
    #aq                         d Z ddlmZmZmZ ddlZddlmZmZm	Z	m
Z
mZmZmZ ddlmZ ddlmZ ddlmZ dd	lmZmZmZmZmZmZmZmZ dd
lmZ dgZd Z d Z! ed          Z"d Z#dS )zL
`cryptography.x509 <https://github.com/pyca/cryptography>`_-specific code.
    )absolute_importdivisionprint_functionN)DNSNameExtensionOID	IPAddressNameOIDObjectIdentifier	OtherNameUniformResourceIdentifier)ExtensionNotFound)decode)	IA5String   )DNS_IDCertificateError
DNSPatternIPAddress_IDIPAddressPattern
SRVPattern
URIPatternverify_service_identity)SubjectAltNameWarningverify_certificate_hostnamec                 `    t          t          |           t          |          gg            dS )a  
    Verify whether *certificate* is valid for *hostname*.

    .. note:: Nothing is verified about the *authority* of the certificate;
       the caller must verify that the certificate chains to an appropriate
       trust root themselves.

    :param cryptography.x509.Certificate certificate: A cryptography X509
        certificate object.
    :param unicode hostname: The hostname that *certificate* should be valid
        for.

    :raises service_identity.VerificationError: If *certificate* is not valid
        for *hostname*.
    :raises service_identity.CertificateError: If *certificate* contains
        invalid/unexpected data.

    :returns: ``None``
    cert_patternsobligatory_idsoptional_idsN)r   extract_idsr   )certificatehostnames     =lib/python3.11/site-packages/service_identity/cryptography.pyr   r   &   sA    ( !+..x(()         c                 `    t          t          |           t          |          gg            dS )a  
    Verify whether *certificate* is valid for *ip_address*.

    .. note:: Nothing is verified about the *authority* of the certificate;
       the caller must verify that the certificate chains to an appropriate
       trust root themselves.

    :param cryptography.x509.Certificate certificate: A cryptography X509
        certificate object.
    :param unicode ip_address: The IP address that *connection* should be valid
        for.  Can be an IPv4 or IPv6 address.

    :raises service_identity.VerificationError: If *certificate* is not valid
        for *ip_address*.
    :raises service_identity.CertificateError: If *certificate* contains
        invalid/unexpected data.

    :returns: ``None``

    .. versionadded:: 18.1.0
    r   N)r   r    r   )r!   
ip_addresss     r#   verify_certificate_ip_addressr'   A   sA    , !+..$Z001     r$   z1.3.6.1.5.5.7.8.7c                 .   g }	 | j                             t          j                  }|                    d |j                            t                    D                        |                    d |j                            t                    D                        |                    d |j                            t                    D                        |j                            t                    D ]}|j        t          k    rpt          |j                  \  }}t          |t                    r5|                    t#          |                                                     st'          d          n# t(          $ r Y nw xY w|sd | j                            t.          j                  D             }t3          t5          |          d          }d |D             }t7          j        d                    |          t<                     |S )	a  
    Extract all valid IDs from a certificate for service verification.

    If *cert* doesn't contain any identifiers, the ``CN``s are used as DNS-IDs
    as fallback.

    :param cryptography.x509.Certificate cert: The certificate to be dissected.

    :return: List of IDs.
    c                 R    g | ]$}t          |                    d                     %S zutf-8r   encode).0names     r#   
<listcomp>zextract_ids.<locals>.<listcomp>u   s<        4;;w//00  r$   c                 R    g | ]$}t          |                    d                     %S r*   )r   r,   )r-   uris     r#   r/   zextract_ids.<locals>.<listcomp>{   s<        3::g..//  r$   c                 ,    g | ]}t          |          S  )r   )r-   ips     r#   r/   zextract_ids.<locals>.<listcomp>   s0        !$$  r$   zUnexpected certificate content.c                     g | ]	}|j         
S r3   )valuer-   ns     r#   r/   zextract_ids.<locals>.<listcomp>   s*     
 
 
 G
 
 
r$   s   <not given>c                 R    g | ]$}t          |                    d                     %S r*   r+   r7   s     r#   r/   zextract_ids.<locals>.<listcomp>   s,    :::z!((7++,,:::r$   zCertificate with CN {!r} has no `subjectAltName`, falling back to check for a `commonName` for now.  This feature is being removed by major browsers and deprecated by RFC 2818.)
extensionsget_extension_for_oidr   SUBJECT_ALTERNATIVE_NAMEextendr6   get_values_for_typer   r   r   r   type_idID_ON_DNS_SRVr   
isinstancer   appendr   asOctetsr   r   subjectget_attributes_for_oidr	   COMMON_NAMEnextiterwarningswarnformatr   )certidsextothersrv_cnscns           r#   r    r    a   sH    C!No331
 
 	

 I99'BB  	
 	
 	
 	

 988-   	
 	
 	
 	

 )77	BB  	
 	
 	
 Y229== 	N 	NE}--,,Qc9-- NJJz#,,..99::::*+LMMM .	N/    >  


 
\889LMM
 
 
 $s))^,,::c:::DDJF2JJ!		
 	
 	
 Js   $E? ?
FF)$__doc__
__future__r   r   r   rI   cryptography.x509r   r   r   r	   r
   r   r   cryptography.x509.extensionsr   pyasn1.codec.der.decoderr   pyasn1.type.charr   _commonr   r   r   r   r   r   r   r   
exceptionsr   __all__r   r'   r@   r    r3   r$   r#   <module>r]      s    A @ @ @ @ @ @ @ @ @                   ; : : : : : + + + + + + & & & & & &	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 . - - - - - )
)  6  : ! !455@ @ @ @ @r$   