o
    h|F                     @  s  d Z ddlmZ ddlZddlZddlmZ ddlm	Z	 ddl
mZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ddl!m"Z# ddl$m%Z& ddl'm(Z) ddl*m+Z, ddl*m-Z. ddl/m0Z1 ddl/m2Z3 ddl4m5Z6 ddl4m7Z8 ddl4m9Z: ddl4m;Z< ddl4m=Z> ddl4m?Z@ ddlAmBZC ddlAmDZE ddlAmFZG ddlAmHZI ddlJmKZL ddlJmMZN dd lOmPZQ dd!lRmSZT dd"lUmVZV dd#lWmXZXmYZY er7dd$lZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZa dd%lbmcZc dd&l*mdZd dd'l4meZemfZf dd(lgmhZhmiZi dd)lAmjZjmkZk dd*llmmZm dd+lWmnZn dd,lompZp ee[je_j"e\je^jqe]jreaj(e`j%f ZseteuZvewd-ejxZydpd2d3Zzdqd;d<Z{drdEdFZ|dsdJdKZ}dtdLdMZ~dudRdSZdvdVdWZdwdZd[Zdxd]d^Zdwd_d`ZdydfdgZdzdndoZdS ){z4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)load_pem_x509_certificate)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)_next_update_this_update)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+cafilestrreturnlist[Certificate]c                 C  sb   t | d}| }W d   n1 sw   Y  g }t }tt|D ]
}|t|| q$|S )z0Parse the tlsCAFile into a list of certificates.rbN)openread_default_backend_refindall_CERT_REGEXappend_load_pem_x509_certificate)r:   fdatatrusted_ca_certsbackendZ	cert_data rK   G/var/www/html/venv/lib/python3.10/site-packages/pymongo/ocsp_support.py_load_trusted_ca_certsi   s   
rM   certr1   chainIterable[Certificate]rI   Optional[list[Certificate]]Optional[Certificate]c                 C  sF   | j }|D ]}|j|kr|  S q|r!|D ]}|j|kr |  S qd S N)issuersubject)rN   rO   rI   Zissuer_name	candidaterK   rK   rL   _get_issuer_certv   s   

rW   keyCertificateIssuerPublicKeyTypes	signaturebytes	algorithm%Union[Prehashed, HashAlgorithm, None]rH   intc                 C  s   zDt | tr| ||t | W dS t | tr!| ||| W dS t | tr2| ||t| W dS t | ttfr<W dS | || W dS  t	yN   Y dS w )N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)rX   rZ   r\   rH   rK   rK   rL   _verify_signature   s&   


	rj   klassType[ExtensionTypeVar]%Optional[Extension[ExtensionTypeVar]]c                 C  s$   z| j |W S  ty   Y d S w rS   )
extensionsZget_extension_for_class_ExtensionNotFound)rN   rk   rK   rK   rL   _get_extension   s
   rp   c                 C  sr   |   }t|tr|tjtj}nt|tr |tj	tj
}n|tjtj}tt t d}|| | S )N)rJ   )
public_keyr`   ra   public_bytes	_EncodingDER_PublicFormatZPKCS1re   ZX962ZUncompressedPointZSubjectPublicKeyInfo_Hash_SHA1rA   updatefinalize)rN   rq   ZpbytesdigestrK   rK   rL   _public_key_hash   s   


r{   certificatesrT   responder_key_hashOptional[bytes]c                       fdd| D S )Nc                   s(   g | ]}t |kr|j jkr|qS rK   )r{   rT   rU   .0rN   rT   r}   rK   rL   
<listcomp>   s
    z*_get_certs_by_key_hash.<locals>.<listcomp>rK   )r|   rT   r}   rK   r   rL   _get_certs_by_key_hash      r   responder_nameOptional[Name]c                   r   )Nc                   s&   g | ]}|j kr|j j kr|qS rK   )rU   rT   r   rT   r   rK   rL   r      s
    z&_get_certs_by_name.<locals>.<listcomp>rK   )r|   rT   r   rK   r   rL   _get_certs_by_name   r   r   responser6   c           
      C  s  |j }|j}|j}|d ur|| jks||krtd | }nXtd |j}|j d ur7t|| |}td nt|| |}td |sKtd dS |d }t	|t
}|r\tj|jvrctd dS t|  |j|j|jsvtd dS t| |j|j|j}	|	std	 |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)r   r}   Zissuer_key_hashrU   _LOGGERdebugr|   r   r   rp   _ExtendedKeyUsage_ExtendedKeyUsageOIDZOCSP_SIGNINGvaluerj   rq   rZ   Zsignature_hash_algorithmZtbs_certificate_bytesZtbs_response_bytes)
rT   r   nameZ	rkey_hashZ	ikey_hashZresponder_certcertsZresponder_certsextretrK   rK   rL   _verify_response_signature   sL   








r   r5   c                 C  s   t  }|| |t }| S rS   )_OCSPRequestBuilderZadd_certificaterw   build)rN   rT   builderrK   rK   rL   _build_ocsp_request  s   r   c                 C  s   t d t| |}|sdS t|}tjtjd}|r&|jd u r&|j	d d}|r3||kr3t d dS t
|}|rD||k rDt d dS dS )NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastr_   )r   r   r   r'   	_datetimenowr   utcr   replacer&   )rT   r   resZthis_updater   Znext_updaterK   rK   rL   _verify_response  s    



r   uriUnion[str, bytes]ocsp_response_cacher8   Optional[OCSPResponse]c           	      C  s$  t | |}z|| }td W |S  ty   ttdd}zt||t	j
ddi|d}W n tyJ } ztd| W Y d }~Y d S d }~ww |jdkrZtd	|j Y d S t|j}td
|j |jtjkroY d S |j|jkr}td Y d S t||sY d S td |||< Y |S w )NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rH   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   r   r   KeyErrormaxr%   Zclamp_remaining_postrr   rs   rt   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULZserial_numberr   )	rN   rT   r   r   Zocsp_requestZocsp_responser   r   excrK   rK   rL   _get_ocsp_response(  sF   
$







r   connr7   
ocsp_bytes	user_dataOptional[_CallbackData]boolc                 C  sV  |sJ |   }|du rtd dS | }t| dr#|  }d}n|  }|j}|s3td dS dd |D }t|||}d}	t	|t
}
|
dur_|
jD ]}|tjkr^td d	}	 nqN|j}|d
krtd |	rttd dS |js~td d	S t	|t}|du rtd d	S dd |jD }|std d	S |du rtd dS td |D ]-}td| t||||}|du rqtd|j |jtjkr d	S |jtjkr dS qtd d	S td |du rtd dS t|}td|j |jtjkr
dS t||sdS ||t||< td|j |jtjkr)dS d	S )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?c                 S  s   g | ]}|  qS rK   )to_cryptography)r   ZcerrK   rK   rL   r   h  s    z"_ocsp_callback.<locals>.<listcomp>z!Peer presented a must-staple certT    z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failc                 S  s    g | ]}|j tjkr|jjqS rK   )Zaccess_method_AuthorityInformationAccessOIDZOCSPZaccess_locationr   )r   ZdescrK   rK   rL   r     s
    zNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   )Zget_peer_certificater   r   r   hasattrr   Zget_peer_cert_chainrI   rW   rp   _TLSFeaturer   _TLSFeatureTypeZstatus_requestr   Zcheck_ocsp_endpoint_AuthorityInformationAccessr   Zcertificate_status_OCSPCertStatusZGOODZREVOKEDr   r   r   r   r   r   )r   r   r   ZpycertrN   ZpychainrI   rO   rT   Zmust_stapleZext_tlsfeaturer   Zext_aiaurisr   r   rK   rK   rL   _ocsp_callbackU  s   

















r   )r:   r;   r<   r=   )rN   r1   rO   rP   rI   rQ   r<   rR   )
rX   rY   rZ   r[   r\   r]   rH   r[   r<   r^   )rN   r1   rk   rl   r<   rm   )rN   r1   r<   r[   )r|   rP   rT   r1   r}   r~   r<   r=   )r|   rP   rT   r1   r   r   r<   r=   )rT   r1   r   r6   r<   r^   )rN   r1   rT   r1   r<   r5   )
rN   r1   rT   r1   r   r   r   r8   r<   r   )r   r7   r   r[   r   r   r<   r   )__doc__
__future__r   loggingZ_loggingrerB   r   r   r   typingr   r   r   r   r	   Zcryptography.exceptionsr
   ri   Zcryptography.hazmat.backendsr   rA   Z-cryptography.hazmat.primitives.asymmetric.dsar   rd   Z,cryptography.hazmat.primitives.asymmetric.ecr   rf   r   re   Z1cryptography.hazmat.primitives.asymmetric.paddingr   rc   Z-cryptography.hazmat.primitives.asymmetric.rsar   ra   Z.cryptography.hazmat.primitives.asymmetric.x448r   rh   Z0cryptography.hazmat.primitives.asymmetric.x25519r   rg   Z%cryptography.hazmat.primitives.hashesr   rw   r   rv   Z,cryptography.hazmat.primitives.serializationr   rs   r   ru   Zcryptography.x509r   r   r   r   r   ro   r   r   r   r   r   rF   Zcryptography.x509.ocspr   r   r   r   r   r   r    r   Zcryptography.x509.oidr!   r   r"   r   requestsr#   r   Zrequests.exceptionsr$   r   Zpymongor%   Zpymongo.ocsp_cacher&   r'   Z)cryptography.hazmat.primitives.asymmetricr(   r)   r*   r+   r,   r-   r.   Z/cryptography.hazmat.primitives.asymmetric.utilsr/   r0   r1   r2   Zcryptography.x509.extensionsr3   r4   r5   r6   ZOpenSSL.SSLr7   r8   Zpymongo.pyopenssl_contextr9   ZEd25519PublicKeyZEd448PublicKeyrY   	getLogger__name__r   compileDOTALLrD   rM   rW   rj   rp   r{   r   r   r   r   r   r   r   rK   rK   rK   rL   <module>   s   $	





	





6

-