U
    [e/Y                     @   s  d dl Z d dlZd dlZd dlmZmZ d dlmZ d dlm	Z	m
Z
mZ d dlmZmZmZmZmZ d dlmZmZ d dlmZmZ d dlmZ d d	lmZ G d
d dejZG dd dejZe ej!G dd de"Z#e ej$G dd de"Z%e ej&j'G dd de"Z(dS )    N)utilsx509)UnsupportedAlgorithm)dsaecrsa)_asn1_integer_to_int_asn1_string_to_bytes_decode_x509_name_obj2txt_parse_asn1_time)_encode_asn1_int_gc_txt2obj_gc)hashesserialization)_PUBLIC_KEY_TYPES)	_ASN1Typec                   @   sd  e Zd ZU ejed< dd Zdd Zee	dddZ
ee	dd	d
ZedddZdd ZejedddZedZeedddZedddZeejdddZeejdddZeejdddZeejdddZ eej!ej dd d!Z"eej#dd"d#Z$ej%ej&dd$d%Z'eedd&d'Z(eedd(d)Z)e*j+ed*d+d,Z,d-S )._CertificateZ_ocsp_resp_refc                 C   sZ   || _ || _| j j| j}|dkr0tjj| _n&|dkrDtjj| _nt	d
||d S )Nr      z{} is not a valid X509 version)_backend_x509_libZX509_get_versionr   Versionv1_versionZv3InvalidVersionformat)selfbackendZ	x509_certversion r    k/var/www/html/services/stratfitenv/lib/python3.8/site-packages/cryptography/hazmat/backends/openssl/x509.py__init__!   s     z_Certificate.__init__c                 C   s   d | jS )Nz<Certificate(subject={}, ...)>)r   subjectr   r    r    r!   __repr__/   s    z_Certificate.__repr__otherreturnc                 C   s*   t |tstS | jj| j|j}|dkS Nr   )
isinstancer   NotImplementedr   r   ZX509_cmpr   r   r'   resr    r    r!   __eq__2   s    
z_Certificate.__eq__c                 C   s
   | |k S Nr    r   r'   r    r    r!   __ne__9   s    z_Certificate.__ne__r(   c                 C   s   t | tjjS r/   hashpublic_bytesr   EncodingDERr$   r    r    r!   __hash__<   s    z_Certificate.__hash__c                 C   s   | S r/   r    )r   memor    r    r!   __deepcopy__?   s    z_Certificate.__deepcopy__	algorithmr(   c                 C   s*   t || j}|| tjj | S r/   )	r   Hashr   updater5   r   r6   r7   finalize)r   r<   hr    r    r!   fingerprintB   s    z_Certificate.fingerprintr   c                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_get_serialNumberr   openssl_assert_ffiNULLr   r   asn1_intr    r    r!   serial_numberI   s    z_Certificate.serial_numberc                 C   sR   | j j| j}|| j jjkr0| j   td| j j|| j jj	}| j 
|S )Nz,Certificate public key is of an unknown type)r   r   ZX509_get_pubkeyr   rC   rD   _consume_errors
ValueErrorgcEVP_PKEY_free_evp_pkey_to_public_keyr   pkeyr    r    r!   
public_keyO   s    
z_Certificate.public_keyc                 C   s   | j j| j}t| j |S r/   )r   r   ZX509_get0_notBeforer   r   r   Z	asn1_timer    r    r!   not_valid_beforeZ   s    z_Certificate.not_valid_beforec                 C   s   | j j| j}t| j |S r/   )r   r   ZX509_get0_notAfterr   r   rP   r    r    r!   not_valid_after_   s    z_Certificate.not_valid_afterc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_get_issuer_namer   rB   rC   rD   r
   r   issuerr    r    r!   rT   d   s    z_Certificate.issuerc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_get_subject_namer   rB   rC   rD   r
   r   r#   r    r    r!   r#   j   s    z_Certificate.subjectc                 C   s:   | j }ztj| W S  tk
r4   td|Y nX d S Nz)Signature algorithm OID:{} not recognizedsignature_algorithm_oidr   Z_SIG_OIDS_TO_HASHKeyErrorr   r   r   oidr    r    r!   signature_hash_algorithmp   s    z%_Certificate.signature_hash_algorithmc                 C   s^   | j jd}| j j| j jj|| j | j |d | j jjk t| j |d j	}t
|S NzX509_ALGOR **r   )r   rC   newr   X509_get0_signaturerD   r   rB   r   r<   r   ObjectIdentifierr   algr[   r    r    r!   rX   |   s      z$_Certificate.signature_algorithm_oidc                 C   s   | j j| jS r/   )r   Z_certificate_extension_parserparser   r$   r    r    r!   
extensions   s    z_Certificate.extensionsc                 C   sR   | j jd}| j j|| j jj| j | j |d | j jjk t| j |d S NzASN1_BIT_STRING **r   )	r   rC   r^   r   r_   rD   r   rB   r	   r   sigr    r    r!   	signature   s      z_Certificate.signaturec                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nunsigned char **r   c                    s    j j| d S r)   r   r   ZOPENSSL_freeZpointerr$   r    r!   <lambda>       z4_Certificate.tbs_certificate_bytes.<locals>.<lambda>)	r   rC   r^   r   Zi2d_re_X509_tbsr   rB   rJ   bufferr   ppr-   r    r$   r!   tbs_certificate_bytes   s     
z"_Certificate.tbs_certificate_bytesencodingr(   c                 C   sn   | j  }|tjjkr*| j j|| j}n(|tjjkrJ| j j	|| j}nt
d| j |dk | j |S Nz/encoding must be an item from the Encoding enum   )r   _create_mem_bio_gcr   r6   PEMr   ZPEM_write_bio_X509r   r7   Zi2d_X509_bio	TypeErrorrB   _read_mem_bior   rs   bior-   r    r    r!   r5      s    
z_Certificate.public_bytesN)-__name__
__module____qualname__typingAny__annotations__r"   r%   objectboolr.   r1   intr8   r:   r   HashAlgorithmbytesrA   r   Zread_only_propertyr   propertyrG   r   rO   datetimerQ   rR   r   NamerT   r#   Optionalr\   r`   rX   cached_property
Extensionsrd   rh   rq   r   r6   r5   r    r    r    r!   r      s@   



		r   c                   @   sP   e Zd Zdd ZeedddZeejdddZe	j
ejddd	Zd
S )_RevokedCertificatec                 C   s   || _ || _|| _d S r/   )r   Z_crl_x509_revoked)r   r   ZcrlZx509_revokedr    r    r!   r"      s    z_RevokedCertificate.__init__r2   c                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_REVOKED_get0_serialNumberr   rB   rC   rD   r   rE   r    r    r!   rG      s
    z!_RevokedCertificate.serial_numberc                 C   s   t | j| jj| jS r/   )r   r   r   Z X509_REVOKED_get0_revocationDater   r$   r    r    r!   revocation_date   s    z#_RevokedCertificate.revocation_datec                 C   s   | j j| jS r/   )r   Z_revoked_cert_extension_parserrc   r   r$   r    r    r!   rd      s    z_RevokedCertificate.extensionsN)r|   r}   r~   r"   r   r   rG   r   r   r   r   r   r   rd   r    r    r    r!   r      s   r   c                   @   sX  e Zd Zdd ZeedddZeedddZej	e
dd	d
Zejdd Zeejej dddZeejej	 dddZeejdddZeejdddZeejdddZeejdddZee
dddZee
dddZe j!e
dd d!Z"d"d# Z#d$d% Z$d&d' Z%edd(d)Z&ejej'dd*d+Z(e)ed,d-d.Z*d/S )0_CertificateRevocationListc                 C   s   || _ || _d S r/   )r   	_x509_crl)r   r   Zx509_crlr    r    r!   r"      s    z#_CertificateRevocationList.__init__r&   c                 C   s*   t |tstS | jj| j|j}|dkS r)   )r*   r   r+   r   r   ZX509_CRL_cmpr   r,   r    r    r!   r.      s    
z!_CertificateRevocationList.__eq__c                 C   s
   | |k S r/   r    r0   r    r    r!   r1      s    z!_CertificateRevocationList.__ne__r;   c                 C   sX   t || j}| j }| jj|| j}| j|dk | j|}|	| |
 S )Nru   )r   r=   r   rv   r   i2d_X509_CRL_bior   rB   ry   r>   r?   )r   r<   r@   r{   r-   Zderr    r    r!   rA      s    

z&_CertificateRevocationList.fingerprintc                 C   s@   | j j| j}| j || j jjk | j j|| j jj}|S r/   )	r   r   ZX509_CRL_dupr   rB   rC   rD   rJ   ZX509_CRL_free)r   dupr    r    r!   _sorted_crl   s    z&_CertificateRevocationList._sorted_crl)rG   r(   c                 C   sl   | j jd}t| j |}| j j| j||}|dkr:d S | j |d | j jjk t	| j | j|d S d S )NzX509_REVOKED **r   )
r   rC   r^   r   r   ZX509_CRL_get0_by_serialr   rB   rD   r   )r   rG   revokedrF   r-   r    r    r!   (get_revoked_certificate_by_serial_number   s        zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberr2   c                 C   s:   | j }ztj| W S  tk
r4   td|Y nX d S rV   rW   rZ   r    r    r!   r\     s    z3_CertificateRevocationList.signature_hash_algorithmc                 C   s^   | j jd}| j j| j| j jj| | j |d | j jjk t| j |d j	}t
|S r]   )r   rC   r^   r   X509_CRL_get0_signaturer   rD   rB   r   r<   r   r`   ra   r    r    r!   rX     s      z2_CertificateRevocationList.signature_algorithm_oidc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_CRL_get_issuerr   rB   rC   rD   r
   rS   r    r    r!   rT     s    z!_CertificateRevocationList.issuerc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_CRL_get0_nextUpdater   rB   rC   rD   r   )r   nur    r    r!   next_update  s    z&_CertificateRevocationList.next_updatec                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_CRL_get0_lastUpdater   rB   rC   rD   r   )r   Zlur    r    r!   last_update$  s    z&_CertificateRevocationList.last_updatec                 C   sR   | j jd}| j j| j|| j jj | j |d | j jjk t| j |d S re   )	r   rC   r^   r   r   r   rD   rB   r	   rf   r    r    r!   rh   *  s      z$_CertificateRevocationList.signaturec                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nri   r   c                    s    j j| d S r)   rj   rk   r$   r    r!   rl   9  rm   z?_CertificateRevocationList.tbs_certlist_bytes.<locals>.<lambda>)	r   rC   r^   r   Zi2d_re_X509_CRL_tbsr   rB   rJ   rn   ro   r    r$   r!   tbs_certlist_bytes3  s     
z-_CertificateRevocationList.tbs_certlist_bytesrr   c                 C   sn   | j  }|tjjkr*| j j|| j}n(|tjjkrJ| j j	|| j}nt
d| j |dk | j |S rt   )r   rv   r   r6   rw   r   ZPEM_write_bio_X509_CRLr   r7   r   rx   rB   ry   rz   r    r    r!   r5   =  s    
 z'_CertificateRevocationList.public_bytesc                 C   sD   | j j| j}| j j||}| j || j jjk t| j | |S r/   )	r   r   X509_CRL_get_REVOKEDr   Zsk_X509_REVOKED_valuerB   rC   rD   r   )r   idxr   rr    r    r!   _revoked_certK  s    z(_CertificateRevocationList._revoked_certc                 c   s"   t t| D ]}| |V  qd S r/   )rangelenr   )r   ir    r    r!   __iter__Q  s    z#_CertificateRevocationList.__iter__c                    s   t |tr8|t \}}} fddt|||D S t|}|dk rV|t 7 }d|  krnt k stn t |S d S )Nc                    s   g | ]}  |qS r    )r   ).0r   r$   r    r!   
<listcomp>X  s     z:_CertificateRevocationList.__getitem__.<locals>.<listcomp>r   )	r*   sliceindicesr   r   operatorindex
IndexErrorr   )r   r   startstopstepr    r$   r!   __getitem__U  s    

z&_CertificateRevocationList.__getitem__c                 C   s4   | j j| j}|| j jjkr"dS | j j|S d S r)   )r   r   r   r   rC   rD   Zsk_X509_REVOKED_num)r   r   r    r    r!   __len__a  s    z"_CertificateRevocationList.__len__c                 C   s   | j j| jS r/   )r   Z_crl_extension_parserrc   r   r$   r    r    r!   rd   h  s    z%_CertificateRevocationList.extensions)rO   r(   c                 C   sL   t |tjtjtjfstd| jj	
| j|j}|dkrH| j  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.ru   FT)r*   r   Z_DSAPublicKeyr   Z_RSAPublicKeyr   Z_EllipticCurvePublicKeyrx   r   r   ZX509_CRL_verifyr   Z	_evp_pkeyrH   )r   rO   r-   r    r    r!   is_signature_validl  s$     
z-_CertificateRevocationList.is_signature_validN)+r|   r}   r~   r"   r   r   r.   r1   r   r   r   rA   r   r   r   r   r   r   r   RevokedCertificater   r   r\   r`   rX   r   rT   r   r   r   rh   r   r   r6   r5   r   r   r   r   r   rd   r   r   r    r    r    r!   r      s@   	



		r   c                   @   s  e Zd Zdd ZeedddZeedddZedd	d
Z	e
dddZeejdddZeejej dddZeejdddZejejdddZejedddZeedddZeedddZ eedddZ!ejeddd Z"d!S )"_CertificateSigningRequestc                 C   s   || _ || _d S r/   )r   	_x509_req)r   r   Zx509_reqr    r    r!   r"     s    z#_CertificateSigningRequest.__init__r&   c                 C   s2   t |tstS | tjj}|tjj}||kS r/   )r*   r   r+   r5   r   r6   r7   )r   r'   Z
self_bytesZother_bytesr    r    r!   r.     s
    
z!_CertificateSigningRequest.__eq__c                 C   s
   | |k S r/   r    r0   r    r    r!   r1     s    z!_CertificateSigningRequest.__ne__r2   c                 C   s   t | tjjS r/   r3   r$   r    r    r!   r8     s    z#_CertificateSigningRequest.__hash__c                 C   sH   | j j| j}| j || j jjk | j j|| j jj}| j 	|S r/   )
r   r   X509_REQ_get_pubkeyr   rB   rC   rD   rJ   rK   rL   rM   r    r    r!   rO     s    z%_CertificateSigningRequest.public_keyc                 C   s2   | j j| j}| j || j jjk t| j |S r/   )r   r   ZX509_REQ_get_subject_namer   rB   rC   rD   r
   rU   r    r    r!   r#     s    z"_CertificateSigningRequest.subjectc                 C   s:   | j }ztj| W S  tk
r4   td|Y nX d S rV   rW   rZ   r    r    r!   r\     s    z3_CertificateSigningRequest.signature_hash_algorithmc                 C   s^   | j jd}| j j| j| j jj| | j |d | j jjk t| j |d j	}t
|S r]   )r   rC   r^   r   X509_REQ_get0_signaturer   rD   rB   r   r<   r   r`   ra   r    r    r!   rX     s      z2_CertificateSigningRequest.signature_algorithm_oidc                    s6    j j j} j j| fdd} j j|S )Nc                    s"    j j|  j j j jjdS )NZX509_EXTENSION_free)r   r   Zsk_X509_EXTENSION_pop_freerC   Z	addressofZ_original_lib)xr$   r    r!   rl     s    z7_CertificateSigningRequest.extensions.<locals>.<lambda>)r   r   ZX509_REQ_get_extensionsr   rC   rJ   Z_csr_extension_parserrc   )r   Z	x509_extsr    r$   r!   rd     s    
	z%_CertificateSigningRequest.extensionsrr   c                 C   sn   | j  }|tjjkr*| j j|| j}n(|tjjkrJ| j j	|| j}nt
d| j |dk | j |S rt   )r   rv   r   r6   rw   r   ZPEM_write_bio_X509_REQr   r7   Zi2d_X509_REQ_biorx   rB   ry   rz   r    r    r!   r5     s    
 z'_CertificateSigningRequest.public_bytesc                    sd    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nri   r   c                    s    j j| d S r)   rj   rk   r$   r    r!   rl     rm   zB_CertificateSigningRequest.tbs_certrequest_bytes.<locals>.<lambda>)	r   rC   r^   r   Zi2d_re_X509_REQ_tbsr   rB   rJ   rn   ro   r    r$   r!   tbs_certrequest_bytes  s     
z0_CertificateSigningRequest.tbs_certrequest_bytesc                 C   sR   | j jd}| j j| j|| j jj | j |d | j jjk t| j |d S re   )	r   rC   r^   r   r   r   rD   rB   r	   rf   r    r    r!   rh     s      z$_CertificateSigningRequest.signaturec                 C   sh   | j j| j}| j || j jjk | j j|| j jj}| j j	| j|}|dkrd| j 
  dS dS )Nru   FT)r   r   r   r   rB   rC   rD   rJ   rK   ZX509_REQ_verifyrH   )r   rN   r-   r    r    r!   r     s    
z-_CertificateSigningRequest.is_signature_valid)r[   r(   c                 C   s   t | j|j}| jj| j|d}|dkr<td||| jj	| j|}| j
|| jjjk | j
| jj|dk | jj|d}| j
|| jjjk |jtjjtjjtjjfkrtd||j| jj|d|j| jjj}| j
|| jjjk | jjd|}t| j|S )NzNo {} attribute was foundru   r   z&OID {} has a disallowed ASN.1 type: {}zASN1_STRING *)r   r   Zdotted_stringr   ZX509_REQ_get_attr_by_OBJr   r   ZAttributeNotFoundr   ZX509_REQ_get_attrrB   rC   rD   ZX509_ATTRIBUTE_countZX509_ATTRIBUTE_get0_typetyper   Z
UTF8StringvalueZPrintableStringZ	IA5StringrI   ZX509_ATTRIBUTE_get0_datacastr	   )r   r[   objposattrZ	asn1_typedatar    r    r!   get_attribute_for_oid  sL           z0_CertificateSigningRequest.get_attribute_for_oidN)#r|   r}   r~   r"   r   r   r.   r1   r   r8   r   rO   r   r   r   r#   r   r   r   r   r\   r`   rX   r   r   r   rd   r   r6   r   r5   r   rh   r   r   r    r    r    r!   r     s,   
		r   c                   @   s   e Zd Zdd ZeejjdddZee	dddZ
eejddd	Zeejjdd
dZedd ZedddZeedddZeedddZdS )_SignedCertificateTimestampc                 C   s   || _ || _|| _d S r/   )r   Z	_sct_list_sct)r   r   Zsct_listZsctr    r    r!   r"   $  s    z$_SignedCertificateTimestamp.__init__r2   c                 C   s,   | j j| j}|| j jjks"ttjjj	S r/   )
r   r   ZSCT_get_versionr   ZSCT_VERSION_V1AssertionErrorr   certificate_transparencyr   r   )r   r   r    r    r!   r   *  s    z#_SignedCertificateTimestamp.versionc                 C   sH   | j jd}| j j| j|}|dks,t| j j|d |d d  S Nri   r   )r   rC   r^   r   ZSCT_get0_log_idr   r   rn   )r   outZlog_id_lengthr    r    r!   log_id0  s    z"_SignedCertificateTimestamp.log_idc                 C   s4   | j j| j}|d }tj|d j|d dS )Ni  )microsecond)r   r   ZSCT_get_timestampr   r   utcfromtimestampreplace)r   	timestampZmillisecondsr    r    r!   r   7  s
    z%_SignedCertificateTimestamp.timestampc                 C   s,   | j j| j}|| j jjks"ttjjj	S r/   )
r   r   ZSCT_get_log_entry_typer   ZCT_LOG_ENTRY_TYPE_PRECERTr   r   r   LogEntryTypeZPRE_CERTIFICATE)r   
entry_typer    r    r!   r   ?  s    z&_SignedCertificateTimestamp.entry_typec                 C   sf   | j jd}| j j| j|}| j |dk | j |d | j jjk | j j|d |d d  S r   )	r   rC   r^   r   ZSCT_get0_signaturer   rB   rD   rn   )r   Zptrptrr-   r    r    r!   
_signatureG  s
    z&_SignedCertificateTimestamp._signaturec                 C   s
   t | jS r/   )r4   r   r$   r    r    r!   r8   O  s    z$_SignedCertificateTimestamp.__hash__r&   c                 C   s   t |tstS | j|jkS r/   )r*   r   r+   r   r0   r    r    r!   r.   R  s    
z"_SignedCertificateTimestamp.__eq__c                 C   s
   | |k S r/   r    r0   r    r    r!   r1   X  s    z"_SignedCertificateTimestamp.__ne__N)r|   r}   r~   r"   r   r   r   r   r   r   r   r   r   r   r   r   r   r8   r   r   r.   r1   r    r    r    r!   r      s   
r   ))r   r   r   Zcryptographyr   r   Zcryptography.exceptionsr   Z$cryptography.hazmat.backends.opensslr   r   r   Z0cryptography.hazmat.backends.openssl.decode_asn1r   r	   r
   r   r   Z0cryptography.hazmat.backends.openssl.encode_asn1r   r   Zcryptography.hazmat.primitivesr   r   Zcryptography.x509.baser   Zcryptography.x509.namer   ZCertificater   r   r   Zregister_interfaceZCertificateRevocationListr   r   ZCertificateSigningRequestr   r   ZSignedCertificateTimestampr   r    r    r    r!   <module>   s.    %
 5
 