
    inD                       S r SSKJr  SSKrSSKrSSKJr  SSKJ	r	  SSK
JrJrJrJrJr  SSKJr  SSKJr  SS	KJr  SS
KJr  SSKJr  SSKJr   SSK!J"r#  SSK$J%r&  SSK'J(r)  SSK*J+r,  SSK*J-r.  SSK/J0r1  SSK/J2r3  SSK4J5r6  SSK4J7r8  SSK4J9r:  SSK4J;r<  SSK4J=r>  SSK?J@rA  SSK?JBrC  SSK?JDrE  SSK?JFrG  SSKHJIrJ  SSKHJKrL  SSKMJNrO  SS KPJQrR  SS!KSJTrT  SS"KUJVrVJWrW  \(       a  SS#KXJYrYJZrZJ[r[J\r\J]r]J^r^J_r_  SS$K`Jara  SS%K*Jbrb  SS&K4JcrcJdrd  SS'KeJfrfJgrg  SS(K?JhrhJiri  SS)KjJkrk  SS*KUJlrl  SS+KmJnrn  \\YR.                  \]RD                  \ZR8                  \\R                  \[R                  \_RP                  \^RJ                  4   rq\R                  " \s5      rt\R                  " S,\R                  5      rw        S8S- jrx          S9S. jry      S:S/ jrzS;S0 jr{        S<S1 jr|        S=S2 jr}S>S3 jr~S?S4 jrS>S5 jr          S@S6 jrSAS7 jrg)Bz4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)_next_update_this_update)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+c                    U R                   nU H  nUR                  U:X  d  M  Us  $    U(       a  U H  nUR                  U:X  d  M  Us  $    g N)issuersubject)certchaintrusted_ca_certsissuer_name	candidates        A/app/mltbenv/lib/python3.13/site-packages/pymongo/ocsp_support.py_get_issuer_certrD   h   sS     ++K	+  )I  K/   *     c                    [        U [        5      (       a  U R                  X[        5       U5        g[        U [        5      (       a  U R                  XU5        g[        U [
        5      (       a  U R                  X[        U5      5        g[        U [        [        45      (       a  gU R                  X5         g! [         a     gf = f)N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)key	signature	algorithmdatas       rC   _verify_signaturerV   {   s    c=))JJy	Y?  ]++JJy	2  455JJyy(9:  "N3
 
 JJy'   s(   0B; 'B; 0B; B; (B; ;
CCc                Z     U R                   R                  U5      $ ! [         a     g f = fr;   )
extensionsget_extension_for_class_ExtensionNotFound)r>   klasss     rC   _get_extensionr\      s.    66u== s    
**c                   U R                  5       n[        U[        5      (       a/  UR                  [        R
                  [        R                  5      nOr[        U[        5      (       a/  UR                  [        R                  [        R                  5      nO.UR                  [        R
                  [        R                  5      n[        [        5       [        5       S9nUR                  U5        UR!                  5       $ )N)backend)
public_keyrH   rI   public_bytes	_EncodingDER_PublicFormatPKCS1rM   X962UncompressedPointSubjectPublicKeyInfo_Hash_SHA1_default_backendupdatefinalize)r>   r_   pbytesdigests       rC   _public_key_hashro      s    "J
 *m,,((8K8KL	J 7	8	8((9X9XY((8Z8Z[57$4$67F
MM&??rE   c                    U  Vs/ s H2  n[        U5      U:X  d  M  UR                  UR                  :X  d  M0  UPM4     sn$ s  snf r;   )ro   r<   r=   )certificatesr<   responder_key_hashr>   s       rC   _get_certs_by_key_hashrs      sL    
 ! DD!%77 	<@KK6>><Y 	   s   AAAc                    U  Vs/ s H3  nUR                   U:X  d  M  UR                  UR                   :X  d  M1  UPM5     sn$ s  snf r;   )r=   r<   )rq   r<   responder_namer>   s       rC   _get_certs_by_namerv      sJ    
 ! D<<>) 	.2kkV^^.K 	   s   AAAc                   UR                   nUR                  nUR                  nUb  X R                  :X  d  X4:X  a  [        R                  S5        U nGO3[        R                  S5        UR                  nUR                   b"  [        X`U5      n[        R                  S5        O![        X`U5      n[        R                  S5        U(       d  [        R                  S5        gUS   n[        U[        5      nU(       a  [        R                  UR                  ;  a  [        R                  S5        g[        U R                  5       UR                   UR"                  UR$                  5      (       d  [        R                  S5        g[        UR                  5       UR                   UR"                  UR&                  5      n	U	(       d  [        R                  S	5        U	$ )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)ru   rr   issuer_key_hashr=   _LOGGERdebugrq   rv   rs   r\   _ExtendedKeyUsage_ExtendedKeyUsageOIDOCSP_SIGNINGvaluerV   r_   rS   signature_hash_algorithmtbs_certificate_bytestbs_response_bytes)
r<   responsename	rkey_hash	ikey_hashresponder_certcertsresponder_certsextrets
             rC   _verify_response_signaturer      s    ""D++I((IDNN2i6L+,/0 %%"".0EOMM014UINOMM*+MMAB )+ ^->?*77syyHMMDE $$3300	
 
 MMBC
!!#))##	C >?JrE   c                j    [        5       nUR                  X[        5       5      nUR                  5       $ r;   )_OCSPRequestBuilderadd_certificateri   build)r>   r<   builders      rC   _build_ocsp_requestr      s*    !#G%%dEG<G==?rE   c                   [         R                  S5        [        X5      nU(       d  g[        U5      n[        R
                  " [        R                  S9nU(       a  UR                  c  UR                  S S9nU(       a  X4:  a  [         R                  S5        g[        U5      nU(       a  XT:  a  [         R                  S5        gg)NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastrG   )ry   rz   r   r'   	_datetimenowr   utcr   replacer&   )r<   r   resthis_updater   next_updates         rC   _verify_responser      s    MM&'
$V
6C x(K
--8<<
(C{))1kkk&{(34x(K{(12rE   c                0   [        X5      n X4   n[        R                  S5        U$ ! [         Gab    [	        [
        R                  " S5      S5      n [        UUR                  [        R                  5      SS0US9nO.! [         a!  n[        R                  SU5         S nA g S nAff = fUR                  S:w  a"  [        R                  S	UR                  5         g [        UR                  5      n[        R                  S
UR                  5        UR                  [         R"                  :w  a   g UR$                  UR$                  :w  a  [        R                  S5         g ['        X5      (       d   g [        R                  S5        XSU'    U$ f = f)NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rU   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   ry   rz   KeyErrormaxr%   clamp_remaining_postr`   ra   rb   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULserial_numberr   )	r>   r<   uriocsp_response_cacheocsp_requestocsp_responser   r   excs	            rC   _get_ocsp_responser     se    't4L$:+934H G  !: e++A.6		!..y}}=')CD	H ! 	MM3S9	 3&MM4h6J6JK/0@0@A0-2O2OP((,?,J,JJ
 &&,*D*DDMMIJ66./,9L)G!:sR   ( +F+B ?F 
B+
B& F&B++3F AF5/F&F8FFc                   U(       d   eU R                  5       nUc  [        R                  S5        gUR                  5       n[	        U S5      (       a  U R                  5       nSnOU R                  5       nUR                  nU(       d  [        R                  S5        gU Vs/ s H  owR                  5       PM     nn[        XHU5      n	Sn
[        U[        5      nUb@  UR                   H0  nU[        R                  :X  d  M  [        R                  S5        Sn
  O   UR                  nUS:X  Ga  [        R                  S	5        U
(       a  [        R                  S
5        gUR                  (       d  [        R                  S5        g[        U[         5      nUc  [        R                  S5        gUR                   Vs/ s H9  nUR"                  [$        R&                  :X  d  M#  UR(                  R                  PM;     nnU(       d  [        R                  S5        gU	c  [        R                  S5        g[        R                  S5        U H  n[        R                  SU5        [+        XIUU5      nUc  M+  [        R                  SUR,                  5        UR,                  [.        R0                  :X  a    gUR,                  [.        R2                  :X  d  M    g   [        R                  S5        g[        R                  S5        U	c  [        R                  S5        g[5        U5      n[        R                  SUR6                  5        UR6                  [8        R:                  :w  a  g[=        U	U5      (       d  gUU[?        XI5      '   [        R                  SUR,                  5        UR,                  [.        R2                  :X  a  ggs  snf s  snf )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?z!Peer presented a must-staple certTrE   z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failzNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   ) get_peer_certificatery   rz   to_cryptographyhasattrr   get_peer_cert_chainr@   rD   r\   _TLSFeaturer~   _TLSFeatureTypestatus_requestr   check_ocsp_endpoint_AuthorityInformationAccessaccess_method_AuthorityInformationAccessOIDOCSPaccess_locationr   certificate_status_OCSPCertStatusGOODREVOKEDr   r   r   r   r   r   )conn
ocsp_bytes	user_datapycertr>   pychainr@   cerr?   r<   must_stapleext_tlsfeaturer   ext_aiadescurisr   r   s                      rC   _ocsp_callbackr   G  s-    9&&(F~o&!!#Dt)**))+**,$55+,.56gs  "gE6d+;<FKT;/G}}G/888AB"	 %
 $77 S<=MMQR,,MMJK 'BC?MMFG  
%!!%C%H%HH 'D  &&% 	 

 MM23>MM+,,- CMM+s+)$=PQH MM0(2M2MN**o.B.BB**o.E.EE  	ABMM12~'(&z2HMM,h.F.FG #6#A#AAFH--=E+D9:MM((*E*EF""o&=&==] 7:
s   $O"O)O)r>   r1   r?   Iterable[Certificate]r@   zOptional[list[Certificate]]returnzOptional[Certificate])
rR   CertificateIssuerPublicKeyTypesrS   bytesrT   z%Union[Prehashed, HashAlgorithm, None]rU   r   r   int)r>   r1   r[   zType[ExtensionTypeVar]r   z%Optional[Extension[ExtensionTypeVar]])r>   r1   r   r   )rq   r   r<   r1   rr   zOptional[bytes]r   list[Certificate])rq   r   r<   r1   ru   zOptional[Name]r   r   )r<   r1   r   r6   r   r   )r>   r1   r<   r1   r   r5   )
r>   r1   r<   r1   r   zUnion[str, bytes]r   r8   r   zOptional[OCSPResponse])r   r7   r   r   r   zOptional[_CallbackData]r   bool)__doc__
__future__r   logging_loggingre_rer   r   r   typingr   r   r   r	   r
   cryptography.exceptionsr   rQ   cryptography.hazmat.backendsr   rj   -cryptography.hazmat.primitives.asymmetric.dsar   rL   ,cryptography.hazmat.primitives.asymmetric.ecr   rN   r   rM   1cryptography.hazmat.primitives.asymmetric.paddingr   rK   -cryptography.hazmat.primitives.asymmetric.rsar   rI   .cryptography.hazmat.primitives.asymmetric.x448r   rP   0cryptography.hazmat.primitives.asymmetric.x25519r   rO   %cryptography.hazmat.primitives.hashesr   ri   r   rh   ,cryptography.hazmat.primitives.serializationr   ra   r   rc   cryptography.x509r   r   r   r{   r   rZ   r   r   r   r   cryptography.x509.ocspr   r   r   r   r   r   r    r   cryptography.x509.oidr!   r   r"   r|   requestsr#   r   requests.exceptionsr$   r   pymongor%   pymongo.ocsp_cacher&   r'   )cryptography.hazmat.primitives.asymmetricr(   r)   r*   r+   r,   r-   r.   /cryptography.hazmat.primitives.asymmetric.utilsr/   r0   r1   r2   cryptography.x509.extensionsr3   r4   r5   r6   OpenSSL.SSLr7   r8   pymongo.pyopenssl_contextr9   Ed25519PublicKeyEd448PublicKeyr   	getLogger__name__ry   compileDOTALL_CERT_REGEXrD   rV   r\   ro   rs   rv   r   r   r   r   r    rE   rC   <module>r     s1   ; "   *  A A I L W H T W @ ? N V W C E 7 ? D L L T N " E  9   JC3H@&-7&+
!!  	'# 

X
&kkDcjj

3Gb&	( 5 	
 	4
4*"'1<Ra'1<N\3l4*
***1B*Yc**ZarE   