File: //usr/lib/python3.9/site-packages/redis/__pycache__/ocsp.cpython-39.pyc
a
��b�, � @ s d dl Z d dlZd dlZd dlmZmZ d dlZd dlZd dlm Z m
Z
d dl m Z d dl
mZ d dlmZ d dlmZmZ d dlmZ d d lmZ d d
lmZmZ d d lmZm Z d d l m Z d d
l m Z m!Z! dd� Z"ddd�Z#dd� Z$dd� Z%d dd�Z&G dd� d�Z'dS ) � N)�urljoin�urlparse)�hazmat�x509)�InvalidSignature)�backends)� DSAPublicKey)�ECDSA�EllipticCurvePublicKey)�PKCS1v15)� RSAPublicKey)�SHA1�Hash)�Encoding� PublicFormat)�ocsp)�AuthorizationError�ConnectionErrorc C s� | � � }z|t|t�r.|�|j|jt� |j� nTt|t�rN|�|j|j|j� n4t|t �rr|�|j|jt
|j�� n|�|j|j� W n t y� t d��Y n0 d S )Nz failed to valid ocsp response)
�
public_key�
isinstancer ZverifyZ signatureZtbs_response_bytesr Zsignature_hash_algorithmr r
r r r )� issuer_cert�
ocsp_response�pubkey� r �./usr/lib/python3.9/site-packages/redis/ocsp.py�_verify_response s0
�
�
� r Tc C sZ t �|�}|jt jjkr td��|jt jjkr^|jt jj krft
dt |j�� d�d � d���nt
d��|j
tj�� kr~t
d��|jr�|jtj�� k r�t
d��|j}|j}|j}| }|d ur�|| jks�||kr�| }nt|j}t|| ||�} z | d
}
W n t�y t
d ��Y n0 |
j�tj�} | d u �s:tj j j | j v�rBt
d ��|
}|�rVt ||� d
S )z=A wrapper the return the validity of a known ocsp certificatez4you are not authorized to view this ocsp certificatez Received an �.� z ocsp certificate statusz?failed to retrieve a sucessful response from the ocsp responderz)ocsp certificate was issued in the futurez1ocsp certificate has invalid update - in the pastNr z'no certificates found for the responderz'delegate not autorized for ocsp signingT)!r Zload_der_ocsp_responseZresponse_statusZOCSPResponseStatusZ UNAUTHORIZEDr Z
SUCCESSFULZcertificate_statusZOCSPCertStatusZGOODr �str�splitZ this_update�datetimeZnowZ next_update�responder_nameZissuer_key_hashZresponder_key_hash�subject� certificates�_get_certificates�
IndexError�
extensionsZget_extension_for_classr ZExtendedKeyUsage�oidZExtendedKeyUsageOIDZ OCSP_SIGNING�valuer ) r �
ocsp_bytesZvalidater r! Z issuer_hash�responder_hashZcert_to_validate�certsZresponder_certsZresponder_cert�extr r r �_check_certificate2 sX
��������
r- c s6 �d u r � �fdd�| D �}n� �fdd�| D �}|S )Nc s( g | ] }t |��kr|j� jkr|�qS r )�_get_pubkey_hash�issuerr" ��.0�c)r r* r r �
<listcomp>o s �z%_get_certificates.<locals>.<listcomp>c s& g | ] }|j �kr|j� j kr|�qS r )r" r/ r0 )r r! r r r3 u s �r )r+ r r! r* r# r )r r* r! r r$ m s � �r$ c C st | � � }t|t�r$|�tjtj�}n,t|t�r@|�tj tj
�}n|�tjtj �}t t
� t�� d�}|�|� |�� S )N)Zbackend)r r r � public_bytesr �DERr ZPKCS1r
ZX962ZUncompressedPointZSubjectPublicKeyInfor r
r �default_backend�update�finalize)Z certificater �hZsha1r r r r. ~ s
r. c C s� |dv rt d��d}| �� �� }| �� D ] }|�� }|j|jkr(|} qJq(|du rZt d��|dur|t�|�}||kr|t d��t||�S )z�An implemention of a function for set_ocsp_client_callback in PyOpenSSL.
This function validates that the provide ocsp_bytes response is valid,
and matches the expected, stapled responses.
)� Nzno ocsp response presentNz2no matching issuer cert found in certificate chainz/received and expected certificates do not match) r Zget_peer_certificateZto_cryptographyZget_peer_cert_chainr" r/ r �load_pem_x509_certificater- )Zconr) Zexpectedr Z peer_certr2 �cert�er r r �ocsp_staple_verifier� s
r> c @ sR e Zd ZdZddd�Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dS )� OCSPVerifiera A class to verify ssl sockets for RFC6960/RFC6961. This can be used
when using direct validation of OCSP responses and certificate revocations.
@see https://datatracker.ietf.org/doc/html/rfc6960
@see https://datatracker.ietf.org/doc/html/rfc6961
Nc C s || _ || _|| _|| _d S )N)�SOCK�HOST�PORT�CA_CERTS)�selfZsock�host�port�ca_certsr r r �__init__� s zOCSPVerifier.__init__c C s" t �|�}t�|�� t�� �}|S )z?Convert SSL certificates in a binary (DER) format to ASCII PEM.)�sslZDER_cert_to_PEM_certr r; �encoder r6 )rD �der�pemr< r r r �
_bin2ascii� s
zOCSPVerifier._bin2asciic C s0 | j �d�}|du r td��| �|�}| �|�S )z�This function returns the certificate, primary issuer, and primary ocsp server
in the chain for a socket already wrapped with ssl.
TFz!no certificate found for ssl peer)r@ Z getpeercertr rM �_certificate_components)rD rK r< r r r �components_from_socket� s
z#OCSPVerifier.components_from_socketc C s� z|j �tjjj�j}W n tjj jy8 t d��Y n0 dd� |D �}z|d j
j}W n t yn d}Y n0 dd� |D �}z|d j
j}W n t y� t d��Y n0 |||fS )z�Given an SSL certificate, retract the useful components for
validating the certificate status with an OCSP server.
Args:
cert ([bytes]): A PEM encoded ssl certificate
z-No AIA information present in ssl certificatec S s g | ]}|j tjjjkr|�qS r )�
access_methodr r' � AuthorityInformationAccessOIDZ
CA_ISSUERS�r1 �ir r r r3 � s �z8OCSPVerifier._certificate_components.<locals>.<listcomp>r Nc S s g | ]}|j tjjjkr|�qS r )rP r r' rQ ZOCSPrR r r r r3 � s �z no ocsp servers in certificate) r& Zget_extension_for_oidr r' Z ExtensionOIDZ AUTHORITY_INFORMATION_ACCESSr( � cryptographyZExtensionNotFoundr Zaccess_locationr% )rD r< ZaiaZissuersr/ Zocspsr r r r rN � s* �
�
� z$OCSPVerifier._certificate_componentsc C s6 t j| j| jf| jd�}t�|�� t� � �}| �
|�S )z�Return the certificate, primary issuer, and primary ocsp server
from the host defined by the socket. This is useful in cases where
different certificates are occasionally presented.
)rG ) rI Zget_server_certificaterA rB rC r r; rJ r r6 rN )rD rL r< r r r �!components_from_direct_connection� s z.OCSPVerifier.components_from_direct_connectionc C sT t �� }|�||tjjj�� �}|�� }t �
|� tjj j
j��}t||�d��}|S )z#Return the complete url to the ocsp�ascii)r ZOCSPRequestBuilderZadd_certificaterT r Z
primitivesZhashesZSHA256Zbuild�base64Z b64encoder4 Z
serializationr r5 r �decode)rD �serverr< r ZorbZrequest�path�urlr r r �build_certificate_url� s ��z"OCSPVerifier.build_certificate_urlc C sp t �|�}|jstd��|j}| �|�}| �|||�}t|�jdd�}t j||d�}|jsbtd��t ||jd�S )z5Checks the validitity of an ocsp server for an issuerz"failed to fetch issuer certificatezapplication/ocsp-request)ZHostz Content-Type)Zheadersz failed to fetch ocsp certificateT)
�requests�get�okr ZcontentrM r\ r �netlocr- ) rD rY r< �
issuer_url�rrK r Zocsp_url�headerr r r �check_certificate
s
�z OCSPVerifier.check_certificatec C sr z.| � � \}}}|du r td��| �|||�W S tyl | �� \}}}|du rZtd��| �|||� Y S 0 dS )aD Returns the validity of the certificate wrapping our socket.
This first retrieves for validate the certificate, issuer_url,
and ocsp_server for certificate validate. Then retrieves the
issuer certificate from the issuer_url, and finally checks
the valididy of OCSP revocation status.
Nz%no issuers found in certificate chain)rO r rd r rU )rD r< ra Z ocsp_serverr r r �is_valid" s zOCSPVerifier.is_valid)N) �__name__�
__module__� __qualname__�__doc__rH rM rO rN rU r\ rd re r r r r r? � s
(
r? )T)N)(rW r rI � urllib.parser r Z%cryptography.hazmat.primitives.hashesrT r] r r Zcryptography.exceptionsr Zcryptography.hazmatr Z-cryptography.hazmat.primitives.asymmetric.dsar Z,cryptography.hazmat.primitives.asymmetric.ecr r
Z1cryptography.hazmat.primitives.asymmetric.paddingr Z-cryptography.hazmat.primitives.asymmetric.rsar r
r Z,cryptography.hazmat.primitives.serializationr r Zcryptography.x509r Zredis.exceptionsr r r r- r$ r. r> r? r r r r �<module> s,
;