
    fx0                    x   d Z ddlmZ ddlZddlZddlmZmZmZm	Z	 ddl
Z
ddlmZmZmZmZmZmZmZ 	 ddlZ e
j*                  d       G d	 d
             Z	 	 	 	 	 	 	 	 d'dZ	 	 	 	 	 	 d(dZd)dZd*dZ e
j*                  d       G d d             Z e
j*                  d       G d d             Z e
j*                  d       G d d             Z e
j*                  d       G d d             Zeeeeef   Z	 e	 G d de             Z  e
j*                  dd       G d d             Z! e
j*                  d       G d d             Z" e
j*                  dd       G d d              Z# e
j*                  dd       G d! d"             Z$d+d#Z%d,d$Z&e'jQ                  d%d&      Z)y# e$ r dZY w xY w)-z
Common verification code.
    )annotationsN)ProtocolSequenceUnionruntime_checkable   )CertificateErrorDNSMismatchIPAddressMismatchMismatchSRVMismatchURIMismatchVerificationErrorT)slotsc                  j    e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   y)ServiceMatchz<
    A match of a service id and a certificate pattern.
    	ServiceID
service_idCertificatePatterncert_patternN)	__name__
__module____qualname____doc__attribr   __annotations__r        9/usr/lib/python3/dist-packages/service_identity/hazmat.pyr   r      s.     $DGGIJ	%'.twwyL$0r   r   c                   | st        d      g }t        | |      t        | |      z   }|D cg c]  }|j                   }}|D ](  }||vs|j                  |j	                  |             * |D ]?  }||vst        | |j                        s|j                  |j	                  |             A |rt        |      |S c c}w )z
    Verify whether *cert_patterns* are valid for *obligatory_ids* and
    *optional_ids*.

    *obligatory_ids* must be both present and match.  *optional_ids* must match
    if a pattern of the respective type is present.
    z3Certificate does not contain any `subjectAltName`s.)mismatched_id)errors)r	   _find_matchesr   appenderror_on_mismatch_contains_instance_ofpattern_classr   )cert_patternsobligatory_idsoptional_idsr#   matchesmatchmatched_idsis           r    verify_service_identityr0   )   s     A
 	
 FM>:]|> G 2995##9K9 @KMM!--A->?@  @
 K$91??%
 MM!--A->?@ v..N% :s   Cc                    g }|D ]7  }| D ]0  }|j                  |      s|j                  t        ||             2 9 |S )z
    Search for matching certificate patterns and service_ids.

    Args:
        service_ids: List of service IDs like DNS_ID.
    )r   r   )verifyr%   r   )r)   service_idsr,   sidcids        r    r$   r$   T   sP     G O  	OCzz#|MN	OO Nr   c                ,    t        fd| D              S )Nc              3  6   K   | ]  }t        |        y wN)
isinstance).0ecls     r    	<genexpr>z(_contains_instance_of.<locals>.<genexpr>g   s     .Qz!R .s   )any)seqr<   s    `r    r'   r'   f   s    .#...r   c                   t        | t              r	 | j                  d      } 	 t	        |        y# t        $ r Y yw xY w# t
        $ r Y nw xY w	 t        j                  | j                  dd             y# t
        $ r Y yw xY w)z
    Check whether *pattern* could be/match an IP address.

    Args:
        pattern: A pattern for a host name.

    Returns:
        `True` if *pattern* could be an IP address, else `False`.
    asciiFT*1)	r9   bytesdecodeUnicodeErrorint
ValueError	ipaddress
ip_addressreplacepatterns    r    _is_ip_addressrN   j   s     '5!	nnW-GG  		  W__S#67   s-   0 ? 	<<	A
A%A5 5	B Bc                  t    e Zd ZU dZ ej
                         Zded<    ej                  d      Z
edd       Zy)
DNSPatternz7
    A DNS pattern as extracted from certificates.
    rD   rM      ^[a-z0-9\-_.]+$c                    t        |t              st        d      |j                         }|dk(  st	        |      sd|v rt        d|d      |j                  t              }d|v rt        |        | |      S )Nz'The DNS pattern must be a bytes string.r       zInvalid DNS pattern .   *rL   )	r9   rD   	TypeErrorstriprN   r	   	translate_TRANS_TO_LOWER_validate_pattern)clsrM   s     r    
from_byteszDNSPattern.from_bytes   sw    '5)EFF--/c>^G48H"%9'A#FGG##O47?g&7##r   N)rM   rD   returnrP   )r   r   r   r   r   r   rM   r   recompile_RE_LEGAL_CHARSclassmethodr\   r   r   r    rP   rP      s>    
 TWWYGU bjj!45O$ $r   rP   c                  P    e Zd ZU dZ ej
                         Zded<   edd       Z	y)IPAddressPatternz?
    An IP address pattern as extracted from certificates.
    -ipaddress.IPv4Address | ipaddress.IPv6AddressrM   c                v    	  | t        j                  |            S # t        $ r t        d|d      d w xY w)NrL   zInvalid IP address pattern rT   )rI   rJ   rH   r	   )r[   bss     r    r\   zIPAddressPattern.from_bytes   sH    	y33B788 	"-bV15	s    8N)rf   rD   r]   rc   )
r   r   r   r   r   r   rM   r   ra   r\   r   r   r    rc   rc      s/    
 >ETWWYG:F r   rc   c                  |    e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   e	dd       Z
y)	
URIPatternz8
    An URI pattern as extracted from certificates.
    rD   protocol_patternrP   dns_patternc                $   t        |t              st        d      |j                         j	                  t
              }d|vsd|v st        |      rt        d|d      |j                  d      \  }} | |t        j                  |            S )Nz'The URI pattern must be a bytes string.   :rU   zInvalid URI pattern rT   )ri   rj   r9   rD   rV   rW   rX   rY   rN   r	   splitrP   r\   )r[   rM   ri   hostnames       r    r\   zURIPattern.from_bytes   s    '5)EFF--/++O<w$'/^G5L"%9'A#FGG%,]]4%8"(-"--h7
 	
r   N)rM   rD   r]   rh   )r   r   r   r   r   r   ri   r   rj   ra   r\   r   r   r    rh   rh      s@    
 &dggie'%dggiK'
 
r   rh   c                  |    e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   e	dd       Z
y)	
SRVPatternz8
    An SRV pattern as extracted from certificates.
    rD   name_patternrP   rj   c                <   t        |t              st        d      |j                         j	                  t
              }|d   dk7  sd|vsd|v st        |      rt        d|d      |j                  dd      \  }} | |dd  t        j                  |      	      S )
Nz'The SRV pattern must be a bytes string.r   _      .rU   zInvalid SRV pattern rT   r   )rr   rj   rm   )r[   rM   namero   s       r    r\   zSRVPattern.from_bytes   s    '5)EFF--/++O< AJ'!7"wg&"%9'A#FGG tQ/habz/D/DX/N
 	
r   N)rM   rD   r]   rq   )r   r   r   r   r   r   rr   r   rj   ra   r\   r   r   r    rq   rq      s?    
 "$'')L%#%dggiK'
 
r   rq   c                  8    e Zd Zedd       Zedd       ZddZy)r   c                     y r8   r   selfs    r    r(   zServiceID.pattern_class       r   c                     y r8   r   ry   s    r    r&   zServiceID.error_on_mismatch  r{   r   c                     y r8   r   rz   rM   s     r    r2   zServiceID.verify  s    r   N)r]   ztype[CertificatePattern])r]   ztype[Mismatch]rM   r   r]   bool)r   r   r   propertyr(   r&   r2   r   r   r    r   r      s-       r   r   F)initr   c                  z    e Zd ZU dZ ej
                         Zded<    ej                  d      Z
eZeZddZd	dZy)
DNS_IDz)
    A DNS service ID, aka hostname.
    rD   ro   rQ   c                   t        |t              st        d      |j                         }|rt	        |      rt        d      t        d |D              r't        rt        j                  |      }nt        d      |j                  d      }|j                  t              | _        | j                  j                  | j                        t        d      y )NzDNS-ID must be a text string.zInvalid DNS-ID.c              3  8   K   | ]  }t        |      d kD    yw)   N)ord)r:   cs     r    r=   z"DNS_ID.__init__.<locals>.<genexpr>   s     .s1v|.s   z+idna library is required for non-ASCII IDs.rA   )r9   strrV   rW   rN   rH   r>   idnaencodeImportErrorrX   rY   ro   r`   r-   )rz   ro   ascii_ids      r    __init__zDNS_ID.__init__  s    (C(;<<>>#>(3.//.X..;;x0!A   w/H **?;%%dmm4<.// =r   c                p    t        || j                        r t        |j                  | j                        S y)zC
        https://tools.ietf.org/search/rfc6125#section-6.4
        F)r9   r(   _hostname_matchesrM   ro   r~   s     r    r2   zDNS_ID.verify.  s,     gt112$W__dmmDDr   N)ro   r   r   )r   r   r   r   r   r   ro   r   r^   r_   r`   rP   r(   r
   r&   r   r2   r   r   r    r   r     sC     dggiHe !bjj!45OM#0,r   r   c                  f    e Zd ZU dZ ej
                  ej                        Zde	d<   e
ZeZddZy)IPAddress_IDz#
    An IP address service ID.
    )	converterrd   ipc                b    t        || j                        r| j                  |j                  k(  S y)zC
        https://tools.ietf.org/search/rfc2818#section-3.1
        F)r9   r(   r   rM   r~   s     r    r2   zIPAddress_ID.verifyE  s*     gt11277goo--r   Nr   )r   r   r   r   r   r   rI   rJ   r   r   rc   r(   r   r&   r2   r   r   r    r   r   8  s=     9@&&9B5  %M)r   r   c                      e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   e	Z
eZd	dZd
dZy)URI_IDz
    An URI service ID.
    rD   protocolr   dns_idc                F   t        |t              st        d      |j                         }d|vst	        |      rt        d      |j                  d      \  }}|j                  d      j                  t              | _
        t        |j                  d            | _        y )NzURI-ID must be a text string.:zInvalid URI-ID.rA   /)r9   r   rV   rW   rN   rH   rn   r   rX   rY   r   r   r   )rz   uriprotro   s       r    r   zURI_ID.__init__[  s~    #s#;<<iikc>^C0.//3hG,66GX^^C01r   c                    t        || j                        r@|j                  | j                  k(  xr% | j                  j                  |j                        S y)zE
        https://tools.ietf.org/search/rfc6125#section-6.5.2
        F)r9   r(   ri   r   r   r2   rj   r~   s     r    r2   zURI_ID.verifyh  sM     gt112((DMM9 <KK&&w':':;
 r   N)r   r   r   )r   r   r   r   r   r   r   r   r   rh   r(   r   r&   r   r2   r   r   r    r   r   O  sB     dggiHeTWWYFFM#2
r   r   c                      e Zd ZU dZ ej
                         Zded<    ej
                         Zded<   e	Z
eZd	dZd
dZy)SRV_IDz
    An SRV service ID.
    rD   rv   r   r   c                @   t        |t              st        d      |j                         }d|vst	        |      s|d   dk7  rt        d      |j                  dd      \  }}|dd  j                  d      j                  t              | _
        t        |      | _        y )NzSRV-ID must be a text string.rT   r   _zInvalid SRV-ID.r   rA   )r9   r   rV   rW   rN   rH   rn   r   rX   rY   rv   r   r   )rz   srvrv   ro   s       r    r   zSRV_ID.__init__  s    #s#;<<iikc>^C0CFcM.//3*hHOOG,66G	X&r   c                    t        || j                        r@| j                  |j                  k(  xr% | j                  j                  |j                        S y)zE
        https://tools.ietf.org/search/rfc6125#section-6.5.1
        F)r9   r(   rv   rr   r   r2   rj   r~   s     r    r2   zSRV_ID.verify  sO     gt11299 4 44 9K9K##:  r   N)r   r   r   )r   r   r   r   r   r   rv   r   r   rq   r(   r   r&   r   r2   r   r   r    r   r   u  sB     $'')D%TWWYFFM#'	r   r   c                    d| v rN| j                  dd      \  }}|j                  dd      \  }}||k7  ry|j                  d      ry|dk(  xs ||k(  S | |k(  S )zT
    :return: `True` if *cert_pattern* matches *actual_hostname*, else `False`.
    rU   ru   r   Fs   xn--)rn   
startswith)r   actual_hostname	cert_head	cert_tailactual_headactual_tails         r    r   r     sv     |+11$:	9#2#8#8q#A [#!!'*D <I$<<?**r   c                .   | j                  d      }|dkD  rt        d| d      | j                  d      }t        |      dk  rt        d| d      d|d   vrt        d	j	                  |             t        d
 |D              rt        d| d      y)zh
    Check whether the usage of wildcards within *cert_pattern* conforms with
    our expectations.
    rU   r   zCertificate's DNS-ID z contains too many wildcards.ru      z0 has too few host components for wildcard usage.r   zDCertificate's DNS-ID {!r} has a wildcard outside the left-most part.c              3  4   K   | ]  }t        |         y wr8   )len)r:   ps     r    r=   z$_validate_pattern.<locals>.<genexpr>  s     
%!s1v:
%s   z contains empty parts.N)countr	   rn   r   formatr>   )r   cntpartss      r    rZ   rZ     s    
 

T
"C
Qw#L#33PQ
 	
 t$E
5zA~#L#3 4 
 	

 58F<(
 	
 
%u
%%#L#33IJ
 	
 &r   s   ABCDEFGHIJKLMNOPQRSTUVWXYZs   abcdefghijklmnopqrstuvwxyz)r)   Sequence[CertificatePattern]r*   Sequence[ServiceID]r+   r   r]   list[ServiceMatch])r)   r   r3   r   r]   r   )r?   zSequence[object]r<   typer]   r   )rM   zstr | bytesr]   r   )r   rD   r   rD   r]   r   )r   rD   r]   None)*r   
__future__r   rI   r^   typingr   r   r   r   r   
exceptionsr	   r
   r   r   r   r   r   r   r   sr   r0   r$   r'   rN   rP   rc   rh   rq   r   r   r   r   r   r   r   rZ   rD   	maketransrY   r   r   r    <module>r      sF   #  	 ? ?   
 d1 1 1(/('( &( 	(V/$ $/< d$ $ $6 d  $ d
 
 
8 d
 
 
> 
J(88  
 
 
 U$) )  )X d  , U$" "  "J U$! !  !H+$
: //!#@]  Ds   F. .F98F9