3 de @s ddlZddlZddlZddlZddlmZddlmZddl m Z m Z ddl m Z mZmZmZmZmZmZddlmZmZmZddlmZmZmZmZddlmZmZdd l m!Z!ejd d d Z"ej#e j$e j%e j&e j'e j(e j)e j*e j+fZ,Gd d d e-Z.eeej/eeddddZ0e!ej/ej1e!e2ej3e4fddddZ5ejejdddZ6GdddZ7GdddZ8Gdddej9Z:Gddde-Z;Gdd d ejej=Gd"d#d#ejej?Gd$d%d%e?Z@Gd&d'd'ejejAGd(d)d)ejejBdEe2ejCe=d*d+d,ZDe2ej/e=d-d.d/ZEdFe2ejCe=d*d0d1ZFdGe2ejCeBd*d2d3ZGdHe2ejCeBd*d4d5ZHdIe2ejCeAd*d6d7ZIdJe2ejCeAd*d8d9ZJGd:d;d;ZKGdd?d?ZMGd@dAdAZNe4dBdCdDZOdS)KN)utils)x509)hashes serialization)dsaeced448ed25519rsax448x25519) CertificateIssuerPrivateKeyTypesCertificateIssuerPublicKeyTypesCertificatePublicKeyTypes) Extension Extensions ExtensionType_make_sequence_methods)Name _ASN1Type)ObjectIdentifierics&eZdZeeddfdd ZZS)AttributeNotFoundN)msgoidreturncstj|||_dS)N)super__init__r)selfrr) __class__M/var/www/agendate/envp3/lib/python3.6/site-packages/cryptography/x509/base.pyr6s zAttributeNotFound.__init__)__name__ __module__ __qualname__strrr __classcell__r r )rr!r5sr) extension extensionsrcCs&x |D]}|j|jkrtdqWdS)Nz$This extension has already been set.)r ValueError)r'r(er r r!_reject_duplicate_extension;s  r+)r attributesrcCs(x"|D]\}}}||krtdqWdS)Nz$This attribute has already been set.)r))rr,Zattr_oid_r r r!_reject_duplicate_attributeEsr.)timercCs:|jdk r2|j}|r|ntj}|jdd|S|SdS)zNormalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. N)tzinfo)r0 utcoffsetdatetime timedeltareplace)r/offsetr r r!_convert_to_naive_utc_timeQs  r6c@sxeZdZejjfeeeddddZ e edddZ e eddd Ze dd d Z eed d dZedddZdS) AttributeN)rvalue_typercCs||_||_||_dS)N)_oid_valuer9)rrr8r9r r r!r`szAttribute.__init__)rcCs|jS)N)r:)rr r r!rjsz Attribute.oidcCs|jS)N)r;)rr r r!r8nszAttribute.valuecCsd|jd|jdS)Nz)rr8)rr r r!__repr__rszAttribute.__repr__)otherrcCs2t|tstS|j|jko0|j|jko0|j|jkS)N) isinstancer7NotImplementedrr8r9)rr=r r r!__eq__us    zAttribute.__eq__cCst|j|j|jfS)N)hashrr8r9)rr r r!__hash__szAttribute.__hash__)r"r#r$rZ UTF8Stringr8rbytesintrpropertyrr%r<objectboolr@rBr r r r!r7_s r7c@sNeZdZejeddddZed\ZZ Z e dddZ e ed d d ZdS) AttributesN)r,rcCst||_dS)N)list _attributes)rr,r r r!rszAttributes.__init__rJ)rcCsd|jdS)Nz )rJ)rr r r!r<szAttributes.__repr__)rrcCs2x|D]}|j|kr|SqWtd|d|dS)NzNo z attribute was found)rr)rrattrr r r!get_attribute_for_oids  z Attributes.get_attribute_for_oid)r"r#r$typingIterabler7rr__len____iter__ __getitem__r%r<rrLr r r r!rHs rHc@seZdZdZdZdS)VersionrN)r"r#r$v1v3r r r r!rRsrRcs&eZdZeeddfdd ZZS)InvalidVersionN)rparsed_versionrcstj|||_dS)N)rrrW)rrrW)rr r!rs zInvalidVersion.__init__)r"r#r$r%rDrr&r r )rr!rVsrVc@seZdZejejedddZe eje dddZ e eje dddZ ejedd d Ze ejejdd d Ze ejejdd dZe ejedddZe ejedddZe ejejejdddZe ejedddZe ejedddZe ejedddZe ejedddZe ejedddZeje e!dd d!Z"eje dd"d#Z#eje$j%ed$d%d&Z&ejdd'd(d)d*Z'd'S)+ Certificate) algorithmrcCsdS)z4 Returns bytes using digest passed. Nr )rrYr r r! fingerprintszCertificate.fingerprint)rcCsdS)z3 Returns certificate serial number Nr )rr r r! serial_numberszCertificate.serial_numbercCsdS)z1 Returns the certificate version Nr )rr r r!versionszCertificate.versioncCsdS)z( Returns the public key Nr )rr r r! public_keyszCertificate.public_keycCsdS)z? Not before time (represented as UTC datetime) Nr )rr r r!not_valid_beforeszCertificate.not_valid_beforecCsdS)z> Not after time (represented as UTC datetime) Nr )rr r r!not_valid_afterszCertificate.not_valid_aftercCsdS)z1 Returns the issuer name object. Nr )rr r r!issuerszCertificate.issuercCsdS)z2 Returns the subject name object. Nr )rr r r!subjectszCertificate.subjectcCsdS)zt Returns a HashAlgorithm corresponding to the type of the digest signed in the certificate. Nr )rr r r!signature_hash_algorithmsz$Certificate.signature_hash_algorithmcCsdS)zJ Returns the ObjectIdentifier of the signature algorithm. Nr )rr r r!signature_algorithm_oidsz#Certificate.signature_algorithm_oidcCsdS)z/ Returns an Extensions object. Nr )rr r r!r(szCertificate.extensionscCsdS)z. Returns the signature bytes. Nr )rr r r! signatureszCertificate.signaturecCsdS)zR Returns the tbsCertificate payload bytes as defined in RFC 5280. Nr )rr r r!tbs_certificate_bytessz!Certificate.tbs_certificate_bytescCsdS)zh Returns the tbsCertificate payload bytes with the SCT list extension stripped. Nr )rr r r!tbs_precertificate_bytessz$Certificate.tbs_precertificate_bytes)r=rcCsdS)z" Checks equality. Nr )rr=r r r!r@szCertificate.__eq__cCsdS)z" Computes a hash. Nr )rr r r!rB szCertificate.__hash__)encodingrcCsdS)zB Serializes the certificate to PEM or DER format. Nr )rrgr r r! public_bytesszCertificate.public_bytesN)r`rcCsdS)z This method verifies that certificate issuer name matches the issuer subject name and that the certificate is signed by the issuer's private key. No other validation is performed. Nr )rr`r r r!verify_directly_issued_bysz%Certificate.verify_directly_issued_by)(r"r#r$abcabstractmethodr HashAlgorithmrCrZrErDr[rRr\rr]r2r^r_rr`rarMOptionalrbrrcrr(rdrerfrFrGr@rBrEncodingrhrir r r r!rXs`rX) metaclassc@sVeZdZeejedddZeejejdddZ eeje dddZ dS) RevokedCertificate)rcCsdS)zG Returns the serial number of the revoked certificate. Nr )rr r r!r['sz RevokedCertificate.serial_numbercCsdS)zH Returns the date of when this certificate was revoked. Nr )rr r r!revocation_date.sz"RevokedCertificate.revocation_datecCsdS)zW Returns an Extensions object containing a list of Revoked extensions. Nr )rr r r!r(5szRevokedCertificate.extensionsN) r"r#r$rErjrkrDr[r2rqrr(r r r r!rp&srpc@sXeZdZeejedddZeedddZeejdddZ eedd d Z d S) _RawRevokedCertificate)r[rqr(cCs||_||_||_dS)N)_serial_number_revocation_date _extensions)rr[rqr(r r r!rBsz_RawRevokedCertificate.__init__)rcCs|jS)N)rs)rr r r!r[Lsz$_RawRevokedCertificate.serial_numbercCs|jS)N)rt)rr r r!rqPsz&_RawRevokedCertificate.revocation_datecCs|jS)N)ru)rr r r!r(Tsz!_RawRevokedCertificate.extensionsN) r"r#r$rDr2rrrEr[rqr(r r r r!rrAsrrc@seZdZejejedddZeje j edddZ eje e jeddd Zeeje je j d d d Zeejed d dZeejed ddZeeje jejd ddZeejejd ddZeejed ddZeejed ddZeejed ddZejeedddZ eje d ddZ!e j"e ed d!d"Z#e j"e$e j%ed d#d"Z#eje j&e e$fe j&ee j%efd d$d"Z#eje j'ed d%d&Z(eje)ed'd(d)Z*d*S)+CertificateRevocationList)rgrcCsdS)z: Serializes the CRL to PEM or DER format. Nr )rrgr r r!rhZsz&CertificateRevocationList.public_bytes)rYrcCsdS)z4 Returns bytes using digest passed. Nr )rrYr r r!rZ`sz%CertificateRevocationList.fingerprint)r[rcCsdS)zs Returns an instance of RevokedCertificate or None if the serial_number is not in the CRL. Nr )rr[r r r!(get_revoked_certificate_by_serial_numberfszBCertificateRevocationList.get_revoked_certificate_by_serial_number)rcCsdS)zt Returns a HashAlgorithm corresponding to the type of the digest signed in the certificate. Nr )rr r r!rbosz2CertificateRevocationList.signature_hash_algorithmcCsdS)zJ Returns the ObjectIdentifier of the signature algorithm. Nr )rr r r!rcysz1CertificateRevocationList.signature_algorithm_oidcCsdS)zC Returns the X509Name with the issuer of this CRL. Nr )rr r r!r`sz CertificateRevocationList.issuercCsdS)z? Returns the date of next update for this CRL. Nr )rr r r! next_updatesz%CertificateRevocationList.next_updatecCsdS)z? Returns the date of last update for this CRL. Nr )rr r r! last_updatesz%CertificateRevocationList.last_updatecCsdS)zS Returns an Extensions object containing a list of CRL extensions. Nr )rr r r!r(sz$CertificateRevocationList.extensionscCsdS)z. Returns the signature bytes. Nr )rr r r!rdsz#CertificateRevocationList.signaturecCsdS)zO Returns the tbsCertList payload bytes as defined in RFC 5280. Nr )rr r r!tbs_certlist_bytessz,CertificateRevocationList.tbs_certlist_bytes)r=rcCsdS)z" Checks equality. Nr )rr=r r r!r@sz CertificateRevocationList.__eq__cCsdS)z< Number of revoked certificates in the CRL. Nr )rr r r!rOsz!CertificateRevocationList.__len__)idxrcCsdS)Nr )rr{r r r!rQsz%CertificateRevocationList.__getitem__cCsdS)Nr )rr{r r r!rQscCsdS)zS Returns a revoked certificate (or slice of revoked certificates). Nr )rr{r r r!rQscCsdS)z8 Iterator over the revoked certificates Nr )rr r r!rPsz"CertificateRevocationList.__iter__)r]rcCsdS)zQ Verifies signature of revocation list against given public key. Nr )rr]r r r!is_signature_validsz,CertificateRevocationList.is_signature_validN)+r"r#r$rjrkrrnrCrhrrlrZrDrMrmrprwrErbrrcrr`r2rxryrr(rdrzrFrGr@rOoverloadrQsliceListUnionIteratorrPrr|r r r r!rvYs^  rvc@s@eZdZejeedddZejedddZ eje dddZ e eje dd d Ze ejejejdd d Ze ejedd dZe ejedddZe ejedddZejejedddZe ejedddZe ejedddZe ejedddZ ejeedddZ!dS) CertificateSigningRequest)r=rcCsdS)z" Checks equality. Nr )rr=r r r!r@sz CertificateSigningRequest.__eq__)rcCsdS)z" Computes a hash. Nr )rr r r!rBsz"CertificateSigningRequest.__hash__cCsdS)z( Returns the public key Nr )rr r r!r]sz$CertificateSigningRequest.public_keycCsdS)z2 Returns the subject name object. Nr )rr r r!rasz!CertificateSigningRequest.subjectcCsdS)zt Returns a HashAlgorithm corresponding to the type of the digest signed in the certificate. Nr )rr r r!rbsz2CertificateSigningRequest.signature_hash_algorithmcCsdS)zJ Returns the ObjectIdentifier of the signature algorithm. Nr )rr r r!rcsz1CertificateSigningRequest.signature_algorithm_oidcCsdS)z@ Returns the extensions in the signing request. Nr )rr r r!r(sz$CertificateSigningRequest.extensionscCsdS)z/ Returns an Attributes object. Nr )rr r r!r, sz$CertificateSigningRequest.attributes)rgrcCsdS)z; Encodes the request to PEM or DER format. Nr )rrgr r r!rhsz&CertificateSigningRequest.public_bytescCsdS)z. Returns the signature bytes. Nr )rr r r!rdsz#CertificateSigningRequest.signaturecCsdS)zd Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC 2986. Nr )rr r r!tbs_certrequest_bytessz/CertificateSigningRequest.tbs_certrequest_bytescCsdS)z8 Verifies signature of signing request. Nr )rr r r!r|&sz,CertificateSigningRequest.is_signature_valid)rrcCsdS)z: Get the attribute value for a given OID. Nr )rrr r r!rL-sz/CertificateSigningRequest.get_attribute_for_oidN)"r"r#r$rjrkrFrGr@rDrBrr]rErrarMrmrrlrbrrcrr(rHr,rrnrCrhrdrr|rLr r r r!rsDr)databackendrcCs tj|S)N) rust_x509load_pem_x509_certificate)rrr r r!r9sr)rrcCs tj|S)N)rload_pem_x509_certificates)rr r r!r?srcCs tj|S)N)rload_der_x509_certificate)rrr r r!rDsrcCs tj|S)N)rload_pem_x509_csr)rrr r r!rKsrcCs tj|S)N)rload_der_x509_csr)rrr r r!rRsrcCs tj|S)N)rload_pem_x509_crl)rrr r r!rYsrcCs tj|S)N)rload_der_x509_crl)rrr r r!r`src @seZdZdggfejeejeeejej e e eje fdddZ eddddZeeddd d Zdd e e ejedd d dZdeejeejedddZdS) CertificateSigningRequestBuilderN) subject_namer(r,cCs||_||_||_dS)zB Creates an empty X.509 certificate request (v1). N) _subject_namerurJ)rrr(r,r r r!rgs z)CertificateSigningRequestBuilder.__init__)namercCs4t|tstd|jdk r$tdt||j|jS)zF Sets the certificate requestor's distinguished name. zExpecting x509.Name object.Nz&The subject name may only be set once.)r>r TypeErrorrr)rrurJ)rrr r r!rvs   z-CertificateSigningRequestBuilder.subject_name)extvalcriticalrcCsDt|tstdt|j||}t||jt|j|j|g|j S)zE Adds an X.509 extension to the certificate request. z"extension must be an ExtensionType) r>rrrrr+rurrrJ)rrrr'r r r! add_extensions   z.CertificateSigningRequestBuilder.add_extension)_tag)rr8rrcCs~t|tstdt|ts$td|dk r@t|t r@tdt||j|dk r\|j}nd}t|j |j |j|||fgS)zK Adds an X.509 attribute with an OID and associated value. zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type) r>rrrCrr.rJr8rrru)rrr8rtagr r r! add_attributes   z.CertificateSigningRequestBuilder.add_attribute) private_keyrYrrcCs |jdkrtdtj|||S)zF Signs the request using the requestor's private key. Nz/A CertificateSigningRequest must have a subject)rr)rZcreate_x509_csr)rrrYrr r r!signs z%CertificateSigningRequestBuilder.sign)N)r"r#r$rMrmrrrrTuplerrCrDrrrGrrrr _AllowedHashTypesAnyrrr r r r!rfs>  rc @seZdZUejeeddddddgfeje eje eje eje eje j eje j ejeeddddZ e ddddZe dddd Ze dd d d Ze dd ddZe j ddddZe j ddddZeeddddZdeejeejedddZdS)CertificateBuilderN) issuer_namerr]r[r^r_r(rcCs6tj|_||_||_||_||_||_||_||_ dS)N) rRrU_version _issuer_namer _public_keyrs_not_valid_before_not_valid_afterru)rrrr]r[r^r_r(r r r!rs zCertificateBuilder.__init__)rrcCsDt|tstd|jdk r$tdt||j|j|j|j |j |j S)z3 Sets the CA's distinguished name. zExpecting x509.Name object.Nz%The issuer name may only be set once.) r>rrrr)rrrrsrrru)rrr r r!rs  zCertificateBuilder.issuer_namecCsDt|tstd|jdk r$tdt|j||j|j|j |j |j S)z: Sets the requestor's distinguished name. zExpecting x509.Name object.Nz&The subject name may only be set once.) r>rrrr)rrrrsrrru)rrr r r!rs  zCertificateBuilder.subject_name)keyrc Cs`t|tjtjtjtjt j t j t jfs.td|jdk r@tdt|j|j||j|j|j|jS)zT Sets the requestor's public key (as found in the signing request). zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)r>rZ DSAPublicKeyr Z RSAPublicKeyrZEllipticCurvePublicKeyr ZEd25519PublicKeyrZEd448PublicKeyr ZX25519PublicKeyr Z X448PublicKeyrrr)rrrrsrrru)rrr r r!r]s*  zCertificateBuilder.public_key)numberrcCsht|tstd|jdk r$td|dkr4td|jdkrHtdt|j|j|j ||j |j |j S)z5 Sets the certificate serial number. z'Serial number must be of integral type.Nz'The serial number may only be set once.rz%The serial number should be positive.z3The serial number should not be more than 159 bits.) r>rDrrsr) bit_lengthrrrrrrru)rrr r r!r[!s"   z CertificateBuilder.serial_number)r/rcCszt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j |j |j ||j|j S)z7 Sets the certificate activation time. zExpecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)r>r2rrr)r6_EARLIEST_UTC_TIMErrrrrrsru)rr/r r r!r^<s&  z#CertificateBuilder.not_valid_beforecCszt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j |j |j |j||j S)z7 Sets the certificate expiration time. zExpecting datetime object.Nz)The not valid after may only be set once.zr2rrr)r6rrrrrrrsru)rr/r r r!r_[s(    z"CertificateBuilder.not_valid_after)rrrc CsTt|tstdt|j||}t||jt|j|j |j |j |j |j |j|gS)z= Adds an X.509 extension to the certificate. z"extension must be an ExtensionType)r>rrrrr+rurrrrrsrr)rrrr'r r r!r{s  z CertificateBuilder.add_extension)rrYrrcCsz|jdkrtd|jdkr$td|jdkr6td|jdkrHtd|jdkrZtd|jdkrltdtj|||S)zC Signs the certificate using the CA's private key. Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key) rr)rrsrrrrZcreate_x509_certificate)rrrYrr r r!rs      zCertificateBuilder.sign)N)r"r#r$rMrrrrurmrrrDr2rrrr]r[r^r_rGrr rrrXrr r r r!rs* D "!rc@seZdZUejeeeje dddggfej e ej e j ej e j ejeeejedddZ e ddddZe j ddd d Ze j dd d d ZeeddddZeddddZdeej eejedddZdS) CertificateRevocationListBuilderN)rryrxr(revoked_certificatescCs"||_||_||_||_||_dS)N)r _last_update _next_updateru_revoked_certificates)rrryrxr(rr r r!rs z)CertificateRevocationListBuilder.__init__)rrcCs<t|tstd|jdk r$tdt||j|j|j|j S)NzExpecting x509.Name object.z%The issuer name may only be set once.) r>rrrr)rrrrur)rrr r r!rs  z,CertificateRevocationListBuilder.issuer_name)ryrcCsrt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j ||j|j |j S)NzExpecting datetime object.z!Last update may only be set once.z8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) r>r2rrr)r6rrrrrur)rryr r r!rys"  z,CertificateRevocationListBuilder.last_update)rxrcCsrt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j||j |j S)NzExpecting datetime object.z!Last update may only be set once.z8The last update date must be on or after 1950 January 1.z8The next update date must be after the last update date.) r>r2rrr)r6rrrrrur)rrxr r r!rxs"  z,CertificateRevocationListBuilder.next_update)rrrcCsLt|tstdt|j||}t||jt|j|j |j |j|g|j S)zM Adds an X.509 extension to the certificate revocation list. z"extension must be an ExtensionType) r>rrrrr+rurrrrr)rrrr'r r r!rs   z.CertificateRevocationListBuilder.add_extension)revoked_certificatercCs2t|tstdt|j|j|j|j|j|gS)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) r>rprrrrrrur)rrr r r!add_revoked_certificates z8CertificateRevocationListBuilder.add_revoked_certificate)rrYrrcCsD|jdkrtd|jdkr$td|jdkr6tdtj|||S)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)rr)rrrZcreate_x509_crl)rrrYrr r r!r$s   z%CertificateRevocationListBuilder.sign)N)r"r#r$rMrrrrurprrmrr2rrryrxrGrrr rrrvrr r r r!rs&  @ rc@seZdZddgfejeejejejee dddZ eddddZ ejddd d Z e e dd d d ZdejedddZdS)RevokedCertificateBuilderN)r[rqr(cCs||_||_||_dS)N)rsrtru)rr[rqr(r r r!r7sz"RevokedCertificateBuilder.__init__)rrcCsXt|tstd|jdk r$td|dkr4td|jdkrHtdt||j|jS)Nz'Serial number must be of integral type.z'The serial number may only be set once.rz$The serial number should be positiverz3The serial number should not be more than 159 bits.) r>rDrrsr)rrrtru)rrr r r!r[As   z'RevokedCertificateBuilder.serial_number)r/rcCsNt|tjstd|jdk r&tdt|}|tkr>tdt|j||j S)NzExpecting datetime object.z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) r>r2rrtr)r6rrrsru)rr/r r r!rqSs  z)RevokedCertificateBuilder.revocation_date)rrrcCsDt|tstdt|j||}t||jt|j|j |j|gS)Nz"extension must be an ExtensionType) r>rrrrr+rurrsrt)rrrr'r r r!rcs  z'RevokedCertificateBuilder.add_extension)rrcCs:|jdkrtd|jdkr$tdt|j|jt|jS)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)rsr)rtrrrru)rrr r r!buildqs  zRevokedCertificateBuilder.build)N)r"r#r$rMrmrDr2rrrrr[rqrGrrrprr r r r!r6s. r)rcCstjtjddd?S)Nbigr)rD from_bytesosurandomr r r r!random_serial_numbersr)N)N)N)N)N)N)Prjr2rrMZ cryptographyrZ"cryptography.hazmat.bindings._rustrrZcryptography.hazmat.primitivesrrZ)cryptography.hazmat.primitives.asymmetricrrrr r r r Z/cryptography.hazmat.primitives.asymmetric.typesr rrZcryptography.x509.extensionsrrrrZcryptography.x509.namerrZcryptography.x509.oidrrrSHA224SHA256SHA384SHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512r Exceptionrrr+rrCrmrDr.r6r7rHEnumrRrVABCMetarXregisterrprrrvrrrrrrrrrrrrrrr r r r!s  $    $  | ] \nI