jm(ddlmZddlmZmZmZmZmZddlmZm Z m Z ddl m Z ddl mZmZddlmZddlmZmZmZmZmZmZddlmZdd lmZdd lmZmZm Z dd l!m"Z"Gd d Z#dS))datetime)DictIterableListOptionalSet)crlocspx509) Authority) CRLFetchErrorOCSPFetchError)Fetchers)KnownPOE POEManagerPOETypeValidationObjectValidationObjectTypedigest_for_poe)NonRevokedStatusAssertion)CertificateRegistry) CRLContainer OCSPContainersort_freshest_first) get_ocsp_urlsc8eZdZdZ d!dededeedeedee d e e f d Z e d efd Ze d efd Ze d efdZe d eejfdZe d eejfdZe d eejfdZdefdZdZd e ejfdZd eefdZd eefdZ d eefdZ!de"d eefdZ#de$e%fdZ&de$e%fdZ'dejde(d efd Z)dS)"RevinfoManagera .. versionadded:: 0.20.0 Class to manage and potentially fetch revocation information. :param certificate_registry: The associated certificate registry. :param poe_manager: The proof-of-existence (POE) data manager. :param crls: CRL data. :param ocsps: OCSP response data. :param fetchers: Fetchers for collecting revocation information. If ``None``, no fetching will be performed. Ncertificate_registry poe_managercrlsocsps assertionsfetchersc||_||_i|_i|_g|_|rt ||_g|_|r0t |x|_}|D]}||||_d|D|_ dS)Nci|] }|j| Sr) cert_sha256).0 assertions t/var/www/finuniver-perm.ru/html/portfolio/venv/lib/python3.11/site-packages/pyhanko_certvalidator/revinfo/manager.py z+RevinfoManager.__init__..Ns0D D D 1:I !9D D D ) _certificate_registry _poe_manager_revocation_certs_crl_issuer_map_crlsr_ocsps_extract_ocsp_certs _fetchers _assertions)selfrr r!r"r#r$ ocsp_responses r*__init__zRevinfoManager.__init__4s&:"'@B>@)+  3,T22DJ+-  8"5e"<"< HD D D r,returnc|jS)z< The proof-of-existence (POE) data manager. )r.r6s r*r zRevinfoManager.poe_managerRs   r,c|jS)z6 The associated certificate registry. )r-r;s r*rz#RevinfoManager.certificate_registryYs ))r,c|jduS)zA Boolean indicating whether fetching is allowed. N)r4r;s r*fetching_allowedzRevinfoManager.fetching_allowed`s ~T))r,cd|jD}|js|St|jj|zS)zK A list of all cached :class:`crl.CertificateList` objects cg|] }|j Sr)crl_datar(conts r* z'RevinfoManager.crls..ms999dDM999r,)r1r4list crl_fetcher fetched_crls)r6raw_crlss r*r!zRevinfoManager.crlsgsL :9dj999~ ODN.;;==>>IIr,cd|jD}|js|St|jj|zS)zI A list of all cached :class:`ocsp.OCSPResponse` objects cg|] }|j Sr)ocsp_response_datarBs r*rDz(RevinfoManager.ocsps..xsEEET,EEEr,)r2r4rE ocsp_fetcherfetched_responses)r6 raw_ocspss r*r"zRevinfoManager.ocspsrsN FEEEE ~  DN/AACCDDyPPr,cNt|jS)z A list of newly-fetched :class:`x509.Certificate` objects that were obtained from OCSP responses and CRLs )rEr/valuesr;s r*new_revocation_certsz#RevinfoManager.new_revocation_certs~s!D*1133444r,r7c |j}||}|j}|j}|}||dr|dD]}||rr|||j<|ttj t| |ttj|dSdSdS)z Extracts any certificates included with an OCSP response and adds them to the certificate registry :param ocsp_response: An asn1crypto.ocsp.OCSPResponse object to look for certs inside of Ncerts) object_typevalue)poe_typedigestpoe_timevalidation_object)r.r-r/extract_basic_ocsp_responseregister issuer_serialregister_known_poerr VALIDATIONrdumprr CERTIFICATE)r6r7poe_man ocsp_poe_timeregistry revo_certsbasic other_certs r*r3z"RevinfoManager._extract_ocsp_certss# . -+ 99;;  w #Gn   $$Z00;EJz78.. %,%7#1*//2C2C#D#D&3.>,@,L&0///            r,c$||j|j<dS)aU Records the certificate that issued a certificate list. Used to reduce processing code when dealing with self-issued certificates and multiple CRLs. :param certificate_list: An ans1crypto.crl.CertificateList object :param cert: An ans1crypto.x509.Certificate object N)r0 signature)r6certificate_listcerts r*record_crl_issuerz RevinfoManager.record_crl_issuers<@-7888r,c@|j|jS)a3 Checks to see if the certificate that signed a certificate list has been found :param certificate_list: An ans1crypto.crl.CertificateList object :return: None if not found, or an asn1crypto.x509.Certificate object of the issuer )r0getrh)r6ris r*check_crl_issuerzRevinfoManager.check_crl_issuers#''(8(BCCCr,ct|j}|jr=|jj}|d|D|S)z .. versionadded:: 0.27.0 Return all currently available CRLs. :return: A list of :class:`CRLContainer` objects c34K|]}t|VdSNrr(rAs r* z:RevinfoManager.currently_available_crls..s*FFX,x00FFFFFFr,)rEr1r4rFrGextend)r6resultr!s r*currently_available_crlsz'RevinfoManager.currently_available_crlssZdj!! > G>-::<.s ===Hh''===r,)r4r rFfetched_crls_for_certKeyErrorfetch)r6rjr$r!contss r* fetch_crlszRevinfoManager.fetch_crlss~ < :;; ;> :'==dCCDD : : :!-33D99999999DDD :===== s<*A)(A)cK|}|jr.|||d{V|S)z .. versionadded:: 0.20.0 :param cert: An asn1crypto.x509.Certificate object :return: A list of :class:`CRLContainer` objects N)rwr4rur~)r6rjr!s r*async_retrieve_crlsz"RevinfoManager.async_retrieve_crlssX,,.. > 5 KKdood33333333 4 4 4 r, authoritycK|jrt|s|jS|j}d|j|D}|sm|j||d{V}t j|}|D]5} ||#t$rtdwxYw||jzS)a  .. versionadded:: 0.20.0 :param cert: An asn1crypto.x509.Certificate object :param authority: The issuing authority for the certificate :return: A list of :class:`OCSPContainer` objects c,g|]}t|Sr)r)r(resps r*rDz7RevinfoManager.async_retrieve_ocsps..s0    $     r,Nz9Failed to extract certificates from fetched OCSP response) r4rr2rLfetched_responses_for_certr|r load_multir3 ValueErrorr)r6rjrr$r"rKrs r*async_retrieve_ocspsz#RevinfoManager.async_retrieve_ocspss& ~ ]4%8%8 ; >   -HHNN    '/'<'B'Bi(("""""" ",-?@@E   ,,T2222!(0 t{""s BB7hashes_to_evictcpdtffd }tt||j|_dS)z Internal API to eliminate local OCSP records from consideration. :param hashes_to_evict: A collection of OCSP response hashes; see :func:`.digest_for_poe`. containercXt|j}|vSrq)rrKr_rrWrs r*pz%RevinfoManager.evict_ocsps..p0s*#I$@$E$E$G$GHHF0 0r,N)rrEfilterr2r6rrs ` r* evict_ocspszRevinfoManager.evict_ocsps(sI 1 1 1 1 1 1 16!T[1122 r,cpdtffd }tt||j|_dS)z Internal API to eliminate local CRLs from consideration. :param hashes_to_evict: A collection of CRL hashes; see :func:`.digest_for_poe`. rcXt|j}|vSrq)rrAr_rs r*rz$RevinfoManager.evict_crls..p>s*#I$6$;$;$=$=>>F0 0r,N)rrErr1rs ` r* evict_crlszRevinfoManager.evict_crls6sI 1 1 1 1 1 1 1&DJ//00 r,rjatc\ ||j|jjkS#t$rYdSwxYw)NF)r5sha256rr{)r6rjrs r*check_asserted_unrevokedz'RevinfoManager.check_asserted_unrevokedDsA )$+699 9   55 s  ++)rN)*__name__ __module__ __qualname____doc__rrrrrrrrr8propertyr rboolr>rr CertificateListr!r OCSPResponser"r CertificaterQr3rkrnrwr~rr rrbytesrrrrrr,r*rr!s0;='+  1   |$   &  67  8$    <!Z!!!X! *&9***X* *$***X* Jd3./JJJXJ QtD-. Q Q QX Q5d4+;&<555X5     D @ @ @ DHT=M4N D D D D $|*<    \(:. l1C    *#(*# m *#*#*#*#X 33u: 3 3 3 3 1#e* 1 1 1 1$*2 r,rN)$rtypingrrrrr asn1cryptor r r pyhanko_certvalidator.authorityr pyhanko_certvalidator.errorsr rpyhanko_certvalidator.fetchersrpyhanko_certvalidator.ltv.poerrrrrr!pyhanko_certvalidator.policy_declrpyhanko_certvalidator.registryr&pyhanko_certvalidator.revinfo.archivalrrrpyhanko_certvalidator.utilrrrr,r*rs'&&&&&&&&&555555FFFFFFFF333333HGGGGG>>>>>> 544444iiiiiiiiiir,