o

��\q�@s�dZd
dl
mZmZmZ
d
dlZd
dlmZmZm	Z	m
Z
mZmZm
Z

d
dlmZ
d
dlmZ
d
dlmZ
dd	lmZmZmZmZmZmZmZmZ
dd
lmZ
dg
Zdd�Z d
d�Z!ed�
Z"dd�Z#dS)zL
`cryptography.x509 <https://github.com/pyca/cryptography>`_-specific code.
�)�absolute_import�division�print_functionN)�DNSName�ExtensionOID�	IPAddress�NameOID�ObjectIdentifier�	OtherName�UniformResourceIdentifier)
�ExtensionNotFound)
�decode)
�	IA5String�
)�DNS_ID�CertificateError�
DNSPattern�IPAddress_ID�IPAddressPattern�
SRVPattern�
URIPattern�verify_service_identity)
�SubjectAltNameWarning�verify_certificate_hostnamecC�tt
|�
t|
�
g
gd
�
dS)a�
    Verify whether *certificate* is valid for *hostname*.

    .. note:: Nothing is verified about the *authority* of the certificate;
       the caller must verify that the certificate chains to an appropriate
       trust root themselves.

    :param cryptography.x509.Certificate certificate: A cryptography X509
        certificate object.
    :param unicode hostname: The hostname that *certificate* should be valid
        for.

    :raises service_identity.VerificationError: If *certificate* is not valid
        for *hostname*.
    :raises service_identity.CertificateError: If *certificate* contains
        invalid/unexpected data.

    :returns: ``None``
    ��
cert_patterns�obligatory_ids�optional_idsN)r�extract_idsr)�certificate�hostname�r"�?/usr/lib/python3/dist-packages/service_identity/cryptography.pyr&s




�cCr)a�
    Verify whether *certificate* is valid for *ip_address*.

    .. note:: Nothing is verified about the *authority* of the certificate;
       the caller must verify that the certificate chains to an appropriate
       trust root themselves.

    :param cryptography.x509.Certificate certificate: A cryptography X509
        certificate object.
    :param unicode ip_address: The IP address that *connection* should be valid
        for.  Can be an IPv4 or IPv6 address.

    :raises service_identity.VerificationError: If *certificate* is not valid
        for *ip_address*.
    :raises service_identity.CertificateError: If *certificate* contains
        invalid/unexpected data.

    :returns: ``None``

    .. versionadded:: 18.1.0
    rN)rrr)r �
ip_addressr"r"r#�verify_certificate_ip_addressAs




�r%z1.3.6.1.5.5.7.8.7c
Cs
g}
z	|j�
tj�
}Wn	ty


YnSw|
�d
d�|j�t�
D�
�

|
�dd�|j�t	�
D�
�

|
�dd�|j�t
�
D�
�

|j�t�
D]!}|jt
krft|j�
\}}t|t�rb|
�t|���
�

qEtd�
�
qE|
s�dd�|j�tj�
D�
}tt|�
d�}dd�|D�
}
t�d	�|�
t�
|
S)
a

    Extract all valid IDs from a certificate for service verification.

    If *cert* doesn't contain any identifiers, the ``CN``s are used as DNS-IDs
    as fallback.

    :param cryptography.x509.Certificate cert: The certificate to be dissected.

    :return: List of IDs.
    c
S�g|]	}
t|
�
d�
�
�qS�
zutf-8�r�encode)�.0�namer"r"r#�
<listcomp>u���zextract_ids.<locals>.<listcomp>c
Sr&r')rr))r*�urir"r"r#r,{r-c
Ssg|]}
t|
�
�qSr")
r)r*�ipr"r"r#r,�s��zUnexpected certificate content.c
Ssg|]}
|
j�qSr")
�value�r*�
nr"r"r#r,�s��s<not given>c
Sr&r'r(r1r"r"r#r,�sz�Certificate with CN {!r} has no `subjectAltName`, falling back to check for a `commonName` for now.  This feature is being removed by major browsers and deprecated by RFC 2818.)�
extensions�get_extension_for_oidr�SUBJECT_ALTERNATIVE_NAMEr�extendr0�get_values_for_typerrrr
�type_id�
ID_ON_DNS_SRVr
�
isinstancer�appendr�asOctetsr�subject�get_attributes_for_oidr�COMMON_NAME�next�iter�warnings�warn�formatr)�cert�ids�ext�other�srv�
_�cns�cnr"r"r#rasX


�
�

��

���

��





��



�r)$�__doc__�
__future__rrrrB�cryptography.x509rrrrr	r
r�cryptography.x509.extensionsr�pyasn1.codec.der.decoderr
�pyasn1.type.charr�_commonrrrrrrrr�
exceptionsr�__all__rr%r9rr"r"r"r#�<module>
s$	

(