\\c@sdZddlZddlZddlmZmZddlmZddlmZej e Z Gddde Z dd ZdS) z*Tools for checking certificate revocation.N)PopenPIPE)errors)utilc@s:eZdZdZddZddZddZdS) RevocationCheckerzEThis class figures out OCSP checking on this system, and performs it.cCsd|_tjds2tjdd|_dStdddddgd td td d}|j\}}d |krd d|_ndd|_dS)NFopensslz-openssl not installed, can't check revocationTocspz-headervarvalstdoutstderrZuniversal_newlinesz Missing =cSs d|gS)NzHost=)hostr r ./usr/lib/python3/dist-packages/certbot/ocsp.pysz,RevocationChecker.__init__..cSs d|gS)NZHostr )rr r rrs) brokenrZ exe_existsloggerinforrZ communicate host_args)selfZtest_host_formatZ_outerrr r r__init__s    zRevocationChecker.__init__cCs|jr dS|j|\}}|s,dSdddd|d|d|d|d |d d g|j|}tjd |tjd j|y"tj|dtj\}}Wn)tj k rtj d|dSYnXt |||S)a;Get revoked status for a particular cert version. .. todo:: Make this a non-blocking call :param str cert_path: Path to certificate :param str chain_path: Path to intermediate cert :rtype bool or None: :returns: True if revoked; False if valid or the check failed Frrz -no_noncez-issuerz-certz-urlz-CAfilez -verify_otherz -trust_otherz-headerzQuerying OCSP for %s logz*OCSP check failed for %s (are we offline?)) rdetermine_ocsp_serverrrdebugjoinr run_scriptrSubprocessErrorr_translate_ocsp_query)r cert_pathZ chain_pathurlrcmdoutputrr r r ocsp_revoked!s, " zRevocationChecker.ocsp_revokedc Csy4tjddd|ddgdtj\}}Wn)tjk r_tjd|d SYnX|j}|jd d jd }|r||fStjd ||dSdS)zExtract the OCSP server host from a certificate. :param str cert_path: Path to the cert we're checking OCSP for :rtype tuple: :returns: (OCSP server URL or None, OCSP server host or None) rZx509z-inz-nooutz -ocsp_urirzCannot extract OCSP URI from %sNz:///z4Cannot process OCSP host from URL (%s) in cert at %s)NN)NN) rrrrrrrrstrip partition)rr r!Z_errrr r rrHs   z'RevocationChecker.determine_ocsp_serverN)__name__ __module__ __qualname____doc__rr$rr r r rr s   'rc sd}fdd|D}fdd|D\}}}|rV|jdnd }d |ksz|rt|sz|rtjd tjd |d S|r| rd S|r|jd}|rtjd|dStjd|d Sd S)z7Parse openssl's weird output to work out what it means.goodrevokedunknowncs"g|]}dj|qS)z{0}: (WARNING.*)?{1})format).0s)r r r ds z)_translate_ocsp_query..c3s*|] }tj|dtjVqdS)flagsN)researchDOTALL)r1p) ocsp_outputr r esz(_translate_ocsp_query..NzResponse verify OKz#Revocation status for %s is unknownzUncertain output: %s stderr: %sFzOCSP revocation warning: %sTz2Unable to properly parse OCSP output: %s stderr:%s)zgoodzrevokedzunknown)grouprrrwarning) r r9Z ocsp_errorsZstatesZpatternsr-r.r/r=r )r r9rr`s$"   r)r,Zloggingr5 subprocessrrZcertbotrrZ getLoggerr)robjectrrr r r rs  T