File: //opt/alt/python37/lib/python3.7/site-packages/redis/__pycache__/ocsp.cpython-37.pyc
B
�P�e�, � @ s d dl Z d dlZd dlZd dlmZmZ d dlZd dlZd dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZmZ d dlmZ d d lmZ d d
lmZmZ d d lmZm Z d d l m Z d d
l m Z m!Z! dd� Z"ddd�Z#dd� Z$dd� Z%d dd�Z&G dd� d�Z'dS ) � N)�urljoin�urlparse)�hazmat�x509)�InvalidSignature)�backends)� DSAPublicKey)�ECDSA�EllipticCurvePublicKey)�PKCS1v15)� RSAPublicKey)�SHA1�Hash)�Encoding� PublicFormat)�ocsp)�AuthorizationError�ConnectionErrorc C s� | � � }y|t|t�r.|�|j|jt� |j� nTt|t�rN|�|j|j|j� n4t|t �rr|�|j|jt
|j�� n|�|j|j� W n t k
r� t d��Y nX d S )Nz failed to valid ocsp response)
�
public_key�
isinstancer �verify� signatureZtbs_response_bytesr Zsignature_hash_algorithmr r
r r r )� issuer_cert�
ocsp_response�pubkey� r �;/opt/alt/python37/lib/python3.7/site-packages/redis/ocsp.py�_verify_response s*
r Tc C s\ t �|�}|jt jjkr td��|jt jjkr^|jt jj krft
dt |j�� d�d � d���nt
d��|j
tj�� kr~t
d��|jr�|jtj�� k r�t
d��|j}|j}|j}| }|d k r�|| jks�||kr�| }nv|j}t|| ||�} y | d
}
W n tk
�r t
d ��Y nX |
j�tj�} | d k�s<tj j j | j k�rDt
d ��|
}|�rXt ||� d
S )z=A wrapper the return the validity of a known ocsp certificatez4you are not authorized to view this ocsp certificatez Received an �.� z ocsp certificate statusz?failed to retrieve a sucessful response from the ocsp responderz)ocsp certificate was issued in the futurez1ocsp certificate has invalid update - in the pastNr z'no certificates found for the responderz'delegate not autorized for ocsp signingT)!r Zload_der_ocsp_responseZresponse_statusZOCSPResponseStatus� UNAUTHORIZEDr Z
SUCCESSFULZcertificate_statusZOCSPCertStatusZGOODr �str�splitZ this_update�datetime�nowZ next_update�responder_nameZissuer_key_hashZresponder_key_hash�subject� certificates�_get_certificates�
IndexError�
extensionsZget_extension_for_classr ZExtendedKeyUsage�oidZExtendedKeyUsageOIDZ OCSP_SIGNING�valuer ) r �
ocsp_bytes�validater r% Z issuer_hash�responder_hashZcert_to_validate�certsZresponder_certsZresponder_cert�extr r r �_check_certificate2 sH
r2 c s6 �d kr � �fdd�| D �}n� �fdd�| D �}|S )Nc s( g | ] }t |��kr|j� jkr|�qS r )�_get_pubkey_hash�issuerr& )�.0�c)r r/ r r �
<listcomp>p s z%_get_certificates.<locals>.<listcomp>c s& g | ] }|j �kr|j� j kr|�qS r )r& r4 )r5 r6 )r r% r r r7 v s r )r0 r r% r/ r' r )r r/ r% r r( m s
r( c C st | � � }t|t�r$|�tjtj�}n,t|t�r@|�tj tj
�}n|�tjtj �}t t
� t�� d�}|�|� |�� S )N)�backend)r r r � public_bytesr �DERr ZPKCS1r
ZX962ZUncompressedPointZSubjectPublicKeyInfor r
r �default_backend�update�finalize)Z certificater �h�sha1r r r r3 ~ s
r3 c C s� |dkrt d��d}| �� �� }x*| �� D ] }|�� }|j|jkr*|}P q*W |dkr\t d��|dk r~t�|�}||kr~t d��t||�S )z�An implemention of a function for set_ocsp_client_callback in PyOpenSSL.
This function validates that the provide ocsp_bytes response is valid,
and matches the expected, stapled responses.
)� Nzno ocsp response presentNz2no matching issuer cert found in certificate chainz/received and expected certificates do not match) r Zget_peer_certificateZto_cryptographyZget_peer_cert_chainr& r4 r �load_pem_x509_certificater2 )�conr- �expectedr Z peer_certr6 �cert�er r r �ocsp_staple_verifier� s
rF c @ sR e Zd ZdZddd�Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dS )� OCSPVerifiera A class to verify ssl sockets for RFC6960/RFC6961. This can be used
when using direct validation of OCSP responses and certificate revocations.
@see https://datatracker.ietf.org/doc/html/rfc6960
@see https://datatracker.ietf.org/doc/html/rfc6961
Nc C s || _ || _|| _|| _d S )N)�SOCK�HOST�PORT�CA_CERTS)�self�sock�host�port�ca_certsr r r �__init__� s zOCSPVerifier.__init__c C s" t �|�}t�|�� t�� �}|S )z?Convert SSL certificates in a binary (DER) format to ASCII PEM.)�ssl�DER_cert_to_PEM_certr rA �encoder r; )rL �der�pemrD r r r �
_bin2ascii� s
zOCSPVerifier._bin2asciic C s0 | j �d�}|dkr td��| �|�}| �|�S )z�This function returns the certificate, primary issuer, and primary ocsp server
in the chain for a socket already wrapped with ssl.
TFz!no certificate found for ssl peer)rH � getpeercertr rW �_certificate_components)rL rU rD r r r �components_from_socket� s
z#OCSPVerifier.components_from_socketc C s� y|j �tjjj�j}W n" tjj jk
r: t d��Y nX dd� |D �}y|d j
j}W n t k
rr d}Y nX dd� |D �}y|d j
j}W n t k
r� t d��Y nX |||fS )z�Given an SSL certificate, retract the useful components for
validating the certificate status with an OCSP server.
Args:
cert ([bytes]): A PEM encoded ssl certificate
z-No AIA information present in ssl certificatec S s g | ]}|j tjjjkr|�qS r )�
access_methodr r+ � AuthorityInformationAccessOIDZ
CA_ISSUERS)r5 �ir r r r7 � s z8OCSPVerifier._certificate_components.<locals>.<listcomp>r Nc S s g | ]}|j tjjjkr|�qS r )r[ r r+ r\ ZOCSP)r5 r] r r r r7 � s z no ocsp servers in certificate) r* Zget_extension_for_oidr r+ Z ExtensionOIDZ AUTHORITY_INFORMATION_ACCESSr, � cryptographyZExtensionNotFoundr Zaccess_locationr) )rL rD ZaiaZissuersr4 Zocspsr r r r rY � s$
z$OCSPVerifier._certificate_componentsc C s6 t j| j| jf| jd�}t�|�� t� � �}| �
|�S )z�Return the certificate, primary issuer, and primary ocsp server
from the host defined by the socket. This is useful in cases where
different certificates are occasionally presented.
)rP ) rR �get_server_certificaterI rJ rK r rA rT r r; rY )rL rV rD r r r �!components_from_direct_connection� s z.OCSPVerifier.components_from_direct_connectionc C sT t �� }|�||tjjj�� �}|�� }t �
|� tjj j
j��}t||�d��}|S )z#Return the complete url to the ocsp�ascii)r ZOCSPRequestBuilderZadd_certificater^ r Z
primitives�hashes�SHA256�build�base64� b64encoder9 Z
serializationr r: r �decode)rL �serverrD r Zorb�request�path�urlr r r �build_certificate_url� s z"OCSPVerifier.build_certificate_urlc C sp t �|�}|jstd��|j}| �|�}| �|||�}t|�jdd�}t j||d�}|jsbtd��t ||jd�S )z5Checks the validitity of an ocsp server for an issuerz"failed to fetch issuer certificatezapplication/ocsp-request)�Hostz Content-Type)�headersz failed to fetch ocsp certificateT)
�requests�get�okr �contentrW rl r �netlocr2 ) rL rh rD �
issuer_url�rrU r Zocsp_url�headerr r r �check_certificate
s
z OCSPVerifier.check_certificatec C sn y,| � � \}}}|dkr td��| �|||�S tk
rh | �� \}}}|dkrZtd��| �|||�S X dS )aD Returns the validity of the certificate wrapping our socket.
This first retrieves for validate the certificate, issuer_url,
and ocsp_server for certificate validate. Then retrieves the
issuer certificate from the issuer_url, and finally checks
the valididy of OCSP revocation status.
Nz%no issuers found in certificate chain)rZ r rw r r` )rL rD rt Z ocsp_serverr r r �is_valid" s zOCSPVerifier.is_valid)N) �__name__�
__module__� __qualname__�__doc__rQ rW rZ rY r` rl rw rx r r r r rG � s
(
rG )T)N)(re r# rR � urllib.parser r Z%cryptography.hazmat.primitives.hashesr^ ro r r Zcryptography.exceptionsr Zcryptography.hazmatr Z-cryptography.hazmat.primitives.asymmetric.dsar Z,cryptography.hazmat.primitives.asymmetric.ecr r
Z1cryptography.hazmat.primitives.asymmetric.paddingr Z-cryptography.hazmat.primitives.asymmetric.rsar r
r Z,cryptography.hazmat.primitives.serializationr r Zcryptography.x509r Zredis.exceptionsr r r r2 r( r3 rF rG r r r r �<module> s,
;