
    h1                    x   d Z ddlmZ ddlZddlZddlmZmZmZm	Z	 ddl
Z
ddlmZmZmZmZmZmZmZ 	 ddlZ e
j*                  d       G d	 d
             Z	 	 	 	 	 	 	 	 d'dZ	 	 	 	 	 	 d(dZd)dZd*dZ e
j*                  d       G d d             Z e
j*                  d       G d d             Z e
j*                  d       G d d             Z e
j*                  d       G d d             Zeeeeef   Z	 e	 G d de             Z  e
j*                  dd       G d d             Z! e
j*                  d       G d d             Z" e
j*                  dd       G d d              Z# e
j*                  dd       G d! d"             Z$d+d#Z%d,d$Z&e'jQ                  d%d&      Z)y# e$ r dZY w xY w)-z
Common verification code.
    )annotationsN)ProtocolSequenceUnionruntime_checkable   )CertificateErrorDNSMismatchIPAddressMismatchMismatchSRVMismatchURIMismatchVerificationErrorT)slotsc                  j    e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   y)ServiceMatchz<
    A match of a service id and a certificate pattern.
    	ServiceID
service_idCertificatePatterncert_patternN)	__name__
__module____qualname____doc__attribr   __annotations__r        S/var/www/Befach/backend/env/lib/python3.12/site-packages/service_identity/hazmat.pyr   r      s.     $DGGIJ	%'.twwyL$0r   r   c                   | sd}t        |      g }t        | |      t        | |      z   }|D cg c]  }|j                   }}|D ](  }||vs|j                  |j	                  |             * |D ]?  }||vst        | |j                        s|j                  |j	                  |             A |rt        |      |S c c}w )z
    Verify whether *cert_patterns* are valid for *obligatory_ids* and
    *optional_ids*.

    *obligatory_ids* must be both present and match.  *optional_ids* must match
    if a pattern of the respective type is present.
    z3Certificate does not contain any `subjectAltName`s.)mismatched_id)errors)r	   _find_matchesr   appenderror_on_mismatch_contains_instance_ofpattern_classr   )	cert_patternsobligatory_idsoptional_idsmsgr#   matchesmatchmatched_idsis	            r    verify_service_identityr1   )   s     Cs##FM>:]|> G 2995##9K9KMM##!#4  
 K$91??%
 MM##!#4  v..N- :s   Cc                    g }|D ]7  }| D ]0  }|j                  |      s|j                  t        ||             2 9 |S )z
    Search for matching certificate patterns and service_ids.

    Args:
        service_ids: List of service IDs like DNS_ID.
    )r   r   )verifyr%   r   )r)   service_idsr-   sidcids        r    r$   r$   W   sE     G Czz# ccB !  Nr   c                ,    t        fd| D              S )Nc              3  6   K   | ]  }t        |        y wN)
isinstance).0ecls     r    	<genexpr>z(_contains_instance_of.<locals>.<genexpr>m   s     .Qz!R .s   )any)seqr=   s    `r    r'   r'   l   s    .#...r   c                   t        | t              r	 | j                  d      } 	 t	        |        y# t        $ r Y yw xY w# t
        $ r Y nw xY w	 t        j                  | j                  dd             y# t
        $ r Y yw xY w)z
    Check whether *pattern* could be/match an IP address.

    Args:
        pattern: A pattern for a host name.

    Returns:
        `True` if *pattern* could be an IP address, else `False`.
    asciiFT*1)	r:   bytesdecodeUnicodeErrorint
ValueError	ipaddress
ip_addressreplacepatterns    r    _is_ip_addressrO   p   s     '5!	nnW-GG   		
  
W__S#67   s-   0 ? 	<<	A
A%A5 5	B Bc                  t    e Zd ZU dZ ej
                         Zded<    ej                  d      Z
edd       Zy)
DNSPatternz7
    A DNS pattern as extracted from certificates.
    rE   rN      ^[a-z0-9\-_.]+$c                    t        |t              sd}t        |      |j                         }|dk(  st	        |      sd|v rd|d}t        |      |j                  t              }d|v rt        |        | |      S )Nz'The DNS pattern must be a bytes string.r       zInvalid DNS pattern .   *rM   )	r:   rE   	TypeErrorstriprO   r	   	translate_TRANS_TO_LOWER_validate_pattern)clsrN   r,   s      r    
from_byteszDNSPattern.from_bytes   s~    '5);CC. --/c>^G48H(15C"3''##O47?g&7##r   N)rN   rE   returnrQ   )r   r   r   r   r   r   rN   r   recompile_RE_LEGAL_CHARSclassmethodr]   r   r   r    rQ   rQ      s>    
 TWWYGU bjj!45O$ $r   rQ   c                  P    e Zd ZU dZ ej
                         Zded<   edd       Z	y)IPAddressPatternz?
    An IP address pattern as extracted from certificates.
    -ipaddress.IPv4Address | ipaddress.IPv6AddressrN   c                z    	  | t        j                  |            S # t        $ r d|d}t        |      d w xY w)NrM   zInvalid IP address pattern rU   )rJ   rK   rI   r	   )r\   bsr,   s      r    r]   zIPAddressPattern.from_bytes   sG    	2y33B788 	2/vQ7C"3'T1	2s    :N)rg   rE   r^   rd   )
r   r   r   r   r   r   rN   r   rb   r]   r   r   r    rd   rd      s/    
 >ETWWYG:F2 2r   rd   c                  |    e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   e	dd       Z
y)	
URIPatternz8
    An URI pattern as extracted from certificates.
    rE   protocol_patternrQ   dns_patternc                ,   t        |t              sd}t        |      |j                         j	                  t
              }d|vsd|v st        |      rd|d}t        |      |j                  d      \  }} | |t        j                  |            S )Nz'The URI pattern must be a bytes string.   :rV   zInvalid URI pattern rU   )rj   rk   r:   rE   rW   rX   rY   rZ   rO   r	   splitrQ   r]   )r\   rN   r,   rj   hostnames        r    r]   zURIPattern.from_bytes   s    '5);CC. --/++O<w$'/^G5L(15C"3''%,]]4%8"(-"--h7
 	
r   N)rN   rE   r^   ri   )r   r   r   r   r   r   rj   r   rk   rb   r]   r   r   r    ri   ri      s@    
 &dggie'%dggiK'
 
r   ri   c                  |    e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   e	dd       Z
y)	
SRVPatternz8
    An SRV pattern as extracted from certificates.
    rE   name_patternrQ   rk   c                D   t        |t              sd}t        |      |j                         j	                  t
              }|d   dk7  sd|vsd|v st        |      rd|d}t        |      |j                  dd      \  }} | |dd  t        j                  |      	      S )
Nz'The SRV pattern must be a bytes string.r   _      .rV   zInvalid SRV pattern rU   r   )rs   rk   rn   )r\   rN   r,   namerp   s        r    r]   zSRVPattern.from_bytes   s    '5);CC. --/++O< AJ'!7"wg&(15C"3'' tQ/habz/D/DX/N
 	
r   N)rN   rE   r^   rr   )r   r   r   r   r   r   rs   r   rk   rb   r]   r   r   r    rr   rr      s?    
 "$'')L%#%dggiK'
 
r   rr   c                  8    e Zd Zedd       Zedd       ZddZy)r   c                     y r9   r   selfs    r    r(   zServiceID.pattern_class  s    9<r   c                     y r9   r   rz   s    r    r&   zServiceID.error_on_mismatch  s    36r   c                     y r9   r   r{   rN   s     r    r3   zServiceID.verify  s    3r   N)r^   ztype[CertificatePattern])r^   ztype[Mismatch]rN   r   r^   bool)r   r   r   propertyr(   r&   r3   r   r   r    r   r   	  s!    < <6 6>r   r   F)initr   c                  z    e Zd ZU dZ ej
                         Zded<    ej                  d      Z
eZeZddZd	dZy)
DNS_IDz)
    A DNS service ID, aka hostname.
    rE   rp   rR   c                   t        |t              sd}t        |      |j                         }|rt	        |      rd}t        |      t        d |D              r)t        rt        j                  |      }nd}t        |      |j                  d      }|j                  t              | _        | j                  j                  | j                        d}t        |      y )NzDNS-ID must be a text string.zInvalid DNS-ID.c              3  8   K   | ]  }t        |      d kD    yw)   N)ord)r;   cs     r    r>   z"DNS_ID.__init__.<locals>.<genexpr>+  s     .s1v|.s   z+idna library is required for non-ASCII IDs.rB   )r:   strrW   rX   rO   rI   r?   idnaencodeImportErrorrY   rZ   rp   ra   r.   )r{   rp   r,   ascii_ids       r    __init__zDNS_ID.__init__!  s    (C(1CC. >>#>(3#CS/!.X..;;x0C!#&&w/H **?;%%dmm4<#CS/! =r   c                p    t        || j                        r t        |j                  | j                        S y)zC
        https://tools.ietf.org/search/rfc6125#section-6.4
        F)r:   r(   _hostname_matchesrN   rp   r~   s     r    r3   zDNS_ID.verify9  s,     gt112$W__dmmDDr   N)rp   r   r   )r   r   r   r   r   r   rp   r   r_   r`   ra   rQ   r(   r
   r&   r   r3   r   r   r    r   r     sC     dggiHe !bjj!45OM#"0r   r   c                  f    e Zd ZU dZ ej
                  ej                        Zde	d<   e
ZeZddZy)IPAddress_IDz#
    An IP address service ID.
    )	converterre   ipc                b    t        || j                        r| j                  |j                  k(  S y)zC
        https://tools.ietf.org/search/rfc2818#section-3.1
        F)r:   r(   r   rN   r~   s     r    r3   zIPAddress_ID.verifyP  s*     gt11277goo--r   Nr   )r   r   r   r   r   r   rJ   rK   r   r   rd   r(   r   r&   r3   r   r   r    r   r   C  s=     9@&&9B5  %M)r   r   c                      e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   e	Z
eZd	dZd
dZy)URI_IDz
    An URI service ID.
    rE   protocolr   dns_idc                N   t        |t              sd}t        |      |j                         }d|vst	        |      rd}t        |      |j                  d      \  }}|j                  d      j                  t              | _
        t        |j                  d            | _        y )NzURI-ID must be a text string.:zInvalid URI-ID.rB   /)r:   r   rW   rX   rO   rI   ro   r   rY   rZ   r   r   r   )r{   urir,   protrp   s        r    r   zURI_ID.__init__f  s    #s#1CC. iikc>^C0#CS/!3hG,66GX^^C01r   c                    t        || j                        r@|j                  | j                  k(  xr% | j                  j                  |j                        S y)zE
        https://tools.ietf.org/search/rfc6125#section-6.5.2
        F)r:   r(   rj   r   r   r3   rk   r~   s     r    r3   zURI_ID.verifyu  sM     gt112((DMM9 <KK&&w':':;
 r   N)r   r   r   )r   r   r   r   r   r   r   r   r   ri   r(   r   r&   r   r3   r   r   r    r   r   Z  sB     dggiHeTWWYFFM#2
r   r   c                      e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   e	Z
eZd	dZd
dZy)SRV_IDz
    An SRV service ID.
    rE   rw   r   r   c                H   t        |t              sd}t        |      |j                         }d|vst	        |      s|d   dk7  rd}t        |      |j                  dd      \  }}|dd  j                  d      j                  t              | _
        t        |      | _        y )NzSRV-ID must be a text string.rU   r   _zInvalid SRV-ID.r   rB   )r:   r   rW   rX   rO   rI   ro   r   rY   rZ   rw   r   r   )r{   srvr,   rw   rp   s        r    r   zSRV_ID.__init__  s    #s#1CC. iikc>^C0CFcM#CS/!3*hHOOG,66G	X&r   c                    t        || j                        r@| j                  |j                  k(  xr% | j                  j                  |j                        S y)zE
        https://tools.ietf.org/search/rfc6125#section-6.5.1
        F)r:   r(   rw   rs   r   r3   rk   r~   s     r    r3   zSRV_ID.verify  sO     gt11299 4 44 9K9K##:  r   N)r   r   r   )r   r   r   r   r   r   rw   r   r   rr   r(   r   r&   r   r3   r   r   r    r   r     sB     $'')D%TWWYFFM#'	r   r   c                    d| v rH| j                  dd      \  }}|j                  dd      \  }}||k7  ry|j                  d      ry|d|fv S | |k(  S )zT
    :return: `True` if *cert_pattern* matches *actual_hostname*, else `False`.
    rV   rv   r   Fs   xn--)ro   
startswith)r   actual_hostname	cert_head	cert_tailactual_headactual_tails         r    r   r     sq     |+11$:	9#2#8#8q#A [#!!'*T;///?**r   c                (   | j                  d      }|dkD  rd| d}t        |      | j                  d      }t        |      dk  rd| d}t        |      d|d   vrd| d	}t        |      t	        d
 |D              rd| d}t        |      y)zh
    Check whether the usage of wildcards within *cert_pattern* conforms with
    our expectations.
    rV   r   zCertificate's DNS-ID z contains too many wildcards.rv      z0 has too few host components for wildcard usage.r   z+ has a wildcard outside the left-most part.c              3  4   K   | ]  }t        |         y wr9   )len)r;   ps     r    r>   z$_validate_pattern.<locals>.<genexpr>  s     
%!s1v:
%s   z contains empty parts.N)countr	   ro   r   r?   )r   cntr,   partss       r    r[   r[     s    
 

T
"C
Qw%l%55RSs##t$E
5zA~%l%55efs##58%l%55`as##

%u
%%%l%55KLs## &r   s   ABCDEFGHIJKLMNOPQRSTUVWXYZs   abcdefghijklmnopqrstuvwxyz)r)   Sequence[CertificatePattern]r*   Sequence[ServiceID]r+   r   r^   list[ServiceMatch])r)   r   r4   r   r^   r   )r@   zSequence[object]r=   typer^   r   )rN   zstr | bytesr^   r   )r   rE   r   rE   r^   r   )r   rE   r^   None)*r   
__future__r   rJ   r_   typingr   r   r   r   r   
exceptionsr	   r
   r   r   r   r   r   r   r   sr   r1   r$   r'   rO   rQ   rd   ri   rr   r   r   r   r   r   r   r   r[   rE   	maketransrZ   r   r   r    <module>r      sG   #  	 ? ?   
 d1 1 1+/+'+ &+ 	+\/$ */> d$ $ $: d2 2 2" d
 
 
< d
 
 
B 
J(88  ? ? ? U$+ +  +\ d  , U$$ $  $N U$# #  #L+$$. //!#@o  Ds   F. .F98F9