3
l_)g @ s d dl mZmZmZ d dlZd dlZd dlZd dlmZ d dl Z d dl
m Z d dl m
Z
d dlmZmZmZmZmZ d dlmZmZ d dlmZ d d lmZ ejd
d d ZG d d
d
e Z dd Z dd Z dd Z G dd deZ!d6ddZ"d7ddZ#d8ddZ$d9d d Z%d:d d Z&d;d d!Z'G d"d# d#e Z(e j)ej*G d$d% d%e+Z,e j)ej*G d&d' d'e+Z-e j)ej*G d(d) d)e+Z.e j)ej*G d*d+ d+e+Z/G d,d- d-e+Z0G d.d/ d/e+Z1G d0d1 d1e+Z2G d2d3 d3e+Z3d4d5 Z4dS )< )absolute_importdivisionprint_functionN)Enum)utils) _get_backend)dsaeced25519ed448rsa) Extension
ExtensionType)Name)ObjectIdentifieri c s e Zd Z fddZ ZS )AttributeNotFoundc s t t| j| || _d S )N)superr __init__oid)selfmsgr ) __class__ /usr/lib64/python3.6/base.pyr s zAttributeNotFound.__init__)__name__
__module__ __qualname__r
__classcell__r r )r r r s r c C s& x |D ]}|j | j krtdqW d S )Nz$This extension has already been set.)r
ValueError) extension
extensionser r r _reject_duplicate_extension% s
r# c C s& x |D ]\}}|| krt dqW d S )Nz$This attribute has already been set.)r )r
attributesZattr_oid_r r r _reject_duplicate_attribute, s r& c C s: | j dk r2| j }|r|ntj }| jdd| S | S dS )zNormalizes a datetime to a naive datetime in UTC.
time -- datetime to normalize. Assumed to be in UTC if not timezone
aware.
N)tzinfo)r' Z utcoffsetdatetimeZ timedeltareplace)timeoffsetr r r _convert_to_naive_utc_time3 s
r, c @ s e Zd ZdZdZdS )Versionr N)r r r Zv1v3r r r r r- A s r- c C s t |}|j| S )N)r load_pem_x509_certificate)databackendr r r r0 F s r0 c C s t |}|j| S )N)r load_der_x509_certificate)r1 r2 r r r r3 K s r3 c C s t |}|j| S )N)r load_pem_x509_csr)r1 r2 r r r r4 P s r4 c C s t |}|j| S )N)r load_der_x509_csr)r1 r2 r r r r5 U s r5 c C s t |}|j| S )N)r load_pem_x509_crl)r1 r2 r r r r6 Z s r6 c C s t |}|j| S )N)r load_der_x509_crl)r1 r2 r r r r7 _ s r7 c s e Zd Z fddZ ZS )InvalidVersionc s t t| j| || _d S )N)r r8 r parsed_version)r r r9 )r r r r e s zInvalidVersion.__init__)r r r r r r r )r r r8 d s r8 c @ s e Zd Zejdd Zejdd Zejdd Zejdd Z ejd d
Z
ejd d Z ejd
d Z ejdd Z
ejdd Zejdd Zejdd Zejdd Zejdd Zejdd Zejd d Zejd d Zejd!d" Zd#S )$ Certificatec C s dS )z4
Returns bytes using digest passed.
Nr )r algorithmr r r fingerprintl s zCertificate.fingerprintc C s dS )z3
Returns certificate serial number
Nr )r r r r
serial_numberr s zCertificate.serial_numberc C s dS )z1
Returns the certificate version
Nr )r r r r versionx s zCertificate.versionc C s dS )z(
Returns the public key
Nr )r r r r
public_key~ s zCertificate.public_keyc C s dS )z?
Not before time (represented as UTC datetime)
Nr )r r r r not_valid_before s z Certificate.not_valid_beforec C s dS )z>
Not after time (represented as UTC datetime)
Nr )r r r r not_valid_after s zCertificate.not_valid_afterc C s dS )z1
Returns the issuer name object.
Nr )r r r r issuer s zCertificate.issuerc C s dS )z2
Returns the subject name object.
Nr )r r r r subject s zCertificate.subjectc C s dS )zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
Nr )r r r r signature_hash_algorithm s z$Certificate.signature_hash_algorithmc C s dS )zJ
Returns the ObjectIdentifier of the signature algorithm.
Nr )r r r r signature_algorithm_oid s z#Certificate.signature_algorithm_oidc C s dS )z/
Returns an Extensions object.
Nr )r r r r r! s zCertificate.extensionsc C s dS )z.
Returns the signature bytes.
Nr )r r r r signature s zCertificate.signaturec C s dS )zR
Returns the tbsCertificate payload bytes as defined in RFC 5280.
Nr )r r r r tbs_certificate_bytes s z!Certificate.tbs_certificate_bytesc C s dS )z"
Checks equality.
Nr )r otherr r r __eq__ s zCertificate.__eq__c C s dS )z#
Checks not equal.
Nr )r rH r r r __ne__ s zCertificate.__ne__c C s dS )z"
Computes a hash.
Nr )r r r r __hash__ s zCertificate.__hash__c C s dS )zB
Serializes the certificate to PEM or DER format.
Nr )r encodingr r r public_bytes s zCertificate.public_bytesN)r r r abcabstractmethodr< abstractpropertyr= r> r? r@ rA rB rC rD rE r! rF rG rI rJ rK rM r r r r r: j s" r: c @ s e Zd Zejdd Zejdd Zejdd Zejdd Z ejd d
Z
ejd d Z ejd
d Z ejdd Z
ejdd Zejdd Zejdd Zejdd Zejdd Zejdd Zejd d Zejd d Zejd!d" Zd#S )$CertificateRevocationListc C s dS )z:
Serializes the CRL to PEM or DER format.
Nr )r rL r r r rM s z&CertificateRevocationList.public_bytesc C s dS )z4
Returns bytes using digest passed.
Nr )r r; r r r r< s z%CertificateRevocationList.fingerprintc C s dS )zs
Returns an instance of RevokedCertificate or None if the serial_number
is not in the CRL.
Nr )r r= r r r (get_revoked_certificate_by_serial_number s zBCertificateRevocationList.get_revoked_certificate_by_serial_numberc C s dS )zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
Nr )r r r r rD s z2CertificateRevocationList.signature_hash_algorithmc C s dS )zJ
Returns the ObjectIdentifier of the signature algorithm.
Nr )r r r r rE s z1CertificateRevocationList.signature_algorithm_oidc C s dS )zC
Returns the X509Name with the issuer of this CRL.
Nr )r r r r rB s z CertificateRevocationList.issuerc C s dS )z?
Returns the date of next update for this CRL.
Nr )r r r r next_update s z%CertificateRevocationList.next_updatec C s dS )z?
Returns the date of last update for this CRL.
Nr )r r r r last_update s z%CertificateRevocationList.last_updatec C s dS )zS
Returns an Extensions object containing a list of CRL extensions.
Nr )r r r r r! s z$CertificateRevocationList.extensionsc C s dS )z.
Returns the signature bytes.
Nr )r r r r rF s z#CertificateRevocationList.signaturec C s dS )zO
Returns the tbsCertList payload bytes as defined in RFC 5280.
Nr )r r r r tbs_certlist_bytes s z,CertificateRevocationList.tbs_certlist_bytesc C s dS )z"
Checks equality.
Nr )r rH r r r rI s z CertificateRevocationList.__eq__c C s dS )z#
Checks not equal.
Nr )r rH r r r rJ s z CertificateRevocationList.__ne__c C s dS )z<
Number of revoked certificates in the CRL.
Nr )r r r r __len__& s z!CertificateRevocationList.__len__c C s dS )zS
Returns a revoked certificate (or slice of revoked certificates).
Nr )r idxr r r __getitem__, s z%CertificateRevocationList.__getitem__c C s dS )z8
Iterator over the revoked certificates
Nr )r r r r __iter__2 s z"CertificateRevocationList.__iter__c C s dS )zQ
Verifies signature of revocation list against given public key.
Nr )r r? r r r is_signature_valid8 s z,CertificateRevocationList.is_signature_validN)r r r rN rO rM r< rR rP rD rE rB rS rT r! rF rU rI rJ rV rX rY rZ r r r r rQ s" rQ c @ s e Zd Zejdd Zejdd Zejdd Zejdd Zej d d
Z
ej d d Z ej d
d Z ej dd Z
ejdd Zej dd Zej dd Zej dd Zej dd ZdS ) CertificateSigningRequestc C s dS )z"
Checks equality.
Nr )r rH r r r rI A s z CertificateSigningRequest.__eq__c C s dS )z#
Checks not equal.
Nr )r rH r r r rJ G s z CertificateSigningRequest.__ne__c C s dS )z"
Computes a hash.
Nr )r r r r rK M s z"CertificateSigningRequest.__hash__c C s dS )z(
Returns the public key
Nr )r r r r r? S s z$CertificateSigningRequest.public_keyc C s dS )z2
Returns the subject name object.
Nr )r r r r rC Y s z!CertificateSigningRequest.subjectc C s dS )zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
Nr )r r r r rD _ s z2CertificateSigningRequest.signature_hash_algorithmc C s dS )zJ
Returns the ObjectIdentifier of the signature algorithm.
Nr )r r r r rE f s z1CertificateSigningRequest.signature_algorithm_oidc C s dS )z@
Returns the extensions in the signing request.
Nr )r r r r r! l s z$CertificateSigningRequest.extensionsc C s dS )z;
Encodes the request to PEM or DER format.
Nr )r rL r r r rM r s z&CertificateSigningRequest.public_bytesc C s dS )z.
Returns the signature bytes.
Nr )r r r r rF x s z#CertificateSigningRequest.signaturec C s dS )zd
Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
2986.
Nr )r r r r tbs_certrequest_bytes~ s z/CertificateSigningRequest.tbs_certrequest_bytesc C s dS )z8
Verifies signature of signing request.
Nr )r r r r rZ s z,CertificateSigningRequest.is_signature_validc C s dS )z:
Get the attribute value for a given OID.
Nr )r r r r get_attribute_for_oid s z/CertificateSigningRequest.get_attribute_for_oidN)r r r rN rO rI rJ rK r? rP rC rD rE r! rM rF r\ rZ r] r r r r r[ ? s r[ c @ s6 e Zd Zejdd Zejdd Zejdd ZdS )RevokedCertificatec C s dS )zG
Returns the serial number of the revoked certificate.
Nr )r r r r r= s z RevokedCertificate.serial_numberc C s dS )zH
Returns the date of when this certificate was revoked.
Nr )r r r r revocation_date s z"RevokedCertificate.revocation_datec C s dS )zW
Returns an Extensions object containing a list of Revoked extensions.
Nr )r r r r r! s z RevokedCertificate.extensionsN)r r r rN rP r= r_ r! r r r r r^ s r^ c @ s> e Zd Zdg g fddZdd Zdd Zdd Zd d
d ZdS )
CertificateSigningRequestBuilderNc C s || _ || _|| _dS )zB
Creates an empty X.509 certificate request (v1).
N)
_subject_name _extensions _attributes)r subject_namer! r$ r r r r s z)CertificateSigningRequestBuilder.__init__c C s4 t |tstd| jdk r$tdt|| j| jS )zF
Sets the certificate requestor's distinguished name.
zExpecting x509.Name object.Nz&The subject name may only be set once.)
isinstancer TypeErrorra r r` rb rc )r namer r r rd s
z-CertificateSigningRequestBuilder.subject_namec C sD t |tstdt|j||}t|| j t| j| j|g | j S )zE
Adds an X.509 extension to the certificate request.
z"extension must be an ExtensionType)
re r rf r
r r# rb r` ra rc )r r criticalr r r
add_extension s
z.CertificateSigningRequestBuilder.add_extensionc C sL t |tstdt |ts$tdt|| j t| j| j| j||fg S )zK
Adds an X.509 attribute with an OID and associated value.
z oid must be an ObjectIdentifierzvalue must be bytes) re r rf bytesr& rc r` ra rb )r r valuer r r
add_attribute s
z.CertificateSigningRequestBuilder.add_attributec C s( t |}| jdkrtd|j| ||S )zF
Signs the request using the requestor's private key.
Nz/A CertificateSigningRequest must have a subject)r ra r Zcreate_x509_csr)r private_keyr; r2 r r r sign s
z%CertificateSigningRequestBuilder.sign)N)r r r r rd ri rl rn r r r r r` s
r` c @ sf e Zd Zddddddg fddZdd Zdd Zdd Zd
d Zd d
Zdd Z dd Z
dddZ dS )CertificateBuilderNc C s6 t j| _|| _|| _|| _|| _|| _|| _|| _ d S )N)
r- r/ Z_version _issuer_namera _public_key_serial_number_not_valid_before_not_valid_afterrb )r issuer_namerd r? r= r@ rA r! r r r r s
zCertificateBuilder.__init__c C sD t |tstd| jdk r$tdt|| j| j| j| j | j
| j S )z3
Sets the CA's distinguished name.
zExpecting x509.Name object.Nz%The issuer name may only be set once.) re r rf rp r ro ra rq rr rs rt rb )r rg r r r ru s
z CertificateBuilder.issuer_namec C sD t |tstd| jdk r$tdt| j|| j| j| j | j
| j S )z:
Sets the requestor's distinguished name.
zExpecting x509.Name object.Nz&The subject name may only be set once.) re r rf ra r ro rp rq rr rs rt rb )r rg r r r rd s
z CertificateBuilder.subject_namec C sX t |tjtjtjtjt j
fs&t d| j dk r8t
dt| j| j|| j| j| j| jS )zT
Sets the requestor's public key (as found in the signing request).
zhExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey or Ed448PublicKey.Nz$The public key may only be set once.)re r Z DSAPublicKeyr Z RSAPublicKeyr ZEllipticCurvePublicKeyr
ZEd25519PublicKeyr ZEd448PublicKeyrf rq r ro rp ra rr rs rt rb )r keyr r r r? s&
z CertificateBuilder.public_keyc C sj t |tjstd| jdk r&td|dkr6td|j dkrJtdt| j| j | j
|| j | j | j
S )z5
Sets the certificate serial number.
z'Serial number must be of integral type.Nz'The serial number may only be set once.r z%The serial number should be positive. z3The serial number should not be more than 159 bits.)re six
integer_typesrf rr r
bit_lengthro rp ra rq rs rt rb )r numberr r r r= ? s"
z CertificateBuilder.serial_numberc C sz t |tjstd| jdk r&tdt|}|tk r>td| jdk rZ|| jkrZtdt| j | j
| j | j || j| j
S )z7
Sets the certificate activation time.
zExpecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)re r( rf rs r r, _EARLIEST_UTC_TIMErt ro rp ra rq rr rb )r r* r r r r@ Z s&
z#CertificateBuilder.not_valid_beforec C sz t |tjstd| jdk r&tdt|}|tk r>td| jdk rZ|| jk rZtdt| j | j
| j | j | j|| j
S )z7
Sets the certificate expiration time.
zExpecting datetime object.Nz)The not valid after may only be set once.ztd| jdkrPtd| jdkrbtd| jdkrttd|j| ||S )zC
Signs the certificate using the CA's private key.
Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key) r ra r rp rr rs rt rq Zcreate_x509_certificate)r rm r; r2 r r r rn s
zCertificateBuilder.sign)N) r r r r ru rd r? r= r@ rA ri rn r r r r ro s ro c @ sR e Zd Zdddg g fddZdd Zdd Zdd Zd
d Zd d
ZdddZ dS ) CertificateRevocationListBuilderNc C s" || _ || _|| _|| _|| _d S )N)rp _last_update _next_updaterb _revoked_certificates)r ru rT rS r! Zrevoked_certificatesr r r r s
z)CertificateRevocationListBuilder.__init__c C s< t |tstd| jd k r$tdt|| j| j| j| j S )NzExpecting x509.Name object.z%The issuer name may only be set once.)
re r rf rp r r} r~ r rb r )r ru r r r ru s
z,CertificateRevocationListBuilder.issuer_namec C sr t |tjstd| jd k r&tdt|}|tk r>td| jd k rZ|| jkrZtdt| j || j| j
| j S )NzExpecting datetime object.z!Last update may only be set once.z8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) re r( rf r~ r r, r| r r} rp rb r )r rT r r r rT s"
z,CertificateRevocationListBuilder.last_updatec C sr t |tjstd| jd k r&tdt|}|tk r>td| jd k rZ|| jk rZtdt| j | j|| j
| j S )NzExpecting datetime object.z!Last update may only be set once.z8The last update date must be on or after 1950 January 1.z8The next update date must be after the last update date.) re r( rf r r r, r| r~ r} rp rb r )r rS r r r rS s"
z,CertificateRevocationListBuilder.next_updatec C sL t |tstdt|j||}t|| j t| j| j | j
| j|g | j S )zM
Adds an X.509 extension to the certificate revocation list.
z"extension must be an ExtensionType) re r rf r
r r# rb r} rp r~ r r )r r rh r r r ri
s
z.CertificateRevocationListBuilder.add_extensionc C s2 t |tstdt| j| j| j| j| j|g S )z8
Adds a revoked certificate to the CRL.
z)Must be an instance of RevokedCertificate) re r^ rf r} rp r~ r rb r )r Zrevoked_certificater r r add_revoked_certificate s
z8CertificateRevocationListBuilder.add_revoked_certificatec C sL t |}| jd krtd| jd kr,td| jd kr>td|j| ||S )Nz A CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r rp r r~ r Zcreate_x509_crl)r rm r; r2 r r r rn - s
z%CertificateRevocationListBuilder.sign)N)
r r r r ru rT rS ri r rn r r r r r} s
r} c @ s> e Zd Zddg fddZdd Zdd Zdd Zd d
d ZdS )
RevokedCertificateBuilderNc C s || _ || _|| _d S )N)rr _revocation_daterb )r r= r_ r! r r r r < s z"RevokedCertificateBuilder.__init__c C sZ t |tjstd| jd k r&td|dkr6td|j dkrJtdt|| j| j S )Nz'Serial number must be of integral type.z'The serial number may only be set once.r z$The serial number should be positiverw z3The serial number should not be more than 159 bits.)
re rx ry rf rr r rz r r rb )r r{ r r r r= C s
z'RevokedCertificateBuilder.serial_numberc C sN t |tjstd| jd k r&tdt|}|tk r>tdt| j|| j S )NzExpecting datetime object.z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
re r( rf r r r, r| r rr rb )r r* r r r r_ U s
z)RevokedCertificateBuilder.revocation_datec C sD t |tstdt|j||}t|| j t| j| j | j|g S )Nz"extension must be an ExtensionType)
re r rf r
r r# rb r rr r )r r rh r r r ri c s
z'RevokedCertificateBuilder.add_extensionc C s6 t |}| jd krtd| jd kr,td|j| S )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r rr r r Z create_x509_revoked_certificate)r r2 r r r buildo s
z RevokedCertificateBuilder.build)N)r r r r r= r_ ri r r r r r r ; s
r c C s t jtjddd? S )N Zbigr )r Zint_from_bytesosurandomr r r r random_serial_number{ s r )N)N)N)N)N)N)5Z
__future__r r r rN r( r enumr rx Z cryptographyr Z cryptography.hazmat.backendsr Z)cryptography.hazmat.primitives.asymmetricr r r
r r Z cryptography.x509.extensionsr
r Zcryptography.x509.namer Zcryptography.x509.oidr r| Exceptionr r# r& r, r- r0 r3 r4 r5 r6 r7 r8 Z
add_metaclassABCMetaobjectr: rQ r[ r^ r` ro r} r r r r r r sL
ijRA ^v@