U
    ~fh{F                     @  sn  d Z ddlmZ ddlZddlZddlmZ ddlm	Z	 ddl
mZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ddl!m"Z# ddl$m%Z& ddl'm(Z) ddl*m+Z, ddl*m-Z. ddl/m0Z1 ddl/m2Z3 ddl4m5Z6 ddl4m7Z8 ddl4m9Z: ddl4m;Z< ddl4m=Z> ddl4m?Z@ ddlAmBZC ddlAmDZE ddlAmFZG ddlAmHZI ddlJmKZL ddlJmMZN dd lOmPZQ dd!lRmSZT dd"lUmVZV dd#lWmXZXmYZY erndd$lZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZa dd%lbmcZc dd&l*mdZd dd'l4meZemfZf dd(lgmhZhmiZi dd)lAmjZjmkZk dd*llmmZm dd+lWmnZn dd,lompZp ee[je_j"e\je^jqe]jreaj(e`j%f ZseteuZvewd-ejxZyd.d/d0d1d2Zzd3d4d5d6d7d8d9Z{d:d;d<d;d=d>d?d@Z|d3dAdBdCdDdEZ}d3d;dFdGdHZ~d4d3dId/dJdKdLZd4d3dMd/dNdOdPZd3dQd=dRdSdTZd3d3dUdVdWdXZd3dQd=dRdYdZZd3d3d[d\d]d^d_d`Zdad;dbdcdddedfZdS )gz4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)load_pem_x509_certificate)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)_next_update_this_update)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+strzlist[Certificate])cafilereturnc              	   C  sN   t | d}| }W 5 Q R X g }t }tt|D ]}|t|| q4|S )z0Parse the tlsCAFile into a list of certificates.rb)openread_default_backend_refindall_CERT_REGEXappend_load_pem_x509_certificate)r;   fdatatrusted_ca_certsbackendZ	cert_data rJ   8/tmp/pip-unpacked-wheel-36gvocj8/pymongo/ocsp_support.py_load_trusted_ca_certsi   s    rL   r1   zIterable[Certificate]zOptional[list[Certificate]]zOptional[Certificate])certchainrH   r<   c                 C  sF   | j }|D ]}|j|kr
|  S q
|rB|D ]}|j|kr*|  S q*d S N)issuersubject)rM   rN   rH   Zissuer_name	candidaterJ   rJ   rK   _get_issuer_certv   s    



rS   CertificateIssuerPublicKeyTypesbytesz%Union[Prehashed, HashAlgorithm, None]int)key	signature	algorithmrG   r<   c                 C  s   zzt | tr | ||t | nXt | tr:| ||| n>t | trX| ||t| n t | ttfrlW dS | || W n t	k
r   Y dS X dS )N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)rW   rX   rY   rG   rJ   rJ   rK   _verify_signature   s     


 re   zType[ExtensionTypeVar]z%Optional[Extension[ExtensionTypeVar]])rM   klassr<   c                 C  s*   z| j |W S  tk
r$   Y d S X d S rO   )
extensionsZget_extension_for_class_ExtensionNotFound)rM   rf   rJ   rJ   rK   _get_extension   s    ri   )rM   r<   c                 C  sr   |   }t|tr$|tjtj}n,t|tr@|tj	tj
}n|tjtj}tt t d}|| | S )N)rI   )
public_keyr[   r\   public_bytes	_EncodingDER_PublicFormatZPKCS1r`   ZX962ZUncompressedPointZSubjectPublicKeyInfo_Hash_SHA1r@   updatefinalize)rM   rj   ZpbytesdigestrJ   rJ   rK   _public_key_hash   s    


rt   zOptional[bytes])certificatesrP   responder_key_hashr<   c                   s    fdd| D S )Nc                   s(   g | ] }t |kr|j jkr|qS rJ   )rt   rP   rQ   .0rM   rP   rv   rJ   rK   
<listcomp>   s    z*_get_certs_by_key_hash.<locals>.<listcomp>rJ   )ru   rP   rv   rJ   ry   rK   _get_certs_by_key_hash   s    r{   zOptional[Name])ru   rP   responder_namer<   c                   s    fdd| D S )Nc                   s&   g | ]}|j kr|j j kr|qS rJ   )rQ   rP   rw   rP   r|   rJ   rK   rz      s   
 z&_get_certs_by_name.<locals>.<listcomp>rJ   )ru   rP   r|   rJ   r}   rK   _get_certs_by_name   s    r~   r6   )rP   responser<   c           
      C  s  |j }|j}|j}|d k	r$|| jks,||kr<td | }ntd |j}|j d k	rnt|| |}td nt|| |}td |std dS |d }t	|t
}|rtj|jkrtd dS t|  |j|j|jstd dS t| |j|j|j}	|	std	 |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)r|   rv   Zissuer_key_hashrQ   _LOGGERdebugru   r~   r{   ri   _ExtendedKeyUsage_ExtendedKeyUsageOIDZOCSP_SIGNINGvaluere   rj   rX   Zsignature_hash_algorithmZtbs_certificate_bytesZtbs_response_bytes)
rP   r   nameZ	rkey_hashZ	ikey_hashZresponder_certcertsZresponder_certsextretrJ   rJ   rK   _verify_response_signature   sL    








r   r5   )rM   rP   r<   c                 C  s   t  }|| |t }| S rO   )_OCSPRequestBuilderZadd_certificaterp   build)rM   rP   ZbuilderrJ   rJ   rK   _build_ocsp_request  s    r   c                 C  s   t d t| |}|sdS t|}tjtjd}|rL|jd krL|j	d d}|rf||krft d dS t
|}|r||k rt d dS dS )NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastrZ   )r   r   r   r'   	_datetimenowr   utcr   replacer&   )rP   r   resZthis_updater   Znext_updaterJ   rJ   rK   _verify_response  s     



r   zUnion[str, bytes]r8   zOptional[OCSPResponse])rM   rP   uriocsp_response_cacher<   c           	      C  s0  t | |}z|| }td W n tk
r*   ttdd}z t||t	j
ddi|d}W n6 tk
r } ztd| W Y Y d S d }~X Y nX |jdkrtd	|j Y d S t|j}td
|j |jtjkrY d S |j|jkrtd Y d S t||sY d S td |||< Y nX |S )NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rG   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   r   r   KeyErrormaxr%   Zclamp_remaining_postrk   rl   rm   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULZserial_numberr   )	rM   rP   r   r   Zocsp_requestZocsp_responser   r   excrJ   rJ   rK   _get_ocsp_response(  s>    






r   r7   zOptional[_CallbackData]bool)conn
ocsp_bytes	user_datar<   c                 C  sj  |st |  }|dkr&td dS | }t| drF|  }d}n|  }|j}|sftd dS dd |D }t	|||}d}	t
|t}
|
dk	r|
jD ] }|tjkrtd d	}	 qq|j}|d
krtd |	rtd dS |jstd d	S t
|t}|dkr td d	S dd |jD }|sDtd d	S |dkr\td dS td |D ]d}td| t||||}|dkrqjtd|j |jtjkr d	S |jtjkrj dS qjtd d	S td |dkr td dS t|}td|j |jtjkr(dS t||s8dS ||t||< td|j |jtjkrfdS d	S )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?c                 S  s   g | ]}|  qS rJ   )to_cryptography)rx   ZcerrJ   rJ   rK   rz   h  s     z"_ocsp_callback.<locals>.<listcomp>z!Peer presented a must-staple certT    z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failc                 S  s    g | ]}|j tjkr|jjqS rJ   )Zaccess_method_AuthorityInformationAccessOIDZOCSPZaccess_locationr   )rx   descrJ   rJ   rK   rz     s   zNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   )AssertionErrorZget_peer_certificater   r   r   hasattrr   Zget_peer_cert_chainrH   rS   ri   _TLSFeaturer   _TLSFeatureTypeZstatus_requestr   Zcheck_ocsp_endpoint_AuthorityInformationAccessr   Zcertificate_status_OCSPCertStatusZGOODZREVOKEDr   r   r   r   r   r   )r   r   r   ZpycertrM   ZpychainrH   rN   rP   Zmust_stapleZext_tlsZfeaturer   Zext_aiaurisr   r   rJ   rJ   rK   _ocsp_callbackU  s    























r   )__doc__
__future__r   loggingZ_loggingrerA   r   r   r   typingr   r   r   r   r	   Zcryptography.exceptionsr
   rd   Zcryptography.hazmat.backendsr   r@   Z-cryptography.hazmat.primitives.asymmetric.dsar   r_   Z,cryptography.hazmat.primitives.asymmetric.ecr   ra   r   r`   Z1cryptography.hazmat.primitives.asymmetric.paddingr   r^   Z-cryptography.hazmat.primitives.asymmetric.rsar   r\   Z.cryptography.hazmat.primitives.asymmetric.x448r   rc   Z0cryptography.hazmat.primitives.asymmetric.x25519r   rb   Z%cryptography.hazmat.primitives.hashesr   rp   r   ro   Z,cryptography.hazmat.primitives.serializationr   rl   r   rn   Zcryptography.x509r   r   r   r   r   rh   r   r   r   r   r   rE   Zcryptography.x509.ocspr   r   r   r   r   r   r    r   Zcryptography.x509.oidr!   r   r"   r   requestsr#   r   Zrequests.exceptionsr$   r   Zpymongor%   Zpymongo.ocsp_cacher&   r'   Z)cryptography.hazmat.primitives.asymmetricr(   r)   r*   r+   r,   r-   r.   Z/cryptography.hazmat.primitives.asymmetric.utilsr/   r0   r1   r2   Zcryptography.x509.extensionsr3   r4   r5   r6   ZOpenSSL.SSLr7   r8   Zpymongo.pyopenssl_contextr9   ZEd25519PublicKeyZEd448PublicKeyrT   	getLogger__name__r   compileDOTALLrC   rL   rS   re   ri   rt   r{   r~   r   r   r   r   r   rJ   rJ   rJ   rK   <module>   s   $	
 	

6-