Ë
    Ü_ËinD  ã                  óþ  — d Z ddlmZ ddlZddlZddlmZ ddlm	Z	 ddl
mZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ddl!m"Z# ddl$m%Z& ddl'm(Z) ddl*m+Z, ddl*m-Z. ddl/m0Z1 ddl/m2Z3 ddl4m5Z6 ddl4m7Z8 ddl4m9Z: ddl4m;Z< ddl4m=Z> ddl?m@ZA ddl?mBZC ddl?mDZE ddl?mFZG ddlHmIZJ ddlHmKZL ddlMmNZO dd lPmQZR dd!lSmTZT dd"lUmVZVmWZW eršdd#lXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_ dd$l`maZa dd%l*mbZb dd&l4mcZcmdZd dd'lemfZfmgZg dd(l?mhZhmiZi dd)ljmkZk dd*lUmlZl dd+lmmnZn eeYj.                  e]jD                  eZj8                  e\jÞ                  e[jà                  e_jP                  e^jJ                  f   Zq ejä                  es«      Zt ejê                  d,ejì                  «      Zw	 	 	 	 	 	 	 	 d8d-„Zx	 	 	 	 	 	 	 	 	 	 d9d.„Zy	 	 	 	 	 	 d:d/„Zzd;d0„Z{	 	 	 	 	 	 	 	 d<d1„Z|	 	 	 	 	 	 	 	 d=d2„Z}d>d3„Z~d?d4„Zd>d5„Z€	 	 	 	 	 	 	 	 	 	 d@d6„Z�dAd7„Z‚y)Bz4Support for requesting and verifying OCSP responses.é    )ÚannotationsN)Údatetime)Útimezone)ÚTYPE_CHECKINGÚIterableÚOptionalÚTypeÚUnion)ÚInvalidSignature)Údefault_backend)ÚDSAPublicKey)ÚECDSA)ÚEllipticCurvePublicKey)ÚPKCS1v15)ÚRSAPublicKey)ÚX448PublicKey)ÚX25519PublicKey)ÚSHA1)ÚHash)ÚEncoding)ÚPublicFormat)ÚAuthorityInformationAccess)ÚExtendedKeyUsage)ÚExtensionNotFound)Ú
TLSFeature)ÚTLSFeatureType)ÚOCSPCertStatus)ÚOCSPRequestBuilder)ÚOCSPResponseStatus)Úload_der_ocsp_response)ÚAuthorityInformationAccessOID)ÚExtendedKeyUsageOID)Úpost)ÚRequestException)Ú_csot)Ú_next_updateÚ_this_update)ÚdsaÚecÚed448Úed25519ÚrsaÚx448Úx25519)Ú	Prehashed)ÚHashAlgorithm)ÚCertificateÚName)Ú	ExtensionÚExtensionTypeVar)ÚOCSPRequestÚOCSPResponse)Ú
Connection)Ú
_OCSPCache)Ú_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+c                óˆ   — | j                   }|D ]  }|j                  |k(  sŒ|c S  |r|D ]  }|j                  |k(  sŒ|c S  y ©N)ÚissuerÚsubject)ÚcertÚchainÚtrusted_ca_certsÚissuer_nameÚ	candidates        úW/var/www/pod-logistic/pod-api/venv/lib/python3.12/site-packages/pymongo/ocsp_support.pyÚ_get_issuer_certrD   h   s]   € ð —+‘+€KØò ˆ	Ø×Ñ Ó+ØÒðñ Ø)ò 	!ˆIØ× Ñ  KÓ/Ø Ò ð	!ð ó    c                ót  — 	 t        | t        «      r| j                  ||t        «       |«       yt        | t        «      r| j                  |||«       yt        | t
        «      r| j                  ||t        |«      «       yt        | t        t        f«      ry| j                  ||«       	 y# t        $ r Y yw xY w)Né   r   )
Ú
isinstanceÚ_RSAPublicKeyÚverifyÚ	_PKCS1v15Ú_DSAPublicKeyÚ_EllipticCurvePublicKeyÚ_ECDSAÚ_X25519PublicKeyÚ_X448PublicKeyÚ_InvalidSignature)ÚkeyÚ	signatureÚ	algorithmÚdatas       rC   Ú_verify_signaturerV   {   s³   € ðÜ�cœ=Ô)Ø�J‰J�y $¬	«°YÔ?ð ô ˜œ]Ô+Ø�J‰J�y $¨	Ô2ð ô ˜Ô4Ô5Ø�J‰J�y $¬¨yÓ(9Ô:ð ô ØÔ"¤NÐ3ô
ð à�J‰J�y $Õ'ð øô ò Ùðús(   ‚,B+ ¯#B+ Á,B+ Â B+ ÂB+ Â+	B7Â6B7c                óX   — 	 | j                   j                  |«      S # t        $ r Y y w xY wr;   )Ú
extensionsÚget_extension_for_classÚ_ExtensionNotFound)r>   Úklasss     rC   Ú_get_extensionr\   •   s.   € ðØ�‰×6Ñ6°uÓ=Ð=øÜò Ùðús   ‚ �	)¨)c                óö  — | j                  «       }t        |t        «      r/|j                  t        j
                  t        j                  «      }nmt        |t        «      r/|j                  t        j                  t        j                  «      }n.|j                  t        j
                  t        j                  «      }t        t        «       t        «       ¬«      }|j                  |«       |j!                  «       S )N)Úbackend)Ú
public_keyrH   rI   Úpublic_bytesÚ	_EncodingÚDERÚ_PublicFormatÚPKCS1rM   ÚX962ÚUncompressedPointÚSubjectPublicKeyInfoÚ_HashÚ_SHA1Ú_default_backendÚupdateÚfinalize)r>   r_   ÚpbytesÚdigests       rC   Ú_public_key_hashro   ž   s¤   € Ø—‘Ó"€Jô
 �*œmÔ,Ø×(Ñ(¬¯©¼×8KÑ8KÓL‰Ü	�JÔ 7Ô	8Ø×(Ñ(¬¯©¼×9XÑ9XÓY‰à×(Ñ(¬¯©¼×8ZÑ8ZÓ[ˆÜ”5“7Ô$4Ó$6Ô7€FØ
‡M�M�&ÔØ�?‰?ÓÐrE   c                óz   — | D �cg c]+  }t        |«      |k(  r|j                  |j                  k(  r|‘Œ- c}S c c}w r;   )ro   r<   r=   )Úcertificatesr<   Úresponder_key_hashr>   s       rC   Ú_get_certs_by_key_hashrs   ¯   sA   € ð
 !öàÜ˜DÓ!Ð%7Ò7¸D¿K¹KÈ6Ï>É>Ò<Yò 	òð ùò s   …08c                ó|   — | D �cg c],  }|j                   |k(  r|j                  |j                   k(  r|‘Œ. c}S c c}w r;   )r=   r<   )rq   r<   Úresponder_namer>   s       rC   Ú_get_certs_by_namerv   ¹   s?   € ð
 !öàØ�<‰<˜>Ò)¨d¯k©k¸V¿^¹^Ò.Kò 	òð ùò s   …19c                ó”  — |j                   }|j                  }|j                  }|�|| j                  k(  s||k(  rt        j                  d«       | }�n#t        j                  d«       |j                  }|j                   �#t        || |«      }t        j                  d«       n"t        || |«      }t        j                  d«       |st        j                  d«       y|d   }t        |t        «      }|rt        j                  |j                  vrt        j                  d«       yt        | j                  «       |j                   |j"                  |j$                  «      st        j                  d«       yt        |j                  «       |j                   |j"                  |j&                  «      }	|	st        j                  d	«       |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)ru   rr   Úissuer_key_hashr=   Ú_LOGGERÚdebugrq   rv   rs   r\   Ú_ExtendedKeyUsageÚ_ExtendedKeyUsageOIDÚOCSP_SIGNINGÚvaluerV   r_   rS   Úsignature_hash_algorithmÚtbs_certificate_bytesÚtbs_response_bytes)
r<   ÚresponseÚnameÚ	rkey_hashÚ	ikey_hashÚresponder_certÚcertsÚresponder_certsÚextÚrets
             rC   Ú_verify_response_signaturer‹   Ã   s‡  € ð ×"Ñ"€DØ×+Ñ+€IØ×(Ñ(€IØÐ˜D F§N¡NÒ2°iÀ9Ò6LÜ�‰Ð+Ô,àŠä�‰Ð/Ô0ð ×%Ñ%ˆØ×"Ñ"Ð.Ü0°¸ÀÓEˆOÜ�M‰MÐ0Õ1ä4°U¸FÀIÓNˆOÜ�M‰MÐ*Ô+ÙÜ�M‰MÐAÔBØð )¨Ñ+ˆô ˜^Ô->Ó?ˆÙÔ*×7Ñ7¸s¿y¹yÑHÜ�M‰MÐDÔEØÜ Ø×ÑÓØ×$Ñ$Ø×3Ñ3Ø×0Ñ0ô	
ô �M‰MÐBÔCØä
Ø×!Ñ!Ó#Ø×ÑØ×)Ñ)Ø×#Ñ#ó	€Cñ Ü�‰Ð>Ô?Ø€JrE   c                ól   — t        «       }|j                  | |t        «       «      }|j                  «       S r;   )Ú_OCSPRequestBuilderÚadd_certificateri   Úbuild)r>   r<   Úbuilders      rC   Ú_build_ocsp_requestr‘   ù   s,   € ä!Ó#€GØ×%Ñ% d¨F´E³GÓ<€GØ�=‰=‹?ÐrE   c                ót  — t         j                  d«       t        | |«      }|syt        |«      }t	        j
                  t        j                  ¬«      }|r|j                  €|j                  d ¬«      }|r||kD  rt         j                  d«       yt        |«      }|r||k  rt         j                  d«       yy)NzVerifying responser   )Útz)ÚtzinfozthisUpdate is in the futureznextUpdate is in the pastrG   )ry   rz   r‹   r'   Ú	_datetimeÚnowr   Úutcr”   Úreplacer&   )r<   r‚   ÚresÚthis_updater–   Únext_updates         rC   Ú_verify_responserœ      sž   € Ü‡M�MÐ&Ô'ä
$ V¨XÓ
6€CÙØô ˜xÓ(€KÜ
�-‰-œ8Ÿ<™<Ô
(€CÙ�{×)Ñ)Ð1à�k‰k ˆkÓ&ˆá�{ SÒ(Ü�‰Ð3Ô4Øä˜xÓ(€KÙ�{ SÒ(Ü�‰Ð1Ô2ØØrE   c                ó(  — t        | |«      }	 ||   }t        j                  d«       |S # t        $ �r] t	        t        j                  d«      d«      }	 t        ||j                  t        j                  «      ddi|¬«      }n-# t        $ r!}t        j                  d|«       Y d }~Y y d }~ww xY w|j                  dk7  r"t        j                  d	|j                  «       Y y t        |j                  «      }t        j                  d
|j                  «       |j                  t         j"                  k7  rY y |j$                  |j$                  k7  rt        j                  d«       Y y t'        ||«      sY y t        j                  d«       |||<   Y |S w xY w)NzUsing cached OCSP response.é   gü©ñÒMbP?zContent-Typezapplication/ocsp-request)rU   ÚheadersÚtimeoutzHTTP request failed: %séÈ   zHTTP request returned %dúOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r‘   ry   rz   ÚKeyErrorÚmaxr%   Úclamp_remainingÚ_postr`   ra   rb   Ú_RequestExceptionÚstatus_codeÚ_load_der_ocsp_responseÚcontentÚresponse_statusÚ_OCSPResponseStatusÚ
SUCCESSFULÚserial_numberrœ   )	r>   r<   ÚuriÚocsp_response_cacheÚocsp_requestÚocsp_responser    r‚   Úexcs	            rC   Ú_get_ocsp_responser´     sk  € ô ' t¨VÓ4€Lð$:Ø+¨LÑ9ˆÜ�‰Ð3Ô4ðH ÐøôG ó !:ô ”e×+Ñ+¨AÓ.°Ó6ˆð		ÜØØ!×.Ñ.¬y¯}©}Ó=Ø'Ð)CÐDØô	‰Høô !ò 	Ü�M‰MÐ3°SÔ9Ýûð	úð ×Ñ 3Ò&Ü�M‰MÐ4°h×6JÑ6JÔKÙÜ/°×0@Ñ0@ÓAˆÜ�‰Ð0°-×2OÑ2OÔPØ×(Ñ(Ô,?×,JÑ,JÒJÙð
 ×&Ñ&¨,×*DÑ*DÒDÜ�M‰MÐIÔJÙÜ ¨Ô6áÜ�‰Ð.Ô/Ø,9Ð˜LÒ)àÐðG!:úsR   Ž* ª)FÁ.BÂFÂ	B-ÂB(Â"FÂ(B-Â-2FÃ!AFÄ5.FÅ%FÅ3FÆFc                ó@  — |sJ ‚| j                  «       }|€t        j                  d«       y|j                  «       }t	        | d«      r| j                  «       }d}n| j                  «       }|j                  }|st        j                  d«       y|D �cg c]  }|j                  «       ‘Œ }}t        |||«      }	d}
t        |t        «      }|�=|j                  D ].  }|t        j                  k(  sŒt        j                  d«       d}
 n |j                  }|dk(  �r¨t        j                  d	«       |
rt        j                  d
«       y|j                  st        j                  d«       yt        |t         «      }|€t        j                  d«       y|j                  D �cg c]5  }|j"                  t$        j&                  k(  r|j(                  j                  ‘Œ7 }}|st        j                  d«       y|	€t        j                  d«       yt        j                  d«       |D ]‡  }t        j                  d|«       t+        ||	||«      }|€Œ*t        j                  d|j,                  «       |j,                  t.        j0                  k(  r y|j,                  t.        j2                  k(  sŒ‡ y t        j                  d«       yt        j                  d«       |	€t        j                  d«       yt5        |«      }t        j                  d|j6                  «       |j6                  t8        j:                  k7  ryt=        |	|«      sy||t?        ||	«      <   t        j                  d|j,                  «       |j,                  t.        j2                  k(  ryyc c}w c c}w )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?FÚget_verified_chainzNo peer cert chain?z!Peer presented a must-staple certTrE   z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failzNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser¢   ) Úget_peer_certificatery   rz   Úto_cryptographyÚhasattrr¶   Úget_peer_cert_chainr@   rD   r\   Ú_TLSFeaturer~   Ú_TLSFeatureTypeÚstatus_requestr°   Úcheck_ocsp_endpointÚ_AuthorityInformationAccessÚaccess_methodÚ_AuthorityInformationAccessOIDÚOCSPÚaccess_locationr´   Úcertificate_statusÚ_OCSPCertStatusÚGOODÚREVOKEDr©   r«   r¬   r­   rœ   r‘   )ÚconnÚ
ocsp_bytesÚ	user_dataÚpycertr>   Úpychainr@   Úcerr?   r<   Úmust_stapleÚext_tlsÚfeaturer°   Úext_aiaÚdescÚurisr¯   r‚   s                      rC   Ú_ocsp_callbackrÔ   G  s3  € ñ Ðˆ9Ø×&Ñ&Ó(€FØ€~Ü�‰�oÔ&ØØ×!Ñ!Ó#€DäˆtÐ)Ô*Ø×)Ñ)Ó+ˆØÑà×*Ñ*Ó,ˆØ$×5Ñ5ÐÙÜ�‰Ð+Ô,ØØ.5Ö6 sˆS× Ñ Õ"Ð6€EÐ6Ü˜d EÐ+;Ó<€FØ€Kä˜T¤;Ó/€GØÐØ—}‘}ò 	ˆGØœ/×8Ñ8Ó8Ü—‘ÐAÔBØ"�Ùð		ð
 $×7Ñ7Ðð �SÓÜ�‰Ð<Ô=ÙÜ�M‰MÐQÔRØØ×,Ò,Ü�M‰MÐJÔKàä  Ô'BÓCˆØˆ?Ü�M‰MÐFÔGàð  Ÿ™ö
àØ×!Ñ!Ô%C×%HÑ%HÒHð × Ñ ×&Ó&ð
ˆð 
ñ
 Ü�M‰MÐ2Ô3àØˆ>Ü�M‰MÐ+Ô,ØÜ�‰Ð,Ô-ð ò 	ˆCÜ�M‰M˜+ sÔ+Ü)¨$°¸Ð=PÓQˆHØÐð Ü�M‰MÐ0°(×2MÑ2MÔNØ×*Ñ*¬o×.BÑ.BÒBÙØ×*Ñ*¬o×.EÑ.EÓEÙð	ô 	�‰ÐAÔBØä‡M�MÐ1Ô2Ø€~Ü�‰Ð'Ô(ØÜ& zÓ2€HÜ‡M�MÐ,¨h×.FÑ.FÔGð ×ÑÔ#6×#AÑ#AÒAØÜ˜F HÔ-Øà=EÐÔ+¨D°&Ó9Ñ:Ü‡M�MÐ(¨(×*EÑ*EÔFØ×"Ñ"¤o×&=Ñ&=Ò=ØØùò] 7ùò:
s   ÂNÆ":N)r>   r1   r?   úIterable[Certificate]r@   zOptional[list[Certificate]]ÚreturnzOptional[Certificate])
rR   ÚCertificateIssuerPublicKeyTypesrS   ÚbytesrT   z%Union[Prehashed, HashAlgorithm, None]rU   rØ   rÖ   Úint)r>   r1   r[   zType[ExtensionTypeVar]rÖ   z%Optional[Extension[ExtensionTypeVar]])r>   r1   rÖ   rØ   )rq   rÕ   r<   r1   rr   zOptional[bytes]rÖ   úlist[Certificate])rq   rÕ   r<   r1   ru   zOptional[Name]rÖ   rÚ   )r<   r1   r‚   r6   rÖ   rÙ   )r>   r1   r<   r1   rÖ   r5   )
r>   r1   r<   r1   r¯   zUnion[str, bytes]r°   r8   rÖ   zOptional[OCSPResponse])rÈ   r7   rÉ   rØ   rÊ   zOptional[_CallbackData]rÖ   Úbool)ƒÚ__doc__Ú
__future__r   ÚloggingÚ_loggingÚreÚ_rer   r•   r   Útypingr   r   r   r	   r
   Úcryptography.exceptionsr   rQ   Úcryptography.hazmat.backendsr   rj   Ú-cryptography.hazmat.primitives.asymmetric.dsar   rL   Ú,cryptography.hazmat.primitives.asymmetric.ecr   rN   r   rM   Ú1cryptography.hazmat.primitives.asymmetric.paddingr   rK   Ú-cryptography.hazmat.primitives.asymmetric.rsar   rI   Ú.cryptography.hazmat.primitives.asymmetric.x448r   rP   Ú0cryptography.hazmat.primitives.asymmetric.x25519r   rO   Ú%cryptography.hazmat.primitives.hashesr   ri   r   rh   Ú,cryptography.hazmat.primitives.serializationr   ra   r   rc   Úcryptography.x509r   r¿   r   r{   r   rZ   r   r»   r   r¼   Úcryptography.x509.ocspr   rÅ   r   r�   r   r¬   r    r©   Úcryptography.x509.oidr!   rÁ   r"   r|   Úrequestsr#   r¦   Úrequests.exceptionsr$   r§   Úpymongor%   Úpymongo.ocsp_cacher&   r'   Ú)cryptography.hazmat.primitives.asymmetricr(   r)   r*   r+   r,   r-   r.   Ú/cryptography.hazmat.primitives.asymmetric.utilsr/   r0   r1   r2   Úcryptography.x509.extensionsr3   r4   r5   r6   ÚOpenSSL.SSLr7   r8   Úpymongo.pyopenssl_contextr9   ÚEd25519PublicKeyÚEd448PublicKeyr×   Ú	getLoggerÚ__name__ry   ÚcompileÚDOTALLÚ_CERT_REGEXrD   rV   r\   ro   rs   rv   r‹   r‘   rœ   r´   rÔ   © rE   rC   ú<module>r     s5  ðñ ;Ý "ã Û Ý *Ý ß AÕ Aå IÝ LÝ WÝ Hõõ TÝ Wõõõ @Ý ?Ý NÝ VÝ WÝ CÝ EÝ 7Ý ?Ý DÝ LÝ LÝ Tõõ NÝ "Ý Eå ß 9á÷÷ ñ õ JÝCß3ßHß@Ý&å-Ý7à&+Ø×ÑØ×ÑØ
×!Ñ!Ø× Ñ Ø×ÑØ×ÑØ×Ñð	ñ'Ð#ð ˆ(×
Ñ
˜XÓ
&€àˆc�k‰kØDÀcÇjÁjó€ð
Ø
ðØ3ðØGbðàóð&Ø	(ðàðð 5ðð ð	ð
 	óð4Ø
ðØ4ðà*óóð"Ø'ðØ1<ðØRaðàóðØ'ðØ1<ðØN\ðàóó3ólóð4*Ø
ð*Ø*ð*Ø1Bð*ØYcð*àó*ôZarE   