o
    >e*                     @   s  d Z ddlZddlZddlZddlmZmZmZmZm	Z	m
Z
 ddlmZmZmZmZmZmZ ddlmZ ddlmZ ddlmZ g d	ZeeZeg d
Zeg dZeg dZeg dZ de!dee" de"de#fddZ$de!de"fddZ%de
ej&ej'f dedej(fddZ)dej&dede"de#fdd Z*de!d!ej+d"e"fd#d$Z,e	d%Z-e	d&Z.d'ee-e
e.e/f f d(ee-ej0f d)e-d*eg ee. f de
e.e/f f
d+d,Z1d-d. Z2d/d0 Z3d1d2 Z4d3d4 Z5de
ej&ej'f fd5d6Z6d7d8 Z7dS )9zd
Internal backend-agnostic utilities to help process fetched certificates, CRLs
and OCSP responses.
    N)	AwaitableCallableDictOptionalTypeVarUnion)algoscmscoreocsppemx509   )errors)	Authority)get_ac_extension_value)unpack_cert_contentformat_ocsp_requestprocess_ocsp_response_dataqueue_fetch_taskcrl_job_results_as_completedocsp_job_get_earliestcomplete_certificate_fetch_jobsgather_aia_issuer_urls$ACCEPTABLE_STRICT_CERT_CONTENT_TYPESACCEPTABLE_CERT_PEM_ALIASESACCEPTABLE_PKCS7_DER_ALIASESACCEPTABLE_CERT_DER_ALIASES)application/pkix-certapplication/pkcs7-mimeapplication/x-x509-ca-cert application/x-pkcs7-certificates)zapplication/x-pem-filez
text/plainapplication/octet-streambinary/octet-stream)r   r    r"   r#   )r   r!   r#   response_datacontent_typeurl
permit_pemc           	      c   s   t | }|d u s|tv rB|sB|d u rtd| d ttj| }|dkr3t	| |E d H  d S |dkr@t
j| V  d S d S |tv rR|sRt	| |E d H  d S |ry|ryt j| ddD ]\}}}|dkrot	||E d H  q]t
j|V  q]d S td| d	| d
)Nz)Response to certificate fetch request to zi did not include a content type, verifying it's sequence length to check if it is a certificate or pkcs7.r      T)multiplePKCS7zFailed to extract certs from z payload. Source URL: .)r   detectr   loggerwarninglenr
   Sequenceload_unpack_der_pkcs7r   Certificater   unarmor
ValueError)	r$   r%   r&   r'   is_pemder_sequence_length	type_name_data r;   l/var/www/html/humari/django-venv/lib/python3.10/site-packages/pyhanko_certvalidator/fetchers/common_utils.pyr   G   s8   

r   
pkcs7_data	pkcs7_urlc                 c   sv    t j| }|d j}|dkrtd| d| d|d }t|d t jr7|d D ]}|jdkr6|jV  q+d S d S )	Nr%   signed_dataziExpected CMS SignedData when extracting certs from application/pkcs7-mime payload, but content type was 'z'. Source URL: r+   contentcertificatescertificate)	r	   ContentInfor1   nativer5   
isinstanceCertificateSetnamechosen)r=   r>   content_infocms_ctr?   cert_choicer;   r;   r<   r2   n   s&   

r2   cert	authorityreturnc                C   sX   t | tjr
| j}n| d d j}t|j|}tt	
d|i|t|j||d}|S )Nac_infoserial_number	algorithm)hash_algorithmissuer_name_hashissuer_key_hashrP   )rE   r   r3   rP   rD   getattrrG   r   CertIdr   DigestAlgorithm
public_key)rL   rM   certid_hash_algorP   iss_name_hashcert_idr;   r;   r<   
get_certid~   s   

r\   rY   request_noncesc             	   C   sr   t | ||d}td|i}tdt|gi}|r2tddtt	dd}t
|g|d< td	|iS )
N)rY   req_certrequest_listnonceF   )extn_idcritical
extn_valuerequest_extensionstbs_request)r\   r   Request
TBSRequestRequestsTBSRequestExtensionr
   OctetStringosurandomTBSRequestExtensionsOCSPRequest)rL   rM   rY   r]   r[   requestrf   nonce_extensionr;   r;   r<   r      s(   r   ocsp_requestocsp_urlc                C   s|   zt j| }W n ty   tdw |d j}|dkr'td||f |j}|r<|j}|r<|j|jkr<td|S )Nz)Failed to parse response from OCSP serverresponse_status
successfulz5OCSP server at %s returned an error. Status was '%s'.zQUnable to verify OCSP response since the request and response nonces do not match)	r   OCSPResponser1   r5   r   OCSPFetchErrorrD   OCSPValidationErrornonce_value)r$   rr   rs   ocsp_responsestatusrequest_nonceresponse_noncer;   r;   r<   r      s(   

r   TRresultsrunning_jobstag	async_func                    sP  z| | }t dt| d t|W S  ty   Y nw z(|| }t dt| d | I d H  t dt| d t| | W S  ty   t dt| d t  ||< }z| I d H }W n! ty } zt d	t| d
|  |}W Y d }~nd }~ww || |< t d	t| d ||= |	  t| Y S w )NzResult for fetch job with tag z was available in cache.zWaiting for fetch job with tag z to return...z,Received completion signal for job with tag r+   z Starting new fetch job with tag z...zNew fetch job with tag z threw an exception: z
 returned.)
r-   debugrepr_return_or_raiseKeyErrorwaitasyncioEvent	Exceptionset)r   r   r   r   result
wait_eventer;   r;   r<   r      sH   
r   c                 C   s   t | tr| | S N)rE   r   )r   r;   r;   r<   r     s   
r   c                 C  st   d }d}t t| D ]!}z
|I d H }|V  W q tjy- } z|}W Y d }~qd }~ww |d ur6|s8|d S d S )NF)r   as_completedlistr   CRLFetchError)jobslast_eat_least_one_successcrl_jobfetched_crlr   r;   r;   r<   r     s   

r   c                    s<   t j|  }|  z|I d H  W d S  t jy   Y d S w r   )r   gathercancelCancelledError)pending_taskspendingr;   r;   r<   
cancel_all!  s   
r   c                    s   dd | D }d  }}|r?t j|t jdI d H \}}|D ]}z|I d H }W  n tjy< } z|}W Y d }~qd }~ww |s|d urLt|I d H  |S |pRtd)Nc                 S   s   g | ]}t |qS r;   )r   create_task).0coror;   r;   r<   
<listcomp>+  s    z)ocsp_job_get_earliest.<locals>.<listcomp>)return_whenzNo OCSP results)r   r   FIRST_COMPLETEDr   rw   r   )r   queue	ocsp_respr   doneocsp_jobr   r;   r;   r<   r   *  s(   

r   c                 c   sr    t | tjr| j}nt| d}|d u rd S |D ]}|d jdkr6|d }|jdkr+q|j}|dr6|V  qd S )Nauthority_information_accessaccess_method
ca_issuersaccess_locationuniform_resource_identifierhttp)rE   r   r3   "authority_information_access_valuer   rD   rG   
startswith)rL   	aia_valueentrylocationr&   r;   r;   r<   r   >  s    


r   c                 C  sn   t | D ].}z|I d H }W n tjy+ } ztd| d W Y d }~qd }~ww |D ]}|V  q.qd S )Nz8Error during certificate fetch job, skipping... (Error: ))r   r   r   CertificateFetchErrorr-   r.   )
fetch_jobs	fetch_jobcerts_fetchedr   rL   r;   r;   r<   r   Q  s"   r   )8__doc__r   loggingrl   typingr   r   r   r   r   r   
asn1cryptor   r	   r
   r   r   r    r   rM   r   utilr   __all__	getLogger__name__r-   	frozensetr   r   r   r   bytesstrboolr   r2   r3   AttributeCertificateV2rV   r\   r   ro   r   r~   r   r   r   r   r   r   r   r   r   r   r;   r;   r;   r<   <module>   s      
		
	
'

#


1	
