Ë
|
|
çúh¼, ã ó
|
d dl Z d dlZd dlZd dlmZmZ d dlZd dlZd dlm Z m
|
Z
|
d dl m Z d dl mZ d dlmZ d dlmZmZ d dlmZ d d lmZ d d
|
lmZmZ d d lmZm Z d d l m Z d d l m Z m!Z! d Z"ddZ#d Z$d Z%ddZ& G d d« Z'y)é N)ÚurljoinÚurlparse)ÚhazmatÚx509)ÚInvalidSignature)Úbackends)Ú DSAPublicKey)ÚECDSAÚEllipticCurvePublicKey)ÚPKCS1v15)Ú RSAPublicKey)ÚSHA1ÚHash)ÚEncodingÚ PublicFormat)Úocsp)ÚAuthorizationErrorÚConnectionErrorc óR | j « } t |t « r;|j |j |j
|
t « |j « y t |t « r2|j |j |j
|
|j « y t |t « r;|j |j |j
|
t |j « « y |j |j |j
|
« y # t $ r t d« w xY w)Nz failed to valid ocsp response) Ú
|
public_keyÚ
|
isinstancer ÚverifyÚ signatureÚtbs_response_bytesr Úsignature_hash_algorithmr r r
|
r r )Ú issuer_certÚ ocsp_responseÚpubkeys õ] H:\项ç®\archive\æµè¯ç»\èæ¬\Change_password\venv_build\Lib\site-packages\redis/ocsp.pyÚ_verify_responser sî Ø × #Ñ #Ó %Fð?Ü flÔ +Ø MMØ ×'Ñ'Ø ×0Ñ0Ü
|
Ø ×6Ñ6õ ô ¤ Ô -Ø MMØ ×'Ñ'Ø ×0Ñ0Ø ×6Ñ6õ ô
|
Ô 6Ô 7Ø MMØ ×'Ñ'Ø ×0Ñ0Üm×<Ñ<Ó=õ ð MM-×1Ñ1°=×3SÑ3SÕ TøÜ ò ?Ü Ð =Ó>Ð>ð?ús A
|
D Á AD Â A
|
D Ã*&D ÄD&c óv t j |« }|j t j j k( r t d« |j t j j k( r[|j t j j k7 r?t dt |j « j d« d d« t d« |j t j j « k\ r t d« |j r6|j t j j « k r t d« |j" }|j$ }|j& }| }||| j( k( s||k( r| }n|j* }t- || ||« } | d }
|
|
|
j0 j3 t4 j6 « } | 0t4 j8 j: j< | j> vr t d « |
|
}|r tA ||« y # t. $ r t d
|
« w xY w) z=A wrapper the return the validity of a known ocsp certificatez4you are not authorized to view this ocsp certificatez Received an ú.é z ocsp certificate statusz@failed to retrieve a successful response from the ocsp responderz)ocsp certificate was issued in the futurez1ocsp certificate has invalid update - in the pastr z'no certificates found for the responderz'delegate not autorized for ocsp signingT)!r Úload_der_ocsp_responseÚresponse_statusÚOCSPResponseStatusÚ UNAUTHORIZEDr Ú
|
SUCCESSFULÚcertificate_statusÚOCSPCertStatusÚGOODr ÚstrÚsplitÚ this_updateÚdatetimeÚnowÚ next_updateÚresponder_nameÚissuer_key_hashÚresponder_key_hashÚsubjectÚ certificatesÚ_get_certificatesÚ
|
IndexErrorÚ
|
extensionsÚget_extension_for_classr ÚExtendedKeyUsageÚoidÚExtendedKeyUsageOIDÚ OCSP_SIGNINGÚvaluer ) r Ú
|
ocsp_bytesÚvalidater r2 Ú issuer_hashÚresponder_hashÚcert_to_validateÚcertsÚresponder_certsÚresponder_certÚexts r Ú_check_certificaterI 2 s ô ×/Ñ/°
|
Ó;Mà×$Ñ$¬×(?Ñ(?×(LÑ(LÒLÜ Ð!WÓXÐXØ×$Ñ$¬×(?Ñ(?×(JÑ(JÒJØ × +Ñ +¬t×/BÑ/B×/GÑ/GÒ GÜ!Ø s =×#CÑ#CÓ D× JÑ JÈ3Ó OÐPQÑ RÐ Sð T*ð *óð ô
|
Ø Nó
|
ð
|
ð × Ñ ¤H×$5Ñ$5×$9Ñ$9Ó$;Ò;Ü Ð IÓJÐJð ×!Ò!Ø × %Ñ %¬×(9Ñ(9×(=Ñ(=Ó(?Ò ?ä Ð QÓRÐRà"×1Ñ1NØ ×/Ñ/KØ"×5Ñ5Nà"ÐàÐ"Ø k× 1Ñ 1Ò 1Ø [Ò (à&Ñà ×*Ñ*Ü+Ø ; °ó
|
ð MØ ,¨QÑ /Nð ×'Ñ'×?Ñ?Ä×@UÑ@UÓVØ ;$((×6Ñ6×CÑCÈ3Ï9É9ÑTÜ!Ð"KÓLÐ LØ)ÐáÜÐ)¨=Ô9Ø øô ò MÜ!Ð"KÓLÐ Lð Mús Æ'H# È#H8c óü |8| D cg c]+ }t |« |k( r|j |j k( r|- }}|S | D cg c], }|j |k( r|j |j k( r|. }}|S c c}w c c}w ©N)Ú_get_pubkey_hashÚissuerr5 )rE r r2 rC Úcr6 s r r7 r7 m s ØÐ ð ö
|
àÜ Ó" nÒ4¸¿¹À[×EXÑEXÒ9Xò ð
|
ð
|
ð Ðð ö
|
àØyyNÒ*¨q¯x©x¸;×;NÑ;NÒ/Nò ð
|
ð
|
ð Ðùò
|
ùò
|
s
|
0A4¿1A9c ó
|
| j « }t |t « r/|j t j
|
t j « }nmt |t « r/|j t j t j « }n.|j t j
|
t j « }t t « t j « ¬« }|j! |« |j# « S )N)Úbackend)r r r Ú public_bytesr ÚDERr ÚPKCS1r ÚX962ÚUncompressedPointÚSubjectPublicKeyInfor r r Údefault_backendÚupdateÚfinalize)Ú certificater ÚhÚsha1s r rL rL ~ s© Ø × #Ñ #Ó %Fô &,Ô'Ø × Ñ ¤§ ¡ ¬l×.@Ñ.@Ó AÜ FÔ 2Ô 3Ø × Ñ ¤§ ¡ ¬|×/MÑ/MÓ Nà × Ñ ¤§ ¡ ¬l×.OÑ.OÓ Pä ¤× 8Ñ 8Ó :Ô ;DØKKNØ ==?Ðó c ód |dv r t d« d}| j « j « }| j « D ]/ }|j « }|j |j
|
k( s-|} n | t d« |%t j |« }||k7 r t d« t ||« S )zÌAn implementation of a function for set_ocsp_client_callback in PyOpenSSL.
|
|
This function validates that the provide ocsp_bytes response is valid,
|
and matches the expected, stapled responses.
|
)r] Nzno ocsp response presentNz2no matching issuer cert found in certificate chainz/received and expected certificates do not match) r Úget_peer_certificateÚto_cryptographyÚget_peer_cert_chainr5 rM r Úload_pem_x509_certificaterI )Úconr@ Úexpectedr Ú peer_certrN ÚcertÚes r Úocsp_staple_verifierrh s¾ ð [Ñ Ü Ð 8Ó9Ð9àKØ×(Ñ(Ó*×:Ñ:Ó<IØ × $Ñ $Ó &ò Ø× Ñ Ó"Ø <<9×+Ñ+Ó +Ø KÙ ð ð ÐÜ Ð RÓSÐSàÐÜ × *Ñ *¨8Ó 4Ø >Ü!Ð"SÓTÐ Tä k¨:Ó 6Ð6r] c óB e Zd ZdZd dZd Zd Zd Zd Zd Z d Z
|
d
|
Z y) Ú OCSPVerifiera A class to verify ssl sockets for RFC6960/RFC6961. This can be used
|
when using direct validation of OCSP responses and certificate revocations.
|
|
@see https://datatracker.ietf.org/doc/html/rfc6960
|
@see https://datatracker.ietf.org/doc/html/rfc6961
|
Nc ó< || _ || _ || _ || _ y rK )ÚSOCKÚHOSTÚPORTÚCA_CERTS)ÚselfÚsockÚhostÚportÚca_certss r Ú__init__zOCSPVerifier.__init__² s Ø Ø Ø Ø r] c ó t j |« }t j |j « t j « « }|S )z?Convert SSL certificates in a binary (DER) format to ASCII PEM.)ÚsslÚDER_cert_to_PEM_certr rb Úencoder rW )rp ÚderÚpemrf s r Ú
|
_bin2asciizOCSPVerifier._bin2ascii¸ s: ô ×&Ñ& sÓ+Ü×-Ñ-¨c¯j©j«l¼H×<TÑ<TÓ<VÓWØ r] c ó | j j d« }|du r t d« | j |« }| j |« S )zThis function returns the certificate, primary issuer, and primary ocsp
|
server in the chain for a socket already wrapped with ssl.
|
TFz!no certificate found for ssl peer)rl Ú getpeercertr r| Ú_certificate_components)rp rz rf s r Úcomponents_from_socketz#OCSPVerifier.components_from_socket¿ sJ ð ii×#Ñ# DÓ)Ø %<Ü!Ð"EÓFÐ FØsÓ#Ø×+Ñ+¨DÓ1Ð1r] c óÖ |j j t j j j
|
« j }|D cg c]5 }|j t j j j k( r|7 }} |d j j }|D cg c]5 }|j t j j j k( r|7 }} |d j j }|||fS # t j j j $ r t d« w xY wc c}w # t $ r d}Y §w xY wc c}w # t $ r t d« w xY w)zÌGiven an SSL certificate, retract the useful components for
|
validating the certificate status with an OCSP server.
|
|
Args:
|
cert ([bytes]): A PEM encoded ssl certificate
|
z-No AIA information present in ssl certificater Nz no ocsp servers in certificate)r9 Úget_extension_for_oidr r< Ú ExtensionOIDÚ AUTHORITY_INFORMATION_ACCESSr? Ú cryptographyÚExtensionNotFoundr Ú access_methodÚ AuthorityInformationAccessOIDÚ
|
CA_ISSUERSÚaccess_locationr8 ÚOCSP)rp rf ÚaiaÚiÚissuersrM Úocspsr s r r z$OCSPVerifier._certificate_componentsË s_ ð SØ//×7Ñ7Ü×%Ñ%×BÑBóçeð ð ö
|
àؤ$§(¡(×"HÑ"H×"SÑ"SÒSò ð
|
ð
|
ð
|
Ø QZ×/Ñ/×5Ñ5Fð ö
|
àؤ$§(¡(×"HÑ"H×"MÑ"MÒMò ð
|
ð
|
ð DØ8×+Ñ+×1Ñ1Dð VTÐ!Ð!øô5 × Ñ ×+Ñ+×=Ñ=ò SÜ!Ð"QÓRÐ Rð Süò
|
øô ò ØFð üò
|
øô ò DÜ!Ð"BÓCÐ Cð Dús6 AD Á :D8Â
|
D= Â':EÃ$E Ä3D5Ä= E Å
|
E ÅE(c óþ t j | j | j f| j ¬« }t j |j « t j « « }| j |« S )zÎReturn the certificate, primary issuer, and primary ocsp server
|
from the host defined by the socket. This is useful in cases where
|
different certificates are occasionally presented.
|
)rt ) rw Úget_server_certificaterm rn ro r rb ry r rW r )rp r{ rf s r Ú!components_from_direct_connectionz.OCSPVerifier.components_from_direct_connectionó sY ô ×(Ñ(¨$¯)©)°T·Y±YÐ)?È$Ï-É-ÔXÜ×-Ñ-¨c¯j©j«l¼H×<TÑ<TÓ<VÓWØ×+Ñ+¨DÓ1Ð1r] c óª t j « }|j ||t j j
|
j j « « }|j « }t j |j t j
|
j j j « « }t ||j! d« « }|S )z#Return the complete url to the ocspÚascii)r ÚOCSPRequestBuilderÚadd_certificater
r Ú
|
primitivesÚhashesÚSHA256ÚbuildÚbase64Ú b64encoderQ Ú serializationr rR r Údecode)rp Úserverrf r ÚorbÚrequestÚpathÚurls r Úbuild_certificate_urlz"OCSPVerifier.build_certificate_urlý s£ ä×%Ñ%Ó'ð ×!Ñ!Ø +|× 2Ñ 2× =Ñ =× DÑ D× KÑ KÓ Mó
|
ð ))+ä× Ñ Ø × Ñ ¤×!2Ñ!2×!@Ñ!@×!IÑ!I×!MÑ!MÓ Nó
|
ô fdkk¨'Ó 2Ó3Ø
|
r] c ót t j |« }|j s t d« |j }| j |« }| j |||« }t |« j dd}t j ||¬« }|j s t d« t ||j d« S )z3Checks the validity of an ocsp server for an issuerz"failed to fetch issuer certificatezapplication/ocsp-request)ÚHostz Content-Type)Úheadersz failed to fetch ocsp certificateT)
|
ÚrequestsÚgetÚokr Úcontentr| r¤ r ÚnetlocrI ) rp r rf Ú
|
issuer_urlÚrrz r Úocsp_urlÚheaders r Úcheck_certificatez OCSPVerifier.check_certificate s¢ ô LLÓ $ØttÜ!Ð"FÓGÐ GØiiØoo cÓ* à×-Ñ-¨f°d¸KÓHô XÓ&×-Ñ-Ø 6ñ
|
ô LL¨6Ô 2ØttÜ!Ð"DÓEÐ EÜ! +¨q¯y©y¸$Ó?Ð?r] c óò | j « \ }}}| t d« | j |||« S # t $ r7 | j « \ }}}| t d« | j |||« cY S w xY w)aD Returns the validity of the certificate wrapping our socket.
|
This first retrieves for validate the certificate, issuer_url,
|
and ocsp_server for certificate validate. Then retrieves the
|
issuer certificate from the issuer_url, and finally checks
|
the validity of OCSP revocation status.
|
z%no issuers found in certificate chain)r r r± r r )rp rf r Ú ocsp_servers r Úis_validzOCSPVerifier.is_valid" s ð IØ,0×,GÑ,GÓ,IÑ )D*kØÐ!Ü%Ð&MÓNÐNØ×)Ñ)¨+°t¸ZÓHÐ HøÜ!ò IØ,0×,RÑ,RÓ,TÑ )D*kØÐ!Ü%Ð&MÓNÐNØ×)Ñ)¨+°t¸ZÓHÒ Hð Iús 36 ¶=A6Á5A6rK ) Ú__name__Ú
|
__module__Ú __qualname__Ú__doc__ru r| r r r r¤ r± r´ © r] r rj rj ª s2 ñó!ò ò
|
2ò&"òP2òò @ó*Ir] rj )TrK )(r r/ rw Ú urllib.parser r Ú%cryptography.hazmat.primitives.hashesr
r¨ r r Úcryptography.exceptionsr Úcryptography.hazmatr Ú-cryptography.hazmat.primitives.asymmetric.dsar Ú,cryptography.hazmat.primitives.asymmetric.ecr
|
r Ú1cryptography.hazmat.primitives.asymmetric.paddingr Ú-cryptography.hazmat.primitives.asymmetric.rsar r r Ú,cryptography.hazmat.primitives.serializationr r Úcryptography.x509r Úredis.exceptionsr r r rI r7 rL rh rj r¹ r] r ú<module>rÅ s` ðÛ Û Û
|
ß *ã ,Û ß %Ý 4Ý (Ý Fß VÝ FÝ Fß <ß OÝ "ç @ò?ó88òvò" ó 7÷8JIò JIr]
|
