U
    [e!n                     @   s6  d dl Z d dlZd dlZd dlZd dlmZ d dlmZmZ d dl	m
Z
 d dlmZmZ d dlmZmZmZmZmZ d dlmZmZmZ d dlmZ d d	lmZ ed
ddZG dd deZeeje dddZ eejej!ee"f  dddZ#ejejdddZ$G dd deZ%G dd deZ&G dd de j'dZ(G dd de j'dZ)G d d! d!e j'dZ*G d"d# d#e j'dZ+d<e"e(d$d%d&Z,d=e"e(d$d'd(Z-d>e"e+d$d)d*Z.d?e"e+d$d+d,Z/d@e"e*d$d-d.Z0dAe"e*d$d/d0Z1G d1d2 d2e2Z3G d3d4 d4e2Z4G d5d6 d6e2Z5G d7d8 d8e2Z6e7d9d:d;Z8dS )B    N)Enum)_PRIVATE_KEY_TYPES_PUBLIC_KEY_TYPES)_get_backend)hashesserialization)dsaeced25519ed448rsa)	ExtensionExtensionType
Extensions)Name)ObjectIdentifieri     c                       s   e Zd Z fddZ  ZS )AttributeNotFoundc                    s   t t| | || _d S N)superr   __init__oid)selfmsgr   	__class__ X/var/www/html/services/stratfitenv/lib/python3.8/site-packages/cryptography/x509/base.pyr      s    zAttributeNotFound.__init____name__
__module____qualname__r   __classcell__r   r   r   r   r      s   r   )	extension
extensionsc                 C   s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r#   r$   er   r   r   _reject_duplicate_extension$   s    r'   )r   
attributesc                 C   s"   |D ]\}}|| krt dqd S )Nz$This attribute has already been set.)r%   )r   r(   Zattr_oid_r   r   r   _reject_duplicate_attribute-   s    r*   )timereturnc                 C   s:   | j dk	r2|  }|r|nt }| jdd| S | S dS )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N)tzinfo)r-   	utcoffsetdatetime	timedeltareplace)r+   offsetr   r   r   _convert_to_naive_utc_time7   s
    
r3   c                   @   s   e Zd ZdZdZdS )Versionr      N)r   r    r!   Zv1v3r   r   r   r   r4   E   s   r4   c                       s   e Zd Z fddZ  ZS )InvalidVersionc                    s   t t| | || _d S r   )r   r7   r   parsed_version)r   r   r8   r   r   r   r   K   s    zInvalidVersion.__init__r   r   r   r   r   r7   J   s   r7   c                   @   sx  e Zd ZejejedddZej	e
dddZej	edddZejedd	d
Zej	ejdddZej	ejdddZej	edddZej	edddZej	ejej dddZej	edddZej	edddZej	edddZej	edddZejee dddZ!ejee dd d!Z"eje
dd"d#Z#eje$j%ed$d%d&Z&d'S )(Certificate	algorithmr,   c                 C   s   dS z4
        Returns bytes using digest passed.
        Nr   r   r;   r   r   r   fingerprintQ   s    zCertificate.fingerprintr,   c                 C   s   dS )z3
        Returns certificate serial number
        Nr   r   r   r   r   serial_numberW   s    zCertificate.serial_numberc                 C   s   dS )z1
        Returns the certificate version
        Nr   r@   r   r   r   version]   s    zCertificate.versionc                 C   s   dS z(
        Returns the public key
        Nr   r@   r   r   r   
public_keyc   s    zCertificate.public_keyc                 C   s   dS )z?
        Not before time (represented as UTC datetime)
        Nr   r@   r   r   r   not_valid_beforei   s    zCertificate.not_valid_beforec                 C   s   dS )z>
        Not after time (represented as UTC datetime)
        Nr   r@   r   r   r   not_valid_aftero   s    zCertificate.not_valid_afterc                 C   s   dS )z1
        Returns the issuer name object.
        Nr   r@   r   r   r   issueru   s    zCertificate.issuerc                 C   s   dS z2
        Returns the subject name object.
        Nr   r@   r   r   r   subject{   s    zCertificate.subjectc                 C   s   dS zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr   r@   r   r   r   signature_hash_algorithm   s    z$Certificate.signature_hash_algorithmc                 C   s   dS zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr   r@   r   r   r   signature_algorithm_oid   s    z#Certificate.signature_algorithm_oidc                 C   s   dS )z/
        Returns an Extensions object.
        Nr   r@   r   r   r   r$      s    zCertificate.extensionsc                 C   s   dS z.
        Returns the signature bytes.
        Nr   r@   r   r   r   	signature   s    zCertificate.signaturec                 C   s   dS )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr   r@   r   r   r   tbs_certificate_bytes   s    z!Certificate.tbs_certificate_bytesotherr,   c                 C   s   dS z"
        Checks equality.
        Nr   r   rR   r   r   r   __eq__   s    zCertificate.__eq__c                 C   s   dS z#
        Checks not equal.
        Nr   rT   r   r   r   __ne__   s    zCertificate.__ne__c                 C   s   dS z"
        Computes a hash.
        Nr   r@   r   r   r   __hash__   s    zCertificate.__hash__encodingr,   c                 C   s   dS )zB
        Serializes the certificate to PEM or DER format.
        Nr   r   r[   r   r   r   public_bytes   s    zCertificate.public_bytesN)'r   r    r!   abcabstractmethodr   HashAlgorithmbytesr>   abstractpropertyintrA   r4   rB   r   rD   r/   rE   rF   r   rG   rI   typingOptionalrK   r   rM   r   r$   rO   rP   objectboolrU   rW   rY   r   Encodingr]   r   r   r   r   r9   P   sF   
r9   )	metaclassc                   @   sJ   e Zd ZejedddZejejdddZeje	dddZ
dS )	RevokedCertificater?   c                 C   s   dS )zG
        Returns the serial number of the revoked certificate.
        Nr   r@   r   r   r   rA      s    z RevokedCertificate.serial_numberc                 C   s   dS )zH
        Returns the date of when this certificate was revoked.
        Nr   r@   r   r   r   revocation_date   s    z"RevokedCertificate.revocation_datec                 C   s   dS )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr   r@   r   r   r   r$      s    zRevokedCertificate.extensionsN)r   r    r!   r^   rb   rc   rA   r/   rk   r   r$   r   r   r   r   rj      s   rj   c                   @   sp  e Zd ZejejedddZeje	j
edddZejeeje ddd	Zeje	j
d
ddZejed
ddZejed
ddZejejd
ddZejejd
ddZejed
ddZejed
ddZejed
ddZejeedddZ ejeedddZ!ejed
d d!Z"ejd"d# Z#ejd$d% Z$eje%ed&d'd(Z&d)S )*CertificateRevocationListrZ   c                 C   s   dS )z:
        Serializes the CRL to PEM or DER format.
        Nr   r\   r   r   r   r]      s    z&CertificateRevocationList.public_bytesr:   c                 C   s   dS r<   r   r=   r   r   r   r>      s    z%CertificateRevocationList.fingerprint)rA   r,   c                 C   s   dS )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr   )r   rA   r   r   r   (get_revoked_certificate_by_serial_number   s    zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr?   c                 C   s   dS rJ   r   r@   r   r   r   rK      s    z2CertificateRevocationList.signature_hash_algorithmc                 C   s   dS rL   r   r@   r   r   r   rM      s    z1CertificateRevocationList.signature_algorithm_oidc                 C   s   dS )zC
        Returns the X509Name with the issuer of this CRL.
        Nr   r@   r   r   r   rG      s    z CertificateRevocationList.issuerc                 C   s   dS )z?
        Returns the date of next update for this CRL.
        Nr   r@   r   r   r   next_update   s    z%CertificateRevocationList.next_updatec                 C   s   dS )z?
        Returns the date of last update for this CRL.
        Nr   r@   r   r   r   last_update   s    z%CertificateRevocationList.last_updatec                 C   s   dS )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr   r@   r   r   r   r$     s    z$CertificateRevocationList.extensionsc                 C   s   dS rN   r   r@   r   r   r   rO   
  s    z#CertificateRevocationList.signaturec                 C   s   dS )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr   r@   r   r   r   tbs_certlist_bytes  s    z,CertificateRevocationList.tbs_certlist_bytesrQ   c                 C   s   dS rS   r   rT   r   r   r   rU     s    z CertificateRevocationList.__eq__c                 C   s   dS rV   r   rT   r   r   r   rW     s    z CertificateRevocationList.__ne__c                 C   s   dS )z<
        Number of revoked certificates in the CRL.
        Nr   r@   r   r   r   __len__"  s    z!CertificateRevocationList.__len__c                 C   s   dS )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr   )r   idxr   r   r   __getitem__(  s    z%CertificateRevocationList.__getitem__c                 C   s   dS )z8
        Iterator over the revoked certificates
        Nr   r@   r   r   r   __iter__.  s    z"CertificateRevocationList.__iter__)rD   r,   c                 C   s   dS )zQ
        Verifies signature of revocation list against given public key.
        Nr   )r   rD   r   r   r   is_signature_valid4  s    z,CertificateRevocationList.is_signature_validN)'r   r    r!   r^   r_   r   rh   ra   r]   r   r`   r>   rc   rd   re   rj   rm   rb   rK   r   rM   r   rG   r/   rn   ro   r   r$   rO   rp   rf   rg   rU   rW   rq   rs   rt   r   ru   r   r   r   r   rl      sH   

rl   c                   @   s  e Zd ZejeedddZejeedddZeje	dddZ
ejedd	d
ZejedddZejejdddZejedddZejedddZejejedddZejedddZejedddZejedddZejeedddZdS ) CertificateSigningRequestrQ   c                 C   s   dS rS   r   rT   r   r   r   rU   <  s    z CertificateSigningRequest.__eq__c                 C   s   dS rV   r   rT   r   r   r   rW   B  s    z CertificateSigningRequest.__ne__r?   c                 C   s   dS rX   r   r@   r   r   r   rY   H  s    z"CertificateSigningRequest.__hash__c                 C   s   dS rC   r   r@   r   r   r   rD   N  s    z$CertificateSigningRequest.public_keyc                 C   s   dS rH   r   r@   r   r   r   rI   T  s    z!CertificateSigningRequest.subjectc                 C   s   dS rJ   r   r@   r   r   r   rK   Z  s    z2CertificateSigningRequest.signature_hash_algorithmc                 C   s   dS rL   r   r@   r   r   r   rM   a  s    z1CertificateSigningRequest.signature_algorithm_oidc                 C   s   dS )z@
        Returns the extensions in the signing request.
        Nr   r@   r   r   r   r$   g  s    z$CertificateSigningRequest.extensionsrZ   c                 C   s   dS )z;
        Encodes the request to PEM or DER format.
        Nr   r\   r   r   r   r]   m  s    z&CertificateSigningRequest.public_bytesc                 C   s   dS rN   r   r@   r   r   r   rO   s  s    z#CertificateSigningRequest.signaturec                 C   s   dS )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr   r@   r   r   r   tbs_certrequest_bytesy  s    z/CertificateSigningRequest.tbs_certrequest_bytesc                 C   s   dS )z8
        Verifies signature of signing request.
        Nr   r@   r   r   r   ru     s    z,CertificateSigningRequest.is_signature_valid)r   r,   c                 C   s   dS )z:
        Get the attribute value for a given OID.
        Nr   )r   r   r   r   r   get_attribute_for_oid  s    z/CertificateSigningRequest.get_attribute_for_oidN)r   r    r!   r^   r_   rf   rg   rU   rW   rc   rY   r   rD   rb   r   rI   r   r`   rK   r   rM   r   r$   r   rh   ra   r]   rO   rw   ru   rx   r   r   r   r   rv   ;  s4   rv   )datar,   c                 C   s   t |}|| S r   )r   load_pem_x509_certificatery   backendr   r   r   rz     s    rz   c                 C   s   t |}|| S r   )r   load_der_x509_certificater{   r   r   r   r}     s    r}   c                 C   s   t |}|| S r   )r   load_pem_x509_csrr{   r   r   r   r~     s    r~   c                 C   s   t |}|| S r   )r   load_der_x509_csrr{   r   r   r   r     s    r   c                 C   s   t |}|| S r   )r   load_pem_x509_crlr{   r   r   r   r     s    r   c                 C   s   t |}|| S r   )r   load_der_x509_crlr{   r   r   r   r     s    r   c                   @   s`   e Zd Zdg g fddZedddZeeddd	Ze	e
d
ddZdeejedddZdS ) CertificateSigningRequestBuilderNc                 C   s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_name_extensions_attributes)r   subject_namer$   r(   r   r   r   r     s    z)CertificateSigningRequestBuilder.__init__namec                 C   s4   t |tstd| jdk	r$tdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)
isinstancer   	TypeErrorr   r%   r   r   r   r   r   r   r   r   r     s    

  z-CertificateSigningRequestBuilder.subject_nameextvalcriticalc                 C   sD   t |tstdt|j||}t|| j t| j| j|g | j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
r   r   r   r   r   r'   r   r   r   r   r   r   r   r#   r   r   r   add_extension  s    

z.CertificateSigningRequestBuilder.add_extension)r   valuec                 C   sL   t |tstdt |ts$tdt|| j t| j| j| j||fg S )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytes)	r   r   r   ra   r*   r   r   r   r   )r   r   r   r   r   r   add_attribute  s    

z.CertificateSigningRequestBuilder.add_attributeprivate_keyr;   r,   c                 C   s(   t |}| jdkrtd|| ||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subject)r   r   r%   Zcreate_x509_csrr   r   r;   r|   r   r   r   sign  s    	
z%CertificateSigningRequestBuilder.sign)N)r   r    r!   r   r   r   r   rg   r   r   ra   r   r   r   r`   rv   r   r   r   r   r   r     s    r   c                   @   s   e Zd Zddddddg fddZedddZedddZed	d
dZe	dddZ
ejdddZejdddZeedddZdeejedddZdS )CertificateBuilderNc                 C   s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r   )
r4   r6   _version_issuer_namer   _public_key_serial_number_not_valid_before_not_valid_afterr   )r   issuer_namer   rD   rA   rE   rF   r$   r   r   r   r     s    
zCertificateBuilder.__init__r   c                 C   sD   t |tstd| jdk	r$tdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)r   r   r   r   r%   r   r   r   r   r   r   r   r   r   r   r   r     s    

zCertificateBuilder.issuer_namec                 C   sD   t |tstd| jdk	r$tdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )r   r   r   r   r%   r   r   r   r   r   r   r   r   r   r   r   r     s    

zCertificateBuilder.subject_name)keyc                 C   sX   t |tjtjtjtjt	j
fs&td| jdk	r8tdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zhExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey or Ed448PublicKey.Nz$The public key may only be set once.)r   r   ZDSAPublicKeyr   ZRSAPublicKeyr	   ZEllipticCurvePublicKeyr
   ZEd25519PublicKeyr   ZEd448PublicKeyr   r   r%   r   r   r   r   r   r   r   )r   r   r   r   r   rD   )  s.    

zCertificateBuilder.public_keynumberc                 C   sh   t |tstd| jdk	r$td|dkr4td| dkrHtdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)r   rc   r   r   r%   
bit_lengthr   r   r   r   r   r   r   r   r   r   r   r   rA   K  s&    

z CertificateBuilder.serial_numberr+   c                 C   sz   t |tjstd| jdk	r&tdt|}|tk r>td| jdk	rZ|| jkrZtdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)r   r/   r   r   r%   r3   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r   r+   r   r   r   rE   f  s,    
z#CertificateBuilder.not_valid_beforec                 C   sz   t |tjstd| jdk	r&tdt|}|tk r>td| jdk	rZ|| jk rZtdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r   Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)r   r/   r   r   r%   r3   r   r   r   r   r   r   r   r   r   r   r   r   rF     s2    
z"CertificateBuilder.not_valid_afterr   c              	   C   sT   t |tstdt|j||}t|| j t| j| j	| j
| j| j| j| j|g S )z=
        Adds an X.509 extension to the certificate.
        r   )r   r   r   r   r   r'   r   r   r   r   r   r   r   r   r   r   r   r   r     s    

z CertificateBuilder.add_extensionr   c                 C   s   t |}| jdkrtd| jdkr,td| jdkr>td| jdkrPtd| jdkrbtd| jdkrttd|| ||S )zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key)	r   r   r%   r   r   r   r   r   Zcreate_x509_certificater   r   r   r   r     s    	





zCertificateBuilder.sign)N)r   r    r!   r   r   r   r   r   rD   rc   rA   r/   rE   rF   r   rg   r   r   r   r`   r9   r   r   r   r   r   r     s,   
"  r   c                   @   s   e Zd Zdddg g fddZedddZejddd	Zejd
ddZe	e
dddZedddZdeejedddZdS ) CertificateRevocationListBuilderNc                 C   s"   || _ || _|| _|| _|| _d S r   )r   _last_update_next_updater   _revoked_certificates)r   r   ro   rn   r$   Zrevoked_certificatesr   r   r   r     s
    z)CertificateRevocationListBuilder.__init__)r   c                 C   s<   t |tstd| jd k	r$tdt|| j| j| j| j	S )Nr   r   )
r   r   r   r   r%   r   r   r   r   r   )r   r   r   r   r   r     s    

z,CertificateRevocationListBuilder.issuer_name)ro   c                 C   sr   t |tjstd| jd k	r&tdt|}|tk r>td| jd k	rZ|| jkrZtdt| j	|| j| j
| jS )Nr   !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)r   r/   r   r   r%   r3   r   r   r   r   r   r   )r   ro   r   r   r   ro     s(    
z,CertificateRevocationListBuilder.last_update)rn   c                 C   sr   t |tjstd| jd k	r&tdt|}|tk r>td| jd k	rZ|| jk rZtdt| j	| j|| j
| jS )Nr   r   r   z8The next update date must be after the last update date.)r   r/   r   r   r%   r3   r   r   r   r   r   r   )r   rn   r   r   r   rn     s(    
z,CertificateRevocationListBuilder.next_updater   c                 C   sL   t |tstdt|j||}t|| j t| j| j	| j
| j|g | jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )r   r   r   r   r   r'   r   r   r   r   r   r   r   r   r   r   r     s    

z.CertificateRevocationListBuilder.add_extension)revoked_certificatec                 C   s2   t |tstdt| j| j| j| j| j|g S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	r   rj   r   r   r   r   r   r   r   )r   r   r   r   r   add_revoked_certificate/  s    

z8CertificateRevocationListBuilder.add_revoked_certificater   c                 C   sL   t |}| jd krtd| jd kr,td| jd kr>td|| ||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r   r   r%   r   r   Zcreate_x509_crlr   r   r   r   r   >  s    


z%CertificateRevocationListBuilder.sign)N)r   r    r!   r   r   r   r/   ro   rn   r   rg   r   rj   r   r   r   r`   rl   r   r   r   r   r   r     s"   
 r   c                   @   sZ   e Zd Zddg fddZedddZejddd	Zee	d
ddZ
dedddZdS )RevokedCertificateBuilderNc                 C   s   || _ || _|| _d S r   )r   _revocation_dater   )r   rA   rk   r$   r   r   r   r   R  s    z"RevokedCertificateBuilder.__init__r   c                 C   sX   t |tstd| jd k	r$td|dkr4td| dkrHtdt|| j| jS )Nr   r   r   z$The serial number should be positiver   r   )	r   rc   r   r   r%   r   r   r   r   r   r   r   r   rA   Y  s    

  z'RevokedCertificateBuilder.serial_numberr   c                 C   sN   t |tjstd| jd k	r&tdt|}|tk r>tdt| j|| j	S )Nr   z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
r   r/   r   r   r%   r3   r   r   r   r   r   r   r   r   rk   k  s    
  z)RevokedCertificateBuilder.revocation_dater   c                 C   sD   t |tstdt|j||}t|| j t| j| j	| j|g S )Nr   )
r   r   r   r   r   r'   r   r   r   r   r   r   r   r   r   y  s    

z'RevokedCertificateBuilder.add_extensionr?   c                 C   s6   t |}| jd krtd| jd kr,td|| S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r   r%   r   Zcreate_x509_revoked_certificate)r   r|   r   r   r   build  s    

zRevokedCertificateBuilder.build)N)r   r    r!   r   rc   rA   r/   rk   r   rg   r   rj   r   r   r   r   r   r   Q  s     
r   r?   c                   C   s   t tddd? S )N   bigr   )rc   
from_bytesosurandomr   r   r   r   random_serial_number  s    r   )N)N)N)N)N)N)9r^   r/   r   rd   enumr   Zcryptography.hazmat._typesr   r   Zcryptography.hazmat.backendsr   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r	   r
   r   r   Zcryptography.x509.extensionsr   r   r   Zcryptography.x509.namer   Zcryptography.x509.oidr   r   	Exceptionr   Listr'   Tuplera   r*   r3   r4   r7   ABCMetar9   rj   rl   rv   rz   r}   r~   r   r   r   rf   r   r   r   r   rc   r   r   r   r   r   <module>   sL    

klRF f{@