o i7@sUddlmZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z ddlm Z ddlmZmZmZejdkrIddlmZnejd krYed ZdwddZnddlmZddlmZmZddlmZmZmZmZmZddlm Z ddlm!Z"ddlm#Z$ddlm%Z&ddlm'Z(ddlm)Z*ddlm+Z,gdZ-eej.ej/ej0ej1ej2fZ3eej4ej5ej6ej7ej8fZ9ee3e9fZ:ee;ede;ffZde?d<e(j@ZAde?d <d!ZBe(jCZDde?d"<e(jEZFde?d#<e(jGZHde?d$<e(jIZJde?d%<Gd&d'd'eKZLe e$eLZMe*eLZNdxdyd+d,ZOdzd/d0ZPd{d4d5ZQd|d6d7ZRd}d9d:ZSGd;d<d<ZTGd=d>d>ZUGd?d@d@ZVedAd~dCdDZWedEddGdHZXejYGdIdJdJZZedKGdLdMdMZ[edNGdOdPdPZ\GdQdRdRZ]GdSdTdTZ^GdUdVdVZ_GdWdXdXeKZ`GdYdZdZZadd\d]Zbdd_d`ZcddbdcZd  dddhdiZeGdjdkdkZfddmdnZg dxddodpZhddrdsZieiZjejeiekdNeldsdtddudvZmemZnejemekdNeldvdtdS)) annotationsN) b16encode)IterableSequence)partial)AnyCallableUnion) ) deprecated)r TmsgstrkwargsobjectreturnCallable[[_T], _T]cKsddS)NcSs|SN)frrTC:\Users\psant\Downloads\PAF backend\school\venv\Lib\site-packages\OpenSSL/crypto.pyszdeprecated..r)rrrrrr sr )utilsx509)dsaeced448ed25519rsa)StrOrBytesPath) byte_string)exception_from_error_queue)ffi)lib) make_assert) path_bytes) FILETYPE_ASN1 FILETYPE_PEM FILETYPE_TEXTTYPE_DSATYPE_RSAX509ErrorPKey X509ExtensionX509NameX509Req X509StoreX509StoreContextX509StoreContextErrorX509StoreFlagsdump_certificatedump_certificate_requestdump_privatekeydump_publickeyget_elliptic_curveget_elliptic_curvesload_certificateload_certificate_requestload_privatekeyload_publickey.intr)r(ir,r+TYPE_DHTYPE_ECc@seZdZdZdS)r.z7 An error occurred in an `OpenSSL.crypto` API. N)__name__ __module__ __qualname____doc__rrrrr.tsr.buffer bytes | NonercCsf|durtt}tj}ntd|}t|t|}|fd dd}t|tj kt ||}|S) z Allocate a new OpenSSL memory BIO. Arrange for the garbage collector to clean it up automatically. :param buffer: None or some bytes to use to put into the BIO so that they can be read out. Nchar[]biorrefrcSs t|Sr)_libBIO_free)rKrLrrrfree z_new_mem_buf..free)rKrrLrrr) rMZBIO_newZ BIO_s_memrN_ffinewZBIO_new_mem_buflen_openssl_assertNULLgc)rHrKrOdatarrr _new_mem_buf~s   rXrKbytescCs.td}t||}t|d|ddS)zO Copy the contents of an OpenSSL BIO object into a Python byte string. zchar**rN)rQrRrMZBIO_get_mem_datarH)rK result_bufferZ buffer_lengthrrr_bio_to_strings  r[boundarywhenNonecCs@t|ts tdt|tjkt||}|dkrtddS)a The the time value of an ASN1 time object. @param boundary: An ASN1_TIME pointer (or an object safely castable to that type) which will have its value set. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. zwhen must be a byte stringrzInvalid stringN) isinstancerY TypeErrorrTrQrUrMZASN1_TIME_set_string ValueError)r\r] set_resultrrr_set_asn1_times  rccCs2t}t|tjkt|tj}t|||S)a Behaves like _set_asn1_time but returns a new ASN1_TIME object. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. N)rMZ ASN1_TIME_newrTrQrUrVZASN1_TIME_freerc)r]retrrr_new_asn1_times   re timestampcCstd|}t|dkrdSt|tjkrtt|Std}t ||t |dtj ktd|d}t|}t|}t |d|S)a] Retrieve the time value of an ASN1 time object. @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to that type) from which the time value will be retrieved. @return: The time value from C{timestamp} as a L{bytes} string in a certain format. Or C{None} if the object contains no time value. ASN1_STRING*rNzASN1_GENERALIZEDTIME**) rQcastrMASN1_STRING_lengthZASN1_STRING_typeZV_ASN1_GENERALIZEDTIMEstringASN1_STRING_get0_datarRZASN1_TIME_to_generalizedtimerTrUZASN1_GENERALIZEDTIME_free)rfZstring_timestampZgeneralized_timestampZ string_data string_resultrrr_get_asn1_times     rmc@s*eZdZd ddZd ddZd d d Zd S)_X509NameInvalidatorrr^cCs g|_dSr)_namesselfrrr__init__rPz_X509NameInvalidator.__init__namer1cCs|j|dSr)roappendrqrsrrraddsz_X509NameInvalidator.addcCs|jD]}|`qdSr)ro_namerurrrclears z_X509NameInvalidator.clearNrr^rsr1rr^)rDrErFrrrvrxrrrrrns  rnc@sbeZdZdZdZdZdddZdd d Zedd d Z dddZ dddZ d ddZ d ddZ dS)!r/zD A class representing an DSA or RSA public key or key pair. FTrr^cCs"t}t|tj|_d|_dS)NF)rMZ EVP_PKEY_newrQrV EVP_PKEY_free_pkey _initializedrqpkeyrrrrrs z PKey.__init___KeycCsNddlm}m}|jrtt|}tt||St t|}tt||ddS)a Export as a ``cryptography`` key. :rtype: One of ``cryptography``'s `key interfaces`_. .. _key interfaces: https://cryptography.io/en/latest/hazmat/ primitives/asymmetric/rsa/#key-interfaces .. versionadded:: 16.1.0 r)load_der_private_keyload_der_public_keyN)password) ,cryptography.hazmat.primitives.serializationrr _only_publicr:r(typingrhrr9)rqrrderrrrto_cryptography_keys    zPKey.to_cryptography_key crypto_keyc Cst|tjtjtjtjtjtj t j t j t jt jf stdddlm}m}m}m}t|tjtjtj t j t jfrCtt||j|jS||j|j|}tt|S)z Construct based on a ``cryptography`` *crypto_key*. :param crypto_key: A ``cryptography`` key. :type crypto_key: One of ``cryptography``'s `key interfaces`_. :rtype: PKey .. versionadded:: 16.1.0 zUnsupported key typer)Encoding NoEncryption PrivateFormat PublicFormatN)r_r DSAPrivateKey DSAPublicKeyrEllipticCurvePrivateKeyEllipticCurvePublicKeyrEd25519PrivateKeyEd25519PublicKeyrEd448PrivateKeyEd448PublicKeyr RSAPrivateKey RSAPublicKeyr`rrrrrr@r( public_bytesDERZSubjectPublicKeyInfoZ private_bytesZPKCS8r?)clsrrrrrrrrrfrom_cryptography_keysF    zPKey.from_cryptography_keytyperAbitsc Cs4t|ts tdt|tstd|tkrQ|dkrtdt}t|tj }t |tj t }t |||tj}t|dkt|j|}t|dknD|tkrt}t|tjkt|tj}t||tjdtjtjtj}t|dktt|dktt|j|dkntdd|_dS) a3 Generate a key pair of the given type, with the given number of bits. This generates a key "into" the this object. :param type: The key type. :type type: :py:data:`TYPE_RSA` or :py:data:`TYPE_DSA` :param bits: The number of bits. :type bits: :py:data:`int` ``>= 0`` :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't of the appropriate type. :raises ValueError: If the number of bits isn't an integer of the appropriate size. :return: ``None`` ztype must be an integerzbits must be an integerrzInvalid number of bitszNo such key typeTN)r_rAr`r,rarMZBN_newrQrVBN_freeZ BN_set_wordZRSA_F4ZRSA_newZRSA_generate_key_exrUrTZEVP_PKEY_assign_RSAr|r+ZDSA_newZDSA_freeZDSA_generate_parameters_exZDSA_generate_keyZEVP_PKEY_set1_DSAr.r})rqrrexponentr resultrresrrr generate_keyUs6     zPKey.generate_keyboolcCsd|jrtdt|tjkrtdt|j}t |tj }t |}|dkr-dSt dS)ax Check the consistency of an RSA private key. This is the Python equivalent of OpenSSL's ``RSA_check_key``. :return: ``True`` if key is consistent. :raise OpenSSL.crypto.Error: if the key is inconsistent. :raise TypeError: if the key is of a type which cannot be checked. Only RSA keys can currently be checked. zpublic key onlyz'Only RSA keys can currently be checked.rTN) rr`rMZ EVP_PKEY_typer EVP_PKEY_RSAEVP_PKEY_get1_RSAr|rQrVRSA_freeZ RSA_check_key_raise_current_error)rqr rrrrchecks    z PKey.checkcC t|jS)zT Returns the type of the key :return: The type of the key. N)rM EVP_PKEY_idr|rprrrr z PKey.typecCr)zh Returns the number of bits of the key :return: The number of bits of the key. N)rMZ EVP_PKEY_bitsr|rprrrrrz PKey.bitsNry)rr)rrrr/)rrArrArr^rrrrA)rDrErFrGrr}rrr classmethodrrrrrrrrrr/s    9 8 r/csneZdZdZdZdfdd Zedd d Zedd dZedddZ dddZ d ddZ d!ddZ Z S)"_EllipticCurveaZ A representation of a supported elliptic curve. @cvar _curves: :py:obj:`None` until an attempt is made to load the curves. Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve` instances each of which represents one curve supported by the system. @type _curves: :py:type:`NoneType` or :py:type:`set` Notherrrrcst|tr t|StS)z Implement cooperation with the right-hand side argument of ``!=``. Python 3 seems to have dropped this cooperation in this very narrow circumstance. N)r_rsuper__ne__NotImplementedrqr __class__rrrs  z_EllipticCurve.__ne__r%set[_EllipticCurve]cs>tjd}td|}||tfdd|DS)z Get the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. rzEC_builtin_curve[]c3s|] }|jVqdSr)from_nidnid).0crr%rr sz7_EllipticCurve._load_elliptic_curves..N)ZEC_get_builtin_curvesrQrUrRset)rr%Z num_curvesZbuiltin_curvesrrr_load_elliptic_curvess  z$_EllipticCurve._load_elliptic_curvescCs|jdur |||_|jS)a Get, cache, and return the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. N)_curvesrrrrr_get_elliptic_curvess z#_EllipticCurve._get_elliptic_curvesrrAcCs|||t||dS)a Instantiate a new :py:class:`_EllipticCurve` associated with the given OpenSSL NID. :param lib: The OpenSSL library binding object. :param nid: The OpenSSL NID the resulting curve object will represent. This must be a curve NID (and not, for example, a hash NID) or subsequent operations will fail in unpredictable ways. :type nid: :py:class:`int` :return: The curve object. asciiN)rQrj OBJ_nid2sndecode)rr%rrrrrsz_EllipticCurve.from_nidrsrr^cCs||_||_||_dS)a :param _lib: The :py:mod:`cryptography` binding instance used to interface with OpenSSL. :param _nid: The OpenSSL NID identifying the curve this object represents. :type _nid: :py:class:`int` :param name: The OpenSSL short name identifying the curve this object represents. :type name: :py:class:`unicode` N)rM_nidrs)rqr%rrsrrrrrs  z_EllipticCurve.__init__cCsd|jdS)Nzrsrprrr__repr__z_EllipticCurve.__repr__cCs|j|j}t|tjS)z Create a new OpenSSL EC_KEY structure initialized to use this curve. The structure is automatically garbage collected when the Python object is garbage collected. N)rMZEC_KEY_new_by_curve_namerrQrVZ EC_KEY_free)rqkeyrrr _to_EC_KEYsz_EllipticCurve._to_EC_KEYrrrr)r%rrr)r%rrrArr)r%rrrArsrrr^rrrr)rDrErFrGrrrrrrrrrr __classcell__rrrrrs      rzSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.rcCs ttS)a Return a set of objects representing the elliptic curves supported in the OpenSSL build in use. The curve objects have a :py:class:`unicode` ``name`` attribute by which they identify themselves. The curve objects are useful as values for the argument accepted by :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be used for ECDHE key exchange. N)rrrMrrrrr<s r<zRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.rscCs(tD] }|j|kr|Sqtd|)aT Return a single curve object selected by name. See :py:func:`get_elliptic_curves` for information about curve objects. :param name: The OpenSSL short name identifying the curve object to retrieve. :type name: :py:class:`unicode` If the named curve is not supported then :py:class:`ValueError` is raised. zunknown curve nameN)r<rsra)rsZcurverrrr;2s   r;csreZdZdZd ddZd!fd d Zd"d dZd#ddZd#ddZd$ddZ d%ddZ d&ddZ d'ddZ Z S)(r1a An X.509 Distinguished Name. :ivar countryName: The country of the entity. :ivar C: Alias for :py:attr:`countryName`. :ivar stateOrProvinceName: The state or province of the entity. :ivar ST: Alias for :py:attr:`stateOrProvinceName`. :ivar localityName: The locality of the entity. :ivar L: Alias for :py:attr:`localityName`. :ivar organizationName: The organization name of the entity. :ivar O: Alias for :py:attr:`organizationName`. :ivar organizationalUnitName: The organizational unit of the entity. :ivar OU: Alias for :py:attr:`organizationalUnitName` :ivar commonName: The common name of the entity. :ivar CN: Alias for :py:attr:`commonName`. :ivar emailAddress: The e-mail address of the entity. rsrr^cCs t|j}t|tj|_dS)z Create a new X509Name, copying the given X509Name instance. :param name: The name to copy. :type name: :py:class:`X509Name` N)rMZ X509_NAME_duprwrQrVZX509_NAME_freerurrrrrbs zX509Name.__init__rvaluerc s|dr t||St|turtdt|jddtt |}|tj kr?zt Wt dt y>Yt dwtt|jD]%}t|j|}t|}t|}||krlt|j|}t|qmqGt|trw|d}t|j|tj|ddd}|st dSdS) N_z$attribute name must be string, not 'z.200'No such attributeutf-8r) startswithr __setattr__rrr`rDrM OBJ_txt2nid _byte_string NID_undefrr.AttributeErrorrangeX509_NAME_entry_countrwX509_NAME_get_entryX509_NAME_ENTRY_get_object OBJ_obj2nidZX509_NAME_delete_entryZX509_NAME_ENTRY_freer_encodeZX509_NAME_add_entry_by_NIDZ MBSTRING_UTF8) rqrsrrientZent_objZent_nid add_resultrrrrlsD           zX509Name.__setattr__ str | Nonec Cstt|}|tjkr!ztWtdty Ytdwt|j|d}|dkr/dSt |j|}t |}t d}t ||}t|dkzt |d|ddd}Wt|d|St|dw)a  Find attribute. An X509Name object has the following attributes: countryName (alias C), stateOrProvince (alias ST), locality (alias L), organization (alias O), organizationalUnit (alias OU), commonName (alias CN) and more... rrNunsigned char**rr)rMrrrrr.rZX509_NAME_get_index_by_NIDrwrX509_NAME_ENTRY_get_datarQrRZASN1_STRING_to_UTF8rTrHr OPENSSL_free) rqrsrZ entry_indexentryrWrZZ data_lengthrrrr __getattr__s0      zX509Name.__getattr__rrcCs"t|tstSt|j|jdkSNrr_r1rrMZ X509_NAME_cmprwrrrr__eq__ zX509Name.__eq__cCs"t|tstSt|j|jdkSrrrrrr__lt__rzX509Name.__lt__cCsDtdd}t|j|t|}t|tjkdt | dS)z6 String representation of an X509Name rJizrN) rQrRrMZX509_NAME_onelinerwrSrTrUformatrjr)rqrZZ format_resultrrrrs  zX509Name.__repr__rAcCr)a& Return an integer representation of the first four bytes of the MD5 digest of the DER representation of the name. This is the Python equivalent of OpenSSL's ``X509_NAME_hash``. :return: The (integer) hash of this name. :rtype: :py:class:`int` N)rMZX509_NAME_hashrwrprrrhash z X509Name.hashrYcCsNtd}t|j|}t|dkt|d|dd}t|d|S)z Return the DER encoding of this name. :return: The DER encoded form of this name. :rtype: :py:class:`bytes` rrN)rQrRrMZ i2d_X509_NAMErwrTrHr)rqrZZ encode_resultrlrrrrs  z X509Name.derlist[tuple[bytes, bytes]]c Csg}tt|jD]7}t|j|}t|}t|}t|}t|}t t |t |dd}| t ||fq |S)z Returns the components of this name, as a sequence of 2-tuples. :return: The components of this name. :rtype: :py:class:`list` of ``name, value`` tuples. N)rrMrrwrrrrrrQrHrkrirtrj) rqrrrfnameZfvalrrsrrrrget_componentss    zX509Name.get_componentsrz)rsrrrrr^)rsrrrrrrrrY)rr)rDrErFrGrrrrrrrrrrrrrrrr1Hs  ' (    r1zZX509Extension support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c@seZdZUdZ  d"d#d dZed$ddZejdej dej diZ de d<d%ddZ d%ddZd&ddZd'ddZd'd d!ZdS)(r0zu An X.509 v3 certificate extension. .. deprecated:: 23.3.0 Use cryptography's X509 APIs instead. N type_namerYcriticalrrsubject X509 | Noneissuerrr^cCstd}t|tjtjtjtjdt||dur)t|ts%td|j |_ |dur:t|ts6td|j |_ |r@d|}t tj|||}|tjkrQt t|tj|_dS)a Initializes an X509 extension. :param type_name: The name of the type of extension_ to create. :type type_name: :py:data:`bytes` :param bool critical: A flag indicating whether this is a critical extension. :param value: The OpenSSL textual representation of the extension's value. :type value: :py:data:`bytes` :param subject: Optional X509 certificate to use as subject. :type subject: :py:class:`X509` :param issuer: Optional X509 certificate to use as issuer. :type issuer: :py:class:`X509` .. _extension: https://www.openssl.org/docs/manmaster/man5/ x509v3_config.html#STANDARD-EXTENSIONS z X509V3_CTX*rNzissuer must be an X509 instancez subject must be an X509 instances critical,)rQrRrMZX509V3_set_ctxrUZX509V3_set_ctx_nodbr_r-r`_x509Z issuer_certZ subject_certZX509V3_EXT_nconfrrVX509_EXTENSION_free _extension)rqrrrrrctx extensionrrrrrs"     zX509Extension.__init__rcCstt|jSr)rMrX509_EXTENSION_get_objectrrprrrr\s zX509Extension._nidemailDNSURIztyping.ClassVar[dict[int, str]] _prefixesrc Cstdt|j}t|tj}g}tt|D]Q}t ||}z|j |j }Wnt yFt }t|||t|dYqwtd|jj}tt|t|ddd}||d|qd|S)NzGENERAL_NAMES*rrg:z, )rQrhrMZX509V3_EXT_d2irrVZGENERAL_NAMES_freerZsk_GENERAL_NAME_numZsk_GENERAL_NAME_valuerrKeyErrorrXZGENERAL_NAME_printrtr[rdZia5rHrkrijoin) rqnamespartsrrslabelrKZ asn1_stringrrrr_subjectAltNameStringhs2     z#X509Extension._subjectAltNameStringcCsFtj|jkr |St}t||jdd}t|dkt| dS)zF :return: a nice text representation of the extension rrN) rMZNID_subject_alt_namerrrXZX509V3_EXT_printrrTr[r)rqrKZ print_resultrrr__str__s  zX509Extension.__str__cCr)zk Returns the critical field of this X.509 extension. :return: The critical field. N)rMZX509_EXTENSION_get_criticalrrprrr get_criticalrzX509Extension.get_criticalcCs8t|j}t|}t|}|tjkrt|SdS)z Returns the short type name of this X.509 extension. The result is a byte string such as :py:const:`b"basicConstraints"`. :return: The short type name. :rtype: :py:data:`bytes` .. versionadded:: 0.12 sUNDEFN)rMrrrrrQrUrj)rqobjrbufrrrget_short_names    zX509Extension.get_short_namecCs@t|j}td|}t|}t|}t||ddS)z Returns the data of the X509 extension, encoded as ASN.1. :return: The ASN.1 encoded data of this X509 extension. :rtype: :py:data:`bytes` .. versionadded:: 0.12 rgN)rMZX509_EXTENSION_get_datarrQrhrkrirH)rqZ octet_resultrlZ char_result result_lengthrrrget_datas   zX509Extension.get_dataNN) rrYrrrrYrrrrrr^rrrr)rDrErFrGrrpropertyrrMZ GEN_EMAILZGEN_DNSZGEN_URIr__annotations__rrrrrrrrrr0 s   E    r0zPCSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c@seZdZdZd*ddZd+ddZed,d d Zd-ddZd.ddZ d/ddZ d0ddZ d1ddZ d2ddZ d3d d!Zd4d$d%Zd5d'd(Zd)S)6r2z An X.509 certificate signing requests. .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. rr^cCs&t}t|tj|_|ddSr)rMZ X509_REQ_newrQrV X509_REQ_free_req set_version)rqreqrrrrrszX509Req.__init__x509.CertificateSigningRequestcCddlm}tt|}||S)z Export as a ``cryptography`` certificate signing request. :rtype: ``cryptography.x509.CertificateSigningRequest`` .. versionadded:: 17.1.0 r)load_der_x509_csrN)cryptography.x509r"_dump_certificate_request_internalr()rqrrrrrto_cryptographys  zX509Req.to_cryptography crypto_reqcC6t|tjs tdddlm}||j}tt |S)a Construct based on a ``cryptography`` *crypto_req*. :param crypto_req: A ``cryptography`` X.509 certificate signing request :type crypto_req: ``cryptography.x509.CertificateSigningRequest`` :rtype: X509Req .. versionadded:: 17.1.0 z%Must be a certificate signing requestrrN) r_rZCertificateSigningRequestr`rrrr"_load_certificate_request_internalr()rr#rrrrrfrom_cryptographys    zX509Req.from_cryptographyrr/cCs t|j|j}t|dkdS)z Set the public key of the certificate signing request. :param pkey: The public key to use. :type pkey: :py:class:`PKey` :return: ``None`` rN)rMZX509_REQ_set_pubkeyrr|rTrqrrbrrr set_pubkeys zX509Req.set_pubkeycCsDtt}t|j|_t|jtjkt |jtj |_d|_ |S)z Get the public key of the certificate signing request. :return: The public key. :rtype: :py:class:`PKey` TN) r/__new__rMZX509_REQ_get_pubkeyrr|rTrQrUrVr{rr~rrr get_pubkeys zX509Req.get_pubkeyversionrAcCs@t|ts td|dkrtdt|j|}t|dkdS)z Set the version subfield (RFC 2986, section 4.1) of the certificate request. :param int version: The version number. :return: ``None`` zversion must be an intrz9Invalid version. The only valid version for X509Req is 0.rN)r_rAr`rarMZX509_REQ_set_versionrrT)rqr,rbrrrr s zX509Req.set_versioncCr)z Get the version subfield (RFC 2459, section 4.1.2.1) of the certificate request. :return: The value of the version subfield. :rtype: :py:class:`int` N)rMZX509_REQ_get_versionrrprrr get_versions zX509Req.get_versionr1cCs2tt}t|j|_t|jtjk||_ |S)a Return the subject of this certificate signing request. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate signing request. Modifying it will modify the underlying signing request, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate signing request. :rtype: :class:`X509Name` N) r1r*rMZX509_REQ_get_subject_namerrwrTrQrU_ownerrurrr get_subject&s zX509Req.get_subject extensionsIterable[X509Extension]cCs|tjdtddt}t|tjkt|tj }|D]}t |t s't dt ||jqt|j|}t|dkdS)z Add extensions to the certificate signing request. :param extensions: The X.509 extensions to add. :type extensions: iterable of :py:class:`X509Extension` :return: ``None`` This API is deprecated and will be removed in a future version of pyOpenSSL. You should use pyca/cryptography's X.509 APIs instead. stacklevel+One of the elements is not an X509ExtensionrN)warningswarnDeprecationWarningrMZsk_X509_EXTENSION_new_nullrTrQrUrVZsk_X509_EXTENSION_freer_r0raZsk_X509_EXTENSION_pushrZX509_REQ_add_extensionsr)rqr0stackextrrrradd_extensions<s  zX509Req.add_extensionslist[X509Extension]cCs~tjdtddg}t|j}t|dd}tt |D]}t t }t t ||}t|tj|_||q|S)z Get X.509 extensions in the certificate signing request. :return: The X.509 extensions in this request. :rtype: :py:class:`list` of :py:class:`X509Extension` objects. .. versionadded:: 0.15 r2r3r4cSst|ttjdS)Nr)rMZsk_X509_EXTENSION_pop_freerQ addressofZ _original_lib)xrrrrts z(X509Req.get_extensions..N)r7r8r9rMZX509_REQ_get_extensionsrrQrVrZsk_X509_EXTENSION_numr0r*X509_EXTENSION_dupZsk_X509_EXTENSION_valuerrrt)rqextsZnative_exts_objrr;rrrrget_extensions]s&     zX509Req.get_extensionsdigestrcCs^|jrtd|jstdtt|}|tjkrtdt|j |j |}t |dkdS)aa Sign the certificate signing request with this key and digest type. :param pkey: The key pair to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use for the signature, e.g. :py:data:`"sha256"`. :type digest: :py:class:`str` :return: ``None`` zKey has only public partKey is uninitializedNo such digest methodrN) rrar}rMEVP_get_digestbynamerrQrUZ X509_REQ_signrr|rT)rqrrCZ digest_obj sign_resultrrrsigns  z X509Req.signrcCs4t|ts tdt|j|j}|dkrt|S)a@ Verifies the signature on this certificate signing request. :param PKey key: A public key. :return: ``True`` if the signature is correct. :rtype: bool :raises OpenSSL.crypto.Error: If the signature is invalid or there is a problem verifying the signature. pkey must be a PKey instancerN)r_r/r`rMZX509_REQ_verifyrr|r)rqrrrrrverifys zX509Req.verifyNry)rr)r#rrr2rr/rr^rr/r,rArr^rrr1r0r1rr^)rr=rr/rCrrr^)rr/rr)rDrErFrGrrr"rr'r)r+rr-r/r<rBrHrJrrrrr2s        ! &r2c@sXeZdZdZd`ddZedadd Zdbd d ZedcddZddddZ deddZ dfddZ dgddZ dhddZ did!d"Zdjd$d%Zded&d'Zdkd)d*Zded+d,Zdld.d/Zdld0d1Zdmd3d4Zdnd7d8Zdod9d:Zdpd=d>Zdqd?d@ZdodAdBZdqdCdDZdrdFdGZdsdIdJZdtdKdLZdudNdOZdtdPdQZ dvdSdTZ!dedUdVZ"dwdYdZZ#dxd]d^Z$d_S)yr-z An X.509 certificate. rr^cCs:t}t|tjkt|tj|_t|_ t|_ dSr) rMZX509_newrTrQrUrV X509_freerrn_issuer_invalidator_subject_invalidator)rqrrrrrrs  z X509.__init__rrcCs.||}t|tj|_t|_t|_|Sr) r*rQrVrMrQrrnrRrS)rrcertrrr_from_raw_x509_ptrs zX509._from_raw_x509_ptrx509.CertificatecCr)z Export as a ``cryptography`` certificate. :rtype: ``cryptography.x509.Certificate`` .. versionadded:: 17.1.0 r)load_der_x509_certificateN)r rWr7r()rqrWrrrrr"s  zX509.to_cryptography crypto_certcCr$)z Construct based on a ``cryptography`` *crypto_cert*. :param crypto_key: A ``cryptography`` X.509 certificate. :type crypto_key: ``cryptography.x509.Certificate`` :rtype: X509 .. versionadded:: 17.1.0 zMust be a certificaterr%N) r_r Certificater`rrrrr=r()rrXrrrrrr's    zX509.from_cryptographyr,rAcCs,t|ts tdtt|j|dkdS)a  Set the version number of the certificate. Note that the version value is zero-based, eg. a value of 0 is V1. :param version: The version number of the certificate. :type version: :py:class:`int` :return: ``None`` zversion must be an integerrN)r_rAr`rTrMZX509_set_versionr)rqr,rrrrs zX509.set_versioncCr)z Return the version number of the certificate. :return: The version number of the certificate. :rtype: :py:class:`int` N)rMZX509_get_versionrrprrrr- zX509.get_versionr/cCsFtt}t|j|_|jtjkrtt |jtj |_d|_ |S)z{ Get the public key of the certificate. :return: The public key. :rtype: :py:class:`PKey` TN) r/r*rMZX509_get_pubkeyrr|rQrUrrVr{rr~rrrr+s  zX509.get_pubkeyrcCs2t|ts tdt|j|j}t|dkdS)z Set the public key of the certificate. :param pkey: The public key. :type pkey: :py:class:`PKey` :return: :py:data:`None` rIrN)r_r/r`rMZX509_set_pubkeyrr|rTr(rrrr)s zX509.set_pubkeyrCrcCspt|ts td|jrtd|jstdtt|}|t j kr'tdt |j |j |}t|dkdS)a Sign the certificate with this key and digest type. :param pkey: The key to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use. :type digest: :py:class:`str` :return: :py:data:`None` rIzKey only has public partrDrErN)r_r/r`rrar}rMrFrrQrUZ X509_signrr|rT)rqrrCZevp_mdrGrrrrHs  z X509.signrYcCsZt|j}td}t|tjtj|t|d}|tjkr%t dt t |S)z Return the signature algorithm used in the certificate. :return: The name of the algorithm. :rtype: :py:class:`bytes` :raises ValueError: If the signature algorithm is undefined. .. versionadded:: 0.13 zASN1_OBJECT **rzUndefined signature algorithmN) rMZX509_get0_tbs_sigalgrrQrRZX509_ALGOR_get0rUrrrarjZ OBJ_nid2ln)rqZsig_algalgrrrrget_signature_algorithm9s  zX509.get_signature_algorithm digest_namecCstt|}|tjkrtdtdtj}tdd}t||d<t |j |||}t |dkd ddt ||dDS) a5 Return the digest of the X509 object. :param digest_name: The name of the digest algorithm to use. :type digest_name: :py:class:`str` :return: The digest of the object, formatted as :py:const:`b":"`-delimited hex pairs. :rtype: :py:class:`bytes` rEzunsigned char[]zunsigned int[]rr:cSsg|]}t|qSr)rupper)rchrrr es zX509.digest..N)rMrFrrQrUrarRZEVP_MAX_MD_SIZErSZ X509_digestrrTr rH)rqr]rCrZrZ digest_resultrrrrCLs     z X509.digestcCr)z Return the hash of the X509 subject. :return: The hash of the subject. :rtype: :py:class:`int` N)rMZX509_subject_name_hashrrprrrsubject_name_hashkrZzX509.subject_name_hashserialcCst|ts tdt|dd}|d}td}t||}t |tj kt |dtj }t |dt |tj kt |tj}t|j|}t |dkdS)z Set the serial number of the certificate. :param serial: The new serial number. :type serial: :py:class:`int` :return: :py:data`None` zserial must be an integerr3NrzBIGNUM**rr)r_rAr`hexrrQrRrMZ BN_hex2bnrTrUZBN_to_ASN1_INTEGERrrVZASN1_INTEGER_freeZX509_set_serialNumberr)rqrc hex_serialZhex_serial_bytes bignum_serialr asn1_serialrbrrrset_serial_numberts    zX509.set_serial_numberc Cspt|j}t|tj}z$t|}zt|}t|d}|Wt |Wt |St |wt |w)zx Return the serial number of this certificate. :return: The serial number. :rtype: int N) rMZX509_get_serialNumberrZASN1_INTEGER_to_BNrQrUZ BN_bn2hexrjrArr)rqrgrfreZhexstring_serialrcrrrget_serial_numbers       zX509.get_serial_numberamountcC.t|ts tdt|j}t||dS)z Adjust the time stamp on which the certificate stops being valid. :param int amount: The number of seconds by which to adjust the timestamp. :return: ``None`` amount must be an integerN)r_rAr`rMX509_getm_notAfterrX509_gmtime_adj)rqrkZnotAfterrrrgmtime_adj_notAfters  zX509.gmtime_adj_notAftercCrl)z Adjust the timestamp on which the certificate starts being valid. :param amount: The number of seconds by which to adjust the timestamp. :return: ``None`` rmN)r_rAr`rMX509_getm_notBeforerro)rqrkZ notBeforerrrgmtime_adj_notBefores  zX509.gmtime_adj_notBeforercCsT|}|dur td|d}tj|d}tjj}tj|jdd}||kS)z Check whether the certificate has expired. :return: ``True`` if the certificate has expired, ``False`` otherwise. :rtype: bool NzUnable to determine notAfterrz %Y%m%d%H%M%SZ)tzinfo) get_notAfterrardatetimestrptimetimezoneutcnowreplace)rqZ time_bytesZ time_stringZ not_afterUTCutcnowrrr has_expireds zX509.has_expiredwhichrIcCst||jSr)rmr)rqr~rrr_get_boundary_timerzX509._get_boundary_timecC |tjS)a  Get the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType N)rrMrqrprrr get_notBefore zX509.get_notBeforeCallable[..., Any]r]cCst||j|Sr)rcr)rqr~r]rrr_set_boundary_timeszX509._set_boundary_timecC|tj|S)z Set the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` N)rrMrqrqr]rrr set_notBefore zX509.set_notBeforecCr)a  Get the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType N)rrMrnrprrrrtrzX509.get_notAftercCr)z Set the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` N)rrMrnrrrr set_notAfterrzX509.set_notAfterr1cCs0tt}||j|_t|jtjk||_|Sr)r1r*rrwrTrQrUr.)rqr~rsrrr _get_name s  zX509._get_namerscCs0t|ts td||j|j}t|dkdS)Nzname must be an X509Namer)r_r1r`rrwrT)rqr~rsrbrrr _set_names zX509._set_namecC|tj}|j||S)a Return the issuer of this certificate. This creates a new :class:`X509Name` that wraps the underlying issuer name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this issuer. :return: The issuer of this certificate. :rtype: :class:`X509Name` N)rrMZX509_get_issuer_namerRrvrurrr get_issuer zX509.get_issuerrcC|tj||jdS)z Set the issuer of this certificate. :param issuer: The issuer. :type issuer: :py:class:`X509Name` :return: ``None`` N)rrMZX509_set_issuer_namerRrx)rqrrrr set_issuer- zX509.set_issuercCr)a Return the subject of this certificate. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate. :rtype: :class:`X509Name` N)rrMZX509_get_subject_namerSrvrurrrr/9rzX509.get_subjectrcCr)z Set the subject of this certificate. :param subject: The subject. :type subject: :py:class:`X509Name` :return: ``None`` N)rrMZX509_set_subject_namerSrx)rqrrrr set_subjectIrzX509.set_subjectcCr)z Get the number of extensions on this certificate. :return: The number of extensions. :rtype: :py:class:`int` .. versionadded:: 0.12 N)rMZX509_get_ext_countrrprrrget_extension_countUs zX509.get_extension_countr0r1cCsNtjdtdd|D]}t|tstdt|j|j d}t |dkq dS)z Add extensions to the certificate. :param extensions: The extensions to add. :type extensions: An iterable of :py:class:`X509Extension` objects. :return: ``None`` r2r3r4r6rrN) r7r8r9r_r0rarMZ X509_add_extrrrT)rqr0r;rrrrr<`s zX509.add_extensionsindexr0cCs^tjdtddtt}t|j||_|jt j krt dt |j}t |tj|_|S)a Get a specific extension of the certificate by index. Extensions on a certificate are kept in order. The index parameter selects which extension will be returned. :param int index: The index of the extension to retrieve. :return: The extension at the specified index. :rtype: :py:class:`X509Extension` :raises IndexError: If the extension index was out of bounds. .. versionadded:: 0.12 r2r3r4zextension index out of boundsN)r7r8r9r0r*rMZ X509_get_extrrrQrU IndexErrorr@rVr)rqrr;rrrr get_extensionys   zX509.get_extensionNry)rrrr-)rrV)rXrVrr-rMrrLrKrPr)r]rrrY)rcrArr^)rkrArr^r)r~rrrI)rrI)r~rr]rYrr^)r]rYrr^)r~rrr1)r~rrsr1rr^rN)rr1rr^)rr1rr^rO)rrArr0)%rDrErFrGrrrrUr"r'rr-r+r)rHr\rCrbrhrjrprrr}rrrrrtrrrrrr/rrr<rrrrrr-sH                     r-c@seZdZUdZejZded<ejZ ded<ej Z ded<ej Z ded<ejZded<ejZded<ejZded <ejZded <ejZded <ejZded <d S)r6a  Flags for X509 verification, used to change the behavior of :class:`X509Store`. See `OpenSSL Verification Flags`_ for details. .. _OpenSSL Verification Flags: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html rA CRL_CHECK CRL_CHECK_ALLIGNORE_CRITICAL X509_STRICTALLOW_PROXY_CERTS POLICY_CHECKEXPLICIT_POLICY INHIBIT_MAPCHECK_SS_SIGNATURE PARTIAL_CHAINN)rDrErFrGrMZX509_V_FLAG_CRL_CHECKrrZX509_V_FLAG_CRL_CHECK_ALLrZX509_V_FLAG_IGNORE_CRITICALrZX509_V_FLAG_X509_STRICTrZX509_V_FLAG_ALLOW_PROXY_CERTSrZX509_V_FLAG_POLICY_CHECKrZX509_V_FLAG_EXPLICIT_POLICYrZX509_V_FLAG_INHIBIT_MAPrZX509_V_FLAG_CHECK_SS_SIGNATURErZX509_V_FLAG_PARTIAL_CHAINrrrrrr6s  r6c@sPeZdZdZdddZddd Zdd d ZdddZd ddZ d!d"ddZ dS)#r3a An X.509 store. An X.509 store is used to describe a context in which to verify a certificate. A description of a context may include a set of certificates to trust, a set of certificate revocation lists, verification flags and more. An X.509 store, being only a description, cannot be used by itself to verify a certificate. To carry out the actual verification process, see :class:`X509StoreContext`. rr^cCst}t|tj|_dSr)rMZX509_STORE_newrQrVZX509_STORE_free_storerqstorerrrrrszX509Store.__init__rTr-cCs0t|tstt|j|j}t|dkdS)a Adds a trusted certificate to this store. Adding a certificate with this method adds this certificate as a *trusted* certificate. :param X509 cert: The certificate to add to this store. :raises TypeError: If the certificate is not an :class:`X509`. :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your certificate. :return: ``None`` if the certificate was added successfully. rN)r_r-r`rMZX509_STORE_add_certrrrT)rqrTrrrradd_certs zX509Store.add_certcrlx509.CertificateRevocationListcCsvt|tjr*ddlm}t||j}t |t j }t |t j kt |tj}ntdt t|j|dkdS)a Add a certificate revocation list to this store. The certificate revocation lists added to a store will only be used if the associated flags are configured to check certificate revocation lists. .. versionadded:: 16.1.0 :param crl: The certificate revocation list to add to this store. :type crl: ``cryptography.x509.CertificateRevocationList`` :return: ``None`` if the certificate revocation list was added successfully. rr%z?CRL must be of type cryptography.x509.CertificateRevocationListN)r_rZCertificateRevocationListrrrXrrrMZd2i_X509_CRL_biorQrUrTrVZ X509_CRL_freer`ZX509_STORE_add_crlr)rqrrrKZ openssl_crlrrradd_crls  zX509Store.add_crlflagsrAcCstt|j|dkdS)a Set verification flags to this store. Verification flags can be combined by oring them together. .. note:: Setting a verification flag sometimes requires clients to add additional information to the store, otherwise a suitable error will be raised. For example, in setting flags to enable CRL checking a suitable CRL must be added to the store otherwise an error will be raised. .. versionadded:: 16.1.0 :param int flags: The verification flags to set on this store. See :class:`X509StoreFlags` for available constants. :return: ``None`` if the verification flags were successfully set. rN)rTrMZX509_STORE_set_flagsr)rqrrrr set_flagsszX509Store.set_flagsvfy_timedatetime.datetimecCsFt}t|tj}t|t|t t |j |dkdS)a Set the time against which the certificates are verified. Normally the current time is used. .. note:: For example, you can determine if a certificate was valid at a given time. .. versionadded:: 17.0.0 :param datetime vfy_time: The verification time to set on this store. :return: ``None`` if the verification time was successfully set. rN) rMZX509_VERIFY_PARAM_newrQrVZX509_VERIFY_PARAM_freeZX509_VERIFY_PARAM_set_timecalendartimegm timetuplerTZX509_STORE_set1_paramr)rqrparamrrrset_times zX509Store.set_timeNcafileStrOrBytesPath | NonecapathcCsR|durtj}nt|}|durtj}nt|}t|j||}|s'tdSdS)a Let X509Store know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If *capath* is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *cafile* or *capath* may be ``None``. .. note:: Both *cafile* and *capath* may be set simultaneously. Call this method multiple times to add more than one location. For example, CA certificates, and certificate revocation list bundles may be passed in *cafile* in subsequent calls to this method. .. versionadded:: 20.0 :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: ``None`` if the locations were set successfully. :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None`` or the locations could not be set for any reason. N)rQrU _path_bytesrMZX509_STORE_load_locationsrr)rqrrZ load_resultrrrload_locations(s# zX509Store.load_locationsry)rTr-rr^)rrrr^)rrArr^)rrrr^r)rrrrrr^) rDrErFrGrrrrrrrrrrrr3s    r3cs"eZdZdZd fd d ZZS) r5z An exception raised when an error occurred while verifying a certificate using `OpenSSL.X509StoreContext.verify_certificate`. :ivar certificate: The certificate which caused verificate failure. :type certificate: :class:`X509` messagererrors list[Any] certificater-rr^cst|||_||_dSr)rrrrr)rqrrrrrrrres  zX509StoreContextError.__init__)rrrrrr-rr^)rDrErFrGrrrrrrrr5\sr5c@sbeZdZdZ ddd d Zed ddZed!ddZd"ddZd#ddZ d$ddZ d%ddZ dS)&r4a9 An X.509 store context. An X.509 store context is used to carry out the actual verification process of a certificate in a described context. For describing such a context, see :class:`X509Store`. :param X509Store store: The certificates which will be trusted for the purposes of any verifications. :param X509 certificate: The certificate to be verified. :param chain: List of untrusted certificates that may be used for building the certificate chain. May be ``None``. :type chain: :class:`list` of :class:`X509` Nrr3rr-chainSequence[X509] | Nonerr^cCs||_||_|||_dSr)r_cert_build_certificate_stack_chain)rqrrrrrrrr}szX509StoreContext.__init__ certificatescCsd dd}|dust|dkrtjSt}t|tjkt||}|D]'}t|ts0t dtt |j dkt ||j dkrLt |j tq%|S) Nsrrr^cSs8tt|D] }t||}t|qt|dSr)rrM sk_X509_num sk_X509_valuerQ sk_X509_free)rrr?rrrcleanups  z:X509StoreContext._build_certificate_stack..cleanuprz+One of the elements is not an X509 instance)rrrr^)rSrQrUrMZsk_X509_new_nullrTrVr_r-r`Z X509_up_refrZ sk_X509_pushrQr)rrr:rTrrrrs    z)X509StoreContext._build_certificate_stack store_ctxrr5cCs\ttt|d}t|t||g}t|}t|}t |}t |||S)z Convert an OpenSSL native context error failure into a Python exception. When a call to native OpenSSL X509_verify_cert fails, additional information about the failure can be obtained from the store context. rN) rQrjrMZX509_verify_cert_error_stringZX509_STORE_CTX_get_errorrZX509_STORE_CTX_get_error_depthZX509_STORE_CTX_get_current_certZX509_dupr-rUr5)rrrrrpycertrrr_exception_from_contexts     z(X509StoreContext._exception_from_contextcCsjt}t|tjkt|tj}t||jj|j j |j }t|dkt |}|dkr3| ||S)a3 Verifies the certificate and runs an X509_STORE_CTX containing the results. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. rrN)rMZX509_STORE_CTX_newrTrQrUrVZX509_STORE_CTX_freeZX509_STORE_CTX_initrrrrZX509_verify_certr)rqrrdrrr_verify_certificates    z$X509StoreContext._verify_certificatecCs ||_dS)z Set the context's X.509 store. .. versionadded:: 0.15 :param X509Store store: The store description which will be used for the purposes of any *future* verifications. N)rrrrr set_stores zX509StoreContext.set_storecCs |dS)a" Verify a certificate in a context. .. versionadded:: 0.15 :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. N)rrprrrverify_certificaterz#X509StoreContext.verify_certificate list[X509]cCst|}t|}t|tjkg}tt|D]}t||}t|tjkt |}| |qt ||S)aR Verify a certificate in a context and return the complete validated chain. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. .. versionadded:: 20.0 N) rrMZX509_STORE_CTX_get1_chainrTrQrUrrrr-rUrtr)rqrZ cert_stackrrrTrrrrget_verified_chains     z#X509StoreContext.get_verified_chainr)rr3rr-rrrr^)rrrr^)rrrr5r)rr3rr^ry)rr) rDrErFrGrr staticmethodrrrrrrrrrrr4ms       r4rcCsvt|tr |d}t|}|tkrt|tjtjtj}n|t kr*t |tj}nt d|tjkr6t t |S)a Load a certificate (X509) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param bytes buffer: The buffer the certificate is stored in :return: The X509 object r3type argument must be FILETYPE_PEM or FILETYPE_ASN1N)r_rrrXr)rMZPEM_read_bio_X509rQrUr(Z d2i_X509_biorarr-rU)rrHrKrrrrr= s   r=rTcCsnt}|tkrt||j}n|tkrt||j}n|tkr)t||jdd}nt dt |dkt |S)a Dump the certificate *cert* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXT) :param cert: The certificate to dump :return: The buffer with the dumped certificate in rCtype argument must be FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXTrN) rXr)rMZPEM_write_bio_X509rr(Z i2d_X509_bior*Z X509_print_exrarTr[)rrTrK result_coderrrr7(s  r7rcCsPt}|tkr tj}n |tkrtj}ntd|||j}|dkr$tt |S)z Dump a public key to a buffer. :param type: The file type (one of :data:`FILETYPE_PEM` or :data:`FILETYPE_ASN1`). :param PKey pkey: The public key to dump :return: The buffer with the dumped key in it. :rtype: bytes rrN) rXr)rMZPEM_write_bio_PUBKEYr(Zi2d_PUBKEY_biorar|rr[)rrrKZ write_biorrrrr:Ds  r:cipherr passphrasePassphraseCallableT | Nonec Cst}t|ts td|dur)|durtdtt|}|tjkr(t dntj}t ||}|t krIt ||j |tjd|j|j}|n4|tkrUt||j }n(|tkryt|j tjkrftdtt|j tj}t||d}nt dt|dkt|S)a Dump the private key *pkey* into a buffer string encoded with the type *type*. Optionally (if *type* is :const:`FILETYPE_PEM`) encrypting it using *cipher* and *passphrase*. :param type: The file type (one of :const:`FILETYPE_PEM`, :const:`FILETYPE_ASN1`, or :const:`FILETYPE_TEXT`) :param PKey pkey: The PKey to dump :param cipher: (optional) if encrypted PEM format, the cipher to use :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The buffer with the dumped key in :rtype: bytes zpkey must be a PKeyNzDif a value is given for cipher one must also be given for passphrasezInvalid cipher namerz-Only RSA keys are supported for FILETYPE_TEXTr)rXr_r/r`rMZEVP_get_cipherbynamerrQrUra_PassphraseHelperr)ZPEM_write_bio_PrivateKeyr|callback callback_argsraise_if_problemr(Zi2d_PrivateKey_bior*rrrVrrZ RSA_printrTr[) rrrrrKZ cipher_objhelperrr rrrr9]sJ     r9c@sPeZdZ  ddd d ZedddZedddZefd ddZd!ddZ dS)"rFrrArr more_argsrtruncaterr^cCs4|tkr |dur td||_||_||_g|_dS)Nz0only FILETYPE_PEM key format supports encryption)r)ra _passphrase _more_args _truncate _problems)rqrrrrrrrrrs z_PassphraseHelper.__init__rcCs<|jdurtjSt|jtst|jrtd|jStd)NZpem_password_cb2Last argument must be a byte string or a callable.) rrQrUr_rYcallabler_read_passphraser`rprrrrs z_PassphraseHelper.callbackcCs4|jdurtjSt|jtst|jrtjStd)Nr)rrQrUr_rYrr`rprrrrs z_PassphraseHelper.callback_args exceptionTypetype[Exception]cCs6|jrzt|Wn |yYnw|jddSr)r_exception_from_error_queuepop)rqrrrrrs   z"_PassphraseHelper.raise_if_problemrsizerwflaguserdatac CszUt|jr|jr||||}n||}n |jdusJ|j}t|ts*tdt||kr>|jr:|d|}ntdtt|D] }|||d||<qDt|WSt yn}z |j |WYd}~dSd}~ww)NzBytes expectedz+passphrase returned by callback is too longrr) rrrr_rYrarSrr Exceptionrrt)rqrrrrrrerrrrs.      z"_PassphraseHelper._read_passphraseN)FF) rrArrrrrrrr^r)rrrr^) rrrrArrrrrrA) rDrErFrrrrrr.rrrrrrrs     r str | bytescCst|tr |d}t|}|tkrt|tjtjtj}n|t kr*t |tj}nt d|tjkr6t t t }t|tj|_d|_|S)a< Load a public key from a buffer. :param type: The file type (one of :data:`FILETYPE_PEM`, :data:`FILETYPE_ASN1`). :param buffer: The buffer the key is stored in. :type buffer: A Python string object, either unicode or bytestring. :return: The PKey object. :rtype: :class:`PKey` rrTN)r_rrrXr)rMZPEM_read_bio_PUBKEYrQrUr(Zd2i_PUBKEY_biorarr/r*rVr{r|r)rrHrKevp_pkeyrrrrr@s   r@cCst|tr |d}t|}t||}|tkr't|tj |j |j }| n|t kr3t|tj }ntd|tj kr?ttt}t|tj|_|S)a Load a private key (PKey) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the key is stored in :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The PKey object rrN)r_rrrXrr)rMZPEM_read_bio_PrivateKeyrQrUrrrr(Zd2i_PrivateKey_biorarr/r*rVr{r|)rrHrrKrrrrrrr? s"      r?rcCsnt}|tkrt||j}n|tkrt||j}n|tkr)t||jdd}nt dt |dkt |S)av Dump the certificate request *req* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param req: The certificate request to dump :return: The buffer with the dumped certificate request in .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. rrN) rXr)rMZPEM_write_bio_X509_REQrr(Zi2d_X509_REQ_bior*ZX509_REQ_print_exrarTr[)rrrKrrrrr8; s  r8rcCst|tr |d}t|}|tkrt|tjtjtj}n|t kr*t |tj}nt dt |tjkt t }t|tj|_|S)a Load a certificate request (X509Req) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the certificate request is stored in :return: The X509Req object .. deprecated:: 24.2.0 Use `cryptography.x509.load_der_x509_csr` or `cryptography.x509.load_pem_x509_csr` instead. rrN)r_rrrXr)rMZPEM_read_bio_X509_REQrQrUr(Zd2i_X509_REQ_biorarTr2r*rVrr)rrHrKrZx509reqrrrr>i s  r>)rrrrrrr)rHrIrr)rKrrrY)r\rr]rYrr^)r]rYrr)rfrrrI)rr)rsrrr)rrArHrYrr-)rrArTr-rrY)rrArr/rrYr) rrArr/rrrrrrY)rrArHrrr/)rrArHrrrrr/)rrArr2rrY)rrArHrYrr2)o __future__rrru functoolssysrr7base64rcollections.abcrrrrrr version_infor TypeVar_TZtyping_extensionsZ cryptographyrrZ)cryptography.hazmat.primitives.asymmetricrrrrr Z OpenSSL._utilr!r"rr#rr$rQr%rMr&Z _make_assertr'r__all__rrrrrZ _PrivateKeyrrrrrZ _PublicKeyrrYZPassphraseCallableTZSSL_FILETYPE_PEMr)rZSSL_FILETYPE_ASN1r(r*rr,Z EVP_PKEY_DSAr+Z EVP_PKEY_DHrBZ EVP_PKEY_ECrCrr.rrTrXr[rcrermrnr/rr<r;total_orderingr1r0r2r-r6r3r5r4r=r7r:r9rr@r?r8r!rDr9r>r&rrrrs                     Bg  C-sm+    E N% )