o
    çó·iÃ1  ã                   @  sê  d Z ddlmZ ddlZddlZddlmZmZmZm	Z	 ddl
Z
ddlmZmZmZmZmZmZmZ zddlZW n eyC   dZY nw e
jdd�G d	d
„ d
ƒƒZd@dd„ZdAdd„ZdBdd„ZdCd d!„Ze
jdd�G d"d#„ d#ƒƒZe
jdd�G d$d%„ d%ƒƒZe
jdd�G d&d'„ d'ƒƒZe
jdd�G d(d)„ d)ƒƒZeeeeef Z	 e	G d*d+„ d+eƒƒZ e
jd,dd-�G d.d/„ d/ƒƒZ!e
jdd�G d0d1„ d1ƒƒZ"e
jd,dd-�G d2d3„ d3ƒƒZ#e
jd,dd-�G d4d5„ d5ƒƒZ$dDd9d:„Z%dEd<d=„Z&e' (d>d?¡Z)dS )Fz
Common verification code.
é    )ÚannotationsN)ÚProtocolÚSequenceÚUnionÚruntime_checkableé   )ÚCertificateErrorÚDNSMismatchÚIPAddressMismatchÚMismatchÚSRVMismatchÚURIMismatchÚVerificationErrorT)Úslotsc                   @  s2   e Zd ZU dZe ¡ Zded< e ¡ Zded< dS )ÚServiceMatchz<
    A match of a service id and a certificate pattern.
    Ú	ServiceIDÚ
service_idÚCertificatePatternÚcert_patternN)	Ú__name__Ú
__module__Ú__qualname__Ú__doc__ÚattrÚibr   Ú__annotations__r   © r   r   ú]C:\Users\psant\Downloads\PAF backend\school\venv\Lib\site-packages\service_identity/hazmat.pyr      s   
 r   Úcert_patternsúSequence[CertificatePattern]Úobligatory_idsúSequence[ServiceID]Úoptional_idsÚreturnúlist[ServiceMatch]c                 C  sœ   | sd}t |ƒ‚g }t| |ƒt| |ƒ }dd„ |D ƒ}|D ]}||vr,| |j|d�¡ q|D ]}||vrDt| |jƒrD| |j|d�¡ q/|rLt|d�‚|S )zä
    Verify whether *cert_patterns* are valid for *obligatory_ids* and
    *optional_ids*.

    *obligatory_ids* must be both present and match.  *optional_ids* must match
    if a pattern of the respective type is present.
    z3Certificate does not contain any `subjectAltName`s.c                 S  s   g | ]}|j ‘qS r   )r   )Ú.0Úmatchr   r   r   Ú
<listcomp>>   s    z+verify_service_identity.<locals>.<listcomp>)Zmismatched_id)ÚerrorsN)r   Ú_find_matchesÚappendÚerror_on_mismatchÚ_contains_instance_ofÚpattern_classr   )r   r    r"   Úmsgr(   ÚmatchesZmatched_idsÚir   r   r   Úverify_service_identity)   s2   
ÿ
ÿ€
ÿ
ÿ€
r1   Úservice_idsc                 C  s8   g }|D ]}| D ]}|  |¡r| t||d�¡ qq|S )z„
    Search for matching certificate patterns and service_ids.

    Args:
        service_ids: List of service IDs like DNS_ID.
    )r   r   N)Úverifyr*   r   )r   r2   r/   ZsidZcidr   r   r   r)   W   s   


ÿ€þr)   ÚseqúSequence[object]ÚclÚtypeÚboolc                   s   t ‡ fdd„| D ƒƒS )Nc                 3  s   � | ]}t |ˆ ƒV  qd S ©N)Ú
isinstance)r%   Úe©r6   r   r   Ú	<genexpr>m   ó   € z(_contains_instance_of.<locals>.<genexpr>)Úany)r4   r6   r   r<   r   r,   l   s   r,   Úpatternústr | bytesc                 C  s~   t | tƒrz|  d¡} W n
 ty   Y dS w zt| ƒ W dS  ty'   Y nw zt |  dd¡¡ W dS  ty>   Y dS w )zÆ
    Check whether *pattern* could be/match an IP address.

    Args:
        pattern: A pattern for a host name.

    Returns:
        `True` if *pattern* could be an IP address, else `False`.
    ÚasciiFTÚ*Ú1N)	r:   ÚbytesÚdecodeÚUnicodeErrorÚintÚ
ValueErrorÚ	ipaddressÚ
ip_addressÚreplace©r@   r   r   r   Ú_is_ip_addressp   s$   

ÿ
ýÿýÿrN   c                   @  s:   e Zd ZU dZe ¡ Zded< e 	d¡Z
ed	dd„ƒZdS )
Ú
DNSPatternz7
    A DNS pattern as extracted from certificates.
    rE   r@   ó   ^[a-z0-9\-_.]+$r#   c                 C  sn   t |tƒsd}t|ƒ‚| ¡ }|dkst|ƒsd|v r%d|›d�}t|ƒ‚| t¡}d|v r2t|ƒ | |d�S )Nz'The DNS pattern must be a bytes string.ó    ó    zInvalid DNS pattern Ú.ó   *rM   )	r:   rE   Ú	TypeErrorÚstriprN   r   Ú	translateÚ_TRANS_TO_LOWERÚ_validate_pattern)Úclsr@   r.   r   r   r   Ú
from_bytesš   s   


zDNSPattern.from_bytesN)r@   rE   r#   rO   )r   r   r   r   r   r   r@   r   ÚreÚcompileÚ_RE_LEGAL_CHARSÚclassmethodr[   r   r   r   r   rO   �   s   
 
rO   c                   @  s0   e Zd ZU dZe ¡ Zded< ed
dd„ƒZ	d	S )ÚIPAddressPatternz?
    An IP address pattern as extracted from certificates.
    ú-ipaddress.IPv4Address | ipaddress.IPv6Addressr@   ÚbsrE   r#   c                 C  s8   z	| t  |¡d�W S  ty   d|›d�}t|ƒd ‚w )NrM   zInvalid IP address pattern rS   )rJ   rK   rI   r   )rZ   rb   r.   r   r   r   r[   ¶   s   
þzIPAddressPattern.from_bytesN)rb   rE   r#   r`   )
r   r   r   r   r   r   r@   r   r_   r[   r   r   r   r   r`   ­   s
   
 r`   c                   @  ó@   e Zd ZU dZe ¡ Zded< e ¡ Zded< e	ddd	„ƒZ
d
S )Ú
URIPatternz8
    An URI pattern as extracted from certificates.
    rE   Úprotocol_patternrO   Údns_patternr@   r#   c                 C  sp   t |tƒsd}t|ƒ‚| ¡  t¡}d|vsd|v st|ƒr(d|›d�}t|ƒ‚| d¡\}}| |t	 
|¡d�S )Nz'The URI pattern must be a bytes string.ó   :rT   zInvalid URI pattern rS   )re   rf   ©r:   rE   rU   rV   rW   rX   rN   r   ÚsplitrO   r[   )rZ   r@   r.   re   Úhostnamer   r   r   r[   Ê   s   
þzURIPattern.from_bytesN)r@   rE   r#   rd   )r   r   r   r   r   r   re   r   rf   r_   r[   r   r   r   r   rd   ¿   ó   
 rd   c                   @  rc   )Ú
SRVPatternz8
    An SRV pattern as extracted from certificates.
    rE   Úname_patternrO   rf   r@   r#   c                 C  s†   t |tƒsd}t|ƒ‚| ¡  t¡}|d dks$d|vs$d|v s$t|ƒr.d|›d�}t|ƒ‚| dd¡\}}| |dd … t	 
|¡d	�S )
Nz'The SRV pattern must be a bytes string.r   é_   ó   .rT   zInvalid SRV pattern rS   r   )rm   rf   rh   )rZ   r@   r.   Únamerj   r   r   r   r[   é   s$   

ÿþýüÿzSRVPattern.from_bytesN)r@   rE   r#   rl   )r   r   r   r   r   r   rm   r   rf   r_   r[   r   r   r   r   rl   Þ   rk   rl   c                   @  s2   e Zd Zeddd„ƒZeddd„ƒZddd„ZdS )r   r#   útype[CertificatePattern]c                 C  ó   d S r9   r   ©Úselfr   r   r   r-     ó   zServiceID.pattern_classútype[Mismatch]c                 C  rr   r9   r   rs   r   r   r   r+     ru   zServiceID.error_on_mismatchr@   r   r8   c                 C  rr   r9   r   ©rt   r@   r   r   r   r3     s    zServiceID.verifyN)r#   rq   )r#   rv   ©r@   r   r#   r8   )r   r   r   Úpropertyr-   r+   r3   r   r   r   r   r   	  s    r   F)Úinitr   c                   @  sH   e Zd ZU dZe ¡ Zded< e 	d¡Z
eZeZddd„Zddd„ZdS )ÚDNS_IDz)
    A DNS service ID, aka hostname.
    rE   rj   rP   Ústrc                 C  sœ   t |tƒsd}t|ƒ‚| ¡ }|rt|ƒrd}t|ƒ‚tdd„ |D ƒƒr2tr,t |¡}nd}t	|ƒ‚| d¡}| 
t¡| _| j | j¡d u rLd}t|ƒ‚d S )NzDNS-ID must be a text string.zInvalid DNS-ID.c                 s  s   � | ]	}t |ƒd kV  qdS )é   N)Úord)r%   Úcr   r   r   r=   +  s   € z"DNS_ID.__init__.<locals>.<genexpr>z+idna library is required for non-ASCII IDs.rB   )r:   r|   rU   rV   rN   rI   r?   ÚidnaÚencodeÚImportErrorrW   rX   rj   r^   r&   )rt   rj   r.   Zascii_idr   r   r   Ú__init__!  s$   

þzDNS_ID.__init__r@   r   r#   r8   c                 C  s   t || jƒrt|j| jƒS dS )zC
        https://tools.ietf.org/search/rfc6125#section-6.4
        FN)r:   r-   Ú_hostname_matchesr@   rj   rw   r   r   r   r3   9  s   zDNS_ID.verifyN)rj   r|   rx   )r   r   r   r   r   r   rj   r   r\   r]   r^   rO   r-   r	   r+   rƒ   r3   r   r   r   r   r{     s   
 

r{   c                   @  s:   e Zd ZU dZejejd�Zde	d< e
ZeZdd	d
„ZdS )ÚIPAddress_IDz#
    An IP address service ID.
    )Ú	converterra   Úipr@   r   r#   r8   c                 C  s   t || jƒr| j|jkS dS )zC
        https://tools.ietf.org/search/rfc2818#section-3.1
        FN)r:   r-   r‡   r@   rw   r   r   r   r3   P  s   zIPAddress_ID.verifyNrx   )r   r   r   r   r   r   rJ   rK   r‡   r   r`   r-   r
   r+   r3   r   r   r   r   r…   C  s   
 ÿr…   c                   @  óN   e Zd ZU dZe ¡ Zded< e ¡ Zded< e	Z
eZddd	„Zddd„ZdS )ÚURI_IDz
    An URI service ID.
    rE   Úprotocolr{   Údns_idÚurir|   c                 C  sn   t |tƒsd}t|ƒ‚| ¡ }d|vst|ƒrd}t|ƒ‚| d¡\}}| d¡ t	¡| _
t| d¡ƒ| _d S )NzURI-ID must be a text string.ú:zInvalid URI-ID.rB   ú/)r:   r|   rU   rV   rN   rI   ri   r�   rW   rX   rŠ   r{   r‹   )rt   rŒ   r.   Zprotrj   r   r   r   rƒ   f  s   
zURI_ID.__init__r@   r   r#   r8   c                 C  s*   t || jƒr|j| jko| j |j¡S dS )zE
        https://tools.ietf.org/search/rfc6125#section-6.5.2
        FN)r:   r-   re   rŠ   r‹   r3   rf   rw   r   r   r   r3   u  s
   þzURI_ID.verifyN)rŒ   r|   rx   )r   r   r   r   r   r   rŠ   r   r‹   rd   r-   r   r+   rƒ   r3   r   r   r   r   r‰   Z  ó   
 
r‰   c                   @  rˆ   )ÚSRV_IDz
    An SRV service ID.
    rE   rp   r{   r‹   Úsrvr|   c                 C  s~   t |tƒsd}t|ƒ‚| ¡ }d|vst|ƒs|d dkr#d}t|ƒ‚| dd¡\}}|dd …  d¡ t	¡| _
t|ƒ| _d S )NzSRV-ID must be a text string.rS   r   Ú_zInvalid SRV-ID.r   rB   )r:   r|   rU   rV   rN   rI   ri   r�   rW   rX   rp   r{   r‹   )rt   r‘   r.   rp   rj   r   r   r   rƒ   Ž  s   
zSRV_ID.__init__r@   r   r#   r8   c                 C  s*   t || jƒr| j|jko| j |j¡S dS )zE
        https://tools.ietf.org/search/rfc6125#section-6.5.1
        FN)r:   r-   rp   rm   r‹   r3   rf   rw   r   r   r   r3   �  s
   ÿzSRV_ID.verifyN)r‘   r|   rx   )r   r   r   r   r   r   rp   r   r‹   rl   r-   r   r+   rƒ   r3   r   r   r   r   r�   ‚  r�   r�   r   rE   Úactual_hostnamec                 C  sV   d| v r'|   dd¡\}}|  dd¡\}}||krdS | d¡r!dS |d|fv S | |kS )zT
    :return: `True` if *cert_pattern* matches *actual_hostname*, else `False`.
    rT   ro   r   Fs   xn--N)ri   Ú
startswith)r   r“   Z	cert_headZ	cert_tailZactual_headZactual_tailr   r   r   r„   ©  s   
r„   ÚNonec                 C  sš   |   d¡}|dkrd| ›d�}t|ƒ‚|  d¡}t|ƒdk r(d| ›d�}t|ƒ‚d|d vr8d| ›d	�}t|ƒ‚td
d„ |D ƒƒrKd| ›d�}t|ƒ‚dS )zh
    Check whether the usage of wildcards within *cert_pattern* conforms with
    our expectations.
    rT   r   zCertificate's DNS-ID z contains too many wildcards.ro   é   z0 has too few host components for wildcard usage.r   z+ has a wildcard outside the left-most part.c                 s  s   � | ]}t |ƒ V  qd S r9   )Úlen)r%   Úpr   r   r   r=   Ì  r>   z$_validate_pattern.<locals>.<genexpr>z contains empty parts.N)Úcountr   ri   r—   r?   )r   Zcntr.   Úpartsr   r   r   rY   »  s   

þrY   s   ABCDEFGHIJKLMNOPQRSTUVWXYZs   abcdefghijklmnopqrstuvwxyz)r   r   r    r!   r"   r!   r#   r$   )r   r   r2   r!   r#   r$   )r4   r5   r6   r7   r#   r8   )r@   rA   r#   r8   )r   rE   r“   rE   r#   r8   )r   rE   r#   r•   )*r   Ú
__future__r   rJ   r\   Útypingr   r   r   r   r   Ú
exceptionsr   r	   r
   r   r   r   r   r€   r‚   Úsr   r1   r)   r,   rN   rO   r`   rd   rl   r   r   r{   r…   r‰   r�   r„   rY   rE   Ú	maketransrX   r   r   r   r   Ú<module>   sZ    $ÿ

	
.





!
ÿ

.'
&
ÿ