
    ɯei2                   
   U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlmZmZ d dlmZmZ d dlmZ d dlmZmZ d dlmZ d dlmZmZ d d	l
mZmZ d d
lmZmZ d dlmZm Z m!Z! d dl"m#Z# d dl$m%Z% d dl&m'Z' d dl(m)Z)m*Z*m+Z+ d dl,m-Z- d dl.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z=m>Z>m?Z?m@Z@mAZA d dlBmCZC d dlDmEZE d dlFmGZG d dlHmIZI ddlJmKZK ddlLmMZM ddlNmOZOmPZPmQZQ ddlKmRZR ddlSmTZT ddlUmVZVmWZW ddlXmYZYmZZZ ddl[m\Z\  G d d e      Z] G d! d"eQ      Z^	  e^eKj                  ej&                  j                  d#d$d%d&      ej&                  j                  d#d'd(d)d&      ej&                  j                  d#d*d+d)d(d&      d,-      Zad.ebd/<    eed      Ze	 	 	 	 d;d2Zf G d3 d4      Zg G d5 d6      Zh G d7 d8      Zieij                           G d9 d:      Zky# ec$ r  ePeKj                  0      Zad1ebd/<   Y hw xY w)<    )annotationsN)	b64decode	b64encode)datetimetimezone)	getLogger)environpath)
expanduser)LockRLock)gmtimestrftime)Any
NamedTuple)CertIdOCSPRequestSingleResponse)Certificate)
Connection)SNOWFLAKE_CONNECTOR_VERSION)OKurlsplit
urlunparse)HTTP_HEADER_USER_AGENT)ER_INVALID_OCSP_RESPONSE_SSDER_INVALID_SSD&ER_OCSP_FAILED_TO_CONNECT_CACHE_SERVER&ER_OCSP_RESPONSE_ATTACHED_CERT_EXPIRED&ER_OCSP_RESPONSE_ATTACHED_CERT_INVALID$ER_OCSP_RESPONSE_CACHE_DECODE_FAILED&ER_OCSP_RESPONSE_CACHE_DOWNLOAD_FAILED$ER_OCSP_RESPONSE_CERT_STATUS_INVALID$ER_OCSP_RESPONSE_CERT_STATUS_REVOKED$ER_OCSP_RESPONSE_CERT_STATUS_UNKNOWNER_OCSP_RESPONSE_EXPIRED ER_OCSP_RESPONSE_FETCH_EXCEPTIONER_OCSP_RESPONSE_FETCH_FAILURE,ER_OCSP_RESPONSE_INVALID_EXPIRY_INFO_MISSING"ER_OCSP_RESPONSE_INVALID_SIGNATUREER_OCSP_RESPONSE_LOAD_FAILURE$ER_OCSP_RESPONSE_STATUS_UNSUCCESSFULER_OCSP_RESPONSE_UNAVAILABLEER_OCSP_URL_INFO_MISSING)RevocationCheckError)PYTHON_CONNECTOR_USER_AGENT)SessionManager)get_current_session_manager   )	constants)exponential_backoff)
CacheEntrySFDictCacheSFDictFileCache)4OCSP_ROOT_CERTS_DICT_LOCK_TIMEOUT_DEFAULT_NO_TIMEOUT)SessionManagerFactory)TelemetryFieldgenerate_telemetry_data_dict)&extract_top_level_domain_from_hostnameurl_encode_str)_base64_bytes_to_strc                      e Zd ZU dZded<   dZded<   dZded<   dZded<   dZd	ed
<   dZ	ded<   dZ
ded<   d Zedd       Zy)OCSPResponseValidationResultNException | None	exceptionCertificate | NoneissuersubjectzCertId | Nonecert_idzbytes | Noneocsp_responsez
int | NonetsFbool	validatedc           
        d }t        j                   || j                        | j                  r#t	        | j                  j                               nd | j                  r#t	        | j                  j                               nd | j                  r#t	        | j                  j                               nd t	        | j                        | j                  | j                  d      S )Nc                    | sy t        |       }|j                  |j                  d}t        | t              r*|j                  | j                  | j                  d       |S |j                  dt        |       i       |S )N)classmodule)errnomsgrQ   )	type__name__
__module__
isinstancer/   updaterP   raw_msgstr)excexc_typerets      d/var/www/html/glpi_dashboard/venv/lib/python3.12/site-packages/snowflake/connector/ocsp_snowflake.pyserialize_exceptionzDOCSPResponseValidationResult._serialize.<locals>.serialize_exceptionN   sp     CyH$--9L9LMC#34

SYYs{{CD J 

E3s8,-J    rC   rE   rF   rG   rH   rI   rK   )jsondumpsrC   rE   r?   dumprF   rG   rH   rI   rK   )selfr]   s     r\   
_serializez'OCSPResponseValidationResult._serializeM   s    	" zz0@@D()9)9);<QU BF():):)<=SW BF():):)<=SW!5d6H6H!Igg!^^
 	
r^   c                   t        j                  |      }d
d}t         ||j                  d            |j                  d      r-t	        j
                  t        |j                  d                  nd |j                  d      r-t	        j
                  t        |j                  d                  nd |j                  d      r-t        j
                  t        |j                  d                  nd |j                  d      rt        |j                  d            nd |j                  d      |j                  d      	      S )Nc           
        | sy | j                  d      }| j                  d      }	 |dk(  r|dk(  rt        | d   | d         S t        j                  |      }t	        ||      } || d         S # t
        $ rb}t        j                  dt        |       d	| d
| d           t        dt        |       dt        j                   t              cY d }~S d }~ww xY w)NrN   rO   r/   zsnowflake.connector.errorsrQ   rP   rQ   rP   zhitting error zO while deserializing exception, the original error error class and message are z and z
Got error zW while deserializing ocsp cache, please try cleaning up the OCSP cache under directory )getr/   	importlibimport_modulegetattr	ExceptionloggerdebugrX   OCSP_RESPONSE_VALIDATION_CACHE	file_pathr+   )exception_dict	exc_class
exc_modulerO   exc_clsdeserialize_excs         r\   deserialize_exceptionzHOCSPResponseValidationResult._deserialize.<locals>.deserialize_exceptionu   s    "&**73I'++H5J!77"&BB/*51,W5 
 '44Z@F%fi8G">%#899 
$S%9$: ;GGPkQVWefkWlVmo ,$S%9$: ;22P2Z2Z1[] 8	 
s$   A0 +A0 0	C9ACCCrC   rE   rF   rG   rH   rI   rK   r_   )rq   zdict | NonereturnrB   )r`   loadsrA   rh   r   loadr   r   )clsjson_strjson_objrv   s       r\   _deserializez)OCSPResponseValidationResult._deserializeq   s    ::h'	B ,+HLL,EF <<)   8<<+A!BC <<	*   8<<	+B!CD <<	* Ihll9&=>? <<0 (,,78||D!ll;//
 	
r^   )r{   rX   rw   rA   )rS   rT   __qualname__rC   __annotations__rE   rF   rG   rH   rI   rK   rd   classmethodr}    r^   r\   rA   rA   D   se    "&I&!%F%"&G&!G]!"&M<&B
It"
H <
 <
r^   rA   c                  &    e Zd ZddZedd       Zy)"_OCSPResponseValidationResultCachec                   | j                   j                         D ci c]a  \  }}t        |d         t        |d         t        |d         f|j                  j	                         |j
                  j                         fc }}}t        j                  t        |j                               t        |j                               | j                  j                         t        | j                        | j                   | j"                  r| j"                  j	                         nd | j$                  t&        d      j)                         S c c}}w )Nr   r3      )
cache_keyscache_itemsentry_lifetimerp   file_timeoutlast_loaded	telemetryconnector_version)_cacheitemsr?   expiry	isoformatentryrd   r`   ra   listkeysvalues_entry_lifetimetotal_secondsrX   rp   r   r   r   r   encode)rc   kventriess       r\   rd   z-_OCSPResponseValidationResultCache._serialize   s    ))+
 1	 %QqT*$QqT*$QqT* ""$agg&8&8&:;	<
 
 zz"7<<>2#GNN$45"&"6"6"D"D"F 0 $ 1 1484D4DD$$..0$!^^%@
 &(	
s   A&E
c           	     Z   t        j                  |j                         j                               } | |d   t	        |d         |d   d      }t
        j                  j                  |d         |_        |d   |_	        |d   rt        j                  |d         nd |_        t        |d   |d	         D ]q  \  }}t        t        j                  |d
         t        j!                  |d               |j"                  t%        |d
         t%        |d         t%        |d         f<   s |S )Nrp   r   r   F)rp   r   r   load_if_file_existsr   r   r   r   r   r3   r   )r`   rx   readdecodeintosr
   r   rp   r   r   fromisoformatr   zipr6   rA   r}   r   r   )rz   	opened_fddatacache_instancer   r   s         r\   r}   z/_OCSPResponseValidationResultCache._deserialize   s)   zz)..*1134;'t$456n- %	
 $&77#5#5d;6G#H #'#4 ;?;NH""4#67TX 	" \*D,?@ 	DAq &&qt,,99!A$? !!1Q4)AaD/9QqT?C	 r^   N)rw   bytes)rw   r   )rS   rT   r~   rd   r   r}   r   r^   r\   r   r      s    2  r^   r   ~.cache	snowflakez#ocsp_response_validation_cache.jsonLibraryCaches	SnowflakeAppDataLocal)linuxdarwinwindows)r   rp   zISFDictFileCache[tuple[bytes, bytes, bytes], OCSPResponseValidationResult]ro   )r   zESFDictCache[tuple[bytes, bytes, bytes], OCSPResponseValidationResult]c                r    | d   j                         | d   j                         | d   j                         fS )Nissuer_name_hashissuer_key_hashserial_number)rb   rG   s    r\   generate_cache_keyr     sC     	"#((*!"'') %%' r^   c                  L   e Zd ZdZdZdZdZdZdZdZ	dZ
d	Zd
ZdZdZdZdZdZdZdZdZdZi eeeeeeeeeeee	ee
eeeeeee ee!ee"ee#ee$ee%ee&ee'ee(eiZ)d#dZ*d$dZ+d%dZ,d#dZ-d#dZ.d#dZ/d#dZ0d#dZ1d#dZ2d#dZ3d#dZ4d#dZ5d#d Z6	 d&	 	 	 	 	 d'd!Z7y")(OCSPTelemetryDataCertificateExtractionFailedOCSPURLMissingOCSPResponseUnavailableOCSPResponseFetchException&OCSPResponseFailedToConnectCacheServerOCSPResponseCertStatusInvalidOCSPResponseCertStatusRevokedOCSPResponseCertStatusUnknownOCSPResponseStatusUnsuccessfulOCSPResponseAttachedCertInvalidOCSPResponseAttachedCertExpiredOCSPResponseSignatureInvalidOCSPResponseExpiryInfoMissingOCSPResponseExpiredOCSPResponseFetchFailureOCSPResponseCacheDownloadFailedOCSPResponseCacheDecodeFailedOCSPResponseLoadFailureOCSPResponseInvalidSSDc                    d | _         d | _        d | _        d | _        d | _        d | _        d | _        d| _        d| _        d| _	        d| _
        y NF)event_sub_typeocsp_connection_methodrG   sfc_peer_hostocsp_urlocsp_req	error_msgcache_enabled	cache_hit	fail_opendisable_ocsp_checksrc   s    r\   __init__zOCSPTelemetryData.__init__B  sT    "&*#!"#( r^   c                X    | j                   | j                    d| | _         y|| _         y)a  
        Sets sub type for OCSP Telemetry Event.

        There can be multiple event_sub_type that could have happened
        during a single connection establishment. Ensure that all of them
        are captured.
        :param event_sub_type:
        :return:
        N|)r   )rc   r   s     r\   set_event_sub_typez$OCSPTelemetryData.set_event_sub_typeO  s3     *%)%8%8$9>:J"KD"0Dr^   c                    || _         y N)r   )rc   ocsp_conn_methods     r\   set_ocsp_connection_methodz,OCSPTelemetryData.set_ocsp_connection_method^  s
    &6#r^   c                    || _         y r   r   rc   rG   s     r\   set_cert_idzOCSPTelemetryData.set_cert_ida  s	    r^   c                    || _         y r   )r   )rc   r   s     r\   set_sfc_peer_hostz#OCSPTelemetryData.set_sfc_peer_hostd  s
    *r^   c                    || _         y r   )r   )rc   r   s     r\   set_ocsp_urlzOCSPTelemetryData.set_ocsp_urlg  	     r^   c                    || _         y r   )r   )rc   r   s     r\   set_ocsp_reqzOCSPTelemetryData.set_ocsp_reqj  r   r^   c                    || _         y r   )r   )rc   r   s     r\   set_error_msgzOCSPTelemetryData.set_error_msgm  	    "r^   c                &    || _         |sd| _        y y r   r   r   )rc   r   s     r\   set_cache_enabledz#OCSPTelemetryData.set_cache_enabledp  s    *"DN r^   c                :    | j                   sd| _        y || _        y r   r   )rc   r   s     r\   set_cache_hitzOCSPTelemetryData.set_cache_hitu  s    !!"DN&DNr^   c                    || _         y r   )r   )rc   r   s     r\   set_fail_openzOCSPTelemetryData.set_fail_open{  r   r^   c                    || _         y r   r   )rc   insecure_modes     r\   set_insecure_modez#OCSPTelemetryData.set_insecure_mode  s
    #0 r^   c                    || _         y r   r   )rc   r   s     r\   set_disable_ocsp_checksz)OCSPTelemetryData.set_disable_ocsp_checks  s
    #6 r^   c                T   t        j                         \  }}}t        t        j                  j
                  |t        j                  j
                  | j                  t        j                  j
                  | j                  t        j                  j
                  | j                  t        j                  j
                  | j                  t        j                  j
                  | j                  t        j                   j
                  | j"                  t        j$                  j
                  | j&                  t        j(                  j
                  | j*                  t        j,                  j
                  | j.                  t        j0                  j
                  | j2                  id      }|S )NT)	from_dictis_oob_telemetry)sysexc_infor<   r;   KEY_OOB_EVENT_TYPEvalueKEY_OOB_EVENT_SUB_TYPEr   KEY_OOB_SFC_PEER_HOSTr   KEY_OOB_CERT_IDrG   KEY_OOB_OCSP_REQUEST_BASE64r   KEY_OOB_OCSP_RESPONDER_URLr   KEY_OOB_ERROR_MESSAGEr   KEY_OOB_INSECURE_MODEr   KEY_OOB_FAIL_OPENr   KEY_OOB_CACHE_ENABLEDr   KEY_OOB_CACHE_HITr   )rc   
event_typeurgent_rC   telemetry_datas         r\   generate_telemetry_dataz)OCSPTelemetryData.generate_telemetry_data  s    ,,.9a5117755;;T=P=P44::D<N<N..44dll::@@$--99??44::DNN44::D<T<T006644::D<N<N0066 "
" r^   Nrw   None)r   rX   rw   r  )r   rX   rw   r  F)r  rX   r  rJ   rw   zdict[str, Any])8rS   rT   r~   CERTIFICATE_EXTRACTION_FAILEDOCSP_URL_MISSINGOCSP_RESPONSE_UNAVAILABLEOCSP_RESPONSE_FETCH_EXCEPTION,OCSP_RESPONSE_FAILED_TO_CONNECT_CACHE_SERVER!OCSP_RESPONSE_CERT_STATUS_INVALID!OCSP_RESPONSE_CERT_STATUS_REVOKED!OCSP_RESPONSE_CERT_STATUS_UNKNOWN!OCSP_RESPONSE_STATUS_UNSUCCESSFUL#OCSP_RESPONSE_ATTACHED_CERT_INVALID#OCSP_RESPONSE_ATTACHED_CERT_EXPIREDOCSP_RESPONSE_INVALID_SIGNATURE!OCSP_RESPONSE_EXPIRY_INFO_MISSINGOCSP_RESPONSE_EXPIREDOCSP_RESPONSE_FETCH_FAILURE#OCSP_RESPONSE_CACHE_DOWNLOAD_FAILED!OCSP_RESPONSE_CACHE_DECODE_FAILEDOCSP_RESPONSE_LOAD_FAILUREOCSP_RESPONSE_INVALID_SSDr.   r-   r'   r   r#   r$   r%   r,   r    r   r*   r)   r&   r(   r+   r"   r!   r   r   ERROR_CODE_MAPr   r   r   r   r   r   r   r   r   r   r   r   r   r  r   r^   r\   r   r     s   $A!' 9$@!0 1 )H%(G%(G%(H%*K'*K'&D#(G%1"<*K'(G%!: 8 "2$&? 	)*G 	/0\	
 	-.O 	-.O 	-.O 	-.O 	/0S 	/0S 	+,K 	56W 	!"7 	'(C 	&'A  	/0S!" 	-.O#$ 	%&?1'N,)17+!!##
'#17 /4'+	r^   r   c                      e Zd Z e ej
                  dd            ZddZedd       Z	ddZ
ddZd Zeddd       Zd	 Zy
)
OCSPServerOCSP_MAX_RETRY3c                   |j                  dt        j                        }d| | _        	 d| d| _        t
        j                         sDt        j                  ddj                  | j                  t        j                              | _        nt        j                  d      | _        t        j                  dd      d	k7  | _        d | _        y )
Ntop_level_domainzhttp://ocsp.snowflakecomputing.z#https://ocspssd.snowflakecomputing./ocsp/!SF_OCSP_RESPONSE_CACHE_SERVER_URLz{}/{}%SF_OCSP_RESPONSE_CACHE_SERVER_ENABLEDtruefalse)popr4   _DEFAULT_HOSTNAME_TLDDEFAULT_CACHE_SERVER_URL!NEW_DEFAULT_CACHE_SERVER_BASE_URLr*  is_enabled_new_ocsp_endpointr   getenvformat	OCSPCacheOCSP_RESPONSE_CACHE_FILE_NAMECACHE_SERVER_URLCACHE_SERVER_ENABLEDOCSP_RETRY_URL)rc   kwargsr.  s      r\   r   zOCSPServer.__init__  s    !::	 ? ?
 ..>-?@ 	%	 22B1C6J 	. 668$&II311;;%D! %'II.Q$RD! II=vF'Q 	! #r^   c                 P    t        j                  dd      j                         dk(  S )z-Checks if new OCSP Endpoint has been enabled.SF_OCSP_ACTIVATE_NEW_ENDPOINTr3  r2  )r   r9  lowerr   r^   r\   r8  z'OCSPServer.is_enabled_new_ocsp_endpoint  s$     yy8'BHHJfTTr^   c                   t        |      }d|v rdj                  d|dg      }nvd|v r)||j                  d      d }dj                  d|dg      }nI|j                  d	|       s| j                  }n(||j                  d
      d }dj                  d|dg      }dj                  |dg      | _        dj                  |dg      | _        y)aj  Resets current object members CACHE_SERVER_URL and RETRY_URL_PATTERN.

        They will point at the new OCSP Fetch and Retry endpoints respectively. The new OCSP Endpoint address is based
        on the hostname the customer is trying to connect to. The deployment or in case of client failover, the
        replication ID is copied from the hostname.
        zprivatelink.snowflakecomputing. zhttps://ocspssd.r/  zglobal.snowflakecomputing.-Nzhttps://ocspssdzsnowflakecomputing..fetchretry)r=   joinfindendswithr7  r=  r?  )rc   hnamer.  temp_ocsp_endpointrep_id_beginhname_wo_accs         r\   reset_ocsp_endpointzOCSPServer.reset_ocsp_endpoint  s     B%H,5!#*<eX)N!O)U2 C!23L!#*;\8)T!U"56F5G HI!%!G!G C!23L!#*;\8)T!U ");W(E F gg'97&CDr^   c                   ||| _         | j                   r!t        j                  d| j                         nt        j                  d       | j                  s| j                  g| j                  j                  | j                        sBt        | j                        }t        |j                  |j                  ddddf       d| _        t        j                  d| j                         y)ztResets OCSP dynamic cache server url pattern.

        This is used only when OCSP cache server is updated.
        Nz)OCSP response cache server is enabled: %sz&OCSP response cache server is disabledrE  z/retry/{0}/{1}z'OCSP dynamic cache server RETRY URL: %s)r>  rm   rn   r=  r?  
startswithr6  r   r   schemenetloc)rc   use_ocsp_cache_server
parsed_urls      r\   #reset_ocsp_dynamic_cache_server_urlz.OCSPServer.reset_ocsp_dynamic_cache_server_url  s    
 !,(=D%$$LL;T=R=R LLAB&$$0))44T5R5RS &d&;&;<
)3Z5F5F
HYHY[]_acegi4j)k(ll~&#>@S@STr^   c                   | j                   r	 t        j                  || j                        }|st	        dt
              t        j                  d| j                         t        j                  dt        t        j                               y y # t        $ r(}t        j                  d|j                  z          d }~ww xY w)NzOCSP Cache Server Unavailable.rg   z+downloaded OCSP response cache file from %sz# of certificates: %uz~OCSP Response cache download failed. The clientwill reach out to the OCSP Responder directly forany missing OCSP responses %s
)r>  r*  _download_ocsp_response_cacher=  r/   r"   rm   rn   lenro   r   rQ   )rc   ocspretvalrces       r\   download_cache_from_serverz%OCSPServer.download_cache_from_server  s    $$#AA$// .<D  A4CXCX
 +6==># %* ( 68;@
 s   B B 	C#B<<Cc                Z   t         t        i}t        j                  }	 t	        j                         }t
        j                  d|       | j                  =t        j                  dd      }t        j                  dd      }|t        |      }||}t        d      xs t        j                  d      }|j                  |      5 }	|rt        j                  nd}
d} t!                      }t#        |
      D ]  }|	j%                  |||      }|j&                  t(        k(  rN| j+                  |j-                                t	        j                         |z
  }t
        j                  d	|        ni|
dkD  s~t/        |      }t
        j                  d
|j&                  |       t	        j0                  |        t
        j3                  d|
       	 ddd       y	 ddd       y# 1 sw Y   yxY w# t4        $ r3}t
        j                  d||       t7        d| d| t8              d}~ww xY w)z4Downloads OCSP response cache from the cache server.z0started downloading OCSP response cache file: %sN,SF_TEST_OCSP_CACHE_SERVER_CONNECTION_TIMEOUTSF_TEST_OCSP_CACHE_SERVER_URLFuse_poolingr3   )timeoutheadersz=ended downloading OCSP response cache file. elapsed time: %ss*OCSP server returned %s. Retrying in %s(s)z-Failed to get OCSP response after %s attempt.Tz-Failed to get OCSP response cache from %s: %sz'Failed to get OCSP Response Cache from z: rg   )r   r0   SnowflakeOCSP$OCSP_CACHE_SERVER_CONNECTION_TIMEOUTtimerm   rn   	test_moder   r9  r   r2   r:   get_manageruse_sessionOCSP_CACHE_SERVER_MAX_RETRYr5   rangerh   status_coder   decode_ocsp_response_cacher`   nextsleeperrorrl   r/   r   )r\  urldo_retryrf  
sf_timeout
start_timetest_timeoutsf_cache_server_urlsession_managersession	max_retry
sleep_timebackoffr  responseelapsed_timees                    r\   rZ  z(OCSPServer._download_ocsp_response_cache  s    *+FG"GG
8	JLLKSQ~~)!yyBD  ')ii0OQU&V#+!$\!2J&2-C :! F&22uE  !,,S1  WIQMEEWX	
/-/1y) !A&{{ * '  +  H
  ++r177H'+yy{Z'?0(
 "Q%)']
H$00&
 

:.-!0 LLG !?   @ A     B  	LLH#qQ&=cU"QCH< 	sJ   B(G. B.G"5AG"G. G"G. "G+'G. +G. .	H*7.H%%H*c                   t        |      }t        |      }| j                  | d| }nF|j                  dk7  r|j                  nd}| j                  j	                  |j
                  |z   |      }t        j                  d|       |S )N/rE  zOCSP Retry URL is - %s)r   r>   r?  r
   r:  rU  rm   rn   )rc   r   b64datarW  url_encoded_b64data
target_urlr
   s          r\   generate_get_urlzOCSPServer.generate_get_urlT  s    h'
,W5&$:Q':&;<J '1oo&<:??"D,,33!!D(*=J 	-z:r^   Nr  rw   rJ   )T)rv  rJ   rw   rJ   )rS   rT   r~   r   r   r9  	MAX_RETRYr   staticmethodr8  rQ  rX  r_  rZ  r  r   r^   r\   r*  r*    sa    IBII.45I#@ U UE,U0< = =~r^   r*  c                  ~   e Zd Z e       ZdZdZdZdZdZ	e
dd       Ze
dd       Ze
dd       Ze
d        Ze
d	        Ze
dd
       Ze
dd       Ze
dd       Ze
dd       Ze
dd       Ze
	 	 	 	 	 	 	 	 	 	 dd       Ze
dd       Ze
d        Ze
dd       Ze
dd       Ze
dd       Ze
dd       Ze
d        Zy)r;  Fi Nzocsp_response_cache.jsonc                 0   t        j                  d      t        _        t        j                  t	        d      xs t        j                         } t        j                         dk(  r#t        j                  | dddd      t        _        nYt        j                         dk(  r"t        j                  | d	dd      t        _        n t        j                  | d
d      t        _        t        j                  dt        j                         t        j                  t        j                        s'	 t        j                  t        j                  d       y y # t        $ r:}t        j                  dt        j                  |       d t        _        Y d }~y d }~ww xY w)NSF_OCSP_RESPONSE_CACHE_DIRr   Windowsr   r   r   r   Darwinr   r   r   zcache directory: %si  )modez/cannot create a cache directory: [%s], err=[%s])r   r9  r;  	CACHE_DIRr   tempfile
gettempdirplatformsystemr
   rJ  rm   rn   existsmakedirsrl   )cache_root_direxs     r\   reset_cache_dirzOCSPCache.reset_cache_dir~  s%    !ii(DE	&'_E0C0C0EN I-&*ii"IwX'	# "h.&*ii"Ix'	# '+ii+&V	#*I,?,?@{{9../+I//e< 0  +E''
 '+	##+s   +%E 	F0FFc                     t        j                  t        j                  t        j                        } t        j
                  |       r.t        j                  d|         t        j                  |        yy)z/Deletes the OCSP response cache file if exists.zdeleting cache file N)
r
   rJ  r;  r  r<  r  rm   rn   r   unlink)
cache_files    r\   del_cache_filezOCSPCache.del_cache_file  sV     YY!H!H

 ;;z"LL/
|<=IIj! #r^   c                   | Ot         j                  ?dt        j                  t         j                  t         j                        z   t         _        n| t         _        t         j
                  )t         j
                  j                  dd      t         _        t        j                  dt         j
                         t        j                  dt        t        j                               y )Nzfile://\r  zocsp_response_cache_uri: %szOCSP_VALIDATION_CACHE size: %u)r;  r  r
   rJ  r<  OCSP_RESPONSE_CACHE_URIreplacerm   rn   r[  ro   r   )ocsp_response_cache_uris    r\   reset_ocsp_response_cache_uriz'OCSPCache.reset_ocsp_response_cache_uri  s    "*y/B/B/N09DII##Y%L%L= 1I- 1HI-,,8 1199$D - 	2I4U4UV 	,.556	
r^   c                   	 t        t        j                        }|j                  dk(  r?t        j	                  | t        j                  |j                  |j
                               ydj                  t        j                        }t        |      # t        t        f$ r1}t        j                  dt        j                  |d       Y d}~yd}~ww xY w)zIReads OCSP Response cache data from the URI, which is very likely a file.filezUnsupported OCSP URI: {}zhFailed to read OCSP response cache file %s: %s, No worry. It will validate with OCSP server. Ignoring...Tr   N)r   r;  r  rT  read_ocsp_response_cache_filer
   rJ  rU  r:  rl   r/   rm   rn   )r\  rW  rQ   r^  s       r\   	read_filezOCSPCache.read_file  s    	!)"C"CDJ  F*77$))J$5$5zG 17755  n$$i0 	LL 11   	s   A&B )*B C"'CCc                   	 t         j                  |      rt        j                  |      rut	        j
                  |ddd      5 }| j                  t        j                  |             ddd       t        j                  d|t        t        j                               yt        j                  d|       y# 1 sw Y   OxY w# t        $ r}t        j                  d|       |d}~ww xY w)	zReads OCSP Response cache.rutf-8ignoreencodingerrorsNz+Read OCSP response cache file: %s, count=%szZFailed to locate OCSP response cache file. No worry. It will validate with OCSP server: %szCaught - %s)r;  "check_ocsp_response_cache_lock_dirr
   r  codecsopenrq  r`   ry   rm   rn   r[  ro   r   rl   )r\  filenamefr  s       r\   r  z'OCSPCache.read_ocsp_response_cache_file  s    	;;HE$++K [[3R BVW33DIIaLAB A6==> FB B  	LL+H	s6   AC %B8*6C !C 8C=C 	C*C%%C*c                    t         j                  rXt        t        t              rt        j                          t         j                  | t         j                         dt         _        yy)a7  
        Updates OCSP Response Cache file.
        Two file shall be updated/saved:
            1. file for OCSP_RESPONSE_VALIDATION_CACHE which keeps ocsp response validation result
            2. ocsp_response_cache.json, the file in the same format as the one downloaded from snowflake cache service
        FN)r;  CACHE_UPDATEDrU   ro   r8   saveupdate_ocsp_response_cache_filer  )r\  s    r\   update_filezOCSPCache.update_file  sL     ""8/J.33555i77 ',I# #r^   c                .   |	 t        |      }|j                  dk(  rt        j                  |j                  |j                        }|dz   }t        d      D ].  }t        j                  |      r nt        j                  d       0 	 t        j                  | |       t        j                  |       yt        j                  d|       yy# t        j                  |       w xY w# t        $ r#}t        j                  d||d	       Y d}~yd}~ww xY w)
zUpdates OCSP Response Cache.Nr  .lckd   {Gz?z\No OCSP response cache file is written, because the given URI is not a file: %s. Ignoring...zJFailed to write OCSP response cache file. file: %s, error: %s, Ignoring...Tr  )r   rT  r
   rJ  rU  ro  r;  lock_cache_filerj  rs  write_ocsp_response_cache_fileunlock_cache_filerm   rn   rl   )r\  r  rW  r  lock_dirr  r  s          r\   r  z)OCSPCache.update_ocsp_response_cache_file  s    #.%&=>
$$.#yy):):JOOLH'&0H"3Z ) %44X>!

4()>!@@xP!33H=LLC/# / "33H=  =+!   s6   BC( 
C  C( 6C( C%%C( (	D1DDc                    t         j                  d|        i }| j                  |       t        j                  |ddd      5 }t        j                  ||       ddd       y# 1 sw Y   yxY w)zWrites OCSP Response Cache.z$writing OCSP response cache file to wr  r  r  N)rm   rn   encode_ocsp_response_cacher  r  r`   rb   )r\  r  file_cache_datar  s       r\   r  z(OCSPCache.write_ocsp_response_cache_file   sb     	;H:FG''8[[3J 	*aIIoq)	* 	* 	*s   A%%A.c                n   t        t        j                               }| dz   }	 t        j                  |       }t	        j
                  |      s|t        j                  z
  |k  ryt	        j
                  |      rbt        j                  |      }||dz
  k  r,t        j                  |       t        j                  d|       y	t        j                  d| |       	 y	t        j                  |        t        j                  d|        	 y	# t        $ r"}t        j                  d| ||       Y d}~y	d}~ww xY w)
zChecks if the lock directory exists.

        Returns:
            True if it can update the cache file or False when some other process may be updating the cache file.
        r  T<   zbThe lock directory is older than 60 seconds. Deleted the lock directory and ignoring the cache: %szOThe lock directory exists. Other process may be updating the cache file: %s, %sz9The cache is older than 1 day. Deleted the cache file: %sz~Failed to check OCSP response cache file. No worry. It will validate with OCSP server: file: %s, lock directory: %s, error: %sNF)r   rj  r;  _file_timestampr
   r  CACHE_EXPIRATIONr  rm   rn   r   r  rl   )r  current_timer  ts_cache_filets_lock_dirr  s         r\   r  z,OCSPCache.check_ocsp_response_cache_lock_dir)  s#    499;'f$)	%55h?MKK) 9#=#==N {{8$'77A!22//9LLP 6 + LL:  	*  		(#R   	LL   	s+   A D	 %AD	 D	 +D	 		D4D//D4c                .    | t         j                  z
  |k  S r   )r;  r  )r  rI   s     r\   is_cache_freshzOCSPCache.is_cache_fresh_  s    i888B>>r^   c                   |r| j                  |      nd }t        t        j                               }|j                  d| j	                  |            }|j                  dd      }	 |r	t
        |   nt
        j                  |      }	 t        j                  ||j                        rB| j                  ||j                        r&|rt        j                  d|       d|j                  fS t        j                  | |||       	 dt        _        y
# t        $ r%}	t        j                  d| d|	        Y d }	~	5d }	~	ww xY w# t"        $ r |rt        j                  d| d	       Y y
w xY w)N	cache_key
lock_cacheTzhit cache for subject: %sr  r  zCould not validate cache entry  zcache miss for subject: '')FN)subject_namer   rj  rh   decode_cert_id_keyro   _getitem_non_lockingr;  r  rI   is_valid_timerH   rm   rn   delete_cacherl   r  KeyError)
r\  rG   rF   r@  r  r  r  r  ocsp_response_validation_resultr  s
             r\   
find_cachezOCSPCache.find_cachec  sm    6=t((1$499;'06

0091
	 "::lD9
	J  /y93HHS ,
O ++ "A"D"D((<JJ $%@,O!@!N!NNN**gz + 
 '+I#   O>wiqMNNO  	J8aHI	JsC   ' E A!D *D E 	D>D94E 9D>>E $E('E(c                    |j                  d| j                  |            }|j                  dd      }	 |rt        |= nt        j                  |       dt        _        y # t        $ r Y y w xY w)Nr  r  T)rh   r  ro   _delitemr;  r  r  )r\  rG   r@  r  r  s        r\   r  zOCSPCache.delete_cache  sj    06

0091
	 "::lD9
	29=.77	B&*I# 		s   *A   	A,+A,c                   t        j                         dk(  r t        t        j                  |             }|S t        j                  |       }t        |d      rt        |j                        }|S t        |j                        }|S )z0Gets the last created timestamp of the file/dir.r  st_birthtime)
r  r  r   r
   getctimer   stathasattrr  st_mtime)r  rI   r  s      r\   r  zOCSPCache._file_timestamp  ss     ??	)T]]8,-B 	 778$Dt^,**+ 	 '	r^   c                N    	 t        j                  |        y# t        $ r Y yw xY w)z+Locks a cache file by creating a directory.TF)r   mkdirOSErrorfnames    r\   r  zOCSPCache.lock_cache_file  '    	HHUO 		    	$$c                N    	 t        j                  |        y# t        $ r Y yw xY w)z-Unlocks a cache file by deleting a directory.TF)r   rmdirr  r  s    r\   r  zOCSPCache.unlock_cache_file  r  r  c                 n   t        t        j                        } t        j                  | j
                  | j                        }t        j                  |       	 t        j                  d|        t        j                  |       t        j                  |       y# t        j                  |       w xY w)z+Deletes the cache file. Used by tests only.z(deleting cache file, used by tests only N)r   r;  r  r
   rJ  rU  r  rm   rn   r   r  r  )rW  r  s     r\   delete_cache_filezOCSPCache.delete_cache_file  s~     i??@
		*++Z__=!!%(	/LLCE7KLIIe''.I''.s   -B B4c                 ,    t         j                          y)zClears cache.N)ro   clearr   r^   r\   clear_cachezOCSPCache.clear_cache  s     	',,.r^   c                      t        t              S )zReturns the cache's size.)r[  ro   r   r^   r\   
cache_sizezOCSPCache.cache_size  s     122r^   r  r  )r  r   rI   r   rw   rJ   )
r\  rh  rG   r   rF   rD   r@  r   rw   ztuple[bool, bytes | None])r\  rh  rG   r   r@  r   rw   r  )rS   rT   r~   r   
CACHE_LOCKr  r  r  r<  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r^   r\   r;  r;  j  s   J M  # %?! I+ +8 " " 
 
,  .  2 , ,  B * * 3 3j ? ? $$&,$7I$UX$	"$ $L   
 
     	/ 	/ / / 3 3r^   r;  c                  .   e Zd ZdZi Z e       Z e       Z e	j                  d      ZdZdZ ej                  dej"                        j%                  d      ZdZd	Zd
ZdZdZdZddddef	 	 	 	 	 	 	 d:dZd;d<dZ	 d;	 	 	 	 	 	 	 d=dZ	 	 d>	 	 	 	 	 	 	 	 	 	 	 d?dZed@d       Z 	 	 	 	 	 	 dAdZ!dBdZ"d@dZ#edCd       Z$	 	 dD	 	 	 	 	 	 	 	 	 	 	 	 	 dEdZ%d Z&	 	 dD	 	 	 	 	 	 	 	 	 dFdZ'	 	 	 	 dGdZ(dCdZ)edHd       Z*e	 dI	 	 	 	 	 	 	 	 	 dJd       Z+edKd       Z,edCd       Z-ed         Z.edCd!       Z/ed"        Z0	 	 dD	 dLd#Z1	 	 	 	 	 	 	 	 dMd$Z2d% Z3d& Z4d' Z5dCd(Z6dId)Z7d* Z8d+ Z9d, Z:d- Z;	 	 	 	 	 	 dNd.Z<d/ Z=d0 Z>d1 Z?d2 Z@d3 ZAd4 ZBd5 ZCd6 ZDd7 ZEd8 ZFd9 ZGy)Orh  z5OCSP validator using PyOpenSSL and asn1crypto/pyasn1.z^(.*\.snowflakecomputing(\.[a-zA-Z]{1,63}){1,2}$|(?:|.*\.)s3.*\.amazonaws(\.[a-zA-Z]{1,63}){1,2}$|.*\.okta\.com$|(?:|.*\.)storage\.googleapis\.com$|.*\.blob\.core\.windows\.net$|.*\.blob\.core\.usgovcloudapi\.net$)r  i  r   Ntzinfoz%Y-%m-%d %H:%M:%SZ
      r3      Tc                z   t        j                  dd       | _        | j                  dk(  rt        j	                  d       || _        || _        t        t        |j                  dd                   | _
        d | _        t        j                  d      ,t        j                  d      j                         dk(  | _        n|| _        t        j                  j!                  |       t        j#                         s| j                  j%                  |       	 t&        s t        j                  j)                  |        y y )NSF_OCSP_TEST_MODEr2  z(WARNING - DRIVER CONFIGURED IN TEST MODEhostname)r.  SF_OCSP_FAIL_OPEN)r   r9  rk  rm   rn   _use_post_method_root_certs_dict_lock_timeoutr*  r=   r4  OCSP_CACHE_SERVERdebug_ocsp_failure_urlrC  	FAIL_OPENrh  
OCSP_CACHEr  r8  rX  ro   r  )rc   r  rV  use_post_methoduse_fail_openroot_certs_dict_lock_timeoutr@  s          r\   r   zSnowflakeOCSP.__init__  s     #6=>>V#LLCD /-I*!+C

:t,"
 '+#99()5  YY':;AACvMDN*DN  >>?VW668""FF%	* .$$..t4 .r^   c                   i }t               }|j                  | j                  j                         |j	                  d       |j                  |       |j                  | j                                	 | j                  ||       | j                  |      }| j                  d||d|      S # t        $ r&}t        j                  dt        |             |d}~ww xY w)z.Validates that the certificate is NOT revoked.Fz-Caught exception while validating certfile %sN)rv  no_exception)r   r   r  r>  r   r   r   is_enabled_fail_openread_cert_bundlecreate_pair_issuer_subjectrl   rm   rn   rX   	_validate)rc   cert_filenamer  cert_mapr  	cert_datar  s          r\   validate_certfilezSnowflakeOCSP.validate_certfileJ  s    *,(()?)?)T)TU..u5((7$$T%>%>%@A	!!-:77AI
 ~~)^e,  
 	
	  	LLH#b'RH	s   4#B- -	C6!CCc                    t         j                  d|       t        j                         }t        j                  j                  |       }|s|j                  d      rt         j                  d|       g dS t        j                         r| j                  j                  |       t               }|j                  | j                  j                         |j                  d       |j                  |       |j!                  | j#                                	 | j%                  |      }| j/                  |||||      S # t&        $ rF |j)                  t        j*                         t         j                  |j-                  d             Y yw xY w)z4Validates the certificate is not revoked using OCSP.zvalidating certificate: %socspssdzskipping OCSP check: %s)NNNNNFRevocationCheckFailureN)rm   rn   rh  get_ocsp_retry_choiceOCSP_WHITELISTmatchrS  r*  r8  r  rQ  r   r   r>  r   r   r   r  extract_certificate_chainr/   r   r  r  r  )rc   r   
connectionr  rv  mr  r  s           r\   validatezSnowflakeOCSP.validate]  sQ   $ 	18< 668,,228<<##I.LL2H=11224""66x@*,(()?)?)T)TU..u5((2$$T%>%>%@A		66zBI ~~i<
 	
 $ 	--!?? LL667OP 	s   D> >AFFc                0   | j                  ||||      }t        j                  j                  |        d}|D ];  \  }}	}	}	}	t	        |t
              r|xj                  d| z  c_        |s|||:d}= t        j                  |sd       |S d       |S )zBValidate certs sequentially if OCSP response cache server is used.)rv  Fz for Tokfailed)	!_validate_certificates_sequentialrh  r  r  rU   r/   rQ   rm   rn   )
rc   r   r  r  rv  r  resultsany_errerrr  s
             r\   r  zSnowflakeOCSP._validate  s     88~x( 9 
 	  ,,T2& 	OCAq!#34U8*--CO		 	T7 /77r^   c                 4    t        j                  dd      dk(  S )NSF_OCSP_DO_RETRYr2  )r   r9  r   r^   r\   r  z#SnowflakeOCSP.get_ocsp_retry_choice  s    yy+V4>>r^   c                T    t        j                  j                  | ||fi |\  }}||fS )zDecides whether OCSP CertID is in cache.

        Args:
            cert_id: OCSP CertID.
            subject: Subject certificate.

        Returns:
            True if in cache otherwise False, followed by the cached OCSP Response.
        )rh  r  r  )rc   rG   rF   r@  foundcaches         r\   is_cert_id_in_cachez!SnowflakeOCSP.is_cert_id_in_cache  s9     %//::'7
&,
u e|r^   c                l    |j                  d      }d|v r|d   j                  d      d   }|S |d   }|S )zExtracts the account name part from the hostname.

        Args:
            hostname: Hostname that account name is in.

        Returns:
            The extracted account name.
        rG  globalr   rF  )split)rc   r   split_hnameacc_names       r\   get_account_from_hostnamez'SnowflakeOCSP.get_account_from_hostname  sJ     nnS){""1~++C03H  #1~Hr^   c                    | j                   S r   )r  r   s    r\   r  z"SnowflakeOCSP.is_enabled_fail_open  s    ~~r^   c                @    d}| d|  }t         j                  |       y )NzWOCSP responder didn't respond correctly. Assuming certificate is not revoked. Details: z 
 )rm   rn   )ocsp_logstatic_debug
ocsp_debugs      r\   print_fail_open_debugz#SnowflakeOCSP.print_fail_open_debug  s#    p$~T(4
Z r^   c                   | j                  ||      \  }} | j                  ||fi |\  }	}
	 |	s=|j                  d       t        j	                  d       | j                  ||||||      }
n| j                  |      }| j                  | j                  |            }|j                  d       t        j                  | ||      | _        |j                  |       |j                  |       |j                  |       t        j	                  d       |
s0|j                  t         j"                         t%        dt&              	 | j)                  |||
       d }	 |||||
fS # t$        $ r3}|j                  t         j*                  |j,                            |d }~ww xY w# t$        $ r7}|j/                  |j0                         | j3                  ||      }Y d }~d }~wt4        $ ru}t        j	                  dt7        |             |j/                  t7        |             | j3                  ||      }t        j8                  j;                  | |       Y d }~d }~ww xY w)NFz+getting OCSP response from CA's OCSP serverTzusing OCSP response cachezACould not retrieve OCSP Response. Cannot perform Revocation Checkrg   zOCSP Validation failed %s)create_ocsp_requestr+  r   rm   rn   _fetch_ocsp_responseextract_ocsp_urlencode_cert_id_base64r  rh  create_ocsp_debug_infor  r   r   r   r   r   r  r/   r-   process_ocsp_responser(  rP   r   rQ   verify_fail_openrl   rX   r  r  )rc   rE   rF   r  r   rv  r@  rG   reqcache_statusrH   r   cert_id_encr%  op_err^  r  s                    r\   validate_by_direct_connectionz+SnowflakeOCSP.validate_by_direct_connection  s9    //@&>d&>&>W'
 &'
#m.	A,,U3JK $ 9 9'>8X!  009"88++G4 ,,T2.;.R.R#x/+ ++H5++C0**;789 11%?? +[6 **67MJ" FGWm;;! ( 11%44U[[A 	 $ 	=((1''^<C 	ALL4c"g>((R1''N;C$$11$@@		AsC   DF" E# #	F,.FFF" "	I+-GI)A+IIc                   | j                         s_|j                  t        u r't        j	                  |j                  dd             |S t        j	                  |j                  d             |S |j                  t        u r't        j	                  |j                  dd             |S t        j                  |j                  d             y )NRevokedCertificateErrorTr  )r  rP   r$   rm   rn   r  rh  r7  )rc   ex_objr  s      r\   r?  zSnowflakeOCSP.verify_fail_open  s    ((*||CC"::14 M "::;ST M||CC"::14
 33"::;ST r^   c           	     P   g }	 | j                  |       i }|D ]   \  }	}
| j                  |	|
      \  }}| j                  |      }t        j                  |      }||j                  sh| j                  |	|
||||      }|d   |d   5t!        |t#        t%        j$                               dd||<   dt&        _        |j+                  |       |j+                  |j,                  |j.                  |j0                  |j2                  |j4                  f        t        j7                  |       |S # t        $ r7}|j                  t        j                  |j
                            Y d }~Zd }~wt        $ r*}t        j                  dt        |             Y d }~d }~ww xY w)NzHCaught unknown exception - %s. Continue to validate by direct connection)rE   rF   )rv  r  r      T)rI   rK   )!_check_ocsp_response_cache_serverr/   r   r   r(  rP   rl   rm   rn   rX   r9  r  ro   rh   rK   rD  rA   r   rj  r;  r  appendrC   rE   rF   rG   rH   rV   )rc   r  r  r   rv  r#  r^  r  to_update_cache_dictrE   rF   rG   r  r  r  r  s                   r\   r"  z/SnowflakeOCSP._validate_certificates_sequential4  s    
	229=  "( *	OFG111QJGQ//8I.L.P.P/+
 076@@ 66"%' 7  Q4#qt'76Rtyy{+"&7(3
 /3I+q!7AA7>>7??7??7EEE*	V 	'--.BCo $ 	--!00;   	LLZB 	s#   D4 4	F%=,E//F%;F  F%c                    d}|D ]B  \  }}| j                  ||      \  }}t        j                  j                  | ||      \  }}|rB n |s| j                  j                  |        yy)zChecks if OCSP response is in cache, and if not it downloads the OCSP response cache from the server.

        Args:
          cert_data: Tuple of issuer and subject certificates.
        FN)r9  rh  r  r  r  r_  )rc   r  in_cacherE   rF   rG   r  s          r\   rJ  z/SnowflakeOCSP._check_ocsp_response_cache_serverw  st     ( 	OFG11&'BJGQ'22==dGWUKHa	 ""==dC r^   c                   t         j                  j                  | j                        }|r*	 t         j                  r 	 t         j                  j                          y	 t        j                  d      xs t        j                  d      }|r(t        j                  |      r| j                  |       n^ddl}ddlm} t        |d      rt        j                  |j                        rt        j                  t        j                   t        j"                  |j                        d            rEt        j                   t        j"                  |j                        d      }| j                  |       nzt        |d	      rng d
ddgdgg}|D ]J  }t        j                   |j$                  g| }t        j                  |      s9| j                  |        n t&        j)                  d       	 ddl}| j                  |j-                                t         j                  st&        j)                  d       t         j                  j                          yt&        j3                  d       y# t.        $ r t&        j1                  d       Y zw xY w# t.        $ r }t&        j)                  d|       Y d}~d}~ww xY w# t         j                  j                          w xY w)z5Reads the local cabundle file and cache it in memory.)re  NREQUESTS_CA_BUNDLECURL_CA_BUNDLEr   )certs__file__
cacert.pem_MEIPASS)botocorevendoredrequestsrT  rX  z%No cabundle file is found in _MEIPASSz!no certifi is installed. ignored.zFailed to read ca_bundle: %szMNo CA bundle file is found in the system. Set REQUESTS_CA_BUNDLE to the file.zSFailed to acquire lock for ROOT_CERTIFICATES_DICT_LOCK. Skipping reading CA bundle.)rh  ROOT_CERTIFICATES_DICT_LOCKacquirer  ROOT_CERTIFICATES_DICTreleaser	   rh   r
   r  r  r   rX  rR  r  rS  rJ  dirnamerU  rm   rt  certifiwhererl   rn   info)	rc   lock_acquired	ca_bundler   rR  cabundle_candidatesr  r^  r  s	            r\   _lazy_read_ca_bundlez"SnowflakeOCSP._lazy_read_ca_bundle  sQ   %AAII66 J 
 >D 77v 99AACs1D ',@ A !W[[(FI !T[[%;--i8" 3 $E:6 $ENN ; $ $		$,,u~~*F U! )-		 $U^^ <l)I !11)<$S*5 !S!+\ :!-3/
 -@ V,0IIcll,NX,N	#';;y#9$($9$9)$D$)	V !'-T UN* 11'--/B %;;LL>
 99AACKK. %  ) N"LL)LMN ! DLL!?CCD 99AACsZ   J>  E&J )J 1#I. %J> .JJ JJ 	J;J61J> 6J;;J> > Kc                p    t        t        t        j                  || z
  z        t        j                        S r   )maxr   rh  TOLERABLE_VALIDITY_RANGE_RATIOMAX_CLOCK_SKEW)this_updatenext_updates     r\   _calculate_tolerable_validityz+SnowflakeOCSP._calculate_tolerable_validity  s8    <<,. ((
 	
r^   c                    |t        j                  d      }|yt        j                  ||      }|t        j                  z
  | cxk  xr ||z   k  S c S )N(SF_TEST_OCSP_FORCE_BAD_RESPONSE_VALIDITYF)r   r9  rh  rk  rh  )r  ri  rj  rk  force_validity_failtolerable_validitys         r\   _is_validaity_rangez!SnowflakeOCSP._is_validaity_range  sn      "$)),V"W".*HH
 -6660//0	
0	
r^   c                d   t         j                  ||      }dj                  t        t         j                  t        |             t        t         j                  t        |            t        t         j                  t        |            t        t         j                  t        ||z                     S )NzResponse is unreliable. Its validity date is out of range: current_time={}, this_update={}, next_update={}, tolerable next_update={}. A potential cause is client clock is skewed, CA fails to update OCSP response in time.)rh  rk  r:  r   OUTPUT_TIMESTAMP_FORMATr   )r  ri  rj  ro  s       r\   _validity_error_messagez%SnowflakeOCSP._validity_error_message  s    *HH
 
 !'>>|@TU>>{@ST>>{@ST!99;);;<	!	
r^   c                 @    t         j                  j                          y r   )rh  r  r  r   r^   r\   r  zSnowflakeOCSP.clear_cache  s      ,,.r^   c                 >    t         j                  j                         S r   )rh  r  r  r   r^   r\   r  zSnowflakeOCSP.cache_size  s    ''2244r^   c                 @    t         j                  j                          y r   )rh  r  r  r   r^   r\   r  zSnowflakeOCSP.delete_cache_file  s      224r^   c                6    | j                  |      }| d| }|S )Nr  )decode_ocsp_request_b64)r\  ocsp_requestr   r  r  s        r\   r=  z$SnowflakeOCSP.create_ocsp_debug_info  s(    ..|< z7),
r^   c           
        t         j                  }| j                  |      }| j                  | j	                  |            }	|s0|j                  t        j                         t        dt              t        t        i}
t        j                         sv| j                  rdnd}| j                  j                   rd}|dk(  r0| j#                  |      }| j                  j%                  ||      }d}na|}| j'                  |      }d|
d<   nHd}| j                  j                   }| j#                  |      }t)        j*                  |||	|d      }d	|
d<   |j-                  |       | j.                  Rt0        j3                  d
       t5        j6                  dd      }t5        j6                  dd      }|t9        |      }||}t         j;                  | ||      | _        |j?                  | j#                  |             |jA                  |       |jC                  |	       d}t0        j3                  d|       t         jD                  }| jG                         st         jH                  }tK        d      }||ntM        jN                  d      }|jQ                  |      5 }|r|nd}d} tS                      }tU        |      D ]  }	 |jW                  |
||||      }|jX                  tZ        k(  r#t0        j3                  d       |j\                  } n|dkD  rAt_        |      }t0        j3                  d|jX                  |       ta        jb                  |        t0        jo                  dji                  |             |j                  t        jp                         t        dji                  |      tr              	 ddd       |S # td        $ r}|dkD  r7t_        |      }t0        j3                  d|       ta        jb                  |       nH|j                  t        jf                         t        dji                  tk        |            tl              Y d}~d}~ww xY w# 1 sw Y   |S xY w)z(Fetches OCSP response using OCSPRequest.zFNo OCSP URL found in cert. Cannot perform Certificate Revocation checkrg   postrh   Nzapplication/ocsp-requestzContent-Type)r   ry  rG   ocsp_responder_urlzapplication/jsonz+WARNING - DRIVER IS CONFIGURED IN TESTMODE.SF_TEST_OCSP_URL,SF_TEST_CA_OCSP_RESPONDER_CONNECTION_TIMEOUTzurl: %sFrc  r3   )rf  methodru  re  r   z9OCSP response was successfully returned from OCSP server.rg  z:Could not fetch OCSP Response from serverRetrying in %s(s)z\Could not fetch OCSP Response from server. Considerchecking your whitelists : Exception - {}z[Failed to get OCSP response after {} attempt. Consider checking for OCSP URLs being blockedz-Failed to get OCSP response after {} attempt.):rh  $CA_OCSP_RESPONDER_CONNECTION_TIMEOUTr;  r<  r  r   r   r  r/   r.   r   r0   r*  r8  r  r  r?  rx  r  decode_ocsp_requestr`   ra   r   rk  rm   rn   r   r9  r   r=  r  r   r   r   CA_OCSP_RESPONDER_MAX_RETRY_FOr  CA_OCSP_RESPONDER_MAX_RETRY_FCr2   r:   rl  rm  r5   ro  requestrp  r   contentrr  rj  rs  rl   r  r:  rX   r'   rt  r#  r(   )rc   ry  rF   rG   r  r   rv  rw  r   rB  rf  actual_methodr  r  payloadocsp_req_enctest_ocsp_urlry  r[   sf_max_retrycontext_session_managerr{  r|  r}  r~  r  r  r  r  s                                r\   r:  z"SnowflakeOCSP._fetch_ocsp_response  s<    #GG
((1001H1H1QR--.?.P.PQ&\.  *+FG668&*&;&;FM%%44 %%66|D!33DDXwW
%
22<@*D'"M//>>J77ELjj ($0**2	G '9GN#11-@>>%LLFGII&8$?M99>L ' .
(*
&3&J&J,'
# 	##D$@$@$NO##H-"";/Y
+$CC((*(GGL #>%"P '2 $&22uE 	
 ((4 ;	(0aIJ+)+-G9% 7(& ',& *$  /  H  ++r1& '.."Q%)']
H$00&
 

:./7V 228&2C 11%AA +GNN! 9	 G ';	z 
C !  1}%)']
0&
 

:.&99-KK 3!HHNsSUw"B  /9;	z 
sF   &Q"A
OQ"AOA%Q"	QBQQ"QQ""Q,c                   t        t        j                               }| j                  |      \  }}||!t        dj	                  ||      t
              |j                  d      t        j                  z
  j                         }|j                  d      t        j                  z
  j                         }t        j                  |||| j                        s&t        t        j                  |||      t              y)zProcesses GOOD status.NzKEither this update or next update is None. this_update: {}, next_update: {}rg   r  )r   rj  extract_good_statusr/   r:  r)   r  rh  
ZERO_EPOCHr   rp  rk  rs  r&   )	rc   single_responserG   rH   r  this_update_nativenext_update_nativeri  rj  s	            r\   _process_good_statusz"SnowflakeOCSP._process_good_status  s    499;'151I1I2
.. %);)C&CCI6&(:D C  &&d&3m6N6NN
-/ 	 &&d&3m6N6NN
-/ 	 00+{DNN
 '!99 +{ /	 
r^   c                x   t        t        j                               }| j                  ~t        j                  d      }|dk(  rdt        dj                  t        t        j                  t        |            t        t        j                  t        |            d      t              t        j                  j                  | |       | j                  |      \  }}t        dj                  t        t        j                  t        |            |j                  t        j                        |      t              )zProcesses REVOKED status.SF_TEST_OCSP_CERT_STATUSrevokedzPThe certificate has been revoked: current_time={}, revocation_time={}, reason={}zForce Revokerg   )r   rj  rk  r   r9  r/   r:  r   rh  rr  r   r$   r  r  extract_revoked_status)rc   r  rG   r  test_cert_statusrevocation_timerevocation_reasons          r\   _process_revoked_statusz%SnowflakeOCSP._process_revoked_status  s   499;'>>%!yy)CD9,*44:F )AA6,CW !)AA6,CW '5 ?  	  --dG<-1-H-H.
** #,,2F>>|@TU(()N)NO!-
 7
 	
r^   c                d    t         j                  j                  | |       t        dt              )zProcesses UNKNOWN status.z0The certificate is in UNKNOWN revocation status.rg   )rh  r  r  r/   r%   r   s     r\   _process_unknown_statusz%SnowflakeOCSP._process_unknown_status  s+      --dG<"B6
 	
r^   c           	        	 t         j                  5  i }|j                         D ]  \  }\  }}| j                  |      }t	        |      }| j                  ||      s8t        t        j                               }| j                  |      }	t        j                  | |d|	d      \  }
}t        j                  ||      rt        ||d      ||	<   |
st        j                  | ||	d        	 ddd       r!t         j                  |       dt        _        yy# 1 sw Y   -xY w# t         $ rF}t"        j%                  d|       dj'                  t)        |            }t+        |t,              d}~ww xY w)	z&Decodes OCSP response cache from JSON.NFr  )rH   rI   rK   TzCaught here - %sz6Exception raised while decoding OCSP Response Cache {}rg   )ro   _lockr   decode_cert_id_base64r   r  r   rj  r  r;  r  r  rA   r  rV   r  rl   rm   rn   r:  rX   r/   r!   )rc   ocsp_response_cache_jsonnew_cache_dictcert_id_base64rI   rH   rG   b64decoded_ocsp_responser  r  r)  r  r  ermsgs                 r\   rq  z(SnowflakeOCSP.decode_ocsp_response_cache  s   &	/55 !# .335 N %!"88HG/8/G,--g7OP #&tyy{#3L<@<S<S=I  )33gtyU  4  HE1 !//bA4P*B+&+5y1
 !.. 'Y5 / -6 .55nE*.	' 7 <  	LL+R0LSSBE '!E 	s6   D' C DD/*D' D$ D' '	E60AE11E6c                    t         j                  d       t        j                         D ]K  \  }}| j	                  |      }t        |j                        j                  d      }|j                  |f||<   M y)z$Encodes OCSP response cache to JSON.z$encoding OCSP response cache to JSONasciiN)	rm   rn   ro   r   r<  r   rH   r   rI   )rc   r  r  r  r   r   s         r\   r  z(SnowflakeOCSP.encode_ocsp_response_cache)  sw    ;< ,113	R 
+**95A9GGHOOPWXA+J+M+Mq*Q$Q'	Rr^   c                    t         )z>Reads a certificate file including certificates in PEM format.NotImplementedError)rc   ca_bundle_filestorages      r\   r  zSnowflakeOCSP.read_cert_bundle4      !!r^   c                    t         )z%Encodes Cert ID key to native CertID.r  rc   r  s     r\   encode_cert_id_keyz SnowflakeOCSP.encode_cert_id_key8  r  r^   c                    t         )z#Decodes name CertID to Cert ID key.r  r  s     r\   r  z SnowflakeOCSP.decode_cert_id_key<  r  r^   c                    t         )z(Encodes native CertID to base64 Cert ID.r  )rc   hkeys     r\   r<  z#SnowflakeOCSP.encode_cert_id_base64@  r  r^   c                    t         )z(Decodes base64 Cert ID to native CertID.r  )rc   r  s     r\   r  z#SnowflakeOCSP.decode_cert_id_base64D  r  r^   c                    t         )zCreates CertId and OCSPRequest.r  )rc   rE   rF   s      r\   r9  z!SnowflakeOCSP.create_ocsp_requestH  s
     "!r^   c                    t         )z#Extracts OCSP URL from Certificate.r  )rc   certs     r\   r;  zSnowflakeOCSP.extract_ocsp_urlP  r  r^   c                    t         )zDecodes OCSP request to DER.r  rc   ry  s     r\   r  z!SnowflakeOCSP.decode_ocsp_requestT  r  r^   c                    t         )z#Decodes OCSP Request object to b64.r  r  s     r\   rx  z%SnowflakeOCSP.decode_ocsp_request_b64X  r  r^   c                    t         )z Extracts Revocation Status GOOD.r  rc   r  s     r\   r  z!SnowflakeOCSP.extract_good_status\  r  r^   c                    t         )z#Extracts Revocation Status REVOKED.r  r  s     r\   r  z$SnowflakeOCSP.extract_revoked_status`  r  r^   c                    t         )zProcesses OCSP response.r  )rc   rE   rG   rH   s       r\   r>  z#SnowflakeOCSP.process_ocsp_responsed  r  r^   c                    t         )zVerifies signature.r  )rc   signature_algorithm	signaturer  r   s        r\   verify_signaturezSnowflakeOCSP.verify_signatureh  r  r^   c                    t         )zHGets certificate chain and extract the key info from OpenSSL connection.r  )rc   r  s     r\   r  z'SnowflakeOCSP.extract_certificate_chainl  r  r^   c                    t         )z1Creates pairs of issuer and subject certificates.r  )rc   r  s     r\   r  z(SnowflakeOCSP.create_pair_issuer_subjectp  r  r^   c                    t         )z!Gets human readable Subject name.r  )rc   rF   s     r\   r  zSnowflakeOCSP.subject_namet  r  r^   c                    t         )z4Checks whether ocsp_response is in valid time range.r  )rc   rG   rH   s      r\   r  zSnowflakeOCSP.is_valid_timex  r  r^   )r  rJ   r	  rJ   r
  r   rw   r  r  )r  rJ   )r   
str | Noner  r   r  rJ   rw   zSlist[tuple[Exception | None, Certificate, Certificate, CertId, str | bytes]] | None)TF)r   r  r  %list[tuple[Certificate, Certificate]]r  r   rv  rJ   r  rJ   rw   Flist[tuple[Exception | None, Certificate, Certificate, CertId, bytes]]r  )rG   r   rF   rD   r@  r   )r   rX   rw   rX   r  )NT)rE   r   rF   r   r  r   r   rX   rv  rJ   r@  r   rw   z@tuple[Exception | None, Certificate, Certificate, CertId, bytes])
r  r  r  r   r   r  rv  rJ   rw   r  )r  r  rw   r  )ri  floatrj  r  rw   r   r   )
r  r   ri  r  rj  r  rk  z
Any | Nonerw   rJ   )rw   rX   )rv  rJ   )r  r   rG   r   rH   r   rw   r  )rE   r   rF   r   rw   ztuple[CertId, OCSPRequest])HrS   rT   r~   __doc__r[  r   rY  r;  r  recompiler  rg  rh  r   fromtimestampr   utcr  r  rr  r  ri  r  r  rn  r9   r   r  r  r  r  r  r+  r1  r  r7  rD  r?  r"  rJ  rd  rk  rp  rs  r  r  r  r=  r:  r  r  r  rq  r  r  r  r  r<  r  r9  r;  r  rx  r  r  r>  r  r  r  r  r  r   r^   r\   rh  rh    s   ?   #(' JRZZ	1N$ &*" N (''8<<8@@@MJ 3 ,.( ,-( &'" &'" #$ !%" $",`<5 	<5
 <5 '*<5 
<5|
. #	1
1
 1
 	1
		1
p " 9 *	
   
P6 ? ?(:FI"  ! ! ><>< >< *	><
 >< >< >< 
J><@>  $A8A *A 	A
 A 
PAFD8D 
D*JX 
 
 
 !%	


 
 	

 

 
( 
 
* / / 5 5 5 5   R Rh - 8> OT 	 D 
D
(T	R""""""" " 
$	""""""""""""r^   rh  )rG   r   rw   ztuple[bytes, bytes, bytes])l
__future__r   r  ri   r`   r   r  r  r   r  rj  base64r   r   r   r   loggingr   r	   r
   os.pathr   	threadingr   r   r   r   typingr   r   asn1crypto.ocspr   r   r   asn1crypto.x509r   OpenSSL.SSLr   snowflake.connectorr   snowflake.connector.compatr   r   r   snowflake.connector.constantsr   snowflake.connector.errorcoder   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   snowflake.connector.errorsr/   snowflake.connector.networkr0   #snowflake.connector.session_managerr1   #snowflake.connector.ssl_wrap_socketr2   rE  r4   backoff_policiesr5   r*  r6   r7   r8   r9   r{  r:   r   r;   r<   url_utilr=   r>   	util_textr?   rA   r   DAY_IN_SECONDSrJ  ro   r   r  rS   rm   r   r   r*  r;  r  rh  r   r^   r\   <module>r     s   "    	  	 
   ' '    ! ! "
 @ ? ' " ; ? ? @     * < C > K  1 ; ; K 2 C L +j
: j
Z/ /d# 	+ //WW\\X{,Q ggll5 ww||5
	 # % H 
8	E EVG GTb3 b3L 
   g" g"k   	 //	 # % s   %A4G" "HH