3
y�_Y~ � @ s� d dl mZmZmZ d dlZd dlZd dlZd dlmZ d dl m
Z
m Z m Z m
Z
d dlmZ d dlmZ d dlmZmZmZmZ dd � Zd
d � Zd d
� Zdd� Zdd� Zdd� Z dd� Z dd� Z G dd� de �Z dd� Z!d d � Z"d d � Z#d d!� Z$d"d#� Z%d$d%� Z&d&d'� Z'd(d)� Z(d*d+� Z)d,d-� Z*d.d/� Z+d0d1� Z,d2d3� Z-d4d5� Z.d6d7� Z/d8d9� Z0d:d;� Z1d Z2d� Z4ej5j6ej5j7ej5j8ej5j9ej5j:ej5j;ej5jd@dA� Z?dBdC� Z@dDdE� ZAdFdG� ZBdHdI� ZCdJdK� ZDdLdM� ZEdNdO� ZFej5jGej5j6ej5j7ej5j8ej5j9ej5j:ej5j;ej5jHej5jK s z$_decode_x509_name..�����r) )
r ZX509_NAME_entry_count�rangeZX509_NAME_get_entryr% Z Cryptography_X509_NAME_ENTRY_set�append�addr �Name) r Z x509_name�count�
attributesZ prev_set_id�x�entryZ attributeZset_idr r r �_decode_x509_name< s
r2 c C sV | j j|�}g }x@t|�D ]4}| j j||�}| j|| jjk� |jt| |�� qW |S )N) r Zsk_GENERAL_NAME_numr* Zsk_GENERAL_NAME_valuer r r r+ �_decode_general_name)r �gns�num�names�i�gnr r r �_decode_general_namesN s r9 c C s |j | jjkr.t| |jj�jd�}tjj |�S |j | jj
kr\t| |jj �jd�}tj j |�S |j | jj
kr�t| |jj�}tjtj|��S |j | jjk�rbt| |jj�}t|�}|dks�|dk�rNtj|d |d � �}tj||d d � �}tt|��dd � }|jd�}|d k�r t|�}d||d � k�r6td��tj|j d j |� �} n
tj|�} tj | �S |j | jj k�r�tj t!| |jj"��S |j | jj#k�r�t| |jj$�jd�}tj%j |�S |j | jj&k�r�t| |jj'j(�}
t)| |jj'j*�} tj+tj|
�| �S tj,d
j tj-j.|j |j ��|j ��d S ) N�utf8� � � �0r �1zInvalid netmaskz/{}z{} is not a supported typer) )/r r ZGEN_DNS�_asn1_string_to_bytes�dZdNSNamer r ZDNSNameZ_init_without_validationZGEN_URIZuniformResourceIdentifierZUniformResourceIdentifierZGEN_RIDr Z registeredIDZ RegisteredIDr! Z GEN_IPADDZ iPAddress�len� ipaddressZ
ip_address�bin�int�find�
ValueErrorZ
ip_networkZexploded�formatZ IPAddressZ GEN_DIRNAMEZ
DirectoryNamer2 Z
directoryNameZ GEN_EMAILZ
rfc822NameZ
RFC822NameZ
GEN_OTHERNAMEZ otherName�type_id� _asn1_to_derr# Z OtherNameZUnsupportedGeneralNameTypeZ_GENERAL_NAMES�get) r r8 r" r$ Zdata_len�baseZnetmask�bits�prefixZiprI r# r r r r3 Y sP
r3 c C s t j� S )N)r Z OCSPNoCheck)r �extr r r �_decode_ocsp_no_check� s rP c C s0 | j jd|�}| j j|| jj�}tjt| |��S )NzASN1_INTEGER *)r �cast�gcr �ASN1_INTEGER_freer Z CRLNumber�_asn1_integer_to_int)r rO �asn1_intr r r �_decode_crl_number� s rV c C s0 | j jd|�}| j j|| jj�}tjt| |��S )NzASN1_INTEGER *)r rQ rR r rS r ZDeltaCRLIndicatorrT )r rO rU r r r �_decode_delta_crl_indicator� s rW c @ s e Zd Zdd� Zdd� ZdS )�_X509ExtensionParserc C s || _ || _|| _|| _d S )N)� ext_count�get_ext�handlers�_backend)�selfr rY rZ r[ r r r �__init__� s z _X509ExtensionParser.__init__c C sp g }t � }�xXt| j|��D �]D}| j||�}| jj|| jjjk� | jjj |�}|dk}t
j t | j| jjj
|���}||kr�t
jdj|�|��|tjk�r | jjj|�} t| j| �}
t|
�jt�} g } x | j� s�| j| jt�j� � q�W t
j dd� | D ��}
|jt
j |||
�� |j |� q n\|tj k�r|| jjj|�} tt| j| ��}|jt�j � |jt
j ||t
j!� �� |j |� q y| j"| }W nv t#k
�r | jjj|�} | jj| | jjjk� | jjj$| j%| j&�d d � }t
j'||�}|jt
j |||�� Y nXX | jjj(|�}|| jjjk�r8| jj)� t*dj|���|| j|�}
|jt
j |||
�� |j |� q W t
j+|�S )Nr z Duplicate {} extension foundc S s g | ] }t | �qS r )r
)r' r0 r r r �
� s z._X509ExtensionParser.parse..z/The {} extension is invalid and can't be parsed),�setr* rY rZ r\ r r r r ZX509_EXTENSION_get_criticalr r! r ZX509_EXTENSION_get_objectZDuplicateExtensionrH r Z TLS_FEATUREZX509_EXTENSION_get_datar@ r Zread_single_elementr Zis_emptyr+ Z read_elementr Z
as_integerZ
TLSFeatureZ Extensionr, ZPRECERT_POISONZ check_emptyZ
PrecertPoisonr[ �KeyErrorr r" �lengthZUnrecognizedExtensionZX509V3_EXT_d2iZ_consume_errorsrG Z
Extensions)r] Zx509_obj�
extensionsZ seen_oidsr7 rO ZcritZcriticalr$ r" Z
data_bytesZfeaturesZparsedr# �readerZhandlerZderZ unrecognizedZext_datar r r �parse� sh
z_X509ExtensionParser.parseN)�__name__�
__module__� __qualname__r^ re r r r r rX � s rX c C s. | j jd|�}| j j|| jj�}| jj|�}g }x�t|�D ]�}d }| jj||�}tj t
| |j ��}|j | j j
k�r| jj|j �}g }x�t|�D ]|} | jj|j | �}
tj t
| |
j��} | tjkr�| j j|
jjj|
jjj�d d � jd�} |j| � q�t| |
jj�}
|j|
� q�W |jtj ||�� q:W tj |�S )Nz"Cryptography_STACK_OF_POLICYINFO *�ascii) r rQ rR r ZCERTIFICATEPOLICIES_freeZsk_POLICYINFO_numr* Zsk_POLICYINFO_valuer r! r Zpolicyid�
qualifiersr Zsk_POLICYQUALINFO_numZsk_POLICYQUALINFO_value�pqualidr
Z
CPS_QUALIFIERr rA �cpsurir" rb r r+ �_decode_user_noticeZ
usernoticeZPolicyInformationZCertificatePolicies)r Zcpr5 Zcertificate_policiesr7 rj Zpir$ Zqnum�jZpqirk rl Z user_noticer r r � _decode_certificate_policies s0
ro c
C s� d }d }|j | jjkr"t| |j �}|j| jjkr�t| |jj�}| jj|jj�}g }x6t |�D ]*}| jj
|jj|�}t | |�} |j | � q\W t
j||�}t
j||�S )N)Zexptextr r r Z noticeref� organizationr Zsk_ASN1_INTEGER_numZ noticenosr* Zsk_ASN1_INTEGER_valuerT r+ r ZNoticeReferenceZ
UserNotice)
r ZunZ
explicit_textZnotice_referencerp r5 Znotice_numbersr7 rU Z
notice_numr r r rm ) s
rm c C sB | j jd|�}| j j|| jj�}|jdk}t| |j�}tj ||�S )NzBASIC_CONSTRAINTS *�� )
r rQ rR r ZBASIC_CONSTRAINTS_free�ca� _asn1_integer_to_int_or_noneZpathlenr ZBasicConstraints)r Zbc_stZbasic_constraintsrr Z path_lengthr r r �_decode_basic_constraintsA s
rt c C s@ | j jd|�}| j j|| jj�}tj| j j|j|j �d d � �S )NzASN1_OCTET_STRING *)
r rQ rR r �ASN1_OCTET_STRING_freer ZSubjectKeyIdentifierr r" rb )r � asn1_stringr r r � _decode_subject_key_identifierQ s
rw c C s� | j jd|�}| j j|| jj�}d }d }|j| j jkrT| j j|jj|jj �d d � }|j
| j jkrnt | |j
�}t | |j
�}tj|||�S )NzAUTHORITY_KEYID *)r rQ rR r ZAUTHORITY_KEYID_freeZkeyidr r r" rb Zissuerr9 rs �serialr ZAuthorityKeyIdentifier)r ZakidZkey_identifierZauthority_cert_issuerZ authority_cert_serial_numberr r r � _decode_authority_key_identifier[ s
ry c s� � j jd|�}� j j|� fdd��}� jj|�}g }xvt|�D ]j}� jj||�}� j|j� j j k� t
j t � |j��}� j|j
� j j k� t� |j
�}|jt
j||�� q>W |S )Nz*Cryptography_STACK_OF_ACCESS_DESCRIPTION *c s � j j| � jj� j jd��S )NZACCESS_DESCRIPTION_free)r Z sk_ACCESS_DESCRIPTION_pop_freer Z addressofZ
_original_lib)r0 )r r r �v s z,_decode_information_access..)r rQ rR r Zsk_ACCESS_DESCRIPTION_numr* Zsk_ACCESS_DESCRIPTION_valuer �methodr r r! r �locationr3 r+ ZAccessDescription)r Ziar5 �access_descriptionsr7 Zadr$ r8 r )r r �_decode_information_accessr s r~ c C s t | |�}tj|�S )N)r~ r ZAuthorityInformationAccess)r �aiar} r r r �$_decode_authority_information_access� s
r� c C s t | |�}tj|�S )N)r~ r ZSubjectInformationAccess)r r r} r r r �"_decode_subject_information_access� s
r� c
C s� | j jd|�}| j j|| jj�}| jj}||d�dk}||d�dk}||d�dk}||d�dk}||d�dk}||d�dk}||d�dk} ||d �dk}
||d
�dk} tj||||||| |
| � S ) NzASN1_BIT_STRING *r r r= � � � � � r; )r rQ rR r ZASN1_BIT_STRING_free�ASN1_BIT_STRING_get_bitr ZKeyUsage) r Z
bit_stringZget_bitZdigital_signatureZcontent_commitmentZkey_enciphermentZdata_enciphermentZ
key_agreementZ
key_cert_signZcrl_signZ
encipher_onlyZ
decipher_onlyr r r �_decode_key_usage� s, r� c C s. | j jd|�}| j j|| jj�}t| |�}|S )NzGENERAL_NAMES *)r rQ rR r �GENERAL_NAMES_freer9 )r r4 �
general_namesr r r � _decode_general_names_extension� s
r� c C s t jt| |��S )N)r ZSubjectAlternativeNamer� )r rO r r r �_decode_subject_alt_name� s r� c C s t jt| |��S )N)r ZIssuerAlternativeNamer� )r rO r r r �_decode_issuer_alt_name� s r� c C sF | j jd|�}| j j|| jj�}t| |j�}t| |j�}tj ||d�S )NzNAME_CONSTRAINTS *)Zpermitted_subtreesZexcluded_subtrees)
r rQ rR r ZNAME_CONSTRAINTS_free�_decode_general_subtreesZpermittedSubtreesZexcludedSubtreesr ZNameConstraints)r ZncZ permittedZexcludedr r r �_decode_name_constraints� s r� c C sl || j jkrd S | jj|�}g }xFt|�D ]:}| jj||�}| j|| j jk� t| |j�}|j |� q*W |S )N)
r r r Zsk_GENERAL_SUBTREE_numr* Zsk_GENERAL_SUBTREE_valuer r3 rL r+ )r Zstack_subtreesr5 Zsubtreesr7 r �namer r r r� � s r� c C s� | j jd|�}| j j|| jj�}|j| j jkr@t| |j�\}}nd }d }|jdk}|j dk}|j
dk}|j dk}|j | j jkr�t
| |j �}nd }tj|||||||�S )NzISSUING_DIST_POINT *rq )r rQ rR r ZISSUING_DIST_POINT_free� distpointr �_decode_distpointZonlyuserZonlyCAZ indirectCRLZonlyattrZonlysomereasons�_decode_reasonsr ZIssuingDistributionPoint) r Zidp� full_name�
relative_nameZ only_userZonly_caZ indirect_crlZ only_attrZonly_some_reasonsr r r �_decode_issuing_dist_point� s*
r� c C sD | j jd|�}| j j|| jj�}t| |j�}t| |j�}tj ||�S )NzPOLICY_CONSTRAINTS *)
r rQ rR r ZPOLICY_CONSTRAINTS_freers ZrequireExplicitPolicyZinhibitPolicyMappingr ZPolicyConstraints)r ZpcZrequire_explicit_policyZinhibit_policy_mappingr r r �_decode_policy_constraints� s
r� c C s� | j jd|�}| j j|| jj�}| jj|�}g }xJt|�D ]>}| jj||�}| j|| j j k� t
j t | |��}|j
|� q:W t
j|�S )Nz#Cryptography_STACK_OF_ASN1_OBJECT *)r rQ rR r Zsk_ASN1_OBJECT_freeZsk_ASN1_OBJECT_numr* Zsk_ASN1_OBJECT_valuer r r r! r r+ ZExtendedKeyUsage)r Zskr5 Zekusr7 r r$ r r r �_decode_extended_key_usage s r� r c
C s� | j jd|�}| j j|| jj�}| jj|�}g }x�t|�D ]�}d }d }d }d }| jj||�} | j| j j krvt
| | j�}| j | j j kr�t | | j �}| j
| j j kr�t| | j
�\}}|jtj||||�� q:W |S )Nz"Cryptography_STACK_OF_DIST_POINT *)r rQ rR r ZCRL_DIST_POINTS_freeZsk_DIST_POINT_numr* Zsk_DIST_POINT_value�reasonsr r� Z CRLissuerr9 r� r� r+ r ZDistributionPoint)
r �cdpsr5 � dist_pointsr7 r� r� Z
crl_issuerr� Zcdpr r r �_decode_dist_points s* r� )r r= r� r� r� r� r� r; c C s< g }x.t jt�D ] \}}| jj||�r|j|� qW t|�S )N)�sixZ iteritems�_REASON_BIT_MAPPINGr r� r+ � frozenset)r r� Z enum_reasonsZ bit_position�reasonr r r r� S s
r� c C s� |j tkr t| |jj�}|d fS |jj}| jj|�}t� }x@t |�D ]4}| jj
||�}| j || j j
k� |jt| |�� qDW tj|�}d |fS )N)r �_DISTPOINT_TYPE_FULLNAMEr9 r� �fullnameZ relativenamer Zsk_X509_NAME_ENTRY_numr` r* Zsk_X509_NAME_ENTRY_valuer r r r, r% r r& ) r r� r� ZrnsZrnumr/ r7 Zrnr� r r r r� ] s
r� c C s t | |�}tj|�S )N)r� r ZCRLDistributionPoints)r r� r� r r r � _decode_crl_distribution_pointsv s
r� c C s t | |�}tj|�S )N)r� r Z FreshestCRL)r r� r� r r r �_decode_freshest_crl{ s
r� c C s4 | j jd|�}| j j|| jj�}t| |�}tj|�S )NzASN1_INTEGER *)r rQ rR r rS rT r ZInhibitAnyPolicy)r rU Z
skip_certsr r r �_decode_inhibit_any_policy� s
r� c C sn ddl m} | jjd|�}| jj|| jj�}g }x8t| jj|��D ]$}| jj ||�}|j
|| ||�� qBW |S )Nr )�_SignedCertificateTimestampzCryptography_STACK_OF_SCT *) Z)cryptography.hazmat.backends.openssl.x509r� r rQ rR r Z
SCT_LIST_freer* Z
sk_SCT_numZ sk_SCT_valuer+ )r � asn1_sctsr� Zsctsr7 Zsctr r r � _decode_scts� s r� c C s t jt| |��S )N)r Z)PrecertificateSignedCertificateTimestampsr� )r r� r r r �-_decode_precert_signed_certificate_timestamps� s r� c C s t jt| |��S )N)r ZSignedCertificateTimestampsr� )r r� r r r �%_decode_signed_certificate_timestamps� s r� )
r r r= r� r� r� r� r; � �
r= r� r� r� r� r; r� r� c C sb | j jd|�}| j j|| jj�}| jj|�}ytjt| �S t k
r\ t
dj |���Y nX d S )NzASN1_ENUMERATED *zUnsupported reason code: {}) r rQ rR r ZASN1_ENUMERATED_freeZASN1_ENUMERATED_getr Z CRLReason� _CRL_ENTRY_REASON_CODE_TO_ENUMra rG rH )r �enum�coder r r �_decode_crl_reason� s r� c C s0 | j jd|�}| j j|| jj�}tjt| |��S )NzASN1_GENERALIZEDTIME *)r rQ rR r �ASN1_GENERALIZEDTIME_freer ZInvalidityDate� _parse_asn1_generalized_time)r Zinv_date�generalized_timer r r �_decode_invalidity_date� s
r� c C s4 | j jd|�}| j j|| jj�}t| |�}tj|�S )NzGENERAL_NAMES *)r rQ rR r r� r9 r ZCertificateIssuer)r r4 r� r r r �_decode_cert_issuer� s
r� c sn � j jd�}� jj||�}� j|dk� � j|d � j jk� � j j|� fdd��}� j j|d |�d d � S )Nzunsigned char **r c s � j j| d �S )Nr )r � OPENSSL_free)r )r r r rz � s z _asn1_to_der..)r r r Z
i2d_ASN1_TYPEr r rR r )r Z asn1_typer r r )r r rJ � s rJ c C s@ | j j|| jj�}| j|| jjk� | jj|| j j�}| j|�S )N)r ZASN1_INTEGER_to_BNr r r rR ZBN_freeZ
_bn_to_int)r rU Zbnr r r rT � s rT c C s || j jkrd S t| |�S d S )N)r r rT )r rU r r r rs � s rs c C s | j j|j|j�d d � S )N)r r r" rb )r rv r r r r@ � s r@ c C s t | |�jd�S )Nri )r@ r )r rv r r r �_asn1_string_to_ascii s r� c s~ � j jd�}� jj||�}|dkr2tdj|j���� j|d � j jk� � j j |� fdd��}� j j
|d |�d d � j d�S ) Nzunsigned char **r z&Unsupported ASN1 string type. Type: {}r c s � j j| d �S )Nr )r r� )r )r r r rz s z&_asn1_string_to_utf8..r: r) ) r r r ZASN1_STRING_to_UTF8rG rH r r r rR r r )r rv r r r )r r r s r c C s` | j || jjk� | jj|| jj�}|| jjkrDtdjt| |����| jj|| jj �}t
| |�S )Nz1Couldn't parse ASN.1 time as generalizedtime {!r}) r r r r Z ASN1_TIME_to_generalizedtimerG rH r@ rR r� r� )r Z asn1_timer� r r r �_parse_asn1_time s r� c C s" t | | jjd|��}tjj|d�S )Nz
ASN1_STRING *z
%Y%m%d%H%M%SZ)r� r rQ �datetimeZstrptime)r r� Ztimer r r r� ' s r� c C s0 | j jd|�}| j j|| jj�}tjt| |��S )NzASN1_OCTET_STRING *)r rQ rR r ru r Z OCSPNoncer@ )r Znoncer r r �
_decode_nonce. s r� )wZ
__future__r r r r� rC r� Z cryptographyr Zcryptography.hazmat._derr r r r Z cryptography.x509.extensionsr
Zcryptography.x509.namer Zcryptography.x509.oidr r
r r r r% r2 r9 r3 rP rV rW �objectrX ro rm rt rw ry r~ r� r� r� r� r� r� r� r� r� r� r� r� Z _DISTPOINT_TYPE_RELATIVENAMEr� Z ReasonFlagsZkey_compromiseZ
ca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZ
aa_compromiser� r� r� r� r� r� r� r� r� Z unspecifiedZremove_from_crlr� Z _CRL_ENTRY_REASON_ENUM_TO_CODEr� r� r� rJ rT rs r@ r� r r� r� r� ZBASIC_CONSTRAINTSZSUBJECT_KEY_IDENTIFIERZ KEY_USAGEZSUBJECT_ALTERNATIVE_NAMEZEXTENDED_KEY_USAGEZAUTHORITY_KEY_IDENTIFIERZ AUTHORITY_INFORMATION_ACCESSZSUBJECT_INFORMATION_ACCESSZCERTIFICATE_POLICIESZCRL_DISTRIBUTION_POINTSZ FRESHEST_CRLZ
OCSP_NO_CHECKZINHIBIT_ANY_POLICYZISSUER_ALTERNATIVE_NAMEZNAME_CONSTRAINTSZPOLICY_CONSTRAINTSZ_EXTENSION_HANDLERS_BASEZ%PRECERT_SIGNED_CERTIFICATE_TIMESTAMPSZ_EXTENSION_HANDLERS_SCTZ
CRL_REASONZINVALIDITY_DATEZCERTIFICATE_ISSUERZ_REVOKED_EXTENSION_HANDLERSZ
CRL_NUMBERZDELTA_CRL_INDICATORZISSUING_DISTRIBUTION_POINTZ_CRL_EXTENSION_HANDLERSZNONCEZ _OCSP_REQ_EXTENSION_HANDLERSZ"_OCSP_BASICRESP_EXTENSION_HANDLERSZ SIGNED_CERTIFICATE_TIMESTAMPSZ'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCTr r r r � s� NQ!
-