
    h:                        d Z ddlZddlZddlmZ ddlmZ	 ddl
mZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddl m!Z" ddl m#Z$ ddl%m&Z' ddl%m(Z) ddl%m*Z+ ddl%m,Z- ddl%m.Z/ ddl%m0Z1 ddl2m3Z4 ddl2m5Z6 ddl2m7Z8 ddl2m9Z: ddl;m<Z= ddl;m>Z? ddl@mAZB ddlCmDZE  ej                  eG      ZH ej                  dej                        ZKd ZLd ZMd  ZNd! ZOd" ZPd# ZQd$ ZRd% ZSd& ZTd' ZUd( ZVd) ZWy)*z4Support for requesting and verifying OCSP responses.    N)datetime)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)load_pem_x509_certificate)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestExceptions9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+c                     t        | d      5 }|j                         }ddd       g }t               }t        j                  t
              D ]  }|j                  t        ||              |S # 1 sw Y   QxY w)z0Parse the tlsCAFile into a list of certificates.rbN)openread_default_backend_refindall_CERT_REGEXappend_load_pem_x509_certificate)cafilefdatatrusted_ca_certsbackend	cert_datas         R/var/www/html/eduruby.in/venv/lib/python3.12/site-packages/pymongo/ocsp_support.py_load_trusted_ca_certsr.   ?   sv    	fd	 qvvx  G[[d3 P	 :9g NOP s   A..A7c                     | j                   }|D ]  }|j                  |k(  s|c S  |r|D ]  }|j                  |k(  s|c S  y N)issuersubject)certchainr*   issuer_name	candidates        r-   _get_issuer_certr7   L   s[    ++K 	+ ) 	!I  K/  	!     c                 F   	 t        | t              r| j                  ||t               |       yt        | t              r| j                  |||       yt        | t
              r| j                  ||t        |             y| j                  ||       	 y# t        $ r Y yw xY w)Nr      )
isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_InvalidSignature)key	signature	algorithmr)   s       r-   _verify_signaturerF   ]   s    
c=)JJy$	Y?  ]+JJy$	2  45JJy$y(9:
  JJy$'   s"   ,B #B ,B  B 	B B c                 X    	 | j                   j                  |      S # t        $ r Y y w xY wr0   )
extensionsget_extension_for_class_ExtensionNotFound)r3   klasss     r-   _get_extensionrL   n   s.    66u== s    	))c                    | j                         }t        |t              r/|j                  t        j
                  t        j                        }nmt        |t              r/|j                  t        j                  t        j                        }n.|j                  t        j
                  t        j                        }t        t               t                     }|j                  |       |j!                         S )N)r+   )
public_keyr;   r<   public_bytes	_EncodingDER_PublicFormatPKCS1r@   X962UncompressedPointSubjectPublicKeyInfo_Hash_SHA1r!   updatefinalize)r3   rN   pbytesdigests       r-   _public_key_hashr]   u   s    "J
 *m,((8K8KL	J 7	8((9X9XY((8Z8Z[57$4$67F
MM&??r8   c                 z    | D cg c]+  }t        |      |k(  r|j                  |j                  k(  r|- c}S c c}w r0   )r]   r1   r2   )certificatesr1   responder_key_hashr3   s       r-   _get_certs_by_key_hashra      sA     !D!%77DKK6>><Y 	  s   08c                 |    | D cg c],  }|j                   |k(  r|j                  |j                   k(  r|. c}S c c}w r0   )r2   r1   )r_   r1   responder_namer3   s       r-   _get_certs_by_namerd      s?     !<<>)dkkV^^.K 	  s   19c                    |j                   }|j                  }|j                  }||| j                  k(  s||k(  rt        j                  d       | }n#t        j                  d       |j                  }|j                   #t        || |      }t        j                  d       n"t        || |      }t        j                  d       |st        j                  d       y|d   }t        |t              }|rt        j                  |j                  vrt        j                  d       yt        | j                         |j                   |j"                  |j$                        st        j                  d       yt        |j                         |j                   |j"                  |j&                        }	|	st        j                  d	       |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)rc   r`   issuer_key_hashr2   _LOGGERdebugr_   rd   ra   rL   _ExtendedKeyUsage_ExtendedKeyUsageOIDOCSP_SIGNINGvaluerF   rN   rD   signature_hash_algorithmtbs_certificate_bytestbs_response_bytes)
r1   responsename	rkey_hash	ikey_hashresponder_certcertsresponder_certsextrets
             r-   _verify_response_signaturery      s    ""D++I((IDFNN2i96L+,/0 %%"".0EOMM014UFINOMM*+MMAB )+ ^->?*77syyHMMDE $$3300	
 MMBC
!!#))##	C >?Jr8   c                 l    t               }|j                  | |t                     }|j                         S r0   )_OCSPRequestBuilderadd_certificaterX   build)r3   r1   builders      r-   _build_ocsp_requestr      s,    !#G%%dFEG<G==?r8   c                     t         j                  d       t        | |      }|syt        j                         }|j
                  |kD  rt         j                  d       y|j                  r%|j                  |k  rt         j                  d       yy)NzVerifying responser   zthisUpdate is in the futureznextUpdate is in the pastr:   )rg   rh   ry   	_datetimeutcnowthis_updatenext_update)r1   rp   resnows       r-   _verify_responser      sx    MM&'
$VX
6C 


Cc!34 4 4s :12r8   c                    t        | |      }	 ||   }t        j                  d       |S # t        $ r> 	 t	        ||j                  t        j                        ddid      }n-# t        $ r!}t        j                  d|       Y d }~Y y d }~ww xY w|j                  dk7  r"t        j                  d|j                         Y y t        |j                        }t        j                  d	|j                         |j                  t        j                  k7  rY y |j                  |j                  k7  rt        j                  d
       Y y t!        ||      sY y t        j                  d       |||<   Y |S w xY w)NzUsing cached OCSP response.zContent-Typezapplication/ocsp-request   )r)   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   rg   rh   KeyError_postrO   rP   rQ   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULserial_numberr   )r3   r1   uriocsp_response_cacheocsp_requestocsp_responserp   excs           r-   _get_ocsp_responser      sN   &tV4L :+L934@ ?  :		!..y}}=')CD	H ! 	MM3S9	 3&MM4h6J6JK/0@0@A0-2O2OP((,?,J,JJ
 &&,*D*DDMMIJ6./,9L)?:sQ   * 
E2.A$#E2$	B-B	E2	B2E2AE2.E2E2E21E2c                 8   | j                         }|t        j                  d       y|j                         }t	        | d      r| j                         }d}n| j                         }|j                  }|st        j                  d       y|D cg c]  }|j                          }}t        |||      }d}t        |t              }	|	=|	j                  D ].  }
|
t        j                  k(  st        j                  d       d} n |j                  }|d	k(  rt        j                  d
       |rt        j                  d       y|j                  st        j                  d       yt        |t               }	|	t        j                  d       y|	j                  D cg c]5  }|j"                  t$        j&                  k(  r|j(                  j                  7 }}|st        j                  d       y|t        j                  d       yt        j                  d       |D ]  }t        j                  d|       t+        ||||      }|*t        j                  d|j,                         |j,                  t.        j0                  k(  r y|j,                  t.        j2                  k(  s y t        j                  d       yt        j                  d       |t        j                  d       yt5        |      }t        j                  d|j6                         |j6                  t8        j:                  k7  ryt=        ||      sy||t?        ||      <   t        j                  d|j,                         |j,                  t.        j2                  k(  ryyc c}w c c}w )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?r   get_verified_chainzNo peer cert chain?Fz!Peer presented a must-staple certTr8   z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.r:   z*No authority access information, soft failzNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   ) get_peer_certificaterg   rh   to_cryptographyhasattrr   get_peer_cert_chainr*   r7   rL   _TLSFeaturerl   _TLSFeatureTypestatus_requestr   check_ocsp_endpoint_AuthorityInformationAccessaccess_method_AuthorityInformationAccessOIDOCSPaccess_locationr   certificate_status_OCSPCertStatusGOODREVOKEDr   r   r   r   r   r   )conn
ocsp_bytes	user_datar3   r4   r*   cerr1   must_staplerw   featurer   descurisr   rp   s                   r-   _ocsp_callbackr     s(   $$&D|o&!Dt)*'')((*$55+,.34sS  "4E4dE+;<FK
{
+C
yy 	G/888AB"		
 $77 S<=MMQR,,MMJKT#>?;MMFG 		
!!%C%H%HH   &&
 

 MM23>MM+,,-  	CMM+s+)$=PQH MM0(2M2MN**o.B.BB**o.E.EE	 	ABMM12~'(&z2HMM,h.F.FG #6#A#AAFH-=E+D&9:MM((*E*EF""o&=&==] 5:
s   N:N)X__doc__logging_loggingrer"   r   r   cryptography.exceptionsr   rB   cryptography.hazmat.backendsr   r!   -cryptography.hazmat.primitives.asymmetric.dsar   r?   ,cryptography.hazmat.primitives.asymmetric.ecr   rA   r   r@   1cryptography.hazmat.primitives.asymmetric.paddingr	   r>   -cryptography.hazmat.primitives.asymmetric.rsar
   r<   %cryptography.hazmat.primitives.hashesr   rX   r   rW   ,cryptography.hazmat.primitives.serializationr   rP   r   rR   cryptography.x509r   r   r   ri   r   rJ   r   r   r   r   r   r&   cryptography.x509.ocspr   r   r   r{   r   r   r   r   cryptography.x509.oidr   r   r   rj   requestsr   r   requests.exceptionsr   r   	getLogger__name__rg   compileDOTALLr$   r.   r7   rF   rL   r]   ra   rd   ry   r   r   r   r    r8   r-   <module>r      s    ;   * I L W H T W ? ? N V W C E 7 ? U D L L T N " E (

X
&ckkDcjj

"""3l*$N_r8   