File: //opt/alt/python311/lib/python3.11/site-packages/redis/__pycache__/ocsp.cpython-311.pyc
�
$�;f�, � � � d dl Z d dlZd dlZd dlmZmZ d dlZd dlZd dlm Z m
Z
d dlmZ d dl
mZ d dlmZ d dlmZmZ d dlmZ d d lmZ d d
lmZmZ d dlmZmZ d dlmZ d d
lm Z m!Z! d� Z"dd�Z#d� Z$d� Z%dd�Z& G d� d� � Z'dS )� N)�urljoin�urlparse)�hazmat�x509)�InvalidSignature)�backends)�DSAPublicKey)�ECDSA�EllipticCurvePublicKey)�PKCS1v15)�RSAPublicKey)�SHA1�Hash)�Encoding�PublicFormat)�ocsp)�AuthorizationError�ConnectionErrorc �L � | � � � } t |t � � r5|� |j |j t
� � |j � � d S t |t � � r(|� |j |j |j � � d S t |t � � r5|� |j |j t |j � � � � d S |� |j |j � � d S # t $ r t d� � �w xY w)Nzfailed to valid ocsp response)
�
public_key�
isinstancer
�verify� signature�tbs_response_bytesr �signature_hash_algorithmr r r
r r )�issuer_cert�
ocsp_response�pubkeys �=/opt/alt/python311/lib/python3.11/site-packages/redis/ocsp.py�_verify_responser sG � �
�
#�
#�
%�
%�F�?��f�l�+�+� U��M�M��'��0��
�
��6�
�
�
�
�
� ���
-�
-�
U��M�M��'��0��6�
�
�
�
�
�
�� 6�
7�
7� U��M�M��'��0��m�<�=�=�
�
�
�
�
�
�M�M�-�1�=�3S�T�T�T�T�T��� ?� ?� ?��=�>�>�>�?���s �AD � ;D �AD �' D � D#Tc � � t j |� � }|j t j j k rt d� � �|j t j j k rY|j t j j k r>t dt |j � � � d� � d � d�� � �nt d� � �|j
t j � � � k rt d� � �|j r6|j t j � � � k rt d� � �|j }|j }|j }| }|�|| j k s||k r| }n�|j }t- || ||� � } | d
}
n# t. $ r t d� � �w xY w|
j � t4 j � � }|�t4 j j j |j vrt d� � �|
}|rtA ||� � d
S )z=A wrapper the return the validity of a known ocsp certificatez4you are not authorized to view this ocsp certificatezReceived an �.� z ocsp certificate statusz?failed to retrieve a sucessful response from the ocsp responderz)ocsp certificate was issued in the futurez1ocsp certificate has invalid update - in the pastNr z'no certificates found for the responderz'delegate not autorized for ocsp signingT)!r �load_der_ocsp_response�response_status�OCSPResponseStatus�UNAUTHORIZEDr �
SUCCESSFUL�certificate_status�OCSPCertStatus�GOODr �str�split�this_update�datetime�now�next_update�responder_name�issuer_key_hash�responder_key_hash�subject�certificates�_get_certificates�
IndexError�
extensions�get_extension_for_classr �ExtendedKeyUsage�oid�ExtendedKeyUsageOID�OCSP_SIGNING�valuer )r �
ocsp_bytes�validater r2 �issuer_hash�responder_hash�cert_to_validate�certs�responder_certs�responder_cert�exts r �_check_certificaterI 2 s8 � � �/�
�;�;�M��$��(?�(L�L�L� �!W�X�X�X��$��(?�(J�J�J��+�t�/B�/G�G�G�!�*�s�=�#C�D�D�J�J�3�O�O�PQ�R� *� *� *�� �
� H� �M�
�
�
� � �H�$5�$9�$9�$;�$;�;�;��I�J�J�J� �!�S��%��(9�(=�(=�(?�(?�?�?��Q�R�R�R�"�1�N��/�K�"�5�N�"���"��k�1�1�1��[�(�(�&����*��+��;���
�
�� M�,�Q�/�N�N��� M� M� M�!�"K�L�L�L� M���� �'�?�?��@U�V�V���;�$�(�6�C�3�9�T�T�!�"K�L�L�L�)��� :��)�=�9�9�9��4s �:F �Fc �N ���� ����fd�| D � � }n��fd�| D � � }|S )Nc �Z �� g | ]'}t |� � �k �|j �j k �%|��(S � )�_get_pubkey_hash�issuerr5 )�.0�cr rC s ��r �
<listcomp>z%_get_certificates.<locals>.<listcomp>o sE �� �
�
�
����"�"�n�4�4���[�EX�9X�9X�
�9X�9X�9X� c �J �� g | ]}|j �k �
|j �j k �|�� S rL )r5 rN )rO rP r r2 s ��r rQ z%_get_certificates.<locals>.<listcomp>u s? �� �
�
�
���y�N�*�*�q�x�;�;N�/N�/N�
�/N�/N�/NrR rL )rE r r2 rC r6 s ``` r r7 r7 m so ���� ���
�
�
�
�
��
�
�
���
�
�
�
�
��
�
�
�� �rR c �, � | � � � }t |t � � r+|� t j t j � � }njt |t � � r+|� t j t j
� � }n*|� t j t j � � }t t � � t j � � �� � }|� |� � |� � � S )N)�backend)r r r
�public_bytesr �DERr �PKCS1r �X962�UncompressedPoint�SubjectPublicKeyInfor r r �default_backend�update�finalize)�certificater �h�sha1s r rM rM ~ s� � �
�
#�
#�
%�
%�F� �&�,�'�'� Q������l�.@�A�A��� �F�2� 3� 3� Q�����
�|�/M�N�N��������l�.O�P�P������� 8� :� :�;�;�;�D��K�K��N�N�N��=�=�?�?�rR c � � |dv rt d� � �d}| � � � � � � }| � � � D ]*}|� � � }|j |j k r|} n�+|�t d� � �|�)t
j |� � }||k rt d� � �t ||� � S )z�An implemention of a function for set_ocsp_client_callback in PyOpenSSL.
This function validates that the provide ocsp_bytes response is valid,
and matches the expected, stapled responses.
)rR Nzno ocsp response presentNz2no matching issuer cert found in certificate chainz/received and expected certificates do not match) r �get_peer_certificate�to_cryptography�get_peer_cert_chainr5 rN r �load_pem_x509_certificaterI )�conr@ �expectedr � peer_certrP �cert�es r �ocsp_staple_verifierrl � s� � � �[� � ��8�9�9�9��K��(�(�*�*�:�:�<�<�I�
�
$�
$�
&�
&� � ��� � �"�"���<�9�+�+�+��K��E� ,� ���R�S�S�S����*�8�4�4����>�>�!�"S�T�T�T��k�:�6�6�6rR c �D � e Zd ZdZdd�Zd� Zd� Zd� Zd� Zd� Z d � Z
d
� ZdS )�OCSPVerifiera A class to verify ssl sockets for RFC6960/RFC6961. This can be used
when using direct validation of OCSP responses and certificate revocations.
@see https://datatracker.ietf.org/doc/html/rfc6960
@see https://datatracker.ietf.org/doc/html/rfc6961
Nc �>