
    ]*inD                       d Z ddlmZ ddlZddlZddlmZ ddlm	Z	 ddl
mZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ddl!m"Z# ddl$m%Z& ddl'm(Z) ddl*m+Z, ddl*m-Z. ddl/m0Z1 ddl/m2Z3 ddl4m5Z6 ddl4m7Z8 ddl4m9Z: ddl4m;Z< ddl4m=Z> ddl?m@ZA ddl?mBZC ddl?mDZE ddl?mFZG ddlHmIZJ ddlHmKZL ddlMmNZO dd lPmQZR dd!lSmTZT dd"lUmVZVmWZW erdd#lXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_ dd$l`maZa dd%l*mbZb dd&l4mcZcmdZd dd'lemfZfmgZg dd(l?mhZhmiZi dd)ljmkZk dd*lUmlZl dd+lmmnZn eeYj.                  e]jD                  eZj8                  e\j                  e[j                  e_jP                  e^jJ                  f   Zq ej                  es      Zt ej                  d,ej                        Zw	 	 	 	 	 	 	 	 d8d-Zx	 	 	 	 	 	 	 	 	 	 d9d.Zy	 	 	 	 	 	 d:d/Zzd;d0Z{	 	 	 	 	 	 	 	 d<d1Z|	 	 	 	 	 	 	 	 d=d2Z}d>d3Z~d?d4Zd>d5Z	 	 	 	 	 	 	 	 	 	 d@d6ZdAd7Zy)Bz4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)_next_update_this_update)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+c                    | j                   }|D ]  }|j                  |k(  s|c S  |r|D ]  }|j                  |k(  s|c S  y N)issuersubject)certchaintrusted_ca_certsissuer_name	candidates        N/home/alumno/antonio/venv/lib/python3.12/site-packages/pymongo/ocsp_support.py_get_issuer_certrD   h   s]     ++K 	+ ) 	!I  K/  	!     c                t   	 t        | t              r| j                  ||t               |       yt        | t              r| j                  |||       yt        | t
              r| j                  ||t        |             yt        | t        t        f      ry| j                  ||       	 y# t        $ r Y yw xY w)N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)key	signature	algorithmdatas       rC   _verify_signaturerV   {   s    c=)JJy$	Y?  ]+JJy$	2  45JJy$y(9:  "N3
 JJy$'   s(   ,B+ #B+ ,B+  B+ B+ +	B76B7c                X    	 | j                   j                  |      S # t        $ r Y y w xY wr;   )
extensionsget_extension_for_class_ExtensionNotFound)r>   klasss     rC   _get_extensionr\      s.    66u== s    	))c                   | j                         }t        |t              r/|j                  t        j
                  t        j                        }nmt        |t              r/|j                  t        j                  t        j                        }n.|j                  t        j
                  t        j                        }t        t               t                     }|j                  |       |j!                         S )N)backend)
public_keyrH   rI   public_bytes	_EncodingDER_PublicFormatPKCS1rM   X962UncompressedPointSubjectPublicKeyInfo_Hash_SHA1_default_backendupdatefinalize)r>   r_   pbytesdigests       rC   _public_key_hashro      s    "J
 *m,((8K8KL	J 7	8((9X9XY((8Z8Z[57$4$67F
MM&??rE   c                z    | D cg c]+  }t        |      |k(  r|j                  |j                  k(  r|- c}S c c}w r;   )ro   r<   r=   )certificatesr<   responder_key_hashr>   s       rC   _get_certs_by_key_hashrs      sA    
 !D!%77DKK6>><Y 	  s   08c                |    | D cg c],  }|j                   |k(  r|j                  |j                   k(  r|. c}S c c}w r;   )r=   r<   )rq   r<   responder_namer>   s       rC   _get_certs_by_namerv      s?    
 !<<>)dkkV^^.K 	  s   19c                   |j                   }|j                  }|j                  }||| j                  k(  s||k(  rt        j                  d       | }n#t        j                  d       |j                  }|j                   #t        || |      }t        j                  d       n"t        || |      }t        j                  d       |st        j                  d       y|d   }t        |t              }|rt        j                  |j                  vrt        j                  d       yt        | j                         |j                   |j"                  |j$                        st        j                  d       yt        |j                         |j                   |j"                  |j&                        }	|	st        j                  d	       |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)ru   rr   issuer_key_hashr=   _LOGGERdebugrq   rv   rs   r\   _ExtendedKeyUsage_ExtendedKeyUsageOIDOCSP_SIGNINGvaluerV   r_   rS   signature_hash_algorithmtbs_certificate_bytestbs_response_bytes)
r<   responsename	rkey_hash	ikey_hashresponder_certcertsresponder_certsextrets
             rC   _verify_response_signaturer      s    ""D++I((IDFNN2i96L+,/0 %%"".0EOMM014UFINOMM*+MMAB )+ ^->?*77syyHMMDE $$3300	
 MMBC
!!#))##	C >?JrE   c                l    t               }|j                  | |t                     }|j                         S r;   )_OCSPRequestBuilderadd_certificateri   build)r>   r<   builders      rC   _build_ocsp_requestr      s,    !#G%%dFEG<G==?rE   c                t   t         j                  d       t        | |      }|syt        |      }t	        j
                  t        j                        }|r|j                  |j                  d       }|r||kD  rt         j                  d       yt        |      }|r||k  rt         j                  d       yy)NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastrG   )ry   rz   r   r'   	_datetimenowr   utcr   replacer&   )r<   r   resthis_updater   next_updates         rC   _verify_responser      s    MM&'
$VX
6C x(K
--8<<
(C{))1kkk&{S(34x(K{S(12rE   c                (   t        | |      }	 ||   }t        j                  d       |S # t        $ r] t	        t        j                  d      d      }	 t        ||j                  t        j                        ddi|      }n-# t        $ r!}t        j                  d|       Y d }~Y y d }~ww xY w|j                  dk7  r"t        j                  d	|j                         Y y t        |j                        }t        j                  d
|j                         |j                  t         j"                  k7  rY y |j$                  |j$                  k7  rt        j                  d       Y y t'        ||      sY y t        j                  d       |||<   Y |S w xY w)NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rU   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   ry   rz   KeyErrormaxr%   clamp_remaining_postr`   ra   rb   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULserial_numberr   )	r>   r<   uriocsp_response_cacheocsp_requestocsp_responser   r   excs	            rC   _get_ocsp_responser     sk    'tV4L$:+L934H G  !: e++A.6		!..y}}=')CD	H ! 	MM3S9	 3&MM4h6J6JK/0@0@A0-2O2OP((,?,J,JJ
 &&,*D*DDMMIJ6./,9L)G!:sR   * )F.BF	B-B("F(B--2F!AF5.F%F3FFc                @   |sJ | j                         }|t        j                  d       y|j                         }t	        | d      r| j                         }d}n| j                         }|j                  }|st        j                  d       y|D cg c]  }|j                          }}t        |||      }	d}
t        |t              }|=|j                  D ].  }|t        j                  k(  st        j                  d       d}
 n |j                  }|dk(  rt        j                  d	       |
rt        j                  d
       y|j                  st        j                  d       yt        |t               }|t        j                  d       y|j                  D cg c]5  }|j"                  t$        j&                  k(  r|j(                  j                  7 }}|st        j                  d       y|	t        j                  d       yt        j                  d       |D ]  }t        j                  d|       t+        ||	||      }|*t        j                  d|j,                         |j,                  t.        j0                  k(  r y|j,                  t.        j2                  k(  s y t        j                  d       yt        j                  d       |	t        j                  d       yt5        |      }t        j                  d|j6                         |j6                  t8        j:                  k7  ryt=        |	|      sy||t?        ||	      <   t        j                  d|j,                         |j,                  t.        j2                  k(  ryyc c}w c c}w )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?z!Peer presented a must-staple certTrE   z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failzNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   ) get_peer_certificatery   rz   to_cryptographyhasattrr   get_peer_cert_chainr@   rD   r\   _TLSFeaturer~   _TLSFeatureTypestatus_requestr   check_ocsp_endpoint_AuthorityInformationAccessaccess_method_AuthorityInformationAccessOIDOCSPaccess_locationr   certificate_status_OCSPCertStatusGOODREVOKEDr   r   r   r   r   r   )conn
ocsp_bytes	user_datapycertr>   pychainr@   cerr?   r<   must_stapleext_tlsfeaturer   ext_aiadescurisr   r   s                      rC   _ocsp_callbackr   G  s3    9&&(F~o&!!#Dt)*))+**,$55+,.56sS  "6E6dE+;<FKT;/G}} 	G/888AB"		
 $77 S<=MMQR,,MMJK 'BC?MMFG  
!!%C%H%HH   &&
 

 MM23>MM+,,-  	CMM+s+)$=PQH MM0(2M2MN**o.B.BB**o.E.EE	 	ABMM12~'(&z2HMM,h.F.FG #6#A#AAFH-=E+D&9:MM((*E*EF""o&=&==] 7:
s   N":N)r>   r1   r?   Iterable[Certificate]r@   zOptional[list[Certificate]]returnzOptional[Certificate])
rR   CertificateIssuerPublicKeyTypesrS   bytesrT   z%Union[Prehashed, HashAlgorithm, None]rU   r   r   int)r>   r1   r[   zType[ExtensionTypeVar]r   z%Optional[Extension[ExtensionTypeVar]])r>   r1   r   r   )rq   r   r<   r1   rr   zOptional[bytes]r   list[Certificate])rq   r   r<   r1   ru   zOptional[Name]r   r   )r<   r1   r   r6   r   r   )r>   r1   r<   r1   r   r5   )
r>   r1   r<   r1   r   zUnion[str, bytes]r   r8   r   zOptional[OCSPResponse])r   r7   r   r   r   zOptional[_CallbackData]r   bool)__doc__
__future__r   logging_loggingre_rer   r   r   typingr   r   r   r	   r
   cryptography.exceptionsr   rQ   cryptography.hazmat.backendsr   rj   -cryptography.hazmat.primitives.asymmetric.dsar   rL   ,cryptography.hazmat.primitives.asymmetric.ecr   rN   r   rM   1cryptography.hazmat.primitives.asymmetric.paddingr   rK   -cryptography.hazmat.primitives.asymmetric.rsar   rI   .cryptography.hazmat.primitives.asymmetric.x448r   rP   0cryptography.hazmat.primitives.asymmetric.x25519r   rO   %cryptography.hazmat.primitives.hashesr   ri   r   rh   ,cryptography.hazmat.primitives.serializationr   ra   r   rc   cryptography.x509r   r   r   r{   r   rZ   r   r   r   r   cryptography.x509.ocspr   r   r   r   r   r   r    r   cryptography.x509.oidr!   r   r"   r|   requestsr#   r   requests.exceptionsr$   r   pymongor%   pymongo.ocsp_cacher&   r'   )cryptography.hazmat.primitives.asymmetricr(   r)   r*   r+   r,   r-   r.   /cryptography.hazmat.primitives.asymmetric.utilsr/   r0   r1   r2   cryptography.x509.extensionsr3   r4   r5   r6   OpenSSL.SSLr7   r8   pymongo.pyopenssl_contextr9   Ed25519PublicKeyEd448PublicKeyr   	getLogger__name__ry   compileDOTALL_CERT_REGEXrD   rV   r\   ro   rs   rv   r   r   r   r   r    rE   rC   <module>r     s5   ; "   *  A A I L W H T W @ ? N V W C E 7 ? D L L T N " E  9   JC3H@&-7&+
!!  	'# (

X
&ckkDcjj

3Gb&	( 5 	
 	4
4*"'1<Ra'1<N\3l4*
***1B*Yc**ZarE   