U 2ܟj @s:UddlmZddlZddlZddlZddlZddlZddlmZddl m Z ddlm Z ddlm Z m Z mZejdkrddlmZn4ejd kred Zd d d dddZn ddlmZddlmZmZddlmZmZmZmZmZddlmZddlm Z!ddlm"Z#ddlm$Z%ddlm&Z'ddlm(Z)ddlm*Z+ddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1gZ,eej-ej.ej/ej0ej1fZ2eej3ej4ej5ej6ej7fZ8ee2e8fZ9ee:e d2e:ffZ;e'jd<e'j?Z@d3e>d<d4ZAe'jBZCd3e>d<e'jDZEd3e>d<e'jFZGd3e>d5<e'jHZId3e>d6<Gd7d d eJZKe e#eKZLe)eKZMdsd8d9d:d;d<ZNd9d=d>d?d@ZOd9d=dAdBdCdDZPd=d9dEdFdGZQd9d8dHdIdJZRGdKdLdLZSGdMd!d!ZTGdNdOdOZUedPdQdRdSd-ZVedTd dOdUdVd,ZWejXGdWd"d"ZYedXGdYd#d#ZZGdZddZ[Gd[d'd'Z\Gd\d$d$Z]Gd]d&d&eJZ^Gd^d%d%Z_d3d=dd_d`d.Z`d3dd=dadbd(Zad3d!d=dcddd+Zbdtd3d!dedfd=dgdhd*ZcGdidjdjZdd3dkd!d_dld1Zedud3dkdfd!dmdnd0Zfd3d#d=dodpd)ZgegZhejegeidXejd)dqd3d=d#d_drd/ZkekZlejekeidXejd/dqdS)v) annotationsN) b16encode)Sequence)partial)AnyCallableUnion) ) deprecated)r TstrobjectzCallable[[_T], _T])msgkwargsreturncKsddS)NcSs|SN)frr2/tmp/pip-unpacked-wheel-y9ao6mel/OpenSSL/crypto.pyzdeprecated..r)rrrrrr sr )utilsx509)dsaeced448ed25519rsa)StrOrBytesPath) byte_string)exception_from_error_queue)ffi)lib) make_assert) path_bytes FILETYPE_ASN1 FILETYPE_PEM FILETYPE_TEXTTYPE_DSATYPE_RSAX509ErrorPKeyX509NameX509Req X509StoreX509StoreContextX509StoreContextErrorX509StoreFlagsdump_certificatedump_certificate_requestdump_privatekeydump_publickeyget_elliptic_curveget_elliptic_curvesload_certificateload_certificate_requestload_privatekeyload_publickey.intiTYPE_DHTYPE_ECc@seZdZdZdS)r-z7 An error occurred in an `OpenSSL.crypto` API. N)__name__ __module__ __qualname____doc__rrrrr-rs bytes | Noner)bufferrcCsn|dkrtt}tj}n2td|}t|t|}|fdddddd}t|tj kt ||}|S)z Allocate a new OpenSSL memory BIO. Arrange for the garbage collector to clean it up automatically. :param buffer: None or some bytes to use to put into the BIO so that they can be read out. Nchar[]r)biorefrcSs t|Sr)_libBIO_free)rIrJrrrfreesz_new_mem_buf..free) rKZBIO_newZ BIO_s_memrL_ffinewZBIO_new_mem_buflen_openssl_assertNULLgc)rGrIrMdatarrr _new_mem_buf|s   rUbytes)rIrcCs.td}t||}t|d|ddS)zO Copy the contents of an OpenSSL BIO object into a Python byte string. zchar**rN)rNrOrKZBIO_get_mem_datarG)rI result_bufferZ buffer_lengthrrr_bio_to_strings  rXNone)boundarywhenrcCs@t|tstdt|tjkt||}|dkrtt|Std}t ||t |dtj ktd|d}t|}t|}t |d|SdS)a] Retrieve the time value of an ASN1 time object. @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to that type) from which the time value will be retrieved. @return: The time value from C{timestamp} as a L{bytes} string in a certain format. Or C{None} if the object contains no time value. z ASN1_STRING*rNzASN1_GENERALIZEDTIME**) rNcastrKASN1_STRING_lengthZASN1_STRING_typeZV_ASN1_GENERALIZEDTIMEstringASN1_STRING_get0_datarOZASN1_TIME_to_generalizedtimerQrRZASN1_GENERALIZEDTIME_free)rdZstring_timestampZgeneralized_timestampZ string_data string_resultrrr_get_asn1_times     rjc@s8eZdZddddZdddddZddd d Zd S) _X509NameInvalidatorrYrcCs g|_dSr)_namesselfrrr__init__sz_X509NameInvalidator.__init__r/namercCs|j|dSr)rmappendrorrrrraddsz_X509NameInvalidator.addcCs|jD]}|`qdSr)rm_namertrrrclears z_X509NameInvalidator.clearN)rBrCrDrprurwrrrrrksrkc@seZdZdZdZdZddddZddd d Zeddd d d Z ddddddZ ddddZ ddddZ ddddZ dS)r.zD A class representing an DSA or RSA public key or key pair. FTrYrlcCs"t}t|tj|_d|_dS)NF)rKZ EVP_PKEY_newrNrS EVP_PKEY_free_pkey _initializedropkeyrrrrpsz PKey.__init___KeycCsRddlm}m}|jr0tt|}tt||St t|}tt||ddSdS)a Export as a ``cryptography`` key. :rtype: One of ``cryptography``'s `key interfaces`_. .. _key interfaces: https://cryptography.io/en/latest/hazmat/ primitives/asymmetric/rsa/#key-interfaces .. versionadded:: 16.1.0 r)load_der_private_keyload_der_public_keyN)password) ,cryptography.hazmat.primitives.serializationr~r _only_publicr8r'typingrer}r7)ror~rderrrrto_cryptography_keys   zPKey.to_cryptography_key) crypto_keyrc Cst|tjtjtjtjtjtj t j t j t jt jf s:tdddlm}m}m}m}t|tjtjtj t j t jfrtt||j|jS||j|j|}tt|SdS)z Construct based on a ``cryptography`` *crypto_key*. :param crypto_key: A ``cryptography`` key. :type crypto_key: One of ``cryptography``'s `key interfaces`_. :rtype: PKey .. versionadded:: 16.1.0 zUnsupported key typer)Encoding NoEncryption PrivateFormat PublicFormatN)r\r DSAPrivateKey DSAPublicKeyrEllipticCurvePrivateKeyEllipticCurvePublicKeyrEd25519PrivateKeyEd25519PublicKeyrEd448PrivateKeyEd448PublicKeyr RSAPrivateKey RSAPublicKeyr]rrrrrr>r' public_bytesDERZSubjectPublicKeyInfoZ private_bytesZPKCS8r=)clsrrrrrrrrrfrom_cryptography_keysL  zPKey.from_cryptography_keyr?)typebitsrc Cs6t|tstdt|ts$td|tkr|dkr= 0`` :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't of the appropriate type. :raises ValueError: If the number of bits isn't an integer of the appropriate size. :return: ``None`` ztype must be an integerzbits must be an integerrzInvalid number of bitszNo such key typeTN)r\r?r]r+r^rKZBN_newrNrSBN_freeZ BN_set_wordZRSA_F4ZRSA_newZRSA_generate_key_exrRrQZEVP_PKEY_assign_RSAryr*ZDSA_newZDSA_freeZDSA_generate_parameters_exZDSA_generate_keyZEVP_PKEY_set1_DSAr-rz)rorrexponentrresultrresrrr generate_keySsB     zPKey.generate_keyboolcCsd|jrtdt|tjkr*tdt|j}t |tj }t |}|dkrZdSt dS)ax Check the consistency of an RSA private key. This is the Python equivalent of OpenSSL's ``RSA_check_key``. :return: ``True`` if key is consistent. :raise OpenSSL.crypto.Error: if the key is inconsistent. :raise TypeError: if the key is of a type which cannot be checked. Only RSA keys can currently be checked. zpublic key onlyz'Only RSA keys can currently be checked.rTN) rr]rKZ EVP_PKEY_typer EVP_PKEY_RSAEVP_PKEY_get1_RSAryrNrSRSA_freeZ RSA_check_key_raise_current_error)rorrrrrchecks   z PKey.checkcCs t|jS)zT Returns the type of the key :return: The type of the key. )rK EVP_PKEY_idryrnrrrrsz PKey.typecCs t|jS)zh Returns the number of bits of the key :return: The number of bits of the key. )rKZ EVP_PKEY_bitsryrnrrrrsz PKey.bitsN)rBrCrDrErrzrpr classmethodrrrrrrrrrr.s98cseZdZdZdZdddfdd Zeddd d d Zeddd d d ZeddddddZ dddddddZ ddddZ ddddZ Z S)_EllipticCurveaZ A representation of a supported elliptic curve. @cvar _curves: :py:obj:`None` until an attempt is made to load the curves. Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve` instances each of which represents one curve supported by the system. @type _curves: :py:type:`NoneType` or :py:type:`set` Nrrotherrcst|trt|StS)z Implement cooperation with the right-hand side argument of ``!=``. Python 3 seems to have dropped this cooperation in this very narrow circumstance. )r\rsuper__ne__NotImplementedror __class__rrrs  z_EllipticCurve.__ne__set[_EllipticCurve])r$rcs>tjd}td|}||tfdd|DS)z Get the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. rzEC_builtin_curve[]c3s|]}|jVqdSr)from_nidnid).0crr$rr sz7_EllipticCurve._load_elliptic_curves..)ZEC_get_builtin_curvesrNrRrOset)rr$Z num_curvesZbuiltin_curvesrrr_load_elliptic_curvess   z$_EllipticCurve._load_elliptic_curvescCs|jdkr|||_|jS)a Get, cache, and return the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. N)_curvesrrrrr_get_elliptic_curvess  z#_EllipticCurve._get_elliptic_curvesr?)r$rrcCs|||t||dS)a Instantiate a new :py:class:`_EllipticCurve` associated with the given OpenSSL NID. :param lib: The OpenSSL library binding object. :param nid: The OpenSSL NID the resulting curve object will represent. This must be a curve NID (and not, for example, a hash NID) or subsequent operations will fail in unpredictable ways. :type nid: :py:class:`int` :return: The curve object. ascii)rNrg OBJ_nid2sndecode)rr$rrrrrsz_EllipticCurve.from_nidrrY)r$rrrrcCs||_||_||_dS)a :param _lib: The :py:mod:`cryptography` binding instance used to interface with OpenSSL. :param _nid: The OpenSSL NID identifying the curve this object represents. :type _nid: :py:class:`int` :param name: The OpenSSL short name identifying the curve this object represents. :type name: :py:class:`unicode` N)rK_nidrr)ror$rrrrrrrps z_EllipticCurve.__init__rlcCsd|jdS)Nzrrrnrrr__repr__sz_EllipticCurve.__repr__cCs|j|j}t|tjS)z Create a new OpenSSL EC_KEY structure initialized to use this curve. The structure is automatically garbage collected when the Python object is garbage collected. )rKZEC_KEY_new_by_curve_namerrNrSZ EC_KEY_free)rokeyrrr _to_EC_KEYsz_EllipticCurve._to_EC_KEY)rBrCrDrErrrrrrrprr __classcell__rrrrrs   rzSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.rrlcCs ttS)a Return a set of objects representing the elliptic curves supported in the OpenSSL build in use. The curve objects have a :py:class:`unicode` ``name`` attribute by which they identify themselves. The curve objects are useful as values for the argument accepted by :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be used for ECDHE key exchange. )rrrKrrrrr:szRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.rqcCs,tD]}|j|kr|Sqtd|dS)aT Return a single curve object selected by name. See :py:func:`get_elliptic_curves` for information about curve objects. :param name: The OpenSSL short name identifying the curve object to retrieve. :type name: :py:class:`unicode` If the named curve is not supported then :py:class:`ValueError` is raised. zunknown curve nameN)r:rrr^)rrZcurverrrr90s   cseZdZdZdddddZddddfd d Zdd dd d ZdddddZdddddZddddZ ddddZ ddddZ ddddZ Z S) r/a An X.509 Distinguished Name. :ivar countryName: The country of the entity. :ivar C: Alias for :py:attr:`countryName`. :ivar stateOrProvinceName: The state or province of the entity. :ivar ST: Alias for :py:attr:`stateOrProvinceName`. :ivar localityName: The locality of the entity. :ivar L: Alias for :py:attr:`localityName`. :ivar organizationName: The organization name of the entity. :ivar O: Alias for :py:attr:`organizationName`. :ivar organizationalUnitName: The organizational unit of the entity. :ivar OU: Alias for :py:attr:`organizationalUnitName` :ivar commonName: The common name of the entity. :ivar CN: Alias for :py:attr:`commonName`. :ivar emailAddress: The e-mail address of the entity. rYrqcCs t|j}t|tj|_dS)z Create a new X509Name, copying the given X509Name instance. :param name: The name to copy. :type name: :py:class:`X509Name` N)rKZ X509_NAME_duprvrNrSZX509_NAME_freertrrrrp`s zX509Name.__init__rr)rrvaluerc s|drt||St|tk rr) rNrOrKZX509_NAME_onelinervrPrQrRformatrgr)rorWZ format_resultrrrrs zX509Name.__repr__r?cCs t|jS)a& Return an integer representation of the first four bytes of the MD5 digest of the DER representation of the name. This is the Python equivalent of OpenSSL's ``X509_NAME_hash``. :return: The (integer) hash of this name. :rtype: :py:class:`int` )rKZX509_NAME_hashrvrnrrrhashs z X509Name.hashrVcCsNtd}t|j|}t|dkt|d|dd}t|d|S)z Return the DER encoding of this name. :return: The DER encoded form of this name. :rtype: :py:class:`bytes` rrN)rNrOrKZ i2d_X509_NAMErvrQrGr)rorWZ encode_resultrirrrrs   z X509Name.derzlist[tuple[bytes, bytes]]c Csg}tt|jD]n}t|j|}t|}t|}t|}t|}t t |t |dd}| t ||fq|S)z Returns the components of this name, as a sequence of 2-tuples. :return: The components of this name. :rtype: :py:class:`list` of ``name, value`` tuples. N)rrKrrvrrrrrrNrGrhrfrsrg) rorrrfnameZfvalrrrrrrrget_componentss     zX509Name.get_components)rBrCrDrErprrrrrrrrrrrrrr/Fs '( zPCSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c@seZdZdZddddZddddZeddd d d Zd dd ddZd dddZ dddddZ ddddZ ddddZ d dddddZ d dd d d!Zd"S)#r0z An X.509 certificate signing requests. .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. rYrlcCs&t}t|tj|_|ddSr)rKZ X509_REQ_newrNrS X509_REQ_free_req set_version)roreqrrrrpszX509Req.__init__zx509.CertificateSigningRequestcCsddlm}tt|}||S)z Export as a ``cryptography`` certificate signing request. :rtype: ``cryptography.x509.CertificateSigningRequest`` .. versionadded:: 17.1.0 r)load_der_x509_csr)cryptography.x509r"_dump_certificate_request_internalr')rorrrrrto_cryptographys  zX509Req.to_cryptography) crypto_reqrcCs6t|tjstdddlm}||j}tt |S)a Construct based on a ``cryptography`` *crypto_req*. :param crypto_req: A ``cryptography`` X.509 certificate signing request :type crypto_req: ``cryptography.x509.CertificateSigningRequest`` :rtype: X509Req .. versionadded:: 17.1.0 z%Must be a certificate signing requestrr) r\rZCertificateSigningRequestr]rrrr"_load_certificate_request_internalr')rrrrrrrfrom_cryptography)s    zX509Req.from_cryptographyr.r|rcCs t|j|j}t|dkdS)z Set the public key of the certificate signing request. :param pkey: The public key to use. :type pkey: :py:class:`PKey` :return: ``None`` rN)rKZX509_REQ_set_pubkeyrryrQror|r_rrr set_pubkey?s zX509Req.set_pubkeycCsDtt}t|j|_t|jtjkt |jtj |_d|_ |S)z Get the public key of the certificate signing request. :return: The public key. :rtype: :py:class:`PKey` T) r.__new__rKZX509_REQ_get_pubkeyrryrQrNrRrSrxrr{rrr get_pubkeyKs  zX509Req.get_pubkeyr?versionrcCs@t|tstd|dkr"tdt|j|}t|dkdS)z Set the version subfield (RFC 2986, section 4.1) of the certificate request. :param int version: The version number. :return: ``None`` zversion must be an intrz9Invalid version. The only valid version for X509Req is 0.rN)r\r?r]r^rKZX509_REQ_set_versionrrQ)rorr_rrrrYs zX509Req.set_versioncCs t|jS)z Get the version subfield (RFC 2459, section 4.1.2.1) of the certificate request. :return: The value of the version subfield. :rtype: :py:class:`int` )rKZX509_REQ_get_versionrrnrrr get_versionjszX509Req.get_versionr/cCs2tt}t|j|_t|jtjk||_ |S)a Return the subject of this certificate signing request. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate signing request. Modifying it will modify the underlying signing request, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate signing request. :rtype: :class:`X509Name` ) r/rrKZX509_REQ_get_subject_namerrvrQrNrR_ownerrtrrr get_subjectts zX509Req.get_subjectrr|digestrcCs^|jrtd|jstdtt|}|tjkrZd dd?d@dAZd5ddBdCZd dd?dDdEZddFd6dGdHZddFddIdJdKZdFddLdMZdFddNdOdPZdFddQdRZ dFddSdTdUZ!dddVdWZ"dXS)Yr,z An X.509 certificate. rYrlcCs:t}t|tjkt|tj|_t|_ t|_ dSr) rKZX509_newrQrNrRrS X509_free_x509rk_issuer_invalidator_subject_invalidator)rorrrrrps z X509.__init__r)rrcCs.||}t|tj|_t|_t|_|Sr) rrNrSrKrr rkr r )rrcertrrr_from_raw_x509_ptrs  zX509._from_raw_x509_ptrzx509.CertificatecCsddlm}tt|}||S)z Export as a ``cryptography`` certificate. :rtype: ``cryptography.x509.Certificate`` .. versionadded:: 17.1.0 r)load_der_x509_certificate)rrr5r')rorrrrrrs  zX509.to_cryptography) crypto_certrcCs6t|tjstdddlm}||j}tt |S)z Construct based on a ``cryptography`` *crypto_cert*. :param crypto_key: A ``cryptography`` X.509 certificate. :type crypto_key: ``cryptography.x509.Certificate`` :rtype: X509 .. versionadded:: 17.1.0 zMust be a certificaterr) r\rZ Certificater]rrrrr;r')rrrrrrrrs   zX509.from_cryptographyr?rcCs,t|tstdtt|j|dkdS)a  Set the version number of the certificate. Note that the version value is zero-based, eg. a value of 0 is V1. :param version: The version number of the certificate. :type version: :py:class:`int` :return: ``None`` zversion must be an integerrN)r\r?r]rQrKZX509_set_versionr )rorrrrrs zX509.set_versioncCs t|jS)z Return the version number of the certificate. :return: The version number of the certificate. :rtype: :py:class:`int` )rKZX509_get_versionr rnrrrrszX509.get_versionr.cCsFtt}t|j|_|jtjkr*tt |jtj |_d|_ |S)z{ Get the public key of the certificate. :return: The public key. :rtype: :py:class:`PKey` T) r.rrKZX509_get_pubkeyr ryrNrRrrSrxrr{rrrrs  zX509.get_pubkeyrcCs2t|tstdt|j|j}t|dkdS)z Set the public key of the certificate. :param pkey: The public key. :type pkey: :py:class:`PKey` :return: :py:data:`None` rrN)r\r.r]rKZX509_set_pubkeyr ryrQrrrrrs zX509.set_pubkeyrrcCspt|tstd|jr td|js.tdtt|}|t j krNtdt |j |j |}t|dkdS)a Sign the certificate with this key and digest type. :param pkey: The key to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use. :type digest: :py:class:`str` :return: :py:data:`None` rzKey only has public partrrrN)r\r.r]rr^rzrKrrrNrRZ X509_signr ryrQ)ror|rZevp_mdrrrrr$s  z X509.signrVcCsZt|j}td}t|tjtj|t|d}|tjkrJt dt t |S)z Return the signature algorithm used in the certificate. :return: The name of the algorithm. :rtype: :py:class:`bytes` :raises ValueError: If the signature algorithm is undefined. .. versionadded:: 0.13 zASN1_OBJECT **rzUndefined signature algorithm) rKZX509_get0_tbs_sigalgr rNrOZX509_ALGOR_get0rRrrr^rgZ OBJ_nid2ln)roZsig_algZalgrrrrget_signature_algorithm@s   zX509.get_signature_algorithm) digest_namercCstt|}|tjkr tdtdtj}tdd}t||d<t |j |||}t |dkd ddt ||dDS) a5 Return the digest of the X509 object. :param digest_name: The name of the digest algorithm to use. :type digest_name: :py:class:`str` :return: The digest of the object, formatted as :py:const:`b":"`-delimited hex pairs. :rtype: :py:class:`bytes` rzunsigned char[]zunsigned int[]rr:cSsg|]}t|qSr)rupper)rchrrr lszX509.digest..)rKrrrNrRr^rOZEVP_MAX_MD_SIZErPZ X509_digestr rQjoinrG)rorrrWZ result_lengthZ digest_resultrrrrSs$     z X509.digestcCs t|jS)z Return the hash of the X509 subject. :return: The hash of the subject. :rtype: :py:class:`int` )rKZX509_subject_name_hashr rnrrrsubject_name_hashrszX509.subject_name_hash)serialrcCst|tstdt|dd}|d}td}t||}t |tj kt |dtj }t |dt |tj kt |tj}t|j|}t |dkdS)z Set the serial number of the certificate. :param serial: The new serial number. :type serial: :py:class:`int` :return: :py:data`None` zserial must be an integerNrzBIGNUM**rr)r\r?r]hexrrNrOrKZ BN_hex2bnrQrRZBN_to_ASN1_INTEGERrrSZASN1_INTEGER_freeZX509_set_serialNumberr )ror hex_serialZhex_serial_bytes bignum_serialr asn1_serialr_rrrset_serial_number{s    zX509.set_serial_numberc Csht|j}t|tj}zrr@rArrrrr,sB           c@seZdZUdZejZded<ejZ ded<ej Z ded<ej Z ded<ejZded<ejZded<ejZded <ejZded <ejZded <ejZded <d S)r4a  Flags for X509 verification, used to change the behavior of :class:`X509Store`. See `OpenSSL Verification Flags`_ for details. .. _OpenSSL Verification Flags: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html r? CRL_CHECK CRL_CHECK_ALLIGNORE_CRITICAL X509_STRICTALLOW_PROXY_CERTS POLICY_CHECKEXPLICIT_POLICY INHIBIT_MAPCHECK_SS_SIGNATURE PARTIAL_CHAINN)rBrCrDrErKZX509_V_FLAG_CRL_CHECKrB__annotations__ZX509_V_FLAG_CRL_CHECK_ALLrCZX509_V_FLAG_IGNORE_CRITICALrDZX509_V_FLAG_X509_STRICTrEZX509_V_FLAG_ALLOW_PROXY_CERTSrFZX509_V_FLAG_POLICY_CHECKrGZX509_V_FLAG_EXPLICIT_POLICYrHZX509_V_FLAG_INHIBIT_MAPrIZX509_V_FLAG_CHECK_SS_SIGNATURErJZX509_V_FLAG_PARTIAL_CHAINrKrrrrr4hs  c@sreZdZdZddddZddddd Zd dd d d ZdddddZdddddZdddddddZ dS)r1a An X.509 store. An X.509 store is used to describe a context in which to verify a certificate. A description of a context may include a set of certificates to trust, a set of certificate revocation lists, verification flags and more. An X.509 store, being only a description, cannot be used by itself to verify a certificate. To carry out the actual verification process, see :class:`X509StoreContext`. rYrlcCst}t|tj|_dSr)rKZX509_STORE_newrNrSZX509_STORE_free_storerostorerrrrpszX509Store.__init__r,)r rcCs0t|tstt|j|j}t|dkdS)a Adds a trusted certificate to this store. Adding a certificate with this method adds this certificate as a *trusted* certificate. :param X509 cert: The certificate to add to this store. :raises TypeError: If the certificate is not an :class:`X509`. :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your certificate. :return: ``None`` if the certificate was added successfully. rN)r\r,r]rKZX509_STORE_add_certrMr rQ)ror rrrradd_certs zX509Store.add_certzx509.CertificateRevocationList)crlrcCsvt|tjrTddlm}t||j}t |t j }t |t j kt |tj}ntdt t|j|dkdS)a Add a certificate revocation list to this store. The certificate revocation lists added to a store will only be used if the associated flags are configured to check certificate revocation lists. .. versionadded:: 16.1.0 :param crl: The certificate revocation list to add to this store. :type crl: ``cryptography.x509.CertificateRevocationList`` :return: ``None`` if the certificate revocation list was added successfully. rrz?CRL must be of type cryptography.x509.CertificateRevocationListN)r\rZCertificateRevocationListrrrUrrrKZd2i_X509_CRL_biorNrRrQrSZ X509_CRL_freer]ZX509_STORE_add_crlrM)rorQrrIZ openssl_crlrrradd_crls  zX509Store.add_crlr?)flagsrcCstt|j|dkdS)a Set verification flags to this store. Verification flags can be combined by oring them together. .. note:: Setting a verification flag sometimes requires clients to add additional information to the store, otherwise a suitable error will be raised. For example, in setting flags to enable CRL checking a suitable CRL must be added to the store otherwise an error will be raised. .. versionadded:: 16.1.0 :param int flags: The verification flags to set on this store. See :class:`X509StoreFlags` for available constants. :return: ``None`` if the verification flags were successfully set. rN)rQrKZX509_STORE_set_flagsrM)rorSrrr set_flagsszX509Store.set_flagszdatetime.datetime)vfy_timercCsFt}t|tj}t|t|t t |j |dkdS)a Set the time against which the certificates are verified. Normally the current time is used. .. note:: For example, you can determine if a certificate was valid at a given time. .. versionadded:: 17.0.0 :param datetime vfy_time: The verification time to set on this store. :return: ``None`` if the verification time was successfully set. rN) rKZX509_VERIFY_PARAM_newrNrSZX509_VERIFY_PARAM_freeZX509_VERIFY_PARAM_set_timecalendartimegm timetuplerQZX509_STORE_set1_paramrM)rorUparamrrrset_times zX509Store.set_timeNzStrOrBytesPath | None)cafilecapathrcCsN|dkrtj}nt|}|dkr(tj}nt|}t|j||}|sJtdS)a Let X509Store know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If *capath* is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *cafile* or *capath* may be ``None``. .. note:: Both *cafile* and *capath* may be set simultaneously. Call this method multiple times to add more than one location. For example, CA certificates, and certificate revocation list bundles may be passed in *cafile* in subsequent calls to this method. .. versionadded:: 20.0 :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: ``None`` if the locations were set successfully. :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None`` or the locations could not be set for any reason. N)rNrR _path_bytesrKZX509_STORE_load_locationsrMr)ror[r\Z load_resultrrrload_locationss#zX509Store.load_locations)N) rBrCrDrErprPrRrTrZr^rrrrr1s cs,eZdZdZdddddfdd ZZS) r3z An exception raised when an error occurred while verifying a certificate using `OpenSSL.X509StoreContext.verify_certificate`. :ivar certificate: The certificate which caused verificate failure. :type certificate: :class:`X509` rz list[Any]r,rY)messageerrors certificatercst|||_||_dSr)rrpr`ra)ror_r`rarrrrp2s zX509StoreContextError.__init__)rBrCrDrErprrrrrr3)sc@seZdZdZdddddddd Zeddd d d Zed ddddZd dddZdddddZ ddddZ ddddZ dS)r2a9 An X.509 store context. An X.509 store context is used to carry out the actual verification process of a certificate in a described context. For describing such a context, see :class:`X509Store`. :param X509Store store: The certificates which will be trusted for the purposes of any verifications. :param X509 certificate: The certificate to be verified. :param chain: List of untrusted certificates that may be used for building the certificate chain. May be ``None``. :type chain: :class:`list` of :class:`X509` Nr1r,zSequence[X509] | NonerY)rOrachainrcCs||_||_|||_dSr)rM_cert_build_certificate_stack_chain)rorOrarbrrrrpJszX509StoreContext.__init__) certificatesrcCsddddd}|dks$t|dkr*tjSt}t|tjkt||}|D]N}t|tsft dtt |j dkt ||j dkrPt |j tqP|S)NrrY)srcSs8tt|D]}t||}t|qt|dSr)rrK sk_X509_num sk_X509_valuer sk_X509_free)rgrxrrrcleanupXs  z:X509StoreContext._build_certificate_stack..cleanuprz+One of the elements is not an X509 instance)rPrNrRrKZsk_X509_new_nullrQrSr\r,r]Z X509_up_refr Z sk_X509_pushrr)rfrlstackr rrrrdTs   z)X509StoreContext._build_certificate_stackrr3) store_ctxrcCs\ttt|d}t|t||g}t|}t|}t |}t |||S)z Convert an OpenSSL native context error failure into a Python exception. When a call to native OpenSSL X509_verify_cert fails, additional information about the failure can be obtained from the store context. r) rNrgrKZX509_verify_cert_error_stringZX509_STORE_CTX_get_errorrZX509_STORE_CTX_get_error_depthZX509_STORE_CTX_get_current_certZX509_dupr,r r3)rnr_r`r rcpycertrrr_exception_from_contextrs    z(X509StoreContext._exception_from_contextrlcCsjt}t|tjkt|tj}t||jj|j j |j }t|dkt |}|dkrf| ||S)a3 Verifies the certificate and runs an X509_STORE_CTX containing the results. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. rr)rKZX509_STORE_CTX_newrQrNrRrSZX509_STORE_CTX_freeZX509_STORE_CTX_initrMrcr reZX509_verify_certrp)rornrbrrr_verify_certificates    z$X509StoreContext._verify_certificate)rOrcCs ||_dS)z Set the context's X.509 store. .. versionadded:: 0.15 :param X509Store store: The store description which will be used for the purposes of any *future* verifications. N)rMrNrrr set_stores zX509StoreContext.set_storecCs |dS)a" Verify a certificate in a context. .. versionadded:: 0.15 :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. N)rqrnrrrverify_certificates z#X509StoreContext.verify_certificatez list[X509]cCst|}t|}t|tjkg}tt|D]2}t||}t|tjkt |}| |q2t ||S)aR Verify a certificate in a context and return the complete validated chain. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. .. versionadded:: 20.0 ) rqrKZX509_STORE_CTX_get1_chainrQrNrRrrhrir,r rsrj)rornZ cert_stackrrr rorrrget_verified_chains      z#X509StoreContext.get_verified_chain)N) rBrCrDrErp staticmethodrdrprqrrrsrtrrrrr2:s   )rrGrcCsvt|tr|d}t|}|tkrs&    )rrGr{rcCst|tr|d}t|}t||}|tkrNt|tj |j |j }| n |t krft|tj }ntd|tj kr~ttt}t|tj|_|S)a Load a private key (PKey) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the key is stored in :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The PKey object rrv)r\rrrUr|r(rKZPEM_read_bio_PrivateKeyrNrRr}r~rr'Zd2i_PrivateKey_bior^rr.rrSrxry)rrGr{rIrrr|rrrr=s(      )rrrcCsnt}|tkrt||j}n<|tkr6t||j}n$|tkrRt||jdd}nt dt |dkt |S)av Dump the certificate request *req* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param req: The certificate request to dump :return: The buffer with the dumped certificate request in .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. rrw) rUr(rKZPEM_write_bio_X509_REQrr'Zi2d_X509_REQ_bior)ZX509_REQ_print_exr^rQrX)rrrIrxrrrr6s  rcCst|tr|d}t|}|tkrr=r6rrBDeprecationWarningr<rrrrrs                   BgC,3+EN%)