
    Wwg*                        d Z ddlZddlZddlZddlmZmZmZmZm	Z	m
Z
 ddlmZmZmZmZmZmZ ddlmZ ddlmZ ddlmZ g d	Z ej2                  e      Z eg d
      Z eg d      Z eg d      Z eg d      Z de!dee"   de"de#fdZ$de!de"fdZ%de
ejL                  ejN                  f   dedejP                  fdZ)dejL                  dede"de#fdZ*de!dejV                  de"fdZ, e	d       Z- e	d!      Z.d"ee-e
e.e/f   f   d#ee-ej`                  f   d$e-d%eg ee.   f   de
e.e/f   f
d&Z1d' Z2d( Z3d) Z4d* Z5de
ejL                  ejN                  f   fd+Z6d, Z7y)-zd
Internal backend-agnostic utilities to help process fetched certificates, CRLs
and OCSP responses.
    N)	AwaitableCallableDictOptionalTypeVarUnion)algoscmscoreocsppemx509   )errors)	Authority)get_ac_extension_value)unpack_cert_contentformat_ocsp_requestprocess_ocsp_response_dataqueue_fetch_taskcrl_job_results_as_completedocsp_job_get_earliestcomplete_certificate_fetch_jobsgather_aia_issuer_urls$ACCEPTABLE_STRICT_CERT_CONTENT_TYPESACCEPTABLE_CERT_PEM_ALIASESACCEPTABLE_PKCS7_DER_ALIASESACCEPTABLE_CERT_DER_ALIASES)application/pkix-certapplication/pkcs7-mimeapplication/x-x509-ca-cert application/x-pkcs7-certificates)zapplication/x-pem-filez
text/plainapplication/octet-streambinary/octet-stream)r   r!   r#   r$   )r    r"   r$   response_datacontent_typeurl
permit_pemc              #     K   t        j                  |       }||t        v r|s|t        j	                  d| d       t        t        j                  j                  |             }|dk(  rt        | |      E d {    y |dk(  r"t        j                  j                  |        y y |t        v r|st        | |      E d {    y |r^|r\t        j                  | d      D ]A  \  }}}|dk(  rt        ||      E d {    !t        j                  j                  |       C y t        d| d	| d
      7 7 y7 ?w)Nz)Response to certificate fetch request to zi did not include a content type, verifying it's sequence length to check if it is a certificate or pkcs7.r      T)multiplePKCS7zFailed to extract certs from z payload. Source URL: .)r   detectr   loggerwarninglenr   Sequenceload_unpack_der_pkcs7r   Certificater   unarmor
ValueError)	r%   r&   r'   r(   is_pemder_sequence_length	type_name_datas	            b/var/www/horilla/myenv/lib/python3.12/site-packages/pyhanko_certvalidator/fetchers/common_utils.pyr   r   H   sM     ZZ&F0K KNN;C5 A9 :
 "$--"4"4]"CD!#(<<< A%""''66 &
6
6$]C888	 #&++md"K 	2Iq$G#,T3777&&++D11		2 +L> :%q"
 	
 = 	9 8s7   A9E ;D:<AE D<;E >D>?<E <E >E 
pkcs7_data	pkcs7_urlc              #   ,  K   t         j                  j                  |       }|d   j                  }|dk7  rt	        d| d| d      |d   }t        |d   t         j                        r)|d   D ]   }|j                  dk(  s|j                   " y y w)	Nr&   signed_dataziExpected CMS SignedData when extracting certs from application/pkcs7-mime payload, but content type was 'z'. Source URL: r-   contentcertificatescertificate)	r
   ContentInfor3   nativer7   
isinstanceCertificateSetnamechosen)r>   r?   content_infocms_ctrA   cert_choices         r=   r4   r4   o   s     $'OO$8$8$DL.)00Fxyk4
 	

 y)K+n-s/A/AB&~6 	)K=0!(((	) Cs   A?BBcert	authorityreturnc                *   t        | t        j                        r| j                  }n| d   d   j                  }t        |j                  |      }t        j                  t        j                  d|i      |t        |j                  |      |d      }|S )Nac_infoserial_number	algorithm)hash_algorithmissuer_name_hashissuer_key_hashrS   )rG   r   r5   rS   rF   getattrrI   r   CertIdr	   DigestAlgorithm
public_key)rN   rO   certid_hash_algorS   iss_name_hashcert_ids         r=   
get_certidr_      s     $(()**Y8??INN,<=Mkk#33./ !.&y';';=MN*	
	G N    r\   request_noncesc          	         t        | ||      }t        j                  d|i      }t        j                  dt        j                  |g      i      }|rXt        j
                  ddt        j                  t        j                  d            d      }t        j                  |g      |d<   t        j                  d	|i      S )
N)r\   req_certrequest_listnonceF   )extn_idcritical
extn_valuerequest_extensionstbs_request)r_   r   Request
TBSRequestRequestsTBSRequestExtensionr   OctetStringosurandomTBSRequestExtensionsOCSPRequest)rN   rO   r\   ra   r^   requestrk   nonce_extensions           r=   r   r      s     y;KLGll	
G
 //DMM7)4	
K 22"!"..rzz"~>
 -1,E,E-
() ]K899r`   ocsp_requestocsp_urlc                ~   	 t         j                  j                  |       }|d   j                  }|dk7  rt	        j                  d|d|d      |j                  }|r<|j                  }|r.|j                  |j                  k7  rt	        j                  d      |S # t        $ r t	        j
                  d      w xY w)Nz)Failed to parse response from OCSP serverresponse_status
successfulzOCSP server at z  returned an error. Status was 'z'.zQUnable to verify OCSP response since the request and response nonces do not match)	r   OCSPResponser3   r7   r   OCSPFetchErrorrF   OCSPValidationErrornonce_value)r%   rw   rx   ocsp_responsestatusrequest_nonceresponse_nonces          r=   r   r      s    Q))..}= ,-44F((!
 	

 !,,M&22 }33~7L7LL,,/  -  Q##$OPPQs   B B<TRresultsrunning_jobstag	async_func                 *  K   	 | |   }t         j                  dt        |       d       t        |      S # t        $ r Y nw xY w	 ||   }t         j                  dt        |       d       |j                          d {  7   t         j                  dt        |       d       t        | |         S # t        $ r t         j                  dt        |       d       t        j                         x||<   }	  |        d {  7  }n<# t        $ r0}t         j                  d	t        |       d
|        |}Y d }~nd }~ww xY w|| |<   t         j                  d	t        |       d       ||= |j                          t        |      cY S w xY ww)NzResult for fetch job with tag z was available in cache.zWaiting for fetch job with tag z to return...z,Received completion signal for job with tag r-   z Starting new fetch job with tag z...zNew fetch job with tag z threw an exception: z
 returned.)
r/   debugrepr_return_or_raiseKeyErrorwaitasyncioEvent	Exceptionset)r   r   r   r   result
wait_eventes          r=   r   r      s    ,T#YK7OP	
  '' ($0$5
6tCykOP oo:49+QG	
  -- (7S	{#FG)08SJ	$;&&F 	LL)$s)4I!M F		
 .tCykDE''!(s   F16 F	AFAF:B6  B4B6 5F6AF;
DDDF	E&E ;F EAFFFFc                 *    t        | t              r| | S N)rG   r   )r   s    r=   r   r     s    &)$Mr`   c                   K   d }d}t        j                  t        |             D ]  }	 | d {   }|  ||s|y y 7 # t        j                  $ r}|}Y d }~9d }~ww xY ww)NF)r   as_completedlistr   CRLFetchError)jobslast_eat_least_one_successcrl_jobfetched_crlr   s         r=   r   r     sx     F ''T
3 	 '-K "6 #7 (## 	F	s=   &A&AA	A
A&AA#AA&A##A&c                    K   t        j                  |  }|j                          	 | d {    y 7 # t         j                  $ r Y y w xY wwr   )r   gathercancelCancelledError)pending_taskspendings     r=   
cancel_allr   "  sA     nnm,GNN!! s1   #A3 13 A3 A	AA		Ac                   K   | D cg c]  }t        j                  |       }}d x}}|rFt        j                  |t         j                         d {   \  }}|D ]  }	 | d {   } n |rF|t        |       d {    |S |xs t	        j
                  d      c c}w 7 R7 A# t        j
                  $ r}|}Y d }~gd }~ww xY w7 Jw)N)return_whenzNo OCSP results)r   create_taskr   FIRST_COMPLETEDr   r}   r   )r   coroqueue	ocsp_respr   doneocsp_jobr   s           r=   r   r   +  s     3784W  &8E8I
#LLw66
 
e  	H"*N			  

<F))*;<<! 9

 +((  	 si   CB!0CB&C!B*&B('B*+C1CC%C(B**C	=C?CC		Cc              #     K   t        | t        j                        r| j                  }nt	        | d      }|y |D ]L  }|d   j
                  dk(  s|d   }|j                  dk7  r+|j
                  }|j                  d      sI| N y w)Nauthority_information_accessaccess_method
ca_issuersaccess_locationuniform_resource_identifierhttp)rG   r   r5   "authority_information_access_valuer   rF   rI   
startswith)rN   	aia_valueentrylocationr'   s        r=   r   r   ?  s      $(();;	*41OP	 !((L8./H}} ==//C~~f%	s   AB2BBc                   K   t        j                  |       D ]  }	 | d {   }|D ]  }| 	  y 7 # t        j                  $ r#}t        j                  d| d       Y d }~Pd }~ww xY ww)Nz8Error during certificate fetch job, skipping... (Error: ))r   r   r   CertificateFetchErrorr/   r0   )
fetch_jobs	fetch_jobcerts_fetchedr   rN   s        r=   r   r   R  s|     ))*5 
		"+OM " 	DJ	
+++ 	NN#Q  	s7   A0757A07A-
A(#A0(A--A0)8__doc__r   loggingrq   typingr   r   r   r   r   r   
asn1cryptor	   r
   r   r   r   r    r   rO   r   utilr   __all__	getLogger__name__r/   	frozensetr   r   r   r   bytesstrboolr   r4   r5   AttributeCertificateV2rY   r_   r   rt   r   r   r   r   r   r   r   r   r   r   r   r    r`   r=   <module>r      s  
   	 F F 8 8  ! ) 
		8	$ (1( $ (  (   )  $
$
3-$
 
$
 	$
N)% )C ) 
  #"<"<<
=
 
[[2 :


 : : 	 :
  :F+/+;+;GJ< CLCL.(!U1i<(().(q'--'(.( 
.( IaL()	.(
 1i<.(b=(
  #"<"<<
=&r`   