\\+=@sdZddlZddlZddlZddlZddlZddlZddlZddl m Z ddl m Z ddl mZddl mZddlmZddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlm Z ddlm!Z!ddlm"Z"ej#e$Z%dddZ&ddZ'ddZ(ddZ)ddZ*ddZ+dd Z,d!d"Z-d#d$Z.d%d&Z/d'd(Z0d)d*Z1ej2d+d,Z3ej2d-d.Z4ej2d/d0Z5d1d2Z6d3d4Z7ej2d5d6Z8ej2d7d8Z9d9d:Z:d;d<Z;d=d>Z<d?d@Z=dAdBZ>dS)CzCertbot client crypto utility functions. .. todo:: Make the transition to use PSS rather than PKCS1_v1_5 when the server is capable of handling the signatures. N)InvalidSignature)default_backend)ECDSA)EllipticCurvePublicKey)PKCS1v15) RSAPublicKey)x509)crypto)SSL) crypto_util)IO)compat)errors) interfaces)utilzkey-certbot.pemcCsyt|}Wn>tk rP}ztjddd|WYdd}~XnXtjjtj}t j |dt j |j t jtjj||dd\}}||j|WdQRXtjd||t j||S) aInitializes and saves a privkey. Inits key and saves it in PEM format on the filesystem. .. note:: keyname is the attempted filename, it may be different if a file already exists at the path. :param int key_size: RSA key size in bits :param str key_dir: Key save directory. :param str keyname: Filename of key :returns: Key :rtype: :class:`certbot.util.Key` :raises ValueError: If unable to generate the key given key_size. exc_infoTNiiwbzGenerating key (%d bits): %s)make_key ValueErrorloggererrorzope component getUtilityrIConfigrmake_or_verify_dirr os_geteuidstrict_permissions unique_fileospathjoinwritedebugZKey)Zkey_sizeZkey_dirZkeynameZkey_pemerrconfigZkey_fkey_pathr(5/usr/lib/python3/dist-packages/certbot/crypto_util.py init_save_key&s $r*c Cstjjtj}tj|j|d|j}t j |dt j |j t jtjj|ddd\}}||j|WdQRXtjd|t j||dS) a2Initialize a CSR with the given private key. :param privkey: Key to include in the CSR :type privkey: :class:`certbot.util.Key` :param set names: `str` names to include in the CSR :param str path: Certificate save directory. :returns: CSR :rtype: :class:`certbot.util.CSR` must_stapleizcsr-certbot.pemirNzCreating CSR: %spem)rrrrracme_crypto_utilZmake_csrr,r+rrr rrrr r!r"r#rr$CSR)privkeynamesr!r&Zcsr_pemZcsr_fZ csr_filenamer(r(r) init_save_csrKs $r1c Cs_y,tjtj|}|j|jSWn,tjk rZtjddddSYnXdS)zValidate CSR. Check if `csr` is a valid CSR for the given domains. :param str csr: CSR in PEM. :returns: Validity of CSR. :rtype: bool rrTFN)r load_certificate_request FILETYPE_PEMverifyZ get_pubkeyErrorrr$)csrreqr(r(r) valid_csros r8c Csntjtj|}tjtj|}y|j|SWn,tjk ritjddddSYnXdS)zDoes private key correspond to the subject public key in the CSR? :param str csr: CSR in PEM. :param str privkey: Private key file contents (PEM) :returns: Correspondence of private key to CSR subject public key. :rtype: bool rrTFN)r r2r3load_privatekeyr4r5rr$)r6r/r7Zpkeyr(r(r)csr_matches_pubkeys r:cCstj}tj}y|tj|}WnXtjk ry|||}Wn-tjk r}tjdj|YnXYnXt|}tj||}|t j d|d|dd|fS)a/Import a CSR file, which can be either PEM or DER. :param str csrfile: CSR filename :param str data: contents of the CSR file :returns: (`crypto.FILETYPE_PEM`, util.CSR object representing the CSR, list of domains requested in the CSR) :rtype: tuple zFailed to parse CSR file: {0}filedataZformr,) r r3r2 FILETYPE_ASN1r5rformat"_get_names_from_loaded_cert_or_reqZdump_certificate_requestrr.)Zcsrfiler<ZPEMloadr6ZdomainsZdata_pemr(r(r)import_csr_files  " rAcCsD|dksttj}|jtj|tjtj|S)zGenerate PEM encoded RSA key. :param int bits: Number of bits, at least 1024. :returns: new RSA key in PEM form with specified number of bits :rtype: str i)AssertionErrorr ZPKeyZ generate_keyZTYPE_RSAZdump_privatekeyr3)bitskeyr(r(r)rs  rc CsCytjtj|jSWnttjfk r>dSYnXdS)zIs valid RSA private key? :param str privkey: Private key file contents in PEM :returns: Validity of private key. :rtype: bool FN)r r9r3Zcheck TypeErrorr5)r/r(r(r) valid_privkeys rFcCs+t|t|t|j|jdS)aFor checking that your certs were not corrupted on disk. Several things are checked: 1. Signature verification for the cert. 2. That fullchain matches cert and chain when concatenated. 3. Check that the private key matches the certificate. :param `.storage.RenewableCert` renewable_cert: cert to verify :raises errors.Error: If verification fails. N)verify_renewable_cert_sigverify_fullchainverify_cert_matches_priv_keycertr/)renewable_certr(r(r)verify_renewable_certs  rLc CsyBt|jd"}tj|jt}WdQRXt|jd"}tj|jt}WdQRX|j}tj tj dt |t r|j |jt|j}|j|j|jnYt |tr+|j |jt|j}|j|j|jntjdWdQRXWn_tttfk r}z6dj|j|}tj|tj|WYdd}~XnXdS)z Verifies the signature of a `.storage.RenewableCert` object. :param `.storage.RenewableCert` renewable_cert: cert to verify :raises errors.Error: If signature verification fails. rbNignorezUnsupported public key typez[verifying the signature of the cert located at {0} has failed. Details: {1})openchainrZload_pem_x509_certificatereadrrJZ public_keywarningscatch_warnings simplefilter isinstancerverifierZ signaturerZsignature_hash_algorithmupdateZtbs_certificate_bytesr4rrrr5IOErrorrrr>r exception) rK chain_filerP cert_filerJZpkrVe error_strr(r(r)rGs.""      rGcCsy:tjtj}|j||j||jWn_ttjfk r}z6dj|||}t j |t j|WYdd}~XnXdS)z Verifies that the private key and cert match. :param str cert_path: path to a cert in PEM format :param str key_path: path to a private key file :raises errors.Error: If they don't match. zverifying the cert located at {0} matches the private key located at {1} has failed. Details: {2}N) r ZContextZ SSLv23_METHODZuse_certificate_fileZuse_privatekey_fileZcheck_privatekeyrXr5r>rrYr) cert_pathr'contextr\r]r(r(r)rI s     rIc Cs.yt|j}|j}WdQRXt|j}|j}WdQRXt|j}|j}WdQRX|||krd}|j|j}tj|Wn}t k r}z0dj|}t j |tj|WYdd}~Xn.tjk r)}z |WYdd}~XnXdS)z Verifies that fullchain is indeed cert concatenated with chain. :param `.storage.RenewableCert` renewable_cert: cert to verify :raises errors.Error: If cert and chain do not combine to fullchain. Nz.fullchain does not match cert + chain for {0}!z8reading one of cert, chain, or fullchain has failed: {0}) rOrPrQrJ fullchainr>Z lineagenamerr5rXrrY) rKrZrPr[rJZfullchain_filer`r]r\r(r(r)rHs" !rHcCsg}xltjtjfD]X}ytj|||fSWqtjk rp}z|j|WYdd}~XqXqWtjdjdjdd|DdS)z:Load PEM/DER certificate. :raises errors.Error: NzUnable to load: {0},css|]}t|VqdS)N)str).0rr(r(r) Hsz-pyopenssl_load_certificate..) r r3r=load_certificater5appendrr>r")r<Zopenssl_errorsZ file_typerr(r(r)pyopenssl_load_certificate9s$rgc CsCy|||SWn+tjk r>tjdddYnXdS)NrrT)r r5rr)cert_or_req_str load_functypr(r(r)_load_cert_or_reqKs rkcCstjt|||S)N)r-Z_pyopenssl_cert_or_req_sanrk)rhrirjr(r(r)_get_sans_from_cert_or_reqTs rlcCst|tj|S)zGet a list of Subject Alternative Names from a certificate. :param str cert: Certificate (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of Subject Alternative Names. :rtype: list )rlr re)rJrjr(r(r)get_sans_from_cert[s rmcCst|||}t|S)N)rkr?)Z cert_or_reqrirjloaded_cert_or_reqr(r(r)_get_names_from_cert_or_reqisrocCs tj|S)N)r-Z _pyopenssl_cert_or_req_all_names)rnr(r(r)r?nsr?cCst|tj|S)zGet a list of domains from a cert, including the CN if it is set. :param str cert: Certificate (encoded). :param typ: `crypto.FILETYPE_PEM` or `crypto.FILETYPE_ASN1` :returns: A list of domain names. :rtype: list )ror re)r6rjr(r(r)get_names_from_certss rpcCstj||S)zDump certificate chain into a bundle. :param list chain: List of `crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). )r-dump_pyopenssl_chain)rPZfiletyper(r(r)rqs rqcCst|tjjS)zWhen does the cert at cert_path start being valid? :param str cert_path: path to a cert in PEM format :returns: the notBefore value from the cert at cert_path :rtype: :class:`datetime.datetime` )_notAfterBeforer X509Z get_notBefore)r^r(r(r) notBefores rtcCst|tjjS)zWhen does the cert at cert_path stop being valid? :param str cert_path: path to a cert in PEM format :returns: the notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` )rrr rsZ get_notAfter)r^r(r(r)notAfters rucCst|"}tjtj|j}WdQRX||}|ddd|ddd|ddd|ddd |dd d |d dg }d j|}tjr|jd }t j |S) aPInternal helper function for finding notbefore/notafter. :param str cert_path: path to a cert in PEM format :param function method: one of ``crypto.X509.get_notBefore`` or ``crypto.X509.get_notAfter`` :returns: the notBefore or notAfter value from the cert at cert_path :rtype: :class:`datetime.datetime` Nr-T : ascii) rOr rer3rQr"sixZPY3decode pyrfc3339parse)r^methodfrZ timestampZreformatted_timestampZ timestamp_strr(r(r)rrs     # rrc CsKtj}t|d#}|j|jjdWdQRX|jS)aNCompute a sha256sum of a file. NB: In given file, platform specific newlines characters will be converted into their equivalent unicode counterparts before calculating the hash. :param str filename: path to the file whose hash will be computed :returns: sha256 digest of the file in hexadecimal :rtype: str rzUTF-8N)hashlibsha256rOrWrQencodeZ hexdigest)filenamerZfile_dr(r(r) sha256sums #rcCsPtjtjtjtj|j}|t|dj}||fS)zSplit fullchain_pem into cert_pem and chain_pem :param str fullchain_pem: concatenated cert + chain :returns: tuple of string cert_pem and chain_pem :rtype: tuple N)r Zdump_certificater3rerlenlstrip)Z fullchain_pemrJrPr(r(r)cert_and_chain_from_fullchains r)?__doc__rZloggingr rRrrZzope.componentrZcryptography.exceptionsrZcryptography.hazmat.backendsrZ,cryptography.hazmat.primitives.asymmetric.ecrrZ1cryptography.hazmat.primitives.asymmetric.paddingrZ-cryptography.hazmat.primitives.asymmetric.rsarZ cryptographyrZOpenSSLr r Zacmer r-Zacme.magic_typingr Zcertbotr rrrZ getLogger__name__rr*r1r8r:rArrFrLrGrIrHrgr3rkrlrmror?rprqrtrurrrrr(r(r(r)s^       % $       %