
    l h|F                       d Z ddlmZ ddlZddlZddlmZ ddlm	Z	 ddl
mZmZmZmZmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ  ddl!m"Z# ddl$m%Z& ddl'm(Z) ddl*m+Z, ddl*m-Z. ddl/m0Z1 ddl/m2Z3 ddl4m5Z6 ddl4m7Z8 ddl4m9Z: ddl4m;Z< ddl4m=Z> ddl4m?Z@ ddlAmBZC ddlAmDZE ddlAmFZG ddlAmHZI ddlJmKZL ddlJmMZN dd lOmPZQ dd!lRmSZT dd"lUmVZV dd#lWmXZXmYZY erdd$lZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZa dd%lbmcZc dd&l*mdZd dd'l4meZemfZf dd(lgmhZhmiZi dd)lAmjZjmkZk dd*llmmZm dd+lWmnZn dd,lompZp ee[j.                  e_jD                  e\j8                  e^j                  e]j                  eajP                  e`jJ                  f   Zs ej                  eu      Zv ej                  d-ej                        Zyd:d.Zz	 	 	 	 	 	 	 	 d;d/Z{	 	 	 	 	 	 	 	 	 	 d<d0Z|	 	 	 	 	 	 d=d1Z}d>d2Z~	 	 	 	 	 	 	 	 d?d3Z	 	 	 	 	 	 	 	 d@d4ZdAd5ZdBd6ZdAd7Z	 	 	 	 	 	 	 	 	 	 dCd8ZdDd9Zy)Ez4Support for requesting and verifying OCSP responses.    )annotationsN)datetime)timezone)TYPE_CHECKINGIterableOptionalTypeUnion)InvalidSignature)default_backend)DSAPublicKey)ECDSA)EllipticCurvePublicKey)PKCS1v15)RSAPublicKey)X448PublicKey)X25519PublicKey)SHA1)Hash)Encoding)PublicFormat)AuthorityInformationAccess)ExtendedKeyUsage)ExtensionNotFound)
TLSFeature)TLSFeatureType)load_pem_x509_certificate)OCSPCertStatus)OCSPRequestBuilder)OCSPResponseStatus)load_der_ocsp_response)AuthorityInformationAccessOID)ExtendedKeyUsageOID)post)RequestException)_csot)_next_update_this_update)dsaeced448ed25519rsax448x25519)	Prehashed)HashAlgorithm)CertificateName)	ExtensionExtensionTypeVar)OCSPRequestOCSPResponse)
Connection)
_OCSPCache)_CallbackDatas9   -----BEGIN CERTIFICATE[^
]+.+?-----END CERTIFICATE[^
]+c                    t        | d      5 }|j                         }ddd       g }t               }t        j                  t
              D ]  }|j                  t        ||              |S # 1 sw Y   QxY w)z0Parse the tlsCAFile into a list of certificates.rbN)openread_default_backend_refindall_CERT_REGEXappend_load_pem_x509_certificate)cafilefdatatrusted_ca_certsbackend	cert_datas         z/var/www/html/SchoolMeal/SchoolMeal/pds_admin_SchoolMeal/Backend/venv/lib/python3.12/site-packages/pymongo/ocsp_support.py_load_trusted_ca_certsrL   i   sv    	fd	 qvvx  G[[d3 P	 :9g NOP s   A..A7c                    | j                   }|D ]  }|j                  |k(  s|c S  |r|D ]  }|j                  |k(  s|c S  y N)issuersubject)certchainrH   issuer_name	candidates        rK   _get_issuer_certrU   v   s]     ++K 	+ ) 	!I  K/  	!     c                t   	 t        | t              r| j                  ||t               |       yt        | t              r| j                  |||       yt        | t
              r| j                  ||t        |             yt        | t        t        f      ry| j                  ||       	 y# t        $ r Y yw xY w)N   r   )

isinstance_RSAPublicKeyverify	_PKCS1v15_DSAPublicKey_EllipticCurvePublicKey_ECDSA_X25519PublicKey_X448PublicKey_InvalidSignature)key	signature	algorithmrG   s       rK   _verify_signaturerf      s    c=)JJy$	Y?  ]+JJy$	2  45JJy$y(9:  "N3
 JJy$'   s(   ,B+ #B+ ,B+  B+ B+ +	B76B7c                X    	 | j                   j                  |      S # t        $ r Y y w xY wrN   )
extensionsget_extension_for_class_ExtensionNotFound)rQ   klasss     rK   _get_extensionrl      s.    66u== s    	))c                   | j                         }t        |t              r/|j                  t        j
                  t        j                        }nmt        |t              r/|j                  t        j                  t        j                        }n.|j                  t        j
                  t        j                        }t        t               t                     }|j                  |       |j!                         S )N)rI   )
public_keyrY   rZ   public_bytes	_EncodingDER_PublicFormatPKCS1r^   X962UncompressedPointSubjectPublicKeyInfo_Hash_SHA1r?   updatefinalize)rQ   rn   pbytesdigests       rK   _public_key_hashr}      s    "J
 *m,((8K8KL	J 7	8((9X9XY((8Z8Z[57$4$67F
MM&??rV   c                z    | D cg c]+  }t        |      |k(  r|j                  |j                  k(  r|- c}S c c}w rN   )r}   rO   rP   )certificatesrO   responder_key_hashrQ   s       rK   _get_certs_by_key_hashr      sA    
 !D!%77DKK6>><Y 	  s   08c                |    | D cg c],  }|j                   |k(  r|j                  |j                   k(  r|. c}S c c}w rN   )rP   rO   )r   rO   responder_namerQ   s       rK   _get_certs_by_namer      s?    
 !<<>)dkkV^^.K 	  s   19c                   |j                   }|j                  }|j                  }||| j                  k(  s||k(  rt        j                  d       | }n#t        j                  d       |j                  }|j                   #t        || |      }t        j                  d       n"t        || |      }t        j                  d       |st        j                  d       y|d   }t        |t              }|rt        j                  |j                  vrt        j                  d       yt        | j                         |j                   |j"                  |j$                        st        j                  d       yt        |j                         |j                   |j"                  |j&                        }	|	st        j                  d	       |	S )
NzResponder is issuerzResponder is a delegatezUsing responder namezUsing key hashz%No matching or valid responder certs.r   z(Delegate not authorized for OCSP signingz&Delegate signature verification failedz&Response signature verification failed)r   r   issuer_key_hashrP   _LOGGERdebugr   r   r   rl   _ExtendedKeyUsage_ExtendedKeyUsageOIDOCSP_SIGNINGvaluerf   rn   rd   signature_hash_algorithmtbs_certificate_bytestbs_response_bytes)
rO   responsename	rkey_hash	ikey_hashresponder_certcertsresponder_certsextrets
             rK   _verify_response_signaturer      s    ""D++I((IDFNN2i96L+,/0 %%"".0EOMM014UFINOMM*+MMAB )+ ^->?*77syyHMMDE $$3300	
 MMBC
!!#))##	C >?JrV   c                l    t               }|j                  | |t                     }|j                         S rN   )_OCSPRequestBuilderadd_certificaterx   build)rQ   rO   builders      rK   _build_ocsp_requestr     s,    !#G%%dFEG<G==?rV   c                t   t         j                  d       t        | |      }|syt        |      }t	        j
                  t        j                        }|r|j                  |j                  d       }|r||kD  rt         j                  d       yt        |      }|r||k  rt         j                  d       yy)NzVerifying responser   )tz)tzinfozthisUpdate is in the futureznextUpdate is in the pastrX   )r   r   r   r(   	_datetimenowr   utcr   replacer'   )rO   r   resthis_updater   next_updates         rK   _verify_responser     s    MM&'
$VX
6C x(K
--8<<
(C{))1kkk&{S(34x(K{S(12rV   c                (   t        | |      }	 ||   }t        j                  d       |S # t        $ r] t	        t        j                  d      d      }	 t        ||j                  t        j                        ddi|      }n-# t        $ r!}t        j                  d|       Y d }~Y y d }~ww xY w|j                  dk7  r"t        j                  d	|j                         Y y t        |j                        }t        j                  d
|j                         |j                  t         j"                  k7  rY y |j$                  |j$                  k7  rt        j                  d       Y y t'        ||      sY y t        j                  d       |||<   Y |S w xY w)NzUsing cached OCSP response.   gMbP?zContent-Typezapplication/ocsp-request)rG   headerstimeoutzHTTP request failed: %s   zHTTP request returned %dOCSP response status: %rz-Response serial number does not match requestzCaching OCSP response.)r   r   r   KeyErrormaxr&   clamp_remaining_postro   rp   rq   _RequestExceptionstatus_code_load_der_ocsp_responsecontentresponse_status_OCSPResponseStatus
SUCCESSFULserial_numberr   )	rQ   rO   uriocsp_response_cacheocsp_requestocsp_responser   r   excs	            rK   _get_ocsp_responser   (  sk    'tV4L$:+L934H G  !: e++A.6		!..y}}=')CD	H ! 	MM3S9	 3&MM4h6J6JK/0@0@A0-2O2OP((,?,J,JJ
 &&,*D*DDMMIJ6./,9L)G!:sR   * )F.BF	B-B("F(B--2F!AF5.F%F3FFc                @   |sJ | j                         }|t        j                  d       y|j                         }t	        | d      r| j                         }d}n| j                         }|j                  }|st        j                  d       y|D cg c]  }|j                          }}t        |||      }	d}
t        |t              }|=|j                  D ].  }|t        j                  k(  st        j                  d       d}
 n |j                  }|dk(  rt        j                  d	       |
rt        j                  d
       y|j                  st        j                  d       yt        |t               }|t        j                  d       y|j                  D cg c]5  }|j"                  t$        j&                  k(  r|j(                  j                  7 }}|st        j                  d       y|	t        j                  d       yt        j                  d       |D ]  }t        j                  d|       t+        ||	||      }|*t        j                  d|j,                         |j,                  t.        j0                  k(  r y|j,                  t.        j2                  k(  s y t        j                  d       yt        j                  d       |	t        j                  d       yt5        |      }t        j                  d|j6                         |j6                  t8        j:                  k7  ryt=        |	|      sy||t?        ||	      <   t        j                  d|j,                         |j,                  t.        j2                  k(  ryyc c}w c c}w )zCCallback for use with OpenSSL.SSL.Context.set_ocsp_client_callback.NzNo peer cert?Fget_verified_chainzNo peer cert chain?z!Peer presented a must-staple certTrV   z$Peer did not staple an OCSP responsez5Must-staple cert with no stapled response, hard fail.z.OCSP endpoint checking is disabled, soft fail.z*No authority access information, soft failzNo OCSP URI, soft failzNo issuer cert?zRequesting OCSP dataz	Trying %szOCSP cert status: %rz)No definitive OCSP cert status, soft failzPeer stapled an OCSP responser   ) get_peer_certificater   r   to_cryptographyhasattrr   get_peer_cert_chainrH   rU   rl   _TLSFeaturer   _TLSFeatureTypestatus_requestr   check_ocsp_endpoint_AuthorityInformationAccessaccess_method_AuthorityInformationAccessOIDOCSPaccess_locationr   certificate_status_OCSPCertStatusGOODREVOKEDr   r   r   r   r   r   )conn
ocsp_bytes	user_datapycertrQ   pychainrH   cerrR   rO   must_stapleext_tlsfeaturer   ext_aiadescurisr   r   s                      rK   _ocsp_callbackr   U  s3    9&&(F~o&!!#Dt)*))+**,$55+,.56sS  "6E6dE+;<FKT;/G}} 	G/888AB"		
 $77 S<=MMQR,,MMJK 'BC?MMFG  
!!%C%H%HH   &&
 

 MM23>MM+,,-  	CMM+s+)$=PQH MM0(2M2MN**o.B.BB**o.E.EE	 	ABMM12~'(&z2HMM,h.F.FG #6#A#AAFH-=E+D&9:MM((*E*EF""o&=&==] 7:
s   N":N)rE   strreturnlist[Certificate])rQ   r2   rR   Iterable[Certificate]rH   zOptional[list[Certificate]]r   zOptional[Certificate])
rc   CertificateIssuerPublicKeyTypesrd   bytesre   z%Union[Prehashed, HashAlgorithm, None]rG   r   r   int)rQ   r2   rk   zType[ExtensionTypeVar]r   z%Optional[Extension[ExtensionTypeVar]])rQ   r2   r   r   )r   r   rO   r2   r   zOptional[bytes]r   r   )r   r   rO   r2   r   zOptional[Name]r   r   )rO   r2   r   r7   r   r   )rQ   r2   rO   r2   r   r6   )
rQ   r2   rO   r2   r   zUnion[str, bytes]r   r9   r   zOptional[OCSPResponse])r   r8   r   r   r   zOptional[_CallbackData]r   bool)__doc__
__future__r   logging_loggingrer@   r   r   r   typingr   r   r   r	   r
   cryptography.exceptionsr   rb   cryptography.hazmat.backendsr   r?   -cryptography.hazmat.primitives.asymmetric.dsar   r]   ,cryptography.hazmat.primitives.asymmetric.ecr   r_   r   r^   1cryptography.hazmat.primitives.asymmetric.paddingr   r\   -cryptography.hazmat.primitives.asymmetric.rsar   rZ   .cryptography.hazmat.primitives.asymmetric.x448r   ra   0cryptography.hazmat.primitives.asymmetric.x25519r   r`   %cryptography.hazmat.primitives.hashesr   rx   r   rw   ,cryptography.hazmat.primitives.serializationr   rp   r   rr   cryptography.x509r   r   r   r   r   rj   r   r   r   r   r   rD   cryptography.x509.ocspr   r   r   r   r    r   r!   r   cryptography.x509.oidr"   r   r#   r   requestsr$   r   requests.exceptionsr%   r   pymongor&   pymongo.ocsp_cacher'   r(   )cryptography.hazmat.primitives.asymmetricr)   r*   r+   r,   r-   r.   r/   /cryptography.hazmat.primitives.asymmetric.utilsr0   r1   r2   r3   cryptography.x509.extensionsr4   r5   r6   r7   OpenSSL.SSLr8   r9   pymongo.pyopenssl_contextr:   Ed25519PublicKeyEd448PublicKeyr   	getLogger__name__r   compileDOTALLrB   rL   rU   rf   rl   r}   r   r   r   r   r   r   r    rV   rK   <module>r     s=   ; "   *  A A I L W H T W @ ? N V W C E 7 ? U D L L T N " E  9   JC3H@&-7&+
!!  	'# (

X
&ckkDcjj


3Gb&	( 5 	
 	4
4*"'1<Ra'1<N\3l4*
***1B*Yc**ZarV   