
    Wwg                        d dl Z d dlZd dlZd dlmZ d dlmZmZmZm	Z	m
Z
mZ d dlmZmZmZmZ d dlmZ d dlmZ ddlmZ dd	lmZmZ dd
lmZmZ ddlmZmZ ddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2 ddl3m4Z4m5Z5m6Z6m7Z7m8Z8 ddl9m:Z:m;Z; ddl<m=Z=m>Z>m?Z?m@Z@ ddlAmBZBmCZCmDZDmEZEmFZFmGZG ddlHmIZI ddlJmKZK ddlLmMZM ddlNmOZOmPZPmQZQmRZRmSZS  ej                  eU      ZV	 dEde
e>   fdZW	 dEdede;de
e>   fdZXdedej                  deZfdZ[dedej                  deeZ   deeZ   de\f
d Z]	 dEdedej                  de
eeZ      fd!Z^d"ej                  d#efd$Z` eag d%      Zbd&ej                  d'eZd(edfd)Zed*ej                  fd+Zgd"ej                  d,eIfd-Zhd"ej                  d.ej                  defd/Zid0ej                  d1ej                  fd2Zk ed34       G d5 d6             Zl e>       dfd"ej                  ded7e>d0e
ej                     d(elf
d8Zme G d9 d:             Zn eag d;      Zo	 dEdede;d<ede
e>   fd=Zpd>ed<efd?Zqd<efd@Zrdede;d<efdAZsdej                  dBend<efdCZtdej                  dBend<efdDZuy)F    N)	dataclass)Dict	FrozenSetIterableListOptionalSet)algoscmscorex509)Validity)InvalidSignature   )ValProcState)
AAControlsTarget)CertTrustAnchorTrustAnchor)ACTargetDescriptionValidationContext)CRLFetchErrorCRLNoMatchesErrorCRLValidationIndeterminateErrorDisallowedAlgorithmErrorExpiredErrorInsufficientRevinfoErrorInvalidAttrCertificateErrorInvalidCertificateErrorNotYetValidErrorOCSPFetchErrorOCSPNoMatchesErrorOCSPValidationError OCSPValidationIndeterminateErrorPathBuildingErrorPathValidationErrorPSSParameterMismatchStaleRevinfoErrorValidationError)ExcludedSubtreesPermittedSubtreesdefault_excluded_subtreesdefault_permitted_subtreesprocess_general_subtrees)QualifiedPolicyValidationPath)AlgorithmUsagePolicyPKIXValidationParamsRevocationCheckingRuleintersect_policy_sets)PolicyTreeNodePolicyTreeRootapply_policy_mappingenumerate_policy_mappingsprune_unacceptable_policiesupdate_policy_tree)CertificateCollection)
verify_crl)verify_ocsp_response)ConsListextract_dir_nameget_ac_extension_valueget_declared_revinfovalidate_sig
parametersc                 H    t        j                  t        | ||            }|S )a  
    Validates the path using the algorithm from
    https://tools.ietf.org/html/rfc5280#section-6.1.

    Critical extensions on the end-entity certificate are not validated
    and are left up to the consuming application to process and/or fail on.

    .. note::
        This is a synchronous equivalent of :func:`.async_validate_path` that
        calls the latter in a new event loop. As such, it can't be used
        from within asynchronous code.

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        configuring validation behavior

    :param path:
        A pyhanko_certvalidator.path.ValidationPath object of the path to validate

    :param parameters:
        Additional input parameters to the PKIX validation algorithm.
        These are not used when validating CRLs and OCSP responses.

    :raises:
        pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path
        pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked

    :return:
        The final certificate in the path - an instance of
        asn1crypto.x509.Certificate
    )rC   )asynciorunasync_validate_path)validation_contextpathrC   results       U/var/www/horilla/myenv/lib/python3.12/site-packages/pyhanko_certvalidator/validate.pyvalidate_pathrL   I   s'    F [[.LF M    rH   rI   c                 z   K   t        t        j                  |            }t        | |||       d{   S 7 w)a  
    Validates the path using the algorithm from
    https://tools.ietf.org/html/rfc5280#section-6.1.

    Critical extensions on the end-entity certificate are not validated
    and are left up to the consuming application to process and/or fail on.

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        configuring validation behavior

    :param path:
        A pyhanko_certvalidator.path.ValidationPath object of the path to validate

    :param parameters:
        Additional input parameters to the PKIX validation algorithm.
        These are not used when validating CRLs and OCSP responses.

    :raises:
        pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path
        pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked

    :return:
        The final certificate in the path - an instance of
        asn1crypto.x509.Certificate
    )cert_path_stackrC   
proc_stateN)r   r>   singintl_validate_path)rH   rI   rC   rQ   s       rK   rG   rG   r   s<     @ hmmD.ABJ#DZJ   s   2;9;certhostnamec                 V   | j                  |      ry|j                  |      s+t        d| ddj                  |j                         d      |j
                  xr d|j
                  j                  v}|j                  xr d|j                  j                  v}|s|rt        d      y)	a
  
    Validates the end-entity certificate from a
    pyhanko_certvalidator.path.ValidationPath object to ensure that the certificate
    is valid for the hostname provided and that the certificate is valid for
    the purpose of a TLS connection.

    THE CERTIFICATE PATH MUST BE VALIDATED SEPARATELY VIA validate_path()!

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        configuring validation behavior

    :param cert:
        An asn1crypto.x509.Certificate object returned from validate_path()

    :param hostname:
        A unicode string of the TLS server hostname

    :raises:
        pyhanko_certvalidator.errors.InvalidCertificateError - when the certificate is not valid for TLS or the hostname
    Nz0The X.509 certificate provided is not valid for z. Valid hostnames include: , .digital_signatureserver_authzHThe X.509 certificate provided is not valid for securing TLS connections)is_whitelistedis_valid_domain_ipr   joinvalid_domainskey_usage_valuenativeextended_key_usage_value)rH   rT   rU   bad_key_usagebad_ext_key_usages        rK   validate_tls_hostnamerd      s    2 ((.""8,%>xj I((,		$2D2D(E'FaI
 	
 	 	Ct';';'B'BB 
 	%% 	F!>!>!E!EE 
 )%
 	
 *rM   	key_usageextended_key_usageextended_optionalc                    | j                  |      ry|
t               }|
t               }|}|j                  r||j                  j                  z
  }t               }|du r|j                  s|}n.|j                  "|t        |j                  j                        z
  }|s|rkt        ||z        dkD  rdnd}g }t        ||z        D ]#  }	|j                  |	j                  dd             % t        d| d	d
j                  |             y)a  
    Validates the end-entity certificate from a
    pyhanko_certvalidator.path.ValidationPath object to ensure that the
    certificate is valid for the key usage and extended key usage purposes
    specified.

    THE CERTIFICATE PATH MUST BE VALIDATED SEPARATELY VIA validate_path()!

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        configuring validation behavior

    :param cert:
        An asn1crypto.x509.Certificate object returned from validate_path()

    :param key_usage:
        A set of unicode strings of the required key usage purposes

    :param extended_key_usage:
        A set of unicode strings of the required extended key usage purposes

    :param extended_optional:
        A bool - if the extended_key_usage extension may be omitted and still
        considered valid

    :raises:
        pyhanko_certvalidator.errors.InvalidCertificateError - when the certificate is not valid for the usages specified
    NFr   s _ z;The X.509 certificate provided is not valid for the purposez of rW   )r[   setr_   r`   ra   lensortedappendreplacer   r]   )
rH   rT   re   rf   rg   missing_key_usagemissing_extended_key_usagepluralfriendly_purposespurposes
             rK   validate_usagerw      s>   H ((.E	! U!%(<(<(C(CC!$E!$*G*G%7"		&	&	2%7#))00;
 &
" 6 $'AABQF  	
 /2LLM 	@G$$W__S#%>?	@%XT$)),=">!?A
 	
 7rM   c                     | j                  |      ryt        | |dh|xs
 t               |du       |j                  }|t	        |d         rt        d      yy)u   
    Validate AA certificate profile conditions in RFC 5755 § 4.5

    :param validation_context:
    :param cert:
    :param extended_key_usage:
    :return:
    NrY   )re   rf   rg   cazlThe X.509 certificate provided is a CA certificate, so it cannot be used to validate attribute certificates.)r[   rw   rm   basic_constraints_valueboolr   )rH   rT   rf   bcs       rK   validate_aa_usager}     ss     ((. &'-6,D8 
	%	%B	~$r$x.%D
 	
 )~rM   	attr_certacceptable_targetsc           	         t        | d      }|y |D ]  }|D ]  }|j                  dk(  r|j                  }|j                  }nL|j                  dk(  r|j                  }|j                  }n$t
        j                  d|j                   d       w	 ||v }|s  y   t        d      # t        $ r7 |j                         |D ch c]  }|j                          nc c}w c}v }Y Sw xY w)Ntarget_informationtarget_nametarget_group'z1' is not supported as a targeting mode; ignoring.zAC targeting check failed)
r@   namechosenvalidator_namesgroup_membershipsloggerinfo
ValueErrordumpr   )	r~   r   target_infotargetstargetgen_namevalid_names	target_okns	            rK   _validate_ac_targetingr   4  s     )4HIK   	F{{m+!==0@@.!==0BB} %  ! O$3	 -	4 &&A
BB  O
 %MMO+/NQ/N/NN	Os   B''C'C
C'&C')authority_information_accessauthority_key_identifiercrl_distribution_pointsfreshest_crlkey_identifierno_rev_availr   audit_identity
iss_serialerr_msg_prefixreturnc                 d    | d   }t        ||      }d|j                  | d   j                  fz  }|S )zp
    Render a cms.IssuerSerial value into something that matches
    x509.Certificate.issuer_serial output.
    issuer   %s:%dserial)r?   sha256r`   )r   r   issuer_namesissuer_dirnameresult_bytess        rK   _parse_iss_serialr   n  sH     h'L%lNCN8## L rM   aki_extc                     | d   j                   }d x}}t        | d   t        j                        s1t	        | d   d      }| d   j                   }|d|j
                  |fz  }|||fS )Nr   authority_cert_issuerz2Could not decode authority issuer in AKI extensionauthority_cert_serial_numberr   )r`   
isinstancer   Voidr?   r   )r   akiauth_iss_serauth_iss_dirnameauth_sers        rK   _process_aki_extr   ~  s    
"
#
*
*C&**L#g56		B++,@
 9:AA#x&AAL ,..rM   registryc              #     K   | d   d   }d }d }|j                   dk(  r|j                  }n|j                  }t        |d   t        j                        s|d   }t        |d   t        j                        st        |d   d      }t        |d   t        j                        st        d      t        | d	      }|&t        |      \  }}}	|	|||	k7  rt        d
      |	}nd }d}
d }|t        |d      }||j                  |      }||f}
n||j                  |      }
|
D ]*  }||j                  |k7  r||j                  |k7  r'| , y w)Nac_infor   v1_formissuer_namebase_certificate_idz3Could not identify AA issuer in base_certificate_idobject_digest_infoz9Could not identify AA; objectDigestInfo is not supported.r   z\AC's AKI extension and issuer include conflicting identifying information for the issuing AA zCould not identify AA by name)r   r   r   r   r   r   NotImplementedErrorr@   r   r   r?   retrieve_by_issuer_serialretrieve_by_namesubjectr   )r~   r   
issuer_recaa_namesaa_iss_serialissuerv2r   r   	aa_issueraki_aa_iss_serial
candidatesaa_name
exact_certaa_candidates                 rK   _candidate_ac_issuersr     s     9%h/J,0H%)M)#$$)00(=1499=.H(#89499E ../EM (#78$))D%K 
 %Y0JKG,<W,E)Y)((]>O-O1A 
 !2-/JG"8-LM 77F
!$J		..w7
" <#7#77#B?|::cAs   EEaa_certc                    | d   }| d   d   }|j                   }|j                  j                  |||j                        }|j                  |j                  k7  rt        d      |s*t        d|d   j                   dd	d
|j                        	 t        | d   j                  | d   j                         |j                  || d   d          y # t        $ r t        d      t        $ r t        d      w xY w)Nsignature_algorithmr   	signature
public_keyz{Signature algorithm declaration in signed portion of AC does not match the signature algorithm declaration on the envelope.zoThe attribute certificate could not be validated because the signature uses the disallowed signature algorithm 	algorithmz. TF)
is_ee_certis_side_validationbanned_sincerC   r   signed_datapublic_key_infosigned_digest_algorithmrC   zgThe signature parameters for the attribute certificate do not match the constraints on the public key. z]The attribute certificate could not be validated because the signature could not be verified.)best_signature_timealgorithm_policysignature_algorithm_allowedr   r`   r   r   not_allowed_afterrB   r   r'   r   )r~   r   rH   sd_algoembedded_sd_algouse_timedigest_alloweds          rK   _check_ac_signaturer     sF   
 -.G +K8!55H++GGX'*<*< 	H 	
 
 ~~)000)I
 	
 &E{#**+2/ $'99
 	

,33!),113
 $..$+ !67E
	
   
)?
 	
  
)/
 	

s   >C (C:holder_certholderc                    |d   }t               }t        |t        j                        s,t	        |d      }|| j
                  k7  r|j                  d       |d   }t        |t        j                        s,t        |d      }|| j                  k7  r|j                  d       |d   }t        |t        j                        st        d      |S )a  
    Match a candidate holder certificate against the holder entry of an
    attribute certificate.

    :param holder_cert:
        Candidate holder certificate.
    :param holder:
        Holder value to match against.
    :return:
        Return the parts of the holder entry that mismatched as a set.
        Possible values are `'base_certificate_id'`, `'entity_name'` and
        `'object_digest_info'`.
        If the returned set is empty, all entries in the holder entry
        matched the information in the certificate.
    r   z,Could not identify holder certificate issuerentity_namezCould not identify AC holder DNr   z-Object digest info is currently not supported)
rm   r   r   r   r   issuer_serialaddr?   r   r   )r   r   base_cert_id
mismatchesdesignated_iss_serialr   	holder_dnobj_digest_infos           rK   check_ac_holder_matchr      s    " /0LJ lDII. !2H!
 !K$=$==NN01'Kk499-$:
	 +++NN=) 12Ootyy1!;
 	
 rM   T)frozenc                       e Zd ZU dZej
                  ed<   	 ej                  ed<   	 e	ed<   	 e
eej                  f   ed<   y)ACValidationResultzF
    The result of a successful attribute certificate validation.
    r~   r   aa_pathapproved_attributesN)__name__
__module____qualname____doc__r   AttributeCertificateV2__annotations__r   Certificater0   r   strAttCertAttributer   rM   rK   r   r   0  sW     )))   c3#7#7788rM   r   aa_pkix_paramsc                 h  K   | d   d   D ci c]  }|d   j                   t        |d           }}|j                         D ch c]  \  }}|r
|t        vr| }}}|r:t	        dt        |      dk7  rdnd d	d
j                  t        |             d      d|v r%|j                  }|t        d      t        | |       | d   d   }	t        |	      dk(  rt        d      |+t        ||	      }
|
rt        dd
j                  |
             |j                  }t        | |j                        }g }d}|D ]i  }	 t        ||       	 |j#                  |       d{   }|D ];  }	 t'        |||t)        t+        j,                  |      d             d{    |} i k ||st%        d      |d   |j0                  }t3        | ||       | d   d   }|j5                  |       }t)        t+        j,                  |      dd      }t7        t9        |d   |d   d      |j:                  |j<                  |       d|vrt?        | |||        d{    | d   d!   D ci c]&  }|jA                  |d"         r|d"   j                   |( }}tC        | |||#      S c c}w c c}}w # t        $ r}|j!                  |       Y d}~d}~ww xY w7 w# t$        $ r}|j!                  |       Y d}~d}~ww xY w7 g# t.        $ r}|j!                  |       Y d}~d}~ww xY w7 c c}w w)$a  
    Validate an attribute certificate with respect to a given validation
    context.

    :param attr_cert:
        The attribute certificate to validate.
    :param validation_context:
        The validation context to validate against.
    :param aa_pkix_params:
        PKIX validation parameters to supply to the path validation algorithm
        applied to the attribute authority's certificate.
    :param holder_cert:
        Certificate of the presumed holder to match against the AC's holder
        entry. If not provided, the holder check is left to the caller to
        perform.

        .. note::
            This is a convenience option in case there's only one reasonable
            candidate holder certificate (e.g. when the attribute certificates
            are part of a CMS SignedData value with only a single signer).
    :return:
        An :class:`.ACValidationResult` detailing the validation result,
        if successful.
    r   
extensionsextn_idcriticalz^The AC could not be validated because it contains the following unsupported critical extensionr   ri   rj   : rW   rX   r   NzkThe attribute certificate is targeted, but no targeting information is available in the validation context.r   r   zAC holder entry is emptyzYCould not match AC holder entry against supplied holder certificate; mismatched entries: zAA certificate)rO   ee_name_overriderP   z:Could not find a suitable AA for the attribute certificateatt_cert_validity_periodFzthe attribute certificate)rO   r   r  not_before_timenot_after_time)
not_before	not_aftervaliditymoment	tolerancerQ   r   rQ   
attributestype)r~   r   r   r   )"r`   r{   itemsSUPPORTED_AC_EXTENSIONSr   rn   r]   ro   acceptable_ac_targetsr   r   r   path_builderr   certificate_registryr}   rp   async_build_pathsr%   rS   r   r>   rR   r)   lastr   copy_and_append_check_validityr   r	  time_tolerance_check_revocationaa_attr_in_scoper   )r~   rH   r   r   extextensions_presentcritunsupported_critical_extensions	targ_desc	ac_holderr   r  aa_candidates
exceptionsr   r   epathscandidate_pathr   r  ac_pathrQ   attrok_attrss                            rK   async_validate_acr(  L  s    H Y'5 	ItC
O44  ,113'CC66 	'# '
 '%79:a?sRHyy ?@AB!E
 	
 11&<<	-F  	y)4)$X.I
9~)*DEE*;	B
-448IIj4I3JL 
 &22L)%::M #%J(,G% %	0,?	&88FFE
 $ 	%N%(&"-+(0n(E)9 	   )	%%8 #L  Q- llG	7,>?#$>?H %%i0G g. 4J
 &'89%&67
 "(($33
 //)7z
 	
 	
 i(6##DL1 	VT!H  $	 k'V + 	a 	 G  	a 	 # %!!!$$%L	
s   L2#J"L2J'C!L2=J-
KKK#L2)0LL L B7L2L+L2&+L-L2-	K6KL2KL2K	K=!K82L28K==L2 L	L(L#L2#L((L2-L2c                   N   e Zd ZU dZed   ed<   eed<   eed<   eed<   eed<   eed<   ej                  ed	<   ej                  ed
<   e
ed<   eed<   dZeed<   ededee   fd       Zdej$                  fdZdedefdZdefdZdej$                  dededej0                  fdZy)_PathValidationStatez^
    State variables that need to be maintained while traversing a certification
    path
    r6   valid_policy_treeexplicit_policyinhibit_any_policypolicy_mappingmax_path_lengthmax_aa_path_lengthworking_public_keyworking_issuer_namepermitted_subtreesexcluded_subtreesFaa_controls_usedtrust_anchorrC   c                    |j                   }| x}}|j                  |j                  }|j                  |j                  }|j                  }||t	        |j
                  |j
                        }|j                  xr |j                  }|j                  xr |j                  }	|j                  xr |j                  }
t        |j                  xs
 t                     }|j                  |j                  |j                         t        |j                  xs
 t                     }|j                  |j!                  |j                         n|xs |xs
 t#               }|j
                  }|j                  }	|j                  }|j                  }
t        |j                  xs
 t                     }t        |j                  xs
 t                     }t%        t'        j(                  dt+               dh      |||	rdn| dz   |rdn| dz   |
rdn| dz   |j,                  j.                  |j,                  j0                  ||
      }||fS )N
any_policyr   r   )
r+  r3  r4  r,  r-  r.  r1  r2  r/  r0  )trust_qualifiersr/  r0  standard_parametersr4   user_initial_policy_setinitial_any_policy_inhibitinitial_explicit_policyinitial_policy_mapping_inhibitr+   initial_permitted_subtreesr-   intersect_withr*   initial_excluded_subtreesr,   
union_withr2   r*  r6   init_policy_treerm   	authorityr   r   )path_lengthr6  rC   trust_anchor_qualsr/  r0  trust_anchor_paramsacceptable_policiesr<  r=  r>  r?  rA  states                 rK   init_pkix_validation_statez/_PathValidationState.init_pkix_validation_state  sz    *::/::,--90@@O--9!3!F!F0DD!&9&E"722#;;#
 55 :99 ' 22 766 $ 99 >== + *;55 0-/*& #==I*99'BB )944 /,.)% #<<H)44'AA
 K1K5I5K  #-"D"D&0&H&H#)3)N)N&99 + *;55 0-/*& )944 /,.)%
 %,==cel^  :7"9Q{Q/[1_ 4q  ,55@@ , 6 6 ; ;+  25
8 )))rM   rT   c                 8   |j                   sl| j                  dk7  r| xj                  dz  c_        | j                  dk7  r| xj                  dz  c_        | j                  dk7  r| xj                  dz  c_        |j                  }|rX|d   j
                  }|t        | j                  |      | _        |d   j
                  }|t        | j                  |      | _        |j                  0t        |j                  j
                  | j                        | _        y y )Nr   r   require_explicit_policyinhibit_policy_mapping)self_issuedr,  r.  r-  policy_constraints_valuer`   mininhibit_any_policy_value)selfrT   policy_constraintsrL  rM  s        rK   update_policy_restrictionsz/_PathValidationState.update_policy_restrictionsa  s   ##q($$)$""a'##q(#&&!+''1,' "::&8)'f $ '2'*((*A($ &8(&f # &1&)'')?'#
 ((4&)--44d6M6M'D# 5rM   indexrQ   c                     |r+| j                   t        || j                   ||      | _         n	|d | _         | j                   7| j                  dk  r't        j                  d|j                          |      y y )N)depthany_policy_uninhibitedr   NThe path could not be validated because there is no valid set of policies for )r+  r:   r,  r&   
from_statedescribe_cert)rR  rU  certificate_policiesrX  rQ   s        rK   process_policiesz%_PathValidationState.process_policies  s      D$:$:$F%7$&&'=	&D" ")%)D" !!)d.B.Ba.G%00##-#;#;#=">@  /H)rM   c                 H   | j                   j                  |      }|s4t        j                  d|j	                          d|j
                   |      | j                  j                  |      }|s4t        j                  d|j	                          d|j
                   |      y )Nz9The path could not be validated because not all names of z: are in the permitted namespace of the issuing authority. z6The path could not be validated because some names of z; are excluded from the namespace of the issuing authority. )r3  accept_certr&   rZ  r[  error_messager4  )rR  rT   rQ   whitelist_resultblacklist_results        rK   check_name_constraintsz+_PathValidationState.check_name_constraints  s    22>>tD%00K++-. /--=-K-K,LN 	   11==dC%00H++-. /7#1124    rM   r   r	  c                 d   |d   }|d   j                   }|j                  ||| j                        }|sXd|j                          d| d}|j                  |d|j                   dz  }t        j                  |||j                        	 t        |d	   j                   |d
   j                         | j                  ||d   d          y # t        $ r) t        j                  d|j                          d|      t        $ r) t        j                  d|j                          d|      w xY w)Nr   r   r   z9The path could not be validated because the signature of z) uses the disallowed signature mechanism rX   z	 Reason: )r   signature_valuetbs_certificaterC   r   zThe signature parameters for z0 do not match the constraints on the public key.z could not be verified)r`   r   r1  r[  failure_reasonr   rZ  r   rB   r   r'   r&   r   )	rR  rT   r   rQ   r	  r   sd_algo_namesig_algo_allowedmsgs	            rK   check_certificate_signaturez0_PathValidationState.check_certificate_signature  s    044I/J{+22+GGV(?(? H 
   ..01 2''3nA7 
  ..:#3#B#B"C1EE*55-?? 	0188 !2388: $ 7 7(/ 56|D $ 	%00/
0H0H0J/K L? @ 
   	%00K++-..DF 	s   >C A"D/N)r   r   r   r   r   r   intr   PublicKeyInfoNamer+   r*   r5  r{   staticmethodr   r2   rJ  r   rT  r   r]  rc  r1   datetimerk  r   rM   rK   r*  r*    s    
   011***"))''"d"`*!`* 12`* `*D%t/?/? %N
 !6| (-- /- !	-
 !!-rM   r*  )r   r   basic_constraintsr   rf   r   r   re   ocsp_no_checkr\  policy_mappingsrS  r-  name_constraintssubject_alt_nameaa_controlsrQ   c                 H  K   | j                   }|j                  }|j                  }t        j	                  |||      \  }}t        |g d      }	t        |t              r)| j                  |j                  |	       |j                  }
nd}
d}| j                  }t        |j                  t        j                        r|j                  |j                  |      }t        d|dz         D ]  }||   }
|xj                   dz  c_        |j#                  |
| j$                  || j&                         | j)                  |
      s#| j*                  }|
d   d   }t-        ||||       |s)|j                  |
|      st/        |
| ||       d{    |
j0                  |j2                  k7  r(t5        j6                  d	|j9                          d
|      ||k(  s|
j:                  s|j=                  |
|       |j?                  ||
j@                  |jB                  dkD  xs ||k  xr |
j:                  |       ||k  rtE        ||
||       tG        |
|||       |
jH                  tJ        z
  }|rUt5        j6                  d	|j9                          dtM        |      dk7  rdnd ddjO                  tQ        |             |      | s|	jS                  |
      }	| j                  |
|	        |
2tU        ||
|||      }|jW                  |       |	jW                  |       |
S 7 w)az  
    Internal copy of validate_path() that allows overriding the name of the
    end-entity certificate as used in exception messages. This functionality is
    used during chain validation when dealing with indirect CRLs issuer or
    OCSP responder certificates.

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        configuring validation behavior

    :param path:
        A pyhanko_certvalidator.path.ValidationPath object of the path to validate

    :param proc_state:
        Internal state for error reporting and policy application decisions.

    :param parameters:
        Additional input parameters to the PKIX validation algorithm.
        These are not used when validating CRLs and OCSP responses.

    :return:
        The final certificate in the path - an instance of
        asn1crypto.x509.Certificate
    N)intermleafFr   rf  r  r  )rT   rH   rI   rQ   (The path could not be validated because z! issuer name could not be matchedr  r   )rX  rQ   z6 contains the following unsupported critical extensionri   rj   r   rW   )rI  rT   rH  rE  rQ   ),r	  r6  pkix_lenr*  rJ  r0   r   r   record_validationcertificaterevinfo_managerry  r   r   check_asserted_unrevokedrangerU  rk  r   r   r[   r  r  r  r   r2  r&   rZ  r[  rN  rc  r]  certificate_policies_valuer-  _prepare_next_step_check_aa_controlscritical_extensionsSUPPORTED_EXTENSIONSrn   r]   ro   r  _finish_policy_processing_set_qualified_policies)rH   rI   rQ   rC   r	  r6  rE  rI  rH  completed_pathrT   leaf_asserted_nonrevokedr~  rU  r
  r  r  qualified_policiess                     rK   rS   rS     sy    >  &&F $$L--K 	77\:	 &4Rd&N
 ,0,,$$n	
 ''  %(88O$))T--.#2#K#KIIv$
  q+/* WGE{A))//22		
 "006*99I-.z:H!#%	 )#<<T6J##5%	   ;;%333%00:++-. /'( 	  Kt'7'7((*(E 	++ ((1, >K'<D,<,<! 	 		
 ;udEjI4*E
 $$';; 	( +%00:++-. /;=>!C3LTYYv&EFGH	J
   
 ,;;DAN00~FoWG~ 6 3#!
 	$$%78../ABK_s   FL"LD9L"AL"r  c                     || d   j                   |z
  k  r$t        j                  | d   j                   |      || d   j                   |z   kD  r$t        j                  | d   j                   |      y )Nr  )
valid_fromrQ   r  )
expired_dtrQ   )r`   r    formatr   r  s       rK   r  r    s     &--	99%%-44
 	
 %,,y88!!,33

 	
 9rM   c                    | j                   dk7  r| xj                   dz  c_         |j                  r#|j                  d   j                  dk(  rd| _         | j                  d n*|dhk(  r| j                  nt	        | j                  |      t               }&dt        t           ffd}t         |             }|S | j                   dk(  r(t        j                  d|j                          d|      |S )	Nr   r   rL  r8  r   c               3      K   J j                        D ]Y  } | j                  }|dk7  r!t        d | j                         D              }nd}t	        ||t        | j                               [ y w)Nr8  c              3   f   K   | ])  }|j                   j                  d k(  r|j                   + yw)r8  N)parentvalid_policy).0ancestors     rK   	<genexpr>zD_finish_policy_processing.<locals>._enum_policies.<locals>.<genexpr>  s0      1$#??77<G !--1s   /1)user_domain_policy_idissuer_domain_policy_id
qualifiers)at_depthr  nextpath_to_rootr/   	frozensetqualifier_set)accepted_policy
listed_polr  intersectionrE  s      rK   _enum_policiesz1_finish_policy_processing.<locals>._enum_policies  s     +++#/#8#8#E ,99
- -1 1(7(D(D(F1 -) -9)%*?,6()F)FG %s   A3A6rY  rX   )r,  rO  r`   r+  r9   r  r   r/   r&   rZ  r[  )rI  rT   rH  rE  rQ   r  r  r  s      `   @rK   r  r    s    !"$$(()BCJJaO$%E! & 
	... 3002E
 6?[	 9 	6 '~'78  
		!	#!,,&4467q:
 	

 rM   c                 F  K   d}d}d}d}d}g }	t        |       \  }
}|
xs |}|j                  j                  }|j                  r|j                  n|j
                  }d }|j                  r|r	 t        | |||       d {    d}d}|sS|j&                  rG|	rdj)                  d |	D              }nd}t+        j,                  d|j/                          d	| |      |xr |t0        j2                  k7  }d}d }|j4                  xs | xr |t0        j6                  k(  }|j8                  xr |
}|s|r |s	 t;        | |||       d {    d}d}d}|sS|j4                  rG|	rdj)                  d
 |	D              }nd}t+        j,                  d|j/                          d	| |      |jB                  xs |xr |t0        jD                  k(  }|xs |}| xr |}|s|sr|rp|rnd|j/                  d       ddj)                  |	       }|xs |}|r)|r|rtG        ||      n|}tI        jJ                  |||      t+        j,                  ||      |r't+        j,                  d|j/                          |      y y 7 # t        $ rM}|	j                  |j                  D cg c]  }|d   	 nc c}w c}       d}d}|j                  }Y d }~Fd }~wt        $ r Y Ut        $ rK}|j                  rd}|j                  |       n |	j!                  |j"                  d          d}Y d }~d }~wt$        $ r-}|	j!                  |j"                  d          d}d}Y d }~d }~ww xY w7  # t<        $ rM}|	j                  |j                  D cg c]  }|d   	 nc c}w c}       d}d}|j                  }Y d }~id }~wt>        $ r Y xt@        $ rK}|j                  rd}|j                  |       n |	j!                  |j"                  d          d}Y d }~d }~ww xY ww)NFr  Tr   z; c              3   2   K   | ]  }t        |        y wNr   r  fs     rK   r  z$_check_revocation.<locals>.<genexpr>5       91A9   z.an applicable OCSP response could not be foundzHThe path could not be validated because the mandatory OCSP check(s) for z	 failed: c              3   2   K   | ]  }t        |        y wr  r  r  s     rK   r  z$_check_revocation.<locals>.<genexpr>d  r  r  z$an applicable CRL could not be foundzGThe path could not be validated because the mandatory CRL check(s) for rz  )
def_intermz revocation checks failed: zUThe path could not be validated because no revocation information could be found for )&rA   revinfo_policyrevocation_checking_policyr   ee_certificate_ruleintermediate_ca_cert_ruleocsp_relevantr=   r$   extendfailuressuspect_staler"   r!   tolerant_report_soft_failrp   argsr#   ocsp_mandatoryr]   r   rZ  r[  r3   CRL_AND_OCSP_REQUIREDcrl_mandatoryCRL_OR_OCSP_REQUIREDcrl_relevantr<   r   r   r   strictCHECK_IF_DECLAREDmaxr(   r  )rT   rH   rI   rQ   ocsp_status_goodrevocation_check_failedocsp_matchedcrl_matched	soft_failr  cert_has_crlcert_has_ocsprevinfo_declaredrev_check_policyrev_ruleocsp_suspect_stale_sincer"  failureerr_strstatus_goodcrl_status_goodcrl_suspect_stale_sincecrl_required_by_policycrl_fetchableexpected_revinfomatchedexpected_revinfo_not_foundrj  maybe_stale_cutoffstale_cutoffs                                 rK   r  r    s     #LKIH"6t"<L-#4}))DD 
    	,,77   $-	 &d.:    $L&  7 7ii999GFG&11&4467y	K
 	
 	 	E.DDD 
 O" &33  	D.CCC  )):lM-	/d.:   ',#"OK  x55ii999G<G&11&4467y	K
 	
    	A.@@@ 
 )\G%,!A1Aw+B:++t+<= >""&))H"5!68  )C,C  " 04K 02IJ+ 
 (..sL*MM.99  &*5522<2J2J2L1MO  &- {
 0 	7OOqzzBGWQZBBC&*#L'($! 	 	/   	"44Q7q	**.'" 	 OOAFF1I&&*#L	 < / 	6OOqzzBGWQZBBC&*#K&'oo#  	 	/   	"44Q7q	**.'	/s   A+P!.I>  I;I> 	B,P!6M+ M(	
M+ D(P!;I> >	M%K J-
,K	P!M%P!M%&A L,&P!,M%8"M P! M%%P!(M+ +	P4N<N
N<6P!<PP!PA PP!PP!rI  c                 n   t        j                  |       }|j|j                  s-|dkD  r(t        j                  d|j                          d|      d|_        |d   j                  }|||j                  k  r||_        y y y |j                  r(t        j                  d|j                          d|      y )Nr   zEAA controls extension only present on part of the certificate chain: z6 has AA controls while preceding certificates do not. Tpath_len_constraintz has no AA controls )r   read_extension_valuer5  r&   rZ  r[  r`   r0  )rT   rI  rU  rQ   rv  new_max_aa_path_lengths         rK   r  r    s     11$7K%%%!)%00&&0&>&>&@%A BAB 	  "&!,-B!C!J!J".&)A)AA'=E$ B / 
		!,,"",":":"<!= >"# 	
 	
 
 rM   c                    |j                   rNt        |j                   |      }|j                  +t        ||j                  | |j                  dkD        |_        |j
                  |_        d }|j                  j                  dk(  rQ|j                  j                  ;|j                  j                  dk(  r"|j                  d   }|d   j                         }|r*|j                  j                         }||d   d<   ||_
        n|j                  |_
        |j                  }||d   }	t        |	t        j                        r$|j                   j#                  t%        |	             |d   }
t        |
t        j                        r$|j&                  j)                  t%        |
             |j+                  |       |j,                  s(t/        j0                  d	|j3                          d
|      |j4                  st|j6                  dk(  rt/        j0                  d|      |xj6                  dz  c_        |j8                  dk(  rt/        j0                  d|      |xj8                  dz  c_        |j6                  *|j6                  |j6                  k  r|j6                  |_        |j:                  rAd|j:                  j<                  vr(t/        j0                  d	|j3                          d|      y y )Nr  r   )rW  policy_mapping_uninhibiteddsar   rC   r3  r4  rz  z is not a CAzJThe path could not be validated because it exceeds the maximum path lengthr   z`The path could not be validated because it exceeds the maximum path length for an AA certificatekey_cert_signz$ is not allowed to sign certificates)policy_mappings_valuer8   r+  r7   r.  r   r2  r   r   	hash_algor1  copyname_constraints_valuer   r   GeneralSubtreesr3  r@  r.   r4  rB  rT  ry   r&   rZ  r[  rN  r/  r0  r_   r`   )rU  rT   rI  rQ   
policy_mapcopy_paramskey_algr1  nc_valuenew_permitted_subtreesnew_excluded_subtreess              rK   r  r    s    !!.&&:


 "".&:''+0+?+?!+C	'E# !%E K  E)doo.G.G.O##--6..{;G!,/446K!__1138C;'5#5 #'??  &*%@%@H!)*>!?,d.B.BC$$33()?@ !))< =+T-A-AB##..()>?
 
$$T* 77!,,6'')*,8
 	
   A%%00& 
 	"##q(%00< 
 	  A%  	(  5#8#88 $ 4 4 	4#7#7#>#>>!,,6'')**NP
 	
 ? 	rM   r  )vrE   rp  loggingdataclassesr   typingr   r   r   r   r   r	   
asn1cryptor
   r   r   r   asn1crypto.x509r   cryptography.exceptionsr   _stater   
asn1_typesr   r   rD  r   r   contextr   r   errorsr   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   
name_treesr*   r+   r,   r-   r.   rI   r/   r0   policy_declr1   r2   r3   r4   policy_treer5   r6   r7   r8   r9   r:   r   r;   revinfo.validate_crlr<   revinfo.validate_ocspr=   utilr>   r?   r@   rA   rB   	getLoggerr   r   rL   rG   r   r   rd   r{   rw   r}   r   r   r  r  IssuerSerialbytesr   AuthorityKeyIdentifierr   r   r   Holderr   r   r(  r*  r  rS   r  r  r  r  r  r   rM   rK   <module>r     s      ! A A - - $ 4   * 3 ;    (  2   , , 7  
		8	$ LP&*23G*H&X 26#)#
# -.#L/
)/
151A1A/
MP/
dE
)E



E
 3xE
 C	E

 E
V .2
)




 !S*
D$C))$C+$CN $ &  25
 /d99 /<))<5J<~1
))1
1
 *1
h-t'7'7 - -` $  < ,@+A.2	\))\)\ )\ $**+	\
 \~ x x xx ! 4 26	q)q
q q -.	qh



7C

??K?DS)S S 	Sl





 	
@e



e
  e
 	e
rM   