a ╣aсГу@s╠ddlZddlZddlZddlZddlmZddlmZddl m Z mZddlm Z mZmZmZmZmZmZddlmZmZmZddlmZmZmZmZddlmZmZdd l m!Z!eаd ddбZ"Gdd Дd e#ГZ$eeej%eeddЬddДZ&e!ej%ej'e!e(fddЬddДZ)ejejdЬddДZ*GddДdГZ+GddДdГZ,GddДdej-ГZ.GddДde#ГZ/Gdd Дd ej0d!НZ1e1а2ej1бGd"d#Дd#ej0d!НZ3e3а2ej3бGd$d%Дd%e3ГZ4Gd&d'Дd'ej0d!НZ5e5а2ej5бGd(d)Дd)ej0d!НZ6e6а2ej6бdBe(ej7e1d*Ьd+d,ДZ8dCe(ej7e1d*Ьd-d.ДZ9dDe(ej7e6d*Ьd/d0ДZ:dEe(ej7e6d*Ьd1d2ДZ;dFe(ej7e5d*Ьd3d4ДZГZ?Gd9d:Дd:e>ГZ@Gd;d<ДdГZAGd=d>Дd>e>ГZBeCd?Ьd@dAДZDdS)HщN)┌utils)┌x509)┌hashes┌ serialization)┌dsa┌ec┌ed25519┌ed448┌rsa┌x25519┌x448)┌CERTIFICATE_PUBLIC_KEY_TYPES┌PRIVATE_KEY_TYPES┌PUBLIC_KEY_TYPES)┌ Extension┌ ExtensionType┌ Extensions┌_make_sequence_methods)┌Name┌ _ASN1Type)┌ObjectIdentifieriЮщcs&eZdZeeddЬЗfddДZЗZS)┌AttributeNotFoundN)┌msg┌oid┌returncstt|Га|б||_dSйN)┌superr┌__init__r)┌selfrrй┌ __class__й·r"r"r#r9`szAttribute.valuecCsdа|j|jбS)Nz)┌formatrr9r>r"r"r#┌__repr__dszAttribute.__repr__й┌otherrcCs2t|tГstS|j|jko0|j|jko0|j|jkSr)┌ isinstancer8┌NotImplementedrr9r:йrrBr"r"r#┌__eq__gs ¤zAttribute.__eq__cCs ||kSrr"rEr"r"r#┌__ne__qszAttribute.__ne__cCst|j|j|jfГSr)┌hashrr9r:r>r"r"r#┌__hash__tszAttribute.__hash__)r$r%r&rZ UTF8Stringr9r┌bytes┌intr┌propertyrr@┌typing┌Any┌boolrFrGrIr"r"r"r#r8Qs№√ r8c@sHeZdZejeddЬddДZedГ\ZZ Z ddДZeedЬd d ДZ dS)┌ AttributesN)r.rcCst|Г|_dSr)┌list┌_attributes)rr.r"r"r#ryszAttributes.__init__rRcCsdа|jбS)Nz)r?rRr>r"r"r#r@БszAttributes.__repr__йrrcCs0|D]}|j|kr|Sqtdа|б|ГВdS)NzNo {} attribute was found)rrr?)rr┌attrr"r"r#┌get_attribute_for_oidДs z Attributes.get_attribute_for_oid)r$r%r&rM┌Iterabler8rr┌__len__┌__iter__┌__getitem__r@rrUr"r"r"r#rPxs¤rPc@seZdZdZdZdS)┌VersionrщN)r$r%r&Zv1┌v3r"r"r"r#rZМsrZcs&eZdZeeddЬЗfddДZЗZS)┌InvalidVersionN)r┌parsed_versionrcstt|Га|б||_dSr)rr]rr^)rrr^r r"r#rТszInvalidVersion.__init__)r$r%r&r'rKrr(r"r"r r#r]Сsr]c@sxeZdZejejedЬddДГZej e dЬddДГZej edЬddДГZ ejedЬd d ДГZej ejdЬddДГZej ejdЬd dДГZej edЬddДГZej edЬddДГZej ejejdЬddДГZej edЬddДГZej edЬddДГZej edЬddДГZej edЬddДГZejee dЬddДГZ!ejee dЬd d!ДГZ"eje dЬd"d#ДГZ#eje$j%ed$Ьd%d&ДГZ&d'S)(┌Certificateй┌ algorithmrcCsdSйz4 Returns bytes using digest passed. Nr"йrrar"r"r#┌fingerprintШszCertificate.fingerprintr=cCsdS)z3 Returns certificate serial number Nr"r>r"r"r#┌ serial_numberЮszCertificate.serial_numbercCsdS)z1 Returns the certificate version Nr"r>r"r"r#┌versionдszCertificate.versioncCsdSйz( Returns the public key Nr"r>r"r"r#┌ public_keyкszCertificate.public_keycCsdS)z? Not before time (represented as UTC datetime) Nr"r>r"r"r#┌not_valid_before░szCertificate.not_valid_beforecCsdS)z> Not after time (represented as UTC datetime) Nr"r>r"r"r#┌not_valid_after╢szCertificate.not_valid_aftercCsdS)z1 Returns the issuer name object. Nr"r>r"r"r#┌issuer╝szCertificate.issuercCsdSйz2 Returns the subject name object. Nr"r>r"r"r#┌subject┬szCertificate.subjectcCsdSйzt Returns a HashAlgorithm corresponding to the type of the digest signed in the certificate. Nr"r>r"r"r#┌signature_hash_algorithm╚sz$Certificate.signature_hash_algorithmcCsdSйzJ Returns the ObjectIdentifier of the signature algorithm. Nr"r>r"r"r#┌signature_algorithm_oid╤sz#Certificate.signature_algorithm_oidcCsdS)z/ Returns an Extensions object. Nr"r>r"r"r#r*╫szCertificate.extensionscCsdSйz. Returns the signature bytes. Nr"r>r"r"r#┌ signature▌szCertificate.signaturecCsdS)zR Returns the tbsCertificate payload bytes as defined in RFC 5280. Nr"r>r"r"r#┌tbs_certificate_bytesуsz!Certificate.tbs_certificate_bytesrAcCsdSйz" Checks equality. Nr"rEr"r"r#rFщszCertificate.__eq__cCsdSйz# Checks not equal. Nr"rEr"r"r#rGяszCertificate.__ne__cCsdSйz" Computes a hash. Nr"r>r"r"r#rIїszCertificate.__hash__й┌encodingrcCsdS)zB Serializes the certificate to PEM or DER format. Nr"йrryr"r"r#┌public_bytes√szCertificate.public_bytesN)'r$r%r&┌abc┌abstractmethodr┌ HashAlgorithmrJrd┌abstractpropertyrKrerZrfr rhr4rirjrrkrmrM┌Optionalrorrqrr*rsrt┌objectrOrFrGrIr┌Encodingr{r"r"r"r#r_ЧsF ■r_)┌ metaclassc@sJeZdZejedЬddДГZejejdЬddДГZeje dЬddДГZ dS) ┌RevokedCertificater=cCsdS)zG Returns the serial number of the revoked certificate. Nr"r>r"r"r#resz RevokedCertificate.serial_numbercCsdS)zH Returns the date of when this certificate was revoked. Nr"r>r"r"r#┌revocation_date sz"RevokedCertificate.revocation_datecCsdS)zW Returns an Extensions object containing a list of Revoked extensions. Nr"r>r"r"r#r*szRevokedCertificate.extensionsN)r$r%r&r|rrKrer4rЕrr*r"r"r"r#rДsrДc@sXeZdZeejedЬddДZeedЬddДГZeejdЬddДГZ eedЬd d ДГZ dS)┌_RawRevokedCertificateйrerЕr*cCs||_||_||_dSrй┌_serial_number┌_revocation_date┌_extensionsйrrerЕr*r"r"r#rsz_RawRevokedCertificate.__init__r=cCs|jSr)rЙr>r"r"r#re)sz$_RawRevokedCertificate.serial_numbercCs|jSr)rКr>r"r"r#rЕ-sz&_RawRevokedCertificate.revocation_datecCs|jSr)rЛr>r"r"r#r*1sz!_RawRevokedCertificate.extensionsN)r$r%r&rKr4rrrLrerЕr*r"r"r"r#rЖs№ rЖc@s▄eZdZejejedЬddДГZeje j edЬddДГZejee jedЬdd ДГZeje je j d ЬddДГZejed Ьd dДГZejed ЬddДГZeje jejd ЬddДГZejejd ЬddДГZejed ЬddДГZejed ЬddДГZejed ЬddДГZejeedЬddДГZ ejeedЬddДГZ!ejed Ьd d!ДГZ"e j#eed"Ьd#d$ДГZ$e j#e%e j&ed"Ьd%d$ДГZ$eje j'ee%fe j'ee j&efd"Ьd&d$ДГZ$eje j(ed Ьd'd(ДГZ)eje*ed)Ьd*d+ДГZ+d,S)-┌CertificateRevocationListrxcCsdS)z: Serializes the CRL to PEM or DER format. Nr"rzr"r"r#r{7sz&CertificateRevocationList.public_bytesr`cCsdSrbr"rcr"r"r#rd=sz%CertificateRevocationList.fingerprint)rercCsdS)zs Returns an instance of RevokedCertificate or None if the serial_number is not in the CRL. Nr")rrer"r"r#┌(get_revoked_certificate_by_serial_numberCszBCertificateRevocationList.get_revoked_certificate_by_serial_numberr=cCsdSrnr"r>r"r"r#roLsz2CertificateRevocationList.signature_hash_algorithmcCsdSrpr"r>r"r"r#rqUsz1CertificateRevocationList.signature_algorithm_oidcCsdS)zC Returns the X509Name with the issuer of this CRL. Nr"r>r"r"r#rk[sz CertificateRevocationList.issuercCsdS)z? Returns the date of next update for this CRL. Nr"r>r"r"r#┌next_updateasz%CertificateRevocationList.next_updatecCsdS)z? Returns the date of last update for this CRL. Nr"r>r"r"r#┌last_updategsz%CertificateRevocationList.last_updatecCsdS)zS Returns an Extensions object containing a list of CRL extensions. Nr"r>r"r"r#r*msz$CertificateRevocationList.extensionscCsdSrrr"r>r"r"r#rsssz#CertificateRevocationList.signaturecCsdS)zO Returns the tbsCertList payload bytes as defined in RFC 5280. Nr"r>r"r"r#┌tbs_certlist_bytesysz,CertificateRevocationList.tbs_certlist_bytesrAcCsdSrur"rEr"r"r#rFsz CertificateRevocationList.__eq__cCsdSrvr"rEr"r"r#rGЕsz CertificateRevocationList.__ne__cCsdS)z< Number of revoked certificates in the CRL. Nr"r>r"r"r#rWЛsz!CertificateRevocationList.__len__)┌idxrcCsdSrr"йrrТr"r"r#rYСsz%CertificateRevocationList.__getitem__cCsdSrr"rУr"r"r#rYХscCsdS)zS Returns a revoked certificate (or slice of revoked certificates). Nr"rУr"r"r#rYЩscCsdS)z8 Iterator over the revoked certificates Nr"r>r"r"r#rXбsz"CertificateRevocationList.__iter__)rhrcCsdS)zQ Verifies signature of revocation list against given public key. Nr")rrhr"r"r#┌is_signature_validзsz,CertificateRevocationList.is_signature_validN),r$r%r&r|r}rrВrJr{rr~rdrKrMrАrДrОrrorrqrrkr4rПrРrr*rsrСrБrOrFrGrW┌overloadrY┌slice┌List┌Union┌IteratorrXrrФr"r"r"r#rН6sV■ ■■rНc@s6eZdZejeedЬddДГZejeedЬddДГZeje dЬddДГZ ejedЬd d ДГZej edЬddДГZej ejejdЬd dДГZej edЬddДГZej edЬddДГZej edЬddДГZejejedЬddДГZej edЬddДГZej edЬddДГZ ej edЬddДГZ!ejeedЬdd ДГZ"d!S)"┌CertificateSigningRequestrAcCsdSrur"rEr"r"r#rF▓sz CertificateSigningRequest.__eq__cCsdSrvr"rEr"r"r#rG╕sz CertificateSigningRequest.__ne__r=cCsdSrwr"r>r"r"r#rI╛sz"CertificateSigningRequest.__hash__cCsdSrgr"r>r"r"r#rh─sz$CertificateSigningRequest.public_keycCsdSrlr"r>r"r"r#rm╩sz!CertificateSigningRequest.subjectcCsdSrnr"r>r"r"r#ro╨sz2CertificateSigningRequest.signature_hash_algorithmcCsdSrpr"r>r"r"r#rq┘sz1CertificateSigningRequest.signature_algorithm_oidcCsdS)z@ Returns the extensions in the signing request. Nr"r>r"r"r#r*▀sz$CertificateSigningRequest.extensionscCsdS)z/ Returns an Attributes object. Nr"r>r"r"r#r.хsz$CertificateSigningRequest.attributesrxcCsdS)z; Encodes the request to PEM or DER format. Nr"rzr"r"r#r{ыsz&CertificateSigningRequest.public_bytescCsdSrrr"r>r"r"r#rsёsz#CertificateSigningRequest.signaturecCsdS)zd Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC 2986. Nr"r>r"r"r#┌tbs_certrequest_bytesўsz/CertificateSigningRequest.tbs_certrequest_bytescCsdS)z8 Verifies signature of signing request. Nr"r>r"r"r#rФ■sz,CertificateSigningRequest.is_signature_validrScCsdS)z: Get the attribute value for a given OID. Nr")rrr"r"r#rUsz/CertificateSigningRequest.get_attribute_for_oidN)#r$r%r&r|r}rБrOrFrGrKrIrrhrrrmrMrАrr~rorrqrr*rPr.rrВrJr{rsrЫrФrUr"r"r"r#rЪ▒s: ■rЪ)┌data┌backendrcCs tа|бSr)┌ rust_x509┌load_pem_x509_certificateйrЬrЭr"r"r#rЯsrЯcCs tа|бSr)rЮ┌load_der_x509_certificaterаr"r"r#rбsrбcCs tа|бSr)rЮ┌load_pem_x509_csrrаr"r"r#rвsrвcCs tа|бSr)rЮ┌load_der_x509_csrrаr"r"r#rг%srгcCs tа|бSr)rЮ┌load_pem_x509_crlrаr"r"r#rд,srдcCs tа|бSr)rЮ┌load_der_x509_crlrаr"r"r#rе3srеc@sЪeZdZdggfejeejeeejej e efdЬddДZeddЬddДZ eeddЬd d ДZe eddЬdd ДZdeejejejedЬddДZdS)┌ CertificateSigningRequestBuilderN)┌subject_namer*r.cCs||_||_||_dS)zB Creates an empty X.509 certificate request (v1). N)┌ _subject_namerЛrR)rrзr*r.r"r"r#r:s z)CertificateSigningRequestBuilder.__init__й┌namercCs4t|tГstdГВ|jdur$tdГВt||j|jГS)zF Sets the certificate requestor's distinguished name. ·Expecting x509.Name object.N·&The subject name may only be set once.)rCr┌ TypeErrorrиr+rжrЛrRйrrкr"r"r#rзGs z-CertificateSigningRequestBuilder.subject_nameй┌extval┌criticalrcCsDt|tГstdГВt|j||Г}t||jГt|j|j|g|j ГS)zE Adds an X.509 extension to the certificate request. ·"extension must be an ExtensionType) rCrrнrrr-rЛrжrиrRйrr░r▒r)r"r"r#┌ add_extensionSs ¤z.CertificateSigningRequestBuilder.add_extension)rr9rcCsLt|tГstdГВt|tГs$tdГВt||jГt|j|j|j||fgГS)zK Adds an X.509 attribute with an OID and associated value. zoid must be an ObjectIdentifierzvalue must be bytes) rCrrнrJr0rRrжrиrЛ)rrr9r"r"r#┌ add_attributees ¤z.CertificateSigningRequestBuilder.add_attributeй┌private_keyrarЭrcCs |jdurtdГВtа|||бS)zF Signs the request using the requestor's private key. Nz/A CertificateSigningRequest must have a subject)rиr+rЮZcreate_x509_csrйrr╖rarЭr"r"r#┌signys z%CertificateSigningRequestBuilder.sign)N)r$r%r&rMrАrrЧrr┌TuplerrJrrзrOr┤r╡rrr~rNrЪr╣r"r"r"r#rж9s,№№ ■■№ √rжc @seZdZUejeeed<ddddddgfeje eje eje ejeejejejejejeeddЬddДZ e ddЬddДZe ddЬd d ДZe ddЬdd ДZeddЬddДZejddЬddДZejddЬddДZeeddЬddДZdeejejejedЬddДZdS)┌CertificateBuilderrЛN)┌issuer_namerзrhrerirjr*rcCs6tj|_||_||_||_||_||_||_||_ dSr) rZr\┌_version┌_issuer_namerи┌_public_keyrЙ┌_not_valid_before┌_not_valid_afterrЛ)rr╝rзrhrerirjr*r"r"r#rКs zCertificateBuilder.__init__rйcCsDt|tГstdГВ|jdur$tdГВt||j|j|j|j |j |jГS)z3 Sets the CA's distinguished name. rлN·%The issuer name may only be set once.)rCrrнr╛r+r╗rиr┐rЙr└r┴rЛrоr"r"r#r╝Эs ∙zCertificateBuilder.issuer_namecCsDt|tГstdГВ|jdur$tdГВt|j||j|j|j |j |jГS)z: Sets the requestor's distinguished name. rлNrм)rCrrнrиr+r╗r╛r┐rЙr└r┴rЛrоr"r"r#rзпs ∙zCertificateBuilder.subject_name)┌keyrc Cs`t|tjtjtjtjt j tjt jfГs.tdГВ|jdur@tdГВt|j|j||j|j|j|jГS)zT Sets the requestor's public key (as found in the signing request). zЙExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rCrZDSAPublicKeyr ZRSAPublicKeyrZEllipticCurvePublicKeyrZEd25519PublicKeyr ZEd448PublicKeyrZX25519PublicKeyrZ X448PublicKeyrнr┐r+r╗r╛rиrЙr└r┴rЛ)rr├r"r"r#rh┴s2∙■ ∙zCertificateBuilder.public_keyй┌numberrcCsht|tГstdГВ|jdur$tdГВ|dkr4tdГВ|абdkrHtdГВt|j|j|j ||j |j|jГS)z5 Sets the certificate serial number. ·'Serial number must be of integral type.N·'The serial number may only be set once.rz%The serial number should be positive.ща·3The serial number should not be more than 159 bits.) rCrKrнrЙr+┌ bit_lengthr╗r╛rиr┐r└r┴rЛйrr┼r"r"r#reцs& ∙z CertificateBuilder.serial_numberr1cCszt|tjГstdГВ|jdur&tdГВt|Г}|tkr>tdГВ|jdurZ||jkrZtdГВt|j |j |j|j||j|j ГS)z7 Sets the certificate activation time. ·Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rCr4rнr└r+r7┌_EARLIEST_UTC_TIMEr┴r╗r╛rиr┐rЙrЛйrr2r"r"r#ris, ∙z#CertificateBuilder.not_valid_beforecCszt|tjГstdГВ|jdur&tdГВt|Г}|tkr>tdГВ|jdurZ||jkrZtdГВt|j |j |j|j|j||j ГS)z7 Sets the certificate expiration time. r╠Nz)The not valid after may only be set once.ztdГВ|jdurZ||jkrZtdГВt|j ||j|j |jГS)Nr╠·!Last update may only be set once.·8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rCr4rнr╙r+r7r═r╘r╨r╛rЛr╤)rrРr"r"r#rРХs( √z,CertificateRevocationListBuilder.last_update)rПrcCsrt|tjГstdГВ|jdur&tdГВt|Г}|tkr>tdГВ|jdurZ||jkrZtdГВt|j |j||j |jГS)Nr╠r╒r╓z8The next update date must be after the last update date.)rCr4rнr╘r+r7r═r╙r╨r╛rЛr╤)rrПr"r"r#rПнs( √z,CertificateRevocationListBuilder.next_updaterпcCsLt|tГstdГВt|j||Г}t||jГt|j|j |j |j|g|jГS)zM Adds an X.509 extension to the certificate revocation list. r▓)rCrrнrrr-rЛr╨r╛r╙r╘r╤r│r"r"r#r┤┼s √z.CertificateRevocationListBuilder.add_extension)┌revoked_certificatercCs2t|tГstdГВt|j|j|j|j|j|gГS)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rCrДrнr╨r╛r╙r╘rЛr╤)rr╫r"r"r#┌add_revoked_certificate╪s √z8CertificateRevocationListBuilder.add_revoked_certificater╢cCsD|jdurtdГВ|jdur$tdГВ|jdur6tdГВtа|||бS)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r╛r+r╙r╘rЮZcreate_x509_crlr╕r"r"r#r╣щs z%CertificateRevocationListBuilder.sign)N)r$r%r&rMrЧrrr╧rДrАrr4rr╝rРrПrOr┤r╪rrr~rNrНr╣r"r"r"r#r╨tsH · ·■■■■■№ √r╨c@sЖeZdZddgfejeejejejee dЬddДZ eddЬddДZejddЬd d ДZe e ddЬdd ДZdejedЬddДZdS)┌RevokedCertificateBuilderNrЗcCs||_||_||_dSrrИrМr"r"r#r№sz"RevokedCertificateBuilder.__init__r─cCsXt|tГstdГВ|jdur$tdГВ|dkr4tdГВ|абdkrHtdГВt||j|jГS)Nr╞r╟rz$The serial number should be positiver╚r╔) rCrKrнrЙr+r╩r┘rКrЛr╦r"r"r#res z'RevokedCertificateBuilder.serial_numberr1cCsNt|tjГstdГВ|jdur&tdГВt|Г}|tkr>tdГВt|j||j ГS)Nr╠z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) rCr4rнrКr+r7r═r┘rЙrЛr╬r"r"r#rЕs z)RevokedCertificateBuilder.revocation_daterпcCsDt|tГstdГВt|j||Г}t||jГt|j|j |j|gГS)Nr▓) rCrrнrrr-rЛr┘rЙrКr│r"r"r#r┤(s ¤z'RevokedCertificateBuilder.add_extension)rЭrcCs:|jdurtdГВ|jdur$tdГВt|j|jt|jГГS)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)rЙr+rКrЖrrЛ)rrЭr"r"r#┌build6s ¤zRevokedCertificateBuilder.build)N)r$r%r&rMrАrKr4rЧrrrrerЕrOr┤rNrДr┌r"r"r"r#r┘√s № № ■■r┘r=cCstаtаdбdбd?S)Nщ┌bigr)rK┌ from_bytes┌os┌urandomr"r"r"r#┌random_serial_numberDsrр)N)N)N)N)N)N)Er|r4r▐rMZcryptographyrZ"cryptography.hazmat.bindings._rustrrЮZcryptography.hazmat.primitivesrrZ)cryptography.hazmat.primitives.asymmetricrrrr r rrZ/cryptography.hazmat.primitives.asymmetric.typesr rrZcryptography.x509.extensionsrrrrZcryptography.x509.namerrZcryptography.x509.oidrr═┌ ExceptionrrЧr-r║rJr0r7r8rP┌EnumrZr]┌ABCMetar_┌registerrДrЖrНrЪrNrЯrбrвrгrдrеrБrжr╗r╨r┘rKrрr"r"r"r#┌sР$ ¤¤ 'lx[ ■ ■ ■ ■ ■ ■NnI