
    g-                        d Z ddlZddlZddlZddlmZmZmZmZm	Z	m
Z
mZ ddlmZmZmZmZmZmZ ddlmZ ddlmZ ddlmZ dd	lmZ g d
Z ej8                  e      Z eg d      Z  eg d      Z! eg d      Z" eg d      Z#de$de	e%   de%de&fdZ'de$de%fdZ(deejR                  ejT                  f   dedejV                  fdZ,dejR                  dede%de&fdZ-de$dej\                  de%fd Z/ e
d!      Z0 e
d"      Z1d#ee0ee1e2f   f   d$ee0ejf                  f   d%e0d&eg ee1   f   dee1e2f   f
d'Z4d( Z5d) Z6d* Z7d+ Z8deejR                  ejT                  f   fd,Z9d- Z:d.efd/Z;y)0zd
Internal backend-agnostic utilities to help process fetched certificates, CRLs
and OCSP responses.
    N)	AwaitableCallableDictIterableOptionalTypeVarUnion)algoscmscoreocsppemx509)DistributionPoint   )errors)	Authority)get_ac_extension_value)unpack_cert_contentformat_ocsp_requestprocess_ocsp_response_dataqueue_fetch_taskcrl_job_results_as_completedocsp_job_get_earliestcomplete_certificate_fetch_jobsgather_aia_issuer_urls$ACCEPTABLE_STRICT_CERT_CONTENT_TYPESACCEPTABLE_CERT_PEM_ALIASESACCEPTABLE_PKCS7_DER_ALIASESACCEPTABLE_CERT_DER_ALIASES)application/pkix-certapplication/pkcs7-mimeapplication/x-x509-ca-cert application/x-pkcs7-certificates)zapplication/x-pem-filez
text/plainapplication/octet-streambinary/octet-stream)r!   r#   r%   r&   )r"   r$   r&   response_datacontent_typeurl
permit_pemc              #     K   t        j                  |       }||t        v r|s|t        j	                  d| d       t        t        j                  j                  |             }|dk(  rt        | |      E d {    y |dk(  r"t        j                  j                  |        y y |t        v r|st        | |      E d {    y |r^|r\t        j                  | d      D ]A  \  }}}|dk(  rt        ||      E d {    !t        j                  j                  |       C y t        d| d	| d
      7 7 y7 ?w)Nz)Response to certificate fetch request to zi did not include a content type, verifying it's sequence length to check if it is a certificate or pkcs7.r      T)multiplePKCS7zFailed to extract certs from z payload. Source URL: .)r   detectr    loggerwarninglenr   Sequenceload_unpack_der_pkcs7r   Certificater   unarmor
ValueError)	r'   r(   r)   r*   is_pemder_sequence_length	type_name_datas	            c/var/www/html/Beni/venv/lib/python3.12/site-packages/pyhanko_certvalidator/fetchers/common_utils.pyr   r   I   sI     ZZ&F0K KNN;C5 A9 :
 "$--"4"4]"CD!#(<<< A%""''66 &
6
6$]C888	 #&++md"KIq$G#,T3777&&++D11	 #L +L> :%q"
 	
 = 	9 8s7   A9E ;D:<AE D<;E >D>?<E <E >E 
pkcs7_data	pkcs7_urlc              #   ,  K   t         j                  j                  |       }|d   j                  }|dk7  rt	        d| d| d      |d   }t        |d   t         j                        r)|d   D ]   }|j                  dk(  s|j                   " y y w)	Nr(   signed_dataziExpected CMS SignedData when extracting certs from application/pkcs7-mime payload, but content type was 'z'. Source URL: r/   contentcertificatescertificate)	r   ContentInfor5   nativer9   
isinstanceCertificateSetnamechosen)r@   rA   content_infocms_ctrC   cert_choices         r?   r6   r6   p   s     $'OO$8$8$DL.)00Fxyk4
 	

 y)K+n-s/A/AB&~6K=0!((( 7 Cs   A?BBcert	authorityreturnc                *   t        | t        j                        r| j                  }n| d   d   j                  }t        |j                  |      }t        j                  t        j                  d|i      |t        |j                  |      |d      }|S )Nac_infoserial_number	algorithm)hash_algorithmissuer_name_hashissuer_key_hashrU   )rI   r   r7   rU   rH   getattrrK   r   CertIdr
   DigestAlgorithm
public_key)rP   rQ   certid_hash_algorU   iss_name_hashcert_ids         r?   
get_certidra      s     $(()**Y8??INN,<=Mkk#33./ !.&y';';=MN*	
	G N    r^   request_noncesc          	         t        | ||      }t        j                  d|i      }t        j                  dt        j                  |g      i      }|rXt        j
                  ddt        j                  t        j                  d            d      }t        j                  |g      |d<   t        j                  d	|i      S )
N)r^   req_certrequest_listnonceF   )extn_idcritical
extn_valuerequest_extensionstbs_request)ra   r   Request
TBSRequestRequestsTBSRequestExtensionr   OctetStringosurandomTBSRequestExtensionsOCSPRequest)rP   rQ   r^   rc   r`   requestrm   nonce_extensions           r?   r   r      s     y;KLGll	
G
 //DMM7)4	
K 22"!"..rzz"~>
 -1,E,E-
() ]K899rb   ocsp_requestocsp_urlc                ~   	 t         j                  j                  |       }|d   j                  }|dk7  rt	        j                  d|d|d      |j                  }|r<|j                  }|r.|j                  |j                  k7  rt	        j                  d      |S # t        $ r t	        j
                  d      w xY w)Nz)Failed to parse response from OCSP serverresponse_status
successfulzOCSP server at z  returned an error. Status was 'z'.zQUnable to verify OCSP response since the request and response nonces do not match)	r   OCSPResponser5   r9   r   OCSPFetchErrorrH   OCSPValidationErrornonce_value)r'   ry   rz   ocsp_responsestatusrequest_nonceresponse_nonces          r?   r   r      s    Q))..}= ,-44F((!
 	

 !,,M&22 }33~7L7LL,,/  -  Q##$OPPQs   B B<TRresultsrunning_jobstag	async_func                 *  K   	 | |   }t         j                  dt        |       d       t        |      S # t        $ r Y nw xY w	 ||   }t         j                  dt        |       d       |j                          d {  7   t         j                  dt        |       d       t        | |         S # t        $ r t         j                  dt        |       d       t        j                         x||<   }	  |        d {  7  }n<# t        $ r0}t         j                  d	t        |       d
|        |}Y d }~nd }~ww xY w|| |<   t         j                  d	t        |       d       ||= |j                          t        |      cY S w xY ww)NzResult for fetch job with tag z was available in cache.zWaiting for fetch job with tag z to return...z,Received completion signal for job with tag r/   z Starting new fetch job with tag z...zNew fetch job with tag z threw an exception: z
 returned.)
r1   debugrepr_return_or_raiseKeyErrorwaitasyncioEvent	Exceptionset)r   r   r   r   result
wait_eventes          r?   r   r      s    ,T#YK7OP	
  '' ($0$5
6tCykOP oo:49+QG	
  -- (7S	{#FG)08SJ	$;&&F 	LL)$s)4I!M F		
 .tCykDE''!(s   F16 F	AFAF:B6  B4B6 5F6AF;
DDDF	E&E ;F EAFFFFc                 *    t        | t              r| | S N)rI   r   )r   s    r?   r   r     s    &)$Mrb   c                   K   d }d}t        j                  t        |             D ]  }	 | d {   }|  ||s|y y 7 # t        j                  $ r}|}Y d }~9d }~ww xY ww)NF)r   as_completedlistr   CRLFetchError)jobslast_eat_least_one_successcrl_jobfetched_crlr   s         r?   r   r     ss     F ''T
3	 '-K 4 "6 #7 (## 	F	s=   &A&AA	A
A&AA#AA&A##A&c                    K   t        j                  |  }|j                          	 | d {    y 7 # t         j                  $ r Y y w xY wwr   )r   gathercancelCancelledError)pending_taskspendings     r?   
cancel_allr   #  sA     nnm,GNN!! s1   #A3 13 A3 A	AA		Ac                   K   | D cg c]  }t        j                  |       }}d x}}|rFt        j                  |t         j                         d {   \  }}|D ]  }	 | d {   } n |rF|t        |       d {    |S |xs t	        j
                  d      c c}w 7 R7 A# t        j
                  $ r}|}Y d }~gd }~ww xY w7 Jw)N)return_whenzNo OCSP results)r   create_taskr   FIRST_COMPLETEDr   r   r   )r   coroqueue	ocsp_respr   doneocsp_jobr   s           r?   r   r   ,  s     37844W  &4E8I
#LLw66
 
e H"*N	 	  

<F))*;<<! 9

 +((  	 si   CB!0CB&C!B*&B('B*+C1CC%C(B**C	=C?CC		Cc              #     K   t        | t        j                        r| j                  }nt	        | d      }|y |D ]L  }|d   j
                  dk(  s|d   }|j                  dk7  r+|j
                  }|j                  d      sI| N y w)Nauthority_information_accessaccess_method
ca_issuersaccess_locationuniform_resource_identifierhttp)rI   r   r7   "authority_information_access_valuer   rH   rK   
startswith)rP   	aia_valueentrylocationr)   s        r?   r   r   @  s      $(();;	*41OP	!((L8./H}} ==//C~~f%	 s   AB2BBc                   K   t        j                  |       D ]  }	 | d {   }|D ]  }| 	  y 7 # t        j                  $ r#}t        j                  d| d       Y d }~Pd }~ww xY ww)Nz8Error during certificate fetch job, skipping... (Error: ))r   r   r   CertificateFetchErrorr1   r2   )
fetch_jobs	fetch_jobcerts_fetchedr   rP   s        r?   r   r   S  sr     ))*5		"+OM "DJ " 6+++ 	NN#Q  	s7   A0757A07A-
A(#A0(A--A0distribution_pointc              #      K   | d   }|j                   dk7  ry |j                  D ]B  }|j                   dk(  s|j                  }|j                         j	                  d      s?| D y w)Nr   	full_namer   )zhttp://zhttps://)rK   rL   rH   lowerr   )r   rK   general_namer)   s       r?   enumerate_delivery_point_urlsr   a  sf     23DyyK 	 ==%%C yy{%%&=>	 $s   4A*+A*#A*)<__doc__r   loggingrs   typingr   r   r   r   r   r   r	   
asn1cryptor
   r   r   r   r   r   asn1crypto.x509r    r   rQ   r   utilr   __all__	getLogger__name__r1   	frozensetr   r   r    r   bytesstrboolr   r6   r7   AttributeCertificateV2r[   ra   r   rv   r   r   r   r   r   r   r   r   r   r   r   r   r    rb   r?   <module>r      s)  
   	 P P P 8 8 -  ! ) 
		8	$ (1( $ (  (   )  $
$
3-$
 
$
 	$
N)% )C ) 
  #"<"<<
=
 
[[2 :


 : : 	 :
  :F+/+;+;GJ< CLCL.(!U1i<(().(q'--'(.( 
.( IaL()	.(
 1i<.(b=(
  #"<"<<
=&6G rb   