tfdZddlmZddlZddlmZddlmZmZm Z m Z m Z m Z m Z ddlmZddlmZddlmZd d lmZd d lmZmZmZmZmZmZmZmZd gZddZ ddZ!e dZ"ddZ#ddZ$dS)zL `cryptography.x509 `_-specific code. ) annotationsN)Sequence) CertificateDNSName ExtensionOID IPAddressObjectIdentifier OtherNameUniformResourceIdentifier)ExtensionNotFound)decode) IA5String)CertificateError)DNS_IDCertificatePattern DNSPattern IPAddress_IDIPAddressPattern SRVPattern URIPatternverify_service_identityverify_certificate_hostname certificaterhostnamestrreturnNonec`tt|t|ggdS)a Verify whether *certificate* is valid for *hostname*. .. note:: Nothing is verified about the *authority* of the certificate; the caller must verify that the certificate chains to an appropriate trust root themselves. Args: certificate: A *cryptography* X509 certificate object. hostname: The hostname that *certificate* should be valid for. Raises: service_identity.VerificationError: If *certificate* is not valid for *hostname*. service_identity.CertificateError: If *certificate* contains invalid / unexpected data. This includes the case where the certificate contains no `subjectAltName`\ s. .. versionchanged:: 24.1.0 :exc:`~service_identity.CertificateError` is raised if the certificate contains no ``subjectAltName``\ s instead of :exc:`~service_identity.VerificationError`.  cert_patternsobligatory_ids optional_idsN)rextract_patternsr)rrs \/var/www/surfInsights/venv3-11/lib/python3.11/site-packages/service_identity/cryptography.pyrr(sA:&{33x(() ip_addressc`tt|t|ggdS)a Verify whether *certificate* is valid for *ip_address*. .. note:: Nothing is verified about the *authority* of the certificate; the caller must verify that the certificate chains to an appropriate trust root themselves. Args: certificate: A *cryptography* X509 certificate object. ip_address: The IP address that *connection* should be valid for. Can be an IPv4 or IPv6 address. Raises: service_identity.VerificationError: If *certificate* is not valid for *ip_address*. service_identity.CertificateError: If *certificate* contains invalid / unexpected data. This includes the case where the certificate contains no ``subjectAltName``\ s. .. versionadded:: 18.1.0 .. versionchanged:: 24.1.0 :exc:`~service_identity.CertificateError` is raised if the certificate contains no ``subjectAltName``\ s instead of :exc:`~service_identity.VerificationError`. r N)rr$r)rr's r%verify_certificate_ip_addressr)LsBB&{33$Z001r&z1.3.6.1.5.5.7.8.7certSequence[CertificatePattern]c,g} |jtj}|d|jtD|d|jtD|d|jtD|jtD]}|j tkrut|j\}}t|tr:|t#j|xt)dn#t*$rYnwxYw|S)a  Extract all valid ID patterns from a certificate for service verification. Args: cert: The certificate to be dissected. Returns: List of IDs. .. versionchanged:: 23.1.0 ``commonName`` is not used as a fallback anymore. c\g|])}tj|d*Szutf-8)r from_bytesencode).0names r% z$extract_patterns..s?   %dkk'&:&:;;   r&c\g|])}tj|d*Sr.)rr/r0)r1uris r%r3z$extract_patterns..s?   %cjj&9&9::   r&c,g|]}t|S)r)r1ips r%r3z$extract_patterns..s0   !$$   r&zUnexpected certificate content.) extensionsget_extension_for_oidrSUBJECT_ALTERNATIVE_NAMEextendvalueget_values_for_typerr rr type_id ID_ON_DNS_SRVr isinstancerappendrr/asOctetsrr )r*idsextothersrv_s r%r$r$ws%'C!No33  1     I99'BB        988-         )77 BB      Y229== N NE} -- ,,Qc9--NJJz4S\\^^DDEEEE*+LMMM . N/      > Js$F FFcXtjtddt|S)zm Deprecated and never public API. Use :func:`extract_patterns` instead. .. deprecated:: 23.1.0 z?`extract_ids()` is deprecated, please use `extract_patterns()`.)categorymessage stacklevel)warningswarnDeprecationWarningr$)r*s r% extract_idsrQs6  M#Q D ! !!r&)rrrrrr)rrr'rrr)r*rrr+)%__doc__ __future__rrNtypingrcryptography.x509rrrrr r r cryptography.x509.extensionsr pyasn1.codec.der.decoderr pyasn1.type.charr exceptionsrhazmatrrrrrrrr__all__rr)r@r$rQr7r&r%r\s#""""";:::::++++++&&&&&&((((((                     ) )!!!!H%%%%P! !455 1111h " " " " " "r&