o
    'h|F                     @  s  d Z ddlmZ ddlZddlZddlmZ ddlm	Z	 ddl
mZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ddl!m"Z# ddl$m%Z& ddl'm(Z) ddl*m+Z, ddl*m-Z. ddl/m0Z1 ddl/m2Z3 ddl4m5Z6 ddl4m7Z8 ddl4m9Z: ddl4m;Z< ddl4m=Z> ddl4m?Z@ ddlAmBZC ddlAmDZE ddlAmFZG ddlAmHZI ddlJmKZL ddlJmMZN dd lOmPZQ dd!lRmSZT dd"lUmVZV dd#lWmXZXmYZY er7dd$lZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZa dd%lbmcZc dd&l*mdZd dd'l4meZemfZf dd(lgmhZhmiZi dd)lAmjZjmkZk dd*llmmZm dd+lWmnZn dd,lompZp ee[je_j"e\je^jqe]jreaj(e`j%f ZseteuZvewd-ejxZydpd2d3Zzdqd;d<Z{drdEdFZ|dsdJdKZ}dtdLdMZ~dudRdSZdvdVdWZdwdZd[Zdxd]d^Zdwd_d`ZdydfdgZdzdndoZdS ){z4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)load_pem_x509_certificate)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)_next_update_this_update)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+cafilestrreturnlist[Certificate]c                 C  sb   t | d}| }W d   n1 sw   Y  g }t }tt|D ]
}|t|| q$|S )z0Parse the tlsCAFile into a list of certificates.rbN)openread_default_backend_refindall_CERT_REGEXappend_load_pem_x509_certificate)r:   fdatatrusted_ca_certsbackend	cert_data rL   P/var/www/html/olx_land/venv/lib/python3.10/site-packages/pymongo/ocsp_support.py_load_trusted_ca_certsi   s   
rN   certr1   chainIterable[Certificate]rI   Optional[list[Certificate]]Optional[Certificate]c                 C  sF   | j }|D ]}|j|kr|  S q|r!|D ]}|j|kr |  S qd S N)issuersubject)rO   rP   rI   issuer_name	candidaterL   rL   rM   _get_issuer_certv   s   

rY   keyCertificateIssuerPublicKeyTypes	signaturebytes	algorithm%Union[Prehashed, HashAlgorithm, None]rH   intc                 C  s   zDt | tr| ||t | W dS t | tr!| ||| W dS t | tr2| ||t| W dS t | ttfr<W dS | || W dS  t	yN   Y dS w )N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)rZ   r\   r^   rH   rL   rL   rM   _verify_signature   s&   


	rl   klassType[ExtensionTypeVar]%Optional[Extension[ExtensionTypeVar]]c                 C  s$   z| j |W S  ty   Y d S w rT   )
extensionsget_extension_for_class_ExtensionNotFound)rO   rm   rL   rL   rM   _get_extension   s
   rs   c                 C  sr   |   }t|tr|tjtj}nt|tr |tj	tj
}n|tjtj}tt t d}|| | S )N)rJ   )
public_keyrb   rc   public_bytes	_EncodingDER_PublicFormatPKCS1rg   X962UncompressedPointSubjectPublicKeyInfo_Hash_SHA1rA   updatefinalize)rO   rt   pbytesdigestrL   rL   rM   _public_key_hash   s   


r   certificatesrU   responder_key_hashOptional[bytes]c                       fdd| D S )Nc                   s(   g | ]}t |kr|j jkr|qS rL   )r   rU   rV   .0rO   rU   r   rL   rM   
<listcomp>   s
    z*_get_certs_by_key_hash.<locals>.<listcomp>rL   )r   rU   r   rL   r   rM   _get_certs_by_key_hash      r   responder_nameOptional[Name]c                   r   )Nc                   s&   g | ]}|j kr|j j kr|qS rL   )rV   rU   r   rU   r   rL   rM   r      s
    z&_get_certs_by_name.<locals>.<listcomp>rL   )r   rU   r   rL   r   rM   _get_certs_by_name   r   r   responser6   c           
      C  s  |j }|j}|j}|d ur|| jks||krtd | }nXtd |j}|j d ur7t|| |}td nt|| |}td |sKtd dS |d }t	|t
}|r\tj|jvrctd dS t|  |j|j|jsvtd dS t| |j|j|j}	|	std	 |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)r   r   issuer_key_hashrV   _LOGGERdebugr   r   r   rs   _ExtendedKeyUsage_ExtendedKeyUsageOIDOCSP_SIGNINGvaluerl   rt   r\   signature_hash_algorithmtbs_certificate_bytestbs_response_bytes)
rU   r   name	rkey_hash	ikey_hashresponder_certcertsresponder_certsextretrL   rL   rM   _verify_response_signature   sL   








r   r5   c                 C  s   t  }|| |t }| S rT   )_OCSPRequestBuilderadd_certificater~   build)rO   rU   builderrL   rL   rM   _build_ocsp_request  s   r   c                 C  s   t d t| |}|sdS t|}tjtjd}|r&|jd u r&|j	d d}|r3||kr3t d dS t
|}|rD||k rDt d dS dS )NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastra   )r   r   r   r'   	_datetimenowr   utcr   replacer&   )rU   r   resthis_updater   next_updaterL   rL   rM   _verify_response  s    



r   uriUnion[str, bytes]ocsp_response_cacher8   Optional[OCSPResponse]c           	      C  s$  t | |}z|| }td W |S  ty   ttdd}zt||t	j
ddi|d}W n tyJ } ztd| W Y d }~Y d S d }~ww |jdkrZtd	|j Y d S t|j}td
|j |jtjkroY d S |j|jkr}td Y d S t||sY d S td |||< Y |S w )NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rH   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   r   r   KeyErrormaxr%   clamp_remaining_postru   rv   rw   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULserial_numberr   )	rO   rU   r   r   ocsp_requestocsp_responser   r   excrL   rL   rM   _get_ocsp_response(  sF   
$







r   connr7   
ocsp_bytes	user_dataOptional[_CallbackData]boolc                 C  sV  |sJ |   }|du rtd dS | }t| dr#|  }d}n|  }|j}|s3td dS dd |D }t|||}d}	t	|t
}
|
dur_|
jD ]}|tjkr^td d	}	 nqN|j}|d
krtd |	rttd dS |js~td d	S t	|t}|du rtd d	S dd |jD }|std d	S |du rtd dS td |D ]-}td| t||||}|du rqtd|j |jtjkr d	S |jtjkr dS qtd d	S td |du rtd dS t|}td|j |jtjkr
dS t||sdS ||t||< td|j |jtjkr)dS d	S )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?c                 S  s   g | ]}|  qS rL   )to_cryptography)r   cerrL   rL   rM   r   h  s    z"_ocsp_callback.<locals>.<listcomp>z!Peer presented a must-staple certT    z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failc                 S  s    g | ]}|j tjkr|jjqS rL   )access_method_AuthorityInformationAccessOIDOCSPaccess_locationr   )r   descrL   rL   rM   r     s
    zNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   )get_peer_certificater   r   r   hasattrr   get_peer_cert_chainrI   rY   rs   _TLSFeaturer   _TLSFeatureTypestatus_requestr   check_ocsp_endpoint_AuthorityInformationAccessr   certificate_status_OCSPCertStatusGOODREVOKEDr   r   r   r   r   r   )r   r   r   pycertrO   pychainrI   rP   rU   must_stapleext_tlsfeaturer   ext_aiaurisr   r   rL   rL   rM   _ocsp_callbackU  s   

















r   )r:   r;   r<   r=   )rO   r1   rP   rQ   rI   rR   r<   rS   )
rZ   r[   r\   r]   r^   r_   rH   r]   r<   r`   )rO   r1   rm   rn   r<   ro   )rO   r1   r<   r]   )r   rQ   rU   r1   r   r   r<   r=   )r   rQ   rU   r1   r   r   r<   r=   )rU   r1   r   r6   r<   r`   )rO   r1   rU   r1   r<   r5   )
rO   r1   rU   r1   r   r   r   r8   r<   r   )r   r7   r   r]   r   r   r<   r   )__doc__
__future__r   logging_loggingrerB   r   r   r   typingr   r   r   r   r	   cryptography.exceptionsr
   rk   cryptography.hazmat.backendsr   rA   -cryptography.hazmat.primitives.asymmetric.dsar   rf   ,cryptography.hazmat.primitives.asymmetric.ecr   rh   r   rg   1cryptography.hazmat.primitives.asymmetric.paddingr   re   -cryptography.hazmat.primitives.asymmetric.rsar   rc   .cryptography.hazmat.primitives.asymmetric.x448r   rj   0cryptography.hazmat.primitives.asymmetric.x25519r   ri   %cryptography.hazmat.primitives.hashesr   r~   r   r}   ,cryptography.hazmat.primitives.serializationr   rv   r   rx   cryptography.x509r   r   r   r   r   rr   r   r   r   r   r   rF   cryptography.x509.ocspr   r   r   r   r   r   r    r   cryptography.x509.oidr!   r   r"   r   requestsr#   r   requests.exceptionsr$   r   pymongor%   pymongo.ocsp_cacher&   r'   )cryptography.hazmat.primitives.asymmetricr(   r)   r*   r+   r,   r-   r.   /cryptography.hazmat.primitives.asymmetric.utilsr/   r0   r1   r2   cryptography.x509.extensionsr3   r4   r5   r6   OpenSSL.SSLr7   r8   pymongo.pyopenssl_contextr9   Ed25519PublicKeyEd448PublicKeyr[   	getLogger__name__r   compileDOTALLrD   rN   rY   rl   rs   r   r   r   r   r   r   r   r   rL   rL   rL   rM   <module>   s   $	





	





6

-