o CZc-@sddlZddlZddlmZmZddlmZddlmZm Z ddl m Z m Z m Z ddlmZmZmZddlmZmZdd lmZdd lmZgd ZGd d d ZdS)N)OptionalIterable)x509)ValidationContextPKIXValidationParams)ValidationErrorPathBuildingErrorInvalidCertificateError)async_validate_pathvalidate_tls_hostnamevalidate_usage) __version____version_info__)pretty_message) type_name)rrCertificateValidatorrrc @s~eZdZdZdZdZdZ   ddejde e ejde e de fddZ dd Zdd d Z  dd dZddZddZdS)rNend_entity_certintermediate_certsvalidation_context pkix_paramscCsF|durt}|dur|j}|D]}||q||_||_||_dS)a  :param end_entity_cert: An asn1crypto.x509.Certificate object X.509 end-entity certificate to validate :param intermediate_certs: None or a list of asn1crypto.x509.Certificate Used in constructing certificate paths for validation. :param validation_context: A pyhanko_certvalidator.context.ValidationContext() object that controls generic validation options and tracks revocation data. The same validation context will also be used in the validation of relevant certificates found in OCSP responses and/or CRLs. :param pkix_params: A pyhanko_certvalidator.context.PKIXValidationParams() object that controls advanced PKIX validation parameters used to validate the end-entity certificate. These can be used to constrain policy processing and names. Ancillary validation of CRLs and OCSP responses ignore these settings. N)rcertificate_registryadd_other_cert_context _certificate_params)selfrrrrrintermediate_certrT/var/www/chikooza/env/lib/python3.10/site-packages/pyhanko_certvalidator/__init__.py__init__&s   zCertificateValidator.__init__c s |jdurdSg}|jj|jjvrttd|jjz |jj|jIdH}Wnt y@|jj dvr?ttd|jj j w|D]+}zt |j||jIdH||_WdStyn}z ||WYd}~qCd}~wwt|dkry|dd}|D] }dt|vr|}q}|r||d)ar Builds possible certificate paths and validates them until a valid one is found, or all fail. :raises: pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked Nz The X.509 certificate provided has a signature using the weak hash algorithm %s >yesmaybez^ The X.509 certificate provided is self-signed - "%s" rr signature)_pathr hash_algorweak_hash_algosr rrasync_build_pathsr self_signedsubjecthuman_friendlyr rrappendlenstr)r exceptionspathscandidate_pathenon_signature_exception exceptionrrr_validate_pathRsP      z#CertificateValidator._validate_pathFcCs tdtt||||S)a Validates the certificate path and that the certificate is valid for the key usage and extended key usage purposes specified. .. deprecated:: 0.17.0 Use :meth:`async_validate_usage` instead. :param key_usage: A set of unicode strings of the required key usage purposes. Valid values include: - "digital_signature" - "non_repudiation" - "key_encipherment" - "data_encipherment" - "key_agreement" - "key_cert_sign" - "crl_sign" - "encipher_only" - "decipher_only" :param extended_key_usage: A set of unicode strings of the required extended key usage purposes. These must be either dotted number OIDs, or one of the following extended key usage purposes: - "server_auth" - "client_auth" - "code_signing" - "email_protection" - "ipsec_end_system" - "ipsec_tunnel" - "ipsec_user" - "time_stamping" - "ocsp_signing" - "wireless_access_points" An example of a dotted number OID: - "1.3.6.1.5.5.7.3.1" :param extended_optional: A bool - if the extended_key_usage extension may be ommited and still considered valid :raises: pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked pyhanko_certvalidator.errors.InvalidCertificateError - when the certificate is not valid for the usages specified :return: A pyhanko_certvalidator.path.ValidationPath object of the validated certificate validation path zB'validate_usage' is deprecated, use 'async_validate_usage' instead)warningswarnDeprecationWarningasynciorunasync_validate_usager key_usageextended_key_usageextended_optionalrrrr s8z#CertificateValidator.validate_usagecs*|IdHt|j|j||||jS)aN Validates the certificate path and that the certificate is valid for the key usage and extended key usage purposes specified. :param key_usage: A set of unicode strings of the required key usage purposes. Valid values include: - "digital_signature" - "non_repudiation" - "key_encipherment" - "data_encipherment" - "key_agreement" - "key_cert_sign" - "crl_sign" - "encipher_only" - "decipher_only" :param extended_key_usage: A set of unicode strings of the required extended key usage purposes. These must be either dotted number OIDs, or one of the following extended key usage purposes: - "server_auth" - "client_auth" - "code_signing" - "email_protection" - "ipsec_end_system" - "ipsec_tunnel" - "ipsec_user" - "time_stamping" - "ocsp_signing" - "wireless_access_points" An example of a dotted number OID: - "1.3.6.1.5.5.7.3.1" :param extended_optional: A bool - if the extended_key_usage extension may be ommited and still considered valid :raises: pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked pyhanko_certvalidator.errors.InvalidCertificateError - when the certificate is not valid for the usages specified :return: A pyhanko_certvalidator.path.ValidationPath object of the validated certificate validation path N)r4r rrr$r;rrrr:s6z)CertificateValidator.async_validate_usagecCstdtt||S)ah Validates the certificate path, that the certificate is valid for the hostname provided and that the certificate is valid for the purpose of a TLS connection. .. deprecated:: 0.17.0 Use :meth:`async_validate_tls` instead. :param hostname: A unicode string of the TLS server hostname :raises: pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked pyhanko_certvalidator.errors.InvalidCertificateError - when the certificate is not valid for TLS or the hostname :return: A pyhanko_certvalidator.path.ValidationPath object of the validated certificate validation path z>'validate_tls' is deprecated, use 'async_validate_tls' instead)r5r6r7r8r9async_validate_tlsrhostnamerrr validate_tlss z!CertificateValidator.validate_tlscs&|IdHt|j|j||jS)a Validates the certificate path, that the certificate is valid for the hostname provided and that the certificate is valid for the purpose of a TLS connection. :param hostname: A unicode string of the TLS server hostname :raises: pyhanko_certvalidator.errors.PathValidationError - when an error occurs validating the path pyhanko_certvalidator.errors.RevokedError - when the certificate or another certificate in its path has been revoked pyhanko_certvalidator.errors.InvalidCertificateError - when the certificate is not valid for TLS or the hostname :return: A pyhanko_certvalidator.path.ValidationPath object of the validated certificate validation path N)r4r rrr$r@rrrr?.sz'CertificateValidator.async_validate_tls)NNN)NF)__name__ __module__ __qualname__rrr$rr Certificaterrrrr r4r r:rBr?rrrrrs0  , ;D @ r)r8r5typingrr asn1cryptorcontextrrerrorsrr r validater r r versionrr_errorsr_typesr__all__rrrrrs