o
    )%a/Y                     @   s  d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm	Z	m
Z
mZ d dlmZmZmZmZmZ d dlmZmZ d dlmZmZ d dlmZ d d	lmZ G d
d dejZG dd dejZe ej!G dd de"Z#e ej$G dd de"Z%e ej&j'G dd de"Z(dS )    N)utilsx509)UnsupportedAlgorithm)dsaecrsa)_asn1_integer_to_int_asn1_string_to_bytes_decode_x509_name_obj2txt_parse_asn1_time)_encode_asn1_int_gc_txt2obj_gc)hashesserialization)_PUBLIC_KEY_TYPES)	_ASN1Typec                   @   sl  e Zd ZU ejed< dd Zdd Zdede	fdd	Z
dede	fd
dZdefddZdd ZdejdefddZedZedefddZdefddZedejfddZedejfddZedejfddZedejfddZ edej!ej fd d!Z"edej#fd"d#Z$ej%dej&fd$d%Z'edefd&d'Z(edefd(d)Z)d*e*j+defd+d,Z,d-S )._Certificate_ocsp_resp_refc                 C   sZ   || _ || _| j j| j}|dkrtjj| _d S |dkr$tjj| _d S t	d
||)Nr      z{} is not a valid X509 version)_backend_x509_libX509_get_versionr   Versionv1_versionv3InvalidVersionformat)selfbackend	x509_certversion r$   K/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/x509.py__init__!   s   
z_Certificate.__init__c                 C   s   d | jS )Nz<Certificate(subject={}, ...)>)r   subjectr    r$   r$   r%   __repr__/   s   z_Certificate.__repr__otherreturnc                 C   *   t |tstS | jj| j|j}|dkS Nr   )
isinstancer   NotImplementedr   r   X509_cmpr   r    r*   resr$   r$   r%   __eq__2      
z_Certificate.__eq__c                 C   
   | |k S Nr$   r    r*   r$   r$   r%   __ne__9      
z_Certificate.__ne__c                 C      t | tjjS r6   hashpublic_bytesr   EncodingDERr(   r$   r$   r%   __hash__<      z_Certificate.__hash__c                 C   s   | S r6   r$   )r    memor$   r$   r%   __deepcopy__?   s   z_Certificate.__deepcopy__	algorithmc                 C   s*   t || j}|| tjj | S r6   )	r   Hashr   updater=   r   r>   r?   finalize)r    rD   hr$   r$   r%   fingerprintB   s   z_Certificate.fingerprintr   c                 C   2   | j j| j}| j || j jjk t| j |S r6   )r   r   X509_get_serialNumberr   openssl_assert_ffiNULLr   r    asn1_intr$   r$   r%   serial_numberI      z_Certificate.serial_numberc                 C   sR   | j j| j}|| j jjkr| j   td| j j|| j jj	}| j 
|S )Nz,Certificate public key is of an unknown type)r   r   X509_get_pubkeyr   rM   rN   _consume_errors
ValueErrorgcEVP_PKEY_free_evp_pkey_to_public_keyr    pkeyr$   r$   r%   
public_keyO   s   
z_Certificate.public_keyc                 C      | j j| j}t| j |S r6   )r   r   X509_get0_notBeforer   r   r    	asn1_timer$   r$   r%   not_valid_beforeZ      z_Certificate.not_valid_beforec                 C   r\   r6   )r   r   X509_get0_notAfterr   r   r^   r$   r$   r%   not_valid_after_   ra   z_Certificate.not_valid_afterc                 C   rJ   r6   )r   r   X509_get_issuer_namer   rL   rM   rN   r
   r    issuerr$   r$   r%   rf   d   rR   z_Certificate.issuerc                 C   rJ   r6   )r   r   X509_get_subject_namer   rL   rM   rN   r
   r    r'   r$   r$   r%   r'   j   rR   z_Certificate.subjectc                 C   0   | j }ztj| W S  ty   td|w Nz)Signature algorithm OID:{} not recognizedsignature_algorithm_oidr   _SIG_OIDS_TO_HASHKeyErrorr   r   r    oidr$   r$   r%   signature_hash_algorithmp      z%_Certificate.signature_hash_algorithmc                 C   s^   | j jd}| j j| j jj|| j | j |d | j jjk t| j |d j	}t
|S NzX509_ALGOR **r   )r   rM   newr   X509_get0_signaturerN   r   rL   r   rD   r   ObjectIdentifierr    algrp   r$   r$   r%   rl   |      
z$_Certificate.signature_algorithm_oidc                 C      | j j| jS r6   )r   _certificate_extension_parserparser   r(   r$   r$   r%   
extensions      z_Certificate.extensionsc                 C   sR   | j jd}| j j|| j jj| j | j |d | j jjk t| j |d S NzASN1_BIT_STRING **r   )	r   rM   rt   r   ru   rN   r   rL   r	   r    sigr$   r$   r%   	signature      z_Certificate.signaturec                    d    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nunsigned char **r   c                        j j| d S r-   r   r   OPENSSL_freepointerr(   r$   r%   <lambda>       z4_Certificate.tbs_certificate_bytes.<locals>.<lambda>)	r   rM   rt   r   i2d_re_X509_tbsr   rL   rV   bufferr    ppr2   r$   r(   r%   tbs_certificate_bytes      z"_Certificate.tbs_certificate_bytesencodingc                 C   n   | j  }|tjju r| j j|| j}n|tjju r%| j j	|| j}nt
d| j |dk | j |S Nz/encoding must be an item from the Encoding enum   )r   _create_mem_bio_gcr   r>   PEMr   PEM_write_bio_X509r   r?   i2d_X509_bio	TypeErrorrL   _read_mem_bior    r   bior2   r$   r$   r%   r=      s   
z_Certificate.public_bytesN)-__name__
__module____qualname__typingAny__annotations__r&   r)   objectboolr3   r8   intr@   rC   r   HashAlgorithmbytesrI   r   read_only_propertyr#   propertyrQ   r   r[   datetimer`   rc   r   Namerf   r'   Optionalrq   rv   rl   cached_property
Extensionsr}   r   r   r   r>   r=   r$   r$   r$   r%   r      sD   
 


		r   c                   @   sP   e Zd Zdd ZedefddZedejfddZe	j
dejfdd	Zd
S )_RevokedCertificatec                 C      || _ || _|| _d S r6   )r   _crl_x509_revoked)r    r!   crlx509_revokedr$   r$   r%   r&      s   
z_RevokedCertificate.__init__r+   c                 C   rJ   r6   )r   r   X509_REVOKED_get0_serialNumberr   rL   rM   rN   r   rO   r$   r$   r%   rQ      s
   z!_RevokedCertificate.serial_numberc                 C   s   t | j| jj| jS r6   )r   r   r    X509_REVOKED_get0_revocationDater   r(   r$   r$   r%   revocation_date   s   z#_RevokedCertificate.revocation_datec                 C   rz   r6   )r   _revoked_cert_extension_parserr|   r   r(   r$   r$   r%   r}      s   z_RevokedCertificate.extensionsN)r   r   r   r&   r   r   rQ   r   r   r   r   r   r   r}   r$   r$   r$   r%   r      s    r   c                   @   sd  e Zd Zdd ZdedefddZdedefddZd	ej	de
fd
dZejdd Zdedejej fddZedejej	 fddZedejfddZedejfddZedejfddZedejfddZede
fddZede
fddZde j!de
fd d!Z"d"d# Z#d$d% Z$d&d' Z%defd(d)Z&ejdej'fd*d+Z(d,e)defd-d.Z*d/S )0_CertificateRevocationListc                 C      || _ || _d S r6   )r   	_x509_crl)r    r!   x509_crlr$   r$   r%   r&         
z#_CertificateRevocationList.__init__r*   r+   c                 C   r,   r-   )r.   r   r/   r   r   X509_CRL_cmpr   r1   r$   r$   r%   r3      r4   z!_CertificateRevocationList.__eq__c                 C   r5   r6   r$   r7   r$   r$   r%   r8      r9   z!_CertificateRevocationList.__ne__rD   c                 C   sX   t || j}| j }| jj|| j}| j|dk | j|}|	| |
 S )Nr   )r   rE   r   r   r   i2d_X509_CRL_bior   rL   r   rF   rG   )r    rD   rH   r   r2   derr$   r$   r%   rI      s   

z&_CertificateRevocationList.fingerprintc                 C   s@   | j j| j}| j || j jjk | j j|| j jj}|S r6   )	r   r   X509_CRL_dupr   rL   rM   rN   rV   X509_CRL_free)r    dupr$   r$   r%   _sorted_crl   s   z&_CertificateRevocationList._sorted_crlrQ   c                 C   sh   | j jd}t| j |}| j j| j||}|dkrd S | j |d | j jjk t	| j | j|d S )NzX509_REVOKED **r   )
r   rM   rt   r   r   X509_CRL_get0_by_serialr   rL   rN   r   )r    rQ   revokedrP   r2   r$   r$   r%   (get_revoked_certificate_by_serial_number   s   zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberc                 C   ri   rj   rk   ro   r$   r$   r%   rq     rr   z3_CertificateRevocationList.signature_hash_algorithmc                 C   ^   | j jd}| j j| j| j jj| | j |d | j jjk t| j |d j	}t
|S rs   )r   rM   rt   r   X509_CRL_get0_signaturer   rN   rL   r   rD   r   rv   rw   r$   r$   r%   rl     ry   z2_CertificateRevocationList.signature_algorithm_oidc                 C   rJ   r6   )r   r   X509_CRL_get_issuerr   rL   rM   rN   r
   re   r$   r$   r%   rf     rR   z!_CertificateRevocationList.issuerc                 C   rJ   r6   )r   r   X509_CRL_get0_nextUpdater   rL   rM   rN   r   )r    nur$   r$   r%   next_update  rR   z&_CertificateRevocationList.next_updatec                 C   rJ   r6   )r   r   X509_CRL_get0_lastUpdater   rL   rM   rN   r   )r    lur$   r$   r%   last_update$  rR   z&_CertificateRevocationList.last_updatec                 C   R   | j jd}| j j| j|| j jj | j |d | j jjk t| j |d S r   )	r   rM   rt   r   r   r   rN   rL   r	   r   r$   r$   r%   r   *  r   z$_CertificateRevocationList.signaturec                    r   )Nr   r   c                    r   r-   r   r   r(   r$   r%   r   9  r   z?_CertificateRevocationList.tbs_certlist_bytes.<locals>.<lambda>)	r   rM   rt   r   i2d_re_X509_CRL_tbsr   rL   rV   r   r   r$   r(   r%   tbs_certlist_bytes3  r   z-_CertificateRevocationList.tbs_certlist_bytesr   c                 C   r   r   )r   r   r   r>   r   r   PEM_write_bio_X509_CRLr   r?   r   r   rL   r   r   r$   r$   r%   r=   =     
z'_CertificateRevocationList.public_bytesc                 C   sD   | j j| j}| j j||}| j || j jjk t| j | |S r6   )	r   r   X509_CRL_get_REVOKEDr   sk_X509_REVOKED_valuerL   rM   rN   r   )r    idxr   rr$   r$   r%   _revoked_certK  s   z(_CertificateRevocationList._revoked_certc                 c   s$    t t| D ]}| |V  qd S r6   )rangelenr   )r    ir$   r$   r%   __iter__Q  s   z#_CertificateRevocationList.__iter__c                    s   t |tr|t \}}} fddt|||D S t|}|dk r+|t 7 }d|  kr8t k s;t t |S )Nc                    s   g | ]}  |qS r$   )r   ).0r   r(   r$   r%   
<listcomp>X  s    z:_CertificateRevocationList.__getitem__.<locals>.<listcomp>r   )	r.   sliceindicesr   r   operatorindex
IndexErrorr   )r    r   startstopstepr$   r(   r%   __getitem__U  s   


z&_CertificateRevocationList.__getitem__c                 C   s0   | j j| j}|| j jjkrdS | j j|S r-   )r   r   r   r   rM   rN   sk_X509_REVOKED_num)r    r   r$   r$   r%   __len__a  s   z"_CertificateRevocationList.__len__c                 C   rz   r6   )r   _crl_extension_parserr|   r   r(   r$   r$   r%   r}   h  r~   z%_CertificateRevocationList.extensionsr[   c                 C   sL   t |tjtjtjfstd| jj	
| j|j}|dkr$| j  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.r   FT)r.   r   _DSAPublicKeyr   _RSAPublicKeyr   _EllipticCurvePublicKeyr   r   r   X509_CRL_verifyr   	_evp_pkeyrT   )r    r[   r2   r$   r$   r%   is_signature_validl  s"   
z-_CertificateRevocationList.is_signature_validN)+r   r   r   r&   r   r   r3   r8   r   r   r   rI   r   r   r   r   r   r   r   RevokedCertificater   r   rq   rv   rl   r   rf   r   r   r   r   r   r   r>   r=   r   r   r   r   r   r}   r   r   r$   r$   r$   r%   r      sH    	
	


		r   c                   @   s
  e Zd Zdd ZdedefddZdedefddZdefd	d
Z	de
fddZedejfddZedejej fddZedejfddZejdejfddZdejdefddZedefddZedefddZ edefddZ!dejdefdd Z"d!S )"_CertificateSigningRequestc                 C   r   r6   )r   	_x509_req)r    r!   x509_reqr$   r$   r%   r&     r   z#_CertificateSigningRequest.__init__r*   r+   c                 C   s2   t |tstS | tjj}|tjj}||kS r6   )r.   r   r/   r=   r   r>   r?   )r    r*   
self_bytesother_bytesr$   r$   r%   r3     s
   
z!_CertificateSigningRequest.__eq__c                 C   r5   r6   r$   r7   r$   r$   r%   r8     r9   z!_CertificateSigningRequest.__ne__c                 C   r:   r6   r;   r(   r$   r$   r%   r@     rA   z#_CertificateSigningRequest.__hash__c                 C   sH   | j j| j}| j || j jjk | j j|| j jj}| j 	|S r6   )
r   r   X509_REQ_get_pubkeyr   rL   rM   rN   rV   rW   rX   rY   r$   r$   r%   r[     s   z%_CertificateSigningRequest.public_keyc                 C   rJ   r6   )r   r   X509_REQ_get_subject_namer   rL   rM   rN   r
   rh   r$   r$   r%   r'     rR   z"_CertificateSigningRequest.subjectc                 C   ri   rj   rk   ro   r$   r$   r%   rq     rr   z3_CertificateSigningRequest.signature_hash_algorithmc                 C   r   rs   )r   rM   rt   r   X509_REQ_get0_signaturer   rN   rL   r   rD   r   rv   rw   r$   r$   r%   rl     ry   z2_CertificateSigningRequest.signature_algorithm_oidc                    s6    j j j} j j| fdd} j j|S )Nc                    s"    j j|  j j j jjdS )NX509_EXTENSION_free)r   r   sk_X509_EXTENSION_pop_freerM   	addressof_original_lib)xr(   r$   r%   r     s    
z7_CertificateSigningRequest.extensions.<locals>.<lambda>)r   r   X509_REQ_get_extensionsr   rM   rV   _csr_extension_parserr|   )r    	x509_extsr$   r(   r%   r}     s   
	z%_CertificateSigningRequest.extensionsr   c                 C   r   r   )r   r   r   r>   r   r   PEM_write_bio_X509_REQr   r?   i2d_X509_REQ_bior   rL   r   r   r$   r$   r%   r=     r   z'_CertificateSigningRequest.public_bytesc                    r   )Nr   r   c                    r   r-   r   r   r(   r$   r%   r     r   zB_CertificateSigningRequest.tbs_certrequest_bytes.<locals>.<lambda>)	r   rM   rt   r   i2d_re_X509_REQ_tbsr   rL   rV   r   r   r$   r(   r%   tbs_certrequest_bytes  r   z0_CertificateSigningRequest.tbs_certrequest_bytesc                 C   r   r   )	r   rM   rt   r   r   r   rN   rL   r	   r   r$   r$   r%   r     r   z$_CertificateSigningRequest.signaturec                 C   sh   | j j| j}| j || j jjk | j j|| j jj}| j j	| j|}|dkr2| j 
  dS dS )Nr   FT)r   r   r   r   rL   rM   rN   rV   rW   X509_REQ_verifyrT   )r    rZ   r2   r$   r$   r%   r     s   
z-_CertificateSigningRequest.is_signature_validrp   c                 C   s   t | j|j}| jj| j|d}|dkrtd||| jj	| j|}| j
|| jjjk | j
| jj|dk | jj|d}| j
|| jjjk |jtjjtjjtjjfvritd||j| jj|d|j| jjj}| j
|| jjjk | jjd|}t| j|S )NzNo {} attribute was foundr   r   z&OID {} has a disallowed ASN.1 type: {}zASN1_STRING *)r   r   dotted_stringr   X509_REQ_get_attr_by_OBJr   r   AttributeNotFoundr   X509_REQ_get_attrrL   rM   rN   X509_ATTRIBUTE_countX509_ATTRIBUTE_get0_typetyper   
UTF8StringvaluePrintableString	IA5StringrU   X509_ATTRIBUTE_get0_datacastr	   )r    rp   objposattr	asn1_typedatar$   r$   r%   get_attribute_for_oid  s>   
z0_CertificateSigningRequest.get_attribute_for_oidN)#r   r   r   r&   r   r   r3   r8   r   r@   r   r[   r   r   r   r'   r   r   r   r   rq   rv   rl   r   r   r   r}   r   r>   r   r=   r	  r   r   r  r$   r$   r$   r%   r     s0    
		r   c                   @   s   e Zd Zdd ZedejjfddZede	fddZ
edejfdd	Zedejjfd
dZedd ZdefddZdedefddZdedefddZdS )_SignedCertificateTimestampc                 C   r   r6   )r   	_sct_list_sct)r    r!   sct_listsctr$   r$   r%   r&   $  s   
z$_SignedCertificateTimestamp.__init__r+   c                 C   ,   | j j| j}|| j jjksJ tjjjS r6   )	r   r   SCT_get_versionr!  SCT_VERSION_V1r   certificate_transparencyr   r   )r    r#   r$   r$   r%   r#   *  s   
z#_SignedCertificateTimestamp.versionc                 C   sH   | j jd}| j j| j|}|dksJ | j j|d |d d  S Nr   r   )r   rM   rt   r   SCT_get0_log_idr!  r   )r    outlog_id_lengthr$   r$   r%   log_id0  s   z"_SignedCertificateTimestamp.log_idc                 C   s4   | j j| j}|d }tj|d j|d dS )Ni  )microsecond)r   r   SCT_get_timestampr!  r   utcfromtimestampreplace)r    	timestampmillisecondsr$   r$   r%   r1  7  s
   z%_SignedCertificateTimestamp.timestampc                 C   r$  r6   )	r   r   SCT_get_log_entry_typer!  CT_LOG_ENTRY_TYPE_PRECERTr   r'  LogEntryTypePRE_CERTIFICATE)r    
entry_typer$   r$   r%   r7  ?  s   
z&_SignedCertificateTimestamp.entry_typec                 C   sf   | j jd}| j j| j|}| j |dk | j |d | j jjk | j j|d |d d  S r(  )	r   rM   rt   r   SCT_get0_signaturer!  rL   rN   r   )r    ptrptrr2   r$   r$   r%   
_signatureG  s
   z&_SignedCertificateTimestamp._signaturec                 C   s
   t | jS r6   )r<   r:  r(   r$   r$   r%   r@   O  r9   z$_SignedCertificateTimestamp.__hash__r*   c                 C   s   t |tstS | j|jkS r6   )r.   r  r/   r:  r7   r$   r$   r%   r3   R  s   
z"_SignedCertificateTimestamp.__eq__c                 C   r5   r6   r$   r7   r$   r$   r%   r8   X  r9   z"_SignedCertificateTimestamp.__ne__N)r   r   r   r&   r   r   r'  r   r#   r   r,  r   r1  r5  r7  r:  r   r@   r   r   r3   r8   r$   r$   r$   r%   r     s    
r  ))r   r   r   cryptographyr   r   cryptography.exceptionsr   $cryptography.hazmat.backends.opensslr   r   r   0cryptography.hazmat.backends.openssl.decode_asn1r   r	   r
   r   r   0cryptography.hazmat.backends.openssl.encode_asn1r   r   cryptography.hazmat.primitivesr   r   cryptography.x509.baser   cryptography.x509.namer   Certificater   r   r   register_interfaceCertificateRevocationListr   r   CertificateSigningRequestr   r'  SignedCertificateTimestampr  r$   r$   r$   r%   <module>   s0    
% 
5 