3
ꅭh�T � @ s. d dl mZmZmZ d dlZd dlZd dlmZmZ d dl m
Z
d dl m Z m
Z
mZmZmZ d dlmZmZ d dlmZmZ d dlmZmZmZ d d lm Z ej ej �G d
d � d e ��Z ej ej!�G d d
� d
e ��Z"ej ej#�G dd� de ��Z$ej ej%�G dd� de ��Z&ej ej'j(�G dd� de ��Z)dS )� )�absolute_import�division�print_functionN)�utils�x509)�UnsupportedAlgorithm)�_asn1_integer_to_int�_asn1_string_to_bytes�_decode_x509_name�_obj2txt�_parse_asn1_time)�_encode_asn1_int_gc� _txt2obj_gc)�hashes�
serialization)�dsa�ec�rsa)� _ASN1Typec @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Z e
j d�Z e
dd� �Ze
dd� �Zdd� Ze
dd� �Ze
dd� �Ze
dd� �Ze
d d � �Ze
d d � �Ze
d d!� �Ze
jd"d#� �Ze
d$d%� �Ze
d&d'� �Zd(d)� Zd*S )+� _Certificatec C sZ || _ || _| j jj| j�}|dkr0tjj| _n&|dkrDtjj| _ntj dj
|�|��d S )Nr � z {} is not a valid X509 version) �_backend�_x509�_libZX509_get_versionr �Version�v1�_versionZv3ZInvalidVersion�format)�self�backendZ x509_cert�version� r! � /usr/lib64/python3.6/x509.py�__init__ s z_Certificate.__init__c C s dj | j�S )Nz )r �subject)r r! r! r" �__repr__, s z_Certificate.__repr__c C s, t |tj�stS | jjj| j|j�}|dkS )Nr )�
isinstancer � Certificate�NotImplementedr r ZX509_cmpr )r �other�resr! r! r" �__eq__/ s z_Certificate.__eq__c C s
| |k S )Nr! )r r) r! r! r" �__ne__6 s z_Certificate.__ne__c C s t | jtjj��S )N)�hash� public_bytesr �Encoding�DER)r r! r! r" �__hash__9 s z_Certificate.__hash__c C s | S )Nr! )r �memor! r! r" � __deepcopy__< s z_Certificate.__deepcopy__c C s* t j|| j�}|j| jtjj�� |j� S )N) r �Hashr �updater. r r/ r0 �finalize)r � algorithm�hr! r! r" � fingerprint? s z_Certificate.fingerprintr c C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_get_serialNumberr �openssl_assert�_ffi�NULLr )r �asn1_intr! r! r" �
serial_numberF s z_Certificate.serial_numberc C s | j S )N)r> )r r! r! r" �serialL s z_Certificate.serialc C sR | j jj| j�}|| j jjkr0| j j� td��| j jj|| j jj �}| j j
|�S )Nz,Certificate public key is of an unknown type) r r ZX509_get_pubkeyr r; r< �_consume_errors�
ValueError�gc�
EVP_PKEY_free�_evp_pkey_to_public_key)r �pkeyr! r! r" �
public_keyP s
z_Certificate.public_keyc C s | j jj| j�}t| j |�S )N)r r ZX509_getm_notBeforer r )r � asn1_timer! r! r" �not_valid_before[ s z _Certificate.not_valid_beforec C s | j jj| j�}t| j |�S )N)r r ZX509_getm_notAfterr r )r rG r! r! r" �not_valid_after` s z _Certificate.not_valid_afterc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_get_issuer_namer r: r; r< r
)r �issuerr! r! r" rJ e s z_Certificate.issuerc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_get_subject_namer r: r; r< r
)r r$ r! r! r" r$ k s z_Certificate.subjectc C s8 | j }y
tj| S tk
r2 tdj|���Y nX d S )Nz)Signature algorithm OID:{} not recognized)�signature_algorithm_oidr �_SIG_OIDS_TO_HASH�KeyErrorr r )r �oidr! r! r" �signature_hash_algorithmq s
z%_Certificate.signature_hash_algorithmc C s^ | j jjd�}| j jj| j jj|| j� | j j|d | j jjk� t| j |d j �}t
j |�S )Nz
X509_ALGOR **r ) r r; �newr �X509_get0_signaturer< r r: r r7 r �ObjectIdentifier)r �algrN r! r! r" rK { s z$_Certificate.signature_algorithm_oidc C s | j jj| j�S )N)r Z _certificate_extension_parser�parser )r r! r! r" �
extensions� s z_Certificate.extensionsc C sR | j jjd�}| j jj|| j jj| j� | j j|d | j jjk� t| j |d �S )NzASN1_BIT_STRING **r ) r r; rP r rQ r< r r: r )r �sigr! r! r" � signature� s
z_Certificate.signaturec sd � j jjd�}� j jj� j|�}� j j|dk� � j jj|� fdd��}� j jj|d |�d d � S )Nzunsigned char **r c s � j jj| d �S )Nr )r r � OPENSSL_free)�pointer)r r! r" �� s z4_Certificate.tbs_certificate_bytes..) r r; rP r Zi2d_re_X509_tbsr r: rB �buffer)r �ppr* r! )r r" �tbs_certificate_bytes� s z"_Certificate.tbs_certificate_bytesc C sn | j j� }|tjjkr*| j jj|| j�}n(|tjjkrJ| j jj || j�}nt
d��| j j |dk� | j j |�S )Nz/encoding must be an item from the Encoding enum� )
r �_create_mem_bio_gcr r/ �PEMr ZPEM_write_bio_X509r r0 Z i2d_X509_bio� TypeErrorr: �
_read_mem_bio)r �encoding�bior* r! r! r" r. � s
z_Certificate.public_bytesN) �__name__�
__module__� __qualname__r# r% r+ r, r1 r3 r9 r Zread_only_propertyr �propertyr> r? rF rH rI rJ r$ rO rK �cached_propertyrU rW r] r. r! r! r! r" r s*
r c @ s: e Zd Zdd� Zedd� �Zedd� �Zejdd� �Z d S )
�_RevokedCertificatec C s || _ || _|| _d S )N)r Z_crl�
_x509_revoked)r r ZcrlZ x509_revokedr! r! r" r# � s z _RevokedCertificate.__init__c C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r Z X509_REVOKED_get0_serialNumberrk r: r; r< r )r r= r! r! r" r> � s z!_RevokedCertificate.serial_numberc C s t | j| jjj| j��S )N)r r r Z X509_REVOKED_get0_revocationDaterk )r r! r! r" �revocation_date� s z#_RevokedCertificate.revocation_datec C s | j jj| j�S )N)r Z _revoked_cert_extension_parserrT rk )r r! r! r" rU � s z _RevokedCertificate.extensionsN)
re rf rg r# rh r> rl r ri rU r! r! r! r" rj � s rj c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zejd d
� �Z d d � Z
e d
d� �Z e dd� �Z
e dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zejd%d&� �Zd'd(� Zd)S )*�_CertificateRevocationListc C s || _ || _d S )N)r � _x509_crl)r r Zx509_crlr! r! r" r# � s z#_CertificateRevocationList.__init__c C s, t |tj�stS | jjj| j|j�}|dkS )Nr )r& r �CertificateRevocationListr( r r Z X509_CRL_cmprn )r r) r* r! r! r" r+ � s z!_CertificateRevocationList.__eq__c C s
| |k S )Nr! )r r) r! r! r" r, � s z!_CertificateRevocationList.__ne__c C sX t j|| j�}| jj� }| jjj|| j�}| jj|dk� | jj|�}|j |� |j
� S )Nr^ ) r r4 r r_ r �i2d_X509_CRL_biorn r: rb r5 r6 )r r7 r8 rd r* Zderr! r! r" r9 � s
z&_CertificateRevocationList.fingerprintc C s@ | j jj| j�}| j j|| j jjk� | j jj|| j jj�}|S )N) r r Z X509_CRL_duprn r: r; r< rB Z
X509_CRL_free)r �dupr! r! r" � _sorted_crl� s z&_CertificateRevocationList._sorted_crlc C sl | j jjd�}t| j |�}| j jj| j||�}|dkr:d S | j j|d | j jjk� t | j | j|d �S d S )NzX509_REVOKED **r )
r r; rP r
r ZX509_CRL_get0_by_serialrr r: r< rj )r r> �revokedr= r* r! r! r" �(get_revoked_certificate_by_serial_number� s zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberc C s8 | j }y
tj| S tk
r2 tdj|���Y nX d S )Nz)Signature algorithm OID:{} not recognized)rK r rL rM r r )r rN r! r! r" rO s
z3_CertificateRevocationList.signature_hash_algorithmc C s^ | j jjd�}| j jj| j| j jj|� | j j|d | j jjk� t| j |d j �}t
j |�S )Nz
X509_ALGOR **r ) r r; rP r �X509_CRL_get0_signaturern r< r: r r7 r rR )r rS rN r! r! r" rK
s z2_CertificateRevocationList.signature_algorithm_oidc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_CRL_get_issuerrn r: r; r< r
)r rJ r! r! r" rJ s z!_CertificateRevocationList.issuerc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_CRL_get_nextUpdatern r: r; r< r )r Znur! r! r" � next_update s z&_CertificateRevocationList.next_updatec C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_CRL_get_lastUpdatern r: r; r< r )r Zlur! r! r" � last_update s z&_CertificateRevocationList.last_updatec C sR | j jjd�}| j jj| j|| j jj� | j j|d | j jjk� t| j |d �S )NzASN1_BIT_STRING **r ) r r; rP r ru rn r< r: r )r rV r! r! r" rW & s
z$_CertificateRevocationList.signaturec sd � j jjd�}� j jj� j|�}� j j|dk� � j jj|� fdd��}� j jj|d |�d d � S )Nzunsigned char **r c s � j jj| d �S )Nr )r r rX )rY )r r! r" rZ 5 s z?_CertificateRevocationList.tbs_certlist_bytes..) r r; rP r Zi2d_re_X509_CRL_tbsrn r: rB r[ )r r\ r* r! )r r" �tbs_certlist_bytes/ s z-_CertificateRevocationList.tbs_certlist_bytesc C sn | j j� }|tjjkr*| j jj|| j�}n(|tjjkrJ| j jj || j�}nt
d��| j j |dk� | j j |�S )Nz/encoding must be an item from the Encoding enumr^ )
r r_ r r/ r` r ZPEM_write_bio_X509_CRLrn r0 rp ra r: rb )r rc rd r* r! r! r" r. 9 s
z'_CertificateRevocationList.public_bytesc C sD | j jj| j�}| j jj||�}| j j|| j jjk� t| j | |�S )N) r r �X509_CRL_get_REVOKEDrn Zsk_X509_REVOKED_valuer: r; r< rj )r �idxrs �rr! r! r" �
_revoked_certG s z(_CertificateRevocationList._revoked_certc c s& x t t| ��D ]}| j|�V qW d S )N)�range�lenr| )r �ir! r! r" �__iter__M s z#_CertificateRevocationList.__iter__c s� t |t�r8|jt� ��\}}}� fdd�t|||�D �S tj|�}|dk rV|t� �7 }d| kolt� �k n svt�� j|�S d S )Nc s g | ]}� j |��qS r! )r| )�.0r )r r! r" �
T s z:_CertificateRevocationList.__getitem__..r ) r& �slice�indicesr~ r} �operator�index�
IndexErrorr| )r rz �start�stop�stepr! )r r" � __getitem__Q s
z&_CertificateRevocationList.__getitem__c C s4 | j jj| j�}|| j jjkr"dS | j jj|�S d S )Nr )r r ry rn r; r< Zsk_X509_REVOKED_num)r rs r! r! r" �__len__] s z"_CertificateRevocationList.__len__c C s | j jj| j�S )N)r Z_crl_extension_parserrT rn )r r! r! r" rU d s z%_CertificateRevocationList.extensionsc C sL t |tjtjtjf�s td��| jj j
| j |j �}|dkrH| jj
� dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.r^ FT)r& r Z DSAPublicKeyr Z RSAPublicKeyr ZEllipticCurvePublicKeyra r r ZX509_CRL_verifyrn Z _evp_pkeyr@ )r rF r* r! r! r" �is_signature_validh s
z-_CertificateRevocationList.is_signature_validN)re rf rg r# r+ r, r9 r ri rr rt rh rO rK rJ rv rw rW rx r. r| r� r� r� rU r� r! r! r! r" rm � s(
rm c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d
� Zed d � �Z ed
d� �Z
edd� �Z e j
dd� �Zdd� Zedd� �Zedd� �Zedd� �Zdd � Zd S ) �_CertificateSigningRequestc C s || _ || _d S )N)r � _x509_req)r r Zx509_reqr! r! r" r# ~ s z#_CertificateSigningRequest.__init__c C s2 t |t�stS | jtjj�}|jtjj�}||kS )N)r& r� r( r. r r/ r0 )r r) Z
self_bytesZ other_bytesr! r! r" r+ � s
z!_CertificateSigningRequest.__eq__c C s
| |k S )Nr! )r r) r! r! r" r, � s z!_CertificateSigningRequest.__ne__c C s t | jtjj��S )N)r- r. r r/ r0 )r r! r! r" r1 � s z#_CertificateSigningRequest.__hash__c C sH | j jj| j�}| j j|| j jjk� | j jj|| j jj�}| j j |�S )N)
r r �X509_REQ_get_pubkeyr� r: r; r< rB rC rD )r rE r! r! r" rF � s z%_CertificateSigningRequest.public_keyc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_REQ_get_subject_namer� r: r; r< r
)r r$ r! r! r" r$ � s z"_CertificateSigningRequest.subjectc C s8 | j }y
tj| S tk
r2 tdj|���Y nX d S )Nz)Signature algorithm OID:{} not recognized)rK r rL rM r r )r rN r! r! r" rO � s
z3_CertificateSigningRequest.signature_hash_algorithmc C s^ | j jjd�}| j jj| j| j jj|� | j j|d | j jjk� t| j |d j �}t
j |�S )Nz
X509_ALGOR **r ) r r; rP r �X509_REQ_get0_signaturer� r< r: r r7 r rR )r rS rN r! r! r" rK � s z2_CertificateSigningRequest.signature_algorithm_oidc s6 � j jj� j�}� j jj|� fdd��}� j jj|�S )Nc s" � j jj| � j jj� j jjd��S )NZX509_EXTENSION_free)r r Zsk_X509_EXTENSION_pop_freer; Z addressofZ
_original_lib)�x)r r! r" rZ � s z7_CertificateSigningRequest.extensions..)r r ZX509_REQ_get_extensionsr� r; rB Z_csr_extension_parserrT )r Z x509_extsr! )r r" rU � s
z%_CertificateSigningRequest.extensionsc C sn | j j� }|tjjkr*| j jj|| j�}n(|tjjkrJ| j jj || j�}nt
d��| j j |dk� | j j |�S )Nz/encoding must be an item from the Encoding enumr^ )
r r_ r r/ r` r ZPEM_write_bio_X509_REQr� r0 Zi2d_X509_REQ_biora r: rb )r rc rd r* r! r! r" r. � s
z'_CertificateSigningRequest.public_bytesc sd � j jjd�}� j jj� j|�}� j j|dk� � j jj|� fdd��}� j jj|d |�d d � S )Nzunsigned char **r c s � j jj| d �S )Nr )r r rX )rY )r r! r" rZ � s zB_CertificateSigningRequest.tbs_certrequest_bytes..) r r; rP r Zi2d_re_X509_REQ_tbsr� r: rB r[ )r r\ r* r! )r r" �tbs_certrequest_bytes� s z0_CertificateSigningRequest.tbs_certrequest_bytesc C sR | j jjd�}| j jj| j|| j jj� | j j|d | j jjk� t| j |d �S )NzASN1_BIT_STRING **r ) r r; rP r r� r� r< r: r )r rV r! r! r" rW � s
z$_CertificateSigningRequest.signaturec C sh | j jj| j�}| j j|| j jjk� | j jj|| j jj�}| j jj | j|�}|dkrd| j j
� dS dS )Nr^ FT) r r r� r� r: r; r< rB rC ZX509_REQ_verifyr@ )r rE r* r! r! r" r� � s
z-_CertificateSigningRequest.is_signature_validc C s t | j|j�}| jjj| j|d�}|dkr s.
% -