U /je @sddlmZddlZddlZddlZddlmZddlmZddl m Z ddl m Z ddlmZmZmZmZmZmZmZmZddlmZmZdd lmZmZmZdd lmZm Z dd l!m"Z"ed d d Z#ej$e j%e j&e j'e j(e j)e j*e j+e j,fZ-Gddde.Z/ddddddZ0ddddddZ1dddddZ2Gdd d Z3Gd!d"d"Z4Gd#d$d$ej5Z6Gd%d&d&e.Z7e j8Z8e j9Z9e j:Z:e j;Z;e jZ>e j?Z?e j@Z@e jAZAe jBZBGd'd(d(ZCGd)d*d*ZDGd+d,d,ZEGd-d.d.ZFd/d0d1d2ZGdS)3) annotationsN)Iterable)utils)x509)hashes)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificatePublicKeyTypes) Extension ExtensionType_make_sequence_methods)Name _ASN1Type)ObjectIdentifierics&eZdZddddfdd ZZS)AttributeNotFoundstrrNone)msgoidreturncst|||_dSN)super__init__r)selfrr __class__:/tmp/pip-unpacked-wheel-qzbw3lpx/cryptography/x509/base.pyr 6s zAttributeNotFound.__init____name__ __module__ __qualname__r __classcell__r$r$r"r%r5srzExtension[ExtensionType]list[Extension[ExtensionType]]r) extension extensionsrcCs"|D]}|j|jkrtdqdS)Nz$This extension has already been set.)r ValueError)r,r-er$r$r%_reject_duplicate_extension;s r0r0list[tuple[ObjectIdentifier, bytes, int | None]])r attributesrcCs$|D]\}}}||krtdqdS)Nz$This attribute has already been set.)r.)rr2Zattr_oid_r$r$r%_reject_duplicate_attributeEsr4datetime.datetimetimercCs:|jdk r2|}|r|nt}|jdd|S|SdS)zNormalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. N)tzinfo)r8 utcoffsetdatetime timedeltareplace)r7offsetr$r$r%_convert_to_naive_utc_timeOs  r>c@sxeZdZejjfdddddddZeddd d Zeddd d Zd dddZ dddddZ ddddZ dS) Attributerbytesintr)rvalue_typercCs||_||_||_dSr)_oid_valuerC)r!rrBrCr$r$r%r ^szAttribute.__init__rcCs|jSr)rDr!r$r$r%rhsz Attribute.oidcCs|jSr)rErGr$r$r%rBlszAttribute.valuercCsd|jd|jdS)Nz)rrBrGr$r$r%__repr__pszAttribute.__repr__objectbool)otherrcCs2t|tstS|j|jko0|j|jko0|j|jkSr) isinstancer?NotImplementedrrBrC)r!rLr$r$r%__eq__ss    zAttribute.__eq__cCst|j|j|jfSr)hashrrBrCrGr$r$r%__hash__}szAttribute.__hash__N) r'r(r)rZ UTF8StringrBr propertyrrIrOrQr$r$r$r%r?]s  r?c@sHeZdZdddddZed\ZZZddd d Zd d d ddZ dS) AttributeszIterable[Attribute]r)r2rcCst||_dSr)list _attributes)r!r2r$r$r%r szAttributes.__init__rUrrFcCsd|jdS)Nz t|ts>tdt||j|dk rZ|j}nd}t|j |j |j|||ffS)zK Adds an X.509 attribute with an OID and associated value. zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type) rMrrir@rr4rUrBr`rcrd)r!rrBrqtagr$r$r% add_attributes   z.CertificateSigningRequestBuilder.add_attribute rsa_paddingecdsa_deterministicr_AllowedHashTypes | None typing.Any%padding.PSS | padding.PKCS1v15 | None bool | NoneCertificateSigningRequest private_key algorithmbackendrurvrcCsv|jdkrtd|dk rHt|tjtjfs4tdt|tjsHtd|dk rdt|t j sdtdt |||||S)zF Signs the request using the requestor's private key. Nz/A CertificateSigningRequest must have a subjectPadding must be PSS or PKCS1v15&Padding is only supported for RSA keys1Deterministic ECDSA is only supported for EC keys) rcr.rMr PSSPKCS1v15rir RSAPrivateKeyrEllipticCurvePrivateKey rust_x509Zcreate_x509_csrr!r}r~rrurvr$r$r%signs&   z%CertificateSigningRequestBuilder.sign)N)r'r(r)r rbrprsrr$r$r$r%r`s  $r`c @seZdZUded<ddddddgfddddddddd d d Zd dd ddZd dd ddZdddddZdddddZdddddZ dddddZ d d!dd"d#d$Z d/ddd%d&d'd(d)d*d+d,d-d.Z dS)0CertificateBuilderr+rdNraz CertificatePublicKeyTypes | None int | Nonedatetime.datetime | Noner) issuer_namerb public_key serial_numbernot_valid_beforenot_valid_afterr-rcCs6tj|_||_||_||_||_||_||_||_ dSr) r[r]_version _issuer_namerc _public_key_serial_number_not_valid_before_not_valid_afterrd)r!rrbrrrrr-r$r$r%r 's zCertificateBuilder.__init__rrecCsDt|tstd|jdk r$tdt||j|j|j|j |j |j S)z3 Sets the CA's distinguished name. rgN%The issuer name may only be set once.) rMrrirr.rrcrrrrrdrjr$r$r%r:s  zCertificateBuilder.issuer_namecCsDt|tstd|jdk r$tdt|j||j|j|j |j |j S)z: Sets the requestor's distinguished name. rgNrh) rMrrircr.rrrrrrrdrjr$r$r%rbLs  zCertificateBuilder.subject_namer)keyrc Cs`t|tjtjtjtjt j t j t jfs.td|jdk r@tdt|j|j||j|j|j|jS)zT Sets the requestor's public key (as found in the signing request). zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rMrZ DSAPublicKeyr Z RSAPublicKeyrZEllipticCurvePublicKeyr ZEd25519PublicKeyr ZEd448PublicKeyrZX25519PublicKeyr Z X448PublicKeyrirr.rrrcrrrrd)r!rr$r$r%r^s2  zCertificateBuilder.public_keyrAnumberrcCsht|tstd|jdk r$td|dkr4td|dkrHtdt|j|j|j ||j |j |j S)z5 Sets the certificate serial number. 'Serial number must be of integral type.N'The serial number may only be set once.rz%The serial number should be positive.3The serial number should not be more than 159 bits.) rMrArirr. bit_lengthrrrcrrrrdr!rr$r$r%rs&   z CertificateBuilder.serial_numberr5r6cCszt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j |j |j ||j|j S)z7 Sets the certificate activation time. Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rMr:rirr.r>_EARLIEST_UTC_TIMErrrrcrrrdr!r7r$r$r%rs,  z#CertificateBuilder.not_valid_beforecCszt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j |j |j |j||j S)z7 Sets the certificate expiration time. rNz)The not valid after may only be set once.zrrrrrcrrrdrr$r$r%rs2  z"CertificateBuilder.not_valid_afterrrKrkc CsTt|tstdt|j||}t||jt|j|j |j |j |j |j |j|fS)z= Adds an X.509 extension to the certificate. rn)rMrrirrr0rdrrrcrrrrror$r$r%rps   z CertificateBuilder.add_extensionrtrrwrxryrz Certificater|cCs|jdkrtd|jdkr$td|jdkr6td|jdkrHtd|jdkrZtd|jdkrltd|dk rt|tj tj fst dt|t j st d |dk rt|tjst d t|||||S) zC Signs the certificate using the CA's private key. Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyrrr)rcr.rrrrrrMr rrrir rrrrZcreate_x509_certificaterr$r$r%rs:        zCertificateBuilder.sign)N) r'r(r)__annotations__r rrbrrrrrprr$r$r$r%r$s* %rc @seZdZUded<ded<dddggfddddddd d Zd dd d dZdddddZdddddZddddddZdddddZ d)dddd d!d"d#d$d%d&d'd(Z dS)* CertificateRevocationListBuilderr+rdzlist[RevokedCertificate]_revoked_certificatesNrar)r last_update next_updater-revoked_certificatescCs"||_||_||_||_||_dSr)r _last_update _next_updaterdr)r!rrrr-rr$r$r%r 's z)CertificateRevocationListBuilder.__init__r)rrcCs<t|tstd|jdk r$tdt||j|j|j|j S)Nrgr) rMrrirr.rrrrdr)r!rr$r$r%r5s  z,CertificateRevocationListBuilder.issuer_namer5)rrcCsrt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j ||j|j |j S)Nr!Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) rMr:rirr.r>rrrrrdr)r!rr$r$r%rDs(  z,CertificateRevocationListBuilder.last_update)rrcCsrt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j||j |j S)Nrrrz8The next update date must be after the last update date.) rMr:rirr.r>rrrrrdr)r!rr$r$r%r\s(  z,CertificateRevocationListBuilder.next_updaterrKrkcCsLt|tstdt|j||}t||jt|j|j |j |j|f|j S)zM Adds an X.509 extension to the certificate revocation list. rn) rMrrirrr0rdrrrrrror$r$r%rpts   z.CertificateRevocationListBuilder.add_extensionRevokedCertificate)revoked_certificatercCs2t|tstdt|j|j|j|j|j|fS)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rMrrirrrrrdr)r!rr$r$r%add_revoked_certificates  z8CertificateRevocationListBuilder.add_revoked_certificatertrrwrxryrzCertificateRevocationListr|cCs|jdkrtd|jdkr$td|jdkr6td|dk rlt|tjtjfsXtdt|t j sltd|dk rt|t j stdt |||||S)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timerrr)rr.rrrMr rrrir rrrrZcreate_x509_crlrr$r$r%rs.     z%CertificateRevocationListBuilder.sign)N) r'r(r)rr rrrrprrr$r$r$r%r#s$ rc@sjeZdZddgfddddddZddd d d Zd dd ddZddddddZddddddZdS)RevokedCertificateBuilderNrrr+)rrevocation_dater-cCs||_||_||_dSr)r_revocation_daterd)r!rrr-r$r$r%r sz"RevokedCertificateBuilder.__init__rArcCsXt|tstd|jdk r$td|dkr4td|dkrHtdt||j|jS)Nrrrz$The serial number should be positiverr) rMrArirr.rrrrdrr$r$r%rs   z'RevokedCertificateBuilder.serial_numberr5r6cCsNt|tjstd|jdk r&tdt|}|tkr>tdt|j||j S)Nrz)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) rMr:rirr.r>rrrrdrr$r$r%rs  z)RevokedCertificateBuilder.revocation_daterrKrkcCsDt|tstdt|j||}t||jt|j|j |j|fS)Nrn) rMrrirrr0rdrrrror$r$r%rps   z'RevokedCertificateBuilder.add_extensionrxr)rrcCs.|jdkrtd|jdkr$tdt|S)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)rr.rrZcreate_revoked_certificate)r!rr$r$r%builds  zRevokedCertificateBuilder.build)N)r'r(r)r rrrprr$r$r$r%rs rrArFcCsttddd?S)Nbigr)rA from_bytesosurandomr$r$r$r%random_serial_numbersr)H __future__rr:rtypingcollections.abcrZ cryptographyrZ"cryptography.hazmat.bindings._rustrrZcryptography.hazmat.primitivesrZ)cryptography.hazmat.primitives.asymmetricrrr r r r r rZ/cryptography.hazmat.primitives.asymmetric.typesrrZcryptography.x509.extensionsrrrZcryptography.x509.namerrZcryptography.x509.oidrrUnionSHA224SHA256SHA384SHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512Z_AllowedHashTypes Exceptionrr0r4r>r?rSEnumr[r^rrrr{Zload_pem_x509_certificateZload_der_x509_certificateZload_pem_x509_certificatesZload_pem_x509_csrZload_der_x509_csrZload_pem_x509_crlZload_der_x509_crlr`rrrrr$r$r$r%sf     (     $pE