3
K^N                 @   s2  d dl mZmZmZ d dlZd dlZd dlmZmZ d dl	m
Z
 d dlmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZmZ d dlmZmZmZ ejej G d	d
 d
e!Z"ejej#G dd de!Z$ejej%G dd de!Z&ejej'G dd de!Z(ejej)j*G dd de!Z+dS )    )absolute_importdivisionprint_functionN)utilsx509)UnsupportedAlgorithm)
_CERTIFICATE_EXTENSION_PARSER$_CERTIFICATE_EXTENSION_PARSER_NO_SCT_CRL_EXTENSION_PARSER_CSR_EXTENSION_PARSER%_REVOKED_CERTIFICATE_EXTENSION_PARSER_asn1_integer_to_int_asn1_string_to_bytes_decode_x509_name_obj2txt_parse_asn1_time)_encode_asn1_int_gc)hashesserialization)dsaecrsac               @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Ze	dd Z
e	dd Zdd Ze	dd Ze	dd Ze	dd Ze	dd Ze	dd Ze	dd Zejdd  Ze	d!d" Ze	d#d$ Zd%d& Zd'S )(_Certificatec             C   s   || _ || _d S )N)_backend_x509)selfbackendr    r   M/tmp/pip-unpacked-wheel-vvkwn1hz/cryptography/hazmat/backends/openssl/x509.py__init__   s    z_Certificate.__init__c             C   s   dj | jS )Nz<Certificate(subject={}, ...)>)formatsubject)r   r   r   r   __repr__   s    z_Certificate.__repr__c             C   s,   t |tjstS | jjj| j|j}|dkS )Nr   )
isinstancer   CertificateNotImplementedr   _libZX509_cmpr   )r   otherresr   r   r   __eq__"   s    z_Certificate.__eq__c             C   s
   | |k S )Nr   )r   r'   r   r   r   __ne__)   s    z_Certificate.__ne__c             C   s   t | jtjjS )N)hashpublic_bytesr   EncodingDER)r   r   r   r   __hash__,   s    z_Certificate.__hash__c             C   s*   t j|| j}|j| jtjj |j S )N)	r   Hashr   updater,   r   r-   r.   finalize)r   	algorithmhr   r   r   fingerprint/   s    z_Certificate.fingerprintc             C   sF   | j jj| j}|dkr tjjS |dkr0tjjS tjdj	||d S )Nr      z{} is not a valid X509 version)
r   r&   ZX509_get_versionr   r   Versionv1Zv3InvalidVersionr    )r   versionr   r   r   r:   4   s    z_Certificate.versionc             C   s2   | j jj| j}| j j|| j jjk t| j |S )N)r   r&   ZX509_get_serialNumberr   openssl_assert_ffiNULLr   )r   asn1_intr   r   r   serial_number@   s    z_Certificate.serial_numberc             C   sR   | j jj| j}|| j jjkr0| j j  td| j jj|| j jj	}| j j
|S )Nz,Certificate public key is of an unknown type)r   r&   ZX509_get_pubkeyr   r<   r=   _consume_errors
ValueErrorgcEVP_PKEY_free_evp_pkey_to_public_key)r   pkeyr   r   r   
public_keyF   s    
z_Certificate.public_keyc             C   s   | j jj| j}t| j |S )N)r   r&   ZX509_getm_notBeforer   r   )r   	asn1_timer   r   r   not_valid_beforeQ   s    z_Certificate.not_valid_beforec             C   s   | j jj| j}t| j |S )N)r   r&   ZX509_getm_notAfterr   r   )r   rG   r   r   r   not_valid_afterV   s    z_Certificate.not_valid_afterc             C   s2   | j jj| j}| j j|| j jjk t| j |S )N)r   r&   ZX509_get_issuer_namer   r;   r<   r=   r   )r   issuerr   r   r   rJ   [   s    z_Certificate.issuerc             C   s2   | j jj| j}| j j|| j jjk t| j |S )N)r   r&   ZX509_get_subject_namer   r;   r<   r=   r   )r   r!   r   r   r   r!   a   s    z_Certificate.subjectc             C   s8   | j }y
tj| S  tk
r2   tdj|Y nX d S )Nz)Signature algorithm OID:{} not recognized)signature_algorithm_oidr   _SIG_OIDS_TO_HASHKeyErrorr   r    )r   oidr   r   r   signature_hash_algorithmg   s    
z%_Certificate.signature_hash_algorithmc             C   s^   | j jjd}| j jj| j jj|| j | j j|d | j jjk t| j |d j	}t
j|S )NzX509_ALGOR **r   )r   r<   newr&   X509_get0_signaturer=   r   r;   r   r3   r   ObjectIdentifier)r   algrN   r   r   r   rK   q   s    z$_Certificate.signature_algorithm_oidc             C   s.   | j jjrtj| j | jS tj| j | jS d S )N)r   r&   Z#CRYPTOGRAPHY_OPENSSL_110_OR_GREATERr   parser   r	   )r   r   r   r   
extensions{   s
    
z_Certificate.extensionsc             C   sR   | j jjd}| j jj|| j jj| j | j j|d | j jjk t| j |d S )NzASN1_BIT_STRING **r   )	r   r<   rP   r&   rQ   r=   r   r;   r   )r   sigr   r   r   	signature   s
    z_Certificate.signaturec                sd    j jjd} j jj j|} j j|dk  j jj| fdd} j jj|d |d d  S )Nzunsigned char **r   c                s    j jj| d S )Nr   )r   r&   OPENSSL_free)pointer)r   r   r   <lambda>   s    z4_Certificate.tbs_certificate_bytes.<locals>.<lambda>)	r   r<   rP   r&   Zi2d_re_X509_tbsr   r;   rB   buffer)r   ppr(   r   )r   r   tbs_certificate_bytes   s    z"_Certificate.tbs_certificate_bytesc             C   sn   | j j }|tjjkr*| j jj|| j}n(|tjjkrJ| j jj	|| j}nt
d| j j|dk | j j|S )Nz/encoding must be an item from the Encoding enum   )r   _create_mem_bio_gcr   r-   PEMr&   ZPEM_write_bio_X509r   r.   Zi2d_X509_bio	TypeErrorr;   _read_mem_bio)r   encodingbior(   r   r   r   r,      s    
z_Certificate.public_bytesN)__name__
__module____qualname__r   r"   r)   r*   r/   r5   propertyr:   r?   rF   rH   rI   rJ   r!   rO   rK   r   cached_propertyrU   rW   r]   r,   r   r   r   r   r      s&   

	
r   c               @   s:   e Zd Zdd Zedd Zedd Zejdd Z	d	S )
_RevokedCertificatec             C   s   || _ || _|| _d S )N)r   Z_crl_x509_revoked)r   r   ZcrlZx509_revokedr   r   r   r      s    z_RevokedCertificate.__init__c             C   s2   | j jj| j}| j j|| j jjk t| j |S )N)r   r&   ZX509_REVOKED_get0_serialNumberrk   r;   r<   r=   r   )r   r>   r   r   r   r?      s    z!_RevokedCertificate.serial_numberc             C   s   t | j| jjj| jS )N)r   r   r&   Z X509_REVOKED_get0_revocationDaterk   )r   r   r   r   revocation_date   s    z#_RevokedCertificate.revocation_datec             C   s   t j| j| jS )N)r   rT   r   rk   )r   r   r   r   rU      s    z_RevokedCertificate.extensionsN)
re   rf   rg   r   rh   r?   rl   r   ri   rU   r   r   r   r   rj      s   	rj   c               @   s   e Zd Zdd Zdd Zdd Zdd Zejd	d
 Z	dd Z
edd Zedd Zedd Zedd Zedd Zedd Zedd Zdd Zdd Zdd  Zd!d" Zd#d$ Zejd%d& Zd'd( Zd)S )*_CertificateRevocationListc             C   s   || _ || _d S )N)r   	_x509_crl)r   r   Zx509_crlr   r   r   r      s    z#_CertificateRevocationList.__init__c             C   s,   t |tjstS | jjj| j|j}|dkS )Nr   )r#   r   CertificateRevocationListr%   r   r&   ZX509_CRL_cmprn   )r   r'   r(   r   r   r   r)      s    z!_CertificateRevocationList.__eq__c             C   s
   | |k S )Nr   )r   r'   r   r   r   r*      s    z!_CertificateRevocationList.__ne__c             C   sX   t j|| j}| jj }| jjj|| j}| jj|dk | jj|}|j	| |j
 S )Nr^   )r   r0   r   r_   r&   i2d_X509_CRL_biorn   r;   rb   r1   r2   )r   r3   r4   rd   r(   Zderr   r   r   r5      s    


z&_CertificateRevocationList.fingerprintc             C   s@   | j jj| j}| j j|| j jjk | j jj|| j jj}|S )N)	r   r&   ZX509_CRL_duprn   r;   r<   r=   rB   ZX509_CRL_free)r   dupr   r   r   _sorted_crl   s    z&_CertificateRevocationList._sorted_crlc             C   sl   | j jjd}t| j |}| j jj| j||}|dkr:d S | j j|d | j jjk t	| j | j|d S d S )NzX509_REVOKED **r   )
r   r<   rP   r   r&   ZX509_CRL_get0_by_serialrr   r;   r=   rj   )r   r?   revokedr>   r(   r   r   r   (get_revoked_certificate_by_serial_number   s    zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberc             C   s8   | j }y
tj| S  tk
r2   tdj|Y nX d S )Nz)Signature algorithm OID:{} not recognized)rK   r   rL   rM   r   r    )r   rN   r   r   r   rO     s    
z3_CertificateRevocationList.signature_hash_algorithmc             C   s^   | j jjd}| j jj| j| j jj| | j j|d | j jjk t| j |d j	}t
j|S )NzX509_ALGOR **r   )r   r<   rP   r&   X509_CRL_get0_signaturern   r=   r;   r   r3   r   rR   )r   rS   rN   r   r   r   rK     s    z2_CertificateRevocationList.signature_algorithm_oidc             C   s2   | j jj| j}| j j|| j jjk t| j |S )N)r   r&   ZX509_CRL_get_issuerrn   r;   r<   r=   r   )r   rJ   r   r   r   rJ     s    z!_CertificateRevocationList.issuerc             C   s2   | j jj| j}| j j|| j jjk t| j |S )N)r   r&   ZX509_CRL_get_nextUpdatern   r;   r<   r=   r   )r   nur   r   r   next_update  s    z&_CertificateRevocationList.next_updatec             C   s2   | j jj| j}| j j|| j jjk t| j |S )N)r   r&   ZX509_CRL_get_lastUpdatern   r;   r<   r=   r   )r   Zlur   r   r   last_update!  s    z&_CertificateRevocationList.last_updatec             C   sR   | j jjd}| j jj| j|| j jj | j j|d | j jjk t| j |d S )NzASN1_BIT_STRING **r   )	r   r<   rP   r&   ru   rn   r=   r;   r   )r   rV   r   r   r   rW   '  s
    z$_CertificateRevocationList.signaturec                sd    j jjd} j jj j|} j j|dk  j jj| fdd} j jj|d |d d  S )Nzunsigned char **r   c                s    j jj| d S )Nr   )r   r&   rX   )rY   )r   r   r   rZ   6  s    z?_CertificateRevocationList.tbs_certlist_bytes.<locals>.<lambda>)	r   r<   rP   r&   Zi2d_re_X509_CRL_tbsrn   r;   rB   r[   )r   r\   r(   r   )r   r   tbs_certlist_bytes0  s    z-_CertificateRevocationList.tbs_certlist_bytesc             C   sn   | j j }|tjjkr*| j jj|| j}n(|tjjkrJ| j jj	|| j}nt
d| j j|dk | j j|S )Nz/encoding must be an item from the Encoding enumr^   )r   r_   r   r-   r`   r&   ZPEM_write_bio_X509_CRLrn   r.   rp   ra   r;   rb   )r   rc   rd   r(   r   r   r   r,   :  s    
z'_CertificateRevocationList.public_bytesc             C   sD   | j jj| j}| j jj||}| j j|| j jjk t| j | |S )N)	r   r&   X509_CRL_get_REVOKEDrn   Zsk_X509_REVOKED_valuer;   r<   r=   rj   )r   idxrs   rr   r   r   _revoked_certH  s    z(_CertificateRevocationList._revoked_certc             c   s&   x t t| D ]}| j|V  qW d S )N)rangelenr}   )r   ir   r   r   __iter__N  s    z#_CertificateRevocationList.__iter__c                s   t |tr8|jt \}}} fddt|||D S tj|}|dk rV|t 7 }d|  kolt k n  svt j|S d S )Nc                s   g | ]} j |qS r   )r}   ).0r   )r   r   r   
<listcomp>U  s    z:_CertificateRevocationList.__getitem__.<locals>.<listcomp>r   )	r#   sliceindicesr   r~   operatorindex
IndexErrorr}   )r   r{   startstopstepr   )r   r   __getitem__R  s    

z&_CertificateRevocationList.__getitem__c             C   s4   | j jj| j}|| j jjkr"dS | j jj|S d S )Nr   )r   r&   rz   rn   r<   r=   Zsk_X509_REVOKED_num)r   rs   r   r   r   __len__^  s    z"_CertificateRevocationList.__len__c             C   s   t j| j| jS )N)r
   rT   r   rn   )r   r   r   r   rU   e  s    z%_CertificateRevocationList.extensionsc             C   sL   t |tjtjtjfstd| jj	j
| j|j}|dkrH| jj  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.r^   FT)r#   r   ZDSAPublicKeyr   ZRSAPublicKeyr   ZEllipticCurvePublicKeyra   r   r&   ZX509_CRL_verifyrn   Z	_evp_pkeyr@   )r   rF   r(   r   r   r   is_signature_validi  s    

z-_CertificateRevocationList.is_signature_validN)re   rf   rg   r   r)   r*   r5   r   ri   rr   rt   rh   rO   rK   rJ   rw   rx   rW   ry   r,   r}   r   r   r   rU   r   r   r   r   r   rm      s(   


	
rm   c               @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zedd Z	edd Z
edd Zejdd Zdd Zedd Zedd Zedd ZdS )_CertificateSigningRequestc             C   s   || _ || _d S )N)r   	_x509_req)r   r   Zx509_reqr   r   r   r   {  s    z#_CertificateSigningRequest.__init__c             C   s2   t |tstS | jtjj}|jtjj}||kS )N)r#   r   r%   r,   r   r-   r.   )r   r'   Z
self_bytesZother_bytesr   r   r   r)     s
    
z!_CertificateSigningRequest.__eq__c             C   s
   | |k S )Nr   )r   r'   r   r   r   r*     s    z!_CertificateSigningRequest.__ne__c             C   s   t | jtjjS )N)r+   r,   r   r-   r.   )r   r   r   r   r/     s    z#_CertificateSigningRequest.__hash__c             C   sH   | j jj| j}| j j|| j jjk | j jj|| j jj}| j j	|S )N)
r   r&   X509_REQ_get_pubkeyr   r;   r<   r=   rB   rC   rD   )r   rE   r   r   r   rF     s    z%_CertificateSigningRequest.public_keyc             C   s2   | j jj| j}| j j|| j jjk t| j |S )N)r   r&   ZX509_REQ_get_subject_namer   r;   r<   r=   r   )r   r!   r   r   r   r!     s    z"_CertificateSigningRequest.subjectc             C   s8   | j }y
tj| S  tk
r2   tdj|Y nX d S )Nz)Signature algorithm OID:{} not recognized)rK   r   rL   rM   r   r    )r   rN   r   r   r   rO     s    
z3_CertificateSigningRequest.signature_hash_algorithmc             C   s^   | j jjd}| j jj| j| j jj| | j j|d | j jjk t| j |d j	}t
j|S )NzX509_ALGOR **r   )r   r<   rP   r&   X509_REQ_get0_signaturer   r=   r;   r   r3   r   rR   )r   rS   rN   r   r   r   rK     s    z2_CertificateSigningRequest.signature_algorithm_oidc                s6    j jj j} j jj| fdd}tj j |S )Nc                s"    j jj|  j jj j jjdS )NZX509_EXTENSION_free)r   r&   Zsk_X509_EXTENSION_pop_freer<   	addressofZ_original_lib)x)r   r   r   rZ     s   
z7_CertificateSigningRequest.extensions.<locals>.<lambda>)r   r&   ZX509_REQ_get_extensionsr   r<   rB   r   rT   )r   Z	x509_extsr   )r   r   rU     s
    z%_CertificateSigningRequest.extensionsc             C   sn   | j j }|tjjkr*| j jj|| j}n(|tjjkrJ| j jj	|| j}nt
d| j j|dk | j j|S )Nz/encoding must be an item from the Encoding enumr^   )r   r_   r   r-   r`   r&   ZPEM_write_bio_X509_REQr   r.   Zi2d_X509_REQ_biora   r;   rb   )r   rc   rd   r(   r   r   r   r,     s    
z'_CertificateSigningRequest.public_bytesc                sd    j jjd} j jj j|} j j|dk  j jj| fdd} j jj|d |d d  S )Nzunsigned char **r   c                s    j jj| d S )Nr   )r   r&   rX   )rY   )r   r   r   rZ     s    zB_CertificateSigningRequest.tbs_certrequest_bytes.<locals>.<lambda>)	r   r<   rP   r&   Zi2d_re_X509_REQ_tbsr   r;   rB   r[   )r   r\   r(   r   )r   r   tbs_certrequest_bytes  s    z0_CertificateSigningRequest.tbs_certrequest_bytesc             C   sR   | j jjd}| j jj| j|| j jj | j j|d | j jjk t| j |d S )NzASN1_BIT_STRING **r   )	r   r<   rP   r&   r   r   r=   r;   r   )r   rV   r   r   r   rW     s
    z$_CertificateSigningRequest.signaturec             C   sh   | j jj| j}| j j|| j jjk | j jj|| j jj}| j jj	| j|}|dkrd| j j
  dS dS )Nr^   FT)r   r&   r   r   r;   r<   r=   rB   rC   ZX509_REQ_verifyr@   )r   rE   r(   r   r   r   r     s    
z-_CertificateSigningRequest.is_signature_validN)re   rf   rg   r   r)   r*   r/   rF   rh   r!   rO   rK   r   ri   rU   r,   r   rW   r   r   r   r   r   r   y  s   


	r   c               @   sh   e Zd Zdd Zedd Zedd Zedd Zed	d
 Zedd Z	dd Z
dd Zdd ZdS )_SignedCertificateTimestampc             C   s   || _ || _|| _d S )N)r   Z	_sct_list_sct)r   r   Zsct_listZsctr   r   r   r     s    z$_SignedCertificateTimestamp.__init__c             C   s,   | j jj| j}|| j jjks"ttjjj	S )N)
r   r&   ZSCT_get_versionr   ZSCT_VERSION_V1AssertionErrorr   certificate_transparencyr7   r8   )r   r:   r   r   r   r:     s    z#_SignedCertificateTimestamp.versionc             C   sH   | j jjd}| j jj| j|}|dks,t| j jj|d |d d  S )Nzunsigned char **r   )r   r<   rP   r&   ZSCT_get0_log_idr   r   r[   )r   outZlog_id_lengthr   r   r   log_id  s    z"_SignedCertificateTimestamp.log_idc             C   s4   | j jj| j}|d }tjj|d j|d dS )Ni  )microsecond)r   r&   ZSCT_get_timestampr   datetimeutcfromtimestampreplace)r   	timestampZmillisecondsr   r   r   r      s
    
z%_SignedCertificateTimestamp.timestampc             C   s,   | j jj| j}|| j jjks"ttjjj	S )N)
r   r&   ZSCT_get_log_entry_typer   ZCT_LOG_ENTRY_TYPE_PRECERTr   r   r   ZLogEntryTypeZPRE_CERTIFICATE)r   
entry_typer   r   r   r     s    z&_SignedCertificateTimestamp.entry_typec             C   sf   | j jjd}| j jj| j|}| j j|dk | j j|d | j jjk | j jj|d |d d  S )Nzunsigned char **r   )	r   r<   rP   r&   ZSCT_get0_signaturer   r;   r=   r[   )r   Zptrptrr(   r   r   r   
_signature  s
    z&_SignedCertificateTimestamp._signaturec             C   s
   t | jS )N)r+   r   )r   r   r   r   r/     s    z$_SignedCertificateTimestamp.__hash__c             C   s   t |tstS | j|jkS )N)r#   r   r%   r   )r   r'   r   r   r   r)     s    
z"_SignedCertificateTimestamp.__eq__c             C   s
   | |k S )Nr   )r   r'   r   r   r   r*   !  s    z"_SignedCertificateTimestamp.__ne__N)re   rf   rg   r   rh   r:   r   r   r   r   r/   r)   r*   r   r   r   r   r     s   r   ),
__future__r   r   r   r   r   Zcryptographyr   r   Zcryptography.exceptionsr   Z0cryptography.hazmat.backends.openssl.decode_asn1r   r	   r
   r   r   r   r   r   r   r   Z0cryptography.hazmat.backends.openssl.encode_asn1r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r   Zregister_interfacer$   objectr   ZRevokedCertificaterj   ro   rm   ZCertificateSigningRequestr   r   ZSignedCertificateTimestampr   r   r   r   r   <module>   s*   0 % -o