U 2ܟj@sdZddlmZddlZddlmZddlmZddlm Z m Z m Z m Z m Z mZmZddlmZdd lmZdd lmZmZmZmZmZmZmZmZd gZd d dddd Zd d ddddZe dZ d ddddZ!d ddddZ"dS)zL `cryptography.x509 `_-specific code. ) annotationsN)Sequence)asn1) CertificateDNSName ExtensionOID IPAddressObjectIdentifier OtherNameUniformResourceIdentifier)ExtensionNotFound)CertificateError)DNS_IDCertificatePattern DNSPattern IPAddress_IDIPAddressPattern SRVPattern URIPatternverify_service_identityverify_certificate_hostnamerstrNone) certificatehostnamereturncCstt|t|ggddS)a Verify whether *certificate* is valid for *hostname*. .. note:: Nothing is verified about the *authority* of the certificate; the caller must verify that the certificate chains to an appropriate trust root themselves. Args: certificate: A *cryptography* X509 certificate object. hostname: The hostname that *certificate* should be valid for. Raises: service_identity.VerificationError: If *certificate* is not valid for *hostname*. service_identity.CertificateError: If *certificate* contains invalid / unexpected data. This includes the case where the certificate contains no `subjectAltName`\ s. .. versionchanged:: 24.1.0 :exc:`~service_identity.CertificateError` is raised if the certificate contains no ``subjectAltName``\ s instead of :exc:`~service_identity.VerificationError`. Z cert_patternsZobligatory_idsZ optional_idsN)rextract_patternsr)rrrA/tmp/pip-unpacked-wheel-8gs45env/service_identity/cryptography.pyr's )r ip_addressrcCstt|t|ggddS)a Verify whether *certificate* is valid for *ip_address*. .. note:: Nothing is verified about the *authority* of the certificate; the caller must verify that the certificate chains to an appropriate trust root themselves. Args: certificate: A *cryptography* X509 certificate object. ip_address: The IP address that *connection* should be valid for. Can be an IPv4 or IPv6 address. Raises: service_identity.VerificationError: If *certificate* is not valid for *ip_address*. service_identity.CertificateError: If *certificate* contains invalid / unexpected data. This includes the case where the certificate contains no ``subjectAltName``\ s. .. versionadded:: 18.1.0 .. versionchanged:: 24.1.0 :exc:`~service_identity.CertificateError` is raised if the certificate contains no ``subjectAltName``\ s instead of :exc:`~service_identity.VerificationError`. rN)rrr)rr!rrr verify_certificate_ip_addressKs !r"z1.3.6.1.5.5.7.8.7zSequence[CertificatePattern])certrc Csg}z|jtj}Wntk r*YnX|dd|jtD|dd|jt D|dd|jt D|jt D]n}|j t krzttj|j}Wn0tk r}zd}t||W5d}~XYnX|t|dq|S)a  Extract all valid ID patterns from a certificate for service verification. Args: cert: The certificate to be dissected. Returns: List of IDs. .. versionchanged:: 23.1.0 ``commonName`` is not used as a fallback anymore. cSsg|]}t|dqSzutf-8)r from_bytesencode).0namerrr sz$extract_patterns..cSsg|]}t|dqSr$)rr%r&)r'urirrr r)scSsg|] }t|qSr)r)r'iprrr r)szUnexpected certificate content.Nascii) extensionsZget_extension_for_oidrZSUBJECT_ALTERNATIVE_NAMEr extendvalueZget_values_for_typerr rr Ztype_id ID_ON_DNS_SRVrZ decode_derZ IA5String ValueErrorrappendrr%Zas_strr&)r#idsextotherZsrvemsgrrr rvsB    rcCstjtdddt|S)zm Deprecated and never public API. Use :func:`extract_patterns` instead. .. deprecated:: 23.1.0 z?`extract_ids()` is deprecated, please use `extract_patterns()`.)categorymessage stacklevel)warningswarnDeprecationWarningr)r#rrr extract_idss r?)#__doc__ __future__rr<typingrZcryptography.hazmatrZcryptography.x509rrrrr r r Zcryptography.x509.extensionsr exceptionsrZhazmatrrrrrrrr__all__rr"r0rr?rrrr s   $  ( $(6