kjfzddlZddlZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddl mZddl mZddl mZddl mZddlZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlmZddlmZddl m!Z!ddl m"Z"ddl#m$Z$ejJdkrddl&m'Z'nddlm'Z'ejPe)Z*ejVdZ,ejVdZ-ejVdZ.ejVdZ/dZ0Gdde$jbZ2dejfde4e5e6e6ffd Z7d!e6d"e6d#e8de5ejrejtffd$Z;d%eejxe4e6zdejzfd&Z> d7d'ej~d(ejtd)e6dzd%eejxd!e6dzd*e6dzde2fd+Z@d'ej~d(ejtdeAfd,ZBe d-.Gd/d0ZCe6ZDe5ee6ejzfZEeeDeEfZFed1eAZGGd2d3ZHd4eAd5eAdzdej~fd6ZIy)8N)Iterable) dataclass)Path)cast)NewType)Optional)Union)x509)hashes) serialization)dsa)ec)rsa)CertificatePublicKeyTypes)pkcs12)ExtendedKeyUsageOID)NameOID) serializable) ) deprecatediB)dayss -----BEGIN DH PARAMETERS----- MIICCAKCAgEAyT6LzpwVFS3gryIo29J5icvgxCnCebcdSe/NHMkD8dKJf8suFCg3 O2+dguLakSVif/t6dhImxInJk230HmfC8q93hdcg/j8rLGJYDKu3ik6H//BAHKIv j5O9yjU3rXCfmVJQic2Nne39sg3CreAepEts2TvYHhVv3TEAzEqCtOuTjgDv0ntJ Gwpj+BJBRQGG9NvprX1YGJ7WOFBP/hWU7d6tgvE6Xa7T/u9QIKpYHMIkcN/l3ZFB chZEqVlyrcngtSXCROTPcDOQ6Q8QzhaBJS+Z6rcsd7X+haiQqvoFcmaJ08Ks6LQC ZIL2EtYJw8V8z7C0igVEBIADZBI6OTbuuhDwRw//zU1uq52Oc48CIZlGxTYG/Evq o9EWAXUYVzWkDSTeBH1r4z/qLPE2cnhtMxbFxuvK53jGB0emy2y1Ei6IhKshJ5qX IB/aE7SSHyQ3MDHHkCmQJCsOd4Mo26YX61NZ+n501XjqpCBQ2+DfZCBh8Va2wDyv A2Ryg9SUz8j0AXViRNMJgJrr446yro/FuJZwnQcO3WQnXeqSBnURqKjmqkeFP+d8 6mk2tqJaY507lRNqtGlLnj7f5RNoBFJDCLBNurVgfvq9TCVWKDIFD4vZRjCrnl6I rD693XKIHUCWOjMh1if6omGXKHH40QuME2gNa50+YPn1iYDl88uDbbMCAQI= -----END DH PARAMETERS----- ceZdZUdZej ed<dej fdZdZdZ dZ e dZ d Z d Ze d ed dfd Zd efdZe dej&j(d dfdZedd ej&j(fdZd ej fdZd efdZd efdZed eeeeffdZ ed e!jBfdZ"ed e!jBfdZ#d e$fdZ%ed eeeeffdZ&ed e'fdZ(ed e$fdZ)ed eee'ffdZ*ed edzfdZ+ed edzfd Z,ed ejZfd!Z.ed eefd"Z/y)#Certz&Representation of a (TLS) certificate._certcertcJt|tjsJ||_yN) isinstancer Certificater)selfrs X/home/ubuntu/.cache/pipx/cdb5059130eadca/lib/python3.12/site-packages/mitmproxy/certs.py__init__z Cert.__init__Es$ 0 0111 cD|j|jk(Sr!) fingerprint)r$others r%__eq__z Cert.__eq__Is!U%6%6%888r'c|jDcgc]}t|j}}d|jd|dScc}w)Nz )altnamesstrvaluecn)r$xr-s r%__repr__z Cert.__repr__Ls?*.--8QCL88477+[ B??9sAc6|jjSr!)r__hash__r$s r%r4z Cert.__hash__Pszz""$$r'c$|j|Sr!)from_pem)clsstates r% from_statezCert.from_stateSs||E""r'c"|jSr!)to_pemr5s r% get_statezCert.get_stateWs{{}r'c8tj||_yr!)r load_pem_x509_certificater)r$r9s r% set_statezCert.set_stateZs33E: r'datareturnc<tj|}||Sr!)r r?)r8rArs r%r7z Cert.from_pem]s--d34yr'ch|jjtjjSr!)r public_bytesr EncodingPEMr5s r%r<z Cert.to_pembs#zz&&}'='='A'ABBr'r c6t|jSr!)rto_cryptography)r$r s r%from_pyopensslzCert.from_pyopenssles(D((*++r'zUse `to_cryptography` instead.chtjjj|jSr!)OpenSSLcryptoX509from_cryptographyrr5s r% to_pyopensslzCert.to_pyopensslis!~~""44TZZ@@r'c|jSr!)rr5s r%rIzCert.to_cryptographyms zzr'c6|jjSr!)r public_keyr5s r%rSzCert.public_keypszz$$&&r'c\|jjtjSr!)rr)r SHA256r5s r%r)zCert.fingerprintsszz%%fmmo66r'c@t|jjSr!)_name_to_keyvalrissuerr5s r%rXz Cert.issuervstzz0011r'c |jjS#t$r7|jjj t j cYSwxYwN)tzinfo)rnot_valid_before_utcAttributeErrornot_valid_beforereplacedatetimeUTCr5s r% notbeforezCert.notbeforezsK L::22 2 L::..66hll6K K L=AAc |jjS#t$r7|jjj t j cYSwxYwrZ)rnot_valid_after_utcr]not_valid_afterr_r`rar5s r%notafterz Cert.notaftersK K::11 1 K::--55X\\5J J Krcctjdkr:tjjtj|j kDStjjtj|j kDS)N)r )sys version_infor`nowrargr5s r% has_expiredzCert.has_expiredsX   g %$$((6F F  $$X\\2T]]BBr'c@t|jjSr!)rWrsubjectr5s r%roz Cert.subjectstzz1122r'c.|jjSr!)r serial_numberr5s r%serialz Cert.serialszz'''r'c |jjjtjj }|j S#tj$rYywxYw)NF)r extensionsget_extension_for_classr BasicConstraintsr/caExtensionNotFound)r$ constraintss r%is_caz Cert.is_casV **//GG%%e >> !%%  sAA A! A!c|jj}t|tjrd|j fSt|t jrd|j fSt|tjr&d|jjd|j fS|jjjddjddt|dd fS) NRSADSAzEC () PublicKey_key_size)rrSr"r RSAPublicKeyrr DSAPublicKeyrEllipticCurvePublicKeycurvename __class____name__r_getattr)r$rSs r%keyinfoz Cert.keyinfosZZ**, j#"2"2 3*--- - j#"2"2 3*--- - j"";"; <***//02J4G4GG G  ) ) 1 1+r B J J3PR S J B /  r'Nc|jjjtjj }|rt t|djSyNr) rroget_attributes_for_oidr r COMMON_NAMErr.r/r$attrss r%r0zCert.cnsA ""99$,,:R:RS U1X^^, ,r'c|jjjtjj }|rt t|djSyr) rrorr rORGANIZATION_NAMErr.r/rs r% organizationzCert.organizationsF ""99 LL * *  U1X^^, ,r'c |jjjtjj }tj |S#tj$rtj gcYSwxYw)z> Get all SubjectAlternativeName DNS altnames. )rrtrur SubjectAlternativeNamer/ GeneralNamesrx)r$sanss r%r-z Cert.altnamessm  +::((@@++e  $$T* *%% )$$R( ( )s=A(A?>A?cr |jjjtjj }|Dcgc]N}|j r@t|j dtjr|j dj Pc}Scc}w#tj$rgcYSwxYwr) rrtrur CRLDistributionPointsr/ full_namer"UniformResourceIdentifierrx)r$ext dist_points r%crl_distribution_pointszCert.crl_distribution_pointss **''??**e #&''z33A68V8VW$$Q'-- %% I s=BABB65B6)0r __module__ __qualname____doc__r r#__annotations__r&r+r2r4 classmethodr:r=r@bytesr7r<rLrMrNrJrrPrIrrSr)propertylisttupler.rXr`rbrgboolrmrointrrrzrr0rrr-rr'r%rr@s0   T--9@%##;EfCC,7>>#6#6,6,,01Agnn11A2A!1!1'5'7U72U38_-22L8,,LLK(++KK CTC 3eCHo.33(((t  sCx    C$J cDj +$++ + + c  r'rrrBcg}|D]Q}|jjdd}tt|j}|j ||fS|S)N=r)rfc4514_string partitionrr.r/append)rpartsattrkvs r%rWrWs[ E    ! + +C 0 3 djj ! aV Lr'rr0rc ftjj}tjd|}t j t j tj|t j tj|g}t j}|jt j}|j|}|j|tz}|j!|tzt"z}|j%|}|j'|j'}|j)t j*ddd}|j)t j,t.j0gd}|j)t j2ddddddddd d}|j)tj4j7|j'd}|j9|t;j<}||fS) Ni)public_exponentrT)rw path_lengthcriticalF) digital_signaturecontent_commitmentkey_enciphermentdata_encipherment key_agreement key_cert_signcrl_sign encipher_only decipher_only private_key algorithm)r`rlrgenerate_private_keyr Name NameAttributerrrCertificateBuilderrqrandom_serial_number subject_namer^CERT_VALIDITY_OFFSETrf CA_EXPIRY issuer_namerS add_extensionrvExtendedKeyUsager SERVER_AUTHKeyUsageSubjectKeyIdentifierfrom_public_keysignr rU)rr0rrlrrbuilderrs r% create_cars      !C**K 99   w22B 7   w88, G  D %%'G##D$=$=$?@G""4(G&&s-A'ABG%%c,@&@9&LMG!!$'G  !7!7!9:G## 484$G## 2>>?@5$G## #$"# $ G## !!11+2H2H2JK$G <tj|Stjtt$tj&|S#t$rF|jdj!}|jtj"|YwxYw)z SANs used to be a list of strings in mitmproxy 10.1 and below, but now they're a list of GeneralNames. This function converts the old format to the new one. rz0Passing SANs as a list of strings is deprecated.) stacklevelidna)r"r rrlenr.warningswarnDeprecationWarningr ipaddress ip_addressr IPAddress ValueErrorencodedecodeDNSNamer GeneralName)rssr1ips r%_fix_legacy_sansrs $))* 43t9q=ZQ5M >  &(d3i& .A .))!,  $..,- .  $$  ht/?/?&@$!GHH +HHV$++- $,,q/* +sD  A EEprivkeycacert commonnamecrl_urlc tj}|j|j}|j tj t jgd}|j|j}tjj}|j|tz}|j|tztz}g}|duxrt|dk} | r7|J|j!tj"t$j&||7|J|j!tj"t$j(||j+tj,|}|j/tj0}|j tj2t5|| } |j6j9tj:j<} tj>jA| } |j | d}|rR|j tjFtjHtjJ|gdddgd}|jM|tOjP} tS| S#tjB$r0tj>jE|j} YwxYw)am Generates a dummy certificate. privkey: CA private key cacert: CA certificate commonname: Common name for the generated certificate. sans: A list of Subject Alternate Names. organization: Organization name for the generated certificate. crl_url: URL of CRL distribution point Returns cert if operation succeeded, None if not. FrN@) relative_name crl_issuerreasonsr)*r rrrorrrrrSr`rlr^rrf CERT_EXPIRYrrrrrrrrrqrrrrtrurr/AuthorityKeyIdentifier"from_issuer_subject_key_identifierrxfrom_issuer_public_keyrDistributionPointrrr rUr) rrrrrrrrlrois_valid_commonname issuer_skiakirs r% dummy_certr:s(%%'G!!&..1G## 2>>?@5$G  !2!2!45G      !C&&s-A'ABG%%c,@&@;&NOGG$D0IS_r5I%%%t))'*=*=zJK'''t))'*C*C\RS""499W#56G##D$=$=$?@G## ##$4T$:;(($G V&&>>  % % % ))LLZX ##C%#8G ''  & &**77@A&*#' $  (   <&-JJ3JR00r'c#Ktjd}tj|dz dtj|y#tj|wxYww)z Context to temporarily set umask to its original value bitor 0o77. Useful when writing private keys to disk so that only the owner will be able to read them. r?N)osumask)original_umasks r% umask_secretzCertStore.umask_secret#sF! $&' %  HH^ $BHH^ $s.A%A A% A""A%c |jdd|xs|}|xs|}t|||\}}tj5||dz j |j t jjt jjt j|jt jjz||dz j tj|j||dt jddd|jt jj}||dz j |||d z j |||d z j tj|jd|dt j||d z j t y#1swYxYw) NT)parentsexist_ok)rr0rr<)encodingformatencryption_algorithmz-ca.p12)rrGrcasrSz -ca-cert.pemz -ca-cert.cerz -ca-cert.p12r=)mkdirrrrMr) private_bytesr rFrG PrivateFormatTraditionalOpenSSL NoEncryptionrErserialize_key_and_certificatesrr*)r%r9rrr0rGrwpem_certs r%r>zCertStore.create_store2s 4$ /#/x ^8"xPR # # %  xj( ( 5 5!!*3377(66II)6)C)C)E" //-"8"8"<"<= > xj( ( 5 555!*)6)C)C)E   .??=#9#9#=#=> 8*L) )66x@ 8*L) )66x@ 8*L) )66  1 1__&%2%?%?%A    8*L) )66GO  s C%G44G=specc T|j}tj|} t||}|j |j k7r>t d|j d|j d|j  tj|Dcgc] }t|} }|jr'tjd|j d |jt|||| |y#t $rW}|j}|j |j k7r t d|j d||Yd}~d}~wwxYwcc}w#t $r%}tjd||g} Yd}~d}~wwxYw) N)passwordzPrivate and public keys in "z"" do not match: cert.public_key()=z private_key.public_key()=zUnable to find private key in "z": z"Failed to read certificate chain: "z" is a certificate authority and not a leaf certificate. This indicates a misconfiguration, see https://docs.mitmproxy.org/stable/concepts-certificates/.)rrr7rErSrabsoluterr rloggerwarningrzadd_certr ) r$r\r%r:rFrrer1chains r% add_cert_filezCertStore.add_cert_fileisoo}}S! .sZHK K$:$:$<< 24==?2CD*(*+1"--/13  &*&E&Ec&JKT!WKEK :: NNDMMO$%st  nT;eDdK5 11K K$:$:$<< 5dmmo5Fc!M= L  NN?sC DFE sB DE9+E4=E9 E1A E,,E14E99 F'F""F'namesc|jjr#||j|jj<|jjD]$}||jt |j <&|D]}||j|<y)z Adds a cert to the certstore. We register the CN in the cert plus any SANs, and also the list of names provided as an argument. N)rr0rr-r.r/)r$rrgis r%rczCertStore.add_certsp ::==(-DJJuzz}} %$$ -A',DJJs177| $ - "A!DJJqM "r'dnc lt|trV|jd}|g}tdt |D](}|j ddj ||dz*|St|tjrtj|jSt|jgS)z Return all asterisk forms for a domain. For example, for www.example.com this will return [b"www.example.com", b"*.example.com", b"*.com"]. The single wildcard "*" is omitted. .rDz*.N) r"r.splitrangerrjoinr rrasterisk_formsr/)rjrretris r%rpzCertStore.asterisk_formss b# HHSME$C1c%j) 7 4#((59"556 7J DLL )++BHH5 5M? "r'rrrrc Jt|}g}|r |jj||D]"}|jj|$|jd|j||ft t fd|d}|rj |}|Sttjjj||||jjj}|j ||f<j||S)a2 commonname: Common name for the generated certificate. Must be a valid, plain-ASCII, IDNA-encoded domain name. sans: A list of Subject Alternate Names. organization: Organization name for the generated certificate. crl_url: URL of CRL distribution point *c |jvSr!)r)rGr$s r%z$CertStore.get_cert..ssdjj'8r'N)rr r r )rextendrprnextfilterrr rrrrrrr$) r$rrrrpotential_keyssrrs ` r%get_certzCertStore.get_certs" %(*   ! !$"5"5j"A B :A  ! !$"5"5a"8 9 :c"z401F8.I4P JJt$E$ !#++OO))   2222 44 E.3DJJ D) * KK  r'r!NN)$rrrrr rr rrrrrdictTCertIdr rr&r$ staticmethodr8rr.rrBr? contextlibcontextmanagerrMr>rfrcr rrprr{rr'r%rrsI)))t #d# ' ((~&&--!4K     4INItI 747H77. $( ASj A A A DL A  A AKO 1 1*. 1rs $!18989U?1%,g,#   8 $ H  H -  h  c* X  Q ' )x))r2"\< $ $\~$))U38_(=11 11 3 - -t/?/? ?@ 1hI8D$4$45S AIdFWFWIF $ Z   Z   Zd Z 4## $ Z * Z 4Z Z Zz8   8   8 80 $ #(9(99:  // 0 :u %ZZz u  ARAR r'