3
l_\ @ s d dl mZmZmZ d dlZd dlZd dlZd dlmZm Z d dl
m Z m Z m
Z
d dlmZ d dlmZmZmZ dd Zd d
Zd d Zd
d Zdd Zdd Zdd Zdd Zdd Z dd Z dd Z d d Z d d Z d!d" Z!d#d$ Z"d%d& Z#d'd( Z$d)d* Z%d+d, Z&d-d. Z'd/d0 Z(d1d2 Z)d3d4 Z*d5d6 Z+d7d8 Z,d9d: Z-d;d< Z.d=d> Z/d?d@ Z0e j1j2dAe j1j3dBe j1j4dCe j1j5dDe j1j6dEe j1j7dFe j1j8dGe j1j9dHiZ:dIdJ Z;dKdL ZdQdR Z?dSdT Z@dUdV ZAdWdX ZBejCe)ejDe-ejEe'ejFe,ejGe,ejHe0ejIe(ejJe"ejKe*ejLe*ejMe>ejNe>ejOeejPe&ejQe?ejRe@iZSejGe,ejIe(ejKe*ejTe ejUe ejVe ejNe>iZWejXe,ejYe ejZe!iZ[ej\eBiZ]ej\eBiZ^dS )Y )absolute_importdivisionprint_functionN)utilsx509) _CRL_ENTRY_REASON_ENUM_TO_CODE_DISTPOINT_TYPE_FULLNAME _DISTPOINT_TYPE_RELATIVENAME) _ASN1Type)CRLEntryExtensionOID ExtensionOIDOCSPExtensionOIDc C sD | j |}| jj|| jj}| jj|| jj}| j|| jjk |S )a
Converts a python integer to an ASN1_INTEGER. The returned ASN1_INTEGER
will not be garbage collected (to support adding them to structs that take
ownership of the object). Be sure to register it for GC if it will be
discarded after use.
)Z
_int_to_bn_ffigc_libZBN_freeZBN_to_ASN1_INTEGERNULLopenssl_assert)backendxi r #/usr/lib64/python3.6/encode_asn1.py_encode_asn1_int s
r c C s t | |}| jj|| jj}|S )N)r r r r ZASN1_INTEGER_free)r r r r r r _encode_asn1_int_gc. s
r c C s0 | j j }| j j||t|}| j|dk |S )z@
Create an ASN1_OCTET_STRING from a Python byte string.
)r ZASN1_OCTET_STRING_newZASN1_OCTET_STRING_setlenr )r datasresr r r _encode_asn1_str4 s
r c C s< | j j }| j j||jdt|jd}| j|dk |S )z
Create an ASN1_UTF8STRING from a Python unicode string.
This object will be an ASN1_STRING with UTF8 type in OpenSSL and
can be decoded with ASN1_STRING_to_UTF8.
utf8r )r ZASN1_UTF8STRING_newASN1_STRING_setencoder r )r stringr r r r r _encode_asn1_utf8_str> s
r$ c C s t | |}| jj|| jj}|S )N)r r r r ZASN1_OCTET_STRING_free)r r r r r r _encode_asn1_str_gcL s
r% c C s t | |jS )N)r Z
skip_certs)r Zinhibit_any_policyr r r _encode_inhibit_any_policyR s r& c C sp | j j }x`|jD ]V}d}xL|D ]D}t| |}| jj|| j j}| j j||d|}| j|dk d}q W qW |S )zP
The X509_NAME created will not be gc'd. Use _encode_name_gc if needed.
r r r' ) r Z
X509_NAME_newZrdns_encode_name_entryr r ZX509_NAME_ENTRY_freeZX509_NAME_add_entryr )r namesubjectZrdnZset_flag attribute
name_entryr r r r _encode_nameV s
r- c C s t | |}| jj|| jj}|S )N)r- r r r ZX509_NAME_free)r
attributesr* r r r _encode_name_gck s
r/ c C sB | j j }x2|D ]*}t| |}| j j||}| j|dk qW |S )z:
The sk_X509_NAME_ENTRY created will not be gc'd.
r )r Zsk_X509_NAME_ENTRY_new_nullr( Zsk_X509_NAME_ENTRY_pushr )r r. stackr+ r, r r r r _encode_sk_name_entryq s
r1 c C sr |j tjkr|jjd}n&|j tjkr4|jjd}n |jjd}t| |jj}| j j
| j j ||j j|t
|}|S )N utf_16_be utf_32_ber )Z_typer
Z BMPStringvaluer" ZUniversalString _txt2obj_gcoid
dotted_stringr Z X509_NAME_ENTRY_create_by_OBJr r r )r r+ r4 objr, r r r r( } s r( c C s t | |jS )N)r Z
crl_number)r extr r r &_encode_crl_number_delta_crl_indicator s r: c C s | j j }| j|| jjk | jj|| j j}|jr8dnd|_|j rHdnd|_
|j rXdnd|_ |j
rhdnd|_|jrt| |j|_|jrt| |j|_|jrt| |j|_|S )N r )r ZISSUING_DIST_POINT_newr r r r ZISSUING_DIST_POINT_freeZonly_contains_user_certsZonlyuserZonly_contains_ca_certsZonlyCAZ indirect_crlZ indirectCRLZ only_contains_attribute_certsZonlyattrZonly_some_reasons_encode_reasonflagsZonlysomereasons full_name_encode_full_name distpoint
relative_name_encode_relative_name)r r9 Zidpr r r _encode_issuing_dist_point s
rB c C sT | j j }| j|| jjk | jj|| j j}| j j|t|j }| j|dk |S )Nr )
r ZASN1_ENUMERATED_newr r r r ZASN1_ENUMERATED_freeZASN1_ENUMERATED_setr reason)r Z
crl_reasonZasn1enumr r r r _encode_crl_reason s
rD c C sF | j j| jjtj|jj }| j|| jjk | jj || j j
}|S )N) r ZASN1_GENERALIZEDTIME_setr r calendarZtimegminvalidity_dateZ timetupler r ZASN1_GENERALIZEDTIME_free)r rF Ztimer r r _encode_invalidity_date s rG c C s | j j }| j|| jjk | jj|| j j}xV|D ]L}| j j }| j|| jjk | j j||}| j|dk t | |j
j }||_ |j
r6| j j }| j|| jjk x|j
D ]}| j j } | j| | jjk | j j|| }| j|dk t|tjr"t | tjj | _t| |jd| j_qt | tjj | _| j j }
| j|
| jjk |
| j_ |j rlt | |j |
_ t!| |j"|
_#qW ||_$q6W |S )Nr ascii)%r Zsk_POLICYINFO_new_nullr r r r Zsk_POLICYINFO_freeZPOLICYINFO_newZsk_POLICYINFO_push_txt2objZpolicy_identifierr7 ZpolicyidZpolicy_qualifiersZsk_POLICYQUALINFO_new_nullZPOLICYQUALINFO_newZsk_POLICYQUALINFO_push
isinstancesixZ text_typer ZOID_CPS_QUALIFIERZpqualidr r" dZcpsuriZOID_CPS_USER_NOTICEZUSERNOTICE_newZ
usernoticeZ
explicit_textr$ Zexptext_encode_notice_referenceZnotice_referenceZ noticerefZ
qualifiers) r Zcertificate_policiesZcpZ policy_infoZpir r6 ZpqisZ qualifierZpqiZunr r r _encode_certificate_policies sH
rN c C s |d kr| j jS | jj }| j|| j jk t| |j|_| jj }||_x4|j D ]*}t
| |}| jj ||}| j|dk qRW |S d S )Nr ) r r r Z
NOTICEREF_newr r$ Z organizationZsk_ASN1_INTEGER_new_nullZ noticenosZnotice_numbersr Zsk_ASN1_INTEGER_push)r ZnoticeZnrZ notice_stackZnumberZnumr r r r rM s
rM c C s. |j d}| jj|d}| j|| jjk |S )z_
Converts a Python string with an ASN.1 object ID in dotted form to a
ASN1_OBJECT.
rH r )r" r OBJ_txt2objr r r )r r) r8 r r r rI s
rI c C s t | |}| jj|| jj}|S )N)rI r r r ZASN1_OBJECT_free)r r) r8 r r r r5
s
r5 c C s
| j j S )N)r Z
ASN1_NULL_new)r r9 r r r _encode_ocsp_nocheck s rP c C sb | j j}| j j }| jj|| j j}||d|j}| j|dk ||d|j}| j|dk ||d|j }| j|dk ||d|j
}| j|dk ||d|j }| j|dk ||d|j }| j|dk ||d|j
}| j|dk |j r*||d|j}| j|dk ||d |j}| j|dk n4||dd}| j|dk ||d d}| j|dk |S )
Nr r )r ASN1_BIT_STRING_set_bitASN1_BIT_STRING_newr r ZASN1_BIT_STRING_freeZdigital_signaturer Zcontent_commitmentZkey_enciphermentZdata_enciphermentZ
key_agreementZ
key_cert_signZcrl_signZ
encipher_onlyZ
decipher_only)r Z key_usageZset_bitZkur r r r _encode_key_usage s6
rZ c C sz | j j }| j|| jjk | jj|| j j}|jd k rFt| |j|_ |j
d k r^t | |j
|_ |j
d k rvt| |j
|_|S )N)r ZAUTHORITY_KEYID_newr r r r ZAUTHORITY_KEYID_freeZkey_identifierr ZkeyidZauthority_cert_issuer_encode_general_namesZissuerZ authority_cert_serial_numberr serial)r Zauthority_keyidZakidr r r _encode_authority_key_identifier8 s
r] c C sN | j j }| jj|| j j}|jr&dnd|_|jrJ|jd k rJt| |j|_|S )Nr; r ) r ZBASIC_CONSTRAINTS_newr r ZBASIC_CONSTRAINTS_freeZcaZ path_lengthr Zpathlen)r Zbasic_constraintsZ constraintsr r r _encode_basic_constraintsO s
r^ c s j j } j| jjk jj| fdd}xV|D ]N} j j }t |jj }t
|j |j ||_
j j||} j|dk q8W |S )Nc s j j| jj j jdS )NZACCESS_DESCRIPTION_free)r Z sk_ACCESS_DESCRIPTION_pop_freer Z addressofZ
_original_lib)r )r r r b s z,_encode_information_access..r )r Z sk_ACCESS_DESCRIPTION_new_nullr r r r ZACCESS_DESCRIPTION_newrI Z
access_methodr7 !_encode_general_name_preallocatedZaccess_locationlocationmethodZsk_ACCESS_DESCRIPTION_push)r Z info_accessZaiaZaccess_descriptionZadrb r r )r r _encode_information_access] s
rc c C sT | j j }| j|| jjk x2|D ]*}t| |}| j j||}| j|dk q"W |S )Nr )r ZGENERAL_NAMES_newr r r _encode_general_nameZsk_GENERAL_NAME_push)r names
general_namesr) gnr r r r r[ x s
r[ c C s t | |}| jj|| jj}|S )N)r[ r r r ZGENERAL_NAMES_free)r Zsanrf r r r _encode_alt_name s
rh c C s t | |jS )N)r% Zdigest)r Zskir r r _encode_subject_key_identifier s ri c C s | j j }t| || |S )N)r ZGENERAL_NAME_newr` )r r) rg r r r rd s
rd c C sR t |tjr~| j|| jjk | jj|_| jj }| j|| jjk |j
j d}| jj ||t
|}| j|dk ||j_nt |tjr| j|| jjk | jj|_| jj|j
jj dd}| j|| jjk ||j_nrt |tjr | j|| jjk t| |j
}| jj|_||j_n0t |tjr| j|| jjk t |j
tjrn|j
j j t j d
|j
j d }n |j
j d }n|j
j }t"| |} | jj#|_| |j_$nt |tj%r| j|| jjk | jj& }
| j|
| jjk | jj|j'jj dd} | j| | jjk | jj(d|j
} | jj(d }
| |
d
< | jj)| jj|
t
|j
}|| jjkr| j* t+d | |
_'||
_
| jj,|_|
|j_-nt |tj.r| j|| jjk |j
j d} t"| | }| jj/|_||j_0nXt |tj1r@| j|| jjk |j
j d} t"| | }| jj2|_||j_3nt+d j4|d S )Nr r rH rS zunsigned char[]zunsigned char **r zInvalid ASN.1 dataz!{} is an unknown GeneralName typel )5rJ r ZDNSNamer r r r ZGEN_DNStypeZASN1_IA5STRING_newr4 r" r! r rL ZdNSNameZ RegisteredIDZGEN_RIDrO r7 Z registeredIDZ
DirectoryNamer- Z GEN_DIRNAMEZ
directoryNameZ IPAddress ipaddressZ IPv4NetworkZnetwork_addresspackedr Z int_to_bytesZ
num_addressesZ IPv6Networkr Z GEN_IPADDZ iPAddressZ OtherNameZ
OTHERNAME_newtype_idnewZ
d2i_ASN1_TYPEZ_consume_errors
ValueErrorZ
GEN_OTHERNAMEZ otherNameZ
RFC822NameZ GEN_EMAILZ
rfc822NameZUniformResourceIdentifierZGEN_URIZuniformResourceIdentifierformat)r r) rg Zia5r4 r r8 Zdir_namero ZipaddrZ
other_namerp r Z data_ptr_ptrZasn1_strr r r r` s
r` c C sV | j j }| jj|| j j}x4|D ],}t| |j}| j j||}| j|dk q"W |S )Nr ) r Zsk_ASN1_OBJECT_new_nullr r Zsk_ASN1_OBJECT_freerI r7 Zsk_ASN1_OBJECT_pushr )r Zextended_key_usageZekur6 r8 r r r r _encode_extended_key_usage s
rt r rQ rR rS rT rU rV rW c C sP | j j }| j|| jjk x.|D ]&}| j j|t| d}| j|dk q"W |S )Nr )r rY r r r rX _CRLREASONFLAGS)r reasonsZbitmaskrC r r r r r< s
r< c C s4 | j j }| j|| jjk t|_t| ||j_ |S )N)
r DIST_POINT_NAME_newr r r r rm r[ r) fullname)r r= dpnr r r r> s
r> c C s4 | j j }| j|| jjk t|_t| ||j_ |S )N)
r rw r r r r rm r1 r) Z relativename)r r@ ry r r r rA s
rA c C s | j j }| jj|| j j}x|D ]}| j j }| j|| jjk |jrVt | |j|_|j
rjt | |j
|_ |j
r~t| |j
|_ |jrt| |j|_| j j||}| j|dk q"W |S )Nr )r Zsk_DIST_POINT_new_nullr r Zsk_DIST_POINT_freeZDIST_POINT_newr r rv r< r= r> r? r@ rA Z
crl_issuerr[ Z CRLissuerZsk_DIST_POINT_push)r ZcdpsZcdpZpointZdpr r r r _encode_cdps_freshest_crl s
rz c C sV | j j }| j|| jjk | jj|| j j}t| |j}||_ t| |j
}||_ |S )N) r ZNAME_CONSTRAINTS_newr r r r ZNAME_CONSTRAINTS_free_encode_general_subtreeZpermitted_subtreesZpermittedSubtreesZexcluded_subtreesZexcludedSubtrees)r Zname_constraintsZncZ permittedZexcludedr r r _encode_name_constraints5 s
r| c C sb | j j }| j|| jjk | jj|| j j}|jd k rFt| |j|_ |j
d k r^t| |j
|_ |S )N) r ZPOLICY_CONSTRAINTS_newr r r r ZPOLICY_CONSTRAINTS_freeZrequire_explicit_policyr ZrequireExplicitPolicyZinhibit_policy_mappingZinhibitPolicyMapping)r Zpolicy_constraintsZpcr r r _encode_policy_constraintsE s
r} c C sT |d kr| j jS | jj }x0|D ](}| jj }t| ||_| jj||}q W |S d S )N)r r r Zsk_GENERAL_SUBTREE_new_nullZGENERAL_SUBTREE_newrd baseZsk_GENERAL_SUBTREE_push)r ZsubtreesZgeneral_subtreesr) Zgsr r r r r{ V s
r{ c C s t | |jS )N)r% nonce)r r r r r
_encode_nonced s r )_Z
__future__r r r rE rn rK Z cryptographyr r Z0cryptography.hazmat.backends.openssl.decode_asn1r r r Zcryptography.x509.namer
Zcryptography.x509.oidr r r
r r r r$ r% r& r- r/ r1 r( r: rB rD rG rN rM rI r5 rP rZ r] r^ rc r[ rh ri rd r` rt Z ReasonFlagsZkey_compromiseZ
ca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZ
aa_compromiseru r< r> rA rz r| r} r{ r ZBASIC_CONSTRAINTSZSUBJECT_KEY_IDENTIFIERZ KEY_USAGEZSUBJECT_ALTERNATIVE_NAMEZISSUER_ALTERNATIVE_NAMEZEXTENDED_KEY_USAGEZAUTHORITY_KEY_IDENTIFIERZCERTIFICATE_POLICIESZ AUTHORITY_INFORMATION_ACCESSZSUBJECT_INFORMATION_ACCESSZCRL_DISTRIBUTION_POINTSZ FRESHEST_CRLZINHIBIT_ANY_POLICYZ
OCSP_NO_CHECKZNAME_CONSTRAINTSZPOLICY_CONSTRAINTSZ_EXTENSION_ENCODE_HANDLERSZ
CRL_NUMBERZDELTA_CRL_INDICATORZISSUING_DISTRIBUTION_POINTZ _CRL_EXTENSION_ENCODE_HANDLERSZCERTIFICATE_ISSUERZ
CRL_REASONZINVALIDITY_DATEZ$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERSZNONCEZ'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERSZ)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERSr r r r s
1 T