr* source_addressalpn_protocolsr c t j | }|j | d|i} t j d||t | rdj |d |d nd ||f} t j | fi |} t j | 5 } t j || } | j | j! | || j# | | j% | j' ddd j) }|sJ |S # t j $ r} t j | d} ~ ww xY w# t j $ r} t j | d} ~ ww xY w# 1 sw Y xY w)a Probe SNI server for SSL certificate. :param bytes name: Byte string to send as the server name in the client hello message. :param bytes host: Host to connect to. :param int port: Port to connect to. :param int timeout: Timeout in seconds. :param method: See `OpenSSL.SSL.Context` for allowed values. :param tuple source_address: Enables multi-path probing (selection of source interface). See `socket.creation_connection` for more info. Available only in Python 2.7+. :param alpn_protocols: Protocols to request using ALPN. :type alpn_protocols: `Sequence` of `bytes` :raises acme.errors.Error: In case of any problems. :returns: SSL certificate presented by the server. :rtype: OpenSSL.crypto.X509 rc z!Attempting to connect to %s:%d%s.z from {0}:{1}r r_ N)r r8 set_timeoutr6 r7 anyformatrN create_connectionrO r rM contextlibclosingr% set_connect_stateset_tlsext_host_nameset_alpn_protosrX rL get_peer_certificate)r0 r` ra rb r* rc rd r[ socket_kwargs socket_tupler) rO client client_sslrB s r probe_sniru sq . kk&!G %~6M " /t ^$ " " q! q! +- ,0, '' F F D !V^^GV4 $$&''- % & &~ 6 & # # % ! " * * ,D K4 K! << "ll5!!" yy &,,u% % & " !sC AD! A F" E!E4E EE>$E99E>>FF private_key_pemdomains must_stapleipaddrsc t j t j | }t j }g }|g }|g }t | t | z dk( r t d |D ] }|j d|z |D ] }|j d|j z " dj | j d } t j dd| g} |r'| j t j d dd |j | |j | |j d |j |d t j t j | S ) a Generate a CSR containing domains or IPs as subjectAltNames. :param buffer private_key_pem: Private key, in PEM PKCS#8 format. :param list domains: List of DNS names to include in subjectAltNames of CSR. :param bool must_staple: Whether to include the TLS Feature extension (aka OCSP Must Staple: https://tools.ietf.org/html/rfc7633). :param list ipaddrs: List of IPaddress(type ipaddress.IPv4Address or ipaddress.IPv6Address) names to include in subbjectAltNames of CSR. params ordered this way for backward competablity when called by positional argument. :returns: buffer PEM-encoded Certificate Signing Request. r zAAt least one of domains or ipaddrs parameter need to be not emptyDNS:IP:, ascii subjectAltNameFcriticalvalues 1.3.6.1.5.5.7.1.24s DER:30:03:02:01:05sha256)r load_privatekey FILETYPE_PEMX509Reqlenr. appendexplodedjoinencode X509Extensionadd_extensions set_pubkey set_versionsigndump_certificate_request) rv rw rx ry private_keycsrsanlistaddressips san_string extensionss r make_csrr sW ((_.K .. CG 7|CL A%\]]v'( us||+, 7#**73J J &.. !') * z"NN; OOAHH[(# * *S " "r loaded_cert_or_reqc | j j }t | }||S |g|D cg c] }||k7 s | c}z S c c}w r ) get_subjectCN_pyopenssl_cert_or_req_san)r common_namesansds r _pyopenssl_cert_or_req_all_namesr sT %00255K %&8 9D =t@t!qK/?At@ @@@s AA cert_or_reqc d}d|z }t | }|D cg c]' }|j | r|j | d ) c}S c c}w )a Get Subject Alternative Names from certificate or CSR using pyOpenSSL. .. todo:: Implement directly in PyOpenSSL! .. note:: Although this is `acme` internal API, it is used by `letsencrypt`. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: A list of Subject Alternative Names that is DNS. :rtype: `list` of `str` :DNSrf ) _pyopenssl_extract_san_list_raw startswithsplitr part_separatorprefix sans_partsparts r r r # s] $ N ^ #F0=J # ?"doof&= JJ~ &q )" ? ? ?s ,Ac d}d|z }t | }|D cg c]" }|j | s|t | d $ c}S c c}w )ae Get Subject Alternative Names IPs from certificate or CSR using pyOpenSSL. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: A list of Subject Alternative Names that are IP Addresses. :rtype: `list` of `str`. note that this returns as string, not IPaddress object r z IP AddressN)r r r r s r _pyopenssl_cert_or_req_san_ipr > sK N N *F0=J+5 Q:4 9PDV : QQ Qs AAc t | t j r4t j t j | j d }n3t j t j | j d }t j d| }d}|g }|S |j d j | }|S )a Get raw SAN string from cert or csr, parse it as UTF-8 and return. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: raw san strings, parsed byte as utf-8 :rtype: `list` of `str` zutf-8z5X509v3 Subject Alternative Name:(?: critical)?\s*(.*)r} rf ) isinstancer r$ dump_certificate FILETYPE_TEXTdecoder researchgroupr )r textraw_sanparts_separatorr s r r r R s +v{{+&&v';';[IPPQXY..v/C/C[QXXY`a iiPRVWGO J -4MM!,<,B,B?,SJ r rA not_beforevalidity force_sanr r c |s |sJ d t j }|j t t j t j d d |j d |g }|g }|g }|j t j ddd t | dkD r|d |j _ |j |j g }|D ] } |j d| z |D ] } |j d | j z " d j! | j# d } |s t | d kD st | dkD r'|j t j d d| |j% | |j' |dn| |j) | |j+ | |j- | d |S )at Generate new self-signed certificate. :type domains: `list` of `str` :param OpenSSL.crypto.PKey key: :param bool force_san: :param extensions: List of additional extensions to include in the cert. :type extensions: `list` of `OpenSSL.crypto.X509Extension` :type ips: `list` of (`ipaddress.IPv4Address` or `ipaddress.IPv6Address`) If more than one domain is provided, all of the domains are put into ``subjectAltName`` X.509 extension and first domain is set as the subject CN. If only one domain is provided no ``subjectAltName`` extension is used, unless `force_san` is ``True``. z7Must provide one or more hostnames or IPs for the cert. s basicConstraintsTs CA:TRUE, pathlen:0r r{ r| r} r~ rf r Fr r )r r$ set_serial_numberr^ binasciihexlifyosurandomr r r r r r set_issuerr r r r gmtime_adj_notBeforegmtime_adj_notAfterr r ) rA rw r r r r r rB r r ipr s r gen_ss_certr q s * cTTT> ;;=D3x / / 2 ?DEQ { '< > 7|a ' OOD$$&'Gv'( ur{{*+ 7#**73JCL1$C1 &.. # :#5a:F X&OOCIIc8 Kr chainfiletypec dt t j t j f dt ffd dj fd| D S )zDump certificate chain into a bundle. :param list chain: List of `OpenSSL.crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). :returns: certificate chain bundle :rtype: bytes rB r c t | t j rEt | j t j rt j d | j } t j | S )NzUnexpected CSR provided.) r joseComparableX509wrappedr r r rM r )rB r s r _dump_certz(dump_pyopenssl_chain.<locals>._dump_cert sQ dD / / 0$,,7 ll#=>><<D&&x66r r c 3 . K | ] } | y wr r& ).0rB r s r <genexpr>z'dump_pyopenssl_chain.<locals>.<genexpr> s 7Jt$s )r r r r r$ r" r )r r r s `@r dump_pyopenssl_chainr sA 7t 2 2FKK ?@ 7U 7 8877 77r )NFN)NNi: TNN)4rP r rk ipaddressloggingr r rN typingr r r r r r r r r josepyr OpenSSLr r acmer getLoggerr r6 SSLv23_METHODr] r r( r" r^ rQ r$ ru rR IPv4Address IPv6Addressr r r r r r r# r r r r r r& r r <module>r s 8 $ '' u up 58 /SZ:>6E 6 6c 6# 66AFsCx 6 &x 76CI;;6r VZ!&\`4"e 4"huSXtCy=P7Q.R 4" 4" tE)*?*?AVAV*V$W XY4" 4"nAv{{FNN?Z9[ A*.s)A?E&++v~~2M,N ?SWX[S\ ?6RuV[[&..5P/Q RVZ[^V_ R( v{{FNN7R1S X\]`Xa > BF,0FJCG[_ ?V[[ ?8DI+> ? $SM? ??C? %T&*>*>%? @? d5)>)> @U@U)U#V WX ? [[ ?F *0)<)<8d4+>+>&?fkkAR&R S 8#&8AF8r