3
l�_\ � @ s� d dl mZmZmZ d dlZd dlZd dlZd dlmZm Z d dl
m Z m Z m
Z
d dlmZ d dlmZmZmZ dd� Zd d
� Zd d � Zd
d� Zdd� Zdd� Zdd� Zdd� Zdd� Z dd� Z dd � Z d d � Z d d � Z d!d"� Z!d#d$� Z"d%d&� Z#d'd(� Z$d)d*� Z%d+d,� Z&d-d.� Z'd/d0� Z(d1d2� Z)d3d4� Z*d5d6� Z+d7d8� Z,d9d:� Z-d;d<� Z.d=d>� Z/d?d@� Z0e j1j2dAe j1j3dBe j1j4dCe j1j5dDe j1j6dEe j1j7dFe j1j8dGe j1j9dHiZ:dIdJ� Z;dKdL� ZdQdR� Z?dSdT� Z@dUdV� ZAdWdX� ZBejCe)ejDe-ejEe'ejFe,ejGe,ejHe0ejIe(ejJe"ejKe*ejLe*ejMe>ejNe>ejOeejPe&ejQe?ejRe@iZSejGe,ejIe(ejKe*ejTe ejUe ejVe ejNe>iZWejXe,ejYe ejZe!iZ[ej\eBiZ]ej\eBiZ^dS )Y� )�absolute_import�division�print_functionN)�utils�x509)� _CRL_ENTRY_REASON_ENUM_TO_CODE�_DISTPOINT_TYPE_FULLNAME� _DISTPOINT_TYPE_RELATIVENAME)� _ASN1Type)�CRLEntryExtensionOID� ExtensionOID�OCSPExtensionOIDc C sD | j |�}| jj|| jj�}| jj|| jj�}| j|| jjk� |S )a
Converts a python integer to an ASN1_INTEGER. The returned ASN1_INTEGER
will not be garbage collected (to support adding them to structs that take
ownership of the object). Be sure to register it for GC if it will be
discarded after use.
)Z
_int_to_bn�_ffi�gc�_libZBN_freeZBN_to_ASN1_INTEGER�NULL�openssl_assert)�backend�x�i� r �#/usr/lib64/python3.6/encode_asn1.py�_encode_asn1_int s
r c C s t | |�}| jj|| jj�}|S )N)r r r r ZASN1_INTEGER_free)r r r r r r �_encode_asn1_int_gc. s
r c C s0 | j j� }| j j||t|��}| j|dk� |S )z@
Create an ASN1_OCTET_STRING from a Python byte string.
� )r ZASN1_OCTET_STRING_newZASN1_OCTET_STRING_set�lenr )r �data�s�resr r r �_encode_asn1_str4 s
r c C s< | j j� }| j j||jd�t|jd���}| j|dk� |S )z�
Create an ASN1_UTF8STRING from a Python unicode string.
This object will be an ASN1_STRING with UTF8 type in OpenSSL and
can be decoded with ASN1_STRING_to_UTF8.
�utf8r )r ZASN1_UTF8STRING_new�ASN1_STRING_set�encoder r )r �stringr r r r r �_encode_asn1_utf8_str> s
r$ c C s t | |�}| jj|| jj�}|S )N)r r r r ZASN1_OCTET_STRING_free)r r r r r r �_encode_asn1_str_gcL s
r% c C s t | |j�S )N)r Z
skip_certs)r Zinhibit_any_policyr r r �_encode_inhibit_any_policyR s r& c C sp | j j� }x`|jD ]V}d}xL|D ]D}t| |�}| jj|| j j�}| j j||d|�}| j|dk� d}q W qW |S )zP
The X509_NAME created will not be gc'd. Use _encode_name_gc if needed.
r r �����r' ) r Z
X509_NAME_newZrdns�_encode_name_entryr r ZX509_NAME_ENTRY_freeZX509_NAME_add_entryr )r �name�subjectZrdnZset_flag� attribute�
name_entryr r r r � _encode_nameV s
r- c C s t | |�}| jj|| jj�}|S )N)r- r r r ZX509_NAME_free)r �
attributesr* r r r �_encode_name_gck s
r/ c C sB | j j� }x2|D ]*}t| |�}| j j||�}| j|dk� qW |S )z:
The sk_X509_NAME_ENTRY created will not be gc'd.
r )r Zsk_X509_NAME_ENTRY_new_nullr( Zsk_X509_NAME_ENTRY_pushr )r r. �stackr+ r, r r r r �_encode_sk_name_entryq s
r1 c C sr |j tjkr|jjd�}n&|j tjkr4|jjd�}n |jjd�}t| |jj�}| j j
| j j ||j j|t
|��}|S )N� utf_16_be� utf_32_ber )Z_typer
Z BMPString�valuer" ZUniversalString� _txt2obj_gc�oid�
dotted_stringr Z X509_NAME_ENTRY_create_by_OBJr r r )r r+ r4 �objr, r r r r( } s r( c C s t | |j�S )N)r Z
crl_number)r �extr r r �&_encode_crl_number_delta_crl_indicator� s r: c C s� | j j� }| j|| jjk� | jj|| j j�}|jr8dnd|_|j rHdnd|_
|j rXdnd|_ |j
rhdnd|_|jr�t| |j�|_|jr�t| |j�|_|jr�t| |j�|_|S )N�� r )r ZISSUING_DIST_POINT_newr r r r ZISSUING_DIST_POINT_freeZonly_contains_user_certsZonlyuserZonly_contains_ca_certsZonlyCAZ indirect_crlZ indirectCRLZ only_contains_attribute_certsZonlyattrZonly_some_reasons�_encode_reasonflagsZonlysomereasons� full_name�_encode_full_name� distpoint�
relative_name�_encode_relative_name)r r9 Zidpr r r �_encode_issuing_dist_point� s
rB c C sT | j j� }| j|| jjk� | jj|| j j�}| j j|t|j �}| j|dk� |S )Nr )
r ZASN1_ENUMERATED_newr r r r ZASN1_ENUMERATED_freeZASN1_ENUMERATED_setr �reason)r Z
crl_reasonZasn1enumr r r r �_encode_crl_reason� s
rD c C sF | j j| jjtj|jj� ��}| j|| jjk� | jj || j j
�}|S )N) r ZASN1_GENERALIZEDTIME_setr r �calendarZtimegm�invalidity_dateZ timetupler r ZASN1_GENERALIZEDTIME_free)r rF Ztimer r r �_encode_invalidity_date� s rG c C s� | j j� }| j|| jjk� | jj|| j j�}�xh|D �]^}| j j� }| j|| jjk� | j j||�}| j|dk� t | |j
j �}||_ |j
r6| j j� }| j|| jjk� x�|j
D ]�}| j j� } | j| | jjk� | j j|| �}| j|dk� t|tj��r"t | tjj �| _t| |jd��| j_q�t|tj��s4t �t | tj j �| _| j j � }
| j|
| jjk� |
| j_ |j �r~t!| |j �|
_"t#| |j$�|
_%q�W ||_&q6W |S )Nr �ascii)'r Zsk_POLICYINFO_new_nullr r r r Zsk_POLICYINFO_freeZPOLICYINFO_newZsk_POLICYINFO_push�_txt2objZpolicy_identifierr7 ZpolicyidZpolicy_qualifiersZsk_POLICYQUALINFO_new_nullZPOLICYQUALINFO_newZsk_POLICYQUALINFO_push�
isinstance�sixZ text_typer ZOID_CPS_QUALIFIERZpqualidr r" �dZcpsuriZ
UserNotice�AssertionErrorZOID_CPS_USER_NOTICEZUSERNOTICE_newZ
usernoticeZ
explicit_textr$ Zexptext�_encode_notice_referenceZnotice_referenceZ noticerefZ
qualifiers) r Zcertificate_policiesZcpZ policy_infoZpir r6 ZpqisZ qualifierZpqiZunr r r � _encode_certificate_policies� sJ
rO c C s� |d kr| j jS | jj� }| j|| j jk� t| |j�|_| jj� }||_x4|j D ]*}t
| |�}| jj ||�}| j|dk� qRW |S d S )Nr ) r r r Z
NOTICEREF_newr r$ Z organizationZsk_ASN1_INTEGER_new_nullZ noticenosZnotice_numbersr Zsk_ASN1_INTEGER_push)r ZnoticeZnrZ notice_stackZnumberZnumr r r r rN � s
rN c C s. |j d�}| jj|d�}| j|| jjk� |S )z_
Converts a Python string with an ASN.1 object ID in dotted form to a
ASN1_OBJECT.
rH r )r" r � OBJ_txt2objr r r )r r) r8 r r r rI s
rI c C s t | |�}| jj|| jj�}|S )N)rI r r r ZASN1_OBJECT_free)r r) r8 r r r r5
s
r5 c C s
| j j� S )N)r Z
ASN1_NULL_new)r r9 r r r �_encode_ocsp_nocheck s rQ c C sb | j j}| j j� }| jj|| j j�}||d|j�}| j|dk� ||d|j�}| j|dk� ||d|j �}| j|dk� ||d|j
�}| j|dk� ||d|j �}| j|dk� ||d|j �}| j|dk� ||d|j
�}| j|dk� |j �r*||d|j�}| j|dk� ||d |j�}| j|dk� n4||dd�}| j|dk� ||d d�}| j|dk� |S )
Nr r � � � � � � � )r �ASN1_BIT_STRING_set_bit�ASN1_BIT_STRING_newr r ZASN1_BIT_STRING_freeZdigital_signaturer Zcontent_commitmentZkey_enciphermentZdata_enciphermentZ
key_agreementZ
key_cert_signZcrl_signZ
encipher_onlyZ
decipher_only)r Z key_usageZset_bitZkur r r r �_encode_key_usage s6
r[ c C sz | j j� }| j|| jjk� | jj|| j j�}|jd k rFt| |j�|_ |j
d k r^t | |j
�|_ |j
d k rvt| |j
�|_|S )N)r ZAUTHORITY_KEYID_newr r r r ZAUTHORITY_KEYID_freeZkey_identifierr ZkeyidZauthority_cert_issuer�_encode_general_namesZissuerZ authority_cert_serial_numberr �serial)r Zauthority_keyidZakidr r r � _encode_authority_key_identifier8 s
r^ c C sN | j j� }| jj|| j j�}|jr&dnd|_|jrJ|jd k rJt| |j�|_|S )Nr; r ) r ZBASIC_CONSTRAINTS_newr r ZBASIC_CONSTRAINTS_freeZcaZ path_lengthr Zpathlen)r Zbasic_constraintsZ constraintsr r r �_encode_basic_constraintsO s
r_ c s� � j j� }� j|� jjk� � jj|� fdd��}xV|D ]N}� j j� }t� |jj �}t
� |j |j � ||_
� j j||�}� j|dk� q8W |S )Nc s � j j| � jj� j jd��S )NZACCESS_DESCRIPTION_free)r Z sk_ACCESS_DESCRIPTION_pop_freer Z addressofZ
_original_lib)r )r r r �b s z,_encode_information_access..r )r Z sk_ACCESS_DESCRIPTION_new_nullr r r r ZACCESS_DESCRIPTION_newrI Z
access_methodr7 �!_encode_general_name_preallocatedZaccess_location�location�methodZsk_ACCESS_DESCRIPTION_push)r Z info_accessZaiaZaccess_descriptionZadrc r r )r r �_encode_information_access] s
rd c C sT | j j� }| j|| jjk� x2|D ]*}t| |�}| j j||�}| j|dk� q"W |S )Nr )r ZGENERAL_NAMES_newr r r �_encode_general_nameZsk_GENERAL_NAME_push)r �names�
general_namesr) �gnr r r r r\ x s
r\ c C s t | |�}| jj|| jj�}|S )N)r\ r r r ZGENERAL_NAMES_free)r Zsanrg r r r �_encode_alt_name� s
ri c C s t | |j�S )N)r% Zdigest)r Zskir r r � _encode_subject_key_identifier� s rj c C s | j j� }t| ||� |S )N)r ZGENERAL_NAME_newra )r r) rh r r r re � s
re c C sR t |tj�r~| j|| jjk� | jj|_| jj � }| j|| jjk� |j
j d�}| jj ||t
|��}| j|dk� ||j_�n�t |tj�r�| j|| jjk� | jj|_| jj|j
jj d�d�}| j|| jjk� ||j_�nrt |tj��r | j|| jjk� t| |j
�}| jj|_||j_�n0t |tj��r�| j|| jjk� t |j
tj��rn|j
j j t j d
|j
j d� }n |j
j d� }n|j
j }t"| |�} | jj#|_| |j_$�n�t |tj%��r�| j|| jjk� | jj&� }
| j|
| jjk� | jj|j'jj d�d�} | j| | jjk� | jj(d|j
�} | jj(d �}
| |
d
< | jj)| jj|
t
|j
��}|| jjk�r�| j*� t+d ��| |
_'||
_
| jj,|_|
|j_-n�t |tj.��r�| j|| jjk� |j
j d�} t"| | �}| jj/|_||j_0nXt |tj1��r@| j|| jjk� |j
j d�} t"| | �}| jj2|_||j_3nt+d j4|���d S )Nr r rH � rT � � zunsigned char[]zunsigned char **r zInvalid ASN.1 dataz!{} is an unknown GeneralName typel )5rJ r ZDNSNamer r r r ZGEN_DNS�typeZASN1_IA5STRING_newr4 r" r! r rL ZdNSNameZ RegisteredIDZGEN_RIDrP r7 Z registeredIDZ
DirectoryNamer- Z GEN_DIRNAMEZ
directoryNameZ IPAddress� ipaddressZ IPv4NetworkZnetwork_address�packedr Z int_to_bytesZ
num_addressesZ IPv6Networkr Z GEN_IPADDZ iPAddressZ OtherNameZ
OTHERNAME_new�type_id�newZ
d2i_ASN1_TYPEZ_consume_errors�
ValueErrorZ
GEN_OTHERNAMEZ otherNameZ
RFC822NameZ GEN_EMAILZ
rfc822NameZUniformResourceIdentifierZGEN_URIZuniformResourceIdentifier�format)r r) rh Zia5r4 r r8 Zdir_namerp ZipaddrZ
other_namerq r Z data_ptr_ptrZasn1_strr r r ra � s�
ra c C sV | j j� }| jj|| j j�}x4|D ],}t| |j�}| j j||�}| j|dk� q"W |S )Nr ) r Zsk_ASN1_OBJECT_new_nullr r Zsk_ASN1_OBJECT_freerI r7 Zsk_ASN1_OBJECT_pushr )r Zextended_key_usageZekur6 r8 r r r r �_encode_extended_key_usage� s
ru r rR rS rT rU rV rW rX c C sP | j j� }| j|| jjk� x.|D ]&}| j j|t| d�}| j|dk� q"W |S )Nr )r rZ r r r rY �_CRLREASONFLAGS)r �reasonsZbitmaskrC r r r r r< s
r< c C s4 | j j� }| j|| jjk� t|_t| |�|j_ |S )N)
r �DIST_POINT_NAME_newr r r r rn r\ r) �fullname)r r= �dpnr r r r> s
r> c C s4 | j j� }| j|| jjk� t|_t| |�|j_ |S )N)
r rx r r r r rn r1 r) Z relativename)r r@ rz r r r rA s
rA c C s� | j j� }| jj|| j j�}x�|D ]�}| j j� }| j|| jjk� |jrVt | |j�|_|j
rjt | |j
�|_ |j
r~t| |j
�|_ |jr�t| |j�|_| j j||�}| j|dk� q"W |S )Nr )r Zsk_DIST_POINT_new_nullr r Zsk_DIST_POINT_freeZDIST_POINT_newr r rw r< r= r> r? r@ rA Z
crl_issuerr\ Z CRLissuerZsk_DIST_POINT_push)r ZcdpsZcdpZpointZdpr r r r �_encode_cdps_freshest_crl s
r{ c C sV | j j� }| j|| jjk� | jj|| j j�}t| |j�}||_ t| |j
�}||_ |S )N) r ZNAME_CONSTRAINTS_newr r r r ZNAME_CONSTRAINTS_free�_encode_general_subtreeZpermitted_subtreesZpermittedSubtreesZexcluded_subtreesZexcludedSubtrees)r Zname_constraintsZncZ permittedZexcludedr r r �_encode_name_constraints5 s
r} c C sb | j j� }| j|| jjk� | jj|| j j�}|jd k rFt| |j�|_ |j
d k r^t| |j
�|_ |S )N) r ZPOLICY_CONSTRAINTS_newr r r r ZPOLICY_CONSTRAINTS_freeZrequire_explicit_policyr ZrequireExplicitPolicyZinhibit_policy_mappingZinhibitPolicyMapping)r Zpolicy_constraintsZpcr r r �_encode_policy_constraintsE s
r~ c C s` |d kr| j jS | jj� }x<|D ]4}| jj� }t| |�|_| jj||�}|dks t�q W |S d S )Nr ) r r r Zsk_GENERAL_SUBTREE_new_nullZGENERAL_SUBTREE_newre �baseZsk_GENERAL_SUBTREE_pushrM )r ZsubtreesZgeneral_subtreesr) Zgsr r r r r| V s
r| c C s t | |j�S )N)r% �nonce)r r� r r r �
_encode_nonced s r� )_Z
__future__r r r rE ro rK Z cryptographyr r Z0cryptography.hazmat.backends.openssl.decode_asn1r r r Zcryptography.x509.namer
Zcryptography.x509.oidr r r
r r r r$ r% r& r- r/ r1 r( r: rB rD rG rO rN rI r5 rQ r[ r^ r_ rd r\ ri rj re ra ru Z ReasonFlagsZkey_compromiseZ
ca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZ
aa_compromiserv r< r> rA r{ r} r~ r| r� ZBASIC_CONSTRAINTSZSUBJECT_KEY_IDENTIFIERZ KEY_USAGEZSUBJECT_ALTERNATIVE_NAMEZISSUER_ALTERNATIVE_NAMEZEXTENDED_KEY_USAGEZAUTHORITY_KEY_IDENTIFIERZCERTIFICATE_POLICIESZ AUTHORITY_INFORMATION_ACCESSZSUBJECT_INFORMATION_ACCESSZCRL_DISTRIBUTION_POINTSZ FRESHEST_CRLZINHIBIT_ANY_POLICYZ
OCSP_NO_CHECKZNAME_CONSTRAINTSZPOLICY_CONSTRAINTSZ_EXTENSION_ENCODE_HANDLERSZ
CRL_NUMBERZDELTA_CRL_INDICATORZISSUING_DISTRIBUTION_POINTZ _CRL_EXTENSION_ENCODE_HANDLERSZCERTIFICATE_ISSUERZ
CRL_REASONZINVALIDITY_DATEZ$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERSZNONCEZ'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERSZ)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERSr r r r � s�
1 T