cert-utils 1.2.0__py3-none-any.whl

cert_utils/compat/pyopenssl.py

@@ -0,0 +1,207 @@
+"""
+Please don't use this.
+
+THIS ENTIRE FILE IS DEPRECATED, UNTESTED AND UNSUPPORTED.
+
+This is provided solely for legacy information as these operations are a bit
+more esoteric and not well documented elsewhere.
+
+Please use the other interfaces.
+"""
+
+import logging
+from types import ModuleType
+from typing import List
+from typing import Optional
+
+# locals
+from ..errors import OpenSslError
+from ..utils import split_pem_chain
+
+# conditional imports
+openssl_crypto: Optional[ModuleType]
+try:
+    from OpenSSL import crypto as openssl_crypto
+except ImportError:
+    openssl_crypto = None
+
+# logging
+log = logging.getLogger("cert_utils")
+log.setLevel(logging.INFO)
+
+# ==============================================================================
+
+
+def ensure_chain(
+    root_pem: str,
+    fullchain_pem: Optional[str] = None,
+    cert_pem: Optional[str] = None,
+    chain_pem: Optional[str] = None,
+    root_pems_other: Optional[List[str]] = None,
+) -> bool:
+    """
+    validates from a root down to a chain
+    if chain is a fullchain (with endentity), cert_pem can be None
+
+    THIS WILL RAISE ERRORS, NOT RETURN VALUES
+
+    submit EITHER fullchain_pem or chain_pem+cert_pem
+
+    :param root_pem: The PEM Encoded Root Certificate. Required.
+    :type root_pem: str
+    :param fullchain_pem: A full Certificate chain in PEM encoding, which
+        consists of a Leaf Certificate, and optionally multiple upstream certs in
+        a single string.
+        If provided:
+            * `:param:cert_pem` MUST NOT be provided
+            * `:param:chain_pem` MUST NOT be provided.
+    :type fullchain_pem: str
+    :param cert_pem: the EndEntity or Leaf Certificate.
+        If provided:
+            * `:param:chain_pem` MUST be provided
+            * `:param:fullchain_pem` MUST NOT be provided.
+    :type cert_pem: str
+    :param chain_pem: A Certificate chain in PEM format, which is multiple
+        upstream certs in a single string.
+        If provided:
+            * `:param:cert_pem` MUST be provided
+            * `:param:fullchain_pem` MUST NOT be provided.
+    :param root_pems_other: an iterable list of trusted roots certificates, in
+       PEM encoding; currently unused.
+    :returns: True
+    :rtype: bool
+
+
+    The OpenSSL Equivalent / Fallback is::
+
+    Modern versions of openssl accept multiple `-untrusted` arguments::
+
+        openssl verify -purpose sslserver -CAfile root.pem [[-untrusted intermediate.pem],[-untrusted intermediate.pem],] cert.pem
+
+    However older ones only want to see a single `-untrusted`::
+
+        openssl verify -purpose sslserver -CAfile root.pem -untrusted intermediate.pem cert.pem
+
+    To get around this, put all the intermediates into a single file.
+
+    This is a stopgap solution and needs to be refactored.
+
+    NOTE:
+        openssl does not care about the order of intermediates, so this should
+        be iteratively built up like the pure-python example
+    """
+    log.debug("ensure_chain >")
+    if fullchain_pem:
+        if chain_pem or cert_pem:
+            raise ValueError(
+                "If `ensure_chain` is invoked with `fullchain_pem`, do not pass in `chain_pem` or `cert_pem`."
+            )
+    else:
+        if not chain_pem or not cert_pem:
+            raise ValueError(
+                "If `ensure_chain` is not invoked with `fullchain_pem`, you must pass in `chain_pem` and `cert_pem`."
+            )
+
+    if fullchain_pem:
+        intermediates = split_pem_chain(fullchain_pem)
+        cert_pem = intermediates.pop(0)
+    else:
+        assert cert_pem
+        assert chain_pem
+        intermediates = split_pem_chain(chain_pem)
+        cert_pem = cert_pem.strip()  # needed to match regex results in above situation
+
+    # sometimes people submit things they should not
+    if intermediates[-1] == cert_pem:
+        intermediates = intermediates[:-1]
+
+    if not openssl_crypto:
+        raise ValueError("Requires pyopenssl")
+    # build a root storage
+    store = openssl_crypto.X509Store()
+    root_parsed = openssl_crypto.load_certificate(
+        openssl_crypto.FILETYPE_PEM, root_pem.encode()
+    )
+    store.add_cert(root_parsed)
+
+    for _intermediate_pem in reversed(intermediates):
+        _intermediate_parsed = openssl_crypto.load_certificate(
+            openssl_crypto.FILETYPE_PEM, _intermediate_pem.encode()
+        )
+        # Check the chain certificate before adding it to the store.
+        _store_ctx = openssl_crypto.X509StoreContext(store, _intermediate_parsed)
+        _store_ctx.verify_certificate()
+        store.add_cert(_intermediate_parsed)
+
+    cert_parsed = openssl_crypto.load_certificate(
+        openssl_crypto.FILETYPE_PEM, cert_pem.encode()
+    )
+    _store_ctx = openssl_crypto.X509StoreContext(store, cert_parsed)
+    _store_ctx.verify_certificate()
+    return True
+
+
+def ensure_chain_order(
+    chain_certs: List[str],
+    cert_pem: Optional[str] = None,
+) -> bool:
+    """
+    :param chain_certs: A list of PEM encoded Certificates. Required.
+    :type chain_certs: list
+    :param cert_pem: A PEM Encoded Certificate to test against the `chain_certs`.
+        Optional
+    :type cert_pem: str
+    :returns: bool
+    :rtype: None
+
+    The OpenSSL Equivalent / Fallback is::
+
+        /usr/local/bin/openssl verify -purpose sslserver -partial_chain -trusted {ROOT.pem} {CHAINREVERSED.pem}
+    """
+    log.debug("ensure_chain_order >")
+    if cert_pem:
+        chain_certs.append(cert_pem)
+    if len(chain_certs) < 2:
+        raise ValueError("must submit 2 or more chain certificates")
+    # reverse the cert list
+    # we're going to pretend the last item is a root
+    r_chain_certs = chain_certs[::-1]
+    if not openssl_crypto:
+        raise ValueError("Requires pyopenssl")
+    # TODO: openssl crypto does not seem to support partial chains yet
+    # as a stopgap, just look to ensure the issuer/subject match
+    """
+    # build a root storage
+    # pretend the first item is a root
+    store = openssl_crypto.X509Store()
+    root_pem = r_chain_certs.pop(0)
+    root_parsed = openssl_crypto.load_certificate(openssl_crypto.FILETYPE_PEM, root_pem)
+    store.add_cert(root_parsed)
+
+    for (idx, cert_pem) in enumerate(r_chain_certs):
+        # Check the chain certificate before adding it to the store.
+        try:
+            cert_parsed = openssl_crypto.load_certificate(openssl_crypto.FILETYPE_PEM, cert_pem)
+            _store_ctx = openssl_crypto.X509StoreContext(store, cert_parsed)
+            _store_ctx.verify_certificate()
+            store.add_cert(cert_parsed)
+        except openssl_crypto.X509StoreContextError as exc:
+            raise OpenSslError("could not verify: crypto")
+    """
+    # stash our data in here
+    parsed_certs = {}
+
+    # loop the certs
+    for idx, cert_pem in enumerate(r_chain_certs):
+        # everyone generates data
+        cert = openssl_crypto.load_certificate(
+            openssl_crypto.FILETYPE_PEM, cert_pem.encode()
+        )
+        parsed_certs[idx] = cert
+        if idx == 0:
+            continue
+        # only after the first cert do we need to check the last cert
+        upchain = parsed_certs[idx - 1]
+        if upchain.get_subject() != cert.get_issuer():
+            raise OpenSslError("could not verify: upchain does not match issuer")
+    return True

cert_utils/compat/signatures.py

@@ -0,0 +1,114 @@
+"""Small DER codecs for account signatures and OpenSSL public-key metadata.
+
+No Cryptography/josepy dependency. This is not a general ASN.1 implementation.
+"""
+
+import subprocess
+from typing import Optional
+from typing import Tuple
+
+import psutil
+
+from ..errors import OpenSslError_InvalidKey
+
+
+def _read(data: bytes, offset: int, tag: int) -> Tuple[bytes, int]:
+    if offset + 2 > len(data) or data[offset] != tag:
+        raise ValueError("invalid DER tag or truncated value")
+    length = data[offset + 1]
+    offset += 2
+    if length & 128:
+        count = length & 127
+        if count == 0 or count > 2 or offset + count > len(data):
+            raise ValueError("invalid DER length")
+        length_end = offset + count
+        encoded = data[offset:length_end]
+        length = int.from_bytes(encoded, "big")
+        if encoded[0] == 0 or length < 128:
+            raise ValueError("non-minimal DER length")
+        offset += count
+    end = offset + length
+    if end > len(data):
+        raise ValueError("truncated DER value")
+    return data[offset:end], end
+
+
+def _encode(tag: int, value: bytes) -> bytes:
+    length = len(value)
+    size = (length.bit_length() + 7) // 8
+    prefix = (
+        bytes([length])
+        if length < 128
+        else bytes([128 | size]) + length.to_bytes(size, "big")
+    )
+    return bytes([tag]) + prefix + value
+
+
+def raw_to_der(signature: bytes, width: int) -> bytes:
+    """Encode a fixed-width unsigned r||s signature as canonical DER."""
+    if width not in (32, 48, 66) or len(signature) != width * 2:
+        raise ValueError("invalid standardized EC signature length")
+    integers = []
+    for part in (signature[:width], signature[width:]):
+        part = part.lstrip(b"\x00") or b"\x00"
+        if part[0] & 128:
+            part = b"\x00" + part
+        integers.append(_encode(2, part))
+    return _encode(48, b"".join(integers))
+
+
+def der_to_raw(signature: bytes, width: int) -> bytes:
+    """Decode two canonical nonnegative DER integers, rejecting trailing data."""
+    if width not in (32, 48, 66) or len(signature) > 2 * width + 10:
+        raise ValueError("invalid EC signature size")
+    sequence, end = _read(signature, 0, 48)
+    if end != len(signature):
+        raise ValueError("trailing DER signature data")
+    offset = 0
+    parts = []
+    for _ in range(2):
+        part, offset = _read(sequence, offset, 2)
+        if not part or part[0] & 128:
+            raise ValueError("invalid DER signature integer")
+        if len(part) > 1 and part[0] == 0 and not part[1] & 128:
+            raise ValueError("non-minimal DER signature integer")
+        number = int.from_bytes(part, "big")
+        if number.bit_length() > width * 8:
+            raise ValueError("EC signature integer exceeds curve width")
+        parts.append(number.to_bytes(width, "big"))
+    if offset != len(sequence):
+        raise ValueError("extra DER signature components")
+    return b"".join(parts)
+
+
+def openssl_key_width(openssl: str, filepath: str) -> Optional[int]:
+    """Return None for RSA or EC component width, using only public metadata."""
+    with psutil.Popen(
+        [openssl, "pkey", "-in", filepath, "-pubout", "-outform", "DER"],
+        stdin=subprocess.DEVNULL,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+    ) as proc:
+        public, error = proc.communicate()
+        if proc.returncode:
+            raise OpenSslError_InvalidKey(error.decode("utf8", errors="replace"))
+    sequence, end = _read(public, 0, 48)
+    if end != len(public):
+        raise ValueError("trailing public key data")
+    algorithm, _ = _read(sequence, 0, 48)
+    oid, offset = _read(algorithm, 0, 6)
+    if oid == bytes.fromhex("2a864886f70d010101"):
+        return None
+    if oid != bytes.fromhex("2a8648ce3d0201"):
+        raise ValueError("unsupported private key type")
+    curve, end = _read(algorithm, offset, 6)
+    if end != len(algorithm):
+        raise ValueError("unsupported EC parameters")
+    widths = {
+        bytes.fromhex("2a8648ce3d030107"): 32,
+        bytes.fromhex("2b81040022"): 48,
+        bytes.fromhex("2b81040023"): 66,
+    }
+    if curve not in widths:
+        raise ValueError("unsupported EC curve")
+    return widths[curve]

cert_utils/conditionals.py

@@ -0,0 +1,121 @@
+# stdlib
+import logging
+import os
+import sys
+from types import ModuleType
+from typing import Any
+from typing import Callable
+from typing import Optional
+
+log = logging.getLogger("cert_utils")
+
+# ------------------------------------------------------------------------------
+
+"""
+Conditional Imports
+
+This package contains our conditional imports.
+
+DO NOT IMPORT FROM THIS PACKAGE.
+Instead, import this package and access the imports through it.
+
+The unit tests need to unset these packages to `None` to ensure fallback
+operations work correctly. If packages are imported from here, they may not
+be property unset in the unit_tests.
+
+BAD:
+    from .conditionals import cryptography
+    cert = cryptography.x509.load_pem_x509_certificate(
+        cert_pem.encode()
+    )
+
+GOOD:
+    from . import conditionals
+    cert = conditionals.cryptography.x509.load_pem_x509_certificate(
+        cert_pem.encode()
+    )
+
+
+"""
+cryptography: Optional[ModuleType]
+crypto_x509: Optional[ModuleType]
+crypto_hashes: Optional[ModuleType]
+crypto_padding: Optional[ModuleType]
+crypto_serialization: Optional[ModuleType]
+crypto_dsa: Optional[ModuleType]
+crypto_ec: Optional[ModuleType]
+crypto_ed25519: Optional[ModuleType]
+crypto_ed448: Optional[ModuleType]
+crypto_rsa: Optional[ModuleType]
+crypto_utils: Optional[ModuleType]
+EllipticCurvePublicKey: Optional[Any]
+RSAPublicKey: Optional[Any]
+crypto_pkcs7: Optional[ModuleType]
+josepy: Optional[ModuleType]
+
+# first cryptography
+try:
+    import cryptography
+    import cryptography.x509 as crypto_x509
+    from cryptography.hazmat.primitives import hashes as crypto_hashes
+    from cryptography.hazmat.primitives import padding as crypto_padding
+    from cryptography.hazmat.primitives import serialization as crypto_serialization
+    from cryptography.hazmat.primitives.asymmetric import dsa as crypto_dsa
+    from cryptography.hazmat.primitives.asymmetric import ec as crypto_ec
+    from cryptography.hazmat.primitives.asymmetric import ed25519 as crypto_ed25519
+    from cryptography.hazmat.primitives.asymmetric import ed448 as crypto_ed448
+    from cryptography.hazmat.primitives.asymmetric import rsa as crypto_rsa
+    from cryptography.hazmat.primitives.asymmetric import utils as crypto_utils
+    from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey
+    from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
+    from cryptography.hazmat.primitives.serialization import pkcs7 as crypto_pkcs7
+except ImportError:
+    cryptography = None
+    crypto_x509 = None
+    crypto_hashes = None
+    crypto_padding = None
+    crypto_serialization = None
+    crypto_dsa = None
+    crypto_ec = None
+    crypto_ed25519 = None
+    crypto_ed448 = None
+    crypto_rsa = None
+    crypto_utils = None
+    EllipticCurvePublicKey = None
+    RSAPublicKey = None
+    crypto_pkcs7 = None
+
+
+def is_josepy_compatible() -> bool:
+    # this code works with josepy 1 & 2
+    f_version: Callable
+    if sys.version_info < (3, 8):
+        # catch 3.7 and below
+        import importlib_metadata
+
+        f_version = importlib_metadata.version
+    else:
+        import importlib
+        import importlib.metadata
+
+        f_version = importlib.metadata.version
+
+    _v = f_version("josepy")
+    if int(_v.split(".")[0]) not in (1, 2):
+        _force = bool(int(os.environ.get("CERT_UTILS_FORCE_JOSEPY", "0")))
+        if not _force:
+            return False
+    return True
+
+
+# then josepy
+try:
+    import josepy
+
+    if not is_josepy_compatible():
+        log.critical("josepy might not be compatible; disabling")
+        log.critical("set env `CERT_UTILS_FORCE_JOSEPY=1` to bypass")
+        josepy = None  # noqa: F811
+except ImportError as exc:
+    log.critical("josepy ImportError %s", exc)
+    josepy = None