ó Y[c@s†dZddlZddlZddlmZmZddlmZddlmZej e ƒZ de fd„ƒYZ d„ZdS( s*Tools for checking certificate revocation.iÿÿÿÿN(tPopentPIPE(terrors(tutiltRevocationCheckercBs)eZdZd„Zd„Zd„ZRS(sEThis class figures out OCSP checking on this system, and performs it.cCsœt|_tjdƒs2tjdƒt|_dStdddddgdtdtd tƒ}|j ƒ\}}d |krŒd „|_ n d „|_ dS( Ntopenssls-openssl not installed, can't check revocationtocsps-headertvartvaltstdouttstderrtuniversal_newliness Missing =cSs d|gS(NsHost=((thost((s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pytscSs d|gS(NtHost((R ((s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pyR s( tFalsetbrokenRt exe_existstloggertinfotTrueRRt communicatet host_args(tselfttest_host_formatt_outterr((s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pyt__init__s    cCsì|jr tS|j|ƒ\}}|s,tSdddd|d|d|d|d|d d g|j|ƒ}tjd |ƒtjd j|ƒƒy"tj|d tjƒ\}}Wn%t j k rÛtj d|ƒtSXt |||ƒS(s;Get revoked status for a particular cert version. .. todo:: Make this a non-blocking call :param str cert_path: Path to certificate :param str chain_path: Path to intermediate cert :rtype bool or None: :returns: True if revoked; False if valid or the check failed RRs -no_nonces-issuers-certs-urls-CAfiles -verify_others -trust_others-headersQuerying OCSP for %st tlogs*OCSP check failed for %s (are we offline?)( RRtdetermine_ocsp_serverRRtdebugtjoinRt run_scriptRtSubprocessErrorRt_translate_ocsp_query(Rt cert_patht chain_pathturlR tcmdtoutputR((s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pyt ocsp_revoked!s, "cCs¯y4tjddd|ddgdtjƒ\}}Wn%tjk r[tjd|ƒd SX|jƒ}|j dƒd jd ƒ}|r”||fStjd ||ƒdSd S(sÞExtract the OCSP server host from a certificate. :param str cert_path: Path to the cert we're checking OCSP for :rtype tuple: :returns: (OCSP server URL or None, OCSP server host or None) Rtx509s-ins-noouts -ocsp_uriRsCannot extract OCSP URI from %ss://it/s4Cannot process OCSP host from URL (%s) in cert at %sN(NN(NN( RR!RRRR"RtNonetrstript partition(RR$R&t_errR ((s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pyRHs  (t__name__t __module__t__doc__RR)R(((s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pyR s  'c sd }g|D]}dj||ƒ^q }‡fd†|Dƒ\}}}|r_|jdƒnd } d|ksƒ|r}| sƒ|rªtjd|ƒtjd ˆ|ƒtS|r»| r»tS|rí|jdƒ} | rétjd | ƒntStjd ˆ|ƒtSd S(s7Parse openssl's weird output to work out what it means.tgoodtrevokedtunknowns{0}: (WARNING.*)?{1}c3s*|] }tj|ˆdtjƒVqdS(tflagsN(tretsearchtDOTALL(t.0tp(t ocsp_output(s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pys esisResponse verify OKs#Revocation status for %s is unknownsUncertain output: %s stderr: %ssOCSP revocation warning: %ss2Unable to properly parse OCSP output: %s stderr:%sN(sgoodsrevokedsunknown( tformattgroupR,RRRRRtwarn( R$R<t ocsp_errorststateststpatternsR3R4R5twarning((R<s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pyR#`s$%   (R2tloggingR7t subprocessRRtcertbotRRt getLoggerR0RtobjectRR#(((s0/usr/lib/python2.7/dist-packages/certbot/ocsp.pyts  T