o
    vh-                     @   s
  d Z ddlZddlZddlZddlmZmZmZmZm	Z	m
Z
mZ ddlmZmZmZmZmZmZ ddlmZ ddlmZ ddlmZ dd	lmZ g d
ZeeZeg dZ eg dZ!eg dZ"eg dZ#de$de	e% de%de&fddZ'de$de%fddZ(deej)ej*f dedej+fddZ,dej)dede%de&fd d!Z-de$d"ej.d#e%fd$d%Z/e
d&Z0e
d'Z1d(ee0ee1e2f f d)ee0ej3f d*e0d+eg ee1 f dee1e2f f
d,d-Z4d.d/ Z5d0d1 Z6d2d3 Z7d4d5 Z8deej)ej*f fd6d7Z9d8d9 Z:d:efd;d<Z;dS )=zd
Internal backend-agnostic utilities to help process fetched certificates, CRLs
and OCSP responses.
    N)	AwaitableCallableDictIterableOptionalTypeVarUnion)algoscmscoreocsppemx509)DistributionPoint   )errors)	Authority)get_ac_extension_value)unpack_cert_contentformat_ocsp_requestprocess_ocsp_response_dataqueue_fetch_taskcrl_job_results_as_completedocsp_job_get_earliestcomplete_certificate_fetch_jobsgather_aia_issuer_urls$ACCEPTABLE_STRICT_CERT_CONTENT_TYPESACCEPTABLE_CERT_PEM_ALIASESACCEPTABLE_PKCS7_DER_ALIASESACCEPTABLE_CERT_DER_ALIASES)application/pkix-certapplication/pkcs7-mimeapplication/x-x509-ca-cert application/x-pkcs7-certificates)zapplication/x-pem-filez
text/plainapplication/octet-streambinary/octet-stream)r    r"   r$   r%   )r!   r#   r%   response_datacontent_typeurl
permit_pemc           	      c   s   t | }|d u s|tv rB|sB|d u rtd| d ttj| }|dkr3t	| |E d H  d S |dkr@t
j| V  d S d S |tv rR|sRt	| |E d H  d S |ry|ryt j| ddD ]\}}}|dkrot	||E d H  q]t
j|V  q]d S td| d	| d
)Nz)Response to certificate fetch request to zi did not include a content type, verifying it's sequence length to check if it is a certificate or pkcs7.r      T)multiplePKCS7zFailed to extract certs from z payload. Source URL: .)r   detectr   loggerwarninglenr   Sequenceload_unpack_der_pkcs7r   Certificater   unarmor
ValueError)	r&   r'   r(   r)   is_pemder_sequence_length	type_name_data r=   i/var/www/html/hyperkenya/venv/lib/python3.10/site-packages/pyhanko_certvalidator/fetchers/common_utils.pyr   I   s8   

r   
pkcs7_data	pkcs7_urlc                 c   sv    t j| }|d j}|dkrtd| d| d|d }t|d t jr7|d D ]}|jdkr6|jV  q+d S d S )	Nr'   signed_dataziExpected CMS SignedData when extracting certs from application/pkcs7-mime payload, but content type was 'z'. Source URL: r-   contentcertificatescertificate)	r
   ContentInfor3   nativer7   
isinstanceCertificateSetnamechosen)r?   r@   content_infocms_ctrA   cert_choicer=   r=   r>   r4   p   s&   

r4   cert	authorityreturnc                C   sX   t | tjr
| j}n| d d j}t|j|}tt	
d|i|t|j||d}|S )Nac_infoserial_number	algorithm)hash_algorithmissuer_name_hashissuer_key_hashrR   )rG   r   r5   rR   rF   getattrrI   r   CertIdr	   DigestAlgorithm
public_key)rN   rO   certid_hash_algorR   iss_name_hashcert_idr=   r=   r>   
get_certid   s   

r^   r[   request_noncesc             	   C   sr   t | ||d}td|i}tdt|gi}|r2tddtt	dd}t
|g|d< td	|iS )
N)r[   req_certrequest_listnonceF   )extn_idcritical
extn_valuerequest_extensionstbs_request)r^   r   Request
TBSRequestRequestsTBSRequestExtensionr   OctetStringosurandomTBSRequestExtensionsOCSPRequest)rN   rO   r[   r_   r]   requestrh   nonce_extensionr=   r=   r>   r      s(   r   ocsp_requestocsp_urlc                C   s|   zt j| }W n ty   tdw |d j}|dkr'td||f |j}|r<|j}|r<|j|jkr<td|S )Nz)Failed to parse response from OCSP serverresponse_status
successfulz5OCSP server at %s returned an error. Status was '%s'.zQUnable to verify OCSP response since the request and response nonces do not match)	r   OCSPResponser3   r7   r   OCSPFetchErrorrF   OCSPValidationErrornonce_value)r&   rt   ru   ocsp_responsestatusrequest_nonceresponse_noncer=   r=   r>   r      s(   

r   TRresultsrunning_jobstag	async_func                    sP  z| | }t dt| d t|W S  ty   Y nw z(|| }t dt| d | I d H  t dt| d t| | W S  ty   t dt| d t  ||< }z| I d H }W n! ty } zt d	t| d
|  |}W Y d }~nd }~ww || |< t d	t| d ||= |	  t| Y S w )NzResult for fetch job with tag z was available in cache.zWaiting for fetch job with tag z to return...z,Received completion signal for job with tag r-   z Starting new fetch job with tag z...zNew fetch job with tag z threw an exception: z
 returned.)
r/   debugrepr_return_or_raiseKeyErrorwaitasyncioEvent	Exceptionset)r   r   r   r   result
wait_eventer=   r=   r>   r      sH   
r   c                 C   s   t | tr| | S N)rG   r   )r   r=   r=   r>   r     s   
r   c                 C  st   d }d}t t| D ]!}z
|I d H }|V  W q tjy- } z|}W Y d }~qd }~ww |d ur6|s8|d S d S )NF)r   as_completedlistr   CRLFetchError)jobslast_eat_least_one_successcrl_jobfetched_crlr   r=   r=   r>   r     s   

r   c                    s<   t j|  }|  z|I d H  W d S  t jy   Y d S w r   )r   gathercancelCancelledError)pending_taskspendingr=   r=   r>   
cancel_all#  s   
r   c                    s   dd | D }d  }}|r?t j|t jdI d H \}}|D ]}z|I d H }W  n tjy< } z|}W Y d }~qd }~ww |s|d urLt|I d H  |S |pRtd)Nc                 S   s   g | ]}t |qS r=   )r   create_task).0coror=   r=   r>   
<listcomp>-  s    z)ocsp_job_get_earliest.<locals>.<listcomp>)return_whenzNo OCSP results)r   r   FIRST_COMPLETEDr   ry   r   )r   queue	ocsp_respr   doneocsp_jobr   r=   r=   r>   r   ,  s(   

r   c                 c   sr    t | tjr| j}nt| d}|d u rd S |D ]}|d jdkr6|d }|jdkr+q|j}|dr6|V  qd S )Nauthority_information_accessaccess_method
ca_issuersaccess_locationuniform_resource_identifierhttp)rG   r   r5   "authority_information_access_valuer   rF   rI   
startswith)rN   	aia_valueentrylocationr(   r=   r=   r>   r   @  s    


r   c                 C  sn   t | D ].}z|I d H }W n tjy+ } ztd| d W Y d }~qd }~ww |D ]}|V  q.qd S )Nz8Error during certificate fetch job, skipping... (Error: ))r   r   r   CertificateFetchErrorr/   r0   )
fetch_jobs	fetch_jobcerts_fetchedr   rN   r=   r=   r>   r   S  s"   r   distribution_pointc                 c   sL    | d }|j dkrd S |jD ]}|j dkr#|j}| dr#|V  qd S )Nr   	full_namer   )zhttp://zhttps://)rI   rJ   rF   lowerr   )r   rI   general_namer(   r=   r=   r>   enumerate_delivery_point_urlsa  s   


r   )<__doc__r   loggingrn   typingr   r   r   r   r   r   r   
asn1cryptor	   r
   r   r   r   r   asn1crypto.x509r    r   rO   r   utilr   __all__	getLogger__name__r/   	frozensetr   r   r   r   bytesstrboolr   r4   r5   AttributeCertificateV2rX   r^   r   rq   r   r   r   r   r   r   r   r   r   r   r   r   r   r=   r=   r=   r>   <module>   s    $ 
		
	
'

#


1	
