ó Y[c@sFdZddlZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZddl mZddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlm Z ddlm!Z!ej"e#ƒZ$dd„Z%d„Z&d„Z'd„Z(d„Z)d„Z*d„Z+d„Z,d„Z-d„Z.d„Z/d„Z0ej1d„Z2ej1d„Z3ej1d „Z4d!„Z5d"„Z6ej1d#„Z7ej1d$„Z8d%„Z9d&„Z:d'„Z;d(„Z<d)„Z=dS(*s¦Certbot client crypto utility functions. .. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server is capable of handling the signatures. iÿÿÿÿN(tInvalidSignature(tdefault_backend(tECDSA(tEllipticCurvePublicKey(tPKCS1v15(t RSAPublicKey(tx509(tcrypto(tSSL(t crypto_util(tIO(terrors(t interfaces(tutilskey-certbot.pemcCsÚyt|ƒ}Wn,tk r>}tjddtƒ|‚nXtjjtj ƒ}t j |dt j ƒ|jƒt jt jj||ƒddƒ\}}||j|ƒWdQXtjd||ƒt j||ƒS(sÚInitializes and saves a privkey. Inits key and saves it in PEM format on the filesystem. .. note:: keyname is the attempted filename, it may be different if a file already exists at the path. :param int key_size: RSA key size in bits :param str key_dir: Key save directory. :param str keyname: Filename of key :returns: Key :rtype: :class:`certbot.util.Key` :raises ValueError: If unable to generate the key given key_size. ttexc_infoiÀi€twbNsGenerating key (%d bits): %s(tmake_keyt ValueErrortloggerterrortTruetzopet componentt getUtilityR tIConfigR tmake_or_verify_dirtostgeteuidtstrict_permissionst unique_filetpathtjointwritetdebugtKey(tkey_sizetkey_dirtkeynametkey_pemterrtconfigtkey_ftkey_path((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt init_save_key%s  $cCs¹tjjtjƒ}tj|j|d|jƒ}t j |dt j ƒ|j ƒt jt jj|dƒddƒ\}}||j|ƒWdQXtjd|ƒt j||dƒS( s2Initialize a CSR with the given private key. :param privkey: Key to include in the CSR :type privkey: :class:`certbot.util.Key` :param set names: `str` names to include in the CSR :param str path: Certificate save directory. :returns: CSR :rtype: :class:`certbot.util.CSR` t must_stapleiíscsr-certbot.pemi¤RNsCreating CSR: %stpem(RRRR Rtacme_crypto_utiltmake_csrR.R-R RRRRRRR R!RR"tCSR(tprivkeytnamesRR)tcsr_pemtcsr_ft csr_filename((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt init_save_csrJs $cCs[y,tjtj|ƒ}|j|jƒƒSWn(tjk rVtjddtƒt SXdS(sŸValidate CSR. Check if `csr` is a valid CSR for the given domains. :param str csr: CSR in PEM. :returns: Validity of CSR. :rtype: bool RRN( Rtload_certificate_requestt FILETYPE_PEMtverifyt get_pubkeytErrorRR"RtFalse(tcsrtreq((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt valid_csrns cCsjtjtj|ƒ}tjtj|ƒ}y|j|ƒSWn(tjk retjddtƒt SXdS(sùDoes private key correspond to the subject public key in the CSR? :param str csr: CSR in PEM. :param str privkey: Private key file contents (PEM) :returns: Correspondence of private key to CSR subject public key. :rtype: bool RRN( RR8R9tload_privatekeyR:R<RR"RR=(R>R2R?tpkey((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pytcsr_matches_pubkey‚s cCsÄtj}tj}y|tj|ƒ}WnVtjk r€y|||ƒ}Wqtjk r|tjdj|ƒƒ‚qXnXt|ƒ}tj||ƒ}|t j d|d|ddƒ|fS(s/Import a CSR file, which can be either PEM or DER. :param str csrfile: CSR filename :param str data: contents of the CSR file :returns: (`crypto.FILETYPE_PEM`, util.CSR object representing the CSR, list of domains requested in the CSR) :rtype: tuple sFailed to parse CSR file: {0}tfiletdatatformR.( RR9R8t FILETYPE_ASN1R<R tformatt"_get_names_from_loaded_cert_or_reqtdump_certificate_requestR R1(tcsrfileREtPEMtloadR>tdomainstdata_pem((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pytimport_csr_file–s    cCsD|dkst‚tjƒ}|jtj|ƒtjtj|ƒS(s­Generate PEM encoded RSA key. :param int bits: Number of bits, at least 1024. :returns: new RSA key in PEM form with specified number of bits :rtype: str i(tAssertionErrorRtPKeyt generate_keytTYPE_RSAtdump_privatekeyR9(tbitstkey((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyR³s  cCs?ytjtj|ƒjƒSWnttjfk r:tSXdS(s’Is valid RSA private key? :param str privkey: Private key file contents in PEM :returns: Validity of private key. :rtype: bool N(RRAR9tcheckt TypeErrorR<R=(R2((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt valid_privkeyÂs cCs+t|ƒt|ƒt|j|jƒdS(s‡For checking that your certs were not corrupted on disk. Several things are checked: 1. Signature verification for the cert. 2. That fullchain matches cert and chain when concatenated. 3. Check that the private key matches the certificate. :param `.storage.RenewableCert` renewable_cert: cert to verify :raises errors.Error: If verification fails. N(tverify_renewable_cert_sigtverify_fullchaintverify_cert_matches_priv_keytcertR2(trenewable_cert((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pytverify_renewable_certÒs  c Cs“y?t|jdƒ"}tj|jƒtƒƒ}WdQXt|jdƒ"}tj|jƒtƒƒ}WdQX|jƒ}tj ƒµtj dƒt |t ƒrß|j |jtƒ|jƒ}|j|jƒ|jƒnYt |tƒr)|j |jt|jƒƒ}|j|jƒ|jƒntjdƒ‚WdQXWnMtttfk rŽ}dj|j|ƒ}tj|ƒtj|ƒ‚nXdS(s Verifies the signature of a `.storage.RenewableCert` object. :param `.storage.RenewableCert` renewable_cert: cert to verify :raises errors.Error: If signature verification fails. trbNtignoresUnsupported public key types[verifying the signature of the cert located at {0} has failed. Details: {1}(topentchainRtload_pem_x509_certificatetreadRR^t public_keytwarningstcatch_warningst simplefiltert isinstanceRtverifiert signatureRtsignature_hash_algorithmtupdatettbs_certificate_bytesR:RRR R<tIOErrorRRRHRt exception( R_t chain_fileRdt cert_fileR^tpkRltet error_str((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyR[ãs.!!      cCsŽy:tjtjƒ}|j|ƒ|j|ƒ|jƒWnMttjfk r‰}dj|||ƒ}t j |ƒt j|ƒ‚nXdS(sÏ Verifies that the private key and cert match. :param str cert_path: path to a cert in PEM format :param str key_path: path to a private key file :raises errors.Error: If they don't match. sverifying the cert located at {0} matches the private key located at {1} has failed. Details: {2}N( RtContextt SSLv23_METHODtuse_certificate_filetuse_privatekey_filetcheck_privatekeyRqR<RHRRrR (t cert_pathR+tcontextRvRw((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyR]s     c Cs yªt|jƒ}|jƒ}WdQXt|jƒ}|jƒ}WdQXt|jƒ}|jƒ}WdQX|||kr©d}|j|jƒ}tj|ƒ‚nWnYt k rê}dj|ƒ}t j |ƒtj|ƒ‚ntjk r}|‚nXdS(sÓ Verifies that fullchain is indeed cert concatenated with chain. :param `.storage.RenewableCert` renewable_cert: cert to verify :raises errors.Error: If cert and chain do not combine to fullchain. Ns.fullchain does not match cert + chain for {0}!s8reading one of cert, chain, or fullchain has failed: {0}( RcRdRfR^t fullchainRHt lineagenameR R<RqRRr( R_RsRdRtR^tfullchain_fileRRwRv((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyR\s" cCs’g}xZtjtjfD]F}ytj||ƒ|fSWqtjk r^}|j|ƒqXqWtjdjdjd„|Dƒƒƒƒ‚dS(s:Load PEM/DER certificate. :raises errors.Error: sUnable to load: {0}t,css|]}t|ƒVqdS(N(tstr(t.0R((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pys GsN( RR9RGtload_certificateR<tappendR RHR (REtopenssl_errorst file_typeR((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pytpyopenssl_load_certificate8scCsBy|||ƒSWn*tjk r=tjddtƒ‚nXdS(NRR(RR<RRR(tcert_or_req_strt load_functtyp((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt_load_cert_or_reqJs cCstjt|||ƒƒS(N(R/t_pyopenssl_cert_or_req_sanR(RŠR‹RŒ((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt_get_sans_from_cert_or_reqSs cCst|tj|ƒS(sóGet a list of Subject Alternative Names from a certificate. :param str cert: Certificate (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of Subject Alternative Names. :rtype: list (RRR…(R^RŒ((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pytget_sans_from_certZs cCst|||ƒ}t|ƒS(N(RRI(t cert_or_reqR‹RŒtloaded_cert_or_req((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt_get_names_from_cert_or_reqhscCs tj|ƒS(N(R/t _pyopenssl_cert_or_req_all_names(R’((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyRImscCst|tj|ƒS(sìGet a list of domains from a cert, including the CN if it is set. :param str cert: Certificate (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of domain names. :rtype: list (R“RR…(R>RŒ((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pytget_names_from_certrs cCstj||ƒS(s–Dump certificate chain into a bundle. :param list chain: List of `crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). (R/tdump_pyopenssl_chain(Rdtfiletype((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyR–€s cCst|tjjƒS(sÕWhen does the cert at cert_path start being valid? :param str cert_path: path to a cert in PEM format :returns: the notBefore value from the cert at cert_path :rtype: :class:`datetime.datetime` (t_notAfterBeforeRtX509t get_notBefore(R}((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt notBeforeŒs cCst|tjjƒS(sÓWhen does the cert at cert_path stop being valid? :param str cert_path: path to a cert in PEM format :returns: the notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` (R˜RR™t get_notAfter(R}((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pytnotAfter˜s c CsÁt|ƒ"}tjtj|jƒƒ}WdQX||ƒ}|dd!d|dd!d|dd!d|dd!d |dd !d |d g }d j|ƒ}tjr´|jd ƒ}nt j |ƒS( sPInternal helper function for finding notbefore/notafter. :param str cert_path: path to a cert in PEM format :param function method: one of ``crypto.X509.get_notBefore`` or ``crypto.X509.get_notAfter`` :returns: the notBefore or notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` Niit-iitTi t:i Rtascii( RcRR…R9RfR tsixtPY3tdecodet pyrfc3339tparse(R}tmethodtfRt timestamptreformatted_timestampt timestamp_str((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyR˜¤s    cCsAtjƒ}t|dƒ}|j|jƒƒWdQX|jƒS(s²Compute a sha256sum of a file. :param str filename: path to the file whose hash will be computed :returns: sha256 digest of the file in hexadecimal :rtype: str RaN(thashlibtsha256RcRoRft hexdigest(tfilenameR­R¨((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyt sha256sumÀs cCsJtjtjtjtj|ƒƒjƒ}|t|ƒjƒ}||fS(s¶Split fullchain_pem into cert_pem and chain_pem :param str fullchain_pem: concatenated cert + chain :returns: tuple of string cert_pem and chain_pem :rtype: tuple (Rtdump_certificateR9R…R¤tlentlstrip(t fullchain_pemR^Rd((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pytcert_and_chain_from_fullchainÍs (>t__doc__R¬tloggingRRhR¥R¢tzope.componentRtcryptography.exceptionsRtcryptography.hazmat.backendsRt,cryptography.hazmat.primitives.asymmetric.ecRRt1cryptography.hazmat.primitives.asymmetric.paddingRt-cryptography.hazmat.primitives.asymmetric.rsaRt cryptographyRtOpenSSLRRtacmeR R/tacme.magic_typingR tcertbotR R R t getLoggert__name__RR,R7R@RCRPRRZR`R[R]R\R‰R9RRRR“RIR•R–R›RR˜R°Rµ(((s7/usr/lib/python2.7/dist-packages/certbot/crypto_util.pyts\        % $       %