3
y_Y~ @ s d dl mZmZmZ d dlZd dlZd dlZd dlmZ d dl m
Z
m Z m Z m
Z
d dlmZ d dlmZ d dlmZmZmZmZ dd Zd
d Zd d
Zdd Zdd Zdd Z dd Z dd Z G dd de Z dd Z!d d Z"d d Z#d d! Z$d"d# Z%d$d% Z&d&d' Z'd(d) Z(d*d+ Z)d,d- Z*d.d/ Z+d0d1 Z,d2d3 Z-d4d5 Z.d6d7 Z/d8d9 Z0d:d; Z1d Z2d Z4ej5j6ej5j7ej5j8ej5j9ej5j:ej5j;ej5jd@dA Z?dBdC Z@dDdE ZAdFdG ZBdHdI ZCdJdK ZDdLdM ZEdNdO ZFej5jGej5j6ej5j7ej5j8ej5j9ej5j:ej5j;ej5jHej5jK s z$_decode_x509_name..r) )
r ZX509_NAME_entry_countrangeZX509_NAME_get_entryr% Z Cryptography_X509_NAME_ENTRY_setappendaddr Name) r Z x509_namecount
attributesZ prev_set_idxentryZ attributeZset_idr r r _decode_x509_name< s
r2 c C sV | j j|}g }x@t|D ]4}| j j||}| j|| jjk |jt| | qW |S )N) r Zsk_GENERAL_NAME_numr* Zsk_GENERAL_NAME_valuer r r r+ _decode_general_name)r gnsnumnamesignr r r _decode_general_namesN s r9 c C s |j | jjkr.t| |jjjd}tjj |S |j | jj
kr\t| |jj jd}tj j |S |j | jj
krt| |jj}tjtj|S |j | jjkrbt| |jj}t|}|dks|dkrNtj|d |d }tj||d d }tt|dd }|jd}|d kr t|}d||d kr6tdtj|j d j | } n
tj|} tj | S |j | jj krtj t!| |jj"S |j | jj#krt| |jj$jd}tj%j |S |j | jj&krt| |jj'j(}
t)| |jj'j*} tj+tj|
| S tj,d
j tj-j.|j |j |j d S ) Nutf8 0r 1zInvalid netmaskz/{}z{} is not a supported typer) )/r r ZGEN_DNS_asn1_string_to_bytesdZdNSNamer r ZDNSNameZ_init_without_validationZGEN_URIZuniformResourceIdentifierZUniformResourceIdentifierZGEN_RIDr Z registeredIDZ RegisteredIDr! Z GEN_IPADDZ iPAddresslen ipaddressZ
ip_addressbinintfind
ValueErrorZ
ip_networkZexplodedformatZ IPAddressZ GEN_DIRNAMEZ
DirectoryNamer2 Z
directoryNameZ GEN_EMAILZ
rfc822NameZ
RFC822NameZ
GEN_OTHERNAMEZ otherNametype_id _asn1_to_derr# Z OtherNameZUnsupportedGeneralNameTypeZ_GENERAL_NAMESget) r r8 r" r$ Zdata_lenbaseZnetmaskbitsprefixZiprI r# r r r r3 Y sP
r3 c C s t j S )N)r Z OCSPNoCheck)r extr r r _decode_ocsp_no_check s rP c C s0 | j jd|}| j j|| jj}tjt| |S )NzASN1_INTEGER *)r castgcr ASN1_INTEGER_freer Z CRLNumber_asn1_integer_to_int)r rO asn1_intr r r _decode_crl_number s rV c C s0 | j jd|}| j j|| jj}tjt| |S )NzASN1_INTEGER *)r rQ rR r rS r ZDeltaCRLIndicatorrT )r rO rU r r r _decode_delta_crl_indicator s rW c @ s e Zd Zdd Zdd ZdS )_X509ExtensionParserc C s || _ || _|| _|| _d S )N) ext_countget_exthandlers_backend)selfr rY rZ r[ r r r __init__ s z _X509ExtensionParser.__init__c C sp g }t }xXt| j|D ]D}| j||}| jj|| jjjk | jjj |}|dk}t
j t | j| jjj
|}||krt
jdj|||tjkr | jjj|} t| j| }
t|
jt} g } x | j s| j| jtj qW t
j dd | D }
|jt
j |||
|j | q n\|tj kr|| jjj|} tt| j| }|jtj |jt
j ||t
j! |j | q y| j"| }W nv t#k
r | jjj|} | jj| | jjjk | jjj$| j%| j&d d }t
j'||}|jt
j ||| Y nXX | jjj(|}|| jjjkr8| jj) t*dj||| j|}
|jt
j |||
|j | q W t
j+|S )Nr z Duplicate {} extension foundc S s g | ] }t | qS r )r
)r' r0 r r r
s z._X509ExtensionParser.parse..z/The {} extension is invalid and can't be parsed),setr* rY rZ r\ r r r r ZX509_EXTENSION_get_criticalr r! r ZX509_EXTENSION_get_objectZDuplicateExtensionrH r Z TLS_FEATUREZX509_EXTENSION_get_datar@ r Zread_single_elementr Zis_emptyr+ Z read_elementr Z
as_integerZ
TLSFeatureZ Extensionr, ZPRECERT_POISONZ check_emptyZ
PrecertPoisonr[ KeyErrorr r" lengthZUnrecognizedExtensionZX509V3_EXT_d2iZ_consume_errorsrG Z
Extensions)r] Zx509_obj
extensionsZ seen_oidsr7 rO ZcritZcriticalr$ r" Z
data_bytesZfeaturesZparsedr# readerZhandlerZderZ unrecognizedZext_datar r r parse sh
z_X509ExtensionParser.parseN)__name__
__module__ __qualname__r^ re r r r r rX s rX c C s@ | j jd|}| j j|| jj}| jj|}g }xt|D ]}d }| jj||}tj t
| |j }|j | j j
kr | jj|j }g }xt|D ]} | jj|j | }
tj t
| |
j} | tjkr| j j|
jjj|
jjjd d jd} |j| q| tjkstt | |
jj }
|j|
qW |jtj || qW |S )Nz*Cryptography_STACK_OF_ACCESS_DESCRIPTION *c s j j| jj j jdS )NZACCESS_DESCRIPTION_free)r Z sk_ACCESS_DESCRIPTION_pop_freer Z addressofZ
_original_lib)r0 )r r r v s z,_decode_information_access..)r rQ rR r Zsk_ACCESS_DESCRIPTION_numr* Zsk_ACCESS_DESCRIPTION_valuer methodr r r! r locationr3 r+ ZAccessDescription)r Ziar5 access_descriptionsr7 Zadr$ r8 r )r r _decode_information_accessr s r c C s t | |}tj|S )N)r r ZAuthorityInformationAccess)r aiar~ r r r $_decode_authority_information_access s
r c C s t | |}tj|S )N)r r ZSubjectInformationAccess)r r r~ r r r "_decode_subject_information_access s
r c
C s | j jd|}| j j|| jj}| jj}||ddk}||ddk}||ddk}||ddk}||ddk}||ddk}||ddk} ||d dk}
||d
dk} tj||||||| |
| S ) NzASN1_BIT_STRING *r r r= r; )r rQ rR r ZASN1_BIT_STRING_freeASN1_BIT_STRING_get_bitr ZKeyUsage) r Z
bit_stringZget_bitZdigital_signatureZcontent_commitmentZkey_enciphermentZdata_enciphermentZ
key_agreementZ
key_cert_signZcrl_signZ
encipher_onlyZ
decipher_onlyr r r _decode_key_usage s, r c C s. | j jd|}| j j|| jj}t| |}|S )NzGENERAL_NAMES *)r rQ rR r GENERAL_NAMES_freer9 )r r4
general_namesr r r _decode_general_names_extension s
r c C s t jt| |S )N)r ZSubjectAlternativeNamer )r rO r r r _decode_subject_alt_name s r c C s t jt| |S )N)r ZIssuerAlternativeNamer )r rO r r r _decode_issuer_alt_name s r c C sF | j jd|}| j j|| jj}t| |j}t| |j}tj ||dS )NzNAME_CONSTRAINTS *)Zpermitted_subtreesZexcluded_subtrees)
r rQ rR r ZNAME_CONSTRAINTS_free_decode_general_subtreesZpermittedSubtreesZexcludedSubtreesr ZNameConstraints)r ZncZ permittedZexcludedr r r _decode_name_constraints s r c C sl || j jkrd S | jj|}g }xFt|D ]:}| jj||}| j|| j jk t| |j}|j | q*W |S )N)
r r r Zsk_GENERAL_SUBTREE_numr* Zsk_GENERAL_SUBTREE_valuer r3 rL r+ )r Zstack_subtreesr5 Zsubtreesr7 r namer r r r s r c C s | j jd|}| j j|| jj}|j| j jkr@t| |j\}}nd }d }|jdk}|j dk}|j
dk}|j dk}|j | j jkrt
| |j }nd }tj|||||||S )NzISSUING_DIST_POINT *rr )r rQ rR r ZISSUING_DIST_POINT_free distpointr _decode_distpointZonlyuserZonlyCAZ indirectCRLZonlyattrZonlysomereasons_decode_reasonsr ZIssuingDistributionPoint) r Zidp full_name
relative_nameZ only_userZonly_caZ indirect_crlZ only_attrZonly_some_reasonsr r r _decode_issuing_dist_point s*
r c C sD | j jd|}| j j|| jj}t| |j}t| |j}tj ||S )NzPOLICY_CONSTRAINTS *)
r rQ rR r ZPOLICY_CONSTRAINTS_freert ZrequireExplicitPolicyZinhibitPolicyMappingr ZPolicyConstraints)r ZpcZrequire_explicit_policyZinhibit_policy_mappingr r r _decode_policy_constraints s
r c C s | j jd|}| j j|| jj}| jj|}g }xJt|D ]>}| jj||}| j|| j j k t
j t | |}|j
| q:W t
j|S )Nz#Cryptography_STACK_OF_ASN1_OBJECT *)r rQ rR r Zsk_ASN1_OBJECT_freeZsk_ASN1_OBJECT_numr* Zsk_ASN1_OBJECT_valuer r r r! r r+ ZExtendedKeyUsage)r Zskr5 Zekusr7 r r$ r r r _decode_extended_key_usage s r r c
C s | j jd|}| j j|| jj}| jj|}g }xt|D ]}d }d }d }d }| jj||} | j| j j krvt
| | j}| j | j j krt | | j }| j
| j j krt| | j
\}}|jtj|||| q:W |S )Nz"Cryptography_STACK_OF_DIST_POINT *)r rQ rR r ZCRL_DIST_POINTS_freeZsk_DIST_POINT_numr* Zsk_DIST_POINT_valuereasonsr r Z CRLissuerr9 r r r+ r ZDistributionPoint)
r cdpsr5 dist_pointsr7 r r Z
crl_issuerr Zcdpr r r _decode_dist_points s* r )r r= r r r r r r; c C s< g }x.t jtD ] \}}| jj||r|j| qW t|S )N)sixZ iteritems_REASON_BIT_MAPPINGr r r+ frozenset)r r Z enum_reasonsZ bit_positionreasonr r r r S s
r c C s |j tkr t| |jj}|d fS |jj}| jj|}t }x@t |D ]4}| jj
||}| j || j j
k |jt| | qDW tj|}d |fS )N)r _DISTPOINT_TYPE_FULLNAMEr9 r fullnameZ relativenamer Zsk_X509_NAME_ENTRY_numr` r* Zsk_X509_NAME_ENTRY_valuer r r r, r% r r& ) r r r ZrnsZrnumr/ r7 Zrnr r r r r ] s
r c C s t | |}tj|S )N)r r ZCRLDistributionPoints)r r r r r r _decode_crl_distribution_pointsv s
r c C s t | |}tj|S )N)r r Z FreshestCRL)r r r r r r _decode_freshest_crl{ s
r c C s4 | j jd|}| j j|| jj}t| |}tj|S )NzASN1_INTEGER *)r rQ rR r rS rT r ZInhibitAnyPolicy)r rU Z
skip_certsr r r _decode_inhibit_any_policy s
r c C sn ddl m} | jjd|}| jj|| jj}g }x8t| jj|D ]$}| jj ||}|j
|| || qBW |S )Nr )_SignedCertificateTimestampzCryptography_STACK_OF_SCT *) Z)cryptography.hazmat.backends.openssl.x509r r rQ rR r Z
SCT_LIST_freer* Z
sk_SCT_numZ sk_SCT_valuer+ )r asn1_sctsr Zsctsr7 Zsctr r r _decode_scts s r c C s t jt| |S )N)r Z)PrecertificateSignedCertificateTimestampsr )r r r r r -_decode_precert_signed_certificate_timestamps s r c C s t jt| |S )N)r ZSignedCertificateTimestampsr )r r r r r %_decode_signed_certificate_timestamps s r )
r r r= r r r r r;
r= r r r r r; r r c C sb | j jd|}| j j|| jj}| jj|}ytjt| S t k
r\ t
dj |Y nX d S )NzASN1_ENUMERATED *zUnsupported reason code: {}) r rQ rR r ZASN1_ENUMERATED_freeZASN1_ENUMERATED_getr Z CRLReason _CRL_ENTRY_REASON_CODE_TO_ENUMra rG rH )r enumcoder r r _decode_crl_reason s r c C s0 | j jd|}| j j|| jj}tjt| |S )NzASN1_GENERALIZEDTIME *)r rQ rR r ASN1_GENERALIZEDTIME_freer ZInvalidityDate _parse_asn1_generalized_time)r Zinv_dategeneralized_timer r r _decode_invalidity_date s
r c C s4 | j jd|}| j j|| jj}t| |}tj|S )NzGENERAL_NAMES *)r rQ rR r r r9 r ZCertificateIssuer)r r4 r r r r _decode_cert_issuer s
r c sn j jd} jj||} j|dk j|d j jk j j| fdd} j j|d |d d S )Nzunsigned char **r c s j j| d S )Nr )r OPENSSL_free)r )r r r r{ s z _asn1_to_der..)r r r Z
i2d_ASN1_TYPEr r rR r )r Z asn1_typer r r )r r rJ s rJ c C s@ | j j|| jj}| j|| jjk | jj|| j j}| j|S )N)r ZASN1_INTEGER_to_BNr r r rR ZBN_freeZ
_bn_to_int)r rU Zbnr r r rT s rT c C s || j jkrd S t| |S d S )N)r r rT )r rU r r r rt s rt c C s | j j|j|jd d S )N)r r r" rb )r rw r r r r@ s r@ c C s t | |jdS )Nri )r@ r )r rw r r r _asn1_string_to_ascii s r c s~ j jd} jj||}|dkr2tdj|j j|d j jk j j | fdd} j j
|d |d d j dS ) Nzunsigned char **r z&Unsupported ASN1 string type. Type: {}r c s j j| d S )Nr )r r )r )r r r r{ s z&_asn1_string_to_utf8..r: r) ) r r r ZASN1_STRING_to_UTF8rG rH r r r rR r r )r rw r r r )r r r s r c C s` | j || jjk | jj|| jj}|| jjkrDtdjt| || jj|| jj }t
| |S )Nz1Couldn't parse ASN.1 time as generalizedtime {!r}) r r r r Z ASN1_TIME_to_generalizedtimerG rH r@ rR r r )r Z asn1_timer r r r _parse_asn1_time s r c C s" t | | jjd|}tjj|dS )Nz
ASN1_STRING *z
%Y%m%d%H%M%SZ)r r rQ datetimeZstrptime)r r Ztimer r r r ' s r c C s0 | j jd|}| j j|| jj}tjt| |S )NzASN1_OCTET_STRING *)r rQ rR r rv r Z OCSPNoncer@ )r Znoncer r r
_decode_nonce. s r )wZ
__future__r r r r rC r Z cryptographyr Zcryptography.hazmat._derr r r r Z cryptography.x509.extensionsr
Zcryptography.x509.namer Zcryptography.x509.oidr r
r r r r% r2 r9 r3 rP rV rW objectrX rp rn ru rx rz r r r r r r r r r r r r r Z _DISTPOINT_TYPE_RELATIVENAMEr Z ReasonFlagsZkey_compromiseZ
ca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZ
aa_compromiser r r r r r r r r Z unspecifiedZremove_from_crlr Z _CRL_ENTRY_REASON_ENUM_TO_CODEr r r rJ rT rt r@ r r r r r ZBASIC_CONSTRAINTSZSUBJECT_KEY_IDENTIFIERZ KEY_USAGEZSUBJECT_ALTERNATIVE_NAMEZEXTENDED_KEY_USAGEZAUTHORITY_KEY_IDENTIFIERZ AUTHORITY_INFORMATION_ACCESSZSUBJECT_INFORMATION_ACCESSZCERTIFICATE_POLICIESZCRL_DISTRIBUTION_POINTSZ FRESHEST_CRLZ
OCSP_NO_CHECKZINHIBIT_ANY_POLICYZISSUER_ALTERNATIVE_NAMEZNAME_CONSTRAINTSZPOLICY_CONSTRAINTSZ_EXTENSION_HANDLERS_BASEZ%PRECERT_SIGNED_CERTIFICATE_TIMESTAMPSZ_EXTENSION_HANDLERS_SCTZ
CRL_REASONZINVALIDITY_DATEZCERTIFICATE_ISSUERZ_REVOKED_EXTENSION_HANDLERSZ
CRL_NUMBERZDELTA_CRL_INDICATORZISSUING_DISTRIBUTION_POINTZ_CRL_EXTENSION_HANDLERSZNONCEZ _OCSP_REQ_EXTENSION_HANDLERSZ"_OCSP_BASICRESP_EXTENSION_HANDLERSZ SIGNED_CERTIFICATE_TIMESTAMPSZ'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCTr r r r s NQ!
-