U
    e]N                     @   s2  d dl mZmZmZ d dlZd dlZd dlmZmZ d dl	m
Z
 d dlmZmZmZmZmZmZmZmZmZmZ d dlmZ d dlmZmZ d dlmZmZmZ eej G d	d
 d
e!Z"eej#G dd de!Z$eej%G dd de!Z&eej'G dd de!Z(eej)j*G dd de!Z+dS )    )absolute_importdivisionprint_functionN)utilsx509)UnsupportedAlgorithm)
_CERTIFICATE_EXTENSION_PARSER$_CERTIFICATE_EXTENSION_PARSER_NO_SCT_CRL_EXTENSION_PARSER_CSR_EXTENSION_PARSER%_REVOKED_CERTIFICATE_EXTENSION_PARSER_asn1_integer_to_int_asn1_string_to_bytes_decode_x509_name_obj2txt_parse_asn1_time)_encode_asn1_int_gc)hashesserialization)dsaecrsac                   @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Ze	dd Z
e	dd Zdd Ze	dd Ze	dd Ze	dd Ze	dd Ze	dd Ze	dd Zejdd  Ze	d!d" Ze	d#d$ Zd%d& Zd'S )(_Certificatec                 C   s   || _ || _d S N)_backend_x509)selfbackendr    r   K/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/x509.py__init__   s    z_Certificate.__init__c                 C   s   d | jS )Nz<Certificate(subject={}, ...)>)formatsubjectr   r   r   r   __repr__   s    z_Certificate.__repr__c                 C   s,   t |tjstS | jj| j|j}|dkS Nr   )
isinstancer   CertificateNotImplementedr   _libZX509_cmpr   r   otherresr   r   r   __eq__"   s    z_Certificate.__eq__c                 C   s
   | |k S r   r   r   r+   r   r   r   __ne__)   s    z_Certificate.__ne__c                 C   s   t | tjjS r   hashpublic_bytesr   EncodingDERr#   r   r   r   __hash__,   s    z_Certificate.__hash__c                 C   s*   t || j}|| tjj | S r   )	r   Hashr   updater2   r   r3   r4   finalize)r   	algorithmhr   r   r   fingerprint/   s    z_Certificate.fingerprintc                 C   sF   | j j| j}|dkr tjjS |dkr0tjjS td	||d S )Nr      z{} is not a valid X509 version)
r   r)   ZX509_get_versionr   r   Versionv1Zv3ZInvalidVersionr!   r   versionr   r   r   r@   4   s     z_Certificate.versionc                 C   s2   | j j| j}| j || j jjk t| j |S r   )r   r)   ZX509_get_serialNumberr   openssl_assert_ffiNULLr   r   asn1_intr   r   r   serial_number@   s    z_Certificate.serial_numberc                 C   sR   | j j| j}|| j jjkr0| j   td| j j|| j jj	}| j 
|S )Nz,Certificate public key is of an unknown type)r   r)   ZX509_get_pubkeyr   rB   rC   _consume_errors
ValueErrorgcEVP_PKEY_free_evp_pkey_to_public_keyr   pkeyr   r   r   
public_keyF   s    
z_Certificate.public_keyc                 C   s   | j j| j}t| j |S r   )r   r)   ZX509_getm_notBeforer   r   r   Z	asn1_timer   r   r   not_valid_beforeQ   s    z_Certificate.not_valid_beforec                 C   s   | j j| j}t| j |S r   )r   r)   ZX509_getm_notAfterr   r   rO   r   r   r   not_valid_afterV   s    z_Certificate.not_valid_afterc                 C   s2   | j j| j}| j || j jjk t| j |S r   )r   r)   ZX509_get_issuer_namer   rA   rB   rC   r   r   issuerr   r   r   rS   [   s    z_Certificate.issuerc                 C   s2   | j j| j}| j || j jjk t| j |S r   )r   r)   ZX509_get_subject_namer   rA   rB   rC   r   r   r"   r   r   r   r"   a   s    z_Certificate.subjectc                 C   s:   | j }ztj| W S  tk
r4   td|Y nX d S Nz)Signature algorithm OID:{} not recognizedsignature_algorithm_oidr   Z_SIG_OIDS_TO_HASHKeyErrorr   r!   r   oidr   r   r   signature_hash_algorithmg   s    z%_Certificate.signature_hash_algorithmc                 C   s^   | j jd}| j j| j jj|| j | j |d | j jjk t| j |d j	}t
|S NzX509_ALGOR **r   )r   rB   newr)   X509_get0_signaturerC   r   rA   r   r9   r   ObjectIdentifierr   ZalgrZ   r   r   r   rW   q   s      z$_Certificate.signature_algorithm_oidc                 C   s.   | j jjrt| j | jS t| j | jS d S r   )r   r)   Z#CRYPTOGRAPHY_OPENSSL_110_OR_GREATERr   parser   r	   r#   r   r   r   
extensions{   s    
  z_Certificate.extensionsc                 C   sR   | j jd}| j j|| j jj| j | j |d | j jjk t| j |d S NzASN1_BIT_STRING **r   )	r   rB   r]   r)   r^   rC   r   rA   r   r   Zsigr   r   r   	signature   s      z_Certificate.signaturec                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nunsigned char **r   c                    s    j j| d S r%   r   r)   ZOPENSSL_freeZpointerr#   r   r   <lambda>       z4_Certificate.tbs_certificate_bytes.<locals>.<lambda>)	r   rB   r]   r)   Zi2d_re_X509_tbsr   rA   rI   bufferr   Zppr,   r   r#   r   tbs_certificate_bytes   s     
z"_Certificate.tbs_certificate_bytesc                 C   sn   | j  }|tjjkr*| j j|| j}n(|tjjkrJ| j j	|| j}nt
d| j |dk | j |S Nz/encoding must be an item from the Encoding enum   )r   _create_mem_bio_gcr   r3   PEMr)   ZPEM_write_bio_X509r   r4   Zi2d_X509_bio	TypeErrorrA   _read_mem_bior   encodingbior,   r   r   r   r2      s    
z_Certificate.public_bytesN)__name__
__module____qualname__r    r$   r-   r/   r5   r;   propertyr@   rF   rN   rP   rQ   rS   r"   r[   rW   r   cached_propertyrb   re   rm   r2   r   r   r   r   r      s<   






	
	



	r   c                   @   s:   e Zd Zdd Zedd Zedd Zejdd Z	d	S )
_RevokedCertificatec                 C   s   || _ || _|| _d S r   )r   Z_crl_x509_revoked)r   r   ZcrlZx509_revokedr   r   r   r       s    z_RevokedCertificate.__init__c                 C   s2   | j j| j}| j || j jjk t| j |S r   )r   r)   ZX509_REVOKED_get0_serialNumberr}   rA   rB   rC   r   rD   r   r   r   rF      s
    z!_RevokedCertificate.serial_numberc                 C   s   t | j| jj| jS r   )r   r   r)   Z X509_REVOKED_get0_revocationDater}   r#   r   r   r   revocation_date   s    z#_RevokedCertificate.revocation_datec                 C   s   t | j| jS r   )r   ra   r   r}   r#   r   r   r   rb      s     z_RevokedCertificate.extensionsN)
rw   rx   ry   r    rz   rF   r~   r   r{   rb   r   r   r   r   r|      s   

r|   c                   @   s   e Zd Zdd Zdd Zdd Zdd Zejd	d
 Z	dd Z
edd Zedd Zedd Zedd Zedd Zedd Zedd Zdd Zdd Zdd  Zd!d" Zd#d$ Zejd%d& Zd'd( Zd)S )*_CertificateRevocationListc                 C   s   || _ || _d S r   )r   	_x509_crl)r   r   Zx509_crlr   r   r   r       s    z#_CertificateRevocationList.__init__c                 C   s,   t |tjstS | jj| j|j}|dkS r%   )r&   r   CertificateRevocationListr(   r   r)   ZX509_CRL_cmpr   r*   r   r   r   r-      s    z!_CertificateRevocationList.__eq__c                 C   s
   | |k S r   r   r.   r   r   r   r/      s    z!_CertificateRevocationList.__ne__c                 C   sX   t || j}| j }| jj|| j}| j|dk | j|}|	| |
 S )Nro   )r   r6   r   rp   r)   i2d_X509_CRL_bior   rA   rs   r7   r8   )r   r9   r:   rv   r,   Zderr   r   r   r;      s    
 
z&_CertificateRevocationList.fingerprintc                 C   s@   | j j| j}| j || j jjk | j j|| j jj}|S r   )	r   r)   ZX509_CRL_dupr   rA   rB   rC   rI   ZX509_CRL_free)r   dupr   r   r   _sorted_crl   s    z&_CertificateRevocationList._sorted_crlc                 C   sl   | j jd}t| j |}| j j| j||}|dkr:d S | j |d | j jjk t	| j | j|d S d S )NzX509_REVOKED **r   )
r   rB   r]   r   r)   ZX509_CRL_get0_by_serialr   rA   rC   r|   )r   rF   revokedrE   r,   r   r   r   (get_revoked_certificate_by_serial_number   s"        zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberc                 C   s:   | j }ztj| W S  tk
r4   td|Y nX d S rU   rV   rY   r   r   r   r[     s    z3_CertificateRevocationList.signature_hash_algorithmc                 C   s^   | j jd}| j j| j| j jj| | j |d | j jjk t| j |d j	}t
|S r\   )r   rB   r]   r)   X509_CRL_get0_signaturer   rC   rA   r   r9   r   r_   r`   r   r   r   rW     s      z2_CertificateRevocationList.signature_algorithm_oidc                 C   s2   | j j| j}| j || j jjk t| j |S r   )r   r)   ZX509_CRL_get_issuerr   rA   rB   rC   r   rR   r   r   r   rS     s    z!_CertificateRevocationList.issuerc                 C   s2   | j j| j}| j || j jjk t| j |S r   )r   r)   ZX509_CRL_get_nextUpdater   rA   rB   rC   r   )r   Znur   r   r   next_update  s    z&_CertificateRevocationList.next_updatec                 C   s2   | j j| j}| j || j jjk t| j |S r   )r   r)   ZX509_CRL_get_lastUpdater   rA   rB   rC   r   )r   Zlur   r   r   last_update!  s    z&_CertificateRevocationList.last_updatec                 C   sR   | j jd}| j j| j|| j jj | j |d | j jjk t| j |d S rc   )	r   rB   r]   r)   r   r   rC   rA   r   rd   r   r   r   re   '  s      z$_CertificateRevocationList.signaturec                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nrf   r   c                    s    j j| d S r%   rg   rh   r#   r   r   ri   6  rj   z?_CertificateRevocationList.tbs_certlist_bytes.<locals>.<lambda>)	r   rB   r]   r)   Zi2d_re_X509_CRL_tbsr   rA   rI   rk   rl   r   r#   r   tbs_certlist_bytes0  s     
z-_CertificateRevocationList.tbs_certlist_bytesc                 C   sn   | j  }|tjjkr*| j j|| j}n(|tjjkrJ| j j	|| j}nt
d| j |dk | j |S rn   )r   rp   r   r3   rq   r)   ZPEM_write_bio_X509_CRLr   r4   r   rr   rA   rs   rt   r   r   r   r2   :  s    
 z'_CertificateRevocationList.public_bytesc                 C   sD   | j j| j}| j j||}| j || j jjk t| j | |S r   )	r   r)   X509_CRL_get_REVOKEDr   Zsk_X509_REVOKED_valuerA   rB   rC   r|   )r   idxr   rr   r   r   _revoked_certH  s    z(_CertificateRevocationList._revoked_certc                 c   s"   t t| D ]}| |V  qd S r   )rangelenr   )r   ir   r   r   __iter__N  s    z#_CertificateRevocationList.__iter__c                    s   t |tr8|t \}}} fddt|||D S t|}|dk rV|t 7 }d|  krnt k stn t |S d S )Nc                    s   g | ]}  |qS r   )r   ).0r   r#   r   r   
<listcomp>U  s     z:_CertificateRevocationList.__getitem__.<locals>.<listcomp>r   )	r&   sliceindicesr   r   operatorindex
IndexErrorr   )r   r   startstopstepr   r#   r   __getitem__R  s    

z&_CertificateRevocationList.__getitem__c                 C   s4   | j j| j}|| j jjkr"dS | j j|S d S r%   )r   r)   r   r   rB   rC   Zsk_X509_REVOKED_num)r   r   r   r   r   __len__^  s    z"_CertificateRevocationList.__len__c                 C   s   t | j| jS r   )r
   ra   r   r   r#   r   r   r   rb   e  s    z%_CertificateRevocationList.extensionsc                 C   sL   t |tjtjtjfstd| jj	
| j|j}|dkrH| j  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.ro   FT)r&   r   ZDSAPublicKeyr   ZRSAPublicKeyr   ZEllipticCurvePublicKeyrr   r   r)   ZX509_CRL_verifyr   Z	_evp_pkeyrG   )r   rN   r,   r   r   r   is_signature_validi  s     
z-_CertificateRevocationList.is_signature_validN)rw   rx   ry   r    r-   r/   r;   r   r{   r   r   rz   r[   rW   rS   r   r   re   r   r2   r   r   r   r   rb   r   r   r   r   r   r      s:   
	
	
	




	
r   c                   @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zedd Z	edd Z
edd Zejdd Zdd Zedd Zedd Zedd ZdS )_CertificateSigningRequestc                 C   s   || _ || _d S r   )r   	_x509_req)r   r   Zx509_reqr   r   r   r    {  s    z#_CertificateSigningRequest.__init__c                 C   s2   t |tstS | tjj}|tjj}||kS r   )r&   r   r(   r2   r   r3   r4   )r   r+   Z
self_bytesZother_bytesr   r   r   r-     s
    
z!_CertificateSigningRequest.__eq__c                 C   s
   | |k S r   r   r.   r   r   r   r/     s    z!_CertificateSigningRequest.__ne__c                 C   s   t | tjjS r   r0   r#   r   r   r   r5     s    z#_CertificateSigningRequest.__hash__c                 C   sH   | j j| j}| j || j jjk | j j|| j jj}| j 	|S r   )
r   r)   X509_REQ_get_pubkeyr   rA   rB   rC   rI   rJ   rK   rL   r   r   r   rN     s    z%_CertificateSigningRequest.public_keyc                 C   s2   | j j| j}| j || j jjk t| j |S r   )r   r)   ZX509_REQ_get_subject_namer   rA   rB   rC   r   rT   r   r   r   r"     s    z"_CertificateSigningRequest.subjectc                 C   s:   | j }ztj| W S  tk
r4   td|Y nX d S rU   rV   rY   r   r   r   r[     s    z3_CertificateSigningRequest.signature_hash_algorithmc                 C   s^   | j jd}| j j| j| j jj| | j |d | j jjk t| j |d j	}t
|S r\   )r   rB   r]   r)   X509_REQ_get0_signaturer   rC   rA   r   r9   r   r_   r`   r   r   r   rW     s      z2_CertificateSigningRequest.signature_algorithm_oidc                    s6    j j j} j j| fdd}t j |S )Nc                    s"    j j|  j j j jjdS )NZX509_EXTENSION_free)r   r)   Zsk_X509_EXTENSION_pop_freerB   Z	addressofZ_original_lib)xr#   r   r   ri     s     z7_CertificateSigningRequest.extensions.<locals>.<lambda>)r   r)   ZX509_REQ_get_extensionsr   rB   rI   r   ra   )r   Z	x509_extsr   r#   r   rb     s    
z%_CertificateSigningRequest.extensionsc                 C   sn   | j  }|tjjkr*| j j|| j}n(|tjjkrJ| j j	|| j}nt
d| j |dk | j |S rn   )r   rp   r   r3   rq   r)   ZPEM_write_bio_X509_REQr   r4   Zi2d_X509_REQ_biorr   rA   rs   rt   r   r   r   r2     s    
 z'_CertificateSigningRequest.public_bytesc                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nrf   r   c                    s    j j| d S r%   rg   rh   r#   r   r   ri     rj   zB_CertificateSigningRequest.tbs_certrequest_bytes.<locals>.<lambda>)	r   rB   r]   r)   Zi2d_re_X509_REQ_tbsr   rA   rI   rk   rl   r   r#   r   tbs_certrequest_bytes  s     
z0_CertificateSigningRequest.tbs_certrequest_bytesc                 C   sR   | j jd}| j j| j|| j jj | j |d | j jjk t| j |d S rc   )	r   rB   r]   r)   r   r   rC   rA   r   rd   r   r   r   re     s      z$_CertificateSigningRequest.signaturec                 C   sh   | j j| j}| j || j jjk | j j|| j jj}| j j	| j|}|dkrd| j 
  dS dS )Nro   FT)r   r)   r   r   rA   rB   rC   rI   rJ   ZX509_REQ_verifyrG   )r   rM   r,   r   r   r   r     s    
z-_CertificateSigningRequest.is_signature_validN)rw   rx   ry   r    r-   r/   r5   rN   rz   r"   r[   rW   r   r{   rb   r2   r   re   r   r   r   r   r   r   y  s(   

	
	

	
r   c                   @   sh   e Zd Zdd Zedd Zedd Zedd Zed	d
 Zedd Z	dd Z
dd Zdd ZdS )_SignedCertificateTimestampc                 C   s   || _ || _|| _d S r   )r   Z	_sct_list_sct)r   r   Zsct_listZsctr   r   r   r      s    z$_SignedCertificateTimestamp.__init__c                 C   s,   | j j| j}|| j jjks"ttjjj	S r   )
r   r)   ZSCT_get_versionr   ZSCT_VERSION_V1AssertionErrorr   certificate_transparencyr=   r>   r?   r   r   r   r@     s    z#_SignedCertificateTimestamp.versionc                 C   sH   | j jd}| j j| j|}|dks,t| j j|d |d d  S Nrf   r   )r   rB   r]   r)   ZSCT_get0_log_idr   r   rk   )r   outZlog_id_lengthr   r   r   log_id  s    z"_SignedCertificateTimestamp.log_idc                 C   s4   | j j| j}|d }tj|d j|d dS )Ni  )Zmicrosecond)r   r)   ZSCT_get_timestampr   datetimeZutcfromtimestampreplace)r   	timestampZmillisecondsr   r   r   r      s    z%_SignedCertificateTimestamp.timestampc                 C   s,   | j j| j}|| j jjks"ttjjj	S r   )
r   r)   ZSCT_get_log_entry_typer   ZCT_LOG_ENTRY_TYPE_PRECERTr   r   r   ZLogEntryTypeZPRE_CERTIFICATE)r   
entry_typer   r   r   r     s    z&_SignedCertificateTimestamp.entry_typec                 C   sf   | j jd}| j j| j|}| j |dk | j |d | j jjk | j j|d |d d  S r   )	r   rB   r]   r)   ZSCT_get0_signaturer   rA   rC   rk   )r   Zptrptrr,   r   r   r   
_signature  s
    z&_SignedCertificateTimestamp._signaturec                 C   s
   t | jS r   )r1   r   r#   r   r   r   r5     s    z$_SignedCertificateTimestamp.__hash__c                 C   s   t |tstS | j|jkS r   )r&   r   r(   r   r.   r   r   r   r-     s    
z"_SignedCertificateTimestamp.__eq__c                 C   s
   | |k S r   r   r.   r   r   r   r/   !  s    z"_SignedCertificateTimestamp.__ne__N)rw   rx   ry   r    rz   r@   r   r   r   r   r5   r-   r/   r   r   r   r   r     s   




r   ),Z
__future__r   r   r   r   r   Zcryptographyr   r   Zcryptography.exceptionsr   Z0cryptography.hazmat.backends.openssl.decode_asn1r   r	   r
   r   r   r   r   r   r   r   Z0cryptography.hazmat.backends.openssl.encode_asn1r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r   Zregister_interfacer'   objectr   ZRevokedCertificater|   r   r   ZCertificateSigningRequestr   r   ZSignedCertificateTimestampr   r   r   r   r   <module>   s,   0
 
%
 -
o