
    &g2H                    4   S r SSKJr  SSKrSSKrSSKJr  SSKJ	r	  SSK
JrJrJrJrJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr   SSK!J"r#  SSK$J%r&  SSK'J(r)  SSK*J+r,  SSK*J-r.  SSK/J0r1  SSK/J2r3  SSK4J5r6  SSK4J7r8  SSK4J9r:  SSK4J;r<  SSK4J=r>  SSK4J?r@  SSKAJBrC  SSKAJDrE  SSKAJFrG  SSKAJHrI  SSKJJKrL  SSKJJMrN  SS KOJPrQ  SS!KRJSrT  SS"KUJVrV  SS#KWJXrXJYrY  \(       a  SS$KZJ[r[J\r\J]r]J^r^J_r_J`r`Jara  SS%KbJcrc  SS&K*Jdrd  SS'K4JereJfrf  SS(KgJhrhJiri  SS)KAJjrjJkrk  SS*KlJmrm  SS+KWJnrn  SS,KoJprp  \\[R.                  \_RD                  \\R8                  \^R                  \]R                  \aRP                  \`RJ                  4   rs\R                  " \u5      rv\R                  " S-\R                  5      ryS:S. jrz        S;S/ jr{          S<S0 jr|      S=S1 jr}S>S2 jr~        S?S3 jr        S@S4 jrSAS5 jrSBS6 jrSAS7 jr          SCS8 jrSDS9 jrg)Ez4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)load_pem_x509_certificate)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)_next_update_this_update)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+c                   [        U S5       nUR                  5       nSSS5        / n[        5       n[        R                  " [
        W5       H  nUR                  [        XT5      5        M     U$ ! , (       d  f       NX= f)z0Parse the tlsCAFile into a list of certificates.rbN)openread_default_backend_refindall_CERT_REGEXappend_load_pem_x509_certificate)cafilefdatatrusted_ca_certsbackend	cert_datas         YC:\Suresh\moveshuttle\MDcreated\moveengine\venv\Lib\site-packages\pymongo/ocsp_support.py_load_trusted_ca_certsrL   i   sf    	fd	qvvx 
  G[[d3	 :9 NO 4 
	s   A00
A>c                    U R                   nU H  nUR                  U:X  d  M  Us  $    U(       a  U H  nUR                  U:X  d  M  Us  $    g N)issuersubject)certchainrH   issuer_name	candidates        rK   _get_issuer_certrU   v   sS     ++K	+  )I  K/   *     c                    [        U [        5      (       a  U R                  X[        5       U5        g[        U [        5      (       a  U R                  XU5        g[        U [
        5      (       a  U R                  X[        U5      5        g[        U [        [        45      (       a  gU R                  X5         g! [         a     gf = f)N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)key	signature	algorithmrG   s       rK   _verify_signaturerf      s    c=))JJy	Y?  ]++JJy	2  455JJyy(9:  "N3
 
 JJy'   s(   0B; 'B; 0B; B; (B; ;
CCc                Z     U R                   R                  U5      $ ! [         a     g f = frN   )
extensionsget_extension_for_class_ExtensionNotFound)rQ   klasss     rK   _get_extensionrl      s.    66u== s    
**c                   U R                  5       n[        U[        5      (       a/  UR                  [        R
                  [        R                  5      nOr[        U[        5      (       a/  UR                  [        R                  [        R                  5      nO.UR                  [        R
                  [        R                  5      n[        [        5       [        5       S9nUR                  U5        UR!                  5       $ )N)rI   )
public_keyrY   rZ   public_bytes	_EncodingDER_PublicFormatPKCS1r^   X962UncompressedPointSubjectPublicKeyInfo_Hash_SHA1r?   updatefinalize)rQ   rn   pbytesdigests       rK   _public_key_hashr}      s    "J
 *m,,((8K8KL	J 7	8	8((9X9XY((8Z8Z[57$4$67F
MM&??rV   c                    U  Vs/ s H2  n[        U5      U:X  d  M  UR                  UR                  :X  d  M0  UPM4     sn$ s  snf rN   )r}   rO   rP   )certificatesrO   responder_key_hashrQ   s       rK   _get_certs_by_key_hashr      sL    
 ! DD!%77 	<@KK6>><Y 	   s   AAAc                    U  Vs/ s H3  nUR                   U:X  d  M  UR                  UR                   :X  d  M1  UPM5     sn$ s  snf rN   )rP   rO   )r   rO   responder_namerQ   s       rK   _get_certs_by_namer      sJ    
 ! D<<>) 	.2kkV^^.K 	   s   AAAc                   UR                   nUR                  nUR                  nUb  X R                  :X  d  X4:X  a  [        R                  S5        U nGO3[        R                  S5        UR                  nUR                   b"  [        X`U5      n[        R                  S5        O![        X`U5      n[        R                  S5        U(       d  [        R                  S5        gUS   n[        U[        5      nU(       a  [        R                  UR                  ;  a  [        R                  S5        g[        U R                  5       UR                   UR"                  UR$                  5      (       d  [        R                  S5        g[        UR                  5       UR                   UR"                  UR&                  5      n	U	(       d  [        R                  S	5        U	$ )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)r   r   issuer_key_hashrP   _LOGGERdebugr   r   r   rl   _ExtendedKeyUsage_ExtendedKeyUsageOIDOCSP_SIGNINGvaluerf   rn   rd   signature_hash_algorithmtbs_certificate_bytestbs_response_bytes)
rO   responsename	rkey_hash	ikey_hashresponder_certcertsresponder_certsextrets
             rK   _verify_response_signaturer      s    ""D++I((IDNN2i6L+,/0 %%"".0EOMM014UINOMM*+MMAB )+ ^->?*77syyHMMDE $$3300	
 
 MMBC
!!#))##	C >?JrV   c                j    [        5       nUR                  X[        5       5      nUR                  5       $ rN   )_OCSPRequestBuilderadd_certificaterx   build)rQ   rO   builders      rK   _build_ocsp_requestr     s*    !#G%%dEG<G==?rV   c                   [         R                  S5        [        X5      nU(       d  g[        U5      n[        R
                  " [        R                  S9nU(       a  UR                  c  UR                  S S9nU(       a  X4:  a  [         R                  S5        g[        U5      nU(       a  XT:  a  [         R                  S5        gg)NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastrX   )r   r   r   r(   	_datetimenowr   utcr   replacer'   )rO   r   resthis_updater   next_updates         rK   _verify_responser     s    MM&'
$V
6C x(K
--8<<
(C{))1kkk&{(34x(K{(12rV   c                0   [        X5      n X4   n[        R                  S5        U$ ! [         Gab    [	        [
        R                  " S5      S5      n [        UUR                  [        R                  5      SS0US9nO.! [         a!  n[        R                  SU5         S nA g S nAff = fUR                  S:w  a"  [        R                  S	UR                  5         g [        UR                  5      n[        R                  S
UR                  5        UR                  [         R"                  :w  a   g UR$                  UR$                  :w  a  [        R                  S5         g ['        X5      (       d   g [        R                  S5        XSU'    U$ f = f)NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rG   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   r   r   KeyErrormaxr&   clamp_remaining_postro   rp   rq   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULserial_numberr   )	rQ   rO   uriocsp_response_cacheocsp_requestocsp_responser   r   excs	            rK   _get_ocsp_responser   (  se    't4L$:+934H G  !: e++A.6		!..y}}=')CD	H ! 	MM3S9	 3&MM4h6J6JK/0@0@A0-2O2OP((,?,J,JJ
 &&,*D*DDMMIJ66./,9L)G!:sR   ( +F+B ?F 
B+
B& F&B++3F AF5/F&F8FFc                   U(       d   eU R                  5       nUc  [        R                  S5        gUR                  5       n[	        U S5      (       a  U R                  5       nSnOU R                  5       nUR                  nU(       d  [        R                  S5        gU Vs/ s H  owR                  5       PM     nn[        XHU5      n	Sn
[        U[        5      nUb@  UR                   H0  nU[        R                  :X  d  M  [        R                  S5        Sn
  O   UR                  nUS:X  Ga  [        R                  S	5        U
(       a  [        R                  S
5        gUR                  (       d  [        R                  S5        g[        U[         5      nUc  [        R                  S5        gUR                   Vs/ s H9  nUR"                  [$        R&                  :X  d  M#  UR(                  R                  PM;     nnU(       d  [        R                  S5        gU	c  [        R                  S5        g[        R                  S5        U H  n[        R                  SU5        [+        XIUU5      nUc  M+  [        R                  SUR,                  5        UR,                  [.        R0                  :X  a    gUR,                  [.        R2                  :X  d  M    g   [        R                  S5        g[        R                  S5        U	c  [        R                  S5        g[5        U5      n[        R                  SUR6                  5        UR6                  [8        R:                  :w  a  g[=        U	U5      (       d  gUU[?        XI5      '   [        R                  SUR,                  5        UR,                  [.        R2                  :X  a  ggs  snf s  snf )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?z!Peer presented a must-staple certTrV   z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failzNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   ) get_peer_certificater   r   to_cryptographyhasattrr   get_peer_cert_chainrH   rU   rl   _TLSFeaturer   _TLSFeatureTypestatus_requestr   check_ocsp_endpoint_AuthorityInformationAccessaccess_method_AuthorityInformationAccessOIDOCSPaccess_locationr   certificate_status_OCSPCertStatusGOODREVOKEDr   r   r   r   r   r   )conn
ocsp_bytes	user_datapycertrQ   pychainrH   cerrR   rO   must_stapleext_tlsfeaturer   ext_aiadescurisr   r   s                      rK   _ocsp_callbackr   U  s-    9&&(F~o&!!#Dt)**))+**,$55+,.56gs  "gE6d+;<FKT;/G}}G/888AB"	 %
 $77 S<=MMQR,,MMJK 'BC?MMFG  
%!!%C%H%HH 'D  &&% 	 

 MM23>MM+,,- CMM+s+)$=PQH MM0(2M2MN**o.B.BB**o.E.EE  	ABMM12~'(&z2HMM,h.F.FG #6#A#AAFH--=E+D9:MM((*E*EF""o&=&==] 7:
s   $O"O)O)rE   strreturnlist[Certificate])rQ   r2   rR   Iterable[Certificate]rH   zOptional[list[Certificate]]r   zOptional[Certificate])
rc   CertificateIssuerPublicKeyTypesrd   bytesre   z%Union[Prehashed, HashAlgorithm, None]rG   r   r   int)rQ   r2   rk   zType[ExtensionTypeVar]r   z%Optional[Extension[ExtensionTypeVar]])rQ   r2   r   r   )r   r   rO   r2   r   zOptional[bytes]r   r   )r   r   rO   r2   r   zOptional[Name]r   r   )rO   r2   r   r7   r   r   )rQ   r2   rO   r2   r   r6   )
rQ   r2   rO   r2   r   zUnion[str, bytes]r   r9   r   zOptional[OCSPResponse])r   r8   r   r   r   zOptional[_CallbackData]r   bool)__doc__
__future__r   logging_loggingrer@   r   r   r   typingr   r   r   r	   r
   cryptography.exceptionsr   rb   cryptography.hazmat.backendsr   r?   -cryptography.hazmat.primitives.asymmetric.dsar   r]   ,cryptography.hazmat.primitives.asymmetric.ecr   r_   r   r^   1cryptography.hazmat.primitives.asymmetric.paddingr   r\   -cryptography.hazmat.primitives.asymmetric.rsar   rZ   .cryptography.hazmat.primitives.asymmetric.x448r   ra   0cryptography.hazmat.primitives.asymmetric.x25519r   r`   %cryptography.hazmat.primitives.hashesr   rx   r   rw   ,cryptography.hazmat.primitives.serializationr   rp   r   rr   cryptography.x509r   r   r   r   r   rj   r   r   r   r   r   rD   cryptography.x509.ocspr   r   r   r   r    r   r!   r   cryptography.x509.oidr"   r   r#   r   requestsr$   r   requests.exceptionsr%   r   pymongor&   pymongo.ocsp_cacher'   r(   )cryptography.hazmat.primitives.asymmetricr)   r*   r+   r,   r-   r.   r/   /cryptography.hazmat.primitives.asymmetric.utilsr0   r1   r2   r3   cryptography.x509.extensionsr4   r5   r6   r7   OpenSSL.SSLr8   r9   pymongo.pyopenssl_contextr:   Ed25519PublicKeyEd448PublicKeyr   	getLogger__name__r   compileDOTALLrB   rL   rU   rf   rl   r}   r   r   r   r   r   r   r    rV   rK   <module>r     s9   ; "   *  A A I L W H T W @ ? N V W C E 7 ? U D L L T N " E  9   JC3H@&-7&+
!!  	'# 

X
&kkDcjj


3Gb&	( 5 	
 	4
4*"'1<Ra'1<N\3l4*
***1B*Yc**ZarV   