o
    sDinD                     @  s  d Z ddlmZ ddlZddlZddlmZ ddlm	Z	 ddl
mZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ddl!m"Z# ddl$m%Z& ddl'm(Z) ddl*m+Z, ddl*m-Z. ddl/m0Z1 ddl/m2Z3 ddl4m5Z6 ddl4m7Z8 ddl4m9Z: ddl4m;Z< ddl4m=Z> ddl?m@ZA ddl?mBZC ddl?mDZE ddl?mFZG ddlHmIZJ ddlHmKZL ddlMmNZO dd lPmQZR dd!lSmTZT dd"lUmVZVmWZW er1dd#lXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_ dd$l`maZa dd%l*mbZb dd&l4mcZcmdZd dd'lemfZfmgZg dd(l?mhZhmiZi dd)ljmkZk dd*lUmlZl dd+lmmnZn eeYje]j"eZje\joe[jpe_j(e^j%f ZqeresZteud,ejvZwdkd5d6Zxdld?d@ZydmdDdEZzdndFdGZ{dodMdNZ|dpdQdRZ}dqdUdVZ~drdXdYZdqdZd[ZdsdadbZdtdidjZdS )uz4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)_next_update_this_update)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+certr0   chainIterable[Certificate]trusted_ca_certsOptional[list[Certificate]]returnOptional[Certificate]c                 C  sF   | j }|D ]}|j|kr|  S q|r!|D ]}|j|kr |  S qd S N)issuersubject)r9   r:   r<   issuer_name	candidate rE   R/home/alumno/antzosa8961/venv/lib/python3.10/site-packages/pymongo/ocsp_support.py_get_issuer_certh   s   

rG   keyCertificateIssuerPublicKeyTypes	signaturebytes	algorithm%Union[Prehashed, HashAlgorithm, None]dataintc                 C  s   zDt | tr| ||t | W dS t | tr!| ||| W dS t | tr2| ||t| W dS t | ttfr<W dS | || W dS  t	yN   Y dS w )N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)rH   rJ   rL   rN   rE   rE   rF   _verify_signature{   s&   


	r[   klassType[ExtensionTypeVar]%Optional[Extension[ExtensionTypeVar]]c                 C  s$   z| j |W S  ty   Y d S w r@   )
extensionsget_extension_for_class_ExtensionNotFound)r9   r\   rE   rE   rF   _get_extension   s
   rb   c                 C  sr   |   }t|tr|tjtj}nt|tr |tj	tj
}n|tjtj}tt t d}|| | S )N)backend)
public_keyrQ   rR   public_bytes	_EncodingDER_PublicFormatPKCS1rV   X962UncompressedPointSubjectPublicKeyInfo_Hash_SHA1_default_backendupdatefinalize)r9   rd   pbytesdigestrE   rE   rF   _public_key_hash   s   


rt   certificatesrA   responder_key_hashOptional[bytes]list[Certificate]c                       fdd| D S )Nc                   s(   g | ]}t |kr|j jkr|qS rE   )rt   rA   rB   .0r9   rA   rv   rE   rF   
<listcomp>   s
    z*_get_certs_by_key_hash.<locals>.<listcomp>rE   )ru   rA   rv   rE   r|   rF   _get_certs_by_key_hash      r~   responder_nameOptional[Name]c                   ry   )Nc                   s&   g | ]}|j kr|j j kr|qS rE   )rB   rA   rz   rA   r   rE   rF   r}      s
    z&_get_certs_by_name.<locals>.<listcomp>rE   )ru   rA   r   rE   r   rF   _get_certs_by_name   r   r   responser5   c           
      C  s  |j }|j}|j}|d ur|| jks||krtd | }nXtd |j}|j d ur7t|| |}td nt|| |}td |sKtd dS |d }t	|t
}|r\tj|jvrctd dS t|  |j|j|jsvtd dS t| |j|j|j}	|	std	 |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)r   rv   issuer_key_hashrB   _LOGGERdebugru   r   r~   rb   _ExtendedKeyUsage_ExtendedKeyUsageOIDOCSP_SIGNINGvaluer[   rd   rJ   signature_hash_algorithmtbs_certificate_bytestbs_response_bytes)
rA   r   name	rkey_hash	ikey_hashresponder_certcertsresponder_certsextretrE   rE   rF   _verify_response_signature   sL   








r   r4   c                 C  s   t  }|| |t }| S r@   )_OCSPRequestBuilderadd_certificatern   build)r9   rA   builderrE   rE   rF   _build_ocsp_request   s   r   c                 C  s   t d t| |}|sdS t|}tjtjd}|r&|jd u r&|j	d d}|r3||kr3t d dS t
|}|rD||k rDt d dS dS )NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastrP   )r   r   r   r&   	_datetimenowr   utcr   replacer%   )rA   r   resthis_updater   next_updaterE   rE   rF   _verify_response   s    



r   uriUnion[str, bytes]ocsp_response_cacher7   Optional[OCSPResponse]c           	      C  s$  t | |}z|| }td W |S  ty   ttdd}zt||t	j
ddi|d}W n tyJ } ztd| W Y d }~Y d S d }~ww |jdkrZtd	|j Y d S t|j}td
|j |jtjkroY d S |j|jkr}td Y d S t||sY d S td |||< Y |S w )NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rN   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   r   r   KeyErrormaxr$   clamp_remaining_postre   rf   rg   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULserial_numberr   )	r9   rA   r   r   ocsp_requestocsp_responser   r   excrE   rE   rF   _get_ocsp_response  sF   
$







r   connr6   
ocsp_bytes	user_dataOptional[_CallbackData]boolc                 C  sV  |sJ |   }|du rtd dS | }t| dr#|  }d}n|  }|j}|s3td dS dd |D }t|||}d}	t	|t
}
|
dur_|
jD ]}|tjkr^td d	}	 nqN|j}|d
krtd |	rttd dS |js~td d	S t	|t}|du rtd d	S dd |jD }|std d	S |du rtd dS td |D ]-}td| t||||}|du rqtd|j |jtjkr d	S |jtjkr dS qtd d	S td |du rtd dS t|}td|j |jtjkr
dS t||sdS ||t||< td|j |jtjkr)dS d	S )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?c                 S  s   g | ]}|  qS rE   )to_cryptography)r{   cerrE   rE   rF   r}   Z  s    z"_ocsp_callback.<locals>.<listcomp>z!Peer presented a must-staple certT    z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failc                 S  s    g | ]}|j tjkr|jjqS rE   )access_method_AuthorityInformationAccessOIDOCSPaccess_locationr   )r{   descrE   rE   rF   r}   w  s
    zNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   )get_peer_certificater   r   r   hasattrr   get_peer_cert_chainr<   rG   rb   _TLSFeaturer   _TLSFeatureTypestatus_requestr   check_ocsp_endpoint_AuthorityInformationAccessr   certificate_status_OCSPCertStatusGOODREVOKEDr   r   r   r   r   r   )r   r   r   pycertr9   pychainr<   r:   rA   must_stapleext_tlsfeaturer   ext_aiaurisr   r   rE   rE   rF   _ocsp_callbackG  s   

















r   )r9   r0   r:   r;   r<   r=   r>   r?   )
rH   rI   rJ   rK   rL   rM   rN   rK   r>   rO   )r9   r0   r\   r]   r>   r^   )r9   r0   r>   rK   )ru   r;   rA   r0   rv   rw   r>   rx   )ru   r;   rA   r0   r   r   r>   rx   )rA   r0   r   r5   r>   rO   )r9   r0   rA   r0   r>   r4   )
r9   r0   rA   r0   r   r   r   r7   r>   r   )r   r6   r   rK   r   r   r>   r   )__doc__
__future__r   logging_loggingre_rer   r   r   typingr   r   r   r   r	   cryptography.exceptionsr
   rZ   cryptography.hazmat.backendsr   ro   -cryptography.hazmat.primitives.asymmetric.dsar   rU   ,cryptography.hazmat.primitives.asymmetric.ecr   rW   r   rV   1cryptography.hazmat.primitives.asymmetric.paddingr   rT   -cryptography.hazmat.primitives.asymmetric.rsar   rR   .cryptography.hazmat.primitives.asymmetric.x448r   rY   0cryptography.hazmat.primitives.asymmetric.x25519r   rX   %cryptography.hazmat.primitives.hashesr   rn   r   rm   ,cryptography.hazmat.primitives.serializationr   rf   r   rh   cryptography.x509r   r   r   r   r   ra   r   r   r   r   cryptography.x509.ocspr   r   r   r   r   r   r   r   cryptography.x509.oidr    r   r!   r   requestsr"   r   requests.exceptionsr#   r   pymongor$   pymongo.ocsp_cacher%   r&   )cryptography.hazmat.primitives.asymmetricr'   r(   r)   r*   r+   r,   r-   /cryptography.hazmat.primitives.asymmetric.utilsr.   r/   r0   r1   cryptography.x509.extensionsr2   r3   r4   r5   OpenSSL.SSLr6   r7   pymongo.pyopenssl_contextr8   Ed25519PublicKeyEd448PublicKeyrI   	getLogger__name__r   compileDOTALL_CERT_REGEXrG   r[   rb   rt   r~   r   r   r   r   r   r   rE   rE   rE   rF   <module>   s   $	




	





6

-