
    WwgX                        d dl Z d dlmZ d dlmZ d dlmZmZmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZ d dlmZ d d	lmZ d d
lmZmZmZ d dlmZ d dlmZmZmZmZmZm Z  d dl!m"Z" d dl#m$Z$m%Z%m&Z& d dl'm(Z(m)Z)m*Z* d dl+m,Z, d dl-m.Z.m/Z/ d dl0m1Z1 d dl2m3Z3m4Z4m5Z5 dZ6dejn                  dede"fdZ8dejn                  dedede"def
dZ9dejn                  fdZ:e G d de,             Z;deejn                  e	jx                  f   ded e.d!e;d"e=f
d#Z>d e.d$e(d!e;d"eejn                     fd%Z?dejn                  ded&e=d"ee=   fd'Z@dejn                  ded(e"d e.ded&e=d!e;ded"e=fd)ZAd e.ded*ee   d"e=fd+ZBd,ed e.d!e;d"e=fd-ZCdeejn                  e	jx                  f   ded e.d$e(d!e;d"eejn                     fd.ZDdeejn                  e	jx                  f   ded/e"d e.ded!e;ded"e=fd0ZE	 d:deejn                  e	jx                  f   d/e"dedee   fd1ZF ed23       G d4 d5             ZG ed23       G d6 d7             ZH	 d:deejn                  e	jx                  f   d/e"d8e1d*edee   d"eHfd9ZIy);    N)	dataclass)datetime)ListOptionalUnion)cmscrlx509)	CRLReason)PublicKeyInfo)InvalidSignature)ValProcState)	AuthorityAuthorityWithCertTrustAnchor)ValidationContext)OCSPNoMatchesErrorOCSPValidationError OCSPValidationIndeterminateErrorPathValidationErrorPSSParameterMismatchRevokedError)ValidationPath)CertRevTrustPolicyRevocationCheckingPolicyRevocationCheckingRule)CertificateCollectionLayeredCertificateStoreSimpleCertificateStore)Errors)OCSPContainerRevinfoUsabilityRating)RevinfoManager)ConsListextract_ac_issuer_dir_namevalidate_sigzXUnable to verify OCSP response since response signing certificate could not be validatedresponder_certissueree_pathc                     t        |t              r|j                  |j                  |       }|S t	        t        |      g |       }|S )Ntrust_anchorintermleaf)
isinstancer   truncate_to_and_appendcertificater   r   )r'   r(   r)   responder_chains       b/var/www/horilla/myenv/lib/python3.12/site-packages/pyhanko_certvalidator/revinfo/validate_ocsp.py_delegated_ocsp_response_pathr4   7   sR     &+,!88
  )$V,Rn
     validation_context
proc_statec                   K   |j                  |       r-t        j                  d| j                  j                  z  |      ddlm} |j                  d      dz   }| j                  t        t        t        j                  t        j                              }t        t        |      gd	||j                  |j                   |j"                  
      }t%        t        |      g |       }	t'        |j(                  j+                  |	      |      }
	  |||	|
       d {    t1        | ||      }|j3                  | |       y t1        | ||      }t'        |j(                  j+                  |      |      }	  ||||       d {    y 7 l# t        $ r}t-        t.              |d }~ww xY w7 (# t        $ r}t-        t.              |d }~ww xY ww)NzVRecursion detected in OCSP responder authorisation check for responder certificate %s.r   )intl_validate_pathT)	never_defz OCSP responder)ee_certificate_ruleintermediate_ca_cert_rule)revocation_checking_policyF)trust_rootsallow_fetchingrevinfo_policymomentalgorithm_usage_policytime_tolerancer+   )cert_path_stackee_name_override)pathr7   )check_path_verif_recursionr   
from_statesubjecthuman_friendlypyhanko_certvalidator.validater9   describe_certocsp_no_check_valuer   r   r   NO_CHECKr   r   rA   algorithm_policyrC   r   r   rD   consr   OCSP_PROVENANCE_ERRr4   record_validation)r'   r(   r6   r)   r7   r9   ocsp_ee_name_overrider@   vcocsp_trunc_pathocsp_trunc_proc_stateer2   ocsp_proc_states                 r3   #_validate_delegated_ocsp_provenancerY   E   s     ,,^< ",,(*8*@*@*O*OP
 	
 B 	  4 03DD  ))5 ,'?$:$C$C*@*I*I(
 $V,- )%,,#5#F#F-<<
 )$V,Rn
 !-&66;;OL2!
	B$5J   8FG
 	,,^_M7FG
 '&66;;OL2
	B$"$*  1 # 	B%&9:A	B*
 # 	B%&9:A	Bss   DGF  F!F %AG9F2 F0F2 GF 	F-F((F--G0F2 2	G;GGGc                 B    | j                   }|d uxr d|j                  v S )Nocsp_signing)extended_key_usage_valuenative)r'   extended_key_usages     r3   _ocsp_allowedr_      s/    '@@$& 	80777r5   c                       e Zd ZU dZeed<   y)	_OCSPErrsr   mismatch_failuresN)__name__
__module____qualname__rb   int__annotations__ r5   r3   ra   ra      s    sr5   ra   certocsp_responseerrsreturnc                    |j                         }||xj                  dz  c_        y|d   }|d   d   j                  }t        | t        j
                        }|r#t        | j                  |      }| j                  }	n)t        |       }
t        |
|      }| d   d   j                  }	t        |j                  |      }|d   j                  |k7  }|d	   j                  |k7  }|d   j                  |	k7  }|s|r|r|xj                  dz  c_        y|r|j                  d
|       y|r|j                  d|       y|r|j                  d|       yy)N   Fcert_idhash_algorithm	algorithmac_infoserial_numberissuer_key_hashissuer_name_hashz-OCSP response issuer name hash does not matchz6OCSP response certificate serial number does not matchz,OCSP response issuer key hash does not matchT)extract_single_responserb   r]   r/   r
   Certificategetattrr(   rs   r%   
public_keyappend)ri   r(   rj   rk   cert_responseresponse_cert_idissuer_hash_algois_pkccert_issuer_name_hashcert_serial_numberiss_namecert_issuer_key_hashkey_hash_mismatchname_mismatchserial_mismatchs                  r3   _match_ocsp_certidr      s    "99;M!#$Y/'(89+FMMd../F '5E F!//-d3 '2B C!)__=DD"6#4#46FG 	*+226JJ 
 	+,337LL  	)004FF  	.?!#;]	
 D	
 :M	
 r5   
cert_storec                 d   | j                         }|J |d   r#t        t        j                  |d         |g      }|d   }|d   j                  dk(  r!|d   j
                  }|j                  |      }n'|j                  |d   j                        }|r|d   nd }|s|j                  d|        |S )Ncertstbs_response_dataresponder_idby_keyr   zVUnable to verify OCSP response since response signing certificate could not be located)
extract_basic_ocsp_responser   r   
from_certsnamer]   retrieve_by_key_identifierretrieve_by_namechosenrz   )rj   r   rk   responsetbs_responsekey_identifierr'   candidate_responder_certss           r3   _identify_responder_certr      s     88:H,#..x/@A:N

 /0LN#((H4%n5<<#>>~N$.$?$?(//%
! -F%a(4 	 /	

 r5   r~   c                     t        |t              rP|j                  j                  | j                  k(  r-|j                  }t	        |d         }t	        | d         }||k(  S t        |       r|syy)z
    This function checks OCSP conditions that don't require path validation
    to pass. If ``None`` is returned, path validation is necessary to proceed.
    signature_valueFN)r/   r   r1   issuer_serialbytesr_   )r'   r(   r~   issuer_cert
issuer_sigresponder_sigs         r3   _precheck_ocsp_responder_authr     ss     	6,-,,0L0LL(( ;'89:
n->?@]** >*&r5   	cert_pathc                   K   t        | ||      }||}	n	 t        | ||||       d {    d}	|	s|j                  d|       |	S 7 # t        $ r+}
|j                  |
j                  d   |       d}	Y d }
~
Gd }
~
ww xY ww)N)r'   r(   r6   r)   r7   Tr   FzWUnable to verify OCSP response since response was signed by an unauthorized certificate)r   rY   r   rz   args)r'   r(   r   rj   r6   r~   rk   r7   simple_checkauth_okrW   s              r3   _check_ocsp_authorisationr   0  s      1PL 	5-#5!%   G 4	

 N# # 	KKq	=1G	s=   A?A AA A?A 	A<!A72A?7A<<A?control_timec                 &   | j                         }|y|d   j                  }|dk(  ry|dk(  rd|d   j                  }|d   }|j                  t	        j
                  d      }|d   j                  }|||k  rt        j                  ||d	|
      y)NFcert_statusgoodTrevokedrevocation_reasonunspecifiedrevocation_timezOCSP response)reasonrevocation_dtrevinfo_typer7   )rv   r   r   r]   r	   r   r   format)rj   r7   r   r{   statusrevocation_infor   r   s           r3   _check_ocsp_statusr   U  s    
 "99;M =)..F'6==+,?@== ]]=1F"12C"D"K"K=L#@%%+,%	  r5   responder_keyc                    |j                         }|y|d   }	 t        |d   j                  |j                         |d   | |d   d          y# t        $ r |j                  d|       Y yt        $ r |j                  d	|       Y yw xY w)
NFr   	signaturesignature_algorithm
parameters)r   signed_datasigned_digest_algorithmpublic_key_infor   Tz\The signature parameters on the OCSP response do not match the constraints on the public keyz(Unable to verify OCSP response signature)r   r&   r]   dumpr   rz   r   )r   rj   rk   r   r   s        r3   _verify_ocsp_signaturer   t  s     88:H /0LO{+22$))+$,-B$C) 56|D	
  
0	
   O>NOs   4A B	,B	B	c                     t        | |||      }|sy t        |||      }|sy t        |j                  ||      }|sy |S )N)r(   rj   rk   )r   rk   )r   rj   rk   )r   r   r   ry   )ri   r(   rj   r   rk   matchedr'   signature_oks           r3   _assess_ocsp_relevancer     s_     !V=tG -*4N )$//#L
 r5   rF   c                 b  K   t        | |||j                  |      }|y|j                  |j                  |j                        }|j
                  }	|	t        j                  k7  r^|	t        j                  k(  rd}
|j                  |j                         n|	t        j                  k(  rd}
nd}
|j                  |
|d       yt        |||||t        | t        j                         ||	       d {   }|sy|j                  }|j"                  r|j$                  nd }t'        |||      S 7 :w)
Nri   r(   rj   r   rk   F)policytiming_paramsz"OCSP response is not recent enoughzOCSP response is too recentz0OCSP response freshness could not be establishedT)is_freshness_failure)r(   r   rj   r6   r~   rk   r7   )r   certificate_registry	usable_atr@   r   ratingr"   OKSTALEupdate_stalelast_usable_atTOO_NEWrz   r   r/   r
   rw   point_in_time_validationvalidation_timer   )ri   r(   rF   rj   r6   rk   r7   r'   freshness_resultr   msg
authorisedtimingr   s                 r3   _handle_single_ocsp_respr     sD     ,#%::N $..!00(66 /  $$F'***+1116C.==>-555/CDCCTB 1#-$ 0 01	 	J --F"("A"At  mZFF#	s   C0D/2D-3;D/c           
        K   |xs t        t        j                  |            }|j                         }	 |j	                  |       }t               }|j                  j                  | |       d{   }|D ]!  }	 t        | ||||||       d{   }	|	r y# |j                  t!        |      k(  rt        d| d      t#        d	| d
|j$                  |j&                  r|j(                        d      # t
        $ r t        d|j                               w xY w7 7 # t        $ r5}
d}t        j                  ||
       |j                  ||       Y d}
~
d}
~
ww xY ww)aa  
    Verifies an OCSP response, checking to make sure the certificate has not
    been revoked. Fulfills the requirements of
    https://tools.ietf.org/html/rfc6960#section-3.2.

    :param cert:
        An asn1cyrpto.x509.Certificate object or
        an asn1crypto.cms.AttributeCertificateV2 object to verify the OCSP
        response for

    :param path:
        A pyhanko_certvalidator.path.ValidationPath object of the cert's
        validation path, or in the case of an AC, the AA's validation path.

    :param validation_context:
        A pyhanko_certvalidator.context.ValidationContext object to use for
        caching validation information

    :param proc_state:
        Internal state for error reporting and policy application decisions.

    :raises:
        pyhanko_certvalidator.errors.OCSPNoMatchesError - when none of the OCSP responses match the certificate
        pyhanko_certvalidator.errors.OCSPValidationIndeterminateError - when the OCSP response could not be verified
        pyhanko_certvalidator.errors.RevokedError - when the OCSP response indicates the certificate has been revoked
    rD   z6Could not determine issuer certificate for %s in path.N)ri   r(   rF   rj   r6   rk   r7   8Generic processing error while validating OCSP response.exc_infoz"No OCSP responses were issued for .zUnable to determine if z@ is revoked due to insufficient information from OCSP responses.)failuressuspect_stale)r   r$   singrL   find_issuing_authorityLookupErrorr   ra   revinfo_managerasync_retrieve_ocspsr   
ValueErrorloggingdebugrz   rb   lenr   r   freshness_failures_onlystale_last_usable_at)ri   rF   r6   r7   cert_descriptioncert_issuerrk   ocsp_responsesrj   	ocsp_goodrW   r   s               r3   verify_ocsp_responser     s    B P|HMM$<OPJ!//1
11$7 ;D 00EE+
 	
  ( ,	,6"+#5% I  ,$ ^!44 01A0B!D
 	
 +
!"2!3 4J 	K)-)E)ED%% 
 LP I  
 D$$&
 	

	
  	,LCMM#*KK]++	,se   4E(C< )E(1D#2	E(<D'D%D'A$E(<$D  E(%D''	E%0+E E( E%%E(T)frozenc                   "    e Zd ZU eed<   eed<   y)OCSPResponseOfInterestrj   	prov_pathN)rc   rd   re   r!   rg   r   rh   r5   r3   r   r   ;  s      r5   r   c                   4    e Zd ZU dZee   ed<   	 ee   ed<   y)OCSPCollectionResultzd
    The result of an OCSP collection operation for AdES point-in-time
    validation purposes.
    	responsesfailure_msgsN)rc   rd   re   __doc__r   r   rg   strrh   r5   r3   r   r   A  s+    
 *++ s)r5   r   r   c                   K   |xs t        t        j                  |            }	 |j                  |       }g }|j                  | |       d{   }|j                  }t               }	|D ]h  }
|
j                  }|||kD  s||
   |kD  r	 t        | ||
|j                  |	      }|=t        |||      }t        |
|      }|j                  |       j t'        ||	j(                  D cg c]  }|d
   	 c}      S # t        $ r t        d|j                          d      w xY w7 # t         $ r5}d}t#        j$                  ||	       |	j                  ||
       Y d}~d}~ww xY wc c}w w)a5  
    Collect potentially relevant OCSP responses with the associated validation
    paths. Will not perform actual path validation.

    :param cert:
        The certificate under scrutiny.
    :param path:
        The path currently being evaluated.
    :param revinfo_manager:
        The revocation info manager.
    :param control_time:
        The control time before which the validation info should have been
        issued.
    :param proc_state:
        The state of any prior validation process.
    :return:
        A :class:`.OCSPCollectionResult`.
    r   z+Could not determine issuer certificate for z	 in path.Nr   )r)   )rj   r   r   r   r   )r   r   )r   r$   r   r   r   r   rL   r   poe_managerra   issuance_dater   r   r4   r   rz   r   r   r   r   r   )ri   rF   r   r   r7   cert_issuer_authrelevantr   r   rk   ocsp_response_contissuedr'   resultrW   r   fs                    r3   %collect_relevant_responses_with_pathsr  S  s    4 P|HMM$<OPJ
66t< H*?? N "--K;D, 1#11N$-.= 	13'0*??N %0 0$D ,0DF OOF#31<  $(MM2qad2 Y  
 ++-.i9
 	

@  	1LCMM#*KK/00	1 3si   $E1C? E1D);E1D+(E1),D+E1+E,
7E1?'D&&E1+	E)4+E$E1$E))E1)N)Jr   dataclassesr   r   typingr   r   r   
asn1cryptor   r	   r
   asn1crypto.crlr   asn1crypto.keysr   cryptography.exceptionsr   pyhanko_certvalidator._stater   pyhanko_certvalidator.authorityr   r   r   pyhanko_certvalidator.contextr   pyhanko_certvalidator.errorsr   r   r   r   r   r   pyhanko_certvalidator.pathr   !pyhanko_certvalidator.policy_declr   r   r   pyhanko_certvalidator.registryr   r   r   )pyhanko_certvalidator.revinfo._err_gatherr    &pyhanko_certvalidator.revinfo.archivalr!   r"   %pyhanko_certvalidator.revinfo.managerr#   pyhanko_certvalidator.utilr$   r%   r&   rQ   rw   r4   rY   r_   ra   AttributeCertificateV2boolr   r   r   r   r   r   r   r   r   r   r   r  rh   r5   r3   <module>r     s4    !  ( ( % % $ ) 4 5 
 <  6 
 
 = A ) $$.7BPUB$$UBUB *UB 	UB
 UBp$"2"2    :
  #"<"<<
=:: !: 	:
 
:z" "%" " d	"J!$$!.7!AE!d^!H"$$"" " !	"
 *" " " " 
"J  8$ 
	> 1>FO	:
  #"<"<<
= ! &	
  d:5G
  #"<"<<
=5G5G 5G !	5G
 *5G 5G 5G 
5Gx *.	R
  #"<"<<
=R
R *R &	Rj $  
 $  , *.L
  #"<"<<
=L
L $L 	L
 &L Lr5   