HEX
Server: Apache
System: Linux a16-asgard6.hospedagemuolhost.com.br 5.14.0-570.52.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Oct 15 06:39:08 EDT 2025 x86_64
User: maoristu4c3dbd03 (1436)
PHP: 8.1.33
Disabled: NONE
$ pwd: /usr/lib64/python3.9/site-packages/rhsm/__pycache__/
Upload Files
File: //usr/lib64/python3.9/site-packages/rhsm/__pycache__/certificate2.cpython-39.opt-1.pyc
a

X�Zh��@s�ddlZddlZddlZddlZddlZddlZddlZddlmZm	Z	m
Z
mZmZddl
mZddlmZddlmZmZmZmZmZmZmZddlmZddl
mZe�e�ZdZ d	Z!d
Z"dZ#dZ$d
Z%dZ&dZ'dZ(dZ)Gdd�de*�Z+Gdd�d�Z,Gdd�d�Z-Gdd�de�Z.Gdd�d�Z/Gdd�de/�Z0Gdd�de/�Z1Gd d!�d!e1�Z2Gd"d#�d#�Z3Gd$d%�d%�Z4Gd&d'�d'�Z5Gd(d)�d)�Z6dS)*�N)�Optional�List�Dict�Union�Tuple)�_certificate)�safe_int)�
Extensions�OID�	DateRange�GMT�get_datetime_from_x509�
parse_tags�CertificateException)�PathTree)�ourjsonz1.3.6.1.4.1.2312.9�4z4.1�6�7�8���ZOrgLevelc@s<eZdZdZd	eeeeeed�dd�Zed�dd�ZdS)
�CertificateLoadingErrorz5
    A certificate loading failure from OpenSSL.
    N��liberr�	reasonerr�path�pemcCs||_||_||_||_dS)a<
        :param liberr: string representing the OpenSSL library where the failure
               occurred
        :param reasonerr: string representing the OpenSSL failure string
        :param path: string representing the file being loaded
        :param pem: string representing the PEM data being loaded
        Nr)�selfrrrr�r �7/usr/lib64/python3.9/site-packages/rhsm/certificate2.py�__init__>sz CertificateLoadingError.__init__��returncCsD|j�d|j��}|jr*|d|j��7}n|jr@|d|j��7}|S)Nz: r)r�errr r r!�__str__KszCertificateLoadingError.__str__)NN)�__name__�
__module__�__qualname__�__doc__�strrr"r&r r r r!r9s
rc@s�eZdZdZedd�dd�Zd;eeed�dd	�Zej	eedd
�dd�Z
d
d�Zed�dd�Zej	e
d�dd�Zej	e
d�dd�Zeeej	edd�dd�Zeeej	edd�dd�Zeeej	edd�dd�Zeed d!�d"d#�Zed$d!�d%d&�Zeed'd!�d(d)�Zeed!�d*d+�Zeeej	eedd,�d-d.�Ze
d$d/�d0d1�Ze
ed d/�d2d3�Ze
ed'd/�d4d5�Ze
ed6d/�d7d8�Zee
d/�d9d:�Z dS)<�_CertFactorya�
    Factory for creating certificate objects.

    Examines the incoming file or PEM text, parses the OID structure,
    from the server, and returns the correct implementation class.
    determines the type of certificate we're dealing with
    (entitlement/product), as well as the version of the certificate

    NOTE: Please use the factory methods that leverage this class in
    certificate.py instead of this class.
    �EntitlementCertificate�rr$c
Cs�zt|d���}Wn0tyB}ztd|��WYd}~n
d}~00zt�|�}Wn@tjy�}z&t|jd|jd|d��WYd}~nd}~00|�	|||�SdS)zP
        Create appropriate certificate object from a PEM file on disk.
        �rzError loading certificate: %sNrr)r)
�open�read�IOErrorrr�load�OpenSSLCertificateLoadingErrorr�args�
_read_x509)rrrr%�cert�excr r r!�create_from_fileas"0z_CertFactory.create_from_fileN)rrc
Csp|std��ztj|d�}Wn@tjy\}z&t|jd|jd|d��WYd}~nd}~00|�|||�SdS)zJ
        Create appropriate certificate object from a PEM string.
        zEmpty certificate)rrrN)rrr3r4rr5r6)rrrr7r8r r r!�create_from_pemps0z_CertFactory.create_from_pem)�x509rrr$c	
Cs�zzt|�}tt�}|�|�}d}t|vr6|t�d�}t|�}|jdkrZ|�||||�WS|jdkrx|�	|||||�WSWn`t
y�}z|�WYd}~nBd}~0ty�}z"t�
|�t
t|���WYd}~n
d}~00dS)Nz1.0�utf-8rr)�_Extensions2r
�REDHAT_OID_NAMESPACE�branch�EXT_CERT_VERSION�decode�Version�major�_create_v1_cert�_create_v3_certr�	Exception�log�	exceptionr+)	rr;rr�
extensionsZ
redhat_oidZcert_version_str�version�er r r!r6}s"



z_CertFactory._read_x509cCsV|�|�}|tkr"|�||||�S|tkr:|�||||�S|tkrR|�||||�SdS�N)�_get_v1_cert_type�
IDENTITY_CERT�_create_identity_cert�ENTITLEMENT_CERT�_create_v1_ent_cert�PRODUCT_CERT�_create_v1_prod_cert)rrJrIr;rZ	cert_typer r r!rD�s
z_CertFactory._create_v1_certr#cCs&|jdd�}|durdS|�d�SdS)z+Try to read subjectAltName from certificateZsubjectAltName)�nameN�r<)Z
get_extensionrA)rr;�alt_namer r r!�_read_alt_name�sz_CertFactory._read_alt_name�r;r$cCs|��SrL)Z
get_issuer�rr;r r r!�_read_issuer�sz_CertFactory._read_issuercCs|��SrL)Zget_subjectrYr r r!�
_read_subject�sz_CertFactory._read_subject�IdentityCertificate)rJrIr;rr$cCsDt||||��t|���t|���|�|�|�|�|�|�d�	}|S)N)	r;rrJ�serial�start�endrV�subject�issuer)r\�get_serial_numberr
�get_not_before�
get_not_afterrWr[rZ)rrJrIr;rr7r r r!rO�s

�z"_CertFactory._create_identity_cert�ProductCertificatecCsH|�|�}t||||��t|���t|���||�|�|�|�d�	}|S)N)	r;rrJr]r^r_�productsr`ra)�_parse_v1_productsrerbr
rcrdr[rZ)rrJrIr;rrfr7r r r!rS�s


�z!_CertFactory._create_v1_prod_certc	Csb|�|�}|�|�}|�|�}t||||��t|���t|���|�|�|||||�	|�d�}|S)N)r;rrJr]r^r_r`�order�contentrfrIra)
�_parse_v1_order�_parse_v1_contentrgr-rbr
rcrdr[rZ)	rrJrIr;rrhrirfr7r r r!rQ�s$




�z _CertFactory._create_v1_ent_cert�Product)rIr$c	Cs�g}|�d�D]�}|d}|�d�}|d}|�|�}|�d�|�d�|�d�|�d�|�d�|�d	�d
�}t|���D]\}	}
|
durx|
�d�||	<qxt|d
�|d
<|�t	fd|i|���q|S)�]
        Returns an ordered list of all the product data in the
        certificate.
        �1.*.1rr�1�2�3r�5r)rTrJ�
architectures�
provided_tags�
brand_type�
brand_nameNr<rt�id)
�find�rtrimr?�get�list�itemsrAr�appendrl)rrIrfZprod_namespace�oid�rootZ
product_id�extZproduct_data�key�valuer r r!rg�s&

�
z_CertFactory._parse_v1_products�OrdercCs�|�t�}|�d�|�d�|�d�|�d�|�d�|�d�|�d�|�d�|�d	�|�d
�|�d�|�d�|�d
�|�d�|�d�|�d�d�}t|���D]\}}|dur�|�d�||<q�tfi|��}|S)Nrorprqrrrr�9�10Z11Z12Z13Z14Z15Z16Z17Z18)rT�number�sku�subscription�quantity�
virt_limit�socket_limit�contract�
quantity_used�warning_period�account�provides_management�
service_level�service_type�stacking_id�	virt_onlyr<)r?�ORDER_NAMESPACErzr{r|rAr�)rrIZorder_extensionsZ
order_datar�r�rhr r r!rjs.
�z_CertFactory._parse_v1_order�Contentc
Cs�g}|�d�}|D]�}|d�d�}|�|�}|�|�|�d�|�d�|�d�|�d�|�d�|�d	�|�d
�|�d�d�	}t|���D]\}}	|	dur�|	�d
�||<q�t|d�|d<|�t	fi|���q|S)Nz2.*.*.1rrrorprrrrrr�r�)	�content_typerT�label�vendor�url�gpg�enabled�metadata_expire�
required_tagsr<r�)
rxryr?rzr{r|rArr}r�)
rrIriZentsZentr~Zcontent_extZcontent_datar�r�r r r!rks*

�z_CertFactory._parse_v1_contentcCs.t|vrtSt|�ddd��dkr&tStSdS)NrnrTr)�EXT_ORDER_NAMErP�lenrxrRrN)rrIr r r!rM6s
z_CertFactory._get_v1_cert_type)rJrIr;rrr$c
Cs�z$|�d�d}|�d�d��}Wnty:d}Yn0|rz|�t�|��}|�|�}|�|�}	|�|�}
|�	|�}nd}d}	d}
d}t
|||||��t|�
��t|���|�|�||	|
|||�|�d�}|S)Nz -----BEGIN ENTITLEMENT DATA-----rz-----END ENTITLEMENT DATA-----r)r;rrJrIr]r^r_r`rhrirf�poolrra)�split�strip�
IndexError�_decompress_payload�base64Z	b64decode�_parse_v3_order�_parse_v3_content�_parse_v3_products�_parse_v3_poolr-rbr
rcrdr[rZ)
rrJrIr;rrZentitlement_data�payloadrhrirfr�r7r r r!rEAs@





�z_CertFactory._create_v3_cert)r�r$cCs�|d}|d}d}d}d|vr@|d�dd�}|d�dd�}t|d|�dd�|�dd�|�d	d�|�d
d�|�dd�|�d	d�|�d
d�|�dd�|�dd�|||�dd�|�dd�|�dd�|�dd�|�dd�|�dd�|�dd�d�S)Nr�rhZservice�level�typerTr�r�r�Zsocketsr�rZwarningrr�Z
managementFr�r�ZramZcores�roles�usage�addons)rTr�r�r�r�r�r�r�r�r�r�r�r�r��	ram_limit�
core_limitr�r�r�)rzr�)rr��subrhr�r�r r r!r�os8















�z_CertFactory._parse_v3_orderc
Cs\|d}g}|D]F}|�t|d|d|�dd�|�dg�|�dd�|�dd�d	��q|S)
rmrfrwrTrJNrsrurv)rwrTrJrsrurv)r}rlrz)rr�Zproduct_payloadrf�productr r r!r��s



��
z_CertFactory._parse_v3_productscCs�g}|dD]x}|dD]j}|�t|d|d|d|�dd�|�dd�|�dd�|�d	d
�|�dd�|�dg�|�d
g�d�
�qq|S)Nrfrir�rTr�r�rZgpg_urlr�Tr�r��arches)
r�rTr�r�r�r�r�r�r�r�)r}r�rz)rr�rir��cr r r!r��s$






��z_CertFactory._parse_v3_content�PoolcCs"|�dd�}|rt|dd�SdS)Nr�rw�rw)rzr�)rr�r�r r r!r��sz_CertFactory._parse_v3_poolc
CsXzt�|��d�}t�|�WStyR}zt�|�td��WYd}~n
d}~00dS)z�
        Certificate payloads arrive in zlib compressed strings
        of JSON.
        This method de-compresses and parses the JSON and returns the
        resulting dict.
        r<z0Error decompressing/parsing certificate payload.N)	�zlib�
decompressrA�json�loadsrFrGrHr)rr�ZdecompressedrKr r r!r��s
z _CertFactory._decompress_payload)N)!r'r(r)r*r+r9rr:r�X509r6rDrW�dictrZr[�intr	rOrSrQrrgrjrkrMrEr�r�r�r��bytesr�r r r r!r,Ts:



�
�
��. r,c@s,eZdZdZed�dd�Zed�dd�ZdS)	rBz-Small wrapper for version string comparisons.��version_strcCsn||_|�d�|_tt|j��D]}t|j|�|j|<q ||jd|_d|_t|j�dkrj|jd|_dS)N�.rr)r�r��segments�ranger�r�rC�minor)rr��ir r r!r"�szVersion.__init__r#cCs|jSrLr��rr r r!r&�szVersion.__str__N)r'r(r)r*r+r"r&r r r r!rB�srBc@seZdZejdd�dd�ZdS)r=NrXcCs2|��}t|���D]\}}t|�}|||<qdS)zS
        Override parent method for an X509 object from the new C wrapper.
        N)Zget_all_extensionsr{r|r
)rr;rIr�r�r~r r r!�_parse�sz_Extensions2._parse)r'r(r)rr�r�r r r r!r=�sr=c@seZdZdZddddddedef	eejeeee	ee	ee
j
ee
j
eeeeeed�	dd�Zdee
j
d�dd�Zd ee
j
d�d	d
�Z
ed�dd
�Zed�dd�Zed�dd�Zed�dd�Zed�dd�Zed�dd�Ze	d�dd�Zedd�dd�Zdd�dd�ZdS)!�Certificatez+Parent class of all x509 certificate types.N)	r;rrJr]r^r_r`rrac

CsZ||_||_||_|dur"td��||_||_||_t|j|j�|_||_	||_
|	|_dS)NzCertificate has no serial)r;rrJrr]r^r_r�valid_rangerr`ra)
rr;rrJr]r^r_r`rrar r r!r"�szCertificate.__init__)�on_datecCs2tj�tjj�}|r|}|jt�d�}|j�|�S�N�Ztzinfo)�datetime�now�timezone�utc�replacerr�Zhas_date�rr��gmtr r r!�is_valids
zCertificate.is_validcCs4tj�tjj�}|r|}|jt�d�}|j��|kSr�)r�r�r�r�r�rr�r_r�r r r!�
is_expireds
zCertificate.is_expiredr#cCs|j|jkSrL�r_�r�otherr r r!�__lt__&szCertificate.__lt__cCs|j|jkSrLr�r�r r r!�__le__)szCertificate.__le__cCs|j|jkSrLr�r�r r r!�__gt__,szCertificate.__gt__cCs|j|jkSrLr�r�r r r!�__ge__/szCertificate.__ge__cCst|d�o|j|jkS�Nr]��hasattrr]r�r r r!�__eq__2szCertificate.__eq__cCst|d�p|j|jkSr�r�r�r r r!�__ne__5szCertificate.__ne__cCs|jSrL)r]r�r r r!�__hash__8szCertificate.__hash__r.cCsPt|d�}|jdur"|�|j�n|�|j���|��t�|d�||_dS)z0
        Write the certificate to disk.
        �wNi�)	r0r�writer;Zas_pem�close�os�chmodr)rr�fr r r!r�;s

zCertificate.writecCs |jrt�|j�ntd��dS)zC
        Delete the file associated with this certificate.
        z'Certificate has no path, cannot delete.N)rr��unlinkrr�r r r!�deleteJszCertificate.delete)N)N)r'r(r)r*r�rrr�r+r�r�r"r�r��boolr�r�r�r�r�r�r�r�r�r r r r!r��s@��&r�c@s eZdZdeed�dd�ZdS)r\N)rVcKstj|fi|��||_dSrL)r�r"rV)rrV�kwargsr r r!r"UszIdentityCertificate.__init__)N)r'r(r)rr+r"r r r r!r\Tsr\c@s eZdZdedd�dd�ZdS)reNrl)rfcKs(tj|fi|��|durg}||_dSrL)r�r"rf)rrfr�r r r!r"[szProductCertificate.__init__)N)r'r(r)rr"r r r r!reZsrec@s�eZdZdedeededeed�dd�Zeed�d	d
��Z	ee
d�dd��Zed
d��Zddd�Z
dd�Zeed�dd�Zeeed�dd��Zdd�dd�Zed�dd�ZdS)r-Nr�r�r�)rhrir�rIcKs4tj|fi|��||_||_||_||_d|_dSrL)rer"rhrir�rI�_path_tree_object)rrhrir�rIr�r r r!r"fszEntitlementCertificate.__init__r#cCs&|j�t�r|j�t��d�SdSdS)Nr<ZBasic)rIrz�EXT_ENT_TYPErAr�r r r!�entitlement_typeusz'EntitlementCertificate.entitlement_typecCsH|jjdkrtd|jj��|jsB|jt}|s8td��t|�|_|jS)z�
        :return:    PathTree object built from this cert's extensions

        :raise: AttributeError if self.version.major < 3
        rz path tree not used for v%d certsz0Certificate has empty entitlement data extension)rJrC�AttributeErrorr�rI�EXT_ENT_PAYLOADr)r�datar r r!�
_path_tree|s

z!EntitlementCertificate._path_treecCsg}|j�|�|SrL)r�Zbuild_path_list)r�pathsr r r!�provided_paths�sz%EntitlementCertificate.provided_pathscCsLtj�tjj�}|r|}|jt�d�}tjt|jj	�d�}|j
��||kS)Nr�)Zdays)r�r�r�r�r�rZ	timedeltar�rhr�r�r_)rr�r�Zwarning_timer r r!�is_expiring�sz"EntitlementCertificate.is_expiringcCs0t�|�}|jjdkr |�|�S|j�|�SdS)a�
        Checks the given path against the list of entitled paths as encoded in
        extensions. See PathTree for more detailed docs.

        :param path:    path to which access is being requested
        :type  path:    basestring

        :return:    True iff the path matches, else False
        :rtype:     bool

        :raise:    ValueError when self.version.major < 3
        rN)�	posixpath�normpathrJrC�_check_v1_pathr�Z
match_path)rrr r r!�
check_path�s

z!EntitlementCertificate.check_pathr.cCsd|�d�}d}t|j���D]B\}}|�d�}|�td��r|�td��r|�||�rd}q`q|S)z�
        Check the requested path against a v1 certificate

        :param path:    requested path
        :return:    True iff the path matches, else False
        �/Fr<z2.z.1.6T)r�r{rIr|rA�matchr
�_validate_v1_url)rrZvalidZext_oid�oid_urlr r r!r��s

z%EntitlementCertificate._check_v1_path)�destr$cCs$t�dd|�d��}t�||�duS)as
        Determines if the destination URL matches the OID's URL.

        Swaps out all $ variables (e.g. $basearch, $version) for a reg ex
        wildcard in that location. For example, the following entitlement:
          content/dist/rhel/server/$version/$basearch/os

        Should allow any value for the variables:
          content/dist/rhel/server/.+?/.+?/os

        :param oid_url: path associated with an entitlement OID, as pulled from
                        the cert's extensions.
        :param dest:    path requested by a client

        :return: True iff the OID permits the destination else False
        z\$[^/]+(/|$)z[^/]+/r�N)�rer�r�r�)rrZoid_rer r r!r��sz'EntitlementCertificate._validate_v1_urlcCs t�|�|��}t�|�dS)zA
        Override parent to also delete certificate key.
        N)r�r��key_pathr�r�)rrr r r!r��s
zEntitlementCertificate.deletec
Csztj�|j�\}}zdt|�dd��}Wn<tyf}z$t�|�td|j��WYd}~n
d}~00tj�	||�}|S)z>
        Returns the full path to the cert key's pem.
        z	%s-key.%sr�rzqEntitlement certificate path "%s" is not in in the expected format so the key file path could not be based on it.N)
r�rr��tuple�rsplit�	TypeErrorrGrHr�join)rZdir_pathZ
cert_filenameZkey_filenamerKrr r r!r�s
��zEntitlementCertificate.key_path)NNNN)N)r'r(r)rrr	r"�propertyr+r�rr�r�r�r�r�r��staticmethodr�r�rr r r r!r-es.�
�

r-c	@s\eZdZdZd	eeeeeeeeeeeeeeed�dd�Zded�dd�Z	dS)
rlz@
    Represents the product information from a certificate.
    N)rwrTrJrsrtrurvcCs�|durtd��|dur td��||_||_||_||_t|t�rLt|�|_|jdur\g|_||_|jdurrg|_||_	||_
dS)NzProduct missing namezProduct missing ID)rrwrTrJrs�
isinstancer+rrtrurv)rrwrTrJrsrtrurvr r r!r"�s"




zProduct.__init__)r�r$cCs|j|jkSrLr�r�r r r!r� szProduct.__eq__)NNNNNNN)
r'r(r)r*rr+rr"r�r�r r r r!rl�s$�
�"rlc@s"eZdZdZddd�Zdd�ZdS)r�zc
    Represents the order information for the subscription an entitlement
    originated from.
    NcCs�||_||_||_||_t|d�|_t|	d�|_||_||_t|d�|_	t|
d�|_
||_||_|pfd|_
|
|_||_||_||_||_|p�d|_t|d�|_t|d�|_dS)NrrF)rTr�r�r�rr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�)rrTr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r r r!r"*s*

zOrder.__init__cCsd|j|j|jfS)Nz!<Order: name=%s number=%s sku=%s>)rTr�r�r�r r r!r&esz
Order.__str__)NNNNNNNNNNNNNNNNNNNNN)r'r(r)r*r"r&r r r r!r�$s0�
;r�c
@s.eZdZd
dd�Zdd�Zdd�Zdd	�ZdS)r�NcCs�|dus|durtd��||_||_||_||_||_||_|sHtd��|dvr\td|��d|_|dusz|dksz|dur�d|_||_|	p�g|_	|
p�g|_
dS)NzContent missing name/labelz!Content does not have a type set.)Nrr�0roz#Invalid content enabled setting: %sFroT)rr�rTr�r�r�r�r�r�r�r�)rr�rTr�r�r�r�r�r�r�r�r r r!r"js$

zContent.__init__cCst||j�o|j|jkSrL)r
�	__class__r�r�r r r!r��szContent.__eq__cCsd|j|j|j|jfS)Nz6<Content: content_type=%s name=%s label=%s enabled=%s>)r�rTr�r�r�r r r!r&�s�zContent.__str__cCs
t|j�SrL)�hashr�r�r r r!r��szContent.__hash__)
NNNNNNNNNN)r'r(r)r"r�r&r�r r r r!r�is�
(r�c@s"eZdZdZddd�Zdd�ZdS)r�z=
    Represents the pool an entitlement originates from.
    NcCs|durtd��||_dS)NzPool is missing ID)rrw)rrwr r r!r"�sz
Pool.__init__cCs|j|jkSrLr�r�r r r!r��szPool.__eq__)N)r'r(r)r*r"r�r r r r!r��s
r�)7r�Zloggingr�r�rr�r��typingrrrrrZrhsmrZrhsm.connectionrZrhsm.certificater	r
rrr
rrZ
rhsm.pathtreerrr�Z	getLoggerr'rGr>r�r�r@r�r�rRrPrNZCONTENT_ACCESS_CERT_TYPErFrr,rBr=r�r\rer-rlr�r�r�r r r r!�<module>sL$	
}e+E8
@ Telegram