Ë
    Õ¦ex0  ã                  óx  — d Z ddlmZ ddlZddlZddlmZmZmZm	Z	 ddl
Z
ddlmZmZmZmZmZmZmZ 	 ddlZ e
j*                  d¬«       G d	„ d
«      «       Z	 	 	 	 	 	 	 	 d'd„Z	 	 	 	 	 	 d(d„Zd)d„Zd*d„Z e
j*                  d¬«       G d„ d«      «       Z e
j*                  d¬«       G d„ d«      «       Z e
j*                  d¬«       G d„ d«      «       Z e
j*                  d¬«       G d„ d«      «       Zeeeeef   Z	 e	 G d„ de«      «       Z  e
j*                  dd¬«       G d„ d«      «       Z! e
j*                  d¬«       G d„ d«      «       Z" e
j*                  dd¬«       G d„ d «      «       Z# e
j*                  dd¬«       G d!„ d"«      «       Z$d+d#„Z%d,d$„Z&e'jQ                  d%d&«      Z)y# e$ r dZY �Œ€w xY w)-z
Common verification code.
é    )ÚannotationsN)ÚProtocolÚSequenceÚUnionÚruntime_checkableé   )ÚCertificateErrorÚDNSMismatchÚIPAddressMismatchÚMismatchÚSRVMismatchÚURIMismatchÚVerificationErrorT)Úslotsc                  ój   — e Zd ZU dZ ej
                  «       Zded<    ej
                  «       Zded<   y)ÚServiceMatchz<
    A match of a service id and a certificate pattern.
    Ú	ServiceIDÚ
service_idÚCertificatePatternÚcert_patternN)	Ú__name__Ú
__module__Ú__qualname__Ú__doc__ÚattrÚibr   Ú__annotations__r   © ó    ú9/usr/lib/python3/dist-packages/service_identity/hazmat.pyr   r      s.   … ñð $˜DŸG™G›I€J�	Ó%Ø'. t§w¡w£y€LÐ$Ô0r   r   c                ó�  — | st        d«      ‚g }t        | |«      t        | |«      z   }|D �cg c]  }|j                  ‘Œ }}|D ](  }||vsŒ|j                  |j	                  |¬«      «       Œ* |D ]?  }||vsŒt        | |j                  «      sŒ|j                  |j	                  |¬«      «       ŒA |rt        |¬«      ‚|S c c}w )zä
    Verify whether *cert_patterns* are valid for *obligatory_ids* and
    *optional_ids*.

    *obligatory_ids* must be both present and match.  *optional_ids* must match
    if a pattern of the respective type is present.
    z3Certificate does not contain any `subjectAltName`s.)Úmismatched_id)Úerrors)r	   Ú_find_matchesr   ÚappendÚerror_on_mismatchÚ_contains_instance_ofÚpattern_classr   )Úcert_patternsÚobligatory_idsÚoptional_idsr#   ÚmatchesÚmatchÚmatched_idsÚis           r    Úverify_service_identityr0   )   sí   € ñ ÜØAó
ð 	
ð €FÜ˜M¨>Ó:¼]Ø�|ó>ñ €Gð 29Ö9¨�5×#Ó#Ð9€KÐ9Øò @ˆØ�KÒØ�M‰M˜!×-Ñ-¸AÐ-Ó>Õ?ð@ð ò @ˆð
 �KÒÔ$9Ø˜1Ÿ?™?õ%
ð �M‰M˜!×-Ñ-¸AÐ-Ó>Õ?ð@ñ Ü vÔ.Ð.à€Nùò% :s   ­Cc                ó‚   — g }|D ]7  }| D ]0  }|j                  |«      sŒ|j                  t        ||¬«      «       Œ2 Œ9 |S )z„
    Search for matching certificate patterns and service_ids.

    Args:
        service_ids: List of service IDs like DNS_ID.
    )r   r   )Úverifyr%   r   )r)   Úservice_idsr,   ÚsidÚcids        r    r$   r$   T   sP   € ð €GØò OˆØ ò 	OˆCØ�z‰z˜#�Ø—‘œ|¸ÈÔMÕNñ	OðOð €Nr   c                ó,   ‡— t        ˆfd„| D «       «      S )Nc              3  ó6   •K  — | ]  }t        |‰«      –— Œ y ­w©N)Ú
isinstance)Ú.0ÚeÚcls     €r    ú	<genexpr>z(_contains_instance_of.<locals>.<genexpr>g   s   øè ø€ Ò. QŒz˜!˜R× Ñ.ùs   ƒ)Úany)Úseqr<   s    `r    r'   r'   f   s   ø€ ÜÓ.¨#Ô.Ó.Ð.r   c                ó  — t        | t        «      r	 | j                  d«      } 	 t	        | «       y# t        $ r Y yw xY w# t
        $ r Y nw xY w	 t        j                  | j                  dd«      «       y# t
        $ r Y yw xY w)zÆ
    Check whether *pattern* could be/match an IP address.

    Args:
        pattern: A pattern for a host name.

    Returns:
        `True` if *pattern* could be an IP address, else `False`.
    ÚasciiFTÚ*Ú1)	r9   ÚbytesÚdecodeÚUnicodeErrorÚintÚ
ValueErrorÚ	ipaddressÚ
ip_addressÚreplace©Úpatterns    r    Ú_is_ip_addressrN   j   sŽ   € ô �'œ5Ô!ð	Ø—n‘n WÓ-ˆGðÜˆGŒØøô ò 	Ùð	ûô ò ÙðúðÜ×Ñ˜WŸ_™_¨S°#Ó6Ô7ð øô ò Ùðús-   ’0 ¤? °	<»<¿	AÁ
AÁ%A5 Á5	BÂ Bc                  ót   — e Zd ZU dZ ej
                  «       Zded<    ej                  d«      Z
edd„«       Zy)Ú
DNSPatternz7
    A DNS pattern as extracted from certificates.
    rD   rM   ó   ^[a-z0-9\-_.]+$c                óø   — t        |t        «      st        d«      ‚|j                  «       }|dk(  st	        |«      sd|v rt        d|›d�«      ‚|j                  t        «      }d|v rt        |«        | |¬«      S )Nz'The DNS pattern must be a bytes string.r   ó    zInvalid DNS pattern ú.ó   *rL   )	r9   rD   Ú	TypeErrorÚstriprN   r	   Ú	translateÚ_TRANS_TO_LOWERÚ_validate_pattern)ÚclsrM   s     r    Ú
from_byteszDNSPattern.from_bytes“   sw   € ä˜'¤5Ô)ÜÐEÓFÐFà—-‘-“/ˆà�cŠ>œ^¨GÔ4¸ÀÑ8HÜ"Ð%9¸'¸ÀAÐ#FÓGÐGà×#Ñ#¤OÓ4ˆØ�7‰?Ü˜gÔ&á˜7Ô#Ð#r   N)rM   rD   ÚreturnrP   )r   r   r   r   r   r   rM   r   ÚreÚcompileÚ_RE_LEGAL_CHARSÚclassmethodr\   r   r   r    rP   rP   ˆ   s>   … ñð
 �T—W‘W“Y€GˆUÓà �b—j‘jÐ!4Ó5€Oàò$ó ñ$r   rP   c                  óP   — e Zd ZU dZ ej
                  «       Zded<   edd„«       Z	y)ÚIPAddressPatternz?
    An IP address pattern as extracted from certificates.
    ú-ipaddress.IPv4Address | ipaddress.IPv6AddressrM   c                óv   — 	  | t        j                  |«      ¬«      S # t        $ r t        d|›d�«      d ‚w xY w)NrL   zInvalid IP address pattern rT   )rI   rJ   rH   r	   )r[   Úbss     r    r\   zIPAddressPattern.from_bytes­   sH   € ð	Ùœy×3Ñ3°BÓ7Ô8Ð8øÜò 	Ü"Ø-¨b¨V°1Ð5óàðð	ús   ‚ ž8N)rf   rD   r]   rc   )
r   r   r   r   r   r   rM   r   ra   r\   r   r   r    rc   rc   ¤   s/   … ñð
 >E¸T¿W¹W»Y€GÐ:ÓFàòó ñr   rc   c                  ó|   — e Zd ZU dZ ej
                  «       Zded<    ej
                  «       Zded<   e	dd„«       Z
y)	Ú
URIPatternz8
    An URI pattern as extracted from certificates.
    rD   Úprotocol_patternrP   Údns_patternc                ó$  — t        |t        «      st        d«      ‚|j                  «       j	                  t
        «      }d|vsd|v st        |«      rt        d|›d�«      ‚|j                  d«      \  }} | |t        j                  |«      ¬«      S )Nz'The URI pattern must be a bytes string.ó   :rU   zInvalid URI pattern rT   )ri   rj   ©r9   rD   rV   rW   rX   rY   rN   r	   ÚsplitrP   r\   )r[   rM   ri   Úhostnames       r    r\   zURIPattern.from_bytesÂ   sŠ   € ä˜'¤5Ô)ÜÐEÓFÐFà—-‘-“/×+Ñ+¬OÓ<ˆà�wÑ $¨'¡/´^ÀGÔ5LÜ"Ð%9¸'¸ÀAÐ#FÓGÐGà%,§]¡]°4Ó%8Ñ"Ð˜(áØ-Ü"×-Ñ-¨hÓ7ô
ð 	
r   N)rM   rD   r]   rh   )r   r   r   r   r   r   ri   r   rj   ra   r\   r   r   r    rh   rh   ·   s@   … ñð
 &˜dŸg™g›iÐ�eÓ'à%˜dŸg™g›i€K�Ó'àò
ó ñ
r   rh   c                  ó|   — e Zd ZU dZ ej
                  «       Zded<    ej
                  «       Zded<   e	dd„«       Z
y)	Ú
SRVPatternz8
    An SRV pattern as extracted from certificates.
    rD   Úname_patternrP   rj   c                ó<  — t        |t        «      st        d«      ‚|j                  «       j	                  t
        «      }|d   dk7  sd|vsd|v st        |«      rt        d|›d�«      ‚|j                  dd«      \  }} | |dd  t        j                  |«      ¬	«      S )
Nz'The SRV pattern must be a bytes string.r   é_   ó   .rU   zInvalid SRV pattern rT   r   )rr   rj   rm   )r[   rM   Únamero   s       r    r\   zSRVPattern.from_bytesß   sŸ   € ä˜'¤5Ô)ÜÐEÓFÐFà—-‘-“/×+Ñ+¬OÓ<ˆð �A‰J˜'Ò!Ø˜7Ñ"Ø�w‰Ü˜gÔ&ä"Ð%9¸'¸ÀAÐ#FÓGÐGà Ÿ™ t¨QÓ/‰ˆˆhÙØ˜a˜b˜¬z×/DÑ/DÀXÓ/Nô
ð 	
r   N)rM   rD   r]   rq   )r   r   r   r   r   r   rr   r   rj   ra   r\   r   r   r    rq   rq   Ô   s?   … ñð
 "˜$Ÿ'™'›)€L�%Ó#à%˜dŸg™g›i€K�Ó'àò
ó ñ
r   rq   c                  ó8   — e Zd Zedd„«       Zedd„«       Zdd„Zy)r   c                 ó   — y r8   r   ©Úselfs    r    r(   zServiceID.pattern_classÿ   ó   € àr   c                 ó   — y r8   r   ry   s    r    r&   zServiceID.error_on_mismatch  r{   r   c                 ó   — y r8   r   ©rz   rM   s     r    r2   zServiceID.verify  s   € Ør   N)r]   ztype[CertificatePattern])r]   ztype[Mismatch]©rM   r   r]   Úbool)r   r   r   Úpropertyr(   r&   r2   r   r   r    r   r   ý   s-   „ àòó ðð òó ðôr   r   F)Úinitr   c                  óz   — e Zd ZU dZ ej
                  «       Zded<    ej                  d«      Z
eZeZdd„Zd	d„Zy)
ÚDNS_IDz)
    A DNS service ID, aka hostname.
    rD   ro   rQ   c                ó²  — t        |t        «      st        d«      ‚|j                  «       }|rt	        |«      rt        d«      ‚t        d„ |D «       «      r't        rt        j                  |«      }nt        d«      ‚|j                  d«      }|j                  t        «      | _        | j                  j                  | j                  «      €t        d«      ‚y )NzDNS-ID must be a text string.zInvalid DNS-ID.c              3  ó8   K  — | ]  }t        |«      d kD  –— Œ y­w)é   N)Úord)r:   Úcs     r    r=   z"DNS_ID.__init__.<locals>.<genexpr>   s   è ø€ Ò. Œs�1‹v˜�|Ñ.ùs   ‚z+idna library is required for non-ASCII IDs.rA   )r9   ÚstrrV   rW   rN   rH   r>   ÚidnaÚencodeÚImportErrorrX   rY   ro   r`   r-   )rz   ro   Úascii_ids      r    Ú__init__zDNS_ID.__init__  s·   € Ü˜(¤CÔ(ÜÐ;Ó<Ð<à—>‘>Ó#ˆÙœ>¨(Ô3ÜÐ.Ó/Ð/äÑ. XÔ.Ô.ÝÜŸ;™; xÓ0‘ä!ØAóð ð  —‘ wÓ/ˆHà ×*Ñ*¬?Ó;ˆŒØ×Ñ×%Ñ% d§m¡mÓ4Ð<ÜÐ.Ó/Ð/ð =r   c                óp   — t        || j                  «      r t        |j                  | j                  «      S y)zC
        https://tools.ietf.org/search/rfc6125#section-6.4
        F)r9   r(   Ú_hostname_matchesrM   ro   r~   s     r    r2   zDNS_ID.verify.  s,   € ô �g˜t×1Ñ1Ô2Ü$ W§_¡_°d·m±mÓDÐDàr   N)ro   rŠ   r   )r   r   r   r   r   r   ro   r   r^   r_   r`   rP   r(   r
   r&   r�   r2   r   r   r    r„   r„     sC   … ñð �d—g‘g“i€HˆeÓð !�b—j‘jÐ!4Ó5€OØ€MØ#Ðó0ô,r   r„   c                  óf   — e Zd ZU dZ ej
                  ej                  ¬«      Zde	d<   e
ZeZdd„Zy)ÚIPAddress_IDz#
    An IP address service ID.
    )Ú	converterrd   Úipc                ób   — t        || j                  «      r| j                  |j                  k(  S y)zC
        https://tools.ietf.org/search/rfc2818#section-3.1
        F)r9   r(   r•   rM   r~   s     r    r2   zIPAddress_ID.verifyE  s*   € ô �g˜t×1Ñ1Ô2Ø—7‘7˜gŸo™oÑ-Ð-àr   Nr   )r   r   r   r   r   r   rI   rJ   r•   r   rc   r(   r   r&   r2   r   r   r    r“   r“   8  s=   … ñð 9@¸¿¹Ø×&Ñ&ô9€BÐ5ó ð %€MØ)Ðôr   r“   c                  ó‚   — e Zd ZU dZ ej
                  «       Zded<    ej
                  «       Zded<   e	Z
eZd	d„Zd
d„Zy)ÚURI_IDz
    An URI service ID.
    rD   Úprotocolr„   Údns_idc                óF  — t        |t        «      st        d«      ‚|j                  «       }d|vst	        |«      rt        d«      ‚|j                  d«      \  }}|j                  d«      j                  t        «      | _
        t        |j                  d«      «      | _        y )NzURI-ID must be a text string.ú:zInvalid URI-ID.rA   ú/)r9   rŠ   rV   rW   rN   rH   rn   rŒ   rX   rY   r™   r„   rš   )rz   ÚuriÚprotro   s       r    r�   zURI_ID.__init__[  s~   € Ü˜#œsÔ#ÜÐ;Ó<Ð<à�i‰i‹kˆØ�c‰>œ^¨CÔ0ÜÐ.Ó/Ð/àŸ™ 3›‰ˆˆhàŸ™ GÓ,×6Ñ6´ÓGˆŒÜ˜XŸ^™^¨CÓ0Ó1ˆ�r   c                ó°   — t        || j                  «      r@|j                  | j                  k(  xr% | j                  j                  |j                  «      S y)zE
        https://tools.ietf.org/search/rfc6125#section-6.5.2
        F)r9   r(   ri   r™   rš   r2   rj   r~   s     r    r2   zURI_ID.verifyh  sM   € ô �g˜t×1Ñ1Ô2à×(Ñ(¨D¯M©MÑ9ò <Ø—K‘K×&Ñ& w×':Ñ':Ó;ðð
 r   N)rž   rŠ   r   )r   r   r   r   r   r   r™   r   rš   rh   r(   r   r&   r�   r2   r   r   r    r˜   r˜   O  sB   … ñð �d—g‘g“i€HˆeÓØ�T—W‘W“Y€FˆFÓà€MØ#Ðó2ô
r   r˜   c                  ó‚   — e Zd ZU dZ ej
                  «       Zded<    ej
                  «       Zded<   e	Z
eZd	d„Zd
d„Zy)ÚSRV_IDz
    An SRV service ID.
    rD   rv   r„   rš   c                ó@  — t        |t        «      st        d«      ‚|j                  «       }d|vst	        |«      s|d   dk7  rt        d«      ‚|j                  dd«      \  }}|dd  j                  d«      j                  t        «      | _
        t        |«      | _        y )NzSRV-ID must be a text string.rT   r   Ú_zInvalid SRV-ID.r   rA   )r9   rŠ   rV   rW   rN   rH   rn   rŒ   rX   rY   rv   r„   rš   )rz   Úsrvrv   ro   s       r    r�   zSRV_ID.__init__�  sˆ   € Ü˜#œsÔ#ÜÐ;Ó<Ð<à�i‰i‹kˆØ�c‰>œ^¨CÔ0°C¸±F¸c²MÜÐ.Ó/Ð/àŸ™ 3¨Ó*‰ˆˆhà˜˜�H—O‘O GÓ,×6Ñ6´ÓGˆŒ	Ü˜XÓ&ˆ�r   c                ó°   — t        || j                  «      r@| j                  |j                  k(  xr% | j                  j                  |j                  «      S y)zE
        https://tools.ietf.org/search/rfc6125#section-6.5.1
        F)r9   r(   rv   rr   rš   r2   rj   r~   s     r    r2   zSRV_ID.verifyŽ  sO   € ô �g˜t×1Ñ1Ô2Ø—9‘9 × 4Ñ 4Ñ4ò ¸¿¹×9KÑ9KØ×#Ñ#ó:ð ð r   N)r¥   rŠ   r   )r   r   r   r   r   r   rv   r   rš   rq   r(   r   r&   r�   r2   r   r   r    r¢   r¢   u  sB   … ñð �$—'‘'“)€Dˆ%ÓØ�T—W‘W“Y€FˆFÓà€MØ#Ðó'ô	r   r¢   c                ó°   — d| v rN| j                  dd«      \  }}|j                  dd«      \  }}||k7  ry|j                  d«      ry|dk(  xs ||k(  S | |k(  S )zT
    :return: `True` if *cert_pattern* matches *actual_hostname*, else `False`.
    rU   ru   r   Fs   xn--)rn   Ú
startswith)r   Úactual_hostnameÚ	cert_headÚ	cert_tailÚactual_headÚactual_tails         r    r‘   r‘   š  sv   € ð ˆ|ÑØ+×1Ñ1°$¸Ó:Ñˆ	�9Ø#2×#8Ñ#8¸¸qÓ#AÑ ˆ�[Ø˜Ò#Øà×!Ñ! 'Ô*Øà˜DÑ Ò< I°Ñ$<Ð<à˜?Ñ*Ð*r   c                ó.  — | j                  d«      }|dkD  rt        d| ›d�«      ‚| j                  d«      }t        |«      dk  rt        d| ›d�«      ‚d|d   vrt        d	j	                  | «      «      ‚t        d
„ |D «       «      rt        d| ›d�«      ‚y)zh
    Check whether the usage of wildcards within *cert_pattern* conforms with
    our expectations.
    rU   r   zCertificate's DNS-ID z contains too many wildcards.ru   é   z0 has too few host components for wildcard usage.r   zDCertificate's DNS-ID {!r} has a wildcard outside the left-most part.c              3  ó4   K  — | ]  }t        |«       –— Œ y ­wr8   )Úlen)r:   Úps     r    r=   z$_validate_pattern.<locals>.<genexpr>Â  s   è ø€ Ò
%˜!Œs�1‹vŒ:Ñ
%ùs   ‚z contains empty parts.N)Úcountr	   rn   r±   Úformatr>   )r   ÚcntÚpartss      r    rZ   rZ   ¬  sÌ   € ð
 ×
Ñ
˜TÓ
"€CØ
ˆQ‚wÜØ# LÐ#3Ð3PÐQó
ð 	
ð ×Ñ˜tÓ$€EÜ
ˆ5ƒz�A‚~ÜØ# LÐ#3ð 4ð ó
ð 	
ð
 �5˜‘8ÑÜðß‘F˜<Ó(ó
ð 	
ô Ñ
%˜uÔ
%Ô%ÜØ# LÐ#3Ð3IÐJó
ð 	
ð &r   s   ABCDEFGHIJKLMNOPQRSTUVWXYZs   abcdefghijklmnopqrstuvwxyz)r)   úSequence[CertificatePattern]r*   úSequence[ServiceID]r+   r¸   r]   úlist[ServiceMatch])r)   r·   r3   r¸   r]   r¹   )r?   zSequence[object]r<   Útyper]   r€   )rM   zstr | bytesr]   r€   )r   rD   r©   rD   r]   r€   )r   rD   r]   ÚNone)*r   Ú
__future__r   rI   r^   Útypingr   r   r   r   r   Ú
exceptionsr	   r
   r   r   r   r   r   r‹   r�   Úsr   r0   r$   r'   rN   rP   rc   rh   rq   r   r   r„   r“   r˜   r¢   r‘   rZ   rD   Ú	maketransrY   r   r   r    ú<module>rÁ      sF  ðñõ #ã Û 	ç ?Ó ?ã ÷÷ ñ ðÛð
 €‡�ˆdÔ÷1ð 1ó ð1ð(Ø/ð(à'ð(ð &ð(ð ó	(ðVØ/ðà$ðð óó$/óð< €‡�ˆdÔ÷$ð $ó ð$ð6 €‡�ˆdÔ÷ð ó ðð$ €‡�ˆdÔ÷
ð 
ó ð
ð8 €‡�ˆdÔ÷
ð 
ó ð
ð> Ø�
˜JÐ(8Ð8ñÐ ðð ô
�ó 
ó ð
ð €‡�ˆU˜$Ô÷)ð )ó  ð)ðX €‡�ˆdÔ÷ð ó ðð, €‡�ˆU˜$Ô÷"ð "ó  ð"ðJ €‡�ˆU˜$Ô÷!ð !ó  ð!óH+ó$
ð: —/‘/Ø!Ð#@ó�øð] ò ØƒDðús   ´F. Æ.F9Æ8F9