a
     `tT                     @   s.  d dl mZmZmZ d dlZd dlZd dlmZmZ d dl	m
Z
 d dlmZmZmZmZmZ d dlmZmZ d dlmZmZ d dlmZmZmZ d d	lmZ eejG d
d deZ eej!G dd deZ"eej#G dd deZ$eej%G dd deZ&eej'j(G dd deZ)dS )    )absolute_importdivisionprint_functionN)utilsx509)UnsupportedAlgorithm)_asn1_integer_to_int_asn1_string_to_bytes_decode_x509_name_obj2txt_parse_asn1_time)_encode_asn1_int_gc_txt2obj_gc)hashesserialization)dsaecrsa)	_ASN1Typec                   @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	e
dZedd Zdd Zedd Zedd Zedd Zedd Zedd Zedd Ze
jd d! Zed"d# Zed$d% Zd&d' Zd(S ))_Certificatec                 C   sZ   || _ || _| j j| j}|dkr0tjj| _n&|dkrDtjj| _nt	d
||d S )Nr      z{} is not a valid X509 version)_backend_x509_libZX509_get_versionr   Versionv1_versionZv3ZInvalidVersionformat)selfbackendZ	x509_certversion r!   K/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/x509.py__init__   s    
z_Certificate.__init__c                 C   s   d | jS )Nz<Certificate(subject={}, ...)>)r   subjectr   r!   r!   r"   __repr__,   s    z_Certificate.__repr__c                 C   s,   t |tjstS | jj| j|j}|dkS Nr   )
isinstancer   CertificateNotImplementedr   r   ZX509_cmpr   r   otherresr!   r!   r"   __eq__/   s    z_Certificate.__eq__c                 C   s
   | |k S Nr!   r   r,   r!   r!   r"   __ne__6   s    z_Certificate.__ne__c                 C   s   t | tjjS r/   hashpublic_bytesr   EncodingDERr%   r!   r!   r"   __hash__9   s    z_Certificate.__hash__c                 C   s   | S r/   r!   )r   memor!   r!   r"   __deepcopy__<   s    z_Certificate.__deepcopy__c                 C   s*   t || j}|| tjj | S r/   )	r   Hashr   updater4   r   r5   r6   finalize)r   	algorithmhr!   r!   r"   fingerprint?   s    z_Certificate.fingerprintr   c                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_get_serialNumberr   openssl_assert_ffiNULLr   r   asn1_intr!   r!   r"   serial_numberF   s    z_Certificate.serial_numberc                 C   sR   | j j| j}|| j jjkr0| j   td| j j|| j jj	}| j 
|S )Nz,Certificate public key is of an unknown type)r   r   ZX509_get_pubkeyr   rA   rB   _consume_errors
ValueErrorgcEVP_PKEY_free_evp_pkey_to_public_keyr   pkeyr!   r!   r"   
public_keyL   s    
z_Certificate.public_keyc                 C   s   | j j| j}t| j |S r/   )r   r   ZX509_getm_notBeforer   r   r   Z	asn1_timer!   r!   r"   not_valid_beforeW   s    z_Certificate.not_valid_beforec                 C   s   | j j| j}t| j |S r/   )r   r   ZX509_getm_notAfterr   r   rN   r!   r!   r"   not_valid_after\   s    z_Certificate.not_valid_afterc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_get_issuer_namer   r@   rA   rB   r
   r   issuerr!   r!   r"   rR   a   s    z_Certificate.issuerc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_get_subject_namer   r@   rA   rB   r
   r   r$   r!   r!   r"   r$   g   s    z_Certificate.subjectc                 C   s8   | j }ztj| W S  ty2   td|Y n0 d S Nz)Signature algorithm OID:{} not recognizedsignature_algorithm_oidr   Z_SIG_OIDS_TO_HASHKeyErrorr   r   r   oidr!   r!   r"   signature_hash_algorithmm   s    z%_Certificate.signature_hash_algorithmc                 C   s^   | j jd}| j j| j jj|| j | j |d | j jjk t| j |d j	}t
|S NzX509_ALGOR **r   )r   rA   newr   X509_get0_signaturerB   r   r@   r   r=   r   ObjectIdentifierr   ZalgrY   r!   r!   r"   rV   w   s    z$_Certificate.signature_algorithm_oidc                 C   s   | j j| jS r/   )r   Z_certificate_extension_parserparser   r%   r!   r!   r"   
extensions   s    z_Certificate.extensionsc                 C   sR   | j jd}| j j|| j jj| j | j |d | j jjk t| j |d S NzASN1_BIT_STRING **r   )	r   rA   r\   r   r]   rB   r   r@   r	   r   Zsigr!   r!   r"   	signature   s    z_Certificate.signaturec                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nunsigned char **r   c                    s    j j| d S r'   r   r   ZOPENSSL_freeZpointerr%   r!   r"   <lambda>       z4_Certificate.tbs_certificate_bytes.<locals>.<lambda>)	r   rA   r\   r   Zi2d_re_X509_tbsr   r@   rH   bufferr   Zppr-   r!   r%   r"   tbs_certificate_bytes   s    z"_Certificate.tbs_certificate_bytesc                 C   sn   | j  }|tjju r*| j j|| j}n(|tjju rJ| j j	|| j}nt
d| j |dk | j |S Nz/encoding must be an item from the Encoding enum   )r   _create_mem_bio_gcr   r5   PEMr   ZPEM_write_bio_X509r   r6   Zi2d_X509_bio	TypeErrorr@   _read_mem_bior   encodingbior-   r!   r!   r"   r4      s    
z_Certificate.public_bytesN)__name__
__module____qualname__r#   r&   r.   r1   r7   r9   r?   r   Zread_only_propertyr    propertyrE   rM   rO   rP   rR   r$   rZ   rV   cached_propertyra   rd   rl   r4   r!   r!   r!   r"   r      s<   






	
	


	r   c                   @   s:   e Zd Zdd Zedd Zedd Zejdd Z	d	S )
_RevokedCertificatec                 C   s   || _ || _|| _d S r/   )r   Z_crl_x509_revoked)r   r   ZcrlZx509_revokedr!   r!   r"   r#      s    z_RevokedCertificate.__init__c                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_REVOKED_get0_serialNumberr|   r@   rA   rB   r   rC   r!   r!   r"   rE      s
    z!_RevokedCertificate.serial_numberc                 C   s   t | j| jj| jS r/   )r   r   r   Z X509_REVOKED_get0_revocationDater|   r%   r!   r!   r"   revocation_date   s    z#_RevokedCertificate.revocation_datec                 C   s   | j j| jS r/   )r   Z_revoked_cert_extension_parserr`   r|   r%   r!   r!   r"   ra      s    z_RevokedCertificate.extensionsN)
rv   rw   rx   r#   ry   rE   r}   r   rz   ra   r!   r!   r!   r"   r{      s   

r{   c                   @   s   e Zd Zdd Zdd Zdd Zdd Zejd	d
 Z	dd Z
edd Zedd Zedd Zedd Zedd Zedd Zedd Zdd Zdd Zdd  Zd!d" Zd#d$ Zejd%d& Zd'd( Zd)S )*_CertificateRevocationListc                 C   s   || _ || _d S r/   )r   	_x509_crl)r   r   Zx509_crlr!   r!   r"   r#      s    z#_CertificateRevocationList.__init__c                 C   s,   t |tjstS | jj| j|j}|dkS r'   )r(   r   CertificateRevocationListr*   r   r   ZX509_CRL_cmpr   r+   r!   r!   r"   r.      s    z!_CertificateRevocationList.__eq__c                 C   s
   | |k S r/   r!   r0   r!   r!   r"   r1      s    z!_CertificateRevocationList.__ne__c                 C   sX   t || j}| j }| jj|| j}| j|dk | j|}|	| |
 S )Nrn   )r   r:   r   ro   r   i2d_X509_CRL_bior   r@   rr   r;   r<   )r   r=   r>   ru   r-   Zderr!   r!   r"   r?      s    

z&_CertificateRevocationList.fingerprintc                 C   s@   | j j| j}| j || j jjk | j j|| j jj}|S r/   )	r   r   ZX509_CRL_dupr   r@   rA   rB   rH   ZX509_CRL_free)r   dupr!   r!   r"   _sorted_crl   s    z&_CertificateRevocationList._sorted_crlc                 C   sl   | j jd}t| j |}| j j| j||}|dkr:d S | j |d | j jjk t	| j | j|d S d S )NzX509_REVOKED **r   )
r   rA   r\   r   r   ZX509_CRL_get0_by_serialr   r@   rB   r{   )r   rE   revokedrD   r-   r!   r!   r"   (get_revoked_certificate_by_serial_number   s    zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberc                 C   s8   | j }ztj| W S  ty2   td|Y n0 d S rT   rU   rX   r!   r!   r"   rZ      s    z3_CertificateRevocationList.signature_hash_algorithmc                 C   s^   | j jd}| j j| j| j jj| | j |d | j jjk t| j |d j	}t
|S r[   )r   rA   r\   r   X509_CRL_get0_signaturer   rB   r@   r   r=   r   r^   r_   r!   r!   r"   rV     s    z2_CertificateRevocationList.signature_algorithm_oidc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_CRL_get_issuerr   r@   rA   rB   r
   rQ   r!   r!   r"   rR     s    z!_CertificateRevocationList.issuerc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_CRL_get_nextUpdater   r@   rA   rB   r   )r   Znur!   r!   r"   next_update  s    z&_CertificateRevocationList.next_updatec                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_CRL_get_lastUpdater   r@   rA   rB   r   )r   Zlur!   r!   r"   last_update  s    z&_CertificateRevocationList.last_updatec                 C   sR   | j jd}| j j| j|| j jj | j |d | j jjk t| j |d S rb   )	r   rA   r\   r   r   r   rB   r@   r	   rc   r!   r!   r"   rd   "  s    z$_CertificateRevocationList.signaturec                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nre   r   c                    s    j j| d S r'   rf   rg   r%   r!   r"   rh   1  ri   z?_CertificateRevocationList.tbs_certlist_bytes.<locals>.<lambda>)	r   rA   r\   r   Zi2d_re_X509_CRL_tbsr   r@   rH   rj   rk   r!   r%   r"   tbs_certlist_bytes+  s    z-_CertificateRevocationList.tbs_certlist_bytesc                 C   sn   | j  }|tjju r*| j j|| j}n(|tjju rJ| j j	|| j}nt
d| j |dk | j |S rm   )r   ro   r   r5   rp   r   ZPEM_write_bio_X509_CRLr   r6   r   rq   r@   rr   rs   r!   r!   r"   r4   5  s    
z'_CertificateRevocationList.public_bytesc                 C   sD   | j j| j}| j j||}| j || j jjk t| j | |S r/   )	r   r   X509_CRL_get_REVOKEDr   Zsk_X509_REVOKED_valuer@   rA   rB   r{   )r   idxr   rr!   r!   r"   _revoked_certC  s    z(_CertificateRevocationList._revoked_certc                 c   s"   t t| D ]}| |V  qd S r/   )rangelenr   )r   ir!   r!   r"   __iter__I  s    z#_CertificateRevocationList.__iter__c                    s   t |tr8|t \}}} fddt|||D S t|}|dk rV|t 7 }d|  krnt k stn t |S d S )Nc                    s   g | ]}  |qS r!   )r   ).0r   r%   r!   r"   
<listcomp>P  ri   z:_CertificateRevocationList.__getitem__.<locals>.<listcomp>r   )	r(   sliceindicesr   r   operatorindex
IndexErrorr   )r   r   startstopstepr!   r%   r"   __getitem__M  s    

z&_CertificateRevocationList.__getitem__c                 C   s4   | j j| j}|| j jjkr"dS | j j|S d S r'   )r   r   r   r   rA   rB   Zsk_X509_REVOKED_num)r   r   r!   r!   r"   __len__Y  s    z"_CertificateRevocationList.__len__c                 C   s   | j j| jS r/   )r   Z_crl_extension_parserr`   r   r%   r!   r!   r"   ra   `  s    z%_CertificateRevocationList.extensionsc                 C   sL   t |tjtjtjfstd| jj	
| j|j}|dkrH| j  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.rn   FT)r(   r   ZDSAPublicKeyr   ZRSAPublicKeyr   ZEllipticCurvePublicKeyrq   r   r   ZX509_CRL_verifyr   Z	_evp_pkeyrF   )r   rM   r-   r!   r!   r"   is_signature_validd  s    
z-_CertificateRevocationList.is_signature_validN)rv   rw   rx   r#   r.   r1   r?   r   rz   r   r   ry   rZ   rV   rR   r   r   rd   r   r4   r   r   r   r   ra   r   r!   r!   r!   r"   r~      s:   	
	
	
	




	
r~   c                   @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zedd Z	edd Z
edd Zejdd Zdd Zedd Zedd Zedd Zdd ZdS )_CertificateSigningRequestc                 C   s   || _ || _d S r/   )r   	_x509_req)r   r   Zx509_reqr!   r!   r"   r#   z  s    z#_CertificateSigningRequest.__init__c                 C   s2   t |tstS | tjj}|tjj}||kS r/   )r(   r   r*   r4   r   r5   r6   )r   r,   Z
self_bytesZother_bytesr!   r!   r"   r.   ~  s
    
z!_CertificateSigningRequest.__eq__c                 C   s
   | |k S r/   r!   r0   r!   r!   r"   r1     s    z!_CertificateSigningRequest.__ne__c                 C   s   t | tjjS r/   r2   r%   r!   r!   r"   r7     s    z#_CertificateSigningRequest.__hash__c                 C   sH   | j j| j}| j || j jjk | j j|| j jj}| j 	|S r/   )
r   r   X509_REQ_get_pubkeyr   r@   rA   rB   rH   rI   rJ   rK   r!   r!   r"   rM     s    z%_CertificateSigningRequest.public_keyc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_REQ_get_subject_namer   r@   rA   rB   r
   rS   r!   r!   r"   r$     s    z"_CertificateSigningRequest.subjectc                 C   s8   | j }ztj| W S  ty2   td|Y n0 d S rT   rU   rX   r!   r!   r"   rZ     s    z3_CertificateSigningRequest.signature_hash_algorithmc                 C   s^   | j jd}| j j| j| j jj| | j |d | j jjk t| j |d j	}t
|S r[   )r   rA   r\   r   X509_REQ_get0_signaturer   rB   r@   r   r=   r   r^   r_   r!   r!   r"   rV     s    z2_CertificateSigningRequest.signature_algorithm_oidc                    s6    j j j} j j| fdd} j j|S )Nc                    s"    j j|  j j j jjdS )NZX509_EXTENSION_free)r   r   Zsk_X509_EXTENSION_pop_freerA   Z	addressofZ_original_lib)xr%   r!   r"   rh     s
   
z7_CertificateSigningRequest.extensions.<locals>.<lambda>)r   r   ZX509_REQ_get_extensionsr   rA   rH   Z_csr_extension_parserr`   )r   Z	x509_extsr!   r%   r"   ra     s    
	z%_CertificateSigningRequest.extensionsc                 C   sn   | j  }|tjju r*| j j|| j}n(|tjju rJ| j j	|| j}nt
d| j |dk | j |S rm   )r   ro   r   r5   rp   r   ZPEM_write_bio_X509_REQr   r6   Zi2d_X509_REQ_biorq   r@   rr   rs   r!   r!   r"   r4     s    
z'_CertificateSigningRequest.public_bytesc                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nre   r   c                    s    j j| d S r'   rf   rg   r%   r!   r"   rh     ri   zB_CertificateSigningRequest.tbs_certrequest_bytes.<locals>.<lambda>)	r   rA   r\   r   Zi2d_re_X509_REQ_tbsr   r@   rH   rj   rk   r!   r%   r"   tbs_certrequest_bytes  s    z0_CertificateSigningRequest.tbs_certrequest_bytesc                 C   sR   | j jd}| j j| j|| j jj | j |d | j jjk t| j |d S rb   )	r   rA   r\   r   r   r   rB   r@   r	   rc   r!   r!   r"   rd     s    z$_CertificateSigningRequest.signaturec                 C   sh   | j j| j}| j || j jjk | j j|| j jj}| j j	| j|}|dkrd| j 
  dS dS )Nrn   FT)r   r   r   r   r@   rA   rB   rH   rI   ZX509_REQ_verifyrF   )r   rL   r-   r!   r!   r"   r     s    
z-_CertificateSigningRequest.is_signature_validc                 C   s   t | j|j}| jj| j|d}|dkr<td||| jj	| j|}| j
|| jjjk | j
| jj|dk | jj|d}| j
|| jjjk |jtjjtjjtjjfvrtd||j| jj|d|j| jjj}| j
|| jjjk | jjd|}t| j|S )NzNo {} attribute was foundrn   r   z&OID {} has a disallowed ASN.1 type: {}zASN1_STRING *)r   r   Zdotted_stringr   ZX509_REQ_get_attr_by_OBJr   r   ZAttributeNotFoundr   ZX509_REQ_get_attrr@   rA   rB   ZX509_ATTRIBUTE_countZX509_ATTRIBUTE_get0_typetyper   Z
UTF8StringvalueZPrintableStringZ	IA5StringrG   ZX509_ATTRIBUTE_get0_datacastr	   )r   rY   objposattrZ	asn1_typedatar!   r!   r"   get_attribute_for_oid  s>    
z0_CertificateSigningRequest.get_attribute_for_oidN)rv   rw   rx   r#   r.   r1   r7   rM   ry   r$   rZ   rV   r   rz   ra   r4   r   rd   r   r   r!   r!   r!   r"   r   x  s*   

	
	

	

r   c                   @   sh   e Zd Zdd Zedd Zedd Zedd Zed	d
 Zedd Z	dd Z
dd Zdd ZdS )_SignedCertificateTimestampc                 C   s   || _ || _|| _d S r/   )r   Z	_sct_list_sct)r   r   Zsct_listZsctr!   r!   r"   r#     s    z$_SignedCertificateTimestamp.__init__c                 C   s,   | j j| j}|| j jjks"J tjjjS r/   )	r   r   ZSCT_get_versionr   ZSCT_VERSION_V1r   certificate_transparencyr   r   )r   r    r!   r!   r"   r      s    z#_SignedCertificateTimestamp.versionc                 C   sH   | j jd}| j j| j|}|dks,J | j j|d |d d  S Nre   r   )r   rA   r\   r   ZSCT_get0_log_idr   rj   )r   outZlog_id_lengthr!   r!   r"   log_id"  s    z"_SignedCertificateTimestamp.log_idc                 C   s4   | j j| j}|d }tj|d j|d dS )Ni  )Zmicrosecond)r   r   ZSCT_get_timestampr   datetimeZutcfromtimestampreplace)r   	timestampZmillisecondsr!   r!   r"   r   )  s
    z%_SignedCertificateTimestamp.timestampc                 C   s,   | j j| j}|| j jjks"J tjjjS r/   )	r   r   ZSCT_get_log_entry_typer   ZCT_LOG_ENTRY_TYPE_PRECERTr   r   ZLogEntryTypeZPRE_CERTIFICATE)r   
entry_typer!   r!   r"   r   1  s    z&_SignedCertificateTimestamp.entry_typec                 C   sf   | j jd}| j j| j|}| j |dk | j |d | j jjk | j j|d |d d  S r   )	r   rA   r\   r   ZSCT_get0_signaturer   r@   rB   rj   )r   Zptrptrr-   r!   r!   r"   
_signature9  s
    z&_SignedCertificateTimestamp._signaturec                 C   s
   t | jS r/   )r3   r   r%   r!   r!   r"   r7   A  s    z$_SignedCertificateTimestamp.__hash__c                 C   s   t |tstS | j|jkS r/   )r(   r   r*   r   r0   r!   r!   r"   r.   D  s    
z"_SignedCertificateTimestamp.__eq__c                 C   s
   | |k S r/   r!   r0   r!   r!   r"   r1   J  s    z"_SignedCertificateTimestamp.__ne__N)rv   rw   rx   r#   ry   r    r   r   r   r   r7   r.   r1   r!   r!   r!   r"   r     s   




r   )*Z
__future__r   r   r   r   r   Zcryptographyr   r   Zcryptography.exceptionsr   Z0cryptography.hazmat.backends.openssl.decode_asn1r   r	   r
   r   r   Z0cryptography.hazmat.backends.openssl.encode_asn1r   r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r   Zcryptography.x509.namer   Zregister_interfacer)   objectr   ZRevokedCertificater{   r   r~   ZCertificateSigningRequestr   r   ZSignedCertificateTimestampr   r!   r!   r!   r"   <module>   s0   
 	
%
 -
 