o
    >h1                     @  s  d Z ddlmZ ddlZddlZddlmZmZmZm	Z	 ddl
Z
ddlmZmZmZmZmZmZmZ zddlZW n eyC   dZY nw e
jddG d	d
 d
Zd@ddZdAddZdBddZdCd d!Ze
jddG d"d# d#Ze
jddG d$d% d%Ze
jddG d&d' d'Ze
jddG d(d) d)Zeeeeef Z	 e	G d*d+ d+eZ e
jd,dd-G d.d/ d/Z!e
jddG d0d1 d1Z"e
jd,dd-G d2d3 d3Z#e
jd,dd-G d4d5 d5Z$dDd9d:Z%dEd<d=Z&e'(d>d?Z)dS )Fz
Common verification code.
    )annotationsN)ProtocolSequenceUnionruntime_checkable   )CertificateErrorDNSMismatchIPAddressMismatchMismatchSRVMismatchURIMismatchVerificationErrorT)slotsc                   @  s2   e Zd ZU dZe Zded< e Zded< dS )ServiceMatchz<
    A match of a service id and a certificate pattern.
    	ServiceID
service_idCertificatePatterncert_patternN)	__name__
__module____qualname____doc__attribr   __annotations__r    r   r   w/var/www/vedio/testing/chatpythonscript.ninositsolution.com/env/lib/python3.10/site-packages/service_identity/hazmat.pyr      s   
 r   cert_patternsSequence[CertificatePattern]obligatory_idsSequence[ServiceID]optional_idsreturnlist[ServiceMatch]c                 C  s   | sd}t |g }t| |t| | }dd |D }|D ]}||vr,||j|d q|D ]}||vrDt| |jrD||j|d q/|rLt|d|S )z
    Verify whether *cert_patterns* are valid for *obligatory_ids* and
    *optional_ids*.

    *obligatory_ids* must be both present and match.  *optional_ids* must match
    if a pattern of the respective type is present.
    z3Certificate does not contain any `subjectAltName`s.c                 S  s   g | ]}|j qS r   )r   ).0matchr   r   r   
<listcomp>>   s    z+verify_service_identity.<locals>.<listcomp>)mismatched_id)errors)r   _find_matchesappenderror_on_mismatch_contains_instance_ofpattern_classr   )r   r    r"   msgr)   matchesmatched_idsir   r   r   verify_service_identity)   s2   




r3   service_idsc                 C  s8   g }|D ]}| D ]}| |r|t||d qq|S )z
    Search for matching certificate patterns and service_ids.

    Args:
        service_ids: List of service IDs like DNS_ID.
    )r   r   )verifyr+   r   )r   r4   r0   sidcidr   r   r   r*   W   s   


r*   seqSequence[object]cltypeboolc                   s   t  fdd| D S )Nc                 3  s    | ]}t | V  qd S N)
isinstance)r%   er:   r   r   	<genexpr>m       z(_contains_instance_of.<locals>.<genexpr>)any)r8   r:   r   r@   r   r-   l   s   r-   patternstr | bytesc                 C  s~   t | trz| d} W n
 ty   Y dS w zt|  W dS  ty'   Y nw zt| dd W dS  ty>   Y dS w )z
    Check whether *pattern* could be/match an IP address.

    Args:
        pattern: A pattern for a host name.

    Returns:
        `True` if *pattern* could be an IP address, else `False`.
    asciiFT*1)	r>   bytesdecodeUnicodeErrorint
ValueError	ipaddress
ip_addressreplacerD   r   r   r   _is_ip_addressp   s$   


rR   c                   @  s:   e Zd ZU dZe Zded< e	dZ
ed	ddZdS )

DNSPatternz7
    A DNS pattern as extracted from certificates.
    rI   rD      ^[a-z0-9\-_.]+$r#   c                 C  sn   t |tsd}t|| }|dkst|sd|v r%d|d}t||t}d|v r2t| | |dS )Nz'The DNS pattern must be a bytes string.        zInvalid DNS pattern .   *rQ   )	r>   rI   	TypeErrorstriprR   r   	translate_TRANS_TO_LOWER_validate_pattern)clsrD   r/   r   r   r   
from_bytes   s   


zDNSPattern.from_bytesN)rD   rI   r#   rS   )r   r   r   r   r   r   rD   r   recompile_RE_LEGAL_CHARSclassmethodr_   r   r   r   r   rS      s   
 
rS   c                   @  s0   e Zd ZU dZe Zded< ed
ddZ	d	S )IPAddressPatternz?
    An IP address pattern as extracted from certificates.
    -ipaddress.IPv4Address | ipaddress.IPv6AddressrD   bsrI   r#   c                 C  s8   z	| t |dW S  ty   d|d}t|d w )NrQ   zInvalid IP address pattern rW   )rN   rO   rM   r   )r^   rf   r/   r   r   r   r_      s   
zIPAddressPattern.from_bytesN)rf   rI   r#   rd   )
r   r   r   r   r   r   rD   r   rc   r_   r   r   r   r   rd      s
   
 rd   c                   @  @   e Zd ZU dZe Zded< e Zded< e	ddd	Z
d
S )
URIPatternz8
    An URI pattern as extracted from certificates.
    rI   protocol_patternrS   dns_patternrD   r#   c                 C  sp   t |tsd}t|| t}d|vsd|v st|r(d|d}t||d\}}| |t	
|dS )Nz'The URI pattern must be a bytes string.   :rX   zInvalid URI pattern rW   )ri   rj   r>   rI   rY   rZ   r[   r\   rR   r   splitrS   r_   )r^   rD   r/   ri   hostnamer   r   r   r_      s   
zURIPattern.from_bytesN)rD   rI   r#   rh   )r   r   r   r   r   r   ri   r   rj   rc   r_   r   r   r   r   rh         
 rh   c                   @  rg   )
SRVPatternz8
    An SRV pattern as extracted from certificates.
    rI   name_patternrS   rj   rD   r#   c                 C  s   t |tsd}t|| t}|d dks$d|vs$d|v s$t|r.d|d}t||dd\}}| |dd  t	
|d	S )
Nz'The SRV pattern must be a bytes string.r   _      .rX   zInvalid SRV pattern rW   r   )rq   rj   rl   )r^   rD   r/   namern   r   r   r   r_      s   
zSRVPattern.from_bytesN)rD   rI   r#   rp   )r   r   r   r   r   r   rq   r   rj   rc   r_   r   r   r   r   rp      ro   rp   c                   @  s2   e Zd ZedddZedddZdddZdS )r   r#   type[CertificatePattern]c                 C     d S r=   r   selfr   r   r   r.        zServiceID.pattern_classtype[Mismatch]c                 C  rv   r=   r   rw   r   r   r   r,     ry   zServiceID.error_on_mismatchrD   r   r<   c                 C  rv   r=   r   rx   rD   r   r   r   r5     s    zServiceID.verifyN)r#   ru   )r#   rz   rD   r   r#   r<   )r   r   r   propertyr.   r,   r5   r   r   r   r   r   	  s    r   F)initr   c                   @  sH   e Zd ZU dZe Zded< e	dZ
eZeZdddZdddZdS )DNS_IDz)
    A DNS service ID, aka hostname.
    rI   rn   rT   strc                 C  s   t |tsd}t|| }|rt|rd}t|tdd |D r2tr,t|}nd}t	||d}|
t| _| j| jd u rLd}t|d S )NzDNS-ID must be a text string.zInvalid DNS-ID.c                 s  s    | ]	}t |d kV  qdS )   N)ord)r%   cr   r   r   rA   +  s    z"DNS_ID.__init__.<locals>.<genexpr>z+idna library is required for non-ASCII IDs.rF   )r>   r   rY   rZ   rR   rM   rC   idnaencodeImportErrorr[   r\   rn   rb   r&   )rx   rn   r/   ascii_idr   r   r   __init__!  s$   

zDNS_ID.__init__rD   r   r#   r<   c                 C  s   t || jrt|j| jS dS )zC
        https://tools.ietf.org/search/rfc6125#section-6.4
        F)r>   r.   _hostname_matchesrD   rn   r{   r   r   r   r5   9  s   zDNS_ID.verifyN)rn   r   r|   )r   r   r   r   r   r   rn   r   r`   ra   rb   rS   r.   r	   r,   r   r5   r   r   r   r   r     s   
 

r   c                   @  s:   e Zd ZU dZejejdZde	d< e
ZeZdd	d
ZdS )IPAddress_IDz#
    An IP address service ID.
    )	converterre   iprD   r   r#   r<   c                 C  s   t || jr| j|jkS dS )zC
        https://tools.ietf.org/search/rfc2818#section-3.1
        F)r>   r.   r   rD   r{   r   r   r   r5   P  s   zIPAddress_ID.verifyNr|   )r   r   r   r   r   r   rN   rO   r   r   rd   r.   r
   r,   r5   r   r   r   r   r   C  s   
 r   c                   @  N   e Zd ZU dZe Zded< e Zded< e	Z
eZddd	ZdddZdS )URI_IDz
    An URI service ID.
    rI   protocolr   dns_idurir   c                 C  sn   t |tsd}t|| }d|vst|rd}t||d\}}|dt	| _
t|d| _d S )NzURI-ID must be a text string.:zInvalid URI-ID.rF   /)r>   r   rY   rZ   rR   rM   rm   r   r[   r\   r   r   r   )rx   r   r/   protrn   r   r   r   r   f  s   
zURI_ID.__init__rD   r   r#   r<   c                 C  s*   t || jr|j| jko| j|jS dS )zE
        https://tools.ietf.org/search/rfc6125#section-6.5.2
        F)r>   r.   ri   r   r   r5   rj   r{   r   r   r   r5   u  s
   zURI_ID.verifyN)r   r   r|   )r   r   r   r   r   r   r   r   r   rh   r.   r   r,   r   r5   r   r   r   r   r   Z     
 
r   c                   @  r   )SRV_IDz
    An SRV service ID.
    rI   rt   r   r   srvr   c                 C  s~   t |tsd}t|| }d|vst|s|d dkr#d}t||dd\}}|dd  dt	| _
t|| _d S )NzSRV-ID must be a text string.rW   r   _zInvalid SRV-ID.r   rF   )r>   r   rY   rZ   rR   rM   rm   r   r[   r\   rt   r   r   )rx   r   r/   rt   rn   r   r   r   r     s   
zSRV_ID.__init__rD   r   r#   r<   c                 C  s*   t || jr| j|jko| j|jS dS )zE
        https://tools.ietf.org/search/rfc6125#section-6.5.1
        F)r>   r.   rt   rq   r   r5   rj   r{   r   r   r   r5     s
   zSRV_ID.verifyN)r   r   r|   )r   r   r   r   r   r   rt   r   r   rp   r.   r   r,   r   r5   r   r   r   r   r     r   r   r   rI   actual_hostnamec                 C  sV   d| v r'|  dd\}}| dd\}}||krdS |dr!dS |d|fv S | |kS )zT
    :return: `True` if *cert_pattern* matches *actual_hostname*, else `False`.
    rX   rs   r   Fs   xn--)rm   
startswith)r   r   	cert_head	cert_tailactual_headactual_tailr   r   r   r     s   
r   Nonec                 C  s   |  d}|dkrd| d}t|| d}t|dk r(d| d}t|d|d vr8d| d	}t|td
d |D rKd| d}t|dS )zh
    Check whether the usage of wildcards within *cert_pattern* conforms with
    our expectations.
    rX   r   zCertificate's DNS-ID z contains too many wildcards.rs      z0 has too few host components for wildcard usage.r   z+ has a wildcard outside the left-most part.c                 s  s    | ]}t | V  qd S r=   )len)r%   pr   r   r   rA     rB   z$_validate_pattern.<locals>.<genexpr>z contains empty parts.N)countr   rm   r   rC   )r   cntr/   partsr   r   r   r]     s   

r]   s   ABCDEFGHIJKLMNOPQRSTUVWXYZs   abcdefghijklmnopqrstuvwxyz)r   r   r    r!   r"   r!   r#   r$   )r   r   r4   r!   r#   r$   )r8   r9   r:   r;   r#   r<   )rD   rE   r#   r<   )r   rI   r   rI   r#   r<   )r   rI   r#   r   )*r   
__future__r   rN   r`   typingr   r   r   r   r   
exceptionsr   r	   r
   r   r   r   r   r   r   sr   r3   r*   r-   rR   rS   rd   rh   rp   r   r   r   r   r   r   r   r]   rI   	maketransr\   r   r   r   r   <module>   sZ    $

	
.





!


.'
&
