
    ɯeiD                    z   d dl mZ d dlZd dlmZmZ d dlmZ d dlmZm	Z	 d dl
mZ d dlmZ d dlmZ d d	lmZmZ d d
lmZmZmZmZmZmZmZmZ d dlmZ d dlmZ d dl m!Z! d dl"m#Z#m$Z$ d dl%m&Z&m'Z' d dl(m)Z) d dl*m+Z+m,Z, d dl-m.Z. d dl/m0Z0 d dl1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7 d dl8m9Z9 d dl:m;Z;m<Z<  ee=      Z> G d de;      Z?y)    )annotationsN)	b64decode	b64encode)OrderedDict)datetimetimezone)	getLogger)getenv)DigestAlgorithm)IntegerOctetString)CertIdOCSPRequestOCSPResponseRequestRequestsSingleResponse
TBSRequestVersion)Certificate)InvalidSignature)default_backend)hashesserialization)paddingutils)DSAPublicKey)ECDSAEllipticCurvePublicKey)RSAPublicKey)
Connection)&ER_OCSP_RESPONSE_ATTACHED_CERT_EXPIRED&ER_OCSP_RESPONSE_ATTACHED_CERT_INVALID$ER_OCSP_RESPONSE_CERT_STATUS_INVALID"ER_OCSP_RESPONSE_INVALID_SIGNATUREER_OCSP_RESPONSE_LOAD_FAILURE$ER_OCSP_RESPONSE_STATUS_UNSUCCESSFUL)RevocationCheckError)SnowflakeOCSPgenerate_cache_keyc                      e Zd ZdZej
                  ej                  ej                  dZd Z	ddZ
d Zd ZdddZ	 	 	 	 	 	 ddZd	 Zd
 Zd Z	 	 	 	 ddZd Z	 	 	 	 	 	 d fdZ	 ddZd Zd Z	 	 	 	 ddZ	 	 	 	 ddZddZ xZS )SnowflakeOCSPAsn1CryptozOCSP checks by asn1crypto.)sha256sha384sha512c                    |\  }}}t        j                  |      }t        j                  |      }t        j                  |      }t        t	        dd d      |||d      }|S )Nsha1	algorithm
parametershash_algorithmissuer_name_hashissuer_key_hashserial_number)r   loadr   r   r   )selfhkeyr7   r8   r9   cert_ids         e/var/www/html/glpi_dashboard/venv/lib/python3.12/site-packages/snowflake/connector/ocsp_asn1crypto.pyencode_cert_id_keyz*SnowflakeOCSPAsn1Crypto.encode_cert_id_key9   sp    ;?8/=&++,<=%**?;]3"1"(=# %5#2!.	
     c                    t        |      S N)r*   )r;   r=   s     r>   decode_cert_id_keyz*SnowflakeOCSPAsn1Crypto.decode_cert_id_keyJ   s    !'**r@   c                >    t        j                  t        |            S rB   )r   r:   r   )r;   cert_id_base64s     r>   decode_cert_id_base64z-SnowflakeOCSPAsn1Crypto.decode_cert_id_base64M   s    {{9^455r@   c                p    t        | j                  |      j                               j                  d      S Nascii)r   r?   dumpdecode)r;   r<   s     r>   encode_cert_id_base64z-SnowflakeOCSPAsn1Crypto.encode_cert_id_base64P   s,    006;;=>EEgNNr@   c                d   |t         j                  }t        j                  d|       t	        |d      5 }ddlm} |j                  |j                         d      }|D ]:  \  }}}|dk(  st        j                  |      }	|	||	j                  j                  <   < 	 ddd       y# 1 sw Y   yxY w)	z>Reads a certificate file including certificates in PEM format.Nzreading certificate bundle: %srbr   )pemT)multipleCERTIFICATE)r)   ROOT_CERTIFICATES_DICTloggerdebugopen
asn1cryptorO   unarmorreadr   r:   subjectr-   )
r;   ca_bundle_filestorage	all_certsrO   	pem_certs	type_name_	der_bytescrts
             r>   read_cert_bundlez(SnowflakeOCSPAsn1Crypto.read_cert_bundleS   s    ?#::G5~F.$' 	69&INN$4tDI+4 6'	1i-%**95C25GCKK../6	6 	6 	6s   6B&,0B&&B/c                8   t        t        ddd      t        |j                  j                        t        |j
                  j                        |j                  d      }t        dt        t        d      t        t        d|i      g      d      i      }||fS )	zCreates CertId and OCSPRequest.r1   Nr2   r5   tbs_requestr   req_cert)versionrequest_list)r   r   r   issuerr1   
public_keyr9   r   r   r   r   r   )r;   rh   rY   r=   ocsp_requests        r>   create_ocsp_requestz+SnowflakeOCSPAsn1Crypto.create_ocsp_requestb   s     "1"(=# %00C0C$D#.v/@/@/E/E#F!(!6!6	
 #z#*1:(0 '(2G%&!") 
$ $$r@   c                4    |j                   }|r|d   }|S d }|S )Nr   )	ocsp_urls)r;   certurlsocsp_urls       r>   extract_ocsp_urlz(SnowflakeOCSPAsn1Crypto.extract_ocsp_url   s'    ~~"47 )-r@   c                "    |j                         S rB   )rJ   )r;   rj   s     r>   decode_ocsp_requestz+SnowflakeOCSPAsn1Crypto.decode_ocsp_request   s      ""r@   c                \    | j                  |      }t        |      j                  d      }|S rH   )rs   r   rK   )r;   rj   datab64datas       r>   decode_ocsp_request_b64z/SnowflakeOCSPAsn1Crypto.decode_ocsp_request_b64   s+    ''5D/((1r@   c                F    |d   j                   }|d   j                   }||fS )zExtracts GOOD status.this_updatenext_updatenative)r;   single_responsethis_update_nativenext_update_natives       r>   extract_good_statusz+SnowflakeOCSPAsn1Crypto.extract_good_status   s2     -];BB,];BB!#555r@   c                P    |d   }|j                   d   }|j                   d   }||fS )zExtracts REVOKED status.cert_statusrevocation_timerevocation_reasonr{   )r;   r}   revoked_infor   r   s        r>   extract_revoked_statusz.SnowflakeOCSPAsn1Crypto.extract_revoked_status   s;    &}5&--.?@(//0CD 111r@   c                    |d   d   d   j                   }|d   d   d   j                   }||kD  s||k  r dj                  |||t        |         }d|fS y)Ntbs_certificatevalidity
not_before	not_afterzCertificate attached to OCSP response is invalid. OCSP response current time - {} certificate not before time - {} certificate not after time - {}. Consider running curl -o ocsp.der {}F)TN)r|   formatsuperdebug_ocsp_failure_url)r;   cur_time	ocsp_cert	val_startval_end	debug_msg	__class__s         r>   check_cert_time_validityz0SnowflakeOCSPAsn1Crypto.check_cert_time_validity   s     /0<\JQQ	-.z:;GNNgI!5LLRFG2	M  )##r@   c                   t        j                  |      }|d   j                  dk7  r-t        dj	                  |d   j                        t
              |j                  }|d   j                  r|d   d   }t        j                  d|d   d	   d
   j                         t        j                  t        j                        }	 | j                  ||      \  }}|st        j                  |       y|d   }	|	d   d   }
|
d   j                  }	 |dk(  r| j                  |
||       y# t         $ r }t        j                  d|       Y d }~yd }~ww xY w)Nresponse_status
successfulInvalid Status: {}msgerrnocertsr   zOVerifying the attached certificate is signed by the issuer. Valid Not After: %sr   r   r   Ftbs_response_data	responsesr   goodz#Failed to validate ocsp response %sT)r   r:   r|   r(   r   r'   basic_ocsp_responserS   rT   r   nowr   utcr   name_process_good_status	Exception)r;   r=   ocsp_responseresr   r   r   
cert_validr   r   r}   r   exs                r>   is_valid_timez%SnowflakeOCSPAsn1Crypto.is_valid_time   s\   . !((L8&(//4E0F0M0MN: 
 "55w'..+G4Q7ILL2+,Z8ELL  ||HLL1H
 %)$A$A(I$V!J	Y'/0CD+K8;%m499	f$))/7MR
 	  	LL>C	s   D( (	E1EEc                   	 t        j                  |      }| j                  t        d      }|t	        dt
              |d   j                  dk7  r-t	        dj                  |d   j                        t              |j                  }|d	   j                  rt        j                  d
       |d	   d   }t        j                  d       t        j                  d|d   d   d   j                         t        j                  t        j                         }	 	 | j#                  |j$                  |j&                  ||d          | j-                  ||      \  }
}|
s(t	        |t.              t        j                  d       |}|d   }t        j                  d       	 | j#                  |d   j$                  |d   j                  ||       |d   d   }|d   j2                  }| j                  "t        d      }|dk(  rd}n|dk(  rd}n|dk(  rd}	 |dk(  r| j5                  |||       y |dk(  r| j7                  ||       y |dk(  r| j9                  |       y dj                  |      }t	        |t:              # t        $ r t	        dt
              w xY w# t        $ r }	t	        |	j(                  t*              d }	~	ww xY w# t        $ r }	t	        |	j(                  t0              d }	~	ww xY w# t        $ rB}dj                  |j(                  | j<                        }t	        ||j>                        d }~ww xY w)N$SF_TEST_OCSP_FORCE_BAD_OCSP_RESPONSEz
Force fail)r   zInvalid OCSP Responser   r   r   r   r   z.Certificate is attached in Basic OCSP Responser   z:Verifying the attached certificate is signed by the issuerzValid Not After: %sr   r   r   zNCertificate is NOT attached in Basic OCSP Response. Using issuer's certificater   z4Verifying the OCSP response is signed by the issuer.signature_algorithm	signaturer   r   SF_TEST_OCSP_CERT_STATUSrevokedunknownr   zJUnknown revocation status was returned.OCSP response may be malformed: {}.z'{} Consider running curl -o ocsp.der {}) r   r:   	test_moder
   r(   r&   r   r|   r   r'   r   rS   rT   r   r   r   r   verify_signature	hash_algor   r   r#   r   r"   r%   r   r   _process_revoked_status_process_unknown_statusr$   r   r   )r;   rh   r=   r   r   ocsp_load_failurer   r   r   rcer   r   r   r}   r   test_cert_statusop_ers                    r>   process_ocsp_responsez-SnowflakeOCSPAsn1Crypto.process_ocsp_response   sk   	##M2C~~)$*+Q$R!$0.$,I   !((L8&(//4E0F0M0MN: 
 "55w'..LLIJ+G4Q7ILLO LL%+,Z8ELL
  ||HLL1H %%''''/0	 %)$A$A(I$V!J	*!)O 
 LL- I/0CDKL
	!!#$9:DD#K077!	 ,K8;%m499>>%%&@A9,'!Y.'!V+$	If$))/7MR	),,_gF	),,W5::@&:M  +!)M y  	&+3P 	H ( *'M 8 $ 	&GG#E 	> $ 	IAHH		466I '9EKKHH		Ise   ?I> ,J  .K K4 -K4 K4 "K4 >J	K%K  K	K1K,,K14	L?==L::L?c                0   t               }t        j                  |j                  j	                         t                     }|t
        j                  v rt        j                  |          }nt        j                         }t        j                  ||      }|j                  |j	                                |j                         }	t               }
t        |t              r0t        j                          |
d<   t#        j$                  |      |
d<   nZt        |t&              rt#        j$                  |      |
d<   n1t        |t(              r!t+        t#        j$                  |            |
d<   	  |j,                  ||	fi |
 y # t.        $ r t1        d      w xY w)N)backendr   r3   r   zFailed to verify the signaturer   )r   r   load_der_public_keyri   rJ   r,   #SIGNATURE_ALGORITHM_TO_DIGEST_CLASSr   SHA1Hashupdatefinalizedict
isinstancer    r   PKCS1v15r   	Prehashedr   r   r   verifyr   r(   )r;   r   r   rn   ru   r   ri   chosen_hashhasherdigestadditional_kwargss              r>   r   z(SnowflakeOCSPAsn1Crypto.verify_signaturea  s]   !#"66OO  "O,=

  &JJK 2UU# K
 !++-K['2diik""376j,/+2+;+;+=i(-2__[-Ik*
L1-2__[-Ik*
$:;7<,834	MJ $
   	M&+KLL	Ms   *E? ?Fc                d   ddl m}m} t               }|j	                         }t
        j                  dt        |             | j                          |D ]  } |||      }t        j                  |      }t
        j                  d|j                  j                  |j                  j                         |||j                  j                  <   |j                  j                  t        j                   v st
        j                  d|j                  j                          n | j#                  |      S )zHGets certificate chain and extract the key info from OpenSSL connection.r   )FILETYPE_ASN1dump_certificatez# of certificates: %szsubject: %s, issuer: %szCA trusted root certificate found: %s, stopping chain traversal here)OpenSSL.cryptor   r   r   get_peer_cert_chainrS   rT   len_lazy_read_ca_bundler   r:   rY   r|   rh   r-   r)   rR   create_pair_issuer_subject)	r;   
connectionr   r   cert_map
cert_chaincert_opensslcert_derrn   s	            r>   extract_certificate_chainz1SnowflakeOCSPAsn1Crypto.extract_certificate_chain  s     	C=335
,c*o>!!#& 	L'|DH##H-DLL)4<<+>+>@R@R -1HT\\((){{!!]%I%IIYLL'' 	 ..x88r@   c                   g }|D ]  }||   }|j                   s|j                  r|j                  s-|j                  j                  }||vrl| j                          t        j                  d|j                  j                         |t        j                  vrt        d      t        j                  |   }n||   }|j                  ||f        |S )z1Creates pairs of issuer and subject certificates.znot found issuer_der: %szCA certificate is NOT found in the root certificate list. Make sure you use the latest Python Connector package and the URL is valid.r   )ocsp_no_check_valuecarm   rh   r-   r   rS   rT   r|   r)   rR   r(   append)r;   r   issuer_subjectsubject_derrY   issuer_hashrh   s          r>   r   z2SnowflakeOCSPAsn1Crypto.create_pair_issuer_subject  s     # 	5K{+G**gjjARAR !..//K(* ))+79N9NOm&J&JJ.I 
 '==kJ!+.!!67"34-	5. r@   c                .    |j                   j                  S rB   )rY   r|   )r;   rY   s     r>   subject_namez$SnowflakeOCSPAsn1Crypto.subject_name  s    %%%r@   )r=   r   returnztuple[bytes, bytes, bytes]rB   )r   None)rh   r   rY   r   r   ztuple[CertId, OCSPRequest])r}   r   r   ztuple[datetime, datetime])r   r   r   r   r   ztuple[bool, str | None])r   bool)r   r!   r   %list[tuple[Certificate, Certificate]])r   r   r   r   )rY   r   r   r   )__name__
__module____qualname____doc__r   SHA256SHA384SHA512r   r?   rC   rF   rL   rb   rk   rq   rs   rw   r   r   r   r   r   r   r   r   r   __classcell__)r   s   @r>   r,   r,   /   s    $ ------+'"+6O6"%"% "% 
$	"%H
#
6-6	"62 -8	 ,0dlI\#MJ9$9	.94#	.<&r@   r,   )@
__future__r   typingbase64r   r   collectionsr   r   r   loggingr	   osr
   asn1crypto.algosr   asn1crypto.corer   r   asn1crypto.ocspr   r   r   r   r   r   r   r   asn1crypto.x509r   cryptography.exceptionsr   cryptography.hazmat.backendsr   cryptography.hazmat.primitivesr   r   )cryptography.hazmat.primitives.asymmetricr   r   -cryptography.hazmat.primitives.asymmetric.dsar   ,cryptography.hazmat.primitives.asymmetric.ecr   r   -cryptography.hazmat.primitives.asymmetric.rsar    OpenSSL.SSLr!   snowflake.connector.errorcoder"   r#   r$   r%   r&   r'   snowflake.connector.errorsr(   "snowflake.connector.ocsp_snowflaker)   r*   r   rS   r,    r@   r>   <module>r     sv    "  ' # '   , 0	 	 	 ( 4 8 @ D F V F "  < P	8	P&m P&r@   