
    _fx0                       d Z ddlmZ ddlZddlZddlmZmZmZm	Z	 ddl
Z
ddlmZmZmZmZmZmZmZ 	 ddlZn# e$ r dZY nw xY w e
j        d           G d	 d
                      Zd:dZd;dZd<dZd=dZ e
j        d           G d d                      Z e
j        d           G d  d!                      Z e
j        d           G d" d#                      Z e
j        d           G d$ d%                      Zeeeeef         Z	 e	 G d& d'e                      Z  e
j        d(d)           G d* d+                      Z! e
j        d           G d, d-                      Z" e
j        d(d)           G d. d/                      Z# e
j        d(d)           G d0 d1                      Z$d>d5Z%d?d7Z&e'(                    d8d9          Z)dS )@z
Common verification code.
    )annotationsN)ProtocolSequenceUnionruntime_checkable   )CertificateErrorDNSMismatchIPAddressMismatchMismatchSRVMismatchURIMismatchVerificationErrorT)slotsc                  d    e Zd ZU dZ ej                    Zded<    ej                    Zded<   dS )ServiceMatchz<
    A match of a service id and a certificate pattern.
    	ServiceID
service_idCertificatePatterncert_patternN)	__name__
__module____qualname____doc__attribr   __annotations__r        I/var/www/html/env/lib/python3.11/site-packages/service_identity/hazmat.pyr   r      sP           $DGIIJ%%%%'.twyyL000000r   r   cert_patternsSequence[CertificatePattern]obligatory_idsSequence[ServiceID]optional_idsreturnlist[ServiceMatch]c                   | st          d          g }t          | |          t          | |          z   }d |D             }|D ]/}||vr)|                    |                    |                     0|D ]D}||vr>t	          | |j                  r)|                    |                    |                     E|rt          |          |S )z
    Verify whether *cert_patterns* are valid for *obligatory_ids* and
    *optional_ids*.

    *obligatory_ids* must be both present and match.  *optional_ids* must match
    if a pattern of the respective type is present.
    z3Certificate does not contain any `subjectAltName`s.c                    g | ]	}|j         
S r   )r   ).0matchs     r    
<listcomp>z+verify_service_identity.<locals>.<listcomp>?   s    9995#999r   )mismatched_id)errors)r	   _find_matchesappenderror_on_mismatch_contains_instance_ofpattern_classr   )r!   r#   r%   r.   matchesmatched_idsis          r    verify_service_identityr7   )   s     
A
 
 	
 FM>::]|> > G :9999K @ @KMM!--A->>??? @ @
 K$91?%
 %
 MM!--A->>??? /v....Nr   service_idsc                    g }|D ]@}| D ];}|                     |          r$|                    t          ||                     <A|S )z
    Search for matching certificate patterns and service_ids.

    Args:
        service_ids: List of service IDs like DNS_ID.
    )r   r   )verifyr0   r   )r!   r8   r4   sidcids        r    r/   r/   T   sk     G O O  	O 	OCzz# O|MMMNNN	O Nr   seqSequence[object]cltypeboolc                :    t          fd| D                       S )Nc              3  8   K   | ]}t          |          V  d S N)
isinstance)r*   er?   s     r    	<genexpr>z(_contains_instance_of.<locals>.<genexpr>g   s-      ..Qz!R  ......r   )any)r=   r?   s    `r    r2   r2   f   s&    ....#......r   patternstr | bytesc                :   t          | t                    r(	 |                     d          } n# t          $ r Y dS w xY w	 t	          |            dS # t
          $ r Y nw xY w	 t          j        |                     dd                     n# t
          $ r Y dS w xY wdS )z
    Check whether *pattern* could be/match an IP address.

    Args:
        pattern: A pattern for a host name.

    Returns:
        `True` if *pattern* could be an IP address, else `False`.
    asciiFT*1)	rE   bytesdecodeUnicodeErrorint
ValueError	ipaddress
ip_addressreplacerI   s    r    _is_ip_addressrX   j   s     '5!! 	nnW--GG 	 	 	55	Gt   W__S#667777   uu 4s/   - 
;;A 
AA!(B
 

BBc                  t    e Zd ZU dZ ej                    Zded<    ej	        d          Z
edd            ZdS )	
DNSPatternz7
    A DNS pattern as extracted from certificates.
    rO   rI      ^[a-z0-9\-_.]+$r&   c                <   t          |t                    st          d          |                                }|dk    st	          |          sd|v rt          d|d          |                    t                    }d|v rt          |            | |          S )Nz'The DNS pattern must be a bytes string.r       zInvalid DNS pattern .   *rW   )	rE   rO   	TypeErrorstriprX   r	   	translate_TRANS_TO_LOWER_validate_pattern)clsrI   s     r    
from_byteszDNSPattern.from_bytes   s    '5)) 	GEFFF--//c>>^G44>8H8H"#F'#F#F#FGGG##O447??g&&&s7####r   N)rI   rO   r&   rZ   )r   r   r   r   r   r   rI   r   recompile_RE_LEGAL_CHARSclassmethodrf   r   r   r    rZ   rZ      sk          
 TWYYG bj!455O$ $ $ [$ $ $r   rZ   c                  T    e Zd ZU dZ ej                    Zded<   ed	d            Z	dS )
IPAddressPatternz?
    An IP address pattern as extracted from certificates.
    -ipaddress.IPv4Address | ipaddress.IPv6AddressrI   bsrO   r&   c                    	  | t          j        |                    S # t          $ r t          d|d          d w xY w)NrW   zInvalid IP address pattern r^   )rT   rU   rS   r	   )re   rn   s     r    rf   zIPAddressPattern.from_bytes   sc    	3y3B778888 	 	 	"5b555 	s     ?N)rn   rO   r&   rl   )
r   r   r   r   r   r   rI   r   rj   rf   r   r   r    rl   rl      sZ          
 >ETWYYGFFFF   [  r   rl   c                  |    e Zd ZU dZ ej                    Zded<    ej                    Zded<   e	d
d            Z
d	S )
URIPatternz8
    An URI pattern as extracted from certificates.
    rO   protocol_patternrZ   dns_patternrI   r&   c                p   t          |t                    st          d          |                                                    t
                    }d|vsd|v st          |          rt          d|d          |                    d          \  }} | |t          
                    |                    S )Nz'The URI pattern must be a bytes string.   :r_   zInvalid URI pattern r^   )rr   rs   rE   rO   r`   ra   rb   rc   rX   r	   splitrZ   rf   )re   rI   rr   hostnames       r    rf   zURIPattern.from_bytes   s    '5)) 	GEFFF--//++O<<w$'//^G5L5L/"#F'#F#F#FGGG%,]]4%8%8"(s-"--h77
 
 
 	
r   N)rI   rO   r&   rq   )r   r   r   r   r   r   rr   r   rs   rj   rf   r   r   r    rq   rq      ss          
 &dgii''''%dgiiK''''
 
 
 [
 
 
r   rq   c                  |    e Zd ZU dZ ej                    Zded<    ej                    Zded<   e	d
d            Z
d	S )
SRVPatternz8
    An SRV pattern as extracted from certificates.
    rO   name_patternrZ   rs   rI   r&   c                   t          |t                    st          d          |                                                    t
                    }|d         dk    sd|vsd|v st          |          rt          d|d          |                    dd          \  }} | |dd          t          
                    |          	          S )
Nz'The SRV pattern must be a bytes string.r   _      .r_   zInvalid SRV pattern r^   r   )r{   rs   rv   )re   rI   namerx   s       r    rf   zSRVPattern.from_bytes   s    '5)) 	GEFFF--//++O<< AJ'!!7""wg&&  ##F'#F#F#FGGG tQ//hsabbz/D/DX/N/N
 
 
 	
r   N)rI   rO   r&   rz   )r   r   r   r   r   r   r{   r   rs   rj   rf   r   r   r    rz   rz      sr          
 "$'))L####%dgiiK''''
 
 
 [
 
 
r   rz   c                  F    e Zd Zedd            Zedd            Zdd	Zd
S )r   r&   type[CertificatePattern]c                    d S rD   r   selfs    r    r3   zServiceID.pattern_class       r   type[Mismatch]c                    d S rD   r   r   s    r    r1   zServiceID.error_on_mismatch  r   r   rI   r   rA   c                    d S rD   r   r   rI   s     r    r:   zServiceID.verify  s    r   N)r&   r   )r&   r   rI   r   r&   rA   )r   r   r   propertyr3   r1   r:   r   r   r    r   r      sf           X    X     r   r   F)initr   c                  t    e Zd ZU dZ ej                    Zded<    ej	        d          Z
eZeZddZddZdS )DNS_IDz)
    A DNS service ID, aka hostname.
    rO   rx   r[   strc                   t          |t                    st          d          |                                }|rt	          |          rt          d          t          d |D                       r+t          rt          j        |          }n$t          d          |                    d          }|
                    t                    | _        | j                            | j                  t          d          d S )NzDNS-ID must be a text string.zInvalid DNS-ID.c              3  <   K   | ]}t          |          d k    V  dS )   N)ord)r*   cs     r    rG   z"DNS_ID.__init__.<locals>.<genexpr>   s,      ..s1vv|......r   z+idna library is required for non-ASCII IDs.rL   )rE   r   r`   ra   rX   rS   rH   idnaencodeImportErrorrb   rc   rx   ri   r+   )r   rx   ascii_ids      r    __init__zDNS_ID.__init__  s    (C(( 	=;<<<>>## 	0>(33 	0.///..X..... 	0 ;x00!A    w//H **?;;%%dm44<./// =<r   rI   r   r&   rA   c                d    t          || j                  rt          |j        | j                  S dS )zC
        https://tools.ietf.org/search/rfc6125#section-6.4
        F)rE   r3   _hostname_matchesrI   rx   r   s     r    r:   zDNS_ID.verify.  s3     gt122 	E$W_dmDDDur   N)rx   r   r   )r   r   r   r   r   r   rx   r   rg   rh   ri   rZ   r3   r
   r1   r   r:   r   r   r    r   r     s           dgiiH !bj!455OM#0 0 0 0,     r   r   c                  Z    e Zd ZU dZ ej        ej                  Zde	d<   e
ZeZdd	Zd
S )IPAddress_IDz#
    An IP address service ID.
    )	converterrm   iprI   r   r&   rA   c                P    t          || j                  r| j        |j        k    S dS )zC
        https://tools.ietf.org/search/rfc2818#section-3.1
        F)rE   r3   r   rI   r   s     r    r:   zIPAddress_ID.verifyE  s-     gt122 	.7go--ur   Nr   )r   r   r   r   r   r   rT   rU   r   r   rl   r3   r   r1   r:   r   r   r    r   r   8  sv           9@&9 9 9B     %M)     r   r   c                  |    e Zd ZU dZ ej                    Zded<    ej                    Zded<   e	Z
eZddZddZdS )URI_IDz
    An URI service ID.
    rO   protocolr   dns_idurir   c                   t          |t                    st          d          |                                }d|vst	          |          rt          d          |                    d          \  }}|                    d                              t                    | _
        t          |                    d                    | _        d S )NzURI-ID must be a text string.:zInvalid URI-ID.rL   /)rE   r   r`   ra   rX   rS   rw   r   rb   rc   r   r   r   )r   r   protrx   s       r    r   zURI_ID.__init__[  s    #s## 	=;<<<iikkc>>^C00>.///3hG,,66GGX^^C0011r   rI   r   r&   rA   c                    t          || j                  r/|j        | j        k    o| j                            |j                  S dS )zE
        https://tools.ietf.org/search/rfc6125#section-6.5.2
        F)rE   r3   rr   r   r   r:   rs   r   s     r    r:   zURI_ID.verifyh  sM     gt122 	(DM9 <K&&w':;;
 ur   N)r   r   r   )r   r   r   r   r   r   r   r   r   rq   r3   r   r1   r   r:   r   r   r    r   r   O  s           dgiiHTWYYFM#2 2 2 2
 
 
 
 
 
r   r   c                  |    e Zd ZU dZ ej                    Zded<    ej                    Zded<   e	Z
eZddZddZdS )SRV_IDz
    An SRV service ID.
    rO   r   r   r   srvr   c                   t          |t                    st          d          |                                }d|vst	          |          s|d         dk    rt          d          |                    dd          \  }}|dd                              d                              t                    | _
        t          |          | _        d S )NzSRV-ID must be a text string.r^   r   _zInvalid SRV-ID.r   rL   )rE   r   r`   ra   rX   rS   rw   r   rb   rc   r   r   r   )r   r   r   rx   s       r    r   zSRV_ID.__init__  s    #s## 	=;<<<iikkc>>^C00>CFcMM.///3**hHOOG,,66GG	X&&r   rI   r   r&   rA   c                    t          || j                  r/| j        |j        k    o| j                            |j                  S dS )zE
        https://tools.ietf.org/search/rfc6125#section-6.5.1
        F)rE   r3   r   r{   r   r:   rs   r   s     r    r:   zSRV_ID.verify  sQ     gt122 	9 44 9K9K#: :  ur   N)r   r   r   )r   r   r   r   r   r   r   r   r   rz   r3   r   r1   r   r:   r   r   r    r   r   u  s           $'))DTWYYFM#' ' ' '	 	 	 	 	 	r   r   r   rO   actual_hostnamec                    d| v r]|                      dd          \  }}|                     dd          \  }}||k    rdS |                    d          rdS |dk    p||k    S | |k    S )zT
    :return: `True` if *cert_pattern* matches *actual_hostname*, else `False`.
    r_   r~   r   Fs   xn--)rw   
startswith)r   r   	cert_head	cert_tailactual_headactual_tails         r    r   r     s     |+11$::	9#2#8#8q#A#A [##5!!'** 	5D <I$<<?**r   Nonec                   |                      d          }|dk    rt          d| d          |                     d          }t          |          dk     rt          d| d          d|d         vr"t          d	                    |                     t          d
 |D                       rt          d| d          dS )zh
    Check whether the usage of wildcards within *cert_pattern* conforms with
    our expectations.
    r_   r   zCertificate's DNS-ID z contains too many wildcards.r~      z0 has too few host components for wildcard usage.r   zDCertificate's DNS-ID {!r} has a wildcard outside the left-most part.c              3  6   K   | ]}t          |           V  d S rD   )len)r*   ps     r    rG   z$_validate_pattern.<locals>.<genexpr>  s*      
%
%!s1vv:
%
%
%
%
%
%r   z contains empty parts.N)countr	   rw   r   formatrH   )r   cntpartss      r    rd   rd     s   
 

T
"
"C
QwwQLQQQ
 
 	
 t$$E
5zzA~~L   
 
 	

 58F<((
 
 	
 
%
%u
%
%
%%% 
JLJJJ
 
 	

 
r   s   ABCDEFGHIJKLMNOPQRSTUVWXYZs   abcdefghijklmnopqrstuvwxyz)r!   r"   r#   r$   r%   r$   r&   r'   )r!   r"   r8   r$   r&   r'   )r=   r>   r?   r@   r&   rA   )rI   rJ   r&   rA   )r   rO   r   rO   r&   rA   )r   rO   r&   r   )*r   
__future__r   rT   rg   typingr   r   r   r   r   
exceptionsr	   r
   r   r   r   r   r   r   r   sr   r7   r/   r2   rX   rZ   rl   rq   rz   r   r   r   r   r   r   r   rd   rO   	maketransrc   r   r   r    <module>r      sN    # " " " " "     				 ? ? ? ? ? ? ? ? ? ? ? ?                  KKKK   DDD d1 1 1 1 1 1 1 1( ( ( (V   $/ / / /   < d$ $ $ $ $ $ $ $6 d       $ d
 
 
 
 
 
 
 
8 d
 
 
 
 
 
 
 
> 
J(88  
 
 
 
 
 
 
 
 U$) ) ) ) ) ) )  )X d       , U$" " " " " " "  "J U$! ! ! ! ! ! !  !H+ + + +$
 
 
 
: //!#@ s   9 AA