o h\@sddlmZmZmZddlZddlZddlZddlmZddl Z ddl m Z ddl m Z mZmZddlmZmZddlmZedd d Zd d Zd d ZGdddeZddZddZddZddZddZddZGdddeZ e !ej"Gddde#Z$e !ej"Gd d!d!e#Z%e !ej"Gd"d#d#e#Z&e !ej"Gd$d%d%e#Z'Gd&d'd'e#Z(Gd(d)d)e#Z)Gd*d+d+e#Z*Gd,d-d-e#Z+d.d/Z,dS)0)absolute_importdivisionprint_functionN)Enum)utils)dsaecrsa) Extension ExtensionType)NameicCs"|D] }|j|jkrtdqdS)Nz$This extension has already been set.)oid ValueError) extension extensionserH/var/www/html/env/lib/python3.10/site-packages/cryptography/x509/base.py_reject_duplicate_extensions  rcCs6|jdur|}|r |nt}|jdd|S|S)zNormalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. N)tzinfo)r utcoffsetdatetime timedeltareplace)timeoffsetrrr_convert_to_naive_utc_times rc@seZdZdZdZdS)VersionrN)__name__ __module__ __qualname__v1v3rrrrr,srcC ||SN)load_pem_x509_certificatedatabackendrrrr'1 r'cCr%r&)load_der_x509_certificater(rrrr,5r+r,cCr%r&)load_pem_x509_csrr(rrrr-9r+r-cCr%r&)load_der_x509_csrr(rrrr.=r+r.cCr%r&)load_pem_x509_crlr(rrrr/Ar+r/cCr%r&)load_der_x509_crlr(rrrr0Er+r0cseZdZfddZZS)InvalidVersioncstt||||_dSr&)superr1__init__parsed_version)selfmsgr4 __class__rrr3Js zInvalidVersion.__init__)r r!r"r3 __classcell__rrr7rr1Isr1c@seZdZejddZejddZejddZejddZ ejd d Z ejd d Z ejd dZ ejddZ ejddZejddZejddZejddZejddZejddZejddZejdd Zejd!d"Zd#S)$ CertificatecCdSz4 Returns bytes using digest passed. Nrr5 algorithmrrr fingerprintQzCertificate.fingerprintcCr;)z3 Returns certificate serial number Nrr5rrr serial_numberWr@zCertificate.serial_numbercCr;)z1 Returns the certificate version NrrArrrversion]r@zCertificate.versioncCr;z( Returns the public key NrrArrr public_keycr@zCertificate.public_keycCr;)z? Not before time (represented as UTC datetime) NrrArrrnot_valid_beforeir@zCertificate.not_valid_beforecCr;)z> Not after time (represented as UTC datetime) NrrArrrnot_valid_afteror@zCertificate.not_valid_aftercCr;)z1 Returns the issuer name object. NrrArrrissuerur@zCertificate.issuercCr;z2 Returns the subject name object. NrrArrrsubject{r@zCertificate.subjectcCr;zt Returns a HashAlgorithm corresponding to the type of the digest signed in the certificate. NrrArrrsignature_hash_algorithmr@z$Certificate.signature_hash_algorithmcCr;zJ Returns the ObjectIdentifier of the signature algorithm. NrrArrrsignature_algorithm_oidr@z#Certificate.signature_algorithm_oidcCr;)z/ Returns an Extensions object. NrrArrrrr@zCertificate.extensionscCr;z. Returns the signature bytes. NrrArrr signaturer@zCertificate.signaturecCr;)zR Returns the tbsCertificate payload bytes as defined in RFC 5280. NrrArrrtbs_certificate_bytesr@z!Certificate.tbs_certificate_bytescCr;z" Checks equality. Nrr5otherrrr__eq__r@zCertificate.__eq__cCr;z# Checks not equal. NrrSrrr__ne__r@zCertificate.__ne__cCr;z" Computes a hash. NrrArrr__hash__r@zCertificate.__hash__cCr;)zB Serializes the certificate to PEM or DER format. Nrr5encodingrrr public_bytesr@zCertificate.public_bytesN)r r!r"abcabstractmethodr?abstractpropertyrBrCrErFrGrHrJrLrNrrPrQrUrWrYr\rrrrr:OsF                r:c@seZdZejddZejddZejddZejddZ ejd d Z ejd d Z ejd dZ ejddZ ejddZejddZejddZejddZejddZejddZejddZejdd Zejd!d"Zd#S)$CertificateRevocationListcCr;)z: Serializes the CRL to PEM or DER format. NrrZrrrr\r@z&CertificateRevocationList.public_bytescCr;r<rr=rrrr?r@z%CertificateRevocationList.fingerprintcCr;)zs Returns an instance of RevokedCertificate or None if the serial_number is not in the CRL. Nr)r5rBrrr(get_revoked_certificate_by_serial_numberr@zBCertificateRevocationList.get_revoked_certificate_by_serial_numbercCr;rKrrArrrrLr@z2CertificateRevocationList.signature_hash_algorithmcCr;rMrrArrrrNr@z1CertificateRevocationList.signature_algorithm_oidcCr;)zC Returns the X509Name with the issuer of this CRL. NrrArrrrHr@z CertificateRevocationList.issuercCr;)z? Returns the date of next update for this CRL. NrrArrr next_updater@z%CertificateRevocationList.next_updatecCr;)z? Returns the date of last update for this CRL. NrrArrr last_updater@z%CertificateRevocationList.last_updatecCr;)zS Returns an Extensions object containing a list of CRL extensions. NrrArrrrr@z$CertificateRevocationList.extensionscCr;rOrrArrrrPr@z#CertificateRevocationList.signaturecCr;)zO Returns the tbsCertList payload bytes as defined in RFC 5280. NrrArrrtbs_certlist_bytesr@z,CertificateRevocationList.tbs_certlist_bytescCr;rRrrSrrrrUr@z CertificateRevocationList.__eq__cCr;rVrrSrrrrWr@z CertificateRevocationList.__ne__cCr;)z< Number of revoked certificates in the CRL. NrrArrr__len__ r@z!CertificateRevocationList.__len__cCr;)zS Returns a revoked certificate (or slice of revoked certificates). Nr)r5idxrrr __getitem__r@z%CertificateRevocationList.__getitem__cCr;)z8 Iterator over the revoked certificates NrrArrr__iter__r@z"CertificateRevocationList.__iter__cCr;)zQ Verifies signature of revocation list against given public key. Nr)r5rErrris_signature_validr@z,CertificateRevocationList.is_signature_validN)r r!r"r]r^r\r?rar_rLrNrHrbrcrrPrdrUrWrergrhrirrrrr`sF                r`c@seZdZejddZejddZejddZejddZej d d Z ej d d Z ej d dZ ej ddZ ejddZej ddZej ddZej ddZdS)CertificateSigningRequestcCr;rRrrSrrrrU&r@z CertificateSigningRequest.__eq__cCr;rVrrSrrrrW,r@z CertificateSigningRequest.__ne__cCr;rXrrArrrrY2r@z"CertificateSigningRequest.__hash__cCr;rDrrArrrrE8r@z$CertificateSigningRequest.public_keycCr;rIrrArrrrJ>r@z!CertificateSigningRequest.subjectcCr;rKrrArrrrLDr@z2CertificateSigningRequest.signature_hash_algorithmcCr;rMrrArrrrNKr@z1CertificateSigningRequest.signature_algorithm_oidcCr;)z@ Returns the extensions in the signing request. NrrArrrrQr@z$CertificateSigningRequest.extensionscCr;)z; Encodes the request to PEM or DER format. NrrZrrrr\Wr@z&CertificateSigningRequest.public_bytescCr;rOrrArrrrP]r@z#CertificateSigningRequest.signaturecCr;)zd Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC 2986. NrrArrrtbs_certrequest_bytescr@z/CertificateSigningRequest.tbs_certrequest_bytescCr;)z8 Verifies signature of signing request. NrrArrrrijr@z,CertificateSigningRequest.is_signature_validN)r r!r"r]r^rUrWrYrEr_rJrLrNrr\rPrkrirrrrrj$s2           rjc@s6eZdZejddZejddZejddZdS)RevokedCertificatecCr;)zG Returns the serial number of the revoked certificate. NrrArrrrBsr@z RevokedCertificate.serial_numbercCr;)zH Returns the date of when this certificate was revoked. NrrArrrrevocation_dateyr@z"RevokedCertificate.revocation_datecCr;)zW Returns an Extensions object containing a list of Revoked extensions. NrrArrrrr@zRevokedCertificate.extensionsN)r r!r"r]r_rBrmrrrrrrlqs  rlc@s2eZdZdgfddZddZddZdd ZdS) CertificateSigningRequestBuilderNcCs||_||_dS)zB Creates an empty X.509 certificate request (v1). N) _subject_name _extensions)r5 subject_namerrrrr3s z)CertificateSigningRequestBuilder.__init__cCs0t|ts td|jdurtdt||jS)zF Sets the certificate requestor's distinguished name. Expecting x509.Name object.N&The subject name may only be set once.) isinstancer TypeErrorrorrnrpr5namerrrrqs   z-CertificateSigningRequestBuilder.subject_namecCs@t|ts tdt|j||}t||jt|j|j|gS)zE Adds an X.509 extension to the certificate request. "extension must be an ExtensionType) rtr rur rrrprnror5rcriticalrrr add_extensions  z.CertificateSigningRequestBuilder.add_extensioncCs |jdur td||||S)zF Signs the request using the requestor's private key. Nz/A CertificateSigningRequest must have a subject)rorcreate_x509_csrr5 private_keyr>r*rrrsigns z%CertificateSigningRequestBuilder.sign)r r!r"r3rqr{rrrrrrns  rnc@sdeZdZddddddgfddZddZddZdd Zd d Zd d ZddZ ddZ ddZ dS)CertificateBuilderNcCs6tj|_||_||_||_||_||_||_||_ dSr&) rr$_version _issuer_namero _public_key_serial_number_not_valid_before_not_valid_afterrp)r5 issuer_namerqrErBrFrGrrrrr3s zCertificateBuilder.__init__cCsDt|ts td|jdurtdt||j|j|j|j |j |j S)z3 Sets the CA's distinguished name. rrN%The issuer name may only be set once.) rtr rurrrrorrrrrprvrrrr   zCertificateBuilder.issuer_namecCsDt|ts td|jdurtdt|j||j|j|j |j |j S)z: Sets the requestor's distinguished name. rrNrs) rtr rurorrrrrrrrprvrrrrqrzCertificateBuilder.subject_namecCsPt|tjtjtjfstd|jdurt dt |j |j ||j |j|j|jS)zT Sets the requestor's public key (as found in the signing request). zGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.Nz$The public key may only be set once.)rtr DSAPublicKeyr RSAPublicKeyrEllipticCurvePublicKeyrurrrrrorrrrp)r5keyrrrrEs   zCertificateBuilder.public_keycCsjt|tjs td|jdurtd|dkrtd|dkr%tdt|j|j |j ||j |j |j S)z5 Sets the certificate serial number. 'Serial number must be of integral type.N'The serial number may only be set once.rz%The serial number should be positive.3The serial number should not be more than 159 bits.)rtsix integer_typesrurr bit_lengthrrrorrrrpr5numberrrrrBs    z CertificateBuilder.serial_numbercCszt|tjs td|jdurtdt|}|tkrtd|jdur-||jkr-tdt|j |j |j |j ||j|j S)z7 Sets the certificate activation time. Expecting datetime object.Nz*The not valid before may only be set once.zHThe not valid before date must be after the unix epoch (1970 January 1).zBThe not valid before date must be before the not valid after date.)rtrrurrr _UNIX_EPOCHrrrrorrrpr5rrrrrFs   z#CertificateBuilder.not_valid_beforecCszt|tjs td|jdurtdt|}|tkrtd|jdur-||jkr-tdt|j |j |j |j |j||j S)z7 Sets the certificate expiration time. rNz)The not valid after may only be set once.zGThe not valid after date must be after the unix epoch (1970 January 1).zAThe not valid after date must be after the not valid before date.)rtrrurrrrrrrrorrrprrrrrGs"     z"CertificateBuilder.not_valid_afterc CsTt|ts tdt|j||}t||jt|j|j |j |j |j |j |j|gS)z= Adds an X.509 extension to the certificate. rx)rtr rur rrrprrrorrrrryrrrr{-s   z CertificateBuilder.add_extensioncCsz|jdur td|jdurtd|jdurtd|jdur$td|jdur-td|jdur6td||||S)zC Signs the certificate using the CA's private key. Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key)rorrrrrrcreate_x509_certificater}rrrr=s      zCertificateBuilder.sign) r r!r"r3rrqrErBrFrGr{rrrrrrs   rc@sPeZdZdddggfddZddZddZdd Zd d Zd d ZddZ dS) CertificateRevocationListBuilderNcCs"||_||_||_||_||_dSr&)r _last_update _next_updaterp_revoked_certificates)r5rrcrbrrevoked_certificatesrrrr3Ws  z)CertificateRevocationListBuilder.__init__cCs<t|ts td|jdurtdt||j|j|j|j S)Nrrr) rtr rurrrrrrpr)r5rrrrr_s   z,CertificateRevocationListBuilder.issuer_namecCsrt|tjs td|jdurtdt|}|tkrtd|jdur-||jkr-tdt|j ||j|j |j S)Nr!Last update may only be set once.CThe last update date must be after the unix epoch (1970 January 1).z9The last update date must be before the next update date.) rtrrurrrrrrrrpr)r5rcrrrrci   z,CertificateRevocationListBuilder.last_updatecCsrt|tjs td|jdurtdt|}|tkrtd|jdur-||jkr-tdt|j |j||j |j S)Nrrrz8The next update date must be after the last update date.) rtrrurrrrrrrrpr)r5rbrrrrb{rz,CertificateRevocationListBuilder.next_updatecCsLt|ts tdt|j||}t||jt|j|j |j |j|g|j S)zM Adds an X.509 extension to the certificate revocation list. rx) rtr rur rrrprrrrrryrrrr{s   z.CertificateRevocationListBuilder.add_extensioncCs2t|ts tdt|j|j|j|j|j|gS)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rtrlrurrrrrpr)r5revoked_certificaterrradd_revoked_certificates  z8CertificateRevocationListBuilder.add_revoked_certificatecCsD|jdur td|jdurtd|jdurtd||||S)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)rrrrcreate_x509_crlr}rrrrs   z%CertificateRevocationListBuilder.sign) r r!r"r3rrcrbr{rrrrrrrVs   rc@s<eZdZddgfddZddZddZdd Zd d ZdS) RevokedCertificateBuilderNcCs||_||_||_dSr&)r_revocation_daterp)r5rBrmrrrrr3s z"RevokedCertificateBuilder.__init__cCsZt|tjs td|jdurtd|dkrtd|dkr%tdt||j|j S)Nrrrz$The serial number should be positiverr) rtrrrurrrrrrprrrrrBs    z'RevokedCertificateBuilder.serial_numbercCsNt|tjs td|jdurtdt|}|tkrtdt|j||j S)Nrz)The revocation date may only be set once.zBThe revocation date must be after the unix epoch (1970 January 1).) rtrrurrrrrrrprrrrrms   z)RevokedCertificateBuilder.revocation_datecCsDt|ts tdt|j||}t||jt|j|j |j|gS)Nrx) rtr rur rrrprrrryrrrr{s   z'RevokedCertificateBuilder.add_extensioncCs.|jdur td|jdurtd||S)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)rrrcreate_x509_revoked_certificate)r5r*rrrbuilds   zRevokedCertificateBuilder.build)r r!r"r3rBrmr{rrrrrrs  rcCsttddd?S)Nbigr )rint_from_bytesosurandomrrrrrandom_serial_numbersr)- __future__rrrr]rrenumrr cryptographyr)cryptography.hazmat.primitives.asymmetricrrr cryptography.x509.extensionsr r cryptography.x509.namer rrrrr'r,r-r.r/r0 Exceptionr1 add_metaclassABCMetaobjectr:r`rjrlrnrrrrrrrrsF     i j L)(_ ;