File: //usr/lib/python3/dist-packages/cryptography/x509/__pycache__/base.cpython-39.pyc
a
� `)g � @ s� d dl mZmZmZ d dlZd dlZd dlZd dlmZ d dl Z d dl
m Z d dl m
Z
d dlmZmZmZmZmZ d dlmZmZ d dlmZ d d lmZ e�d
d d �ZG d d
� d
e �Z dd� Z dd� Z dd� Z G dd� de�Z!d6dd�Z"d7dd�Z#d8dd�Z$d9d d �Z%d:d d �Z&d;d d!�Z'G d"d#� d#e �Z(e �)ej*�G d$d%� d%e+��Z,e �)ej*�G d&d'� d'e+��Z-e �)ej*�G d(d)� d)e+��Z.e �)ej*�G d*d+� d+e+��Z/G d,d-� d-e+�Z0G d.d/� d/e+�Z1G d0d1� d1e+�Z2G d2d3� d3e+�Z3d4d5� Z4dS )<� )�absolute_import�division�print_functionN)�Enum)�utils)� _get_backend)�dsa�ec�ed25519�ed448�rsa)� Extension�
ExtensionType)�Name)�ObjectIdentifieri� � c s e Zd Z� fdd�Z� ZS )�AttributeNotFoundc s t t| ��|� || _d S �N)�superr �__init__�oid)�self�msgr �� __class__� �8/usr/lib/python3/dist-packages/cryptography/x509/base.pyr s zAttributeNotFound.__init__��__name__�
__module__� __qualname__r �
__classcell__r r r r r s r c C s" |D ]}|j | j krtd��qd S )Nz$This extension has already been set.)r �
ValueError)� extension�
extensions�er r r �_reject_duplicate_extension% s r& c C s" |D ]\}}|| krt d��qd S )Nz$This attribute has already been set.)r" )r �
attributesZattr_oid�_r r r �_reject_duplicate_attribute, s r) c C s: | j dur2| �� }|r|nt�� }| jdd�| S | S dS )z�Normalizes a datetime to a naive datetime in UTC.
time -- datetime to normalize. Assumed to be in UTC if not timezone
aware.
N)�tzinfo)r* � utcoffset�datetime� timedelta�replace)�time�offsetr r r �_convert_to_naive_utc_time3 s
r1 c @ s e Zd ZdZdZdS )�Versionr � N)r r r �v1�v3r r r r r2 A s r2 c C s t |�}|�| �S r )r �load_pem_x509_certificate��data�backendr r r r6 F s r6 c C s t |�}|�| �S r )r �load_der_x509_certificater7 r r r r: K s r: c C s t |�}|�| �S r )r �load_pem_x509_csrr7 r r r r; P s r; c C s t |�}|�| �S r )r �load_der_x509_csrr7 r r r r< U s r< c C s t |�}|�| �S r )r �load_pem_x509_crlr7 r r r r= Z s r= c C s t |�}|�| �S r )r �load_der_x509_crlr7 r r r r> _ s r> c s e Zd Z� fdd�Z� ZS )�InvalidVersionc s t t| ��|� || _d S r )r r? r �parsed_version)r r r@ r r r r e s zInvalidVersion.__init__r r r r r r? d s r? c @ s� e Zd Zejdd� �Zejdd� �Zejdd� �Zejdd� �Z ejd d
� �Z
ejd d � �Z ejd
d� �Z ejdd� �Z
ejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd � �Zejd d � �Zejd d � �Zejd!d"� �Zd#S )$� Certificatec C s dS �z4
Returns bytes using digest passed.
Nr �r � algorithmr r r � fingerprintl s zCertificate.fingerprintc C s dS )z3
Returns certificate serial number
Nr �r r r r �
serial_numberr s zCertificate.serial_numberc C s dS )z1
Returns the certificate version
Nr rF r r r �versionx s zCertificate.versionc C s dS �z(
Returns the public key
Nr rF r r r �
public_key~ s zCertificate.public_keyc C s dS )z?
Not before time (represented as UTC datetime)
Nr rF r r r �not_valid_before� s z Certificate.not_valid_beforec C s dS )z>
Not after time (represented as UTC datetime)
Nr rF r r r �not_valid_after� s zCertificate.not_valid_afterc C s dS )z1
Returns the issuer name object.
Nr rF r r r �issuer� s zCertificate.issuerc C s dS �z2
Returns the subject name object.
Nr rF r r r �subject� s zCertificate.subjectc C s dS �zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
Nr rF r r r �signature_hash_algorithm� s z$Certificate.signature_hash_algorithmc C s dS �zJ
Returns the ObjectIdentifier of the signature algorithm.
Nr rF r r r �signature_algorithm_oid� s z#Certificate.signature_algorithm_oidc C s dS )z/
Returns an Extensions object.
Nr rF r r r r$ � s zCertificate.extensionsc C s dS �z.
Returns the signature bytes.
Nr rF r r r � signature� s zCertificate.signaturec C s dS )zR
Returns the tbsCertificate payload bytes as defined in RFC 5280.
Nr rF r r r �tbs_certificate_bytes� s z!Certificate.tbs_certificate_bytesc C s dS �z"
Checks equality.
Nr �r �otherr r r �__eq__� s zCertificate.__eq__c C s dS �z#
Checks not equal.
Nr rX r r r �__ne__� s zCertificate.__ne__c C s dS �z"
Computes a hash.
Nr rF r r r �__hash__� s zCertificate.__hash__c C s dS )zB
Serializes the certificate to PEM or DER format.
Nr �r �encodingr r r � public_bytes� s zCertificate.public_bytesN)r r r �abc�abstractmethodrE �abstractpropertyrG rH rJ rK rL rM rO rQ rS r$ rU rV rZ r\ r^ ra r r r r rA j sD
rA c @ s� e Zd Zejdd� �Zejdd� �Zejdd� �Zejdd� �Z ejd d
� �Z
ejd d � �Z ejd
d� �Z ejdd� �Z
ejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd� �Zejdd � �Zejd d � �Zejd d � �Zejd!d"� �Zd#S )$�CertificateRevocationListc C s dS )z:
Serializes the CRL to PEM or DER format.
Nr r_ r r r ra � s z&CertificateRevocationList.public_bytesc C s dS rB r rC r r r rE � s z%CertificateRevocationList.fingerprintc C s dS )zs
Returns an instance of RevokedCertificate or None if the serial_number
is not in the CRL.
Nr )r rG r r r �(get_revoked_certificate_by_serial_number� s zBCertificateRevocationList.get_revoked_certificate_by_serial_numberc C s dS rP r rF r r r rQ � s z2CertificateRevocationList.signature_hash_algorithmc C s dS rR r rF r r r rS � s z1CertificateRevocationList.signature_algorithm_oidc C s dS )zC
Returns the X509Name with the issuer of this CRL.
Nr rF r r r rM � s z CertificateRevocationList.issuerc C s dS )z?
Returns the date of next update for this CRL.
Nr rF r r r � next_update� s z%CertificateRevocationList.next_updatec C s dS )z?
Returns the date of last update for this CRL.
Nr rF r r r � last_update s z%CertificateRevocationList.last_updatec C s dS )zS
Returns an Extensions object containing a list of CRL extensions.
Nr rF r r r r$ s z$CertificateRevocationList.extensionsc C s dS rT r rF r r r rU s z#CertificateRevocationList.signaturec C s dS )zO
Returns the tbsCertList payload bytes as defined in RFC 5280.
Nr rF r r r �tbs_certlist_bytes s z,CertificateRevocationList.tbs_certlist_bytesc C s dS rW r rX r r r rZ s z CertificateRevocationList.__eq__c C s dS r[ r rX r r r r\ s z CertificateRevocationList.__ne__c C s dS )z<
Number of revoked certificates in the CRL.
Nr rF r r r �__len__& s z!CertificateRevocationList.__len__c C s dS )zS
Returns a revoked certificate (or slice of revoked certificates).
Nr )r �idxr r r � __getitem__, s z%CertificateRevocationList.__getitem__c C s dS )z8
Iterator over the revoked certificates
Nr rF r r r �__iter__2 s z"CertificateRevocationList.__iter__c C s dS )zQ
Verifies signature of revocation list against given public key.
Nr )r rJ r r r �is_signature_valid8 s z,CertificateRevocationList.is_signature_validN)r r r rb rc ra rE rf rd rQ rS rM rg rh r$ rU ri rZ r\ rj rl rm rn r r r r re � sD
re c @ s� e Zd Zejdd� �Zejdd� �Zejdd� �Zejdd� �Zej d d
� �Z
ej d d � �Z ej d
d� �Z ej dd� �Z
ejdd� �Zej dd� �Zej dd� �Zej dd� �Zej dd� �ZdS ) �CertificateSigningRequestc C s dS rW r rX r r r rZ A s z CertificateSigningRequest.__eq__c C s dS r[ r rX r r r r\ G s z CertificateSigningRequest.__ne__c C s dS r] r rF r r r r^ M s z"CertificateSigningRequest.__hash__c C s dS rI r rF r r r rJ S s z$CertificateSigningRequest.public_keyc C s dS rN r rF r r r rO Y s z!CertificateSigningRequest.subjectc C s dS rP r rF r r r rQ _ s z2CertificateSigningRequest.signature_hash_algorithmc C s dS rR r rF r r r rS f s z1CertificateSigningRequest.signature_algorithm_oidc C s dS )z@
Returns the extensions in the signing request.
Nr rF r r r r$ l s z$CertificateSigningRequest.extensionsc C s dS )z;
Encodes the request to PEM or DER format.
Nr r_ r r r ra r s z&CertificateSigningRequest.public_bytesc C s dS rT r rF r r r rU x s z#CertificateSigningRequest.signaturec C s dS )zd
Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
2986.
Nr rF r r r �tbs_certrequest_bytes~ s z/CertificateSigningRequest.tbs_certrequest_bytesc C s dS )z8
Verifies signature of signing request.
Nr rF r r r rn � s z,CertificateSigningRequest.is_signature_validc C s dS )z:
Get the attribute value for a given OID.
Nr rF r r r �get_attribute_for_oid� s z/CertificateSigningRequest.get_attribute_for_oidN)r r r rb rc rZ r\ r^ rJ rd rO rQ rS r$ ra rU rp rn rq r r r r ro ? s4
ro c @ s6 e Zd Zejdd� �Zejdd� �Zejdd� �ZdS )�RevokedCertificatec C s dS )zG
Returns the serial number of the revoked certificate.
Nr rF r r r rG � s z RevokedCertificate.serial_numberc C s dS )zH
Returns the date of when this certificate was revoked.
Nr rF r r r �revocation_date� s z"RevokedCertificate.revocation_datec C s dS )zW
Returns an Extensions object containing a list of Revoked extensions.
Nr rF r r r r$ � s z RevokedCertificate.extensionsN)r r r rb rd rG rs r$ r r r r rr � s
rr c @ s> e Zd Zdg g fdd�Zdd� Zdd� Zdd � Zd d
d �ZdS )
� CertificateSigningRequestBuilderNc C s || _ || _|| _dS )zB
Creates an empty X.509 certificate request (v1).
N)�
_subject_name� _extensions� _attributes)r � subject_namer$ r' r r r r � s z)CertificateSigningRequestBuilder.__init__c C s4 t |t�std��| jdur$td��t|| j| j�S )zF
Sets the certificate requestor's distinguished name.
�Expecting x509.Name object.N�&The subject name may only be set once.)�
isinstancer � TypeErrorru r" rt rv rw �r �namer r r rx � s
�z-CertificateSigningRequestBuilder.subject_namec C sD t |t�std��t|j||�}t|| j� t| j| j|g | j �S )zE
Adds an X.509 extension to the certificate request.
�"extension must be an ExtensionType)
r{ r r| r
r r& rv rt ru rw �r r# �criticalr r r �
add_extension� s
�z.CertificateSigningRequestBuilder.add_extensionc C sL t |t�std��t |t�s$td��t|| j� t| j| j| j||fg �S )zK
Adds an X.509 attribute with an OID and associated value.
z oid must be an ObjectIdentifierzvalue must be bytes) r{ r r| �bytesr) rw rt ru rv )r r �valuer r r �
add_attribute� s
�z.CertificateSigningRequestBuilder.add_attributec C s( t |�}| jdu rtd��|�| ||�S )zF
Signs the request using the requestor's private key.
Nz/A CertificateSigningRequest must have a subject)r ru r" Zcreate_x509_csr�r Z private_keyrD r9 r r r �sign� s
z%CertificateSigningRequestBuilder.sign)N)r r r r rx r� r� r� r r r r rt � s
rt c @ sf e Zd Zddddddg fdd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zdd� Z dd� Z
ddd�Z dS )�CertificateBuilderNc C s6 t j| _|| _|| _|| _|| _|| _|| _|| _ d S r )
r2 r5 �_version� _issuer_nameru � _public_key�_serial_number�_not_valid_before�_not_valid_afterrv )r � issuer_namerx rJ rG rK rL r$ r r r r � s
zCertificateBuilder.__init__c C sD t |t�std��| jdur$td��t|| j| j| j| j | j
| j �S )z3
Sets the CA's distinguished name.
ry N�%The issuer name may only be set once.) r{ r r| r� r" r� ru r� r� r� r� rv r} r r r r� � s
�z CertificateBuilder.issuer_namec C sD t |t�std��| jdur$td��t| j|| j| j| j | j
| j �S )z:
Sets the requestor's distinguished name.
ry Nrz ) r{ r r| ru r" r� r� r� r� r� r� rv r} r r r rx s
�z CertificateBuilder.subject_namec C sX t |tjtjtjtjt j
f�s&t d��| j dur8t
d��t| j| j|| j| j| j| j�S )zT
Sets the requestor's public key (as found in the signing request).
zhExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey or Ed448PublicKey.Nz$The public key may only be set once.)r{ r � DSAPublicKeyr � RSAPublicKeyr ZEllipticCurvePublicKeyr
ZEd25519PublicKeyr ZEd448PublicKeyr| r� r" r� r� ru r� r� r� rv )r �keyr r r rJ s. ��
�
�z CertificateBuilder.public_keyc C sj t |tj�std��| jdur&td��|dkr6td��|�� dkrJtd��t| j| j | j
|| j | j | j
�S )z5
Sets the certificate serial number.
�'Serial number must be of integral type.N�'The serial number may only be set once.r z%The serial number should be positive.� �3The serial number should not be more than 159 bits.)r{ �six�
integer_typesr| r� r" �
bit_lengthr� r� ru r� r� r� rv �r �numberr r r rG ? s&
��z CertificateBuilder.serial_numberc C sz t |tj�std��| jdur&td��t|�}|tk r>td��| jdurZ|| jkrZtd��t| j | j
| j | j || j| j
�S )z7
Sets the certificate activation time.
�Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)r{ r, r| r� r" r1 �_EARLIEST_UTC_TIMEr� r� r� ru r� r� rv �r r/ r r r rK Z s,
���z#CertificateBuilder.not_valid_beforec C sz t |tj�std��| jdur&td��t|�}|tk r>td��| jdurZ|| jk rZtd��t| j | j
| j | j | j|| j
�S )z7
Sets the certificate expiration time.
r� Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)r{ r, r| r� r" r1 r� r� r� r� ru r� r� rv r� r r r rL w s2
�����z"CertificateBuilder.not_valid_afterc C sT t |t�std��t|j||�}t|| j� t| j| j | j
| j | j | j
| j|g �S )z=
Adds an X.509 extension to the certificate.
r )r{ r r| r
r r& rv r� r� ru r� r� r� r� r� r r r r� � s
�z CertificateBuilder.add_extensionc C s� t |�}| jdu rtd��| jdu r,td��| jdu r>td��| jdu rPtd��| jdu rbtd��| jdu rttd��|�| ||�S )zC
Signs the certificate using the CA's private key.
Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key) r ru r" r� r� r� r� r� Zcreate_x509_certificater� r r r r� � s
zCertificateBuilder.sign)N) r r r r r� rx rJ rG rK rL r� r� r r r r r� � s �
r� c @ sR e Zd Zdddg g fdd�Zdd� Zdd� Zdd � Zd
d � Zd d
� Zddd�Z dS )� CertificateRevocationListBuilderNc C s" || _ || _|| _|| _|| _d S r )r� � _last_update� _next_updaterv �_revoked_certificates)r r� rh rg r$ Zrevoked_certificatesr r r r � s
z)CertificateRevocationListBuilder.__init__c C s< t |t�std��| jd ur$td��t|| j| j| j| j �S )Nry r� )
r{ r r| r� r" r� r� r� rv r� )r r� r r r r� � s
�z,CertificateRevocationListBuilder.issuer_namec C sr t |tj�std��| jd ur&td��t|�}|tk r>td��| jd urZ|| jkrZtd��t| j || j| j
| j �S )Nr� �!Last update may only be set once.�8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) r{ r, r| r� r" r1 r� r� r� r� rv r� )r rh r r r rh � s(
���z,CertificateRevocationListBuilder.last_updatec C sr t |tj�std��| jd ur&td��t|�}|tk r>td��| jd urZ|| jk rZtd��t| j | j|| j
| j �S )Nr� r� r� z8The next update date must be after the last update date.) r{ r, r| r� r" r1 r� r� r� r� rv r� )r rg r r r rg � s(
���z,CertificateRevocationListBuilder.next_updatec C sL t |t�std��t|j||�}t|| j� t| j| j | j
| j|g | j �S )zM
Adds an X.509 extension to the certificate revocation list.
r ) r{ r r| r
r r& rv r� r� r� r� r� r� r r r r�
s
�z.CertificateRevocationListBuilder.add_extensionc C s2 t |t�std��t| j| j| j| j| j|g �S )z8
Adds a revoked certificate to the CRL.
z)Must be an instance of RevokedCertificate) r{ rr r| r� r� r� r� rv r� )r Zrevoked_certificater r r �add_revoked_certificate s
�z8CertificateRevocationListBuilder.add_revoked_certificatec C sL t |�}| jd u rtd��| jd u r,td��| jd u r>td��|�| ||�S )Nz A CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r r� r" r� r� Zcreate_x509_crlr� r r r r� - s
z%CertificateRevocationListBuilder.sign)N)
r r r r r� rh rg r� r� r� r r r r r� � s �
r� c @ s> e Zd Zddg fdd�Zdd� Zdd� Zdd � Zd d
d �ZdS )
�RevokedCertificateBuilderNc C s || _ || _|| _d S r )r� �_revocation_daterv )r rG rs r$ r r r r < s z"RevokedCertificateBuilder.__init__c C sZ t |tj�std��| jd ur&td��|dkr6td��|�� dkrJtd��t|| j| j �S )Nr� r� r z$The serial number should be positiver� r� )
r{ r� r� r| r� r" r� r� r� rv r� r r r rG C s
�
�z'RevokedCertificateBuilder.serial_numberc C sN t |tj�std��| jd ur&td��t|�}|tk r>td��t| j|| j �S )Nr� z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
r{ r, r| r� r" r1 r� r� r� rv r� r r r rs U s
�
�z)RevokedCertificateBuilder.revocation_datec C sD t |t�std��t|j||�}t|| j� t| j| j | j|g �S )Nr )
r{ r r| r
r r& rv r� r� r� r� r r r r� c s
�z'RevokedCertificateBuilder.add_extensionc C s6 t |�}| jd u rtd��| jd u r,td��|�| �S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r r� r" r� Z create_x509_revoked_certificate)r r9 r r r �buildo s
�z RevokedCertificateBuilder.build)N)r r r r rG rs r� r� r r r r r� ; s �
r� c C s t �t�d�d�d? S )N� �bigr )r �int_from_bytes�os�urandomr r r r �random_serial_number{ s r� )N)N)N)N)N)N)5�
__future__r r r rb r, r� �enumr r� � cryptographyr Z cryptography.hazmat.backendsr �)cryptography.hazmat.primitives.asymmetricr r r
r r � cryptography.x509.extensionsr
r �cryptography.x509.namer �cryptography.x509.oidr r� � Exceptionr r& r) r1 r2 r6 r: r; r< r= r> r? �
add_metaclass�ABCMeta�objectrA re ro rr rt r� r� r� r� r r r r �<module> sL
i
j
R
A ^v@