File: //lib/python3/dist-packages/cryptography/x509/__pycache__/base.cpython-38.pyc
U
� >b0n � @ s8 d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZ d dl m
Z
d dl m Z m
Z
d dlmZmZmZmZmZ d dlmZmZmZ d dlmZ d d lmZ e�d
d d �Z G d d
� d
e �Z eej e d�dd�Z eej ej!ee"f d�dd�Z#ejejd�dd�Z$G dd� dej%�Z&G dd� de �Z'G dd � d e j(d �Z)G d d � d e j(d �Z*G d d!� d!e j(d �Z+G d"d#� d#e j(d �Z,d<e"e)d$�d%d&�Z-d=e"e)d$�d'd(�Z.d>e"e,d$�d)d*�Z/d?e"e,d$�d+d,�Z0d@e"e+d$�d-d.�Z1dAe"e+d$�d/d0�Z2G d1d2� d2e3�Z4G d3d4� d4e3�Z5G d5d6� d6e3�Z6G d7d8� d8e3�Z7e8d9�d:d;�Z9dS )B� N)�utils)�_PRIVATE_KEY_TYPES�_PUBLIC_KEY_TYPES)� _get_backend)�hashes�
serialization)�dsa�ec�ed25519�ed448�rsa)� Extension�
ExtensionType�
Extensions)�Name)�ObjectIdentifieri� � c s e Zd Z� fdd�Z� ZS )�AttributeNotFoundc s t t| ��|� || _d S �N)�superr �__init__�oid)�self�msgr �� __class__� �8/usr/lib/python3/dist-packages/cryptography/x509/base.pyr s zAttributeNotFound.__init__��__name__�
__module__� __qualname__r �
__classcell__r r r r r s r )� extension�
extensionsc C s" |D ]}|j | j krtd��qd S )Nz$This extension has already been set.)r �
ValueError)r# r$ �er r r �_reject_duplicate_extension$ s r' )r �
attributesc C s" |D ]\}}|| krt d��qd S )Nz$This attribute has already been set.)r% )r r( Zattr_oid�_r r r �_reject_duplicate_attribute- s r* )�time�returnc C s: | j dk r2| �� }|r|nt�� }| jdd�| S | S dS )z�Normalizes a datetime to a naive datetime in UTC.
time -- datetime to normalize. Assumed to be in UTC if not timezone
aware.
N)�tzinfo)r- � utcoffset�datetime� timedelta�replace)r+ �offsetr r r �_convert_to_naive_utc_time7 s
r3 c @ s e Zd ZdZdZdS )�Versionr � N)r r r! �v1�v3r r r r r4 E s r4 c s e Zd Z� fdd�Z� ZS )�InvalidVersionc s t t| ��|� || _d S r )r r8 r �parsed_version)r r r9 r r r r K s zInvalidVersion.__init__r r r r r r8 J s r8 c @ sx e Zd Zejejed�dd��Zej e
d�dd��Z ej e d�dd��Z
ejed�d d
��Zej ejd�d d ��Zej ejd�d
d��Zej ed�dd��Zej ed�dd��Zej ejej d�dd��Zej ed�dd��Zej ed�dd��Z ej ed�dd��Z ej ed�dd ��Z eje e d �d d ��Z!eje e d �d d!��Z"eje
d�d"d#��Z#eje$j%ed$�d%d&��Z&d'S )(� Certificate�� algorithmr, c C s dS �z4
Returns bytes using digest passed.
Nr �r r< r r r � fingerprintQ s zCertificate.fingerprint�r, c C s dS )z3
Returns certificate serial number
Nr �r r r r �
serial_numberW s zCertificate.serial_numberc C s dS )z1
Returns the certificate version
Nr rA r r r �version] s zCertificate.versionc C s dS �z(
Returns the public key
Nr rA r r r �
public_keyc s zCertificate.public_keyc C s dS )z?
Not before time (represented as UTC datetime)
Nr rA r r r �not_valid_beforei s z Certificate.not_valid_beforec C s dS )z>
Not after time (represented as UTC datetime)
Nr rA r r r �not_valid_aftero s zCertificate.not_valid_afterc C s dS )z1
Returns the issuer name object.
Nr rA r r r �issueru s zCertificate.issuerc C s dS �z2
Returns the subject name object.
Nr rA r r r �subject{ s zCertificate.subjectc C s dS �zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
Nr rA r r r �signature_hash_algorithm� s z$Certificate.signature_hash_algorithmc C s dS �zJ
Returns the ObjectIdentifier of the signature algorithm.
Nr rA r r r �signature_algorithm_oid� s z#Certificate.signature_algorithm_oidc C s dS )z/
Returns an Extensions object.
Nr rA r r r r$ � s zCertificate.extensionsc C s dS �z.
Returns the signature bytes.
Nr rA r r r � signature� s zCertificate.signaturec C s dS )zR
Returns the tbsCertificate payload bytes as defined in RFC 5280.
Nr rA r r r �tbs_certificate_bytes� s z!Certificate.tbs_certificate_bytes��otherr, c C s dS �z"
Checks equality.
Nr �r rS r r r �__eq__� s zCertificate.__eq__c C s dS �z#
Checks not equal.
Nr rU r r r �__ne__� s zCertificate.__ne__c C s dS �z"
Computes a hash.
Nr rA r r r �__hash__� s zCertificate.__hash__��encodingr, c C s dS )zB
Serializes the certificate to PEM or DER format.
Nr �r r\ r r r � public_bytes� s zCertificate.public_bytesN)'r r r! �abc�abstractmethodr �
HashAlgorithm�bytesr? �abstractproperty�intrB r4 rC r rE r/ rF rG r rH rJ �typing�OptionalrL r rN r r$ rP rQ �object�boolrV rX rZ r �Encodingr^ r r r r r: P sF
�r: )� metaclassc @ sJ e Zd Zejed�dd��Zejejd�dd��Zeje d�dd��Z
dS ) �RevokedCertificater@ c C s dS )zG
Returns the serial number of the revoked certificate.
Nr rA r r r rB � s z RevokedCertificate.serial_numberc C s dS )zH
Returns the date of when this certificate was revoked.
Nr rA r r r �revocation_date� s z"RevokedCertificate.revocation_datec C s dS )zW
Returns an Extensions object containing a list of Revoked extensions.
Nr rA r r r r$ � s z RevokedCertificate.extensionsN) r r r! r_ rc rd rB r/ rl r r$ r r r r rk � s rk c @ sp e Zd Zejejed�dd��Zeje j
ed�dd��Z eje e
je d�dd ��Zeje j
d
�d d ��Zejed
�d
d��Zejed
�dd��Zejejd
�dd��Zejejd
�dd��Zejed
�dd��Zejed
�dd��Z ejed
�dd��Z eje e d�d d ��Z eje e d�d d ��Z!eje d
�d d!��Z"ejd"d#� �Z#ejd$d%� �Z$eje%e d&�d'd(��Z&d)S )*�CertificateRevocationListr[ c C s dS )z:
Serializes the CRL to PEM or DER format.
Nr r] r r r r^ � s z&CertificateRevocationList.public_bytesr; c C s dS r= r r> r r r r? � s z%CertificateRevocationList.fingerprint)rB r, c C s dS )zs
Returns an instance of RevokedCertificate or None if the serial_number
is not in the CRL.
Nr )r rB r r r �(get_revoked_certificate_by_serial_number� s zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr@ c C s dS rK r rA r r r rL � s z2CertificateRevocationList.signature_hash_algorithmc C s dS rM r rA r r r rN � s z1CertificateRevocationList.signature_algorithm_oidc C s dS )zC
Returns the X509Name with the issuer of this CRL.
Nr rA r r r rH � s z CertificateRevocationList.issuerc C s dS )z?
Returns the date of next update for this CRL.
Nr rA r r r � next_update� s z%CertificateRevocationList.next_updatec C s dS )z?
Returns the date of last update for this CRL.
Nr rA r r r � last_update� s z%CertificateRevocationList.last_updatec C s dS )zS
Returns an Extensions object containing a list of CRL extensions.
Nr rA r r r r$ s z$CertificateRevocationList.extensionsc C s dS rO r rA r r r rP
s z#CertificateRevocationList.signaturec C s dS )zO
Returns the tbsCertList payload bytes as defined in RFC 5280.
Nr rA r r r �tbs_certlist_bytes s z,CertificateRevocationList.tbs_certlist_bytesrR c C s dS rT r rU r r r rV s z CertificateRevocationList.__eq__c C s dS rW r rU r r r rX s z CertificateRevocationList.__ne__c C s dS )z<
Number of revoked certificates in the CRL.
Nr rA r r r �__len__" s z!CertificateRevocationList.__len__c C s dS )zS
Returns a revoked certificate (or slice of revoked certificates).
Nr )r �idxr r r � __getitem__( s z%CertificateRevocationList.__getitem__c C s dS )z8
Iterator over the revoked certificates
Nr rA r r r �__iter__. s z"CertificateRevocationList.__iter__)rE r, c C s dS )zQ
Verifies signature of revocation list against given public key.
Nr )r rE r r r �is_signature_valid4 s z,CertificateRevocationList.is_signature_validN)'r r r! r_ r` r ri rb r^ r ra r? rd re rf rk rn rc rL r rN r rH r/ ro rp r r$ rP rq rg rh rV rX rr rt ru r rv r r r r rm � sH �
rm c @ s e Zd Zejeed�dd��Zejeed�dd��Zeje d�dd��Z
eje d�d d
��Z ej
ed�d d ��Zej
ejd�d
d��Zej
ed�dd��Zej
ed�dd��Zejejed�dd��Zej
ed�dd��Zej
ed�dd��Z ej
ed�dd��Z ejeed �d d ��Z d S ) �CertificateSigningRequestrR c C s dS rT r rU r r r rV < s z CertificateSigningRequest.__eq__c C s dS rW r rU r r r rX B s z CertificateSigningRequest.__ne__r@ c C s dS rY r rA r r r rZ H s z"CertificateSigningRequest.__hash__c C s dS rD r rA r r r rE N s z$CertificateSigningRequest.public_keyc C s dS rI r rA r r r rJ T s z!CertificateSigningRequest.subjectc C s dS rK r rA r r r rL Z s z2CertificateSigningRequest.signature_hash_algorithmc C s dS rM r rA r r r rN a s z1CertificateSigningRequest.signature_algorithm_oidc C s dS )z@
Returns the extensions in the signing request.
Nr rA r r r r$ g s z$CertificateSigningRequest.extensionsr[ c C s dS )z;
Encodes the request to PEM or DER format.
Nr r] r r r r^ m s z&CertificateSigningRequest.public_bytesc C s dS rO r rA r r r rP s s z#CertificateSigningRequest.signaturec C s dS )zd
Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
2986.
Nr rA r r r �tbs_certrequest_bytesy s z/CertificateSigningRequest.tbs_certrequest_bytesc C s dS )z8
Verifies signature of signing request.
Nr rA r r r rv � s z,CertificateSigningRequest.is_signature_valid)r r, c C s dS )z:
Get the attribute value for a given OID.
Nr )r r r r r �get_attribute_for_oid� s z/CertificateSigningRequest.get_attribute_for_oidN) r r r! r_ r` rg rh rV rX rd rZ r rE rc r rJ r ra rL r rN r r$ r ri rb r^ rP rx rv ry r r r r rw ; s4 rw )�datar, c C s t |�}|�| �S r )r �load_pem_x509_certificate�rz �backendr r r r{ � s r{ c C s t |�}|�| �S r )r �load_der_x509_certificater| r r r r~ � s r~ c C s t |�}|�| �S r )r �load_pem_x509_csrr| r r r r � s r c C s t |�}|�| �S r )r �load_der_x509_csrr| r r r r� � s r� c C s t |�}|�| �S r )r �load_pem_x509_crlr| r r r r� � s r� c C s t |�}|�| �S r )r �load_der_x509_crlr| r r r r� � s r� c @ s` e Zd Zdg g fdd�Zed�dd�Zeed�dd �Ze e
d
�d d �Z de e
jed
�dd�ZdS )� CertificateSigningRequestBuilderNc C s || _ || _|| _dS )zB
Creates an empty X.509 certificate request (v1).
N)�
_subject_name� _extensions� _attributes)r � subject_namer$ r( r r r r � s z)CertificateSigningRequestBuilder.__init__��namec C s4 t |t�std��| jdk r$td��t|| j| j�S )zF
Sets the certificate requestor's distinguished name.
�Expecting x509.Name object.N�&The subject name may only be set once.)�
isinstancer � TypeErrorr� r% r� r� r� �r r� r r r r� � s
�z-CertificateSigningRequestBuilder.subject_name��extval�criticalc C sD t |t�std��t|j||�}t|| j� t| j| j|g | j �S )zE
Adds an X.509 extension to the certificate request.
�"extension must be an ExtensionType)
r� r r� r
r r' r� r� r� r� �r r� r� r# r r r �
add_extension� s
�z.CertificateSigningRequestBuilder.add_extension)r �valuec C sL t |t�std��t |t�s$td��t|| j� t| j| j| j||fg �S )zK
Adds an X.509 attribute with an OID and associated value.
z oid must be an ObjectIdentifierzvalue must be bytes) r� r r� rb r* r� r� r� r� )r r r� r r r �
add_attribute� s
�z.CertificateSigningRequestBuilder.add_attribute�� private_keyr< r, c C s( t |�}| jdkrtd��|�| ||�S )zF
Signs the request using the requestor's private key.
Nz/A CertificateSigningRequest must have a subject)r r� r% Zcreate_x509_csr�r r� r< r} r r r �sign� s
z%CertificateSigningRequestBuilder.sign)N)r r r! r r r� r rh r� r rb r� r r ra rw r� r r r r r� � s ��r� c @ s� e Zd Zddddddg fdd�Zed�dd�Zed�dd�Zed �d
d �Ze d �d
d�Z
e j d�dd�Z e j d�dd�Z
eed�dd�Zdeejed�dd�ZdS )�CertificateBuilderNc C s6 t j| _|| _|| _|| _|| _|| _|| _|| _ d S r )
r4 r7 �_version� _issuer_namer� � _public_key�_serial_number�_not_valid_before�_not_valid_afterr� )r � issuer_namer� rE rB rF rG r$ r r r r � s
zCertificateBuilder.__init__r� c C sD t |t�std��| jdk r$td��t|| j| j| j| j | j
| j �S )z3
Sets the CA's distinguished name.
r� N�%The issuer name may only be set once.) r� r r� r� r% r� r� r� r� r� r� r� r� r r r r� s
�z CertificateBuilder.issuer_namec C sD t |t�std��| jdk r$td��t| j|| j| j| j | j
| j �S )z:
Sets the requestor's distinguished name.
r� Nr� ) r� r r� r� r% r� r� r� r� r� r� r� r� r r r r� s
�z CertificateBuilder.subject_name)�keyc C sX t |tjtjtjtjt j
f�s&t d��| j dk r8t
d��t| j| j|| j| j| j| j�S )zT
Sets the requestor's public key (as found in the signing request).
zhExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey or Ed448PublicKey.Nz$The public key may only be set once.)r� r � DSAPublicKeyr � RSAPublicKeyr ZEllipticCurvePublicKeyr
ZEd25519PublicKeyr ZEd448PublicKeyr� r� r% r� r� r� r� r� r� r� )r r� r r r rE ) s. ��
�
�z CertificateBuilder.public_key��numberc C sh t |t�std��| jdk r$td��|dkr4td��|�� dkrHtd��t| j| j| j || j
| j | j �S )z5
Sets the certificate serial number.
�'Serial number must be of integral type.N�'The serial number may only be set once.r z%The serial number should be positive.� �3The serial number should not be more than 159 bits.)
r� rd r� r� r% �
bit_lengthr� r� r� r� r� r� r� �r r� r r r rB K s&
��z CertificateBuilder.serial_number�r+ c C sz t |tj�std��| jdk r&td��t|�}|tk r>td��| jdk rZ|| jkrZtd��t| j | j
| j | j || j| j
�S )z7
Sets the certificate activation time.
�Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)r� r/ r� r� r% r3 �_EARLIEST_UTC_TIMEr� r� r� r� r� r� r� �r r+ r r r rF f s,
���z#CertificateBuilder.not_valid_beforec C sz t |tj�std��| jdk r&td��t|�}|tk r>td��| jdk rZ|| jk rZtd��t| j | j
| j | j | j|| j
�S )z7
Sets the certificate expiration time.
r� Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)r� r/ r� r� r% r3 r� r� r� r� r� r� r� r� r� r r r rG � s2
�����z"CertificateBuilder.not_valid_afterr� c C sT t |t�std��t|j||�}t|| j� t| j| j | j
| j | j | j
| j|g �S )z=
Adds an X.509 extension to the certificate.
r� )r� r r� r
r r' r� r� r� r� r� r� r� r� r� r r r r� � s
�z CertificateBuilder.add_extensionr� c C s� t |�}| jdkrtd��| jdkr,td��| jdkr>td��| jdkrPtd��| jdkrbtd��| jdkrttd��|�| ||�S )zC
Signs the certificate using the CA's private key.
Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key) r r� r% r� r� r� r� r� Zcreate_x509_certificater� r r r r� � s
zCertificateBuilder.sign)N)r r r! r r r� r� r rE rd rB r/ rF rG r rh r� r r ra r: r� r r r r r� � s, �
� " ��r� c @ s� e Zd Zdddg g fdd�Zed�dd�Zejd�dd �Zejd
�d d �Ze e
d
�dd�Z e d�dd�Z
deejed�dd�ZdS )� CertificateRevocationListBuilderNc C s" || _ || _|| _|| _|| _d S r )r� � _last_update� _next_updater� �_revoked_certificates)r r� rp ro r$ Zrevoked_certificatesr r r r � s
z)CertificateRevocationListBuilder.__init__)r� c C s< t |t�std��| jd k r$td��t|| j| j| j| j �S )Nr� r� )
r� r r� r� r% r� r� r� r� r� )r r� r r r r� � s
�z,CertificateRevocationListBuilder.issuer_name)rp c C sr t |tj�std��| jd k r&td��t|�}|tk r>td��| jd k rZ|| jkrZtd��t| j || j| j
| j �S )Nr� �!Last update may only be set once.�8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) r� r/ r� r� r% r3 r� r� r� r� r� r� )r rp r r r rp � s(
���z,CertificateRevocationListBuilder.last_update)ro c C sr t |tj�std��| jd k r&td��t|�}|tk r>td��| jd k rZ|| jk rZtd��t| j | j|| j
| j �S )Nr� r� r� z8The next update date must be after the last update date.) r� r/ r� r� r% r3 r� r� r� r� r� r� )r ro r r r ro s(
���z,CertificateRevocationListBuilder.next_updater� c C sL t |t�std��t|j||�}t|| j� t| j| j | j
| j|g | j �S )zM
Adds an X.509 extension to the certificate revocation list.
r� ) r� r r� r
r r' r� r� r� r� r� r� r� r r r r� s
�z.CertificateRevocationListBuilder.add_extension)�revoked_certificatec C s2 t |t�std��t| j| j| j| j| j|g �S )z8
Adds a revoked certificate to the CRL.
z)Must be an instance of RevokedCertificate) r� rk r� r� r� r� r� r� r� )r r� r r r �add_revoked_certificate/ s
�z8CertificateRevocationListBuilder.add_revoked_certificater� c C sL t |�}| jd krtd��| jd kr,td��| jd kr>td��|�| ||�S )Nz A CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r r� r% r� r� Zcreate_x509_crlr� r r r r� > s
z%CertificateRevocationListBuilder.sign)N)r r r! r r r� r/ rp ro r rh r� rk r� r r ra rm r� r r r r r� � s" �
��r� c @ sZ e Zd Zddg fdd�Zed�dd�Zejd�dd �Zee d
�d d �Z
de d
�dd�Z dS )�RevokedCertificateBuilderNc C s || _ || _|| _d S r )r� �_revocation_dater� )r rB rl r$ r r r r R s z"RevokedCertificateBuilder.__init__r� c C sX t |t�std��| jd k r$td��|dkr4td��|�� dkrHtd��t|| j| j�S )Nr� r� r z$The serial number should be positiver� r� ) r� rd r� r� r% r� r� r� r� r� r r r rB Y s
� �z'RevokedCertificateBuilder.serial_numberr� c C sN t |tj�std��| jd k r&td��t|�}|tk r>td��t| j|| j �S )Nr� z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
r� r/ r� r� r% r3 r� r� r� r� r� r r r rl k s
� �z)RevokedCertificateBuilder.revocation_dater� c C sD t |t�std��t|j||�}t|| j� t| j| j | j|g �S )Nr� )
r� r r� r
r r' r� r� r� r� r� r r r r� y s
�z'RevokedCertificateBuilder.add_extensionr@ c C s6 t |�}| jd krtd��| jd kr,td��|�| �S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r r� r% r� Z create_x509_revoked_certificate)r r} r r r �build� s
�z RevokedCertificateBuilder.build)N)
r r r! r rd rB r/ rl r rh r� rk r� r r r r r� Q s �
r� r@ c C s t �t�d�d�d? S )N� �bigr )rd �
from_bytes�os�urandomr r r r �random_serial_number� s r� )N)N)N)N)N)N):r_ r/ r� re � cryptographyr Zcryptography.hazmat._typesr r Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr r �)cryptography.hazmat.primitives.asymmetricr r r
r r � cryptography.x509.extensionsr
r r �cryptography.x509.namer �cryptography.x509.oidr r� � Exceptionr �Listr' �Tuplerb r* r3 �Enumr4 r8 �ABCMetar: rk rm rw r{ r~ r r� r� r� rg r� r� r� r� rd r� r r r r �<module> sL �
�
klRF f{@