
    M}bgE                    N   d Z ddlmZ ddlZddlZddlmZ ddlm	Z	 ddl
mZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ddl!m"Z# ddl$m%Z& ddl'm(Z) ddl*m+Z, ddl*m-Z. ddl/m0Z1 ddl/m2Z3 ddl4m5Z6 ddl4m7Z8 ddl4m9Z: ddl4m;Z< ddl4m=Z> ddl4m?Z@ ddlAmBZC ddlAmDZE ddlAmFZG ddlAmHZI ddlJmKZL ddlJmMZN dd lOmPZQ dd!lRmSZT dd"lUmVZV erzdd#lWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^ dd$l_m`Z` dd%l*maZa dd&l4mbZbmcZc dd'ldmeZemfZf dd(lAmgZgmhZh dd)limjZj dd*lkmlZl dd+lmmnZn eeXj        e\j"        eYj        e[jo        eZjp        e^j(        e]j%        f         Zq ejr        es          Zt eju        d,ejv                  Zwdcd1Zxddd9ZydedBZzdfdFZ{dgdGZ|dhdLZ}didOZ~djdRZdkdTZdjdUZdld[ZdmdbZdS )nz4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)load_pem_x509_certificate)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+cafilestrreturnlist[Certificate]c                   t          | d          5 }|                                }ddd           n# 1 swxY w Y   g }t                      }t          j        t
          |          D ]%}|                    t          ||                     &|S )z0Parse the tlsCAFile into a list of certificates.rbN)openread_default_backend_refindall_CERT_REGEXappend_load_pem_x509_certificate)r9   fdatatrusted_ca_certsbackend	cert_datas         g/home/e360mart.nyusoft.in/public_html/e360mart_env/lib/python3.11/site-packages/pymongo/ocsp_support.py_load_trusted_ca_certsrM   h   s    	fd		 qvvxx                 G[d33 P P	 :9g N NOOOOs   266certr0   chainIterable[Certificate]rI   Optional[list[Certificate]]Optional[Certificate]c                h    | j         }|D ]}|j        |k    r|c S |r|D ]}|j        |k    r|c S d S N)issuersubject)rN   rO   rI   issuer_name	candidates        rL   _get_issuer_certrY   u   sv     +K  	++ ,  !) 	! 	!I K//     04    keyCertificateIssuerPublicKeyTypes	signaturebytes	algorithm%Union[Prehashed, HashAlgorithm, None]rH   intc                   	 t          | t                    r%|                     ||t                      |           nt          | t                    r|                     |||           nnt          | t
                    r%|                     ||t          |                     n4t          | t          t          f          rdS |                     ||           n# t          $ r Y dS w xY wdS )N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)r[   r]   r_   rH   s       rL   _verify_signaturern      s    c=)) 	(JJy$	Y????]++ 		(JJy$	2222455 	(JJy$y(9(9::::"N3
 
 	( 1JJy$'''   qq1s   B=C C 
C&%C&klassType[ExtensionTypeVar]%Optional[Extension[ExtensionTypeVar]]c                Z    	 | j                             |          S # t          $ r Y d S w xY wrT   )
extensionsget_extension_for_class_ExtensionNotFound)rN   ro   s     rL   _get_extensionrv      s?    66u===   tts    
**c                "   |                                  }t          |t                    r+|                    t          j        t          j                  }njt          |t                    r+|                    t          j	        t          j
                  }n*|                    t          j        t          j                  }t          t                      t                                }|                    |           |                                S )N)rJ   )
public_keyrd   re   public_bytes	_EncodingDER_PublicFormatPKCS1ri   X962UncompressedPointSubjectPublicKeyInfo_Hash_SHA1rA   updatefinalize)rN   rx   pbytesdigests       rL   _public_key_hashr      s    ""J
 *m,, \((8KLL	J 7	8	8 \((9XYY((8Z[[577$4$6$6777F
MM&??rZ   certificatesrU   responder_key_hashOptional[bytes]c                $    fd| D             S )Nc                Z    g | ]'}t          |          k    |j        j        k    %|(S  )r   rU   rV   ).0rN   rU   r   s     rL   
<listcomp>z*_get_certs_by_key_hash.<locals>.<listcomp>   sE       D!!%777DK6><Y<Y 	<Y<Y<YrZ   r   )r   rU   r   s    ``rL   _get_certs_by_key_hashr      4            rZ   responder_nameOptional[Name]c                $    fd| D             S )Nc                J    g | ]}|j         k    |j        j         k    | S r   )rV   rU   )r   rN   rU   r   s     rL   r   z&_get_certs_by_name.<locals>.<listcomp>   s>       <>))dkV^.K.K 	.K.K.KrZ   r   )r   rU   r   s    ``rL   _get_certs_by_namer      r   rZ   responser5   c                   |j         }|j        }|j        }||| j        k    s||k    rt                              d           | }n:t                              d           |j        }|j         ,t          || |          }t                              d           n+t          || |          }t                              d           |st                              d           dS |d         }t          |t                    }|rt          j        |j        vrt                              d           dS t          |                                 |j        |j        |j                  st                              d           dS t          |                                |j        |j        |j                  }	|	st                              d	           |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)r   r   issuer_key_hashrV   _LOGGERdebugr   r   r   rv   _ExtendedKeyUsage_ExtendedKeyUsageOIDOCSP_SIGNINGvaluern   rx   r]   signature_hash_algorithmtbs_certificate_bytestbs_response_bytes)
rU   r   name	rkey_hash	ikey_hashresponder_certcertsresponder_certsextrets
             rL   _verify_response_signaturer      s    "D+I(IDFN22i96L6L+,,,/000 %".0EEOMM011114UFINNOMM*+++ 	MMABBB1 )+ ^->?? 	*7syHHMMDEEE1 $30	
 
 	 MMBCCC1
!!##)#	 C  @>???JrZ   r4   c                    t                      }|                    | |t                                }|                                S rT   )_OCSPRequestBuilderadd_certificater   build)rN   rU   builders      rL   _build_ocsp_requestr     s6    !##G%%dFEGG<<G==??rZ   c                r   t                               d           t          | |          }|sdS t          j        t
          j                                      d           }|j        |k    rt                               d           dS |j	        r'|j	        |k     rt                               d           dS dS )NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastrc   )
r   r   r   	_datetimenowr   utcreplacethis_updatenext_update)rU   r   resr   s       rL   _verify_responser     s    MM&'''
$VX
6
6C q -8<
(
(
(
0
0
0
=
=Cc!!3444q  4s : :1222q1rZ   uriUnion[str, bytes]ocsp_response_cacher7   Optional[OCSPResponse]c                X   t          | |          }	 ||         }t                              d           nt# t          $ rf t	          t          j        d          d          }	 t          ||                    t          j
                  ddi|          }n4# t          $ r'}t                              d|           Y d }~Y d S d }~ww xY w|j        dk    r#t                              d	|j                   Y d S t          |j                  }t                              d
|j                   |j        t           j        k    rY d S |j        |j        k    rt                              d           Y d S t'          ||          sY d S t                              d           |||<   Y nw xY w|S )NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rH   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   r   r   KeyErrormaxr&   clamp_remaining_postry   rz   r{   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULserial_numberr   )	rN   rU   r   r   ocsp_requestocsp_responser   r   excs	            rL   _get_ocsp_responser   "  s    'tV44L$:+L934444 !: !: !: e+A..66		!..y}==')CD	  HH ! 	 	 	MM3S999444444	 3&&MM4h6JKKK44/0@AA0-2OPPP(,?,JJJ44
 &,*DDDMMIJJJ4466 	44.///,9L)))C!:F sR   "6 -F'$2BF'
C!C<F'C.F'9A	F'*F'2F'F'&F'connr6   
ocsp_bytes	user_dataOptional[_CallbackData]boolc                2   |sJ |                                  }|t                              d           dS |                                }t	          | d          r|                                 }d}n|                                 }|j        }|st                              d           dS d |D             }t          |||          }d}	t          |t                    }
|
8|
j        D ]0}|t          j        k    rt                              d           d}	 n1|j        }|d	k    rt                              d
           |	rt                              d           dS |j        st                              d           dS t          |t                     }|t                              d           dS d |j        D             }|st                              d           dS |t                              d           dS t                              d           |D ]}t                              d|           t#          ||||          }|2t                              d|j                   |j        t&          j        k    r dS |j        t&          j        k    r dS t                              d           dS t                              d           |t                              d           dS t-          |          }t                              d|j                   |j        t0          j        k    rdS t5          ||          sdS ||t7          ||          <   t                              d|j                   |j        t&          j        k    rdS dS )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?c                6    g | ]}|                                 S r   )to_cryptography)r   cers     rL   r   z"_ocsp_callback.<locals>.<listcomp>b  s$    666sS  ""666rZ   z!Peer presented a must-staple certTrZ   z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failc                P    g | ]#}|j         t          j        k    |j        j        $S r   )access_method_AuthorityInformationAccessOIDOCSPaccess_locationr   )r   descs     rL   r   z"_ocsp_callback.<locals>.<listcomp>  s:     
 
 
!%C%HHH  &HHHrZ   zNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   )get_peer_certificater   r   r   hasattrr   get_peer_cert_chainrI   rY   rv   _TLSFeaturer   _TLSFeatureTypestatus_requestr   check_ocsp_endpoint_AuthorityInformationAccessr   certificate_status_OCSPCertStatusGOODREVOKEDr   r   r   r   r   r   )r   r   r   pycertrN   pychainrI   rO   rU   must_stapleext_tlsfeaturer   ext_aiaurisr   r   s                    rL   _ocsp_callbackr   O  s    9&&((F~o&&&u!!##Dt)** 6))++**,,$5 +,,,u66g666EdE+;<<FKT;//G} 	 	G/888ABBB" 9 $7 S<=== 	MMQRRR5, 	MMJKKK4 'BCC?MMFGGG4
 

 
 

  	MM23334>MM+,,,5,---  	 	CMM+s+++)$=PQQH MM0(2MNNN*o.BBBtt*o.EEEuu F 	ABBBtMM1222~'(((u&z22HMM,h.FGGG #6#AAAuFH-- u=E+D&99:MM((*EFFF"o&===u4rZ   )r9   r:   r;   r<   )rN   r0   rO   rP   rI   rQ   r;   rR   )
r[   r\   r]   r^   r_   r`   rH   r^   r;   ra   )rN   r0   ro   rp   r;   rq   )rN   r0   r;   r^   )r   rP   rU   r0   r   r   r;   r<   )r   rP   rU   r0   r   r   r;   r<   )rU   r0   r   r5   r;   ra   )rN   r0   rU   r0   r;   r4   )
rN   r0   rU   r0   r   r   r   r7   r;   r   )r   r6   r   r^   r   r   r;   r   )__doc__
__future__r   logging_loggingrerB   r   r   r   typingr   r   r   r	   r
   cryptography.exceptionsr   rm   cryptography.hazmat.backendsr   rA   -cryptography.hazmat.primitives.asymmetric.dsar   rh   ,cryptography.hazmat.primitives.asymmetric.ecr   rj   r   ri   1cryptography.hazmat.primitives.asymmetric.paddingr   rg   -cryptography.hazmat.primitives.asymmetric.rsar   re   .cryptography.hazmat.primitives.asymmetric.x448r   rl   0cryptography.hazmat.primitives.asymmetric.x25519r   rk   %cryptography.hazmat.primitives.hashesr   r   r   r   ,cryptography.hazmat.primitives.serializationr   rz   r   r|   cryptography.x509r   r   r   r   r   ru   r   r   r   r   r   rF   cryptography.x509.ocspr   r   r   r   r    r   r!   r   cryptography.x509.oidr"   r   r#   r   requestsr$   r   requests.exceptionsr%   r   pymongor&   )cryptography.hazmat.primitives.asymmetricr'   r(   r)   r*   r+   r,   r-   /cryptography.hazmat.primitives.asymmetric.utilsr.   r/   r0   r1   cryptography.x509.extensionsr2   r3   r4   r5   OpenSSL.SSLr6   pymongo.ocsp_cacher7   pymongo.pyopenssl_contextr8   Ed25519PublicKeyEd448PublicKeyr\   	getLogger__name__r   compileDOTALLrD   rM   rY   rn   rv   r   r   r   r   r   r   r   r   r   rZ   rL   <module>r     s'   ; : " " " " " "         * * * * * *       A A A A A A A A A A A A A A I I I I I I L L L L L L W W W W W W H H H H H H      T S S S S S W W W W W W           @ ? ? ? ? ? ? ? ? ? ? ? N N N N N N V V V V V V W W W W W W C C C C C C E E E E E E 7 7 7 7 7 7 ? ? ? ? ? ? U U U U U U D D D D D D L L L L L L L L L L L L T T T T T T      N M M M M M " " " " " " E E E E E E                         JIIIIICCCCCC33333333HHHHHHHH@@@@@@@@&&&&&&------777777&+
! 	'# (
X
&
&ckDcj 

 
 
 
   &   4      "      3 3 3 3l      ** * * *Za a a a a arZ   