| Server IP : 3.96.16.70 / Your IP : 216.73.216.15 Web Server : Apache System : Linux ip-172-31-26-103.ca-central-1.compute.internal 6.1.163-186.299.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Feb 24 16:35:42 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.18 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /lib/python3.9/site-packages/acme/__pycache__/ |
Upload File : |
a
�]e�F � @ sv d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddlm
Z
ddlm Z ddlm Z ddlm
Z
ddlmZ dd lmZ dd
lmZ dd lmZ ddlZdd lmZ dd
lmZ ddlmZ e�e�Zej Z G dd� d�Z G dd� d�Z dde ddfe e e!e!e!ee"e!f e
ee ej#d�dd�Z$d/e e
eee" e e" f e%e
e eej&ej'f e d�dd �Z(eej#ej)f e e" d �d d �Z*eej#ej)f e e" d �d!d"�Z+eej#ej)f e e" d �d#d$�Z,eej#ej)f e e" d �d%d&�Z-d0ej.e
e e" e
e! e!e%e
e ej/ e
e eej&ej'f ej#d)�d*d+�Z0ej1fee ej2 e ej# f e!e d,�d-d.�Z3dS )1zCrypto utilities.� N)�Any)�Callable)�List)�Mapping)�Optional)�Sequence)�Set)�Tuple)�Union)�crypto)�SSL)�errorsc @ sP e Zd Zeeeejejf f d�dd�Z e
j e eejejf d�dd�Z
dS )�_DefaultCertSelection��certsc C s
|| _ d S �Nr )�selfr � r �4/usr/lib/python3.9/site-packages/acme/crypto_util.py�__init__& s z _DefaultCertSelection.__init__��
connection�returnc C s |� � }|r| j�|d �S d S r )�get_servernamer �get)r r Z server_namer r r �__call__) s z _DefaultCertSelection.__call__N)�__name__�
__module__� __qualname__r �bytesr r �PKey�X509r r �
Connectionr r r r r r r % s "r c @ s� e Zd ZdZdeddfejeeee e
j e
j f f e
eeejee gef eeejgee e
j e
j f f dd�dd�Zeed�dd�Zejdd �d
d �ZG d d
� d
�Ze eef d�dd�ZdS )� SSLSocketa� SSL wrapper for sockets.
:ivar socket sock: Original wrapped socket.
:ivar dict certs: Mapping from domain names (`bytes`) to
`OpenSSL.crypto.X509`.
:ivar method: See `OpenSSL.SSL.Context` for allowed values.
:ivar alpn_selection: Hook to select negotiated ALPN protocol for
connection.
:ivar cert_selection: Hook to select certificate for connection. If given,
`certs` parameter would be ignored, and therefore must be empty.
N)�sockr �method�alpn_selection�cert_selectionr c C sX || _ || _|| _|s"|s"td��|r2|r2td��|}|d u rNt|rH|ni �}|| _d S )Nz*Neither cert_selection or certs specified.z(Both cert_selection and certs specified.)r$ r& r% �
ValueErrorr r' )r r$ r r% r& r' Zactual_cert_selectionr r r r = s �zSSLSocket.__init__��namer c C s t | j|�S r )�getattrr$ �r r* r r r � __getattr__T s zSSLSocket.__getattr__r c C s� | � |�}|du r&t�d|�� � dS |\}}t�| j�}|�tj� |�tj � |�
|� |� |� | j dur||�
| j � |�|� dS )a� SNI certificate callback.
This method will set a new OpenSSL context object for this
connection when an incoming connection provides an SNI name
(in order to serve the appropriate certificate, if any).
:param connection: The TLS connection object on which the SNI
extension was received.
:type connection: :class:`OpenSSL.Connection`
Nz=Certificate selection for server name %s failed, dropping SSL)r' �logger�debugr r �Contextr% � set_options� OP_NO_SSLv2� OP_NO_SSLv3Zuse_privatekeyZuse_certificater& �set_alpn_select_callbackZ set_context)r r Zpair�key�certZ new_contextr r r �_pick_certificate_cbW s
�
z SSLSocket._pick_certificate_cbc @ sB e Zd ZdZejdd�dd�Zeed�dd�Z ee
d �d
d �Z dS ) zSSLSocket.FakeConnectionz Fake OpenSSL.SSL.Connection.Nr c C s
|| _ d S r )�_wrapped)r r r r r r w s z!SSLSocket.FakeConnection.__init__r) c C s t | j|�S r )r+ r8 r, r r r r- z s z$SSLSocket.FakeConnection.__getattr__)� unused_argsr c
G sB z | j �� W S tjy< } zt�|��W Y d }~n
d }~0 0 d S r )r8 �shutdownr �Error�socket�error)r r9 r= r r r r: } s z!SSLSocket.FakeConnection.shutdown) r r r �__doc__r r" r �strr r- �boolr: r r r r �FakeConnectionr s rA )r c
C s� | j �� \}}z�t�| j�}|�tj� |�tj� |�| j � | j
d urV|� | j
� | � t�
||��}|�� t�d|� z |�� W n0 tjy� } zt�|��W Y d }~n
d }~0 0 ||fW S |�� � Y n0 d S )Nz Performing handshake with %s)r$ �acceptr r0 r% r1 r2 r3 Z set_tlsext_servername_callbackr7 r& r4 rA r" Zset_accept_stater. r/ � do_handshaker; r< r= �close)r r$ Zaddr�contextZssl_sockr= r r r rB � s&
zSSLSocket.accept)r r r r> �_DEFAULT_SSL_METHODr< r r r r r r r! �intr r r" r r r? r r- r7 rA rB r r r r r# 0 s(
�
��� r# i� i, )� r )r* �host�port�timeoutr% �source_address�alpn_protocolsr c C sR t �|�}|�|� d|i}zJt�d||t|�rDd�|d |d �nd� ||f} tj| fi |��}
W n0 tj y� } zt
� | ��W Y d} ~ n
d} ~ 0 0 t �
|
���} t �|| �}
|
�� |
�| � |dur�|
�|� z|
�� |
�� W n2 t j �y } zt
� | ��W Y d} ~ n
d} ~ 0 0 W d � n1 �s20 Y |
�� }|�sNJ �|S )a Probe SNI server for SSL certificate.
:param bytes name: Byte string to send as the server name in the
client hello message.
:param bytes host: Host to connect to.
:param int port: Port to connect to.
:param int timeout: Timeout in seconds.
:param method: See `OpenSSL.SSL.Context` for allowed values.
:param tuple source_address: Enables multi-path probing (selection
of source interface). See `socket.creation_connection` for more
info. Available only in Python 2.7+.
:param alpn_protocols: Protocols to request using ALPN.
:type alpn_protocols: `Sequence` of `bytes`
:raises acme.errors.Error: In case of any problems.
:returns: SSL certificate presented by the server.
:rtype: OpenSSL.crypto.X509
rL z!Attempting to connect to %s:%d%s.z
from {0}:{1}r � rH N)r r0 Z set_timeoutr. r/ �any�formatr< Zcreate_connectionr= r
r; �
contextlib�closingr" Zset_connect_stateZset_tlsext_host_nameZset_alpn_protosrC r: Zget_peer_certificate)r* rI rJ rK r% rL rM rE Z
socket_kwargsZ socket_tupler$ r= ZclientZ
client_sslr6 r r r � probe_sni� s>
���
@
rS F)�private_key_pem�domains� must_staple�ipaddrsr c C s� t �t j| �}t �� }g }|du r&g }|du r2g }t|�t|� dkrNtd��|D ]}|�d| � qR|D ]}|�d|j � qjd�|�� d�} t j
dd | d
�g}
|r�|
�t j
d d d d
�� |� |
� |� |� |�
d� |�|d
� t �t j|�S )a� Generate a CSR containing domains or IPs as subjectAltNames.
:param buffer private_key_pem: Private key, in PEM PKCS#8 format.
:param list domains: List of DNS names to include in subjectAltNames of CSR.
:param bool must_staple: Whether to include the TLS Feature extension (aka
OCSP Must Staple: https://tools.ietf.org/html/rfc7633).
:param list ipaddrs: List of IPaddress(type ipaddress.IPv4Address or ipaddress.IPv6Address)
names to include in subbjectAltNames of CSR.
params ordered this way for backward competablity when called by positional argument.
:returns: buffer PEM-encoded Certificate Signing Request.
Nr zAAt least one of domains or ipaddrs parameter need to be not empty�DNS:�IP:�, �ascii� subjectAltNameF�Zcritical�values 1.3.6.1.5.5.7.1.24s DER:30:03:02:01:05�sha256)r Zload_privatekey� FILETYPE_PEM�X509Req�lenr( �append�exploded�join�encode�
X509Extension�add_extensions�
set_pubkey� set_version�sign�dump_certificate_request) rT rU rV rW Z private_keyZcsr�sanlist�address�ips�
san_string�
extensionsr r r �make_csr� sF ����
�rr )�loaded_cert_or_reqr c s6 | � � j� t| �}� d u r |S � g� fdd�|D � S )Nc s g | ]}|� kr|�qS r r )�.0�d�Z common_namer r �
<listcomp> � z4_pyopenssl_cert_or_req_all_names.<locals>.<listcomp>)� get_subject�CN�_pyopenssl_cert_or_req_san)rs Zsansr rv r � _pyopenssl_cert_or_req_all_names s
r| )� cert_or_reqr c s( d� d� �t | �}� �fdd�|D �S )a� Get Subject Alternative Names from certificate or CSR using pyOpenSSL.
.. todo:: Implement directly in PyOpenSSL!
.. note:: Although this is `acme` internal API, it is used by
`letsencrypt`.
:param cert_or_req: Certificate or CSR.
:type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
:returns: A list of Subject Alternative Names that is DNS.
:rtype: `list` of `str`
�:ZDNSc s$ g | ] }|� ��r|�� �d �qS )rN )�
startswith�split�rt �part��part_separator�prefixr r rw : s �z._pyopenssl_cert_or_req_san.<locals>.<listcomp>�� _pyopenssl_extract_san_list_raw)r} �
sans_partsr r� r r{ # s �r{ c s& d}d| � t | �}� fdd�|D �S )ae Get Subject Alternative Names IPs from certificate or CSR using pyOpenSSL.
:param cert_or_req: Certificate or CSR.
:type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
:returns: A list of Subject Alternative Names that are IP Addresses.
:rtype: `list` of `str`. note that this returns as string, not IPaddress object
r~ z
IP Addressc s& g | ] }|� � �r|t� �d � �qS r )r rb r� �r� r r rw O rx z1_pyopenssl_cert_or_req_san_ip.<locals>.<listcomp>r� )r} r� r� r r� r � _pyopenssl_cert_or_req_san_ip> s r� c C sf t | tj�r"t�tj| ��d�}nt�tj| ��d�}t�d|�}d}|du rRg n|� d��
|�}|S )a Get raw SAN string from cert or csr, parse it as UTF-8 and return.
:param cert_or_req: Certificate or CSR.
:type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`.
:returns: raw san strings, parsed byte as utf-8
:rtype: `list` of `str`
zutf-8z5X509v3 Subject Alternative Name:(?: critical)?\s*(.*)rZ NrN ) �
isinstancer r! �dump_certificateZ
FILETYPE_TEXT�decoderl �re�search�groupr� )r} �textZraw_sanZparts_separatorr� r r r r� R s r� �: T)r5 rU �
not_before�validity� force_sanrq ro r c C sb |s|sJ d��t �� }|�tt�t�d��d�� |�d� |du rJg }|du rVg }|du rbg }|� t �
ddd�� t |�dkr�|d |� � _
|�|� � � g }|D ]} |� d | � q�|D ]}
|� d
|
j � q�d �|��d �} |�st |�d
k�st |�dk�r |� t j
dd| d�� |�|� |�|du �r8dn|� |�|� |�| � |�| d� |S )at Generate new self-signed certificate.
:type domains: `list` of `str`
:param OpenSSL.crypto.PKey key:
:param bool force_san:
:param extensions: List of additional extensions to include in the cert.
:type extensions: `list` of `OpenSSL.crypto.X509Extension`
:type ips: `list` of (`ipaddress.IPv4Address` or `ipaddress.IPv6Address`)
If more than one domain is provided, all of the domains are put into
``subjectAltName`` X.509 extension and first domain is set as the
subject CN. If only one domain is provided no ``subjectAltName``
extension is used, unless `force_san` is ``True``.
z7Must provide one or more hostnames or IPs for the cert.� � Ns basicConstraintsTs CA:TRUE, pathlen:0r rX rY rZ r[ rN r\ Fr] r_ )r r! Zset_serial_numberrG �binasciiZhexlify�os�urandomrj rc rg rb ry rz Z
set_issuerrd re rf rh Zgmtime_adj_notBeforeZgmtime_adj_notAfterri rk ) r5 rU r� r� r� rq ro r6 rm rn Ziprp r r r � gen_ss_certq sH
�� "�
r� )�chain�filetyper c s8 t tjtjf td��fdd� � d�� fdd�| D ��S )z�Dump certificate chain into a bundle.
:param list chain: List of `OpenSSL.crypto.X509` (or wrapped in
:class:`josepy.util.ComparableX509`).
:returns: certificate chain bundle
:rtype: bytes
)r6 r c s6 t | tj�r*t | jtj�r$t�d��| j} t�� | �S )NzUnexpected CSR provided.) r� �jose�ComparableX509�wrappedr ra r
r; r� )r6 )r� r r �
_dump_cert� s
z(dump_pyopenssl_chain.<locals>._dump_certrx c 3 s | ]}� |�V qd S r r )rt r6 )r� r r � <genexpr>� rx z'dump_pyopenssl_chain.<locals>.<genexpr>)r
r� r� r r! r re )r� r� r )r� r� r �dump_pyopenssl_chain� s r� )NFN)NNr� TNN)4r> r� rQ Z ipaddressZloggingr� r� r< �typingr r r r r r r r r
Zjosepyr� ZOpenSSLr r Zacmer
Z getLoggerr r. Z
SSLv23_METHODrF r r# r rG r? r! rS r@ Z IPv4AddressZ IPv6Addressrr ra r| r{ r� r� r rg r� r` r� r� r r r r �<module> sz
x�
� 9 �� 7� � � C��