snowflake-connector-python 4.4.0__cp314-cp314-win_amd64.whl

snowflake/connector/tool/dump_ocsp_response.py

@@ -0,0 +1,139 @@
+#!/usr/bin/env python
+from __future__ import annotations
+
+import logging
+import sys
+import time
+from argparse import ArgumentParser, Namespace
+from time import gmtime, strftime
+
+from asn1crypto import ocsp as asn1crypto_ocsp
+
+from snowflake.connector.compat import urlsplit
+from snowflake.connector.ocsp_asn1crypto import SnowflakeOCSPAsn1Crypto as SFOCSP
+from snowflake.connector.ocsp_snowflake import OCSPTelemetryData
+from snowflake.connector.ssl_wrap_socket import _openssl_connect
+
+
+def _parse_args() -> Namespace:
+    parser = ArgumentParser(
+        prog="dump_ocsp_response",
+        description="Dump OCSP Response for the URLs (an internal tool).",
+    )
+    parser.add_argument(
+        "-o",
+        "--output-file",
+        required=False,
+        help="Dump output file",
+        type=str,
+        default=None,
+    )
+    parser.add_argument(
+        "--log-level",
+        required=False,
+        help="Log level",
+        choices=["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"],
+    )
+    parser.add_argument("--log-file", required=False, help="Log file", default=None)
+    parser.add_argument("urls", nargs="+", help="URLs to dump OCSP Response for")
+    return parser.parse_args()
+
+
+def main() -> None:
+    """Internal Tool: OCSP response dumper."""
+    args = _parse_args()
+    if args.log_level:
+        if args.log_file:
+            logging.basicConfig(
+                filename=args.log_file, level=getattr(logging, args.log_level.upper())
+            )
+        else:
+            logging.basicConfig(stream=sys.stdout, level=logging.DEBUG)
+    dump_ocsp_response(args.urls, output_filename=args.output_file)
+
+
+def dump_good_status(current_time, single_response) -> None:
+    print("This Update: {}".format(single_response["this_update"].native))
+    print("Next Update: {}".format(single_response["next_update"].native))
+    this_update = (
+        single_response["this_update"].native.replace(tzinfo=None) - SFOCSP.ZERO_EPOCH
+    ).total_seconds()
+    next_update = (
+        single_response["next_update"].native.replace(tzinfo=None) - SFOCSP.ZERO_EPOCH
+    ).total_seconds()
+
+    tolerable_validity = SFOCSP._calculate_tolerable_validity(this_update, next_update)
+    print(
+        "Tolerable Update: {}".format(
+            strftime("%Y%m%d%H%M%SZ", gmtime(next_update + tolerable_validity))
+        )
+    )
+    if SFOCSP._is_validaity_range(current_time, this_update, next_update):
+        print("OK")
+    else:
+        print(SFOCSP._validity_error_message(current_time, this_update, next_update))
+
+
+def dump_revoked_status(single_response) -> None:
+    revoked_info = single_response["cert_status"]
+    revocation_time = revoked_info.native["revocation_time"]
+    revocation_reason = revoked_info.native["revocation_reason"]
+    print(
+        "Revoked Time: {}".format(
+            revocation_time.strftime(SFOCSP.OUTPUT_TIMESTAMP_FORMAT)
+        )
+    )
+    print(f"Revoked Reason: {revocation_reason}")
+
+
+def dump_ocsp_response(urls, output_filename):
+    ocsp = SFOCSP()
+    for url in urls:
+        if not url.startswith("http"):
+            url = "https://" + url
+        parsed_url = urlsplit(url)
+        hostname = parsed_url.hostname
+        port = parsed_url.port or 443
+        connection = _openssl_connect(hostname, port)
+        cert_data = ocsp.extract_certificate_chain(connection)
+        current_time = int(time.time())
+        print(f"Target URL: {url}")
+        print(
+            "Current Time: {}".format(strftime("%Y%m%d%H%M%SZ", gmtime(current_time)))
+        )
+        for issuer, subject in cert_data:
+            _, _ = ocsp.create_ocsp_request(issuer, subject)
+            _, _, _, cert_id, ocsp_response_der = ocsp.validate_by_direct_connection(
+                issuer, subject, OCSPTelemetryData()
+            )
+            ocsp_response = asn1crypto_ocsp.OCSPResponse.load(ocsp_response_der)
+            print("------------------------------------------------------------")
+            print(f"Subject Name: {subject.subject.native}")
+            print(f"Issuer Name: {issuer.subject.native}")
+            print(f"OCSP URI: {subject.ocsp_urls}")
+            print(f"CRL URI: {subject.crl_distribution_points[0].native}")
+            print(f"Issuer Name Hash: {subject.issuer.sha1}")
+            print(f"Issuer Key Hash: {issuer.public_key.sha1}")
+            print(f"Serial Number: {subject.serial_number}")
+            print("Response Status: {}".format(ocsp_response["response_status"].native))
+            basic_ocsp_response = ocsp_response.basic_ocsp_response
+            tbs_response_data = basic_ocsp_response["tbs_response_data"]
+            print("Responder ID: {}".format(tbs_response_data["responder_id"].name))
+            current_time = int(time.time())
+            for single_response in tbs_response_data["responses"]:
+                cert_status = single_response["cert_status"].name
+                if cert_status == "good":
+                    dump_good_status(current_time, single_response)
+                elif cert_status == "revoked":
+                    dump_revoked_status(single_response)
+                else:
+                    print("Unknown")
+            print("")
+
+        if output_filename:
+            SFOCSP.OCSP_CACHE.write_ocsp_response_cache_file(ocsp, output_filename)
+    return SFOCSP.OCSP_CACHE
+
+
+if __name__ == "__main__":
+    main()

snowflake/connector/tool/dump_ocsp_response_cache.py

@@ -0,0 +1,194 @@
+#!/usr/bin/env python
+from __future__ import annotations
+
+import json
+import sys
+from datetime import datetime, timezone
+from glob import glob
+from os import path
+from time import gmtime, strftime, time
+
+from asn1crypto import core, ocsp
+from asn1crypto.x509 import Certificate
+from OpenSSL.crypto import FILETYPE_ASN1, dump_certificate
+
+from snowflake.connector.ocsp_asn1crypto import SnowflakeOCSPAsn1Crypto as SFOCSP
+from snowflake.connector.ssl_wrap_socket import _openssl_connect
+
+ZERO_EPOCH = datetime.fromtimestamp(0, timezone.utc).replace(tzinfo=None)
+
+OCSP_CACHE_SERVER_INTERVAL = 20 * 60 * 60  # seconds
+
+
+def main() -> None:
+    """Internal Tool: Dump OCSP response cache file."""
+
+    def help() -> None:
+        print(
+            "Dump OCSP Response cache. This tools extracts OCSP response "
+            "cache file, i.e., ~/.cache/snowflake/ocsp_response_cache. "
+            "Note the subject name shows up if the certificate exists in "
+            "the certs directory."
+        )
+        print(
+            """
+Usage: {}  <ocsp response cache file> <hostname file> <cert file glob pattern>
+""".format(
+                path.basename(sys.argv[0])
+            )
+        )
+        sys.exit(2)
+
+    if len(sys.argv) < 4:
+        help()
+        sys.exit(2)
+
+    ocsp_response_cache_file = sys.argv[1]
+    if not path.isfile(ocsp_response_cache_file):
+        help()
+        sys.exit(2)
+
+    hostname_file = sys.argv[2]
+    cert_glob_pattern = sys.argv[3]
+    dump_ocsp_response_cache(ocsp_response_cache_file, hostname_file, cert_glob_pattern)
+
+
+def raise_old_cache_exception(current_time, created_on, name, serial_number):
+    raise Exception(
+        "ERROR: OCSP response cache is too old. created_on "
+        "should be newer than {}: "
+        "name: {}, serial_number: {}, "
+        "current_time: {}, created_on: {}".format(
+            strftime(
+                SFOCSP.OUTPUT_TIMESTAMP_FORMAT,
+                gmtime(current_time - OCSP_CACHE_SERVER_INTERVAL),
+            ),
+            name,
+            serial_number,
+            strftime(SFOCSP.OUTPUT_TIMESTAMP_FORMAT, gmtime(current_time)),
+            strftime(SFOCSP.OUTPUT_TIMESTAMP_FORMAT, gmtime(created_on)),
+        )
+    )
+
+
+def raise_outdated_validity_exception(
+    current_time, name, serial_number, this_update, next_update
+):
+    raise Exception(
+        "ERROR: OCSP response cache include "
+        "outdated data: "
+        "name: {}, serial_number: {}, "
+        "current_time: {}, this_update: {}, "
+        "next_update: {}".format(
+            name,
+            serial_number,
+            strftime(SFOCSP.OUTPUT_TIMESTAMP_FORMAT, gmtime(current_time)),
+            this_update.strftime(SFOCSP.OUTPUT_TIMESTAMP_FORMAT),
+            next_update.strftime(SFOCSP.OUTPUT_TIMESTAMP_FORMAT),
+        )
+    )
+
+
+def dump_ocsp_response_cache(
+    ocsp_response_cache_file, hostname_file, cert_glob_pattern
+) -> None:
+    """Dump OCSP response cache contents.
+
+    Show the subject name as well if the subject is included in the certificate files.
+    """
+    sfocsp = SFOCSP()
+    s_to_n = _fetch_certs(hostname_file)
+    s_to_n1 = _serial_to_name(sfocsp, cert_glob_pattern)
+    s_to_n.update(s_to_n1)
+
+    SFOCSP.OCSP_CACHE.read_ocsp_response_cache_file(sfocsp, ocsp_response_cache_file)
+
+    def custom_key(k):
+        # third element is Serial Number for the subject
+        serial_number = core.Integer.load(k[2])
+        return int(serial_number.native)
+
+    output = {}
+    ocsp_validation_cache = SFOCSP.OCSP_CACHE.CACHE
+    for hkey in sorted(ocsp_validation_cache, key=custom_key):
+        json_key = sfocsp.encode_cert_id_base64(hkey)
+
+        serial_number = core.Integer.load(hkey[2]).native
+        if int(serial_number) in s_to_n:
+            name = s_to_n[int(serial_number)]
+        else:
+            name = "Unknown"
+        output[json_key] = {
+            "serial_number": format(serial_number, "d"),
+            "name": name,
+        }
+        value = ocsp_validation_cache[hkey]
+        cache = value[1]
+        ocsp_response = ocsp.OCSPResponse.load(cache)
+        basic_ocsp_response = ocsp_response.basic_ocsp_response
+
+        tbs_response_data = basic_ocsp_response["tbs_response_data"]
+
+        current_time = int(time())
+        for single_response in tbs_response_data["responses"]:
+            created_on = int(value[0])
+            produce_at = tbs_response_data["produced_at"].native
+            this_update = single_response["this_update"].native
+            next_update = single_response["next_update"].native
+            if current_time - OCSP_CACHE_SERVER_INTERVAL > created_on:
+                raise_old_cache_exception(current_time, created_on, name, serial_number)
+
+            next_update_utc = (
+                next_update.replace(tzinfo=None) - ZERO_EPOCH
+            ).total_seconds()
+            this_update_utc = (
+                this_update.replace(tzinfo=None) - ZERO_EPOCH
+            ).total_seconds()
+
+            if current_time > next_update_utc or current_time < this_update_utc:
+                raise_outdated_validity_exception(
+                    current_time, name, serial_number, this_update, next_update
+                )
+
+            output[json_key]["created_on"] = strftime(
+                SFOCSP.OUTPUT_TIMESTAMP_FORMAT, gmtime(created_on)
+            )
+            output[json_key]["produce_at"] = str(produce_at)
+            output[json_key]["this_update"] = str(this_update)
+            output[json_key]["next_update"] = str(next_update)
+    print(json.dumps(output))
+
+
+def _serial_to_name(sfocsp, cert_glob_pattern):
+    """Creates a map table from serial number to name."""
+    map_serial_to_name = {}
+    for cert_file in glob(cert_glob_pattern):
+        cert_map = {}
+        sfocsp.read_cert_bundle(cert_file, cert_map)
+        cert_data = sfocsp.create_pair_issuer_subject(cert_map)
+
+        for _, subject in cert_data:
+            map_serial_to_name[subject.serial_number] = subject.subject.native
+
+    return map_serial_to_name
+
+
+def _fetch_certs(hostname_file):
+    with open(hostname_file) as f:
+        hostnames = f.read().split("\n")
+
+    map_serial_to_name = {}
+    for h in hostnames:
+        if not h:
+            continue
+        connection = _openssl_connect(h, 443)
+        for cert_openssl in connection.get_peer_cert_chain():
+            cert_der = dump_certificate(FILETYPE_ASN1, cert_openssl)
+            cert = Certificate.load(cert_der)
+            map_serial_to_name[cert.serial_number] = cert.subject.native
+
+    return map_serial_to_name
+
+
+if __name__ == "__main__":
+    main()

snowflake/connector/tool/probe_connection.py

@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+from socket import gaierror, gethostbyname_ex
+
+from asn1crypto import ocsp
+from OpenSSL.crypto import FILETYPE_ASN1, dump_certificate
+
+from ..compat import urlsplit
+from ..ssl_wrap_socket import _openssl_connect
+
+
+def probe_connection(url):
+    parsed_url = urlsplit(url)
+
+    # DNS lookup
+    try:
+        actual_hostname, aliases, ips = gethostbyname_ex(parsed_url.hostname)
+        ret = {
+            "url": url,
+            "input_hostname": parsed_url.hostname,
+            "actual_hostname": actual_hostname,
+            "aliases": aliases,
+            "ips": ips,
+        }
+    except gaierror as e:
+        return {"err:": e}
+    connection = _openssl_connect(parsed_url.hostname, parsed_url.port)
+
+    # certificates
+    certificates = []
+    for cert_openssl in connection.get_peer_cert_chain():
+        cert_der = dump_certificate(FILETYPE_ASN1, cert_openssl)
+        cert = ocsp.Certificate.load(cert_der)
+        ocsp_uris = cert.ocsp_urls
+
+        if len(ocsp_uris) == 1:
+            parsed_ocsp_url = urlsplit(ocsp_uris[0])
+
+            # DNS lookup for OCSP server
+            try:
+                actual_hostname, aliases, ips = gethostbyname_ex(
+                    parsed_ocsp_url.hostname
+                )
+                ocsp_status = {
+                    "input_url": ocsp_uris[0],
+                    "actual_hostname": actual_hostname,
+                    "aliases": aliases,
+                    "ips": ips,
+                }
+            except gaierror as e:
+                ocsp_status = {
+                    "input_url": ocsp_uris[0],
+                    "error": e,
+                }
+        else:
+            ocsp_status = {}
+
+        certificates.append(
+            {
+                "hash": cert.subject.sha1,
+                "name": cert.subject.native,
+                "issuer": cert.issuer.native,
+                "serial_number": cert.serial_number,
+                "ocsp": ocsp_status,
+            }
+        )
+
+    ret["certificates"] = certificates
+    return ret

snowflake/connector/url_util.py

@@ -0,0 +1,55 @@
+from __future__ import annotations
+
+import re
+import urllib.parse
+from logging import getLogger
+from typing import Iterable
+
+from .constants import _TOP_LEVEL_DOMAIN_REGEX
+from .vendored import requests
+
+logger = getLogger(__name__)
+
+
+URL_VALIDATOR = re.compile(
+    "^http(s?)\\:\\/\\/[0-9a-zA-Z]([-.\\w]*[0-9a-zA-Z@:])*(:(0-9)*)*(\\/?)([a-zA-Z0-9\\-\\.\\?\\,\\&\\(\\)\\/\\\\\\+&%\\$#_=@:]*)?$"
+)
+
+
+def is_valid_url(url: str) -> bool:
+    """Confirms if the provided URL is a valid HTTP/ HTTPs URL
+
+    Args:
+        url: the URL that needs to be validated
+
+    Returns:
+        true/ false depending on whether the URL is valid or not
+    """
+    return bool(URL_VALIDATOR.match(url))
+
+
+def url_encode_str(target: str | None) -> str:
+    """Converts a target string into escaped URL safe string
+
+    Args:
+        target: string to be URL encoded
+
+    Returns:
+        URL encoded string
+    """
+    if target is None:
+        logger.debug("The string to be URL encoded is None")
+        return ""
+    return urllib.parse.quote_plus(target, safe="")
+
+
+def extract_top_level_domain_from_hostname(hostname: str | None = None) -> str:
+    if not hostname:
+        return "com"
+    # RFC1034 for TLD spec, and https://data.iana.org/TLD/tlds-alpha-by-domain.txt for full TLD list
+    match = re.search(_TOP_LEVEL_DOMAIN_REGEX, hostname)
+    return (match.group(0)[1:] if match else "com").lower()
+
+
+def should_bypass_proxies(url: str | bytes, no_proxy: Iterable[str] | None) -> bool:
+    return requests.utils.should_bypass_proxies(url, no_proxy)