3
ꅭhT @ s. d dl mZmZmZ d dlZd dlZd dlmZmZ d dl m
Z
d dl m Z m
Z
mZmZmZ d dlmZmZ d dlmZmZ d dlmZmZmZ d d lm Z ej ej G d
d d e Z ej ej!G d d
d
e Z"ej ej#G dd de Z$ej ej%G dd de Z&ej ej'j(G dd de Z)dS ) )absolute_importdivisionprint_functionN)utilsx509)UnsupportedAlgorithm)_asn1_integer_to_int_asn1_string_to_bytes_decode_x509_name_obj2txt_parse_asn1_time)_encode_asn1_int_gc _txt2obj_gc)hashes
serialization)dsaecrsa) _ASN1Typec @ s e Zd Zdd Zdd Zdd Zdd Zd d
Zd d Zd
d Z e
j dZ e
dd Ze
dd Zdd Ze
dd Ze
dd Ze
dd Ze
d d Ze
d d Ze
d d! Ze
jd"d# Ze
d$d% Ze
d&d' Zd(d) Zd*S )+ _Certificatec C sZ || _ || _| j jj| j}|dkr0tjj| _n&|dkrDtjj| _ntj dj
||d S )Nr z {} is not a valid X509 version) _backend_x509_libZX509_get_versionr Versionv1_versionZv3ZInvalidVersionformat)selfbackendZ x509_certversion r! /usr/lib64/python3.6/x509.py__init__ s z_Certificate.__init__c C s dj | jS )Nz )r subject)r r! r! r" __repr__, s z_Certificate.__repr__c C s, t |tjstS | jjj| j|j}|dkS )Nr )
isinstancer CertificateNotImplementedr r ZX509_cmpr )r otherresr! r! r" __eq__/ s z_Certificate.__eq__c C s
| |k S )Nr! )r r) r! r! r" __ne__6 s z_Certificate.__ne__c C s t | jtjjS )N)hash public_bytesr EncodingDER)r r! r! r" __hash__9 s z_Certificate.__hash__c C s | S )Nr! )r memor! r! r" __deepcopy__< s z_Certificate.__deepcopy__c C s* t j|| j}|j| jtjj |j S )N) r Hashr updater. r r/ r0 finalize)r algorithmhr! r! r" fingerprint? s z_Certificate.fingerprintr c C s2 | j jj| j}| j j|| j jjk t| j |S )N)r r ZX509_get_serialNumberr openssl_assert_ffiNULLr )r asn1_intr! r! r"
serial_numberF s z_Certificate.serial_numberc C s | j S )N)r> )r r! r! r" serialL s z_Certificate.serialc C sR | j jj| j}|| j jjkr0| j j td| j jj|| j jj }| j j
|S )Nz,Certificate public key is of an unknown type) r r ZX509_get_pubkeyr r; r< _consume_errors
ValueErrorgc
EVP_PKEY_free_evp_pkey_to_public_key)r pkeyr! r! r"
public_keyP s
z_Certificate.public_keyc C s | j jj| j}t| j |S )N)r r ZX509_getm_notBeforer r )r asn1_timer! r! r" not_valid_before[ s z _Certificate.not_valid_beforec C s | j jj| j}t| j |S )N)r r ZX509_getm_notAfterr r )r rG r! r! r" not_valid_after` s z _Certificate.not_valid_afterc C s2 | j jj| j}| j j|| j jjk t| j |S )N)r r ZX509_get_issuer_namer r: r; r< r
)r issuerr! r! r" rJ e s z_Certificate.issuerc C s2 | j jj| j}| j j|| j jjk t| j |S )N)r r ZX509_get_subject_namer r: r; r< r
)r r$ r! r! r" r$ k s z_Certificate.subjectc C s8 | j }y
tj| S tk
r2 tdj|Y nX d S )Nz)Signature algorithm OID:{} not recognized)signature_algorithm_oidr _SIG_OIDS_TO_HASHKeyErrorr r )r oidr! r! r" signature_hash_algorithmq s
z%_Certificate.signature_hash_algorithmc C s^ | j jjd}| j jj| j jj|| j | j j|d | j jjk t| j |d j }t
j |S )Nz
X509_ALGOR **r ) r r; newr X509_get0_signaturer< r r: r r7 r ObjectIdentifier)r algrN r! r! r" rK { s z$_Certificate.signature_algorithm_oidc C s | j jj| jS )N)r Z _certificate_extension_parserparser )r r! r! r"
extensions s z_Certificate.extensionsc C sR | j jjd}| j jj|| j jj| j | j j|d | j jjk t| j |d S )NzASN1_BIT_STRING **r ) r r; rP r rQ r< r r: r )r sigr! r! r" signature s
z_Certificate.signaturec sd j jjd} j jj j|} j j|dk j jj| fdd} j jj|d |d d S )Nzunsigned char **r c s j jj| d S )Nr )r r OPENSSL_free)pointer)r r! r" s z4_Certificate.tbs_certificate_bytes..) r r; rP r Zi2d_re_X509_tbsr r: rB buffer)r ppr* r! )r r" tbs_certificate_bytes s z"_Certificate.tbs_certificate_bytesc C sn | j j }|tjjkr*| j jj|| j}n(|tjjkrJ| j jj || j}nt
d| j j |dk | j j |S )Nz/encoding must be an item from the Encoding enum )
r _create_mem_bio_gcr r/ PEMr ZPEM_write_bio_X509r r0 Z i2d_X509_bio TypeErrorr:
_read_mem_bio)r encodingbior* r! r! r" r. s
z_Certificate.public_bytesN) __name__
__module__ __qualname__r# r% r+ r, r1 r3 r9 r Zread_only_propertyr propertyr> r? rF rH rI rJ r$ rO rK cached_propertyrU rW r] r. r! r! r! r" r s*
r c @ s: e Zd Zdd Zedd Zedd Zejdd Z d S )
_RevokedCertificatec C s || _ || _|| _d S )N)r Z_crl
_x509_revoked)r r ZcrlZ x509_revokedr! r! r" r# s z _RevokedCertificate.__init__c C s2 | j jj| j}| j j|| j jjk t| j |S )N)r r Z X509_REVOKED_get0_serialNumberrk r: r; r< r )r r= r! r! r" r> s z!_RevokedCertificate.serial_numberc C s t | j| jjj| jS )N)r r r Z X509_REVOKED_get0_revocationDaterk )r r! r! r" revocation_date s z#_RevokedCertificate.revocation_datec C s | j jj| jS )N)r Z _revoked_cert_extension_parserrT rk )r r! r! r" rU s z _RevokedCertificate.extensionsN)
re rf rg r# rh r> rl r ri rU r! r! r! r" rj s rj c @ s e Zd Zdd Zdd Zdd Zdd Zejd d
Z d d Z
e d
d Z e dd Z
e dd Ze dd Ze dd Ze dd Ze dd Zdd Zd d Zd d Zd!d" Zd#d$ Zejd%d& Zd'd( Zd)S )*_CertificateRevocationListc C s || _ || _d S )N)r _x509_crl)r r Zx509_crlr! r! r" r# s z#_CertificateRevocationList.__init__c C s, t |tjstS | jjj| j|j}|dkS )Nr )r& r CertificateRevocationListr( r r Z X509_CRL_cmprn )r r) r* r! r! r" r+ s z!_CertificateRevocationList.__eq__c C s
| |k S )Nr! )r r) r! r! r" r, s z!_CertificateRevocationList.__ne__c C sX t j|| j}| jj }| jjj|| j}| jj|dk | jj|}|j | |j
S )Nr^ ) r r4 r r_ r i2d_X509_CRL_biorn r: rb r5 r6 )r r7 r8 rd r* Zderr! r! r" r9 s
z&_CertificateRevocationList.fingerprintc C s@ | j jj| j}| j j|| j jjk | j jj|| j jj}|S )N) r r Z X509_CRL_duprn r: r; r< rB Z
X509_CRL_free)r dupr! r! r" _sorted_crl s z&_CertificateRevocationList._sorted_crlc C sl | j jjd}t| j |}| j jj| j||}|dkr:d S | j j|d | j jjk t | j | j|d S d S )NzX509_REVOKED **r )
r r; rP r
r ZX509_CRL_get0_by_serialrr r: r< rj )r r> revokedr= r* r! r! r" (get_revoked_certificate_by_serial_number s zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberc C s8 | j }y
tj| S tk
r2 tdj|Y nX d S )Nz)Signature algorithm OID:{} not recognized)rK r rL rM r r )r rN r! r! r" rO s
z3_CertificateRevocationList.signature_hash_algorithmc C s^ | j jjd}| j jj| j| j jj| | j j|d | j jjk t| j |d j }t
j |S )Nz
X509_ALGOR **r ) r r; rP r X509_CRL_get0_signaturern r< r: r r7 r rR )r rS rN r! r! r" rK
s z2_CertificateRevocationList.signature_algorithm_oidc C s2 | j jj| j}| j j|| j jjk t| j |S )N)r r ZX509_CRL_get_issuerrn r: r; r< r
)r rJ r! r! r" rJ s z!_CertificateRevocationList.issuerc C s2 | j jj| j}| j j|| j jjk t| j |S )N)r r ZX509_CRL_get_nextUpdatern r: r; r< r )r Znur! r! r" next_update s z&_CertificateRevocationList.next_updatec C s2 | j jj| j}| j j|| j jjk t| j |S )N)r r ZX509_CRL_get_lastUpdatern r: r; r< r )r Zlur! r! r" last_update s z&_CertificateRevocationList.last_updatec C sR | j jjd}| j jj| j|| j jj | j j|d | j jjk t| j |d S )NzASN1_BIT_STRING **r ) r r; rP r ru rn r< r: r )r rV r! r! r" rW & s
z$_CertificateRevocationList.signaturec sd j jjd} j jj j|} j j|dk j jj| fdd} j jj|d |d d S )Nzunsigned char **r c s j jj| d S )Nr )r r rX )rY )r r! r" rZ 5 s z?_CertificateRevocationList.tbs_certlist_bytes..) r r; rP r Zi2d_re_X509_CRL_tbsrn r: rB r[ )r r\ r* r! )r r" tbs_certlist_bytes/ s z-_CertificateRevocationList.tbs_certlist_bytesc C sn | j j }|tjjkr*| j jj|| j}n(|tjjkrJ| j jj || j}nt
d| j j |dk | j j |S )Nz/encoding must be an item from the Encoding enumr^ )
r r_ r r/ r` r ZPEM_write_bio_X509_CRLrn r0 rp ra r: rb )r rc rd r* r! r! r" r. 9 s
z'_CertificateRevocationList.public_bytesc C sD | j jj| j}| j jj||}| j j|| j jjk t| j | |S )N) r r X509_CRL_get_REVOKEDrn Zsk_X509_REVOKED_valuer: r; r< rj )r idxrs rr! r! r"
_revoked_certG s z(_CertificateRevocationList._revoked_certc c s& x t t| D ]}| j|V qW d S )N)rangelenr| )r ir! r! r" __iter__M s z#_CertificateRevocationList.__iter__c s t |tr8|jt \}}} fddt|||D S tj|}|dk rV|t 7 }d| kolt k n svt j|S d S )Nc s g | ]} j |qS r! )r| ).0r )r r! r"
T s z:_CertificateRevocationList.__getitem__..r ) r& sliceindicesr~ r} operatorindex
IndexErrorr| )r rz startstopstepr! )r r" __getitem__Q s
z&_CertificateRevocationList.__getitem__c C s4 | j jj| j}|| j jjkr"dS | j jj|S d S )Nr )r r ry rn r; r< Zsk_X509_REVOKED_num)r rs r! r! r" __len__] s z"_CertificateRevocationList.__len__c C s | j jj| jS )N)r Z_crl_extension_parserrT rn )r r! r! r" rU d s z%_CertificateRevocationList.extensionsc C sL t |tjtjtjfs td| jj j
| j |j }|dkrH| jj
dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.r^ FT)r& r Z DSAPublicKeyr Z RSAPublicKeyr ZEllipticCurvePublicKeyra r r ZX509_CRL_verifyrn Z _evp_pkeyr@ )r rF r* r! r! r" is_signature_validh s
z-_CertificateRevocationList.is_signature_validN)re rf rg r# r+ r, r9 r ri rr rt rh rO rK rJ rv rw rW rx r. r| r r r rU r r! r! r! r" rm s(
rm c @ s e Zd Zdd Zdd Zdd Zdd Zd d
Zed d Z ed
d Z
edd Z e j
dd Zdd Zedd Zedd Zedd Zdd Zd S ) _CertificateSigningRequestc C s || _ || _d S )N)r _x509_req)r r Zx509_reqr! r! r" r# ~ s z#_CertificateSigningRequest.__init__c C s2 t |tstS | jtjj}|jtjj}||kS )N)r& r r( r. r r/ r0 )r r) Z
self_bytesZ other_bytesr! r! r" r+ s
z!_CertificateSigningRequest.__eq__c C s
| |k S )Nr! )r r) r! r! r" r, s z!_CertificateSigningRequest.__ne__c C s t | jtjjS )N)r- r. r r/ r0 )r r! r! r" r1 s z#_CertificateSigningRequest.__hash__c C sH | j jj| j}| j j|| j jjk | j jj|| j jj}| j j |S )N)
r r X509_REQ_get_pubkeyr r: r; r< rB rC rD )r rE r! r! r" rF s z%_CertificateSigningRequest.public_keyc C s2 | j jj| j}| j j|| j jjk t| j |S )N)r r ZX509_REQ_get_subject_namer r: r; r< r
)r r$ r! r! r" r$ s z"_CertificateSigningRequest.subjectc C s8 | j }y
tj| S tk
r2 tdj|Y nX d S )Nz)Signature algorithm OID:{} not recognized)rK r rL rM r r )r rN r! r! r" rO s
z3_CertificateSigningRequest.signature_hash_algorithmc C s^ | j jjd}| j jj| j| j jj| | j j|d | j jjk t| j |d j }t
j |S )Nz
X509_ALGOR **r ) r r; rP r X509_REQ_get0_signaturer r< r: r r7 r rR )r rS rN r! r! r" rK s z2_CertificateSigningRequest.signature_algorithm_oidc s6 j jj j} j jj| fdd} j jj|S )Nc s" j jj| j jj j jjdS )NZX509_EXTENSION_free)r r Zsk_X509_EXTENSION_pop_freer; Z addressofZ
_original_lib)x)r r! r" rZ s z7_CertificateSigningRequest.extensions..)r r ZX509_REQ_get_extensionsr r; rB Z_csr_extension_parserrT )r Z x509_extsr! )r r" rU s
z%_CertificateSigningRequest.extensionsc C sn | j j }|tjjkr*| j jj|| j}n(|tjjkrJ| j jj || j}nt
d| j j |dk | j j |S )Nz/encoding must be an item from the Encoding enumr^ )
r r_ r r/ r` r ZPEM_write_bio_X509_REQr r0 Zi2d_X509_REQ_biora r: rb )r rc rd r* r! r! r" r. s
z'_CertificateSigningRequest.public_bytesc sd j jjd} j jj j|} j j|dk j jj| fdd} j jj|d |d d S )Nzunsigned char **r c s j jj| d S )Nr )r r rX )rY )r r! r" rZ s zB_CertificateSigningRequest.tbs_certrequest_bytes..) r r; rP r Zi2d_re_X509_REQ_tbsr r: rB r[ )r r\ r* r! )r r" tbs_certrequest_bytes s z0_CertificateSigningRequest.tbs_certrequest_bytesc C sR | j jjd}| j jj| j|| j jj | j j|d | j jjk t| j |d S )NzASN1_BIT_STRING **r ) r r; rP r r r r< r: r )r rV r! r! r" rW s
z$_CertificateSigningRequest.signaturec C sh | j jj| j}| j j|| j jjk | j jj|| j jj}| j jj | j|}|dkrd| j j
dS dS )Nr^ FT) r r r r r: r; r< rB rC ZX509_REQ_verifyr@ )r rE r* r! r! r" r s
z-_CertificateSigningRequest.is_signature_validc C s t | j|j}| jjj| j|d}|dkr s.
% -