⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.144
Server IP:
157.245.143.252
Server:
Linux www 6.11.0-9-generic #9-Ubuntu SMP PREEMPT_DYNAMIC Mon Oct 14 13:19:59 UTC 2024 x86_64
Server Software:
nginx/1.26.0
PHP Version:
8.3.11
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
certbot
/
__pycache__
/
View File Name :
ocsp.cpython-312.pyc
M/e: d Z ddlmZ ddlmZ ddlZddlZddlZddlmZ ddlmZ ddlm Z ddl m Z dd l m Z dd l mZ dd lmZ dd lmZ dd lmZ ddlmZ ddlZddlZddlmZ ddlmZ ddlmZ ddl m Z ddl m Z ej@ e! Z" G d d Z#de$de ee$ ee$ f fdZ%de$de$de$de&de'f d Z(d d d d d!e jR de$ddf d"Z*d d d!e jR de$ddfd#Z+de$d$e$d%e$de'fd&Z,y)'z*Tools for checking certificate revocation. )datetime) timedeltaN)PIPE)Optional)Tuple)x509)InvalidSignature)UnsupportedAlgorithm)default_backend)hashes) serialization)ocsp) crypto_util)errors)util)getenv) RenewableCertc l e Zd ZdZddeddfdZdedefdZdded ed e defd Z ded ed ed ed e def dZ y)RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it. enforce_openssl_binary_usagereturnNc J d| _ || _ | j rt j d s t j d d| _ y t j g dt t ddt j }d|j v r d | _ y d | _ y y ) NFopensslz-openssl not installed, can't check revocationT)r r -headervarval)stdoutstderruniversal_newlinescheckenvz Missing =c d| z gS )NzHost= hosts ./usr/lib/python3/dist-packages/certbot/ocsp.py<lambda>z,RevocationChecker.__init__.<locals>.<lambda>0 s w~.> c d| gS )NHostr# r$ s r& r' z,RevocationChecker.__init__.<locals>.<lambda>2 s vtnr( ) brokenuse_openssl_binaryr exe_existsloggerinfo subprocessrunr env_no_snap_for_external_callsr host_args)selfr test_host_formats r& __init__zRevocationChecker.__init__! s "> " "??9- KL " *~~.Z,0RV+0d6Y6Y6[ ] . 5 55!>!< #r( certc N | j |j |j S )a Get revoked status for a particular cert version. .. todo:: Make this a non-blocking call :param `.interfaces.RenewableCert` cert: Certificate object :returns: True if revoked; False if valid or the check failed or cert is expired. :rtype: bool )ocsp_revoked_by_paths cert_path chain_path)r4 r7 s r& ocsp_revokedz RevocationChecker.ocsp_revoked4 s ))$..$//JJr( r: r; timeoutc | j ryt j t j }t j | |k ryt | \ }}|r|sy| j r| j ||||| S t |||| S )aE Performs the OCSP revocation check :param str cert_path: Certificate filepath :param str chain_path: Certificate chain :param int timeout: Timeout (in seconds) for the OCSP query :returns: True if revoked; False if valid or the check failed or cert is expired. :rtype: bool F) r+ r nowpytzUTCr notAfter_determine_ocsp_serverr, _check_ocsp_openssl_bin_check_ocsp_cryptography)r4 r: r; r= r? urlr% s r& r9 z'RevocationChecker.ocsp_revoked_by_paths@ s ;; ll488$ *c 1*95 T3 " "// :tSRYZ Z' :sGLLr( r% rF c : t d }t d }d }||||n|}|d|g} n%|j d r|t d d }d|d|g} ddd d |d |d |d |ddt | dg| j | z | z } t j d| t j dj | t j | t j \ } } t || | S # t j $ r t j d| Y yw xY w)N http_proxy HTTP_PROXYz-urlzhttp://z-hostz-pathr r z -no_noncez-issuerz-certz-CAfilez -verify_otherz -trust_otherz-timeoutr zQuerying OCSP for %s )log*OCSP check failed for %s (are we offline?)F)r startswithlenstrr3 r. debugjoinr run_scriptr SubprocessErrorr/ _translate_ocsp_query) r4 r: r; r% rF r= env_http_proxyenv_HTTP_PROXY proxy_hosturl_optscmdoutputerrs r& rD z)RevocationChecker._check_ocsp_openssl_bin] s: - - % )C+9+E >J }H$$Y/ 'I 8 Wc:H&* * 3w< !NN4 01 4<< +Y7 SXXc]# //#6<<@KFC %Y<< %% KKDi P s 9(C. .)DD)F) ) __name__ __module__ __qualname____doc__boolr6 r r< rO intr9 rD r# r( r& r r s O=T =d =& K K4 KMs M Mc M[_ M:#= #=# #=&)#=03#=>A#=FJ#=r( r r: r c t | d 5 }t j |j t }ddd j j t j }t j j }|j D cg c] }|j |k( r| }}|d j j }|j# }|j% d d j# d }|r||fS t j! d || y# 1 sw Y xY wc c}w # t j t f$ r t j! d| Y yw xY w) zExtract the OCSP server host from a certificate. :param str cert_path: Path to the cert we're checking OCSP for :rtype tuple: :returns: (OCSP server URL or None, OCSP server host or None) rbNr z Cannot extract OCSP URI from %s)NNz:// /z;Cannot process OCSP host from URL (%s) in certificate at %s)openr load_pem_x509_certificatereadr extensionsget_extension_for_classAuthorityInformationAccess AuthorityInformationAccessOIDOCSPvalue access_methodaccess_locationExtensionNotFound IndexErrorr. r/ rstrip partition) r: file_handlerr7 extensionocsp_oid description descriptionsrF r% s r& rC rC s2 i ,--l.?.?.A?CTU OO;;D<[<[\ 55::7@ B &44@ $ B 1o--33 **,C == " ) )# .D Dy KKMsT]^ ' B " "J / 5yAs0 -DAD) D$,D) D!$D) )/EEr; rF r= c ( t |d 5 }t j |j t }d d d t | d 5 }t j |j t }d d d t j }|j t j }|j }|j t j j } t j || ddi| } | j* d k7 r"t& j) d | | j* yt j, | j. } | j0 t j2 j4 k7 r"t& j7 d | | j0 y t9 | ||| t& j; d | | j< | j< t j> j@ k( S # 1 sw Y xY w# 1 sw Y xY w# t j" j$ $ r t& j) d| d Y yw xY w# tB $ r(} t& j7 tE | Y d } ~ yd } ~ wtF jH $ r(} t& j7 tE | Y d } ~ yd } ~ wtJ $ r t& j7 d | Y ytL $ r*} t& j7 d| tE | Y d } ~ yd } ~ ww xY w)Nrd z Content-Typezapplication/ocsp-request)dataheadersr= rL T)exc_infoF z*OCSP check failed for %s (HTTP status: %d)z'Invalid OCSP response status for %s: %sz%OCSP certificate status for %s is: %sz)Invalid signature on OCSP response for %sz!Invalid OCSP response for %s: %s.)'rg r rh ri r r OCSPRequestBuilderadd_certificater SHA1build public_bytesr EncodingDERrequestspost exceptionsRequestExceptionr. r/ status_codeload_der_ocsp_responsecontentresponse_statusOCSPResponseStatus SUCCESSFULwarning_check_ocsp_responserP certificate_statusOCSPCertStatusREVOKEDr rO r Errorr AssertionError)r: r; rF r= rv issuerr7 builderrequestrequest_binaryresponse response_ocspeerrors r& rE rE sv j$ <// 0A0A0C_EVW i ,--l.?.?.A?CTU %%'G%%dFFKKMBGmmoG ))-*@*@*D*DEN==>*8:T)U)02 s" @)XMaMab//0@0@AM $$(?(?(J(JJ@ = = ?O ]GVYG < @ @ B //43F3F3N3NNNU / / @)VZ [$ s1v << s1v OBIN S:Is5zRR Ss_ -H-H6H +I H H5II L JL J;;"L L' L Lr zocsp.OCSPResponse request_ocspzocsp.OCSPRequest issuer_certc | | j |j k7 r t d t | || t | j t |j r2| j |j k7 s| j |j k7 r t d t j t j j d }| j s t d | j |t d z kD r t d | j r(| j |t d z k r t d yy) z2Verify that the OCSP is valid for several criteriazMthe certificate in response does not correspond to the certificate in requestz<the issuer does not correspond to issuer of the certificate.N)tzinfoz param thisUpdate is not set. )minutesz"param thisUpdate is in the future.z param nextUpdate is in the past.) serial_numberr _check_ocsp_response_signature isinstancehash_algorithmtypeissuer_key_hashissuer_name_hashr r? r@ rA replace this_updater next_update)r r r r: r? s r& r r s ""l&@&@@ = > > #=+yI }33T,:U:U5V W ,, 0L0LL -- 1N1NN [\\ ,,txx ( ( ( 5C $ $ ;<< 31)=#== ABB ]%>%>yYZG[A[%[ ?@@ &\ r( c B dt j dt fd}| j |j k( s| j || k( rt j d| |}nDt j d| | j D cg c]2 }| j |j k( s| j || k( r|4 }}|s t d |d }|j |j k7 r t d |j j t j }t j j j |j" v }|s t d |j( } | sJ t+ j, |j/ |j0 |j2 | | j( } | s t d t+ j, |j/ | j0 | j4 | y c c}w # t j$ t& f$ r d }Y w xY w) zIVerify an OCSP response signature against certificate issuer or responderr7 r c p t j j | j j S )N)r SubjectKeyIdentifierfrom_public_key public_keydigest)r7 s r& _key_hashz1_check_ocsp_response_signature.<locals>._key_hash s& ((88 9JKRRRr( zGOCSP response for certificate %s is signed by the certificate's issuer.zGOCSP response for certificate %s is delegated to an external responder.z0no matching responder certificate could be foundr z?responder certificate is not signed by the certificate's issuerFz<responder is not authorized by issuer to sign OCSP responsesz#no signature hash algorithm definedN)r Certificatebytesresponder_namesubjectresponder_key_hashr. rP certificatesr r rj rk ExtendedKeyUsageoidExtendedKeyUsageOID OCSP_SIGNINGro rr rs signature_hash_algorithmr verify_signed_payloadr signaturetbs_certificate_bytestbs_response_bytes) r r r: r responder_certr7 responder_certsrw delegate_authorizedchosen_cert_hashchosen_response_hashs r& r r s S(( SU S $$ (;(;; //9[3II _ $ ^ -:,F,F S,FD + : :dll J + > >)D/ Q ,F S !ST T )+ K$7$7 7 "@ A A (&11II$J_J_`I"&((">">"K"Ky"^ # !_` ` *BB ))+*@*@*BND\D\*8*N*NP` b )AA BCC%%n&?&?&A=CZCZ&3&F&FH\^KS$ && 3 ("' (s 7G;7AH H H ocsp_output ocsp_errorsc d}|D cg c] }dj | | }}fd|D \ }}}|r|j d nd} d|vs|r| s|r.t j d| t j d| y |r| sy |r*|j d } | rt j d | y t j d | y c c}w ) z7Parse openssl's weird output to work out what it means.)goodrevokedunknownz{0}: (WARNING.*)?{1}c 3 j K | ]* }t j |t j , yw))flagsN)researchDOTALL).0pr s r& <genexpr>z(_translate_ocsp_query.<locals>.<genexpr>5 s( [RZQbii;bii H HRZs 03 NzResponse verify OKz#Revocation status for %s is unknownz Uncertain output: %s stderr: %sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s stderr:%s)formatgroupr. r/ rP r ) r: r r statesspatternsr r r r s ` r& rT rT 0 s ,FFLMf'..y!<fHM [RZ [D'7 #djjmG K/Tg' 99E 9; T g --" KK5w ?L"K 1' Ns C)-r` r r loggingr r0 r typingr r cryptographyr cryptography.exceptionsr r cryptography.hazmat.backendsr cryptography.hazmat.primitivesr r cryptography.x509r r@ r certbotr r r certbot.compat.osr certbot.interfacesr getLoggerr] r. r rO rC rb ra rE r r r rT r# r( r& <module>r sF 0 4 8 8 1 8 " $ , 8 $b= b=Jc eHSM8C=4P.Q <. . .3 .QT .Y] .b!A(; !AK] !A&*&6&6!ACF!AKO!AH7^2E 7^040@0@7^MP7^UY7^tS s QU r(