ɯei6dddlmZddlZddlZddlZddlZddlZddlZddlZddl m Z m Z ddl m Z ddlmZmZmZddlmZddlmZddlmZdd lmZdd lmZmZd d lmZej<eZ e Gd dZ!Gdde Z"Gdde"Z#Gdde"Z$Gdde"Z%GddZ&GddZ'ddZ(ddZ)y)) annotationsN)ABCabstractmethod) dataclass)datetime timedeltatimezone)Path)x509)default_backend) serialization) BaseFileLockFileLock) IS_WINDOWSc>eZdZUdZded<ded<d dZd dZd dZy ) CRLCacheEntryz8Cache entry containing a CRL and its download timestamp.x509.CertificateRevocationListcrlr download_timecbt|jddxst|jddS)z/A compatibility wrapper around crl.next_update.next_update_utcN next_update)getattrrselfs _/var/www/html/glpi_dashboard/venv/lib/python3.12/site-packages/snowflake/connector/crl_cache.py _next_updatezCRLCacheEntry._next_update!s/txx!2D9 W HHmT>  c8|j}|duxr||kS)z Check if the CRL has expired. Args: ts: Time to check against Returns: True if the CRL has expired, False otherwise N)r)rtsrs ris_crl_expired_byzCRLCacheEntry.is_crl_expired_by's''') $&;;+;;rc*|j|z}||kS)a/ Check if the cache entry should be evicted based on cache validity time. Args: ts: Current time to check against cache_validity_time: How long cache entries remain valid Returns: True if the entry should be evicted, False otherwise )r)rr!cache_validity_time expiry_times r is_evicted_byzCRLCacheEntry.is_evicted_by4s ((+>> RrN)returnzdatetime | None)r!rr'bool)r!rr$rr'r()__name__ __module__ __qualname____doc____annotations__rr"r&rrrrs B '' <  rrcFeZdZdZeddZeddZeddZy) CRLCachez- Abstract base class for CRL caches. ct)z Get a CRL cache entry by URL. Args: crl_url: The CRL URL Returns: The cache entry if found, None otherwise NotImplementedErrorrcrl_urls rgetz CRLCache.getHs "##rct)z Store a CRL cache entry. Args: crl_url: The CRL URL entry: The cache entry to store r2rr5entrys rputz CRLCache.putUs "##rct)z2Remove expired and evicted entries from the cache.r2rs rcleanupzCRLCache.cleanup`s "##rNr5strr'zCRLCacheEntry | Noner5r>r9rr'Noner'r@)r)r*r+r,rr6r:r<r.rrr0r0CsC $ $$$$$rr0c>eZdZdZdZfdZddZddZd dZxZ S) NoopCRLCachez= No-operation CRL cache that doesn't store anything. Nc\|jt| ||_|jS)N)INSTANCEsuper__new__)cls __class__s rrGzNoopCRLCache.__new__ns' <<  7?3/CL||rcy)zAlways returns None.Nr.r4s rr6zNoopCRLCache.getssrcyz Does nothing.Nr.r8s rr:zNoopCRLCache.putw rcyrLr.rs rr<zNoopCRLCache.cleanup{rMrr=r?rA) r)r*r+r,rErGr6r:r< __classcell__)rIs@rrCrCfs# H   rrCc0eZdZdZddZddZd dZd dZy) CRLInMemoryCachez= In-memory CRL cache using a thread-safe dictionary. cRi|_||_tj|_y)z Initialize the in-memory cache. Args: cache_validity_time: How long cache entries remain valid N)_cache_cache_validity_time threadingRLock_lock)rr$s r__init__zCRLInMemoryCache.__init__s!13 $7!__& rc|j5|jj|}|tj d||cdddS#1swYyxYw)z Get a CRL cache entry from memory. Args: crl_url: The CRL URL Returns: The cache entry if found, None otherwise NzFound CRL in memory cache for )rWrSr6loggerdebugr8s rr6zCRLInMemoryCache.getsOZZ KKOOG,E  =gYGH    s 7AAcd|j5||j|<dddy#1swYyxYw)z Store a CRL cache entry in memory. Args: crl_url: The CRL URL entry: The cache entry to store N)rWrSr8s rr:zCRLInMemoryCache.puts.ZZ )#(DKK  ) ) )s&/c @tjtj}tj d||j 5g}|jjD]f\}}|j|}|j||j}|s|s8tj d|d|d||j|h|D]}|j|=t|}|dkDrtj d|ddddy#1swYyxYw) z5Remove expired and evicted entries from memory cache.z#Cleaning up in-memory CRL cache at z'Removing in-memory CRL cache entry for z : expired=z , evicted=rzRemoved z1 expired/evicted entries from in-memory CRL cacheN)rnowr utcrZr[rWrSitemsr"r&rTappendlen)rr^urls_to_removeurlr9expiredevicted removed_counts rr<zCRLInMemoryCache.cleanupsll8<<( :3%@A ZZ N"kk//1 / U11#6--c43L3LMgLLA#G##*):gY@#))#. /& %KK$ % /Mq  }o-^_'   sADA.DDN)r$rr=r?rA)r)r*r+r,rXr6r:r<r.rrrQrQs ' )rrQceZdZdZ d d dZddZddZddZ ddZddZ dd Z dd Z dd Z y) CRLFileCachez: File-based CRL cache that persists CRLs to disk. Ncd|_|xs t|_|xs td|_||_|j y)ac Initialize the file cache. Args: cache_dir: Directory to store cached CRLs removal_delay: How long to wait before removing expired files unsafe_skip_file_permissions_check: Skip file permission validation for security Raises: OSError: If cache directory cannot be created @daysN)_cache_file_lock_timeout_get_default_crl_cache_path _cache_dirr_removal_delay#_unsafe_skip_file_permissions_check_ensure_cache_directory_exists)r cache_dir removal_delay"unsafe_skip_file_permissions_checks rrXzCRLFileCache.__init__sB"),%#D'B'D+@ya/@3U0 ++-rcB |jjddd|js|j|jddtj d|jy #t $rt$r }td|jd|d }~wwxYw) zGCreate the cache directory if it doesn't exist with secure permissions.Ti)parentsexist_okmode directory0o700z"Cache directory created/verified: z!Failed to create cache directory : N)rqmkdirrs_check_permissionsrZr[PermissionErrorOSError)res rrtz+CRLFileCache._ensure_cache_directory_existss V OO ! !$E ! J;;''gN LL=doo=NO P   V=doo=NbQRPSTU U VsA)A,,B>BBctj|jj}|jd|dz S)z Generate a file path for the given CRL URL. Args: crl_url: The CRL URL Returns: Path to the cache file crl_z.der)hashlibsha256encode hexdigestrq)rr5url_hashs r_get_crl_file_pathzCRLFileCache._get_crl_file_paths:>>'.."23==?4z!666rcPt|jdd|jS)z3Return a lock instance for the given CRL cache filez.lockT) thread_localtimeout)r with_suffixro)rcrl_cache_files r_get_crl_file_lockzCRLFileCache._get_crl_file_locks)  & &w /11  rc try |j}tj|j}|dzdk7r2t d|d|dt |d|j d|d y#t$rYywxYw) aF Check that a CRL cache resource has secure permissions (owner-only access). Note: This check is only performed on Unix-like systems. Windows file permissions work differently and are not checked. Args: path: Path to the resource (file or directory) to check resource_type: Description of the resource type (e.g., "file", "directory") expected_perms: Description of expected permissions (e.g., "0o600 or 0o400", "0o700") Raises: PermissionError: If resource permissions are too wide N?rz CRL cache  z has insecure permissions: z. z' must be accessible only by the owner (z).)rstatS_IMODEst_moderoct capitalizeFileNotFoundError)rpath resource_typeexpected_perms stat_infoactual_permissionss rrzCRLFileCache._check_permissions s$    I!%i.?.?!@ #U*a/% q6QRUVhRiQjjl$//122YZhYiikm0!   sA)A33 A?>A?cH|j|}|j|5 |jrtj d||j s|j |ddntjd||j}tj|jtj}t|d5}|j}dddt!j"t%}t'||cdddS dddy#1swYGxYw#t($r-}tj+d |d |Yd}~dddyd}~wt,$r%}tjd |d |Yd}~rd}~wwxYw#1swYyxYw) z Get a CRL cache entry from disk. Args: crl_url: The CRL URL Returns: The cache entry if found, None otherwise zFound CRL on disk for filez0o600 or 0o400z$Skipping file permissions check for tzrbN)backendz1Permission error reading CRL from disk cache for r~z'Failed to read CRL from disk cache for )rrexistsrZr[rsrwarningrr fromtimestampst_mtimer r_openreadr load_der_x509_crlr rrerror Exception) rr5 crl_file_pathrrfcrl_datarrs rr6zCRLFileCache.get2s//8  $ $] 3 Y Y '')LL#9-!IJ CC// vGWXB=/R !. 2 2 4I$,$:$:!**x||%M mT2,a#$668,00?CTUC(m<1 Y Y) YD,, #  GyPRSTRUV= Y Y> Y!H QSTUSVWXX Y? YDs_FB+D3D'!2D3F'D0 ,D33 F<E$F$ F0F FFFF!c |j|}|j|5 |jjtj j }tjtjztjz}tr|tjz}tj||d} tj||tj||j j#}tj$|||ft&j)d|dddy#tj|wxYw#t*$r%}t&j-d|d|Yd}~Ld}~wwxYw#1swYyxYw)z Store a CRL cache entry to disk. Args: crl_url: The CRL URL entry: The cache entry to store izStored CRL to disk cache: z&Failed to write CRL to disk cache for r~N)rrr public_bytesr EncodingDERosO_WRONLYO_CREATO_TRUNCrO_BINARYrwritecloser timestamputimerZr[rr) rr5r9rrflagsfddownload_timestamprs rr:zCRLFileCache.putasG//8  $ $] 3 X X 9911-2H2H2L2LM bjj02::=R[[(EWW]E59!HHR*HHRL&+%8%8%B%B%D");=O(PQ 9-IJ+ X XHHRL X!GyPRSTRUVWW X/ X XsHFBE;D9AE9EE FE<7F<FFF c  |j}tj|jtj }||j z}||kDS#t$r%}tjd|d|Yd}~yd}~wwxYw)z5Check if the given CRL cache file is by its lifetime.rzError processing cache file r~NF) rrrrr r_rrrrZr)rrr!rr removal_timers r_is_cached_crl_file_for_removalz,CRLFileCache._is_cached_crl_file_for_removals| &++-I$2293E3E(,,WM)4+>+>>L $ $  NN9.9IA3O P sAA BA>>Bctjtj}tj d|d} |j jdD]p}|j||s|j|5|j||r/|jd|dz }tj d|dddry#1swY}xYw#t$r"}tjd |Yd}~yd}~wwxYw) z%Remove expired files from disk cache.z$Cleaning up file-based CRL cache at rz crl_*.derT) missing_okrzRemoved expired file: Nz!Error during file cache cleanup: ) rr^r r_rZr[rqglobrrunlinkrr)rr^rgcrl_filers rr<zCRLFileCache.cleanupsll8<<( ;C5AB  B OO00= N77#F00:N??#N$OOtO<)Q.M"LL+A()LM NN NNN  B LLr'r )rr r'r)rr rr>rr>r'r@r=r?)rr r!rr'r() r)r*r+r,rXrtrrrr6r:rr<r.rrriris "&*.38 ..(.-1 .0V" 7 $$),$>A$ $L-^!XF"(0  BrricReZdZdZ ddZeddZd dZ d dZy) CRLCacheManagerzU Cache manager that coordinates between in-memory and file-based CRL caches. c ||_||_y)z Initialize the cache manager. Args: memory_cache: In-memory cache implementation file_cache: File-based cache implementation N) _memory_cache _file_cache)r memory_cache file_caches rrXzCRLCacheManager.__init__s*%rc4|ttS)zCreate noop cache manager.)rCrHs rnoopzCRLCacheManager.noops<><>22rc|jj|}||S|jj|}||jj|||Stj d|y)z Get a CRL cache entry, checking memory cache first, then file cache. Args: crl_url: The CRL URL Returns: The cache entry if found, None otherwise NzCRL not found in cache for )rr6rr:rZr[r8s rr6zCRLCacheManager.getsu""&&w/  L  $$W-      " "7E 2L 27)<=rct||}|jj|||jj||y)z Store a CRL in both memory and file caches. Args: crl_url: The CRL URL crl: The CRL to store download_time: When the CRL was downloaded N)rrr:r)rr5rrr9s rr:zCRLCacheManager.puts<c=1 w. We,rN)rr0rr0)r'rr=)r5r>rrrrr'r@) r)r*r+r,rX classmethodrr6r:r.rrrrs\ & & &332 - -!? -PX -  -rrc8eZdZUdZdZdZejZdZ de d<ejZ de d<dZ de d<d Zd e d <edd Ze d dd ZeddZeddZeddZeddZeddZeddZy)CRLCacheFactorya* Factory class for creating singleton instances of CRL caches. This factory ensures that only one instance of each cache type exists, providing warnings when attempting to create instances with different parameters. Also manages background cleanup of existing cache instances. Nzthreading.Thread | None_cleanup_threadzthreading.Event_cleanup_shutdownr_cleanup_intervalFr(_atexit_registeredc(|j5|jt||_nH|jj|k7r/tj d|jjd||jcdddS#1swYyxYw)z Get or create a singleton CRLInMemoryCache instance. Args: cache_validity_time: How long cache entries remain valid Returns: The singleton CRLInMemoryCache instance NzNCRLs in-memory cache has already been initialized with cache validity time of z&, ignoring new cache validity time of )_instance_lock_memory_cache_instancerQrTrZr)rHr$s rget_memory_cachez CRLCacheFactory.get_memory_caches   .))1-=>Q-R*++@@DWWdeheefUfUeVV;;N:OQ-- . . .s A1BBc|j5|jt||||_n|jj}|jj}|jj }|xs t }|xs td}||k7rtjd|d|d||k7rtjd|d|||k7rtjd |d ||jcdddS#1swYyxYw) ap Get or create a singleton CRLFileCache instance. Args: cache_dir: Directory to store cached CRLs removal_delay: How long to wait before removing expired files unsafe_skip_file_permissions_check: Skip file permission validation for security Returns: The singleton CRLFileCache instance NrlrmzCCRLs file cache has already been initialized with cache directory 'z!', ignoring new cache directory ''zCCRLs file cache has already been initialized with removal delay of z , ignoring new removal delay of zUCRLs file cache has already been initialized with unsafe_skip_file_permissions_check=z, ignoring new value ) r_file_cache_instancerirqrrrsrprrZr) rHrurvrwexisting_cache_direxisting_removal_delayexisting_skip_checkrequested_cache_dirrequested_removal_delays rget_file_cachezCRLCacheFactory.get_file_cachesG$   ,''/+7}.P,( &)%=%=%H%H"),)A)A)P)P&,,PP$'0&P3N3P#*7*L9!;L'%)<<NN]^p]qr99L8MQP*-DDNN]^t]uv99P8QS'*LLNNoqDpEE..P-QS++= , , ,s C,DD c|j5|jr%tjd|j ||_t j|jdd|_ |js&tj|jd|_ |jjtjd|jddddy#1swYyxYw)z Start the periodic cleanup task for existing cache instances. Args: cleanup_interval: How often to run cleanup tasks zPPeriodic cleanup already running, so it will first be stopped before restarting.zcrl-cache-cleanupT)targetnamedaemonz.Scheduled CRL cache cleanup task to run every z seconds.N)ris_periodic_cleanup_runningrZr[stop_periodic_cleanuprrUThread _cleanup_looprratexitregister_atexit_cleanup_handlerstart total_seconds)rHcleanup_intervals rstart_periodic_cleanupz&CRLCacheFactory.start_periodic_cleanupDs   ..0 f))+$4C !"+"2"2(((#C )) ; ;<)-&    % % ' LL@AQA_A_Aa@bbkl -   s CC--C6cd}|j5|j|jjr dddy|jj |j}ddd|"|j r|j d|j5|jjd|_d|_dddy#1swYkxYw#1swYyxYw)zStop the periodic cleanup task.Nrkr) rrris_setsetis_alivejoinclearr)rHthread_to_joins rrz%CRLCacheFactory.stop_periodic_cleanupfs    1""*c.C.C.J.J.L 1 1  ! ! % % ' 00N  1  %.*A*A*C     ,    )  ! ! ' ' )"&C $(C ! ) ) 1 1 ) )s(C&C)CCC%c|j5|jduxr|jjcdddS#1swYyxYw)z*Check if periodic cleanup task is running.N)rrrrs rrz+CRLCacheFactory.is_periodic_cleanup_running{sH   V&&d2Us7J7J7S7S7U V V Vs *AA c|jjs|jytj d|jj d|j  |j j|j |jj|jj|jj }|rtj dy|jjsyy#t$r"}tjd|Yd}~d}~wwxYw#t$r"}tjd|Yd}~d}~wwxYw)z)Main cleanup loop that runs periodically.Nz1Running periodic CRL cache cleanup with interval z secondsz=An error occurred during scheduled CRL memory cache cleanup: z;An error occurred during scheduled CRL disk cache cleanup: rz9CRL cache cleanup stopped gracefully by a shutdown event.) rrrrZr[rrr<rrrwait)rHrshutdowns rrzCRLCacheFactory._cleanup_loopsR''..0$$, LLCCDYDYDgDgDiCjjrs  ))5..668''3,,446 ,,11--;;=2H OC''..0!LLWXYWZ[!LLUVWUXYs0&D D> D;D66D;> E)E$$E)c |jtjdy#t$r"}tj d|Yd}~yd}~wwxYw)za Atexit handler to ensure graceful shutdown of periodic cleanup on program exit. z5CRL cache cleanup stopped gracefully on program exit.z2Error stopping CRL cache cleanup on program exit: N)rrZr[rr)rHrs rrz'CRLCacheFactory._atexit_cleanup_handlersJ  S  % % ' LLP Q S LLMaSQ R R Ss%( AAAc|j5|jd|_d|_d|_dddy#1swYyxYw)z Reset the factory, clearing all singleton instances and stopping cleanup. This is primarily useful for testing purposes. NF)rrrrrrs rresetzCRLCacheFactory.resetsF    +  % % ')-C &'+C $%*C "  + + +s &<A)r$rr'rQr)rurrvrrwr(r'ri)rrr'r@rA)r'r()r)r*r+r,rrrUrVrrr-Eventrrrrrrrrrrrr r.rrrrs1"$Y__&N04O,3)8)::*.'.$$..("&*.38 /,/,(/,-1 /,  /,/,bB))(VV ##J S S + +rrcl tjS#t$rYnwxYwdtjvrttjdSdtjvrBdtjvr0ttjdtjdz Sdtjvr0ttjdj j Sdtjvr0ttjdj j StdS)N USERPROFILE HOMEDRIVEHOMEPATH LOCALAPPDATAAPPDATA~)r home RuntimeErrorrenvironparentr.rr_get_windows_home_pathrs yy{     "BJJ}-..bjj Z2::%=BJJ{+,rzz*/EEE#BJJ~./66===BJJBJJy)*11888 9s  ""c tjdk(rtdz dz dz dz dz Stjdk(r tjdz dz dz dz Stjd z dz dz S) z/Return the default path to persist cached CRLs.WindowsAppDataLocal SnowflakeCachescrlsDarwinLibraryz.cache)platformsystemrr rr.rrrprpsI% " $           h &yy{Y&1K?&HHyy{X% 3f<r.s"   #!2288+   8 $ % %  % P $s $F 8 4ExEP\B8\B~?-?-DT+T+n  =r