File: //opt/alt/python37/lib/python3.7/site-packages/asn1crypto/__pycache__/x509.cpython-37.opt-1.pyc
B
U�XDE � @ s� d Z ddlmZmZmZmZ ddlmZ ddlZddl Z ddl
Z
ddl Z ddl Z ddl
Z
ddlmZ ddlmZmZ ddlmZ dd lmZmZmZ dd
lmZmZ dd l m Z m Z m Z m Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7 dd l8m9Z9 dd
l:m;Z;m<Z<m=Z=m>Z> G dd� de%�Z?G dd� de%�Z@G dd� de%�ZAG dd� de+�ZBG dd� de.�ZCG dd� de/�ZDG dd� de �ZEG d d � d e.�ZFG d d � d e!�ZGG d d!� d!e)�ZHG d"d#� d#e.�ZIG d$d%� d%e1�ZJG d&d'� d'e/�ZKG d(d)� d)e!�ZLG d*d+� d+e.�ZMG d,d-� d-e!�ZNG d.d/� d/e!�ZOG d0d1� d1e!�ZPG d2d3� d3e0�ZQG d4d5� d5e0�ZRG d6d7� d7e/�ZSG d8d9� d9e/�ZTG d:d;� d;e.�ZUG d<d=� d=e.�ZVG d>d?� d?e/�ZWG d@dA� dAe.�ZXG dBdC� dCe/�ZYG dDdE� dEe!�ZZG dFdG� dGe!�Z[G dHdI� dIe0�Z\G dJdK� dKe/�Z]G dLdM� dMe0�Z^G dNdO� dOe.�Z_G dPdQ� dQe1�Z`G dRdS� dSe.�ZaG dTdU� dUe!�ZbG dVdW� dWe&�ZcG dXdY� dYe&�ZdG dZd[� d[e.�ZeG d\d]� d]e/�ZfG d^d_� d_e.�ZgG d`da� dae.�ZhG dbdc� dce!�ZiG ddde� dee/�ZjG dfdg� dge!�ZkG dhdi� die.�ZlG djdk� dke.�ZmG dldm� dme.�ZnG dndo� doe!�ZoG dpdq� dqe �ZpG drds� dse.�ZqG dtdu� due/�ZrG dvdw� dwe.�ZsG dxdy� dye.�ZtG dzd{� d{e/�ZuG d|d}� d}e!�ZvG d~d� de/�ZwG d�d�� d�e.�ZxG d�d�� d�e.�ZyG d�d�� d�e)�ZzG d�d�� d�e.�Z{G d�d�� d�e/�Z|G d�d�� d�e)�Z}G d�d�� d�e.�Z~G d�d�� d�e/�ZG d�d�� d�e.�Z�G d�d�� d�e/�Z�G d�d�� d�e.�Z�G d�d�� d�e)�Z�G d�d�� d�e/�Z�G d�d�� d�e)�Z�G d�d�� d�e.�Z�G d�d�� d�e/�Z�G d�d�� d�e/�Z�G d�d�� d�e/�Z�G d�d�� d�e.�Z�G d�d�� d�e �Z�G d�d�� d�e)�Z�G d�d�� d�e.�Z�G d�d�� d�e/�Z�G d�d�� d�e&�Z�G d�d�� d�e.�Z�G d�d�� d�e.�Z�G d�d�� d�e/�Z�G d�d�� d�e/�Z�G d�d�� d�e.�Z�G d�d�� d�e"�Z�dS )�z�
ASN.1 type classes for X.509 certificates. Exports the following items:
- Attributes()
- Certificate()
- Extensions()
- GeneralName()
- GeneralNames()
- Name()
Other type classes are defined that help compose the types listed above.
� )�unicode_literals�division�absolute_import�print_function)�idnaN� )�unwrap)�
iri_to_uri�
uri_to_iri)� OrderedDict)� type_name�str_cls�
bytes_to_list)�AlgorithmIdentifier�SignedDigestAlgorithm)�Any� BitString� BMPString�Boolean�Choice�Concat�GeneralizedTime�
GeneralString� IA5String�Integer�Null�
NumericString�ObjectIdentifier�OctetBitString� OctetString�ParsableOctetString�PrintableString�Sequence�
SequenceOf�Set�SetOf�
TeletexString�UniversalString�UTCTime�
UTF8String�
VisibleString�VOID)�
PublicKeyInfo)� int_to_bytes�int_from_bytes� inet_ntop� inet_ptonc @ s, e Zd ZdZdZdd� Zdd� Zdd� Zd S )
�DNSNamer � c C s
| |k S )N� )�self�otherr3 r3 �@/opt/alt/python37/lib/python3.7/site-packages/asn1crypto/x509.py�__ne__J s zDNSName.__ne__c C s& t |t�sdS | �� �� |�� �� kS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2
:param other:
Another DNSName object
:return:
A boolean
F)�
isinstancer1 � __unicode__�lower)r4 r5 r3 r3 r6 �__eq__M s
zDNSName.__eq__c C sx t |t�s"ttdt| �t|����|�d�rFd|dd� �| j� }n |�| j�}|| _|| _ d| _
| j dkrtd| _ dS )zd
Sets the value of the DNS name
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
�.� .r N� ) r8 r
� TypeErrorr r �
startswith�encode� _encoding�_unicode�contents�_header�_trailer)r4 �value�
encoded_valuer3 r3 r6 �set] s
z DNSName.setN)�__name__�
__module__� __qualname__rB Z_bad_tagr7 r; rI r3 r3 r3 r6 r1 E s
r1 c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S )
�URIc C sL t |t�s"ttdt| �t|����|| _t|�| _d| _| j dkrHd| _ dS )zb
Sets the value of the string
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
Nr> )
r8 r
r? r r rC r rD rE rF )r4 rG r3 r3 r6 rI | s
zURI.setc C s
| |k S )Nr3 )r4 r5 r3 r3 r6 r7 � s z
URI.__ne__c C s" t |t�sdS t| j�t|j�kS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4
:param other:
Another URI object
:return:
A boolean
F)r8 rM r �native)r4 r5 r3 r3 r6 r; � s
z
URI.__eq__c C s, | j dkrdS | jdkr&t| �� �| _| jS )z7
:return:
A unicode string
N� )rD rC r
�
_merge_chunks)r4 r3 r3 r6 r9 � s
zURI.__unicode__N)rJ rK rL rI r7 r; r9 r3 r3 r3 r6 rM z s rM c @ sN e Zd ZdZdZedd� �Zejdd� �Zdd� Zdd � Z d
d � Z
d d
� Z dS )� EmailAddressNFc C s | j S )z`
:return:
A byte string of the DER-encoded contents of the sequence
)� _contents)r4 r3 r3 r6 rD � s zEmailAddress.contentsc C s d| _ || _dS )ze
:param value:
A byte string of the DER-encoded contents of the sequence
FN)� _normalizedrR )r4 rG r3 r3 r6 rD � s c C s� t |t�s"ttdt| �t|����|�d�dkrZ|�dd�\}}|�d�d |�d� }n
|�d�}d| _|| _ || _
d | _ | j d
kr�d
| _ d S ) zb
Sets the value of the string
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
�@���r �ascii� @r TNr> )
r8 r
r? r r �find�rsplitrA rS rC rD rE rF )r4 rG �mailbox�hostnamerH r3 r3 r6 rI � s
zEmailAddress.setc C s^ | j dkrX| �� }|�d�dkr.|�d�| _ n*|�dd�\}}|�d�d |�d� | _ | j S )z7
:return:
A unicode string
NrW rU rV r rT r )rC rP rX �decoderY )r4 rD rZ r[ r3 r3 r6 r9 � s
zEmailAddress.__unicode__c C s
| |k S )Nr3 )r4 r5 r3 r3 r6 r7 � s zEmailAddress.__ne__c C s� t |t�sdS | js | �| j� |js2|�|j� | j�d�dksR|j�d�dkr^| j|jkS |j�dd�\}}| j�dd�\}}||kr�dS |�� |�� kr�dS dS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5
:param other:
Another EmailAddress object
:return:
A boolean
FrW rU r T) r8 rQ rS rI rN rR rX rY r: )r4 r5 Z
other_mailboxZother_hostnamerZ r[ r3 r3 r6 r; � s
zEmailAddress.__eq__) rJ rK rL rR rS �propertyrD �setterrI r9 r7 r; r3 r3 r3 r6 rQ � s
rQ c @ s: e Zd Zd dd�Zdd� Zedd� �Zdd � Zd
d � ZdS )
� IPAddressNc C s t td���dS )z?
This method is not applicable to IP addresses
z=
IP address values can not be parsed
N)�
ValueErrorr )r4 �specZ spec_paramsr3 r3 r6 �parse s zIPAddress.parsec
C sT t |t�s"ttdt| �t|����|}|�d�dk}d}|rv|�dd�}|d }t|d �}|dk rvttdt| ����|�d�dkr�t j
}|dkr�ttd t| ����d}n$t j }|d
kr�ttd t| ����d
}d }|�rd
| } | d|t | � 7 } t
t| d��}d|d t |� | }|| _t||�| | _| j| _d| _| jd k�rPd | _dS )z�
Sets the value of the object
:param value:
A unicode string containing an IPv4 address, IPv4 address with CIDR,
an IPv6 address or IPv6 address with CIDR
zK
%s value must be a unicode string, not %s
�/rU r r zT
%s value contains a CIDR range less than 0
�:� z�
%s value contains a CIDR range bigger than 128, the maximum
value for an IPv6 address
� z�
%s value contains a CIDR range bigger than 32, the maximum
value for an IPv4 address
r> �1�0� � � N)r8 r
r? r r rX �split�intr` �socket�AF_INET6�AF_INET�lenr- �_nativer0 rD Z_bytesrE rF )
r4 rG �original_valueZhas_cidr�cidr�parts�familyZ cidr_sizeZ
cidr_bytesZ cidr_maskr3 r3 r6 rI + sR
z
IPAddress.setc C s� | j dkrdS | jdkr�| �� }t|�}d}|tddg�krjttj|dd� �}|dkr�t|dd� �}n<|tddg�kr�ttj |dd� �}|dkr�t|dd� �}|dk r�d�
|�}t|� d��}|d t |� }|| _| jS )
z�
The a native Python datatype representation of this value
:return:
A unicode string or None
Nrf � r rk � z{0:b}rh rc )
rD rr � __bytes__rq rI r/ rn ro r. rp �format�rstripr
)r4 Z byte_stringZbyte_lenZcidr_intrG Z cidr_bitsrt r3 r3 r6 rN r s(
zIPAddress.nativec C s
| |k S )Nr3 )r4 r5 r3 r3 r6 r7 � s zIPAddress.__ne__c C s t |t�sdS | �� |�� kS )zl
:param other:
Another IPAddress object
:return:
A boolean
F)r8 r_ ry )r4 r5 r3 r3 r6 r; � s
zIPAddress.__eq__)NN) rJ rK rL rb rI r] rN r7 r; r3 r3 r3 r6 r_ s
G r_ c @ s" e Zd ZdefdedeifgZdS )� Attribute�type�valuesra N)rJ rK rL r r% r �_fieldsr3 r3 r3 r6 r| � s r| c @ s e Zd ZeZdS )�
AttributesN)rJ rK rL r| � _child_specr3 r3 r3 r6 r� � s r� c
@ s$ e Zd Zddddddddd d
� Zd S ) �KeyUsageZdigital_signatureZnon_repudiationZkey_enciphermentZdata_enciphermentZ
key_agreementZ
key_cert_signZcrl_signZ
encipher_onlyZ
decipher_only) r r ri � rx � � � rk N)rJ rK rL �_mapr3 r3 r3 r6 r� � s r� c @ s0 e Zd Zdedddd�fdedddd�fgZdS ) �PrivateKeyUsagePeriod�
not_before�implicitr T)�tag_type�tag�optional� not_afterr N)rJ rK rL r r r3 r3 r3 r6 r� � s r� c @ s4 e Zd ZdefdefdefdefdefdefgZ dS )�DirectoryString�teletex_string�printable_stringZuniversal_string� utf8_string�
bmp_string�
ia5_stringN)
rJ rK rL r& r! r' r) r r �
_alternativesr3 r3 r3 r6 r� � s r� c @ s� e Zd Zddddddddd d
d d d
ddddddddddddddd �Zdddd ddd ddddd d
ddddddddd
ddddgZed d � �Zed d � �Zd!S )"�NameType� common_name�surname�
serial_number� country_name�
locality_name�state_or_province_name�street_address�organization_name�organizational_unit_name�title�business_category� postal_code�telephone_number�name�
given_name�initials�generation_qualifier�unique_identifier� dn_qualifier� pseudonym�organization_identifier�
email_address�incorporation_locality� incorporation_state_or_province�incorporation_country�domain_component�name_distinguisher)z2.5.4.3z2.5.4.4z2.5.4.5z2.5.4.6z2.5.4.7z2.5.4.8z2.5.4.9z2.5.4.10z2.5.4.11z2.5.4.12z2.5.4.15z2.5.4.17z2.5.4.20z2.5.4.41z2.5.4.42z2.5.4.43z2.5.4.44z2.5.4.45z2.5.4.46z2.5.4.65z2.5.4.97z1.2.840.113549.1.9.1z1.3.6.1.4.1.311.60.2.1.1z1.3.6.1.4.1.311.60.2.1.2z1.3.6.1.4.1.311.60.2.1.3z0.9.2342.19200300.100.1.25z0.2.262.1.10.7.20c C s4 | � |�}|| jkr"| j�|�}n
t| j�}||fS )z�
Returns an ordering value for a particular attribute key.
Unrecognized attributes and OIDs will be sorted lexically at the end.
:return:
An orderable value.
)�map�preferred_order�indexrq )�clsZ attr_nameZordinalr3 r3 r6 �preferred_ordinal s
zNameType.preferred_ordinalc C sH ddddddddd d
d d d
ddddddddddddddd �� | j| j�S ) zZ
:return:
A human-friendly unicode string to display to users
z Common NameZSurnamez
Serial Number�CountryZLocalityzState/ProvincezStreet AddressZ OrganizationzOrganizational UnitZTitlezBusiness Categoryz Postal CodezTelephone Number�Namez
Given NameZInitialszGeneration QualifierzUnique Identifierz DN QualifierZ Pseudonymz
Email AddresszIncorporation Localityz Incorporation State/ProvincezIncorporation CountryzDomain ComponentzName DistinguisherzOrganization Identifier)r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� )�getrN )r4 r3 r3 r6 �human_friendly& s8 zNameType.human_friendlyN) rJ rK rL r� r� � classmethodr� r] r� r3 r3 r3 r6 r� � sn r� c @ s� e Zd ZdefdefgZdZeeeeeeeeeeeeeeeeee eee
eeee eed�Z dZ
edd� �Zdd � Zd
d � Zd d
� ZdS )�NameTypeAndValuer} rG )r} rG )r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� Nc C s" | j dkr | �| d j�| _ | j S )z�
Returns the value after being processed by the internationalized string
preparation as specified by RFC 5280
:return:
A unicode string
NrG )�_prepped�_ldap_string_preprN )r4 r3 r3 r6 �
prepped_valueu s
z NameTypeAndValue.prepped_valuec C s
| |k S )Nr3 )r4 r5 r3 r3 r6 r7 � s zNameTypeAndValue.__ne__c C s2 t |t�sdS |d j| d jkr&dS |j| jkS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another NameTypeAndValue object
:return:
A boolean
Fr} )r8 r� rN r� )r4 r5 r3 r3 r6 r; � s
zNameTypeAndValue.__eq__c C s� t �dd|�}t �dd|�}tjdkr6t �dd|�}nt �dd|�}t �dd|�}|�d d�}t �d
d|�}d�ttj|��}t �
d |�}x�|D ]�}t� |�r�t t
d ���t�|�r�t t
d
���t�|�r�t t
d���t�|�r�t t
d���t�|��rt t
d���|dkr�t t
d���q�W d}d}x0|D ](}t�|��r@d}nt�|��r*d}�q*W |�r�t�|d �}t�|d �}|�s�|�r�|�s�t t
d���dt �dd|��� d }|S )a"
Implements the internationalized string preparation algorithm from
RFC 4518. https://tools.ietf.org/html/rfc4518#section-2
:param string:
A unicode string to prepare
:return:
A prepared unicode string, ready for comparison
u [᠆͏᠋-᠍️-]+rO u [
]� i�� u �[�-�]|�[�-�]|u [--]u? [ -- -------]+u u [ -
-
]ZNFKCzc
X.509 Name objects may not contain unassigned code points
z�
X.509 Name objects may not contain change display or
zzzzdeprecated characters
zc
X.509 Name objects may not contain private use characters
zf
X.509 Name objects may not contain non-character code points
zb
X.509 Name objects may not contain surrogate code points
u �zf
X.509 Name objects may not contain the replacement character
FTr rU z{
X.509 Name object contains a malformed bidirectional
sequence
z +z )�re�sub�sys�
maxunicode�replace�joinr� �
stringprepZ map_table_b2� unicodedataZ normalizeZ in_table_a1r` r Z in_table_c8Z in_table_c3Z in_table_c4Z in_table_c5Z in_table_d1Z in_table_d2�strip)r4 �string�charZhas_r_and_al_catZ has_l_catZfirst_is_r_and_alZlast_is_r_and_alr3 r3 r6 r� � s^
z"NameTypeAndValue._ldap_string_prep)rJ rK rL r� r r � _oid_pairr� r! r rQ r1 �
_oid_specsr� r] r� r7 r; r� r3 r3 r3 r6 r� L sF
r� c @ s< e Zd ZeZedd� �Zdd� Zdd� Zdd� Z d d
� Z
d S ) �RelativeDistinguishedNamec C sD g }| � | �}x*t|�� �D ]}|�d||| f � q W d�|�S )zb
:return:
A unicode string that can be used as a dict key or in a set
z%s: %s� )� _get_values�sorted�keys�appendr� )r4 �outputr~ �keyr3 r3 r6 �hashable s
z"RelativeDistinguishedName.hashablec C s
| |k S )Nr3 )r4 r5 r3 r3 r6 r7 s z RelativeDistinguishedName.__ne__c C s| t |t�sdS t| �t|�kr"dS | �| �}| �|�}||krBdS | �| �}| �|�}x |D ]}|| || kr\dS q\W dS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another RelativeDistinguishedName object
:return:
A boolean
FT)r8 r� rq �
_get_typesr� )r4 r5 Z
self_typesZ other_typesZ self_valuesZ other_valuesZ
type_name_r3 r3 r6 r; s
z RelativeDistinguishedName.__eq__c C s t dd� |D ��S )z�
Returns a set of types contained in an RDN
:param rdn:
A RelativeDistinguishedName object
:return:
A set object with unicode strings of NameTypeAndValue type field
values
c S s g | ]}|d j �qS )r} )rN )�.0�ntvr3 r3 r6 �
<listcomp>H s z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rI )r4 �rdnr3 r3 r6 r� < s z$RelativeDistinguishedName._get_typesc s i � � fdd�|D � � S )a$
Returns a dict of prepped values contained in an RDN
:param rdn:
A RelativeDistinguishedName object
:return:
A dict object with unicode strings of NameTypeAndValue value field
values that have been prepped for comparison
c s$ g | ] }� � |d j|jfg��qS )r} )�updaterN r� )r� r� )r� r3 r6 r� W s z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r3 )r4 r� r3 )r� r6 r� J s z%RelativeDistinguishedName._get_valuesN) rJ rK rL r� r� r] r� r7 r; r� r� r3 r3 r3 r6 r� s r� c @ s, e Zd ZeZedd� �Zdd� Zdd� ZdS )� RDNSequencec C s d� dd� | D ��S )zb
:return:
A unicode string that can be used as a dict key or in a set
� c s s | ] }|j V qd S )N)r� )r� r� r3 r3 r6 � <genexpr>h s z'RDNSequence.hashable.<locals>.<genexpr>)r� )r4 r3 r3 r6 r� ^ s
zRDNSequence.hashablec C s
| |k S )Nr3 )r4 r5 r3 r3 r6 r7 j s zRDNSequence.__ne__c C sL t |t�sdS t| �t|�kr"dS x$t| �D ]\}}|| |kr,dS q,W dS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another RDNSequence object
:return:
A boolean
FT)r8 r� rq � enumerate)r4 r5 r� Zself_rdnr3 r3 r6 r; m s
zRDNSequence.__eq__N) rJ rK rL r� r� r] r� r7 r; r3 r3 r3 r6 r� [ s r� c @ s� e Zd ZdefgZdZdZdZeddd��Z e
dd� �Z dd � Z d
d � Z
d d
� Ze
dd� �Ze
dd� �Zdd� Ze
dd� �Ze
dd� �ZdS )r� rO NFc C s� g }|sd}t }nd}t}tt|�� dd� d��}x�|�� D ]�\}}t�|�}|dkr`t|�}nF|dkrrt|�}n4|t dd d
g�kr�t
dt|�d �}nt
|||�d �}|� t t
||d ��g�� q<W | d
t|�d �S )aS
Creates a Name object from a dict of unicode string keys and values.
The keys should be from NameType._map, or a dotted-integer OID unicode
string.
:param name_dict:
A dict of name information, e.g. {"common_name": "Will Bond",
"country_name": "US", "organization": "Codex Non Sufficit LC"}
:param use_printable:
A bool - if PrintableString should be used for encoding instead of
UTF8String. This is for backwards compatiblity with old software.
:return:
An x509.Name object
r� r� c S s t �| d �S )Nr )r� r� )�itemr3 r3 r6 �<lambda>� r> z Name.build.<locals>.<lambda>)r� r� r� r� r� r� )r� rG )r} rG rO )r) r! r r� �itemsr� r� rQ r1 rI r� r� r� r� r� ) r� Z name_dictZ
use_printableZrdnsZ
encoding_nameZencoding_class�attribute_nameZattribute_valuerG r3 r3 r6 �build� s8
z
Name.buildc C s | j jS )zb
:return:
A unicode string that can be used as a dict key or in a set
)�chosenr� )r4 r3 r3 r6 r� � s z
Name.hashablec C s
t | j�S )N)rq r� )r4 r3 r3 r6 �__len__� s z Name.__len__c C s
| |k S )Nr3 )r4 r5 r3 r3 r6 r7 � s z Name.__ne__c C s t |t�sdS | j|jkS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another Name object
:return:
A boolean
F)r8 r� r� )r4 r5 r3 r3 r6 r; � s
z Name.__eq__c C s� | j d kr�t� | _ xr| jjD ]f}x`|D ]X}|d }|| j krp| j | }t|t�s`|g }| j |< |�|d � q&|d | j |< q&W q W | j S )Nr} rG )rr r r� rN r8 �listr� )r4 r� �type_val�
field_nameZexistingr3 r3 r6 rN � s
z Name.nativec C s | j dk�rt� }d}x`| jD ]V}xP|D ]H}|d j}|}||krd|| g||< || �|d � q(|d ||< q(W q W g }|�� }|dkr�tt|��}x0|D ](}|| } | �| �}
|�d||
f � q�W d} x |D ]} | � d�dkr�d } P q�W | s�d
nd }
|
�
|ddd� �| _ | j S ) zg
:return:
A human-friendly unicode string containing the parts of the name
Nr} rG r� z%s: %sF�,rU Tz, z; ) �_human_friendlyr r� r� r� r� �reversedr� �_recursive_humanizerX r� )r4 �dataZ
last_fieldr� r� r� Zto_joinr� r� rG Z native_valueZ has_commaZelementZ separatorr3 r3 r6 r� � s6
zName.human_friendlyc s, t |t�r&d�t� fdd�|D ���S |jS )z�
Recursively serializes data compiled from the RDNSequence
:param value:
An Asn1Value object, or a list of Asn1Value objects
:return:
A unicode string
z, c s g | ]}� � |��qS r3 )r� )r� Z sub_value)r4 r3 r6 r� - s z,Name._recursive_humanize.<locals>.<listcomp>)r8 r� r� r� rN )r4 rG r3 )r4 r6 r� s
zName._recursive_humanizec C s$ | j dkr t�| �� ��� | _ | j S )zZ
:return:
The SHA1 hash of the DER-encoded bytes of this name
N)�_sha1�hashlib�sha1�dump�digest)r4 r3 r3 r6 r� 1 s
z Name.sha1c C s$ | j dkr t�| �� ��� | _ | j S )z]
:return:
The SHA-256 hash of the DER-encoded bytes of this name
N)�_sha256r� �sha256r� r� )r4 r3 r3 r6 r� < s
z Name.sha256)F)rJ rK rL r� r� r� r� r� r� r� r] r� r� r7 r; rN r� r� r� r� r3 r3 r3 r6 r� � s
< ' r� c @ s$ e Zd Zdefdeddd�fgZdS )� AnotherNameZtype_idrG �explicitr )r� r� N)rJ rK rL r r r r3 r3 r3 r6 r� H s r� c @ s$ e Zd ZdZdZdefdefgZdS )� CountryNamer �
x121_dcc_code�iso_3166_alpha2_codeN)rJ rK rL �class_r� r r! r� r3 r3 r3 r6 r� O s r� c @ s$ e Zd ZdZdZdefdefgZdS )�AdministrationDomainNamer ri �numeric� printableN)rJ rK rL r� r� r r! r� r3 r3 r3 r6 r� Y s r� c @ s e Zd ZdefdefgZdS )�PrivateDomainNamer� r� N)rJ rK rL r r! r� r3 r3 r3 r6 r c s r c @ sN e Zd Zdeddd�fdedddd�fd edd
dd�fd edd dd�fgZd
S )� PersonalNamer� r� r )r� r� r� r T)r� r� r� r� ri r� r� N)rJ rK rL r! r r3 r3 r3 r6 r j s r c @ sN e Zd Zdeddd�fdedddd�fd edd
dd�fd edd dd�fgZd
S )�TeletexPersonalNamer� r� r )r� r� r� r T)r� r� r� r� ri r� r� N)rJ rK rL r& r r3 r3 r3 r6 r s s r c @ s e Zd ZeZdS )�OrganizationalUnitNamesN)rJ rK rL r! r� r3 r3 r3 r6 r | s r c @ s e Zd ZeZdS )� TeletexOrganizationalUnitNamesN)rJ rK rL r& r� r3 r3 r3 r6 r � s r c @ s� e Zd Zdeddifdeddifdedddd�fd edd
dd�fd ed d
dd�fdedddd�fdedddd�fdedddd�fde dddd�fg Z
dS )�BuiltInStandardAttributesr� r� TZadministration_domain_nameZnetwork_addressr� r )r� r� r� Zterminal_identifierr Zprivate_domain_namer� ri r� r� Znumeric_user_identifierrx Z
personal_namer� Zorganizational_unit_namesr� N) rJ rK rL r� r� r r! r r r r r3 r3 r3 r6 r � s r c @ s e Zd ZdefdefgZdS )� BuiltInDomainDefinedAttributer} rG N)rJ rK rL r! r r3 r3 r3 r6 r � s r c @ s e Zd ZeZdS )� BuiltInDomainDefinedAttributesN)rJ rK rL r r� r3 r3 r3 r6 r � s r c @ s e Zd ZdefdefgZdS )� TeletexDomainDefinedAttributer} rG N)rJ rK rL r& r r3 r3 r3 r6 r � s r c @ s e Zd ZeZdS )� TeletexDomainDefinedAttributesN)rJ rK rL r r� r3 r3 r3 r6 r � s r c @ s e Zd ZdefdefgZdS )�PhysicalDeliveryCountryNamer� r� N)rJ rK rL r r! r� r3 r3 r3 r6 r
� s r
c @ s e Zd ZdefdefgZdS )�
PostalCodeZ numeric_codeZprintable_codeN)rJ rK rL r r! r� r3 r3 r3 r6 r � s r c @ s( e Zd ZdeddifdeddifgZdS )� PDSParameterr� r� Tr� N)rJ rK rL r! r& r r3 r3 r3 r6 r � s r c @ s e Zd ZeZdS )�PrintableAddressN)rJ rK rL r! r� r3 r3 r3 r6 r
� s r
c @ s( e Zd ZdeddifdeddifgZdS )�UnformattedPostalAddressZprintable_addressr� Tr� N)rJ rK rL r
r& r r3 r3 r3 r6 r � s r c @ s. e Zd Zdeddd�fdedddd�fgZd S )
� E1634AddressZnumberr� r )r� r� Z sub_addressr T)r� r� r� N)rJ rK rL r r r3 r3 r3 r6 r � s r c @ s e Zd ZeZdS )�
NAddressesN)rJ rK rL r r� r3 r3 r3 r6 r � s r c @ sN e Zd Zdedddd�fdedddd�fdedd dd�fd
edd d �fgZd
S )�PresentationAddressZ
p_selectorr� r T)r� r� r� Z
s_selectorr Z
t_selectorri Z n_addressesr� )r� r� N)rJ rK rL r r r r3 r3 r3 r6 r � s r c @ s$ e Zd Zdefdeddd�fgZdS )�ExtendedNetworkAddressZe163_4_addressZ psap_addressr� r )r� r� N)rJ rK rL r r r� r3 r3 r3 r6 r � s r c @ s e Zd Zddddddd�ZdS ) � TerminalTypeZtelexZteletexZ g3_facsimileZ g4_facsimileZ ia5_terminalZvideotex)r� rx r� r� r� rk N)rJ rK rL r� r3 r3 r3 r6 r � s r c @ s@ e Zd Zddddddddd d
d d d
ddddddddddd�ZdS )�ExtensionAttributeTyper� �teletex_common_name�teletex_organization_name�teletex_personal_name� teletex_organization_unit_names�!teletex_domain_defined_attributes�pds_name� physical_delivery_country_namer� � physical_delivery_office_name� physical_delivery_office_number� extension_of_address_components� physical_delivery_personal_name�#physical_delivery_organization_name�.extension_physical_delivery_address_components�unformatted_postal_addressr� �post_office_box_address�poste_restante_address�unique_postal_name�local_postal_attributes�extended_network_address�
terminal_type)r ri r� rx r� r� r� rk � �
� � �
� � rw � � r2 � � � � N)rJ rK rL r� r3 r3 r3 r6 r � s. r c @ sd e Zd Zdeddd�fdeddd�fgZdZeeee e
e ee e
eeeeeeeeeeeeeed �Zd
S ) �ExtensionAttribute�extension_attribute_typer� r )r� r� �extension_attribute_valuer� r )r7 r8 )r� r r r r r r r r� r r r r r r! r" r� r# r$ r% r& r' r( N)rJ rK rL r r r r� r! r& r r r r
r r r r r r� r3 r3 r3 r6 r6
s4 r6 c @ s e Zd ZeZdS )�ExtensionAttributesN)rJ rK rL r6 r� r3 r3 r3 r6 r9 , s r9 c @ s. e Zd ZdefdeddifdeddifgZdS )� ORAddressZ built_in_standard_attributesZ"built_in_domain_defined_attributesr� TZextension_attributesN)rJ rK rL r r r9 r r3 r3 r3 r6 r: 0 s r: c @ s. e Zd Zdedddd�fdeddd�fgZd S )
� EDIPartyNameZ
name_assignerr� r T)r� r� r� Z
party_namer )r� r� N)rJ rK rL r� r r3 r3 r3 r6 r; 8 s r; c
@ s� e Zd Zdeddd�fdeddd�fdeddd�fd edd
d�fd ed d
d�fdeddd�fde ddd�fde
ddd�fde ddd�fg Z dd� Z
dd� ZdS )� GeneralName�
other_namer� r )r� r� Z rfc822_namer �dns_nameri � x400_addressr� Zdirectory_namer� rx �edi_party_namer� �uniform_resource_identifierr� �
ip_addressr� Z
registered_idrk c C s
| |k S )Nr3 )r4 r5 r3 r3 r6 r7 L s zGeneralName.__ne__c C sP | j dkrttd| j ���|j dkr4ttd|j ���| j |j krDdS | j|jkS )z�
Does not support other_name, x400_address or edi_party_name
:param other:
The other GeneralName to compare to
:return:
A boolean
)r= r? r@ zr
Comparison is not supported for GeneralName objects of
choice %s
za
Comparison is not supported for GeneralName objects of choice
%sF)r� r` r r� )r4 r5 r3 r3 r6 r; O s
zGeneralName.__eq__N)rJ rK rL r� rQ r1 r: r� r; rM r_ r r� r7 r; r3 r3 r3 r6 r< ? s r< c @ s e Zd ZeZdS )� GeneralNamesN)rJ rK rL r< r� r3 r3 r3 r6 rC q s rC c @ s e Zd ZdefdefgZdS )�TimeZutc_timeZ general_timeN)rJ rK rL r( r r� r3 r3 r3 r6 rD u s rD c @ s e Zd ZdefdefgZdS )�Validityr� r� N)rJ rK rL rD r r3 r3 r3 r6 rE | s rE c @ s( e Zd ZdeddifdeddifgZdS )�BasicConstraints�ca�defaultF�path_len_constraintr� TN)rJ rK rL r r r r3 r3 r3 r6 rF � s rF c @ s@ e Zd Zdedddd�fdedddd�fdedd dd�fgZd
S ) �AuthorityKeyIdentifier�key_identifierr� r T)r� r� r� �authority_cert_issuerr � authority_cert_serial_numberri N)rJ rK rL r rC r r r3 r3 r3 r6 rJ � s rJ c @ s, e Zd Zdeddd�fdeddd�fgZdS )�DistributionPointName� full_namer� r )r� r� �name_relative_to_crl_issuerr N)rJ rK rL rC r� r� r3 r3 r3 r6 rN � s rN c
@ s$ e Zd Zddddddddd d
� Zd S ) � ReasonFlagsZunusedZkey_compromiseZ
ca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZ
aa_compromise) r r ri r� rx r� r� r� rk N)rJ rK rL r� r3 r3 r3 r6 rQ � s rQ c @ s6 e Zd Zdefdedddd�fdedddd �fgZd
S ) �GeneralSubtree�baseZminimumr� r )r� r� rH Zmaximumr T)r� r� r� N)rJ rK rL r< r r r3 r3 r3 r6 rR � s rR c @ s e Zd ZeZdS )�GeneralSubtreesN)rJ rK rL rR r� r3 r3 r3 r6 rT � s rT c @ s0 e Zd Zdedddd�fdedddd�fgZdS ) �NameConstraintsZpermitted_subtreesr� r T)r� r� r� Zexcluded_subtreesr N)rJ rK rL rT r r3 r3 r3 r6 rU � s rU c @ sP e Zd Zdedddd�fdedddd�fd edd
dd�fgZd Zed d
� �Z dS )�DistributionPoint�distribution_pointr� r T)r� r� r� Zreasonsr� r Z
crl_issuerri Fc C sl | j dkrfd| _ | d }|jdkr.ttd���x6|jD ],}|jdkr6|j}|dd� d kr6|| _ P q6W | j S )
z_
:return:
None or a unicode string of the distribution point's URL
FNrW rO z�
CRL distribution points that are relative to the issuer are
not supported
rA r r� zhttp://)�_urlr� r` r r� rN )r4 r� � general_name�urlr3 r3 r6 rZ � s
zDistributionPoint.urlN)
rJ rK rL rN rQ rC r rX r] rZ r3 r3 r3 r6 rV � s
rV c @ s e Zd ZeZdS )�CRLDistributionPointsN)rJ rK rL rV r� r3 r3 r3 r6 r[ � s r[ c @ s( e Zd ZdefdefdefdefgZdS )� DisplayTextr� Zvisible_stringr� r� N)rJ rK rL r r* r r) r� r3 r3 r3 r6 r\ � s r\ c @ s e Zd ZeZdS )�
NoticeNumbersN)rJ rK rL r r� r3 r3 r3 r6 r] � s r] c @ s e Zd ZdefdefgZdS )�NoticeReferenceZ organizationZnotice_numbersN)rJ rK rL r\ r] r r3 r3 r3 r6 r^ � s r^ c @ s( e Zd ZdeddifdeddifgZdS )�
UserNoticeZ
notice_refr� TZ
explicit_textN)rJ rK rL r^ r\ r r3 r3 r3 r6 r_ � s r_ c @ s e Zd Zddd�ZdS )�PolicyQualifierId� certification_practice_statement� user_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2N)rJ rK rL r� r3 r3 r3 r6 r` � s r` c @ s* e Zd ZdefdefgZdZeed�Z dS )�PolicyQualifierInfo�policy_qualifier_id� qualifier)rd re )ra rb N)
rJ rK rL r` r r r� r r_ r� r3 r3 r3 r6 rc s
rc c @ s e Zd ZeZdS )�PolicyQualifierInfosN)rJ rK rL rc r� r3 r3 r3 r6 rf s rf c @ s e Zd ZddiZdS )�PolicyIdentifierz 2.5.29.32.0Z
any_policyN)rJ rK rL r� r3 r3 r3 r6 rg s rg c @ s" e Zd ZdefdeddifgZdS )�PolicyInformationZpolicy_identifierZpolicy_qualifiersr� TN)rJ rK rL rg rf r r3 r3 r3 r6 rh s rh c @ s e Zd ZeZdS )�CertificatePoliciesN)rJ rK rL rh r� r3 r3 r3 r6 ri # s ri c @ s e Zd ZdefdefgZdS )�
PolicyMappingZissuer_domain_policyZsubject_domain_policyN)rJ rK rL rg r r3 r3 r3 r6 rj ' s rj c @ s e Zd ZeZdS )�PolicyMappingsN)rJ rK rL rj r� r3 r3 r3 r6 rk . s rk c @ s0 e Zd Zdedddd�fdedddd�fgZdS ) �PolicyConstraintsZrequire_explicit_policyr� r T)r� r� r� Zinhibit_policy_mappingr N)rJ rK rL r r r3 r3 r3 r6 rl 2 s rl c N @ s� e Zd Zddddddddd d
d d d
ddddddddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdN�MZdOS )P� KeyPurposeIdZany_extended_key_usageZ server_authZ client_authZ code_signingZemail_protectionZipsec_end_systemZ ipsec_tunnelZ
ipsec_user�
time_stampingZ ocsp_signingZdvcsZ eap_over_pppZ eap_over_lanZ scvp_serverZ scvp_clientZ ipsec_ikeZ capwap_acZ
capwap_wtpZ
sip_domainZsecure_shell_clientZsecure_shell_serverZ send_routerZsend_proxied_routerZ
send_ownerZsend_proxied_ownerZcmc_caZcmc_raZ cmc_archiveZbgpspec_routerZ microsoft_trust_list_signingZ microsoft_time_stamp_signingZmicrosoft_server_gatedZmicrosoft_serializedZ
microsoft_efsZmicrosoft_efs_recoveryZmicrosoft_whqlZ
microsoft_nt5Zmicrosoft_oem_whqlZmicrosoft_embedded_ntZmicrosoft_root_list_signerZ!microsoft_qualified_subordinationZmicrosoft_key_recoveryZmicrosoft_document_signingZmicrosoft_lifetime_signingZ microsoft_mobile_device_softwareZapple_x509_basicZ apple_sslZapple_local_cert_genZ
apple_csr_genZapple_revocation_crlZapple_revocation_ocspZ apple_smimeZ apple_eapZ apple_software_update_signingZ apple_ipsecZ apple_ichatZapple_resource_signingZapple_pkinit_clientZapple_pkinit_serverZapple_code_signingZapple_package_signingZapple_id_validationZapple_time_stampingZapple_revocationZapple_passbook_signingZapple_mobile_storeZapple_escrow_serviceZapple_profile_signerZapple_qa_profile_signerZapple_test_mobile_storeZapple_otapki_signerZapple_test_otapki_signerZ)apple_id_validation_record_signing_policyZapple_smp_encryptionZapple_test_smp_encryptionZapple_server_authenticationZapple_pcs_escrow_service)Mz 2.5.29.37.0z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2z1.3.6.1.5.5.7.3.3z1.3.6.1.5.5.7.3.4z1.3.6.1.5.5.7.3.5z1.3.6.1.5.5.7.3.6z1.3.6.1.5.5.7.3.7z1.3.6.1.5.5.7.3.8z1.3.6.1.5.5.7.3.9z1.3.6.1.5.5.7.3.10z1.3.6.1.5.5.7.3.13z1.3.6.1.5.5.7.3.14z1.3.6.1.5.5.7.3.15z1.3.6.1.5.5.7.3.16z1.3.6.1.5.5.7.3.17z1.3.6.1.5.5.7.3.18z1.3.6.1.5.5.7.3.19z1.3.6.1.5.5.7.3.20z1.3.6.1.5.5.7.3.21z1.3.6.1.5.5.7.3.22z1.3.6.1.5.5.7.3.23z1.3.6.1.5.5.7.3.24z1.3.6.1.5.5.7.3.25z1.3.6.1.5.5.7.3.26z1.3.6.1.5.5.7.3.27z1.3.6.1.5.5.7.3.28z1.3.6.1.5.5.7.3.29z1.3.6.1.5.5.7.3.30z1.3.6.1.4.1.311.10.3.1z1.3.6.1.4.1.311.10.3.2z1.3.6.1.4.1.311.10.3.3z1.3.6.1.4.1.311.10.3.3.1z1.3.6.1.4.1.311.10.3.4z1.3.6.1.4.1.311.10.3.4.1z1.3.6.1.4.1.311.10.3.5z1.3.6.1.4.1.311.10.3.6z1.3.6.1.4.1.311.10.3.7z1.3.6.1.4.1.311.10.3.8z1.3.6.1.4.1.311.10.3.9z1.3.6.1.4.1.311.10.3.10z1.3.6.1.4.1.311.10.3.11z1.3.6.1.4.1.311.10.3.12z1.3.6.1.4.1.311.10.3.13z1.3.6.1.4.1.311.10.3.14z1.2.840.113635.100.1.2z1.2.840.113635.100.1.3z1.2.840.113635.100.1.4z1.2.840.113635.100.1.5z1.2.840.113635.100.1.6z1.2.840.113635.100.1.7z1.2.840.113635.100.1.8z1.2.840.113635.100.1.9z1.2.840.113635.100.1.10z1.2.840.113635.100.1.11z1.2.840.113635.100.1.12z1.2.840.113635.100.1.13z1.2.840.113635.100.1.14z1.2.840.113635.100.1.15z1.2.840.113635.100.1.16z1.2.840.113635.100.1.17z1.2.840.113635.100.1.18z1.2.840.113635.100.1.20z1.2.840.113635.100.1.21z1.2.840.113635.100.1.22z1.2.840.113635.100.1.23z1.2.840.113635.100.1.24z1.2.840.113635.100.1.25z1.2.840.113635.100.1.26z1.2.840.113635.100.1.27z1.2.840.113635.100.1.28z1.2.840.113635.100.1.29z1.2.840.113625.100.1.30z1.2.840.113625.100.1.31z1.2.840.113625.100.1.32z1.2.840.113635.100.1.33z1.2.840.113635.100.1.34N)rJ rK rL r� r3 r3 r3 r6 rm 9 s� rm c @ s e Zd ZeZdS )�ExtKeyUsageSyntaxN)rJ rK rL rm r� r3 r3 r3 r6 ro � s ro c @ s e Zd Zddddd�ZdS )� AccessMethod�ocspZ
ca_issuersrn Z
ca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5N)rJ rK rL r� r3 r3 r3 r6 rp � s rp c @ s e Zd ZdefdefgZdS )�AccessDescription�
access_method�access_locationN)rJ rK rL rp r< r r3 r3 r3 r6 rr � s rr c @ s e Zd ZeZdS )�AuthorityInfoAccessSyntaxN)rJ rK rL rr r� r3 r3 r3 r6 ru � s ru c @ s e Zd ZeZdS )�SubjectInfoAccessSyntaxN)rJ rK rL rr r� r3 r3 r3 r6 rv � s rv c @ s e Zd ZeZdS )�FeaturesN)rJ rK rL r r� r3 r3 r3 r6 rw � s rw c @ s e Zd ZdefdefgZdS )�EntrustVersionInfoZ entrust_versZentrust_info_flagsN)rJ rK rL r r r r3 r3 r3 r6 rx � s rx c @ s" e Zd Zddddddddd �Zd
S ) �NetscapeCertificateTypeZ
ssl_clientZ
ssl_serverZemailZobject_signingZreservedZssl_caZemail_caZobject_signing_ca)r r ri r� rx r� r� r� N)rJ rK rL r� r3 r3 r3 r6 ry � s ry c @ s> e Zd Zddddddddd d
d d d
dddddddddd�ZdS )� ExtensionId� subject_directory_attributesrK � key_usage�private_key_usage_period�subject_alt_name�issuer_alt_name�basic_constraints�name_constraints�crl_distribution_points�certificate_policies�policy_mappings�authority_key_identifier�policy_constraints�extended_key_usage� freshest_crl�inhibit_any_policy� authority_information_access�subject_information_access� tls_feature�
ocsp_no_check�entrust_version_extension�netscape_certificate_type)z2.5.29.9z 2.5.29.14z 2.5.29.15z 2.5.29.16z 2.5.29.17z 2.5.29.18z 2.5.29.19z 2.5.29.30z 2.5.29.31z 2.5.29.32z 2.5.29.33z 2.5.29.35z 2.5.29.36z 2.5.29.37z 2.5.29.46z 2.5.29.54z1.3.6.1.5.5.7.1.1z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1N)rJ rK rL r� r3 r3 r3 r6 rz � s, rz c @ s^ e Zd ZdefdeddifdefgZdZee e
e e e e
eeeeeeeeeeeeeeed�Z dS ) � Extension�extn_id�criticalrH F�
extn_value)r� r� )r{ rK r| r} r~ r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� N) rJ rK rL rz r r r r� r� r r� r� rC rF rU r[ ri rk rJ rl ro r ru rv rw r rx ry r� r3 r3 r3 r6 r� � s4
r� c @ s e Zd ZeZdS )�
ExtensionsN)rJ rK rL r� r� r3 r3 r3 r6 r� s r� c @ s e Zd Zdddd�ZdS )�Version�v1Zv2Zv3)r r ri N)rJ rK rL r� r3 r3 r3 r6 r� s r� c @ st e Zd Zdedddd�fdefdefdefd efd
efd efd e d
ddd�fde d
ddd�fde
dddd�fg
Z dS )�TbsCertificate�versionr� r r� )r� r� rH r� � signature�issuerZvalidity�subject�subject_public_key_infoZissuer_unique_idr� r T)r� r� r� Zsubject_unique_idri �
extensionsr� N) rJ rK rL r� r r r� rE r, r r� r r3 r3 r3 r6 r� s r� c @ s� e Zd ZdefdefdefgZdZdZdZ dZ
dZ dZ dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ dZ dZ dZ dZ!dZ"dZ#dZ$dZ%dd� Z&e'dd � �Z(e'd
d � �Z)e'd d
� �Z*e'dd� �Z+e'dd� �Z,e'dd� �Z-e'dd� �Z.e'dd� �Z/e'dd� �Z0e'dd� �Z1e'd d � �Z2e'd d � �Z3e'd d!� �Z4e'd"d#� �Z5e'd$d%� �Z6e'd&d'� �Z7e'd(d)� �Z8e'd*d+� �Z9e'd,d-� �Z:e'd.d/� �Z;e'd0d1� �Z<e'd2d3� �Z=e'd4d5� �Z>e'd6d7� �Z?e'd8d9� �Z@e'd:d;� �ZAe'd<d=� �ZBe'd>d?� �ZCe'd@dA� �ZDe'dBdC� �ZEe'dDdE� �ZFe'dFdG� �ZGe'dHdI� �ZHdJdK� ZIe'dLdM� �ZJe'dNdO� �ZKe'dPdQ� �ZLe'dRdS� �ZMe'dTdU� �ZNe'dVdW� �ZOe'dXdY� �ZPe'dZd[� �ZQe'd\d]� �ZRe'd^d_� �ZSd`da� ZTdbdc� ZUddde� ZVdS )f� Certificate�tbs_certificate�signature_algorithm�signature_valueFNc C sl t � | _xX| d d D ]H}|d j}d| }t| |�rHt| ||d j� |d jr| j�|� qW d| _dS ) zv
Sets common named extensions to private attributes and creates a list
of critical extensions
r� r� r� z _%s_valuer� r� TN)rI �_critical_extensionsrN �hasattr�setattrZparsed�add�_processed_extensions)r4 � extensionr� r� r3 r3 r6 �_set_extensionsP s
zCertificate._set_extensionsc C s | j s| �� | jS )z�
Returns a set of the names (or OID if not a known extension) of the
extensions marked as critical
:return:
A set of unicode strings
)r� r� r� )r4 r3 r3 r6 �critical_extensionsb s
z Certificate.critical_extensionsc C s | j s| �� | jS )z�
This extension is used to contain additional identification attributes
about the subject.
:return:
None or an Attributes object
)r� r� �_key_identifier_value)r4 r3 r3 r6 �"subject_directory_attributes_valuep s
z.Certificate.subject_directory_attributes_valuec C s | j s| �� | jS )z�
This extension is used to help in creating certificate validation paths.
It contains an identifier that should generally, but is not guaranteed
to, be unique.
:return:
None or an OctetString object
)r� r� r� )r4 r3 r3 r6 �key_identifier_value~ s z Certificate.key_identifier_valuec C s | j s| �� | jS )z�
This extension is used to define the purpose of the public key
contained within the certificate.
:return:
None or a KeyUsage
)r� r� �_key_usage_value)r4 r3 r3 r6 �key_usage_value� s
zCertificate.key_usage_valuec C s | j s| �� | jS )aT
This extension allows for additional names to be associate with the
subject of the certificate. While it may contain a whole host of
possible names, it is usually used to allow certificates to be used
with multiple different domain names.
:return:
None or a GeneralNames object
)r� r� �_subject_alt_name_value)r4 r3 r3 r6 �subject_alt_name_value� s z"Certificate.subject_alt_name_valuec C s | j s| �� | jS )z�
This extension allows associating one or more alternative names with
the issuer of the certificate.
:return:
None or an x509.GeneralNames object
)r� r� �_issuer_alt_name_value)r4 r3 r3 r6 �issuer_alt_name_value� s
z!Certificate.issuer_alt_name_valuec C s | j s| �� | jS )a'
This extension is used to determine if the subject of the certificate
is a CA, and if so, what the maximum number of intermediate CA certs
after this are, before an end-entity certificate is found.
:return:
None or a BasicConstraints object
)r� r� �_basic_constraints_value)r4 r3 r3 r6 �basic_constraints_value� s z#Certificate.basic_constraints_valuec C s | j s| �� | jS )z�
This extension is used in CA certificates, and is used to limit the
possible names of certificates issued.
:return:
None or a NameConstraints object
)r� r� �_name_constraints_value)r4 r3 r3 r6 �name_constraints_value� s
z"Certificate.name_constraints_valuec C s | j s| �� | jS )z�
This extension is used to help in locating the CRL for this certificate.
:return:
None or a CRLDistributionPoints object
extension
)r� r� � _crl_distribution_points_value)r4 r3 r3 r6 � crl_distribution_points_value� s
z)Certificate.crl_distribution_points_valuec C s | j s| �� | jS )a;
This extension defines policies in CA certificates under which
certificates may be issued. In end-entity certificates, the inclusion
of a policy indicates the issuance of the certificate follows the
policy.
:return:
None or a CertificatePolicies object
)r� r� �_certificate_policies_value)r4 r3 r3 r6 �certificate_policies_value� s z&Certificate.certificate_policies_valuec C s | j s| �� | jS )z�
This extension allows mapping policy OIDs to other OIDs. This is used
to allow different policies to be treated as equivalent in the process
of validation.
:return:
None or a PolicyMappings object
)r� r� �_policy_mappings_value)r4 r3 r3 r6 �policy_mappings_value� s z!Certificate.policy_mappings_valuec C s | j s| �� | jS )z�
This extension helps in identifying the public key with which to
validate the authenticity of the certificate.
:return:
None or an AuthorityKeyIdentifier object
)r� r� � _authority_key_identifier_value)r4 r3 r3 r6 � authority_key_identifier_value s
z*Certificate.authority_key_identifier_valuec C s | j s| �� | jS )z�
This extension is used to control if policy mapping is allowed and
when policies are required.
:return:
None or a PolicyConstraints object
)r� r� �_policy_constraints_value)r4 r3 r3 r6 �policy_constraints_value s
z$Certificate.policy_constraints_valuec C s | j s| �� | jS )z�
This extension is used to help locate any available delta CRLs
:return:
None or an CRLDistributionPoints object
)r� r� �_freshest_crl_value)r4 r3 r3 r6 �freshest_crl_value s z Certificate.freshest_crl_valuec C s | j s| �� | jS )z�
This extension is used to prevent mapping of the any policy to
specific requirements
:return:
None or a Integer object
)r� r� �_inhibit_any_policy_value)r4 r3 r3 r6 �inhibit_any_policy_value, s
z$Certificate.inhibit_any_policy_valuec C s | j s| �� | jS )z�
This extension is used to define additional purposes for the public key
beyond what is contained in the basic constraints.
:return:
None or an ExtKeyUsageSyntax object
)r� r� �_extended_key_usage_value)r4 r3 r3 r6 �extended_key_usage_value: s
z$Certificate.extended_key_usage_valuec C s | j s| �� | jS )z�
This extension is used to locate the CA certificate used to sign this
certificate, or the OCSP responder for this certificate.
:return:
None or an AuthorityInfoAccessSyntax object
)r� r� �#_authority_information_access_value)r4 r3 r3 r6 �"authority_information_access_valueH s
z.Certificate.authority_information_access_valuec C s | j s| �� | jS )z�
This extension is used to access information about the subject of this
certificate.
:return:
None or a SubjectInfoAccessSyntax object
)r� r� �!_subject_information_access_value)r4 r3 r3 r6 � subject_information_access_valueV s
z,Certificate.subject_information_access_valuec C s | j s| �� | jS )z�
This extension is used to list the TLS features a server must respond
with if a client initiates a request supporting them.
:return:
None or a Features object
)r� r� �_tls_feature_value)r4 r3 r3 r6 �tls_feature_valued s
z Certificate.tls_feature_valuec C s | j s| �� | jS )a-
This extension is used on certificates of OCSP responders, indicating
that revocation information for the certificate should never need to
be verified, thus preventing possible loops in path validation.
:return:
None or a Null object (if present)
)r� r� �_ocsp_no_check_value)r4 r3 r3 r6 �ocsp_no_check_valuer s z Certificate.ocsp_no_check_valuec C s
| d j S )zE
:return:
A byte string of the signature
r� )rN )r4 r3 r3 r6 r� � s zCertificate.signaturec C s
| d j S )zj
:return:
A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
r� )�signature_algo)r4 r3 r3 r6 r� � s zCertificate.signature_algoc C s
| d j S )z�
:return:
A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
"sha384", "sha512", "sha512_224", "sha512_256"
r� )� hash_algo)r4 r3 r3 r6 r� � s zCertificate.hash_algoc C s | d d S )zT
:return:
The PublicKeyInfo object for this certificate
r� r� r3 )r4 r3 r3 r6 �
public_key� s zCertificate.public_keyc C s | d d S )zZ
:return:
The Name object for the subject of this certificate
r� r� r3 )r4 r3 r3 r6 r� � s zCertificate.subjectc C s | d d S )zY
:return:
The Name object for the issuer of this certificate
r� r� r3 )r4 r3 r3 r6 r� � s zCertificate.issuerc C s | d d j S )zT
:return:
An integer of the certificate's serial number
r� r� )rN )r4 r3 r3 r6 r� � s zCertificate.serial_numberc C s | j s
dS | j jS )z�
:return:
None or a byte string of the certificate's key identifier from the
key identifier extension
N)r� rN )r4 r3 r3 r6 rK � s zCertificate.key_identifierc C s. | j dkr(| jjd t| j��d� | _ | j S )z�
:return:
A byte string of the SHA-256 hash of the issuer concatenated with
the ascii character ":", concatenated with the serial number as
an ascii string
N� :rV )�_issuer_serialr� r� r
r� rA )r4 r3 r3 r6 �
issuer_serial� s
zCertificate.issuer_serialc C s | j s
dS | j d jS )z�
:return:
None or a byte string of the key_identifier from the authority key
identifier extension
NrK )r� rN )r4 r3 r3 r6 r� � s z$Certificate.authority_key_identifierc C sj | j dkrd| j}|r^|d jr^| jd d j}|�� }| jd j}|jd t|��d� | _ nd| _ | j S )a;
:return:
None or a byte string of the SHA-256 hash of the isser from the
authority key identifier extension concatenated with the ascii
character ":", concatenated with the serial number from the
authority key identifier extension as an ascii string
FrL r rM r� rV N)�_authority_issuer_serialr� rN r� Zuntagr� r
rA )r4 Zakivr� Zauthority_serialr3 r3 r6 �authority_issuer_serial� s
z#Certificate.authority_issuer_serialc C s | j dkr| �| j�| _ | j S )z�
Returns complete CRL URLs - does not include delta CRLs
:return:
A list of zero or more DistributionPoint objects
N)�_crl_distribution_points�!_get_http_crl_distribution_pointsr� )r4 r3 r3 r6 r� � s
z#Certificate.crl_distribution_pointsc C s | j dkr| �| j�| _ | j S )z�
Returns delta CRL URLs - does not include complete CRLs
:return:
A list of zero or more DistributionPoint objects
N)� _delta_crl_distribution_pointsr� r� )r4 r3 r3 r6 � delta_crl_distribution_points s
z)Certificate.delta_crl_distribution_pointsc C sd g }|dkrg S xN|D ]F}|d }|t kr,q|jdkr8qx"|jD ]}|jdkr@|�|� q@W qW |S )a?
Fetches the DistributionPoint object for non-relative, HTTP CRLs
referenced by the certificate
:param crl_distribution_points:
A CRLDistributionPoints object to grab the DistributionPoints from
:return:
A list of zero or more DistributionPoint objects
NrW rP rA )r+ r� r� r� )r4 r� r� rW Zdistribution_point_namerY r3 r3 r6 r� s
z-Certificate._get_http_crl_distribution_pointsc C sh | j s
g S g }xT| j D ]J}|d jdkr|d }|jdkr<q|j}|�� dd� dkr|�|� qW |S )zx
:return:
A list of zero or more unicode strings of the OCSP URLs for this
cert
rs rq rt rA r r� zhttp://)r� rN r� r: r� )r4 r� �entry�locationrZ r3 r3 r6 � ocsp_urls7 s
zCertificate.ocsp_urlsc C s� | j dkr�g | _ | jrLx�| jD ](}|jdkr |j| j kr | j �|j� q W nXt�d�}xL| jjD ]@}x:|D ]2}|d jdkrj|d j}|� |�rj| j �|� qjW q`W | j S )z�
:return:
A list of unicode strings of valid domain names for the certificate.
Wildcard certificates will have a domain in the form: *.example.com
Nr> zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r} r� rG )
�_valid_domainsr� r� rN r� r� �compiler� r� �match)r4 rY �patternr� Zname_type_valuerG r3 r3 r6 �
valid_domainsM s
zCertificate.valid_domainsc C sD | j dkr>g | _ | jr>x&| jD ] }|jdkr | j �|j� q W | j S )zj
:return:
A list of unicode strings of valid IP addresses for the certificate
NrB )�
_valid_ipsr� r� r� rN )r4 rY r3 r3 r6 � valid_ipsp s
zCertificate.valid_ipsc C s | j o| j d jS )zW
:return;
A boolean - if the certificate is marked as a CA
rG )r� rN )r4 r3 r3 r6 rG � s zCertificate.cac C s | j s
dS | jd jS )zT
:return;
None or an integer of the maximum path length
NrI )rG r� rN )r4 r3 r3 r6 �max_path_length� s zCertificate.max_path_lengthc C s | j dkr| j| jk| _ | j S )zx
:return:
A boolean - if the certificate is self-issued, as defined by RFC
5280
N)� _self_issuedr� r� )r4 r3 r3 r6 � self_issued� s
zCertificate.self_issuedc C sJ | j dkrDd| _ | jrD| jr>| js*d| _ qD| j| jkrDd| _ nd| _ | j S )a�
:return:
A unicode string of "yes", "no" or "maybe". The "maybe" result will
be returned if the certificate does not contain a key identifier
extension, but is issued by the subject. In this case the
certificate signature will need to be verified using the subject
public key to determine a "yes" or "no" answer.
NZnoZyes�maybe)� _self_signedr� rK r� )r4 r3 r3 r6 � self_signed� s
zCertificate.self_signedc C s$ | j dkr t�| �� ��� | _ | j S )zk
:return:
The SHA-1 hash of the DER-encoded bytes of this complete certificate
N)r� r� r� r� r� )r4 r3 r3 r6 r� � s
zCertificate.sha1c C s d� dd� t| j�D ��S )z�
:return:
A unicode string of the SHA-1 hash, formatted using hex encoding
with a space between each pair of characters, all uppercase
r� c s s | ]}d | V qdS )z%02XNr3 )r� �cr3 r3 r6 r� � s z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r� r r� )r4 r3 r3 r6 �sha1_fingerprint� s z Certificate.sha1_fingerprintc C s$ | j dkr t�| �� ��� | _ | j S )zy
:return:
The SHA-256 hash of the DER-encoded bytes of this complete
certificate
N)r� r� r� r� r� )r4 r3 r3 r6 r� � s
zCertificate.sha256c C sP t |t�s ttdt|����|�d��d��� }|�d�dk}| oNt �
d|�}| oZ| }|r�| j sjdS |� d�}xh| j D ]^}|�d��d��� }|� d�} t
| �t
|�kr�q|| |kr�d S | �|�}
|
r|| �|| �r|d S q|W dS | js�dS |r�tjntj} t| |�} xD| jD ]:}
|
�d�dk�r(tjntj}t||
�}|| k�rd S �qW dS )
a
Check if a domain name or IP address is valid according to the
certificate
:param domain_ip:
A unicode string of a domain name or IP address
:return:
A boolean - if the domain or IP is valid for the certificate
zL
domain_ip must be a unicode string, not %s
r rV rd rU z^\d+\.\d+\.\d+\.\d+$Fr< T)r8 r
r? r r rA r\ r: rX r� r� r� rl rq �_is_wildcard_domain�_is_wildcard_matchr� rn rp ro r0 )r4 Z domain_ipZencoded_domain_ipZis_ipv6Zis_ipv4Z is_domain�
domain_labelsZ valid_domainZencoded_valid_domain�valid_domain_labelsZ is_wildcardrv Z
normalized_ipZvalid_ipZ valid_familyZnormalized_valid_ipr3 r3 r6 �is_valid_domain_ip� sB
z Certificate.is_valid_domain_ipc C sZ |� d�dkrdS |�� �d�}|s(dS |d �d�dkr>dS |d dd� dkrVdS d S )
af
Checks if a domain is a valid wildcard according to
https://tools.ietf.org/html/rfc6125#section-6.4.3
:param domain:
A unicode string of the domain name, where any U-labels from an IDN
have been converted to A-labels
:return:
A boolean - if the domain is a valid wildcard domain
�*r Fr< r rU rx zxn--T)�countr: rl rX )r4 Zdomain�labelsr3 r3 r6 r�
s z Certificate._is_wildcard_domainc C sl |d }|dd� }|d }|dd� }||kr4dS |dkr@dS t �d|�dd� d �}|�|�rhdS dS )
a�
Determines if the labels in a domain are a match for labels from a
wildcard valid domain name
:param domain_labels:
A list of unicode strings, with A-label form for IDNs, of the labels
in the domain name to check
:param valid_domain_labels:
A list of unicode strings, with A-label form for IDNs, of the labels
in a wildcard domain pattern
:return:
A boolean - if the domain matches the valid domain
r r NFr� T�^z.*�$)r� r� r� r� )r4 r� r� Zfirst_domain_labelZother_domain_labelsZwildcard_labelZother_valid_domain_labelsZwildcard_regexr3 r3 r6 r� <
s
z Certificate._is_wildcard_match)WrJ rK rL r� r r r r� r� Z _subject_directory_attributesr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r] r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rK r� r� r� r� r� r� r� r� r� rG r� r� r� r� r� r� r� r� r� r3 r3 r3 r6 r� ) s�
#
B!r� c @ s e Zd ZeZdS )�KeyPurposeIdentifiersN)rJ rK rL rm r� r3 r3 r3 r6 r� f
s r� c @ s e Zd ZeZdS )� SequenceOfAlgorithmIdentifiersN)rJ rK rL r r� r3 r3 r3 r6 r� j
s r� c
@ sT e Zd Zdeddifdedddd�fdeddifd eddifd
edd dd�fgZd S )
�CertificateAuxZtrustr� TZrejectr� r )r� r� r� �aliasZkeyidr5 r N)rJ rK rL r� r) r r� r r3 r3 r3 r6 r� n
s
r� c @ s e Zd ZeegZdS )�TrustedCertificateN)rJ rK rL r� r� Z _child_specsr3 r3 r3 r6 r� x
s r� )��__doc__Z
__future__r r r r Z encodingsr r� r� rn r� r� r� Z_errorsr Z_irir r
Z _ordereddictr Z_typesr r
r Zalgosr r Zcorer r r r r r r r r r r r r r r r r! r" r# r$ r% r& r' r( r) r* r+ r� r, �utilr- r. r/ r0 r1 rM rQ r_ r| r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r r r r r
r r r
r r r r r r r r6 r9 r: r; r< rC rD rE rF rJ rN rQ rR rT rU rV r[ r\ r] r^ r_ r` rc rf rg rh ri rj rk rl rm ro rp rr ru rv rw rx ry rz r� r� r� r� r� r� r� r� r� r3 r3 r3 r6 �<module> s� t 59l } ;U* D
"2%
b
" C