ó ¡\\c@s2dZddlZddlZddlZddlZddlZddlZddlmZddlm Z ddl Z ddl m Z ddlmZmZmZmZejeƒZe jZdefd„ƒYZd d edd „Zed„Zd„Zd„Zdde d„Z!ej"d„Z#dS(sCrypto utilities.iÿÿÿÿN(tcrypto(tSSL(terrors(tCallabletUniontTupletOptionalt SSLSocketcBsKeZdZed„Zd„Zd„Zdefd„ƒYZd„Z RS(sëSSL wrapper for sockets. :ivar socket sock: Original wrapped socket. :ivar dict certs: Mapping from domain names (`bytes`) to `OpenSSL.crypto.X509`. :ivar method: See `OpenSSL.SSL.Context` for allowed values. cCs||_||_||_dS(N(tsocktcertstmethod(tselfRR R ((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyt__init__+s  cCst|j|ƒS(N(tgetattrR(R tname((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyt __getattr__0scCs¥|jƒ}y|j|\}}Wn"tk rGtjd|ƒdSXtj|jƒ}|jtj ƒ|jtj ƒ|j |ƒ|j |ƒ|j |ƒdS(sSNI certificate callback. This method will set a new OpenSSL context object for this connection when an incoming connection provides an SNI name (in order to serve the appropriate certificate, if any). :param connection: The TLS connection object on which the SNI extension was received. :type connection: :class:`OpenSSL.Connection` s-Server name (%s) not recognized, dropping SSLN(tget_servernameR tKeyErrortloggertdebugRtContextR t set_optionst OP_NO_SSLv2t OP_NO_SSLv3tuse_privatekeytuse_certificatet set_context(R t connectiont server_nametkeytcertt new_context((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyt_pick_certificate_cb3s     tFakeConnectioncBs)eZdZd„Zd„Zd„ZRS(sFake OpenSSL.SSL.Connection.cCs ||_dS(N(t_wrapped(R R((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyR RscCst|j|ƒS(N(R R"(R R((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyRUscGs |jjƒS(N(R"tshutdown(R t unused_args((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyR#Xs(t__name__t __module__t__doc__R RR#(((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyR!Ms  cCsÌ|jjƒ\}}tj|jƒ}|jtjƒ|jtjƒ|j|j ƒ|j tj ||ƒƒ}|j ƒt jd|ƒy|jƒWn%tjk rÁ}tj|ƒ‚nX||fS(NsPerforming handshake with %s(RtacceptRRR RRRtset_tlsext_servername_callbackR R!t Connectiontset_accept_stateRRt do_handshaketErrortsocketterror(R Rtaddrtcontexttssl_sockR/((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyR(\s ( R%R&R't_DEFAULT_TLSSNI01_SSL_METHODR RR tobjectR!R((((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyR"s    i»i,tic Cs4tj|ƒ}|j|ƒi|d6}yXtjd|||r[dj|d|dƒndƒ||f}tj||} Wn%tjk r¨} t j | ƒ‚nXt j | ƒp} tj || ƒ} | jƒ| j|ƒy| jƒ| jƒWn%tj k r#} t j | ƒ‚nXWdQX| jƒS(sProbe SNI server for SSL certificate. :param bytes name: Byte string to send as the server name in the client hello message. :param bytes host: Host to connect to. :param int port: Port to connect to. :param int timeout: Timeout in seconds. :param method: See `OpenSSL.SSL.Context` for allowed values. :param tuple source_address: Enables multi-path probing (selection of source interface). See `socket.creation_connection` for more info. Available only in Python 2.7+. :raises acme.errors.Error: In case of any problems. :returns: SSL certificate presented by the server. :rtype: OpenSSL.crypto.X509 tsource_addresss!Attempting to connect to %s:%d%s.s from {0}:{1}iiR5N(RRt set_timeoutRRtformatR.tcreate_connectionR/RR-t contextlibtclosingR*tset_connect_statetset_tlsext_host_nameR,R#tget_peer_certificate( RthosttportttimeoutR R6R1t socket_kwargst socket_tupleRR/tclientt client_ssl((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyt probe_snirs*   '    cCsÐtjtj|ƒ}tjƒ}tjddtddjd„|Dƒƒjdƒƒg}|r†|jtjddtddƒƒn|j |ƒ|j |ƒ|j d ƒ|j |d ƒtj tj|ƒS( s©Generate a CSR containing a list of domains as subjectAltNames. :param buffer private_key_pem: Private key, in PEM PKCS#8 format. :param list domains: List of DNS names to include in subjectAltNames of CSR. :param bool must_staple: Whether to include the TLS Feature extension (aka OCSP Must Staple: https://tools.ietf.org/html/rfc7633). :returns: buffer PEM-encoded Certificate Signing Request. tsubjectAltNametcriticaltvalues, css|]}d|VqdS(sDNS:N((t.0td((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pys ´stasciis1.3.6.1.5.5.7.1.24sDER:30:03:02:01:05itsha256(Rtload_privatekeyt FILETYPE_PEMtX509Reqt X509ExtensiontFalsetjointencodetappendtadd_extensionst set_pubkeyt set_versiontsigntdump_certificate_request(tprivate_key_pemtdomainst must_staplet private_keytcsrt extensions((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pytmake_csr¤s$  (     cCsY|jƒj}t|ƒ}|dkr+|S|gg|D]}||kr8|^q8SdS(N(t get_subjecttCNt_pyopenssl_cert_or_req_santNone(tloaded_cert_or_reqt common_nametsansRK((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyt _pyopenssl_cert_or_req_all_namesÃs   c CsÇd}d}d|}t|tjƒr4tj}n tj}|tj|ƒjdƒ}tjd|ƒ}|dkr|gn|j dƒj |ƒ}g|D](}|j |ƒr›|j |ƒd^q›S(s¡Get Subject Alternative Names from certificate or CSR using pyOpenSSL. .. todo:: Implement directly in PyOpenSSL! .. note:: Although this is `acme` internal API, it is used by `letsencrypt`. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: A list of Subject Alternative Names. :rtype: `list` of `unicode` t:s, tDNSsutf-8s5X509v3 Subject Alternative Name:(?: critical)?\s*(.*)iN( t isinstanceRtX509tdump_certificateRZt FILETYPE_TEXTtdecodetretsearchRetgrouptsplitt startswith( t cert_or_reqtpart_separatortparts_separatortprefixtfuncttexttmatcht sans_partstpart((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyRdÌs   *iii<c Cs;|stdƒ‚tjƒ}|jttjtjdƒƒdƒƒ|j dƒtj dt dƒg}|d|j ƒ_ |j|j ƒƒ|s©t|ƒdkrá|jtj dd td d jd „|Dƒƒƒƒn|j|ƒ|j|dkrdn|ƒ|j|ƒ|j|ƒ|j|d ƒ|S(sžGenerate new self-signed certificate. :type domains: `list` of `unicode` :param OpenSSL.crypto.PKey key: :param bool force_san: If more than one domain is provided, all of the domains are put into ``subjectAltName`` X.509 extension and first domain is set as the subject CN. If only one domain is provided no ``subjectAltName`` extension is used, unless `force_san` is ``True``. s0Must provide one or more hostnames for the cert.iitbasicConstraintssCA:TRUE, pathlen:0iiRGRHRIs, css|]}d|jƒVqdS(sDNS:N(RT(RJRK((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pys sRMN(tAssertionErrorRRmtset_serial_numbertinttbinasciithexlifytosturandomRXRQtTrueRbRct set_issuertlenRURRRSRVtgmtime_adj_notBeforeRetgmtime_adj_notAfterRWRY(RR\t not_beforetvalidityt force_sanRR`((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyt gen_ss_cert÷s& (      cs,‡fd†‰dj‡fd†|DƒƒS(sØDump certificate chain into a bundle. :param list chain: List of `OpenSSL.crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). :returns: certificate chain bundle :rtype: bytes cs.t|tjƒr|j}ntjˆ|ƒS(N(RltjosetComparableX509twrappedRRn(R(tfiletype(s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyt _dump_cert0s R5c3s|]}ˆ|ƒVqdS(N((RJR(R”(s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pys 8s(RS(tchainR“((R”R“s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pytdump_pyopenssl_chain#s (R5ii¨i`'i€: ($R'RƒR:tloggingR…RqR.tOpenSSLRRtjosepyRtacmeRtacme.magic_typingRRRRt getLoggerR%Rt SSLv23_METHODR3R4RRFRRRaRiRdReR‡RROR–(((s4/usr/lib/python2.7/dist-packages/acme/crypto_util.pyts,       " P1  ++