kjdZddlmZddlZddlmZddlmZddlm Z m Z m Z m Z m Z mZmZddlmZdd lmZdd lmZmZmZmZmZmZmZmZd gZ dd Z dd Ze dZ ddZ!ddZ"y)zL `cryptography.x509 `_-specific code. ) annotationsN)Sequence)asn1) CertificateDNSName ExtensionOID IPAddressObjectIdentifier OtherNameUniformResourceIdentifier)ExtensionNotFound)CertificateError)DNS_IDCertificatePattern DNSPattern IPAddress_IDIPAddressPattern SRVPattern URIPatternverify_service_identityverify_certificate_hostnamecFtt|t|ggy)a Verify whether *certificate* is valid for *hostname*. .. note:: Nothing is verified about the *authority* of the certificate; the caller must verify that the certificate chains to an appropriate trust root themselves. Args: certificate: A *cryptography* X509 certificate object. hostname: The hostname that *certificate* should be valid for. Raises: service_identity.VerificationError: If *certificate* is not valid for *hostname*. service_identity.CertificateError: If *certificate* contains invalid / unexpected data. This includes the case where the certificate contains no `subjectAltName`\ s. .. versionchanged:: 24.1.0 :exc:`~service_identity.CertificateError` is raised if the certificate contains no ``subjectAltName``\ s instead of :exc:`~service_identity.VerificationError`.  cert_patternsobligatory_ids optional_idsN)rextract_patternsr) certificatehostnames f/home/ubuntu/.cache/pipx/cdb5059130eadca/lib/python3.12/site-packages/service_identity/cryptography.pyrr's":&{3x()cFtt|t|ggy)a Verify whether *certificate* is valid for *ip_address*. .. note:: Nothing is verified about the *authority* of the certificate; the caller must verify that the certificate chains to an appropriate trust root themselves. Args: certificate: A *cryptography* X509 certificate object. ip_address: The IP address that *connection* should be valid for. Can be an IPv4 or IPv6 address. Raises: service_identity.VerificationError: If *certificate* is not valid for *ip_address*. service_identity.CertificateError: If *certificate* contains invalid / unexpected data. This includes the case where the certificate contains no ``subjectAltName``\ s. .. versionadded:: 18.1.0 .. versionchanged:: 24.1.0 :exc:`~service_identity.CertificateError` is raised if the certificate contains no ``subjectAltName``\ s instead of :exc:`~service_identity.VerificationError`. rN)rrr)r ip_addresss r!verify_certificate_ip_addressr%Ks#B&{3$Z01r"z1.3.6.1.5.5.7.8.7c ,g} |jjtj}|j |j j tDcgc]&}tj|jd(c}|j |j j tDcgc]&}tj|jd(c}|j |j j tDcgc] }t|c}|j j tD]}|j t"k(s t%j&t$j(|j }|j/t1j|j3jd|Scc}wcc}wcc}w#t*$r}d} t-| |d}~wwxYw#t4$rY|SwxYw)a  Extract all valid ID patterns from a certificate for service verification. Args: cert: The certificate to be dissected. Returns: List of IDs. .. versionchanged:: 23.1.0 ``commonName`` is not used as a fallback anymore. zutf-8zUnexpected certificate content.Nascii) extensionsget_extension_for_oidrSUBJECT_ALTERNATIVE_NAMEextendvalueget_values_for_typerr from_bytesencoder rr rr type_id ID_ON_DNS_SRVr decode_der IA5String ValueErrorrappendras_strr ) certidsextnameuriipothersrvemsgs r!rrvs%'C#Poo33  1 1   II99'B %%dkk'&:;  9988- %%cjj&9:   ))77 B !$  YY229= PE}} -7//$..%++FC  :001D1DW1MNO P J;    "7;C*3/Q677   @ JC s;)H+G7+GG"%.G'' H0G>>H HHcPtjtddt|S)zm Deprecated and never public API. Use :func:`extract_patterns` instead. .. deprecated:: 23.1.0 z?`extract_ids()` is deprecated, please use `extract_patterns()`.)categorymessage stacklevel)warningswarnDeprecationWarningr)r7s r! extract_idsrIs&  MM#Q D !!r")rrr strreturnNone)rrr$rJrKrL)r7rrKzSequence[CertificatePattern])#__doc__ __future__rrFtypingrcryptography.hazmatrcryptography.x509rrrr r r r cryptography.x509.extensionsr exceptionsrhazmatrrrrrrrr__all__rr%r1rrIr"r!rWs#$;(    ) )!!(+! !H%%*-% %P!!45 3l "r"