⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.133
Server IP:
185.119.109.197
Server:
Linux managedhosting.chostar.me 5.15.0-160-generic #170-Ubuntu SMP Wed Oct 1 10:06:56 UTC 2025 x86_64
Server Software:
Apache
PHP Version:
8.1.33
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
acme
/
__pycache__
/
View File Name :
crypto_util.cpython-310.pyc
o [ PdA @ s d Z ddlZddlZddlZddlZddlZddlZddlZddlm Z ddlm Z ddlm Z ddlm Z ddlm Z ddlmZ dd lmZ dd lmZ ddlZdd lmZ dd lmZ dd lmZ eeZejZ G dd dZ G dd dZ dde ddfde de de de de dee!e f de e e! d ej"fd d Z# d>d e d!e eee! e e! f d"e$d#e e eej%ej&f d e f d$d%Z'd&eej"ej(f d e e! fd'd(Z)d)eej"ej(f d e e! fd*d+Z*d)eej"ej(f d e e! fd,d-Z+d)eej"ej(f d e e! fd.d/Z, 1 d?d2ej-d!e e e! d3e e d4e d5e$d6e e ej. d7e e eej%ej%f d ej"fd8d9Z/ej0fd:e ej" d;e d e fd<d=Z1dS )@zCrypto utilities. N)Any)Callable)List)Mapping)Optional)Set)Tuple)Union)crypto)SSL)errorsc @ sR e Zd Zdeeeejejf f fddZ de j de eejejf fddZ dS ) _DefaultCertSelectioncertsc C || _ d S N)r )selfr r 2/usr/lib/python3/dist-packages/acme/crypto_util.py__init__% z _DefaultCertSelection.__init__ connectionreturnc C s | }| j|d S r )get_servernamer get)r r server_namer r r __call__( s z _DefaultCertSelection.__call__N)__name__ __module__ __qualname__r bytesr r PKeyX509r r Connectionr r r r r r r $ s "(r c @ s e Zd ZdZdeddfdejdeeee e j e j f f de deeejee gef deeejge e j e j f f ddf d d Zd edefd d ZdejddfddZG dd dZde eef fddZdS ) SSLSocketa SSL wrapper for sockets. :ivar socket sock: Original wrapped socket. :ivar dict certs: Mapping from domain names (`bytes`) to `OpenSSL.crypto.X509`. :ivar method: See `OpenSSL.SSL.Context` for allowed values. :ivar alpn_selection: Hook to select negotiated ALPN protocol for connection. :ivar cert_selection: Hook to select certificate for connection. If given, `certs` parameter would be ignored, and therefore must be empty. Nsockr methodalpn_selectioncert_selectionr c C sX || _ || _|| _|s|std|r|rtd|}|d u r't|r$|ni }|| _d S )Nz*Neither cert_selection or certs specified.z(Both cert_selection and certs specified.)r$ r& r% ValueErrorr r' )r r$ r r% r& r' actual_cert_selectionr r r r : s zSSLSocket.__init__namec C t | j|S r )getattrr$ r r* r r r __getattr__P zSSLSocket.__getattr__r c C s | |}|du rtd| dS |\}}t| j}|tj |tj | | | | | j dur>| | j || dS )a SNI certificate callback. This method will set a new OpenSSL context object for this connection when an incoming connection provides an SNI name (in order to serve the appropriate certificate, if any). :param connection: The TLS connection object on which the SNI extension was received. :type connection: :class:`OpenSSL.Connection` Nz=Certificate selection for server name %s failed, dropping SSL)r' loggerdebugr r Contextr% set_options OP_NO_SSLv2 OP_NO_SSLv3use_privatekeyuse_certificater& set_alpn_select_callback set_context)r r pairkeycert new_contextr r r _pick_certificate_cbS s z SSLSocket._pick_certificate_cbc @ sH e Zd ZdZdejddfddZdedefdd Z d ede fd d Z dS ) zSSLSocket.FakeConnectionz Fake OpenSSL.SSL.Connection.r r Nc C r r )_wrapped)r r r r r r s r z!SSLSocket.FakeConnection.__init__r* c C r+ r )r, r? r- r r r r. v r/ z$SSLSocket.FakeConnection.__getattr__ unused_argsc G s | j S r )r? shutdown)r r@ r r r rA y s z!SSLSocket.FakeConnection.shutdown) r r r __doc__r r" r strr r. boolrA r r r r FakeConnectionn s rE c C s | j \}}t| j}|tj |tj || j | j d ur*| | j | t ||}| td| z | W ||fS tjyX } zt|d }~ww )Nz Performing handshake with %s)r$ acceptr r2 r% r3 r4 r5 set_tlsext_servername_callbackr> r& r8 rE r" set_accept_stater0 r1 do_handshakeErrorsocketerror)r r$ addrcontextssl_sockrL r r r rF } s" zSSLSocket.accept)r r r rB _DEFAULT_SSL_METHODrK r r r r r r r! intr r r" r r rC r r. r> rE rF r r r r r# - s. r# i i, ) r r* hostporttimeoutr% source_addressalpn_protocolsr c C s. t |}|| d|i}z%td||t|r"d|d |d nd ||f} tj| fi |} W n tj yE } zt | d} ~ ww t | @} t || } | | | |durd| | z | | W n t j y } zt | d} ~ ww W d | S 1 sw Y | S )a Probe SNI server for SSL certificate. :param bytes name: Byte string to send as the server name in the client hello message. :param bytes host: Host to connect to. :param int port: Port to connect to. :param int timeout: Timeout in seconds. :param method: See `OpenSSL.SSL.Context` for allowed values. :param tuple source_address: Enables multi-path probing (selection of source interface). See `socket.creation_connection` for more info. Available only in Python 2.7+. :param alpn_protocols: Protocols to request using ALPN. :type alpn_protocols: `list` of `str` :raises acme.errors.Error: In case of any problems. :returns: SSL certificate presented by the server. :rtype: OpenSSL.crypto.X509 rV z!Attempting to connect to %s:%d%s.z from {0}:{1}r rR N)r r2 set_timeoutr0 r1 anyformatrK create_connectionrL r rJ contextlibclosingr" set_connect_stateset_tlsext_host_nameset_alpn_protosrI rA get_peer_certificate)r* rS rT rU r% rV rW rN socket_kwargs socket_tupler$ rL client client_sslr r r probe_sni sJ rg Fprivate_key_pemdomains must_stapleipaddrsc C s t t j| }t }g }|du rg }|du rg }t|t| dkr'td|D ] }|d| q)|D ] }|d|j q5d| d} t j dd | d g} |r^| t j d d d d | | | | | d ||d t t j|S )a Generate a CSR containing domains or IPs as subjectAltNames. :param buffer private_key_pem: Private key, in PEM PKCS#8 format. :param list domains: List of DNS names to include in subjectAltNames of CSR. :param bool must_staple: Whether to include the TLS Feature extension (aka OCSP Must Staple: https://tools.ietf.org/html/rfc7633). :param list ipaddrs: List of IPaddress(type ipaddress.IPv4Address or ipaddress.IPv6Address) names to include in subbjectAltNames of CSR. params ordered this way for backward competablity when called by positional argument. :returns: buffer PEM-encoded Certificate Signing Request. Nr zAAt least one of domains or ipaddrs parameter need to be not emptyDNS:IP:, ascii subjectAltNameFcriticalvalues 1.3.6.1.5.5.7.1.24s DER:30:03:02:01:05sha256)r load_privatekey FILETYPE_PEMX509Reqlenr( appendexplodedjoinencode X509Extensionadd_extensions set_pubkey set_versionsigndump_certificate_request) rh ri rj rk private_keycsrsanlistaddressips san_string extensionsr r r make_csr sF r loaded_cert_or_reqc s6 | j t| } d u r|S g fdd|D S )Nc s g | ]}| kr|qS r r ).0d common_namer r <listcomp> s z4_pyopenssl_cert_or_req_all_names.<locals>.<listcomp>) get_subjectCN_pyopenssl_cert_or_req_san)r sansr r r _pyopenssl_cert_or_req_all_names s r cert_or_reqc s( d d t | } fdd|D S )a Get Subject Alternative Names from certificate or CSR using pyOpenSSL. .. todo:: Implement directly in PyOpenSSL! .. note:: Although this is `acme` internal API, it is used by `letsencrypt`. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: A list of Subject Alternative Names that is DNS. :rtype: `list` of `unicode` :DNSc s$ g | ]}| r| d qS )rX ) startswithsplitr partpart_separatorprefixr r r % s z._pyopenssl_cert_or_req_san.<locals>.<listcomp> _pyopenssl_extract_san_list_raw)r sans_partsr r r r s r c s& d}d| t | } fdd|D S )ai Get Subject Alternative Names IPs from certificate or CSR using pyOpenSSL. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: A list of Subject Alternative Names that are IP Addresses. :rtype: `list` of `unicode`. note that this returns as string, not IPaddress object r z IP Addressc s& g | ]}| r|t d qS r )r rx r r r r r : s & z1_pyopenssl_cert_or_req_san_ip.<locals>.<listcomp>r )r r r r r r _pyopenssl_cert_or_req_san_ip) s r c C sj t | tjrttj| d}n ttj| d}td|}d}|du r+g }|S | d |}|S )a Get raw SAN string from cert or csr, parse it as UTF-8 and return. :param cert_or_req: Certificate or CSR. :type cert_or_req: `OpenSSL.crypto.X509` or `OpenSSL.crypto.X509Req`. :returns: raw san strings, parsed byte as utf-8 :rtype: `list` of `unicode` zutf-8z5X509v3 Subject Alternative Name:(?: critical)?\s*(.*)rn NrX ) isinstancer r! dump_certificate FILETYPE_TEXTdecoder researchgroupr )r textraw_sanparts_separatorr r r r r = s r : Tr; not_beforevalidity force_sanr r c C sZ |s|sJ dt }|tttdd |d |du r%g }|du r+g }|du r1g }| t ddd t |dkrH|d | _ || g }|D ] } | d | qS|D ] } | d | j q_d |d } |st |d kst |dkr| t j dd| d || ||du rdn| || || || d |S )ax Generate new self-signed certificate. :type domains: `list` of `unicode` :param OpenSSL.crypto.PKey key: :param bool force_san: :param extensions: List of additional extensions to include in the cert. :type extensions: `list` of `OpenSSL.crypto.X509Extension` :type ips: `list` of (`ipaddress.IPv4Address` or `ipaddress.IPv6Address`) If more than one domain is provided, all of the domains are put into ``subjectAltName`` X.509 extension and first domain is set as the subject CN. If only one domain is provided no ``subjectAltName`` extension is used, unless `force_san` is ``True``. z7Must provide one or more hostnames or IPs for the cert. Ns basicConstraintsTs CA:TRUE, pathlen:0r rl rm rn ro rX rp Frq rt )r r! set_serial_numberrQ binasciihexlifyosurandomr ry r} rx r r set_issuerrz r{ r| r~ gmtime_adj_notBeforegmtime_adj_notAfterr r ) r; ri r r r r r r< r r ipr r r r gen_ss_cert\ sH r chainfiletypec s: dt tjtjf dtffdd d fdd| D S )zDump certificate chain into a bundle. :param list chain: List of `OpenSSL.crypto.X509` (or wrapped in :class:`josepy.util.ComparableX509`). :returns: certificate chain bundle :rtype: bytes r< r c s t | tjr | j} t | S r )r joseComparableX509wrappedr r )r< )r r r _dump_cert s z(dump_pyopenssl_chain.<locals>._dump_cert c 3 s | ]} |V qd S r r )r r< )r r r <genexpr> s z'dump_pyopenssl_chain.<locals>.<genexpr>)r r r r r! r r{ )r r r )r r r dump_pyopenssl_chain s " r )NFN)NNr TNN)2rB r r] ipaddressloggingr r rK typingr r r r r r r r josepyr OpenSSLr r acmer getLoggerr r0 SSLv23_METHODrP r r# r rQ rC r! rg rD IPv4Address IPv6Addressr rw r r r r r r} r rv r r r r r <module> s h 7 7 " "" &B