File: //snap/core20/2599/lib/python3/dist-packages/cryptography/x509/__pycache__/base.cpython-38.pyc
U
�e�]�] � @ s� d dl mZmZmZ d dlZd dlZd dlZd dlmZ d dl Z d dl
m Z d dl m
Z
mZmZmZmZ d dlmZmZ d dlmZ e�dd d �Zd
d � Zd d
� ZG dd� de�Zdd� Zdd� Z dd� Z dd� Z dd� Z dd� Z G d d � d e!�Z"e �#ej$�G d d � d e%��Z&e �#ej$�G d d!� d!e%��Z'e �#ej$�G d"d#� d#e%��Z(e �#ej$�G d$d%� d%e%��Z)G d&d'� d'e%�Z*G d(d)� d)e%�Z+G d*d+� d+e%�Z,G d,d-� d-e%�Z-d.d/� Z.dS )0� )�absolute_import�division�print_functionN)�Enum)�utils)�dsa�ec�ed25519�ed448�rsa)� Extension�
ExtensionType)�Namei� � c C s" |D ]}|j | j krtd��qd S )Nz$This extension has already been set.)�oid�
ValueError)� extension�
extensions�e� r �8/usr/lib/python3/dist-packages/cryptography/x509/base.py�_reject_duplicate_extension s r c C s: | j dk r2| �� }|r|nt�� }| jdd�| S | S dS )z�Normalizes a datetime to a naive datetime in UTC.
time -- datetime to normalize. Assumed to be in UTC if not timezone
aware.
N)�tzinfo)r Z utcoffset�datetimeZ timedelta�replace)�time�offsetr r r �_convert_to_naive_utc_time s
r c @ s e Zd ZdZdZdS )�Versionr � N)�__name__�
__module__� __qualname__Zv1�v3r r r r r . s r c C s
|� | �S �N)�load_pem_x509_certificate��data�backendr r r r% 3 s r% c C s
|� | �S r$ )�load_der_x509_certificater& r r r r) 7 s r) c C s
|� | �S r$ )�load_pem_x509_csrr& r r r r* ; s r* c C s
|� | �S r$ )�load_der_x509_csrr& r r r r+ ? s r+ c C s
|� | �S r$ )�load_pem_x509_crlr& r r r r, C s r, c C s
|� | �S r$ )�load_der_x509_crlr& r r r r- G s r- c s e Zd Z� fdd�Z� ZS )�InvalidVersionc s t t| ��|� || _d S r$ )�superr. �__init__�parsed_version)�self�msgr1 �� __class__r r r0 L s zInvalidVersion.__init__)r r! r" r0 �
__classcell__r r r4 r r. K s r. c @ s� e Zd Zejdd� �Zejdd� �Zejdd� �Zejdd� �Z ejd d
� �Z
ejd d � �Z ejd
d� �Z ejdd� �Z
ejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd � �Zejd d � �Zejd d � �Zejd!d"� �Zd#S )$� Certificatec C s dS �z4
Returns bytes using digest passed.
Nr �r2 � algorithmr r r � fingerprintS s zCertificate.fingerprintc C s dS )z3
Returns certificate serial number
Nr �r2 r r r �
serial_numberY s zCertificate.serial_numberc C s dS )z1
Returns the certificate version
Nr r< r r r �version_ s zCertificate.versionc C s dS �z(
Returns the public key
Nr r< r r r �
public_keye s zCertificate.public_keyc C s dS )z?
Not before time (represented as UTC datetime)
Nr r< r r r �not_valid_beforek s z Certificate.not_valid_beforec C s dS )z>
Not after time (represented as UTC datetime)
Nr r< r r r �not_valid_afterq s zCertificate.not_valid_afterc C s dS )z1
Returns the issuer name object.
Nr r< r r r �issuerw s zCertificate.issuerc C s dS �z2
Returns the subject name object.
Nr r< r r r �subject} s zCertificate.subjectc C s dS �zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
Nr r< r r r �signature_hash_algorithm� s z$Certificate.signature_hash_algorithmc C s dS �zJ
Returns the ObjectIdentifier of the signature algorithm.
Nr r< r r r �signature_algorithm_oid� s z#Certificate.signature_algorithm_oidc C s dS )z/
Returns an Extensions object.
Nr r< r r r r � s zCertificate.extensionsc C s dS �z.
Returns the signature bytes.
Nr r< r r r � signature� s zCertificate.signaturec C s dS )zR
Returns the tbsCertificate payload bytes as defined in RFC 5280.
Nr r< r r r �tbs_certificate_bytes� s z!Certificate.tbs_certificate_bytesc C s dS �z"
Checks equality.
Nr �r2 �otherr r r �__eq__� s zCertificate.__eq__c C s dS �z#
Checks not equal.
Nr rN r r r �__ne__� s zCertificate.__ne__c C s dS �z"
Computes a hash.
Nr r< r r r �__hash__� s zCertificate.__hash__c C s dS )zB
Serializes the certificate to PEM or DER format.
Nr �r2 �encodingr r r � public_bytes� s zCertificate.public_bytesN)r r! r" �abc�abstractmethodr; �abstractpropertyr= r> r@ rA rB rC rE rG rI r rK rL rP rR rT rW r r r r r7 Q sD
r7 c @ s� e Zd Zejdd� �Zejdd� �Zejdd� �Zejdd� �Z ejd d
� �Z
ejd d � �Z ejd
d� �Z ejdd� �Z
ejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd � �Zejd d � �Zejd d � �Zejd!d"� �Zd#S )$�CertificateRevocationListc C s dS )z:
Serializes the CRL to PEM or DER format.
Nr rU r r r rW � s z&CertificateRevocationList.public_bytesc C s dS r8 r r9 r r r r; � s z%CertificateRevocationList.fingerprintc C s dS )zs
Returns an instance of RevokedCertificate or None if the serial_number
is not in the CRL.
Nr )r2 r= r r r �(get_revoked_certificate_by_serial_number� s zBCertificateRevocationList.get_revoked_certificate_by_serial_numberc C s dS rF r r< r r r rG � s z2CertificateRevocationList.signature_hash_algorithmc C s dS rH r r< r r r rI � s z1CertificateRevocationList.signature_algorithm_oidc C s dS )zC
Returns the X509Name with the issuer of this CRL.
Nr r< r r r rC � s z CertificateRevocationList.issuerc C s dS )z?
Returns the date of next update for this CRL.
Nr r< r r r � next_update� s z%CertificateRevocationList.next_updatec C s dS )z?
Returns the date of last update for this CRL.
Nr r< r r r � last_update� s z%CertificateRevocationList.last_updatec C s dS )zS
Returns an Extensions object containing a list of CRL extensions.
Nr r< r r r r � s z$CertificateRevocationList.extensionsc C s dS rJ r r< r r r rK � s z#CertificateRevocationList.signaturec C s dS )zO
Returns the tbsCertList payload bytes as defined in RFC 5280.
Nr r< r r r �tbs_certlist_bytes� s z,CertificateRevocationList.tbs_certlist_bytesc C s dS rM r rN r r r rP s z CertificateRevocationList.__eq__c C s dS rQ r rN r r r rR s z CertificateRevocationList.__ne__c C s dS )z<
Number of revoked certificates in the CRL.
Nr r< r r r �__len__
s z!CertificateRevocationList.__len__c C s dS )zS
Returns a revoked certificate (or slice of revoked certificates).
Nr )r2 �idxr r r � __getitem__ s z%CertificateRevocationList.__getitem__c C s dS )z8
Iterator over the revoked certificates
Nr r< r r r �__iter__ s z"CertificateRevocationList.__iter__c C s dS )zQ
Verifies signature of revocation list against given public key.
Nr )r2 r@ r r r �is_signature_valid s z,CertificateRevocationList.is_signature_validN)r r! r" rX rY rW r; r\ rZ rG rI rC r] r^ r rK r_ rP rR r` rb rc rd r r r r r[ � sD
r[ c @ s� e Zd Zejdd� �Zejdd� �Zejdd� �Zejdd� �Zej d d
� �Z
ej d d � �Z ej d
d� �Z ej dd� �Z
ejdd� �Zej dd� �Zej dd� �Zej dd� �ZdS )�CertificateSigningRequestc C s dS rM r rN r r r rP ( s z CertificateSigningRequest.__eq__c C s dS rQ r rN r r r rR . s z CertificateSigningRequest.__ne__c C s dS rS r r< r r r rT 4 s z"CertificateSigningRequest.__hash__c C s dS r? r r< r r r r@ : s z$CertificateSigningRequest.public_keyc C s dS rD r r< r r r rE @ s z!CertificateSigningRequest.subjectc C s dS rF r r< r r r rG F s z2CertificateSigningRequest.signature_hash_algorithmc C s dS rH r r< r r r rI M s z1CertificateSigningRequest.signature_algorithm_oidc C s dS )z@
Returns the extensions in the signing request.
Nr r< r r r r S s z$CertificateSigningRequest.extensionsc C s dS )z;
Encodes the request to PEM or DER format.
Nr rU r r r rW Y s z&CertificateSigningRequest.public_bytesc C s dS rJ r r< r r r rK _ s z#CertificateSigningRequest.signaturec C s dS )zd
Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
2986.
Nr r< r r r �tbs_certrequest_bytese s z/CertificateSigningRequest.tbs_certrequest_bytesc C s dS )z8
Verifies signature of signing request.
Nr r< r r r rd l s z,CertificateSigningRequest.is_signature_validN)r r! r" rX rY rP rR rT r@ rZ rE rG rI r rW rK rf rd r r r r re & s0
re c @ s6 e Zd Zejdd� �Zejdd� �Zejdd� �ZdS )�RevokedCertificatec C s dS )zG
Returns the serial number of the revoked certificate.
Nr r< r r r r= u s z RevokedCertificate.serial_numberc C s dS )zH
Returns the date of when this certificate was revoked.
Nr r< r r r �revocation_date{ s z"RevokedCertificate.revocation_datec C s dS )zW
Returns an Extensions object containing a list of Revoked extensions.
Nr r< r r r r � s z RevokedCertificate.extensionsN)r r! r" rX rZ r= rh r r r r r rg s s
rg c @ s2 e Zd Zdg fdd�Zdd� Zdd� Zdd � ZdS )
� CertificateSigningRequestBuilderNc C s || _ || _dS )zB
Creates an empty X.509 certificate request (v1).
N)�
_subject_name� _extensions)r2 � subject_namer r r r r0 � s z)CertificateSigningRequestBuilder.__init__c C s0 t |t�std��| jdk r$td��t|| j�S )zF
Sets the certificate requestor's distinguished name.
�Expecting x509.Name object.N�&The subject name may only be set once.)�
isinstancer � TypeErrorrj r ri rk �r2 �namer r r rl � s
z-CertificateSigningRequestBuilder.subject_namec C s@ t |t�std��t|j||�}t|| j� t| j| j|g �S )zE
Adds an X.509 extension to the certificate request.
�"extension must be an ExtensionType) ro r
rp r r r rk ri rj �r2 r Zcriticalr r r �
add_extension� s
�z.CertificateSigningRequestBuilder.add_extensionc C s | j dkrtd��|�| ||�S )zF
Signs the request using the requestor's private key.
Nz/A CertificateSigningRequest must have a subject)rj r Zcreate_x509_csr�r2 Z private_keyr: r( r r r �sign� s
z%CertificateSigningRequestBuilder.sign)r r! r" r0 rl ru rw r r r r ri � s
ri c @ sd e Zd Zddddddg fdd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
dd� Z dS )�CertificateBuilderNc C s6 t j| _|| _|| _|| _|| _|| _|| _|| _ d S r$ )
r r# Z_version� _issuer_namerj � _public_key�_serial_number�_not_valid_before�_not_valid_afterrk )r2 � issuer_namerl r@ r= rA rB r r r r r0 � s zCertificateBuilder.__init__c C sD t |t�std��| jdk r$td��t|| j| j| j| j | j
| j �S )z3
Sets the CA's distinguished name.
rm N�%The issuer name may only be set once.) ro r rp ry r rx rj rz r{ r| r} rk rq r r r r~ � s
�z CertificateBuilder.issuer_namec C sD t |t�std��| jdk r$td��t| j|| j| j| j | j
| j �S )z:
Sets the requestor's distinguished name.
rm Nrn ) ro r rp rj r rx ry rz r{ r| r} rk rq r r r rl � s
�z CertificateBuilder.subject_namec C sX t |tjtjtjtjt j
f�s&t d��| j dk r8t
d��t| j| j|| j| j| j| j�S )zT
Sets the requestor's public key (as found in the signing request).
zhExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey or Ed448PublicKey.Nz$The public key may only be set once.)ro r Z DSAPublicKeyr Z RSAPublicKeyr ZEllipticCurvePublicKeyr ZEd25519PublicKeyr
ZEd448PublicKeyrp rz r rx ry rj r{ r| r} rk )r2 �keyr r r r@ � s" �
�z CertificateBuilder.public_keyc C sj t |tj�std��| jdk r&td��|dkr6td��|�� dkrJtd��t| j| j | j
|| j | j | j
�S )z5
Sets the certificate serial number.
�'Serial number must be of integral type.N�'The serial number may only be set once.r z%The serial number should be positive.� �3The serial number should not be more than 159 bits.)ro �six�
integer_typesrp r{ r �
bit_lengthrx ry rj rz r| r} rk �r2 Znumberr r r r= � s"
�z CertificateBuilder.serial_numberc C sz t |tj�std��| jdk r&td��t|�}|tk r>td��| jdk rZ|| jkrZtd��t| j | j
| j | j || j| j
�S )z7
Sets the certificate activation time.
�Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)ro r rp r| r r �_EARLIEST_UTC_TIMEr} rx ry rj rz r{ rk �r2 r r r r rA s(
� �z#CertificateBuilder.not_valid_beforec C sz t |tj�std��| jdk r&td��t|�}|tk r>td��| jdk rZ|| jk rZtd��t| j | j
| j | j | j|| j
�S )z7
Sets the certificate expiration time.
r� Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)ro r rp r} r r r� r| rx ry rj rz r{ rk r� r r r rB s,
�� �z"CertificateBuilder.not_valid_afterc C sT t |t�std��t|j||�}t|| j� t| j| j | j
| j | j | j
| j|g �S )z=
Adds an X.509 extension to the certificate.
rs )ro r
rp r r r rk rx ry rj rz r{ r| r} rt r r r ru 2 s
�z CertificateBuilder.add_extensionc C sz | j dkrtd��| jdkr$td��| jdkr6td��| jdkrHtd��| jdkrZtd��| jdkrltd��|�| ||�S )zC
Signs the certificate using the CA's private key.
Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key)rj r ry r{ r| r} rz Zcreate_x509_certificaterv r r r rw B s
zCertificateBuilder.sign) r r! r" r0 r~ rl r@ r= rA rB ru rw r r r r rx � s �
rx c @ sP e Zd Zdddg g fdd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dS )� CertificateRevocationListBuilderNc C s" || _ || _|| _|| _|| _d S r$ )ry � _last_update� _next_updaterk �_revoked_certificates)r2 r~ r^ r] r Zrevoked_certificatesr r r r0 \ s
z)CertificateRevocationListBuilder.__init__c C s< t |t�std��| jd k r$td��t|| j| j| j| j �S )Nrm r )
ro r rp ry r r� r� r� rk r� )r2 r~ r r r r~ d s
�z,CertificateRevocationListBuilder.issuer_namec C sr t |tj�std��| jd k r&td��t|�}|tk r>td��| jd k rZ|| jkrZtd��t| j || j| j
| j �S )Nr� �!Last update may only be set once.�8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) ro r rp r� r r r� r� r� ry rk r� )r2 r^ r r r r^ n s$
� �z,CertificateRevocationListBuilder.last_updatec C sr t |tj�std��| jd k r&td��t|�}|tk r>td��| jd k rZ|| jk rZtd��t| j | j|| j
| j �S )Nr� r� r� z8The next update date must be after the last update date.) ro r rp r� r r r� r� r� ry rk r� )r2 r] r r r r] � s$
� �z,CertificateRevocationListBuilder.next_updatec C sL t |t�std��t|j||�}t|| j� t| j| j | j
| j|g | j �S )zM
Adds an X.509 extension to the certificate revocation list.
rs ) ro r
rp r r r rk r� ry r� r� r� rt r r r ru � s
�z.CertificateRevocationListBuilder.add_extensionc C s2 t |t�std��t| j| j| j| j| j|g �S )z8
Adds a revoked certificate to the CRL.
z)Must be an instance of RevokedCertificate) ro rg rp r� ry r� r� rk r� )r2 Zrevoked_certificater r r �add_revoked_certificate� s
�z8CertificateRevocationListBuilder.add_revoked_certificatec C sD | j d krtd��| jd kr$td��| jd kr6td��|�| ||�S )Nz A CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)ry r r� r� Zcreate_x509_crlrv r r r rw � s
z%CertificateRevocationListBuilder.sign)
r r! r" r0 r~ r^ r] ru r� rw r r r r r� [ s �
r� c @ s< e Zd Zddg fdd�Zdd� Zdd� Zdd � Zd
d � ZdS ) �RevokedCertificateBuilderNc C s || _ || _|| _d S r$ )r{ �_revocation_daterk )r2 r= rh r r r r r0 � s z"RevokedCertificateBuilder.__init__c C sZ t |tj�std��| jd k r&td��|dkr6td��|�� dkrJtd��t|| j| j �S )Nr� r� r z$The serial number should be positiver� r� )
ro r� r� rp r{ r r� r� r� rk r� r r r r= � s
�z'RevokedCertificateBuilder.serial_numberc C sN t |tj�std��| jd k r&td��t|�}|tk r>td��t| j|| j �S )Nr� z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
ro r rp r� r r r� r� r{ rk r� r r r rh � s
�z)RevokedCertificateBuilder.revocation_datec C sD t |t�std��t|j||�}t|| j� t| j| j | j|g �S )Nrs )
ro r
rp r r r rk r� r{ r� rt r r r ru � s
�z'RevokedCertificateBuilder.add_extensionc C s. | j d krtd��| jd kr$td��|�| �S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r{ r r� Z create_x509_revoked_certificate)r2 r( r r r �build� s
�z RevokedCertificateBuilder.build)r r! r" r0 r= rh ru r� r r r r r� � s �
r� c C s t �t�d�d�d? S )N� Zbigr )r Zint_from_bytes�os�urandomr r r r �random_serial_number� s r� )/Z
__future__r r r rX r r� �enumr r� Z cryptographyr Z)cryptography.hazmat.primitives.asymmetricr r r r
r Z cryptography.x509.extensionsr r
Zcryptography.x509.namer r� r r r r% r) r* r+ r, r- � Exceptionr. Z
add_metaclass�ABCMeta�objectr7 r[ re rg ri rx r� r� r� r r r r �<module> sD
i
j
L
) +_;