+ h,cs^RIt^RIt^RIt^RIHtHt^RIt^RIt^RIH t H t ^RI H t ^RI Ht^RIHt^RIHtHt^RIHt^R IHt^R IHtHt^R IHtHt^R IHt^R IH t H!t!Rt"RRlt#Rt$Rt%RRlt&!RR4t'R#)iN)urljoinurlparse)hazmatx509)InvalidSignature)backends) DSAPublicKey)ECDSAEllipticCurvePublicKey)PKCS1v15) RSAPublicKey)SHA1Hash)Encoding PublicFormat)ocsp)AuthorizationErrorConnectionErrorcsVP4p\V\4'd=VPVPVP \ 4VP4R#\V\4'd4VPVPVP VP4R#\V\4'd=VPVPVP \VP44R#VPVPVP 4R# \d \R4hi;i)zfailed to valid ocsp responseN) public_key isinstancer ZverifyZ signatureZtbs_response_bytesr Zsignature_hash_algorithmrrrrr) issuer_cert ocsp_responsepubkeys&& //usr/lib/python3.14/site-packages/redis/ocsp.py_verify_responsers  # # %F? fl + + MM''00 66    - - MM''0066   6 7 7 MM''00m<<=  MM-11=3S3S T ?=>>?s AD'$AD'-AD'?&D''D>cs\P!V4pVP\PP8Xd \ R4hVP\PP 8XdcVP\PP8wd9\R\VP4PR4^, R24hM \R4hVP\PP48d \R4hVP 'd9VP \PP48d \R4hVP"pVP$pVP&pTpVeW@P(8XgWe8XdTpMVP*p\-WWF4p V ^,p T P0P3\4P64p T e4\4P8P:P<T P>9d \R 4hT pV'd \AWs4R # \.d \R4hi;i) z=A wrapper the return the validity of a known ocsp certificatez4you are not authorized to view this ocsp certificatez Received an Z.z ocsp certificate statusz@failed to retrieve a successful response from the ocsp responderz)ocsp certificate was issued in the futurez1ocsp certificate has invalid update - in the pastz'no certificates found for the responderz'delegate not autorized for ocsp signingT)!rZload_der_ocsp_responseZresponse_statusZOCSPResponseStatusZ UNAUTHORIZEDrZ SUCCESSFULZcertificate_statusZOCSPCertStatusZGOODrZstrZsplitZ this_updatedatetimeZnowZ next_updateresponder_nameZissuer_key_hashZresponder_key_hashsubject certificates_get_certificates IndexError extensionsZget_extension_for_classrZExtendedKeyUsageoidZExtendedKeyUsageOIDZ OCSP_SIGNINGvaluer) r ocsp_bytesZvalidaterrZ issuer_hashresponder_hashZcert_to_validatecertsZresponder_certsZresponder_certZexts &&& r_check_certificater%1s// ;M$$(?(?(L(LL !WXX$$(?(?(J(JJ  + +t/B/B/G/G G!s=#C#CDJJ3OPQRST**  H  N    H$5$5$9$9$;;IJJ !!!  % %(9(9(=(=(? ?QRR"11N//K"55N"" 11 1  (&**+   M,Q/N''??@U@UV ;$((66CC399T!"KL L))9  M!"KL L Ms ? I I!cs(VfCVUu.uF4p\V4V8XgKVPVP8XgK2VNK6 ppV#VUu.uF5pVPV8XgKVPVP8XgK3VNK7 ppV#uupiuupiN)_get_pubkey_hashissuerr)r$rrr#crs&&&& rrrls "n4 9:[EXEX9X A     yyN* /0xx;;N;N/N A    s!B B B  B#BBcs$VP4p\V\4'd0VP\P \ P4pMs\V\4'd0VP\P\ P4pM.VP\P \ P4p\\4\P!4R7pVP!V4VP#4#))Zbackend)rrr public_bytesr DERrZPKCS1rZX962ZUncompressedPointZSubjectPublicKeyInfor r rdefault_backendZupdateZfinalize)Z certificaterZhZsha1& rr'r'}s  # # %F&,''    l.@.@ A F2 3 3    |/M/M N    l.O.O P  8 8 : ;DKKN ==?cs|VR9d \R4hRpVP4P4pVP4F2pVP4pVPVP 8XgK0TpM Vf \R4hVe(\ P!V4pWG8wd \R4h\W14#)zAn implementation of a function for set_ocsp_client_callback in PyOpenSSL. This function validates that the provide ocsp_bytes response is valid, and matches the expected, stapled responses. Nzno ocsp response presentz2no matching issuer cert found in certificate chainz/received and expected certificates do not match)r.N) rZget_peer_certificateZto_cryptographyZget_peer_cert_chainrr(rload_pem_x509_certificater%)Zconr"ZexpectedrZ peer_certr)certZes&&& rocsp_staple_verifierr1s [ 899K((*::!"ST T k 66r.csXa]tRt^toRtR RltRtRtRtRt Rt R t R t R t VtR#) OCSPVerifierzA class to verify ssl sockets for RFC6960/RFC6961. This can be used when using direct validation of OCSP responses and certificate revocations. @see https://datatracker.ietf.org/doc/html/rfc6960 @see https://datatracker.ietf.org/doc/html/rfc6961 Ncs6WnW nW0nW@nR#r&)SOCKHOSTPORTCA_CERTS)selfZsockZhostZportca_certss&&&&&r__init__ZOCSPVerifier.__init__s    r.c s\P!V4p\P!VP 4\ P !44pV#)z?Convert SSL certificates in a binary (DER) format to ASCII PEM.)sslZDER_cert_to_PEM_certrr/encoderr,)r7derpemr0s&& r _bin2asciiZOCSPVerifier._bin2asciis:&&s+--cjjlH_certificate_components)r7r<r0& rcomponents_from_socketZ#OCSPVerifier.components_from_socketsJ ii##D) %<!"EF Fs#++D11r.c sVPP\PPP 4P pTUu.uF:pTP\PPP8XgK8TNK< ppT^,PP pTUu.uF:pTP\PPP8XgK8TNK< ppT^,PP pYT3# \PPPd \R4hi;iuupi \dRpLi;iuupi \d \R4hi;i)zGiven an SSL certificate, retract the useful components for validating the certificate status with an OCSP server. Args: cert ([bytes]): A PEM encoded ssl certificate z-No AIA information present in ssl certificateNzno ocsp servers in certificate)rZget_extension_for_oidrr Z ExtensionOIDZAUTHORITY_INFORMATION_ACCESSr! cryptographyZExtensionNotFoundrZ access_methodZAuthorityInformationAccessOIDZ CA_ISSUERSZaccess_locationrZOCSP)r7r0ZaiaZiZissuersr(Zocspsrs&& rr?Z$OCSPVerifier._certificate_componentssg S//77%%BBe  $(("H"H"S"SS A   QZ//55F $(("H"H"M"MM A   D8++11DT!!5  ++== S!"QR R S  F   D!"BC C DsBAD 5E E E15E%+E%4E*5E  E"!E"*Fc s\P!VPVP3VPR7p\ P !VP4\P!44pVPV4#)zReturn the certificate, primary issuer, and primary ocsp server from the host defined by the socket. This is useful in cases where different certificates are occasionally presented. )r8) r:Zget_server_certificater4r5r6rr/r;rr,r?)r7r=r0r@r!components_from_direct_connectionZ.OCSPVerifier.components_from_direct_connectionsY (($))TYY)?$--X--cjjlHrFrZnetlocr%) r7rEr0 issuer_urlZrr<rZocsp_urlZheaders &&&& rcheck_certificateZOCSPVerifier.check_certificate s LL $ttt!"FG Giiooc* --fKH HX&-- 6  LL 2ttt!"DE E!+yy$??r.c sVP4wrpVf \R4hVPW1V4# \d8TP 4wrpTf \R4hTPY1T4u#i;i)aReturns the validity of the certificate wrapping our socket. This first retrieves for validate the certificate, issuer_url, and ocsp_server for certificate validate. Then retrieves the issuer certificate from the issuer_url, and finally checks the validity of OCSP revocation status. z%no issuers found in certificate chain)rArrIrrC)r7r0rHZ ocsp_serverr-ris_validZOCSPVerifier.is_valid!s I,0,G,G,I )Dk!%&MNN))+ZH H! I,0,R,R,T )Dk!%&MNN))+ZH H  Is36?A87A8)r6r4r5r3r&)Z__name__Z __module__Z __qualname__Z__firstlineno__Z__doc__r9r>rAr?rCrFrIrJZ__static_attributes__Z__classdictcell__)Z __classdict__s@rr2r2s;!  2&"P2 @*IIr.r2)Tr&)(rDrr:Z urllib.parserrZ%cryptography.hazmat.primitives.hashesrBrGrrZcryptography.exceptionsrZcryptography.hazmatrZ-cryptography.hazmat.primitives.asymmetric.dsarZ,cryptography.hazmat.primitives.asymmetric.ecrrZ1cryptography.hazmat.primitives.asymmetric.paddingr Z-cryptography.hazmat.primitives.asymmetric.rsar r r Z,cryptography.hazmat.primitives.serializationr rZcryptography.x509rZredis.exceptionsrrrr%rr'r1r2)r.rrKs`  *,%4(FVFF<O"@?88v"  78JIJIr.