U
     T‚g°8 ã                   @  sT  U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlmZ d dl	m
Z
mZ d dlmZ d dlmZ d dlmZmZmZ d dlmZmZ d d	lmZmZmZmZmZ d d
lmZ d dlmZ d dlm Z! d dlm"Z# d dlm$Z% d dlm&Z' ddddddddddddddddd d!d"d#d$d%d&d'd(gZ(eej)ej*ej+ej,ej-f Z.eej/ej0ej1ej2ej3f Z4ee.e4f Z5ee6e7ef Z8ee7ed)e7f f Z9e#j:Z;d*e<d< e#j=Z>d*e<d< d+Z?e#j@ZAd*e<d< e#jBZCd*e<d< e#jDZEd*e<d,< e#jFZGd*e<d-< G d.d„ deHƒZIeeeIƒZJe%eIƒZKdmd/d0d1œd2d3„ZLd0d4d5œd6d7„ZMd0d4d8d9œd:d;„ZNd4d0d<œd=d>„ZOd0d/d?œd@dA„ZPG dBdC„ dCƒZQG dDd„ dƒZRG dEdF„ dFƒZSdGdHœdId$„ZTeTZUejVeTeWdJeXd$dK� dLdFdMœdNd#„ZYejVeYeWdOeXd#dK� ejZG dPd„ dƒƒZ[G dQd„ dƒZ\e\Z]ejVe\eWdReXddK� G dSd„ dƒZ^e^Z_ejVe^eWdTeXddK� G dUd„ dƒZ`G dVd„ dƒZaG dWd„ dƒZbG dXd„ deHƒZcG dYd„ dƒZdd*d4ddZœd[d%„Zed*dd4d\œd]d„Zfd*dd4d^œd_d"„Zgdnd*dd`dad4dbœdcd!„ZhG ddde„ deƒZid*dfddZœdgd(„Zjdod*dfdaddhœdid'„Zkd*dd4djœdkd „ZlelZmejVeleWdTeXd dK� d*d4ddZœdld&„ZnenZoejVeneWdTeXd&dK� dS )pé    )ÚannotationsN)Ú	b16encode)ÚIterableÚSequence)Úpartial)ÚPathLike)ÚAnyÚCallableÚUnion)ÚutilsÚx509)ÚdsaÚecÚed448Úed25519Úrsa)Úbyte_string)Úexception_from_error_queue)Úffi)Úlib)Úmake_assert)Ú
path_bytesÚFILETYPE_ASN1ÚFILETYPE_PEMÚFILETYPE_TEXTÚTYPE_DSAÚTYPE_RSAÚX509ÚErrorÚPKeyÚX509ExtensionÚX509NameÚX509ReqÚ	X509StoreÚX509StoreContextÚX509StoreContextErrorÚX509StoreFlagsÚdump_certificateÚdump_certificate_requestÚdump_privatekeyÚdump_publickeyÚget_elliptic_curveÚget_elliptic_curvesÚload_certificateÚload_certificate_requestÚload_privatekeyÚload_publickey.Úintiÿÿ  ÚTYPE_DHÚTYPE_ECc                   @  s   e Zd ZdZdS )r   z7
    An error occurred in an `OpenSSL.crypto` API.
    N)Ú__name__Ú
__module__Ú__qualname__Ú__doc__© r8   r8   ú2/tmp/pip-unpacked-wheel-7h6zd61s/OpenSSL/crypto.pyr   j   s   úbytes | Noner   )ÚbufferÚreturnc                 C  sn   | dkrt  t  ¡ ¡}t j}n2t d| ¡}t  |t| ƒ¡}|fddddœdd„}t|tj	kƒ t 
||¡}|S )zÙ
    Allocate a new OpenSSL memory BIO.

    Arrange for the garbage collector to clean it up automatically.

    :param buffer: None or some bytes to use to put into the BIO so that they
        can be read out.
    Núchar[]r   )ÚbioÚrefr<   c                 S  s
   t  | ¡S ©N)Ú_libÚBIO_free)r>   r?   r8   r8   r9   Úfree…   s    z_new_mem_buf.<locals>.free)rA   ZBIO_newZ	BIO_s_memrB   Ú_ffiÚnewZBIO_new_mem_bufÚlenÚ_openssl_assertÚNULLÚgc)r;   r>   rC   Údatar8   r8   r9   Ú_new_mem_buft   s    	rK   Úbytes)r>   r<   c                 C  s.   t  d¡}t | |¡}t  |d |¡dd… S )zO
    Copy the contents of an OpenSSL BIO object into a Python byte string.
    zchar**r   N)rD   rE   rA   ZBIO_get_mem_datar;   )r>   Úresult_bufferZbuffer_lengthr8   r8   r9   Ú_bio_to_stringŽ   s    
rN   ÚNone)ÚboundaryÚwhenr<   c                 C  s@   t |tƒstdƒ‚t| tjkƒ t | |¡}|dkr<tdƒ‚dS )aô  
    The the time value of an ASN1 time object.

    @param boundary: An ASN1_TIME pointer (or an object safely
        castable to that type) which will have its value set.
    @param when: A string representation of the desired time value.

    @raise TypeError: If C{when} is not a L{bytes} string.
    @raise ValueError: If C{when} does not represent a time in the required
        format.
    @raise RuntimeError: If the time value cannot be set for some other
        (unspecified) reason.
    zwhen must be a byte stringr   zInvalid stringN)	Ú
isinstancerL   Ú	TypeErrorrG   rD   rH   rA   ZASN1_TIME_set_stringÚ
ValueError)rP   rQ   Ú
set_resultr8   r8   r9   Ú_set_asn1_time—   s    
rV   ©rQ   r<   c                 C  s2   t  ¡ }t|tjkƒ t |t j¡}t|| ƒ |S )aŒ  
    Behaves like _set_asn1_time but returns a new ASN1_TIME object.

    @param when: A string representation of the desired time value.

    @raise TypeError: If C{when} is not a L{bytes} string.
    @raise ValueError: If C{when} does not represent a time in the required
        format.
    @raise RuntimeError: If the time value cannot be set for some other
        (unspecified) reason.
    )rA   ZASN1_TIME_newrG   rD   rH   rI   ZASN1_TIME_freerV   )rQ   Úretr8   r8   r9   Ú_new_asn1_time°   s
    
rY   )Ú	timestampr<   c                 C  s    t  d| ¡}t |¡dkrdS t |¡tjkr>t  t |¡¡S t  d¡}t 	| |¡ t
|d t jkƒ t  d|d ¡}t |¡}t  |¡}t |d ¡ |S dS )a]  
    Retrieve the time value of an ASN1 time object.

    @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to
        that type) from which the time value will be retrieved.

    @return: The time value from C{timestamp} as a L{bytes} string in a certain
        format.  Or C{None} if the object contains no time value.
    úASN1_STRING*r   NzASN1_GENERALIZEDTIME**)rD   ÚcastrA   ÚASN1_STRING_lengthZASN1_STRING_typeZV_ASN1_GENERALIZEDTIMEÚstringÚASN1_STRING_get0_datarE   ZASN1_TIME_to_generalizedtimerG   rH   ZASN1_GENERALIZEDTIME_free)rZ   Zstring_timestampZgeneralized_timestampZstring_dataÚstring_resultr8   r8   r9   Ú_get_asn1_timeÃ   s    
ÿ


ra   c                   @  s8   e Zd Zddœdd„Zdddœdd„Zddœd	d
„ZdS )Ú_X509NameInvalidatorrO   ©r<   c                 C  s
   g | _ d S r@   )Ú_names©Úselfr8   r8   r9   Ú__init__á   s    z_X509NameInvalidator.__init__r!   ©Únamer<   c                 C  s   | j  |¡ d S r@   )rd   Úappend©rf   ri   r8   r8   r9   Úaddä   s    z_X509NameInvalidator.addc                 C  s   | j D ]}|`qd S r@   )rd   Ú_namerk   r8   r8   r9   Úclearç   s    
z_X509NameInvalidator.clearN)r4   r5   r6   rg   rl   rn   r8   r8   r8   r9   rb   à   s   rb   c                   @  s„   e Zd ZdZdZdZddœdd„Zddœd	d
„Zedd dœdd„ƒZ	ddddœdd„Z
ddœdd„Zddœdd„Zddœdd„ZdS )r   zD
    A class representing an DSA or RSA public key or key pair.
    FTrO   rc   c                 C  s"   t  ¡ }t |t j¡| _d| _d S )NF)rA   ZEVP_PKEY_newrD   rI   ÚEVP_PKEY_freeÚ_pkeyÚ_initialized©rf   Úpkeyr8   r8   r9   rg   õ   s    zPKey.__init__Ú_Keyc                 C  s@   ddl m}m} | jr(tt| ƒ}||ƒS tt| ƒ}||dƒS dS )a  
        Export as a ``cryptography`` key.

        :rtype: One of ``cryptography``'s `key interfaces`_.

        .. _key interfaces: https://cryptography.io/en/latest/hazmat/            primitives/asymmetric/rsa/#key-interfaces

        .. versionadded:: 16.1.0
        r   )Úload_der_private_keyÚload_der_public_keyN)Ú,cryptography.hazmat.primitives.serializationru   rv   Ú_only_publicr*   r   r)   )rf   ru   rv   Úderr8   r8   r9   Úto_cryptography_keyú   s    

zPKey.to_cryptography_key)Ú
crypto_keyr<   c                 C  s¨   t |tjtjtjtjtjtj	t
jt
jtjtjf
ƒs:tdƒ‚ddlm}m}m}m} t |tjtjtj	t
jtjfƒr†tt| |j|j¡ƒS | |j|j|ƒ ¡}tt|ƒS dS )zø
        Construct based on a ``cryptography`` *crypto_key*.

        :param crypto_key: A ``cryptography`` key.
        :type crypto_key: One of ``cryptography``'s `key interfaces`_.

        :rtype: PKey

        .. versionadded:: 16.1.0
        zUnsupported key typer   )ÚEncodingÚNoEncryptionÚPrivateFormatÚPublicFormatN)rR   r   ÚDSAPrivateKeyÚDSAPublicKeyr   ÚEllipticCurvePrivateKeyÚEllipticCurvePublicKeyr   ÚEd25519PrivateKeyÚEd25519PublicKeyr   ÚEd448PrivateKeyÚEd448PublicKeyr   ÚRSAPrivateKeyÚRSAPublicKeyrS   rw   r|   r}   r~   r   r0   r   Úpublic_bytesÚDERZSubjectPublicKeyInfoZprivate_bytesZPKCS8r/   )Úclsr{   r|   r}   r~   r   ry   r8   r8   r9   Úfrom_cryptography_key  sL    öþûþ
 ÿþ  ÿzPKey.from_cryptography_keyr1   )ÚtypeÚbitsr<   c              	   C  s6  t |tƒstdƒ‚t |tƒs$tdƒ‚|tkr¢|dkr<tdƒ‚t ¡ }t |tj	¡}t 
|tj¡ t ¡ }t |||tj¡}t|dkƒ t | j|¡}t|dkƒ nŠ|tk�r$t ¡ }t|tjkƒ t |tj¡}t ||tjdtjtjtj¡}t|dkƒ tt |¡dkƒ tt | j|¡dkƒ ntdƒ‚d| _dS )	a3  
        Generate a key pair of the given type, with the given number of bits.

        This generates a key "into" the this object.

        :param type: The key type.
        :type type: :py:data:`TYPE_RSA` or :py:data:`TYPE_DSA`
        :param bits: The number of bits.
        :type bits: :py:data:`int` ``>= 0``
        :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't
            of the appropriate type.
        :raises ValueError: If the number of bits isn't an integer of
            the appropriate size.
        :return: ``None``
        ztype must be an integerzbits must be an integerr   zInvalid number of bitsé   zNo such key typeTN)rR   r1   rS   r   rT   rA   ZBN_newrD   rI   ÚBN_freeZBN_set_wordZRSA_F4ZRSA_newZRSA_generate_key_exrH   rG   ZEVP_PKEY_assign_RSArp   r   ZDSA_newZDSA_freeZDSA_generate_parameters_exZDSA_generate_keyZEVP_PKEY_set1_DSAr   rq   )rf   rŽ   r�   Úexponentr   Úresultr   Úresr8   r8   r9   Úgenerate_keyK  sB    


      ÿzPKey.generate_keyÚboolc                 C  sd   | j rtdƒ‚t |  ¡ ¡tjkr*tdƒ‚t | j¡}t 	|tj
¡}t |¡}|dkrZdS tƒ  dS )ax  
        Check the consistency of an RSA private key.

        This is the Python equivalent of OpenSSL's ``RSA_check_key``.

        :return: ``True`` if key is consistent.

        :raise OpenSSL.crypto.Error: if the key is inconsistent.

        :raise TypeError: if the key is of a type which cannot be checked.
            Only RSA keys can currently be checked.
        zpublic key onlyz'Only RSA keys can currently be checked.r�   TN)rx   rS   rA   ZEVP_PKEY_typerŽ   ÚEVP_PKEY_RSAÚEVP_PKEY_get1_RSArp   rD   rI   ÚRSA_freeZRSA_check_keyÚ_raise_current_error)rf   r   r“   r8   r8   r9   Úcheckƒ  s    
z
PKey.checkc                 C  s   t  | j¡S )zT
        Returns the type of the key

        :return: The type of the key.
        )rA   ÚEVP_PKEY_idrp   re   r8   r8   r9   rŽ   �  s    z	PKey.typec                 C  s   t  | j¡S )zh
        Returns the number of bits of the key

        :return: The number of bits of the key.
        )rA   ZEVP_PKEY_bitsrp   re   r8   r8   r9   r�   ¥  s    z	PKey.bitsN)r4   r5   r6   r7   rx   rq   rg   rz   Úclassmethodr�   r•   r›   rŽ   r�   r8   r8   r8   r9   r   í   s   98c                      sš   e Zd ZdZdZdddœ‡ fdd„Zeddd	œd
d„ƒZeddd	œdd„ƒZeddd dœdd„ƒZ	dddddœdd„Z
ddœdd„Zddœdd„Z‡  ZS )Ú_EllipticCurveaZ  
    A representation of a supported elliptic curve.

    @cvar _curves: :py:obj:`None` until an attempt is made to load the curves.
        Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve`
        instances each of which represents one curve supported by the system.
    @type _curves: :py:type:`NoneType` or :py:type:`set`
    Nr   r–   ©Úotherr<   c                   s   t |tƒrtƒ  |¡S tS )z·
        Implement cooperation with the right-hand side argument of ``!=``.

        Python 3 seems to have dropped this cooperation in this very narrow
        circumstance.
        )rR   rž   ÚsuperÚ__ne__ÚNotImplemented©rf   r    ©Ú	__class__r8   r9   r¢   º  s    
z_EllipticCurve.__ne__úset[_EllipticCurve])r   r<   c                   s>   ˆ  tjd¡}t d|¡}ˆ  ||¡ t‡ ‡fdd„|D ƒƒS )zü
        Get the curves supported by OpenSSL.

        :param lib: The OpenSSL library binding object.

        :return: A :py:type:`set` of ``cls`` instances giving the names of the
            elliptic curves the underlying library supports.
        r   zEC_builtin_curve[]c                 3  s   | ]}ˆ   ˆ|j¡V  qd S r@   )Úfrom_nidÚnid)Ú.0Úc©rŒ   r   r8   r9   Ú	<genexpr>Õ  s     z7_EllipticCurve._load_elliptic_curves.<locals>.<genexpr>)ZEC_get_builtin_curvesrD   rH   rE   Úset)rŒ   r   Z
num_curvesZbuiltin_curvesr8   r¬   r9   Ú_load_elliptic_curvesÅ  s    
z$_EllipticCurve._load_elliptic_curvesc                 C  s   | j dkr|  |¡| _ | j S )a  
        Get, cache, and return the curves supported by OpenSSL.

        :param lib: The OpenSSL library binding object.

        :return: A :py:type:`set` of ``cls`` instances giving the names of the
            elliptic curves the underlying library supports.
        N)Ú_curvesr¯   r¬   r8   r8   r9   Ú_get_elliptic_curves×  s    

z#_EllipticCurve._get_elliptic_curvesr1   )r   r©   r<   c                 C  s   | ||t  | |¡¡ d¡ƒS )aË  
        Instantiate a new :py:class:`_EllipticCurve` associated with the given
        OpenSSL NID.

        :param lib: The OpenSSL library binding object.

        :param nid: The OpenSSL NID the resulting curve object will represent.
            This must be a curve NID (and not, for example, a hash NID) or
            subsequent operations will fail in unpredictable ways.
        :type nid: :py:class:`int`

        :return: The curve object.
        Úascii)rD   r^   Ú
OBJ_nid2snÚdecode)rŒ   r   r©   r8   r8   r9   r¨   å  s    z_EllipticCurve.from_nidÚstrrO   )r   r©   ri   r<   c                 C  s   || _ || _|| _dS )a‰  
        :param _lib: The :py:mod:`cryptography` binding instance used to
            interface with OpenSSL.

        :param _nid: The OpenSSL NID identifying the curve this object
            represents.
        :type _nid: :py:class:`int`

        :param name: The OpenSSL short name identifying the curve this object
            represents.
        :type name: :py:class:`unicode`
        N)rA   Ú_nidri   )rf   r   r©   ri   r8   r8   r9   rg   ö  s    z_EllipticCurve.__init__rc   c                 C  s   d| j ›d�S )Nz<Curve ú>©ri   re   r8   r8   r9   Ú__repr__  s    z_EllipticCurve.__repr__c                 C  s   | j  | j¡}t |t j¡S )zÅ
        Create a new OpenSSL EC_KEY structure initialized to use this curve.

        The structure is automatically garbage collected when the Python object
        is garbage collected.
        )rA   ZEC_KEY_new_by_curve_namer¶   rD   rI   ZEC_KEY_free)rf   Úkeyr8   r8   r9   Ú
_to_EC_KEY
  s    z_EllipticCurve._to_EC_KEY)r4   r5   r6   r7   r°   r¢   r�   r¯   r±   r¨   rg   r¹   r»   Ú__classcell__r8   r8   r¥   r9   rž   ®  s   	rž   r§   rc   c                   C  s
   t  t¡S )a“  
    Return a set of objects representing the elliptic curves supported in the
    OpenSSL build in use.

    The curve objects have a :py:class:`unicode` ``name`` attribute by which
    they identify themselves.

    The curve objects are useful as values for the argument accepted by
    :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be
    used for ECDHE key exchange.
    )rž   r±   rA   r8   r8   r8   r9   r,     s    zSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.r¸   rµ   rh   c                 C  s,   t ƒ D ]}|j| kr|  S qtd| ƒ‚dS )aT  
    Return a single curve object selected by name.

    See :py:func:`get_elliptic_curves` for information about curve objects.

    :param name: The OpenSSL short name identifying the curve object to
        retrieve.
    :type name: :py:class:`unicode`

    If the named curve is not supported then :py:class:`ValueError` is raised.
    zunknown curve nameN)Ú_get_elliptic_curves_internalri   rT   )ri   Zcurver8   r8   r9   r+   2  s    


zRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.c                      s¢   e Zd ZdZd ddœdd„Zddddœ‡ fd	d
„Zdddœdd„Zdddœdd„Zdddœdd„Zddœdd„Z	ddœdd„Z
ddœdd„Zddœdd„Z‡  ZS ) r!   a  
    An X.509 Distinguished Name.

    :ivar countryName: The country of the entity.
    :ivar C: Alias for  :py:attr:`countryName`.

    :ivar stateOrProvinceName: The state or province of the entity.
    :ivar ST: Alias for :py:attr:`stateOrProvinceName`.

    :ivar localityName: The locality of the entity.
    :ivar L: Alias for :py:attr:`localityName`.

    :ivar organizationName: The organization name of the entity.
    :ivar O: Alias for :py:attr:`organizationName`.

    :ivar organizationalUnitName: The organizational unit of the entity.
    :ivar OU: Alias for :py:attr:`organizationalUnitName`

    :ivar commonName: The common name of the entity.
    :ivar CN: Alias for :py:attr:`commonName`.

    :ivar emailAddress: The e-mail address of the entity.
    rO   rh   c                 C  s    t  |j¡}t |t j¡| _dS )zž
        Create a new X509Name, copying the given X509Name instance.

        :param name: The name to copy.
        :type name: :py:class:`X509Name`
        N)rA   ZX509_NAME_duprm   rD   rI   ZX509_NAME_freerk   r8   r8   r9   rg   j  s    zX509Name.__init__rµ   r   )ri   Úvaluer<   c           	   	     s  |  d¡rtƒ  ||¡S t|ƒtk	r<tdt|ƒjd›d�ƒ‚t t	|ƒ¡}|tj
kr|z
tƒ  W n tk
rr   Y nX tdƒ‚tt | j¡ƒD ]J}t | j|¡}t |¡}t |¡}||krŒt | j|¡}t |¡  qØqŒt|tƒrì| d¡}t | j|tj|ddd¡}|�stƒ  d S )	NÚ_z$attribute name must be string, not 'z.200ú'úNo such attributeúutf-8éÿÿÿÿr   )Ú
startswithr¡   Ú__setattr__rŽ   rµ   rS   r4   rA   ÚOBJ_txt2nidÚ_byte_stringÚ	NID_undefrš   r   ÚAttributeErrorÚrangeÚX509_NAME_entry_countrm   ÚX509_NAME_get_entryÚX509_NAME_ENTRY_get_objectÚOBJ_obj2nidZX509_NAME_delete_entryZX509_NAME_ENTRY_freerR   ÚencodeZX509_NAME_add_entry_by_NIDZMBSTRING_UTF8)	rf   ri   r¾   r©   ÚiÚentZent_objZent_nidÚ
add_resultr¥   r8   r9   rÅ   t  sD    
ÿ






      ÿzX509Name.__setattr__ú
str | Nonec           	   
   C  sÎ   t  t|ƒ¡}|t jkr@z
tƒ  W n tk
r6   Y nX tdƒ‚t  | j|d¡}|dkr\dS t  	| j|¡}t  
|¡}t d¡}t  ||¡}t|dkƒ z"t |d |¡dd…  d¡}W 5 t  |d ¡ X |S )a
  
        Find attribute. An X509Name object has the following attributes:
        countryName (alias C), stateOrProvince (alias ST), locality (alias L),
        organization (alias O), organizationalUnit (alias OU), commonName
        (alias CN) and more...
        rÁ   rÃ   Núunsigned char**r   rÂ   )rA   rÆ   rÇ   rÈ   rš   r   rÉ   ZX509_NAME_get_index_by_NIDrm   rÌ   ÚX509_NAME_ENTRY_get_datarD   rE   ZASN1_STRING_to_UTF8rG   ÚOPENSSL_freer;   r´   )	rf   ri   r©   Zentry_indexÚentryrJ   rM   Zdata_lengthr“   r8   r8   r9   Ú__getattr__›  s*    



ÿzX509Name.__getattr__r–   rŸ   c                 C  s"   t |tƒstS t | j|j¡dkS ©Nr   ©rR   r!   r£   rA   ZX509_NAME_cmprm   r¤   r8   r8   r9   Ú__eq__Ã  s    
zX509Name.__eq__c                 C  s"   t |tƒstS t | j|j¡dk S rÙ   rÚ   r¤   r8   r8   r9   Ú__lt__É  s    
zX509Name.__lt__rc   c                 C  sD   t  dd¡}t | j|t|ƒ¡}t|t jkƒ d t  	|¡ 
d¡¡S )z6
        String representation of an X509Name
        r=   i   z<X509Name object '{}'>rÂ   )rD   rE   rA   ZX509_NAME_onelinerm   rF   rG   rH   Úformatr^   r´   )rf   rM   Zformat_resultr8   r8   r9   r¹   Ï  s      ÿÿzX509Name.__repr__r1   c                 C  s   t  | j¡S )a&  
        Return an integer representation of the first four bytes of the
        MD5 digest of the DER representation of the name.

        This is the Python equivalent of OpenSSL's ``X509_NAME_hash``.

        :return: The (integer) hash of this name.
        :rtype: :py:class:`int`
        )rA   ZX509_NAME_hashrm   re   r8   r8   r9   ÚhashÝ  s    
zX509Name.hashrL   c                 C  sN   t  d¡}t | j|¡}t|dkƒ t  |d |¡dd… }t |d ¡ |S )zŽ
        Return the DER encoding of this name.

        :return: The DER encoded form of this name.
        :rtype: :py:class:`bytes`
        rÔ   r   N)rD   rE   rA   Zi2d_X509_NAMErm   rG   r;   rÖ   )rf   rM   Zencode_resultr`   r8   r8   r9   ry   é  s    
zX509Name.derzlist[tuple[bytes, bytes]]c           	      C  sˆ   g }t t | j¡ƒD ]n}t | j|¡}t |¡}t |¡}t |¡}t |¡}t	 
t |¡t |¡¡dd… }| t	 |¡|f¡ q|S )z¼
        Returns the components of this name, as a sequence of 2-tuples.

        :return: The components of this name.
        :rtype: :py:class:`list` of ``name, value`` tuples.
        N)rÊ   rA   rË   rm   rÌ   rÍ   rÕ   rÎ   r³   rD   r;   r_   r]   rj   r^   )	rf   r“   rÐ   rÑ   ÚfnameZfvalr©   ri   r¾   r8   r8   r9   Úget_componentsø  s    



 ÿzX509Name.get_components)r4   r5   r6   r7   rg   rÅ   rØ   rÛ   rÜ   r¹   rÞ   ry   rà   r¼   r8   r8   r¥   r9   r!   P  s   
'(c                   @  s¢   e Zd ZU dZddddddddœdd	„Zed
dœdd„ƒZejdej	dej
diZded< ddœdd„Zddœdd„Zddœdd„Zddœdd„Zddœdd„ZdS )r    zu
    An X.509 v3 certificate extension.

    .. deprecated:: 23.3.0
       Use cryptography's X509 APIs instead.
    NrL   r–   zX509 | NonerO   )Ú	type_nameÚcriticalr¾   ÚsubjectÚissuerr<   c                 C  s¶   t  d¡}t |t jt jt jt jd¡ t |¡ |dk	rRt|tƒsJtdƒ‚|j	|_
|dk	rtt|tƒsltdƒ‚|j	|_|r€d| }t t j|||¡}|t jkr¢tƒ  t  |tj¡| _dS )aÝ  
        Initializes an X509 extension.

        :param type_name: The name of the type of extension_ to create.
        :type type_name: :py:data:`bytes`

        :param bool critical: A flag indicating whether this is a critical
            extension.

        :param value: The OpenSSL textual representation of the extension's
            value.
        :type value: :py:data:`bytes`

        :param subject: Optional X509 certificate to use as subject.
        :type subject: :py:class:`X509`

        :param issuer: Optional X509 certificate to use as issuer.
        :type issuer: :py:class:`X509`

        .. _extension: https://www.openssl.org/docs/manmaster/man5/
            x509v3_config.html#STANDARD-EXTENSIONS
        zX509V3_CTX*r   Nzissuer must be an X509 instancez subject must be an X509 instances	   critical,)rD   rE   rA   ZX509V3_set_ctxrH   ZX509V3_set_ctx_nodbrR   r   rS   Ú_x509Zissuer_certZsubject_certZX509V3_EXT_nconfrš   rI   ÚX509_EXTENSION_freeÚ
_extension)rf   rá   râ   r¾   rã   rä   ÚctxÚ	extensionr8   r8   r9   rg     s"    




zX509Extension.__init__r   rc   c                 C  s   t  t  | j¡¡S r@   )rA   rÎ   ÚX509_EXTENSION_get_objectrç   re   r8   r8   r9   r¶   `  s    
ÿzX509Extension._nidÚemailÚDNSÚURIztyping.ClassVar[dict[int, str]]Ú	_prefixesrµ   c              	   C  sÔ   t  dt | j¡¡}t  |tj¡}g }tt |¡ƒD ]”}t 	||¡}z| j
|j }W n: tk
rŽ   tƒ }t ||¡ | t|ƒ d¡¡ Y q4X t  |jjj|jjj¡d d …  d¡}| |d | ¡ q4d |¡S )NzGENERAL_NAMES*rÂ   ú:z, )rD   r\   rA   ZX509V3_EXT_d2irç   rI   ZGENERAL_NAMES_freerÊ   Zsk_GENERAL_NAME_numZsk_GENERAL_NAME_valuerî   rŽ   ÚKeyErrorrK   ZGENERAL_NAME_printrj   rN   r´   r;   ÚdZia5rJ   ÚlengthÚjoin)rf   ÚnamesÚpartsrÐ   ri   Úlabelr>   r¾   r8   r8   r9   Ú_subjectAltNameStringl  s&     
ÿ þz#X509Extension._subjectAltNameStringc                 C  sF   t j| jkr|  ¡ S tƒ }t  || jdd¡}t|dkƒ t|ƒ 	d¡S )zF
        :return: a nice text representation of the extension
        r   rÂ   )
rA   ZNID_subject_alt_namer¶   r÷   rK   ZX509V3_EXT_printrç   rG   rN   r´   )rf   r>   Zprint_resultr8   r8   r9   Ú__str__‚  s    zX509Extension.__str__c                 C  s   t  | j¡S )zk
        Returns the critical field of this X.509 extension.

        :return: The critical field.
        )rA   ZX509_EXTENSION_get_criticalrç   re   r8   r8   r9   Úget_critical�  s    zX509Extension.get_criticalc                 C  s<   t  | j¡}t  |¡}t  |¡}|tjkr4t |¡S dS dS )zü
        Returns the short type name of this X.509 extension.

        The result is a byte string such as :py:const:`b"basicConstraints"`.

        :return: The short type name.
        :rtype: :py:data:`bytes`

        .. versionadded:: 0.12
        s   UNDEFN)rA   rê   rç   rÎ   r³   rD   rH   r^   )rf   Úobjr©   Úbufr8   r8   r9   Úget_short_name—  s    



zX509Extension.get_short_namec                 C  s@   t  | j¡}t d|¡}t  |¡}t  |¡}t ||¡dd… S )zÍ
        Returns the data of the X509 extension, encoded as ASN.1.

        :return: The ASN.1 encoded data of this X509 extension.
        :rtype: :py:data:`bytes`

        .. versionadded:: 0.12
        r[   N)rA   ZX509_EXTENSION_get_datarç   rD   r\   r_   r]   r;   )rf   Zoctet_resultr`   Zchar_resultÚresult_lengthr8   r8   r9   Úget_data­  s
    	

zX509Extension.get_data)NN)r4   r5   r6   r7   rg   Úpropertyr¶   rA   Z	GEN_EMAILZGEN_DNSZGEN_URIrî   Ú__annotations__r÷   rø   rù   rü   rþ   r8   r8   r8   r9   r      s$   
  úE   ýzZX509Extension support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c                   @  sÊ   e Zd ZdZddœdd„Zddœdd„Zedd d	œd
d„ƒZdddœdd„Zddœdd„Z	dddœdd„Z
ddœdd„Zddœdd„Zdddœdd„Zddœd d!„Zdd"dd#œd$d%„Zdd&dœd'd(„Zd)S )*r"   zŽ
    An X.509 certificate signing requests.

    .. deprecated:: 24.2.0
       Use `cryptography.x509.CertificateSigningRequest` instead.
    rO   rc   c                 C  s&   t  ¡ }t |t j¡| _|  d¡ d S rÙ   )rA   ZX509_REQ_newrD   rI   ÚX509_REQ_freeÚ_reqÚset_version)rf   Úreqr8   r8   r9   rg   Ò  s    zX509Req.__init__zx509.CertificateSigningRequestc                 C  s   ddl m} tt| ƒ}||ƒS )z®
        Export as a ``cryptography`` certificate signing request.

        :rtype: ``cryptography.x509.CertificateSigningRequest``

        .. versionadded:: 17.1.0
        r   )Úload_der_x509_csr)Úcryptography.x509r  Ú"_dump_certificate_request_internalr   )rf   r  ry   r8   r8   r9   Úto_cryptographyØ  s    
zX509Req.to_cryptography)Ú
crypto_reqr<   c                 C  s6   t |tjƒstdƒ‚ddlm} | |j¡}tt	|ƒS )a  
        Construct based on a ``cryptography`` *crypto_req*.

        :param crypto_req: A ``cryptography`` X.509 certificate signing request
        :type crypto_req: ``cryptography.x509.CertificateSigningRequest``

        :rtype: X509Req

        .. versionadded:: 17.1.0
        z%Must be a certificate signing requestr   ©r|   )
rR   r   ZCertificateSigningRequestrS   rw   r|   rŠ   r‹   Ú"_load_certificate_request_internalr   )rŒ   r	  r|   ry   r8   r8   r9   Úfrom_cryptographyæ  s
    zX509Req.from_cryptographyr   ©rs   r<   c                 C  s    t  | j|j¡}t|dkƒ dS )zµ
        Set the public key of the certificate signing request.

        :param pkey: The public key to use.
        :type pkey: :py:class:`PKey`

        :return: ``None``
        r�   N)rA   ZX509_REQ_set_pubkeyr  rp   rG   ©rf   rs   rU   r8   r8   r9   Ú
set_pubkeyü  s    	zX509Req.set_pubkeyc                 C  sD   t  t ¡}t | j¡|_t|jtjkƒ t 	|jtj
¡|_d|_|S )z‹
        Get the public key of the certificate signing request.

        :return: The public key.
        :rtype: :py:class:`PKey`
        T)r   Ú__new__rA   ZX509_REQ_get_pubkeyr  rp   rG   rD   rH   rI   ro   rx   rr   r8   r8   r9   Ú
get_pubkey  s    
zX509Req.get_pubkeyr1   ©Úversionr<   c                 C  s@   t |tƒstdƒ‚|dkr"tdƒ‚t | j|¡}t|dkƒ dS )z±
        Set the version subfield (RFC 2986, section 4.1) of the certificate
        request.

        :param int version: The version number.
        :return: ``None``
        zversion must be an intr   z9Invalid version. The only valid version for X509Req is 0.r�   N)rR   r1   rS   rT   rA   ZX509_REQ_set_versionr  rG   )rf   r  rU   r8   r8   r9   r    s    
ÿzX509Req.set_versionc                 C  s   t  | j¡S )z¿
        Get the version subfield (RFC 2459, section 4.1.2.1) of the certificate
        request.

        :return: The value of the version subfield.
        :rtype: :py:class:`int`
        )rA   ZX509_REQ_get_versionr  re   r8   r8   r9   Úget_version'  s    zX509Req.get_versionr!   c                 C  s2   t  t ¡}t | j¡|_t|jtjkƒ | |_	|S )aÝ  
        Return the subject of this certificate signing request.

        This creates a new :class:`X509Name` that wraps the underlying subject
        name field on the certificate signing request. Modifying it will modify
        the underlying signing request, and will have the effect of modifying
        any other :class:`X509Name` that refers to this subject.

        :return: The subject of this certificate signing request.
        :rtype: :class:`X509Name`
        )
r!   r  rA   ZX509_REQ_get_subject_namer  rm   rG   rD   rH   Ú_ownerrk   r8   r8   r9   Úget_subject1  s
    
zX509Req.get_subjectú Iterable[_X509ExtensionInternal]©Ú
extensionsr<   c                 C  s|   t jdtdd� t ¡ }t|tjkƒ t |tj	¡}|D ]$}t
|tƒsNtdƒ‚t ||j¡ q8t | j|¡}t|dkƒ dS )z×
        Add extensions to the certificate signing request.

        :param extensions: The X.509 extensions to add.
        :type extensions: iterable of :py:class:`X509Extension`
        :return: ``None``
        úƒThis API is deprecated and will be removed in a future version of pyOpenSSL. You should use pyca/cryptography's X.509 APIs instead.é   ©Ú
stacklevelú+One of the elements is not an X509Extensionr�   N)ÚwarningsÚwarnÚDeprecationWarningrA   Zsk_X509_EXTENSION_new_nullrG   rD   rH   rI   Zsk_X509_EXTENSION_freerR   Ú_X509ExtensionInternalrT   Zsk_X509_EXTENSION_pushrç   ZX509_REQ_add_extensionsr  )rf   r  ÚstackÚextrÒ   r8   r8   r9   Úadd_extensionsG  s    
ù

zX509Req.add_extensionszlist[_X509ExtensionInternal]c                 C  s~   t jdtdd� g }t | j¡}t |dd„ ¡}tt 	|¡ƒD ]:}t
 t
¡}t t ||¡¡}t |tj¡|_| |¡ q>|S )zé
        Get X.509 extensions in the certificate signing request.

        :return: The X.509 extensions in this request.
        :rtype: :py:class:`list` of :py:class:`X509Extension` objects.

        .. versionadded:: 0.15
        r  r  r  c                 S  s   t  | t t jd¡¡S )Nræ   )rA   Zsk_X509_EXTENSION_pop_freerD   Ú	addressofZ_original_lib)Úxr8   r8   r9   Ú<lambda>�  s   þz(X509Req.get_extensions.<locals>.<lambda>)r  r   r!  rA   ZX509_REQ_get_extensionsr  rD   rI   rÊ   Zsk_X509_EXTENSION_numr"  r  ÚX509_EXTENSION_dupZsk_X509_EXTENSION_valueræ   rç   rj   )rf   ÚextsZnative_exts_objrÐ   r$  ré   r8   r8   r9   Úget_extensionsj  s&    	ù
þ

ÿzX509Req.get_extensionsrµ   ©rs   Údigestr<   c                 C  s^   |j rtdƒ‚|jstdƒ‚t t|ƒ¡}|tjkr<tdƒ‚t | j	|j
|¡}t|dkƒ dS )aa  
        Sign the certificate signing request with this key and digest type.

        :param pkey: The key pair to sign with.
        :type pkey: :py:class:`PKey`
        :param digest: The name of the message digest to use for the signature,
            e.g. :py:data:`"sha256"`.
        :type digest: :py:class:`str`
        :return: ``None``
        zKey has only public partúKey is uninitializedúNo such digest methodr   N)rx   rT   rq   rA   ÚEVP_get_digestbynamerÇ   rD   rH   ZX509_REQ_signr  rp   rG   )rf   rs   r-  Z
digest_objÚsign_resultr8   r8   r9   Úsign�  s    
zX509Req.signr–   c                 C  s4   t |tƒstdƒ‚t | j|j¡}|dkr0tƒ  |S )a@  
        Verifies the signature on this certificate signing request.

        :param PKey key: A public key.

        :return: ``True`` if the signature is correct.
        :rtype: bool

        :raises OpenSSL.crypto.Error: If the signature is invalid or there is a
            problem verifying the signature.
        úpkey must be a PKey instancer   )rR   r   rS   rA   ZX509_REQ_verifyr  rp   rš   )rf   rs   r“   r8   r8   r9   Úverify¨  s    
zX509Req.verifyN)r4   r5   r6   r7   rg   r  r�   r  r  r  r  r  r  r%  r+  r2  r4  r8   r8   r8   r9   r"   Ê  s   
#&zPCSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c                   @  s  e Zd ZdZddœdd„Zedd dœdd	„ƒZd
dœdd„Zed
d dœdd„ƒZdddœdd„Z	ddœdd„Z
ddœdd„Zdddœdd„Zddddœdd„Zd dœd!d"„Zdd d#œd$d%„Zd dœd&d'„Zddd(œd)d*„Zddœd+d,„Zddd-œd.d/„Zddd-œd0d1„Zd2dœd3d4„Zdd5d6œd7d8„Zd5dœd9d:„Zd;d dd<œd=d>„Zd dd?œd@dA„Zd5dœdBdC„Zd dd?œdDdE„ZddFd6œdGdH„ZddFddIœdJdK„ZdFdœdLdM„ZdFddNœdOdP„ZdFdœdQdR„Z dFddSœdTdU„Z!ddœdVdW„Z"dXddYœdZd[„Z#dd\d]œd^d_„Z$d`S )ar   z
    An X.509 certificate.
    rO   rc   c                 C  s:   t  ¡ }t|tjkƒ t |t j¡| _tƒ | _	tƒ | _
d S r@   )rA   ZX509_newrG   rD   rH   rI   Ú	X509_freerå   rb   Ú_issuer_invalidatorÚ_subject_invalidator)rf   r   r8   r8   r9   rg   Ñ  s
    zX509.__init__r   )r   r<   c                 C  s.   |   | ¡}t |tj¡|_tƒ |_tƒ |_|S r@   )	r  rD   rI   rA   r5  rå   rb   r6  r7  )rŒ   r   Úcertr8   r8   r9   Ú_from_raw_x509_ptrÙ  s
    
zX509._from_raw_x509_ptrzx509.Certificatec                 C  s   ddl m} tt| ƒ}||ƒS )z�
        Export as a ``cryptography`` certificate.

        :rtype: ``cryptography.x509.Certificate``

        .. versionadded:: 17.1.0
        r   )Úload_der_x509_certificate)r  r:  r'   r   )rf   r:  ry   r8   r8   r9   r  á  s    
zX509.to_cryptography)Úcrypto_certr<   c                 C  s6   t |tjƒstdƒ‚ddlm} | |j¡}tt	|ƒS )zü
        Construct based on a ``cryptography`` *crypto_cert*.

        :param crypto_key: A ``cryptography`` X.509 certificate.
        :type crypto_key: ``cryptography.x509.Certificate``

        :rtype: X509

        .. versionadded:: 17.1.0
        zMust be a certificater   r
  )
rR   r   ZCertificaterS   rw   r|   rŠ   r‹   r-   r   )rŒ   r;  r|   ry   r8   r8   r9   r  î  s
    zX509.from_cryptographyr1   r  c                 C  s,   t |tƒstdƒ‚tt | j|¡dkƒ dS )a	  
        Set the version number of the certificate. Note that the
        version value is zero-based, eg. a value of 0 is V1.

        :param version: The version number of the certificate.
        :type version: :py:class:`int`

        :return: ``None``
        zversion must be an integerr�   N)rR   r1   rS   rG   rA   ZX509_set_versionrå   )rf   r  r8   r8   r9   r    s    

zX509.set_versionc                 C  s   t  | j¡S )z˜
        Return the version number of the certificate.

        :return: The version number of the certificate.
        :rtype: :py:class:`int`
        )rA   ZX509_get_versionrå   re   r8   r8   r9   r    s    zX509.get_versionr   c                 C  sF   t  t ¡}t | j¡|_|jtjkr*tƒ  t 	|jtj
¡|_d|_|S )z{
        Get the public key of the certificate.

        :return: The public key.
        :rtype: :py:class:`PKey`
        T)r   r  rA   ZX509_get_pubkeyrå   rp   rD   rH   rš   rI   ro   rx   rr   r8   r8   r9   r    s    
zX509.get_pubkeyr  c                 C  s2   t |tƒstdƒ‚t | j|j¡}t|dkƒ dS )z¥
        Set the public key of the certificate.

        :param pkey: The public key.
        :type pkey: :py:class:`PKey`

        :return: :py:data:`None`
        r3  r�   N)rR   r   rS   rA   ZX509_set_pubkeyrå   rp   rG   r  r8   r8   r9   r  )  s    	
zX509.set_pubkeyrµ   r,  c                 C  sp   t |tƒstdƒ‚|jr tdƒ‚|js.tdƒ‚t t|ƒ¡}|t	j
krNtdƒ‚t | j|j|¡}t|dkƒ dS )a  
        Sign the certificate with this key and digest type.

        :param pkey: The key to sign with.
        :type pkey: :py:class:`PKey`

        :param digest: The name of the message digest to use.
        :type digest: :py:class:`str`

        :return: :py:data:`None`
        r3  zKey only has public partr.  r/  r   N)rR   r   rS   rx   rT   rq   rA   r0  rÇ   rD   rH   Z	X509_signrå   rp   rG   )rf   rs   r-  Zevp_mdr1  r8   r8   r9   r2  8  s    

z	X509.signrL   c                 C  sZ   t  | j¡}t d¡}t  |tjtj|¡ t  |d ¡}|t jkrJt	dƒ‚t 
t  |¡¡S )zþ
        Return the signature algorithm used in the certificate.

        :return: The name of the algorithm.
        :rtype: :py:class:`bytes`

        :raises ValueError: If the signature algorithm is undefined.

        .. versionadded:: 0.13
        zASN1_OBJECT **r   zUndefined signature algorithm)rA   ZX509_get0_tbs_sigalgrå   rD   rE   ZX509_ALGOR_get0rH   rÎ   rÈ   rT   r^   Z
OBJ_nid2ln)rf   Zsig_algZalgr©   r8   r8   r9   Úget_signature_algorithmT  s    

zX509.get_signature_algorithm)Údigest_namer<   c                 C  s„   t  t|ƒ¡}|tjkr tdƒ‚t dt j¡}t dd¡}t|ƒ|d< t  	| j
|||¡}t|dkƒ d dd„ t ||d ¡D ƒ¡S )	a5  
        Return the digest of the X509 object.

        :param digest_name: The name of the digest algorithm to use.
        :type digest_name: :py:class:`str`

        :return: The digest of the object, formatted as
            :py:const:`b":"`-delimited hex pairs.
        :rtype: :py:class:`bytes`
        r/  zunsigned char[]zunsigned int[]r�   r   ó   :c                 S  s   g | ]}t |ƒ ¡ ‘qS r8   )r   Úupper)rª   Úchr8   r8   r9   Ú
<listcomp>€  s   ÿzX509.digest.<locals>.<listcomp>)rA   r0  rÇ   rD   rH   rT   rE   ZEVP_MAX_MD_SIZErF   ZX509_digestrå   rG   ró   r;   )rf   r=  r-  rM   rý   Zdigest_resultr8   r8   r9   r-  g  s$    
   ÿþÿzX509.digestc                 C  s   t  | j¡S )zƒ
        Return the hash of the X509 subject.

        :return: The hash of the subject.
        :rtype: :py:class:`bytes`
        )rA   ZX509_subject_name_hashrå   re   r8   r8   r9   Úsubject_name_hash†  s    zX509.subject_name_hash)Úserialr<   c                 C  sª   t |tƒstdƒ‚t|ƒdd… }| d¡}t d¡}t ||¡}t	|tj
kƒ t |d tj
¡}t |d ¡ t	|tj
kƒ t |tj¡}t | j|¡}t	|dkƒ dS )z±
        Set the serial number of the certificate.

        :param serial: The new serial number.
        :type serial: :py:class:`int`

        :return: :py:data`None`
        zserial must be an integerr  Nr²   zBIGNUM**r   r�   )rR   r1   rS   ÚhexrÏ   rD   rE   rA   Z	BN_hex2bnrG   rH   ZBN_to_ASN1_INTEGERr‘   rI   ZASN1_INTEGER_freeZX509_set_serialNumberrå   )rf   rC  Ú
hex_serialZhex_serial_bytesÚbignum_serialr“   Úasn1_serialrU   r8   r8   r9   Úset_serial_number�  s    	


zX509.set_serial_numberc              	   C  sh   t  | j¡}t  |tj¡}z<t  |¡}z t 	|¡}t
|dƒ}|W ¢W ¢S t  |¡ X W 5 t  |¡ X dS )zx
        Return the serial number of this certificate.

        :return: The serial number.
        :rtype: int
        é   N)rA   ZX509_get_serialNumberrå   ZASN1_INTEGER_to_BNrD   rH   r‘   Z	BN_bn2hexrÖ   r^   r1   )rf   rG  rF  rE  Zhexstring_serialrC  r8   r8   r9   Úget_serial_number«  s    


zX509.get_serial_number)Úamountr<   c                 C  s.   t |tƒstdƒ‚t | j¡}t ||¡ dS )zÍ
        Adjust the time stamp on which the certificate stops being valid.

        :param int amount: The number of seconds by which to adjust the
            timestamp.
        :return: ``None``
        úamount must be an integerN)rR   r1   rS   rA   ÚX509_getm_notAfterrå   ÚX509_gmtime_adj)rf   rK  ZnotAfterr8   r8   r9   Úgmtime_adj_notAfter¿  s    
zX509.gmtime_adj_notAfterc                 C  s.   t |tƒstdƒ‚t | j¡}t ||¡ dS )z½
        Adjust the timestamp on which the certificate starts being valid.

        :param amount: The number of seconds by which to adjust the timestamp.
        :return: ``None``
        rL  N)rR   r1   rS   rA   ÚX509_getm_notBeforerå   rN  )rf   rK  Z	notBeforer8   r8   r9   Úgmtime_adj_notBeforeÍ  s    
zX509.gmtime_adj_notBeforer–   c                 C  sT   |   ¡ }|dkrtdƒ‚| d¡}tj |d¡}tjj}tj |¡jdd�}||k S )z¡
        Check whether the certificate has expired.

        :return: ``True`` if the certificate has expired, ``False`` otherwise.
        :rtype: bool
        NzUnable to determine notAfterrÂ   z%Y%m%d%H%M%SZ)Útzinfo)	Úget_notAfterrT   r´   ÚdatetimeÚstrptimeÚtimezoneÚutcÚnowÚreplace)rf   Z
time_bytesZtime_stringZ	not_afterÚUTCÚutcnowr8   r8   r9   Úhas_expiredÚ  s    
zX509.has_expiredr:   )Úwhichr<   c                 C  s   t || jƒƒS r@   )ra   rå   )rf   r]  r8   r8   r9   Ú_get_boundary_timeë  s    zX509._get_boundary_timec                 C  s   |   tj¡S )a
  
        Get the timestamp at which the certificate starts being valid.

        The timestamp is formatted as an ASN.1 TIME::

            YYYYMMDDhhmmssZ

        :return: A timestamp string, or ``None`` if there is none.
        :rtype: bytes or NoneType
        )r^  rA   rP  re   r8   r8   r9   Úget_notBeforeî  s    zX509.get_notBeforezCallable[..., Any])r]  rQ   r<   c                 C  s   t || jƒ|ƒS r@   )rV   rå   )rf   r]  rQ   r8   r8   r9   Ú_set_boundary_timeû  s    zX509._set_boundary_timerW   c                 C  s   |   tj|¡S )zî
        Set the timestamp at which the certificate starts being valid.

        The timestamp is formatted as an ASN.1 TIME::

            YYYYMMDDhhmmssZ

        :param bytes when: A timestamp string.
        :return: ``None``
        )r`  rA   rP  ©rf   rQ   r8   r8   r9   Úset_notBefore   s    zX509.set_notBeforec                 C  s   |   tj¡S )a	  
        Get the timestamp at which the certificate stops being valid.

        The timestamp is formatted as an ASN.1 TIME::

            YYYYMMDDhhmmssZ

        :return: A timestamp string, or ``None`` if there is none.
        :rtype: bytes or NoneType
        )r^  rA   rM  re   r8   r8   r9   rS    s    zX509.get_notAfterc                 C  s   |   tj|¡S )zí
        Set the timestamp at which the certificate stops being valid.

        The timestamp is formatted as an ASN.1 TIME::

            YYYYMMDDhhmmssZ

        :param bytes when: A timestamp string.
        :return: ``None``
        )r`  rA   rM  ra  r8   r8   r9   Úset_notAfter  s    zX509.set_notAfterr!   c                 C  s0   t  t ¡}|| jƒ|_t|jtjkƒ | |_|S r@   )r!   r  rå   rm   rG   rD   rH   r  )rf   r]  ri   r8   r8   r9   Ú	_get_name'  s
    
zX509._get_name)r]  ri   r<   c                 C  s0   t |tƒstdƒ‚|| j|jƒ}t|dkƒ d S )Nzname must be an X509Namer�   )rR   r!   rS   rå   rm   rG   )rf   r]  ri   rU   r8   r8   r9   Ú	_set_name2  s    
zX509._set_namec                 C  s   |   tj¡}| j |¡ |S )a¥  
        Return the issuer of this certificate.

        This creates a new :class:`X509Name` that wraps the underlying issuer
        name field on the certificate. Modifying it will modify the underlying
        certificate, and will have the effect of modifying any other
        :class:`X509Name` that refers to this issuer.

        :return: The issuer of this certificate.
        :rtype: :class:`X509Name`
        )rd  rA   ZX509_get_issuer_namer6  rl   rk   r8   r8   r9   Ú
get_issuer8  s    zX509.get_issuer)rä   r<   c                 C  s   |   tj|¡ | j ¡  dS )zŸ
        Set the issuer of this certificate.

        :param issuer: The issuer.
        :type issuer: :py:class:`X509Name`

        :return: ``None``
        N)re  rA   ZX509_set_issuer_namer6  rn   )rf   rä   r8   r8   r9   Ú
set_issuerH  s    	zX509.set_issuerc                 C  s   |   tj¡}| j |¡ |S )a©  
        Return the subject of this certificate.

        This creates a new :class:`X509Name` that wraps the underlying subject
        name field on the certificate. Modifying it will modify the underlying
        certificate, and will have the effect of modifying any other
        :class:`X509Name` that refers to this subject.

        :return: The subject of this certificate.
        :rtype: :class:`X509Name`
        )rd  rA   ZX509_get_subject_namer7  rl   rk   r8   r8   r9   r  T  s    zX509.get_subject)rã   r<   c                 C  s   |   tj|¡ | j ¡  dS )z£
        Set the subject of this certificate.

        :param subject: The subject.
        :type subject: :py:class:`X509Name`

        :return: ``None``
        N)re  rA   ZX509_set_subject_namer7  rn   )rf   rã   r8   r8   r9   Úset_subjectd  s    	zX509.set_subjectc                 C  s   t  | j¡S )z¯
        Get the number of extensions on this certificate.

        :return: The number of extensions.
        :rtype: :py:class:`int`

        .. versionadded:: 0.12
        )rA   ZX509_get_ext_countrå   re   r8   r8   r9   Úget_extension_countp  s    	zX509.get_extension_countr  r  c                 C  sN   t jdtdd� |D ]4}t|tƒs*tdƒ‚t | j|j	d¡}t
|dkƒ qdS )zÍ
        Add extensions to the certificate.

        :param extensions: The extensions to add.
        :type extensions: An iterable of :py:class:`X509Extension` objects.
        :return: ``None``
        r  r  r  r  rÃ   r�   N)r  r   r!  rR   r"  rT   rA   ZX509_add_extrå   rç   rG   )rf   r  r$  rÒ   r8   r8   r9   r%  {  s    
ù

zX509.add_extensionsr"  )Úindexr<   c                 C  s^   t jdtdd� t t¡}t | j|¡|_|jt	j
kr>tdƒ‚t |j¡}t	 |tj¡|_|S )aÏ  
        Get a specific extension of the certificate by index.

        Extensions on a certificate are kept in order. The index
        parameter selects which extension will be returned.

        :param int index: The index of the extension to retrieve.
        :return: The extension at the specified index.
        :rtype: :py:class:`X509Extension`
        :raises IndexError: If the extension index was out of bounds.

        .. versionadded:: 0.12
        r  r  r  zextension index out of bounds)r  r   r!  r"  r  rA   ZX509_get_extrå   rç   rD   rH   Ú
IndexErrorr)  rI   ræ   )rf   rj  r$  ré   r8   r8   r9   Úget_extension–  s    ù

zX509.get_extensionN)%r4   r5   r6   r7   rg   r�   r9  r  r  r  r  r  r  r2  r<  r-  rB  rH  rJ  rO  rQ  r\  r^  r_  r`  rb  rS  rc  rd  re  rf  rg  r  rh  ri  r%  rl  r8   r8   r8   r9   r   Ì  sF   		c                   @  sž   e Zd ZU dZejZded< ejZ	ded< ej
Zded< ejZded< ejZded< ejZded< ejZded	< ejZded
< ejZded< ejZded< dS )r&   a  
    Flags for X509 verification, used to change the behavior of
    :class:`X509Store`.

    See `OpenSSL Verification Flags`_ for details.

    .. _OpenSSL Verification Flags:
        https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html
    r1   Ú	CRL_CHECKÚCRL_CHECK_ALLÚIGNORE_CRITICALÚX509_STRICTÚALLOW_PROXY_CERTSÚPOLICY_CHECKÚEXPLICIT_POLICYÚINHIBIT_MAPÚCHECK_SS_SIGNATUREÚPARTIAL_CHAINN)r4   r5   r6   r7   rA   ZX509_V_FLAG_CRL_CHECKrm  r   ZX509_V_FLAG_CRL_CHECK_ALLrn  ZX509_V_FLAG_IGNORE_CRITICALro  ZX509_V_FLAG_X509_STRICTrp  ZX509_V_FLAG_ALLOW_PROXY_CERTSrq  ZX509_V_FLAG_POLICY_CHECKrr  ZX509_V_FLAG_EXPLICIT_POLICYrs  ZX509_V_FLAG_INHIBIT_MAPrt  ZX509_V_FLAG_CHECK_SS_SIGNATUREru  ZX509_V_FLAG_PARTIAL_CHAINrv  r8   r8   r8   r9   r&   ¸  s   

c                   @  sr   e Zd ZdZddœdd„Zdddœdd	„Zd
ddœdd„Zdddœdd„Zdddœdd„Zdddddœdd„Z	dS )r#   aº  
    An X.509 store.

    An X.509 store is used to describe a context in which to verify a
    certificate. A description of a context may include a set of certificates
    to trust, a set of certificate revocation lists, verification flags and
    more.

    An X.509 store, being only a description, cannot be used by itself to
    verify a certificate. To carry out the actual verification process, see
    :class:`X509StoreContext`.
    rO   rc   c                 C  s   t  ¡ }t |t j¡| _d S r@   )rA   ZX509_STORE_newrD   rI   ZX509_STORE_freeÚ_store©rf   Ústorer8   r8   r9   rg   Ý  s    zX509Store.__init__r   )r8  r<   c                 C  s0   t |tƒstƒ ‚t | j|j¡}t|dkƒ dS )aÔ  
        Adds a trusted certificate to this store.

        Adding a certificate with this method adds this certificate as a
        *trusted* certificate.

        :param X509 cert: The certificate to add to this store.

        :raises TypeError: If the certificate is not an :class:`X509`.

        :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your
            certificate.

        :return: ``None`` if the certificate was added successfully.
        r�   N)rR   r   rS   rA   ZX509_STORE_add_certrw  rå   rG   )rf   r8  r”   r8   r8   r9   Úadd_certá  s    
zX509Store.add_certzx509.CertificateRevocationList)Úcrlr<   c                 C  sv   t |tjƒrTddlm} t| |j¡ƒ}t 	|t
j¡}t|t
jkƒ t
 |tj¡}ntdƒ‚tt | j|¡dkƒ dS )aþ  
        Add a certificate revocation list to this store.

        The certificate revocation lists added to a store will only be used if
        the associated flags are configured to check certificate revocation
        lists.

        .. versionadded:: 16.1.0

        :param crl: The certificate revocation list to add to this store.
        :type crl: ``cryptography.x509.CertificateRevocationList``
        :return: ``None`` if the certificate revocation list was added
            successfully.
        r   r
  z?CRL must be of type cryptography.x509.CertificateRevocationListN)rR   r   ZCertificateRevocationListrw   r|   rK   rŠ   r‹   rA   Zd2i_X509_CRL_biorD   rH   rG   rI   ZX509_CRL_freerS   ZX509_STORE_add_crlrw  )rf   r{  r|   r>   Zopenssl_crlr8   r8   r9   Úadd_crl÷  s    ÿzX509Store.add_crlr1   )Úflagsr<   c                 C  s   t t | j|¡dkƒ dS )aÒ  
        Set verification flags to this store.

        Verification flags can be combined by oring them together.

        .. note::

          Setting a verification flag sometimes requires clients to add
          additional information to the store, otherwise a suitable error will
          be raised.

          For example, in setting flags to enable CRL checking a
          suitable CRL must be added to the store otherwise an error will be
          raised.

        .. versionadded:: 16.1.0

        :param int flags: The verification flags to set on this store.
            See :class:`X509StoreFlags` for available constants.
        :return: ``None`` if the verification flags were successfully set.
        r   N)rG   rA   ZX509_STORE_set_flagsrw  )rf   r}  r8   r8   r9   Ú	set_flags  s    zX509Store.set_flagszdatetime.datetime)Úvfy_timer<   c                 C  sF   t  ¡ }t |t j¡}t  |t | ¡ ¡¡ t	t  
| j|¡dkƒ dS )a¤  
        Set the time against which the certificates are verified.

        Normally the current time is used.

        .. note::

          For example, you can determine if a certificate was valid at a given
          time.

        .. versionadded:: 17.0.0

        :param datetime vfy_time: The verification time to set on this store.
        :return: ``None`` if the verification time was successfully set.
        r   N)rA   ZX509_VERIFY_PARAM_newrD   rI   ZX509_VERIFY_PARAM_freeZX509_VERIFY_PARAM_set_timeÚcalendarÚtimegmÚ	timetuplerG   ZX509_STORE_set1_paramrw  )rf   r  Úparamr8   r8   r9   Úset_time-  s     ÿzX509Store.set_timeNÚStrOrBytesPathzStrOrBytesPath | None)ÚcafileÚcapathr<   c                 C  sN   |dkrt j}nt|ƒ}|dkr(t j}nt|ƒ}t | j||¡}|sJtƒ  dS )aˆ  
        Let X509Store know where we can find trusted certificates for the
        certificate chain.  Note that the certificates have to be in PEM
        format.

        If *capath* is passed, it must be a directory prepared using the
        ``c_rehash`` tool included with OpenSSL.  Either, but not both, of
        *cafile* or *capath* may be ``None``.

        .. note::

          Both *cafile* and *capath* may be set simultaneously.

          Call this method multiple times to add more than one location.
          For example, CA certificates, and certificate revocation list bundles
          may be passed in *cafile* in subsequent calls to this method.

        .. versionadded:: 20.0

        :param cafile: In which file we can find the certificates (``bytes`` or
                       ``unicode``).
        :param capath: In which directory we can find the certificates
                       (``bytes`` or ``unicode``).

        :return: ``None`` if the locations were set successfully.

        :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None``
            or the locations could not be set for any reason.

        N)rD   rH   Ú_path_bytesrA   ZX509_STORE_load_locationsrw  rš   )rf   r†  r‡  Zload_resultr8   r8   r9   Úload_locationsE  s    !  ÿzX509Store.load_locations)N)
r4   r5   r6   r7   rg   rz  r|  r~  r„  r‰  r8   r8   r8   r9   r#   Ï  s    ÿc                      s,   e Zd ZdZdddddœ‡ fdd„Z‡  ZS )	r%   zù
    An exception raised when an error occurred while verifying a certificate
    using `OpenSSL.X509StoreContext.verify_certificate`.

    :ivar certificate: The certificate which caused verificate failure.
    :type certificate: :class:`X509`
    rµ   z	list[Any]r   rO   )ÚmessageÚerrorsÚcertificater<   c                   s   t ƒ  |¡ || _|| _d S r@   )r¡   rg   r‹  rŒ  )rf   rŠ  r‹  rŒ  r¥   r8   r9   rg   €  s    zX509StoreContextError.__init__)r4   r5   r6   r7   rg   r¼   r8   r8   r¥   r9   r%   w  s   c                   @  sˆ   e Zd ZdZddddddœdd	„Zeddd
œdd„ƒZedddœdd„ƒZddœdd„Zdddœdd„Z	ddœdd„Z
ddœdd„ZdS )r$   a9  
    An X.509 store context.

    An X.509 store context is used to carry out the actual verification process
    of a certificate in a described context. For describing such a context, see
    :class:`X509Store`.

    :param X509Store store: The certificates which will be trusted for the
        purposes of any verifications.
    :param X509 certificate: The certificate to be verified.
    :param chain: List of untrusted certificates that may be used for building
        the certificate chain. May be ``None``.
    :type chain: :class:`list` of :class:`X509`
    Nr#   r   zSequence[X509] | NonerO   )ry  rŒ  Úchainr<   c                 C  s   || _ || _|  |¡| _d S r@   )rw  Ú_certÚ_build_certificate_stackÚ_chain)rf   ry  rŒ  r�  r8   r8   r9   rg   ˜  s    zX509StoreContext.__init__)Úcertificatesr<   c                 C  s¤   dddœdd„}| d ks$t | ƒdkr*tjS t ¡ }t|tjkƒ t ||¡}| D ]N}t|tƒsft	dƒ‚tt 
|j¡dkƒ t ||j¡dkrPt |j¡ tƒ  qP|S )Nr   rO   )Úsr<   c                 S  s8   t t | ¡ƒD ]}t | |¡}t |¡ qt | ¡ d S r@   )rÊ   rA   Úsk_X509_numÚsk_X509_valuer5  Úsk_X509_free)r’  rÐ   r'  r8   r8   r9   Úcleanup¦  s    z:X509StoreContext._build_certificate_stack.<locals>.cleanupr   z+One of the elements is not an X509 instance)rF   rD   rH   rA   Zsk_X509_new_nullrG   rI   rR   r   rS   ZX509_up_refrå   Zsk_X509_pushr5  rš   )r‘  r–  r#  r8  r8   r8   r9   r�  ¢  s    
z)X509StoreContext._build_certificate_stackr   r%   )Ú	store_ctxr<   c                 C  s\   t  t t | ¡¡¡ d¡}t | ¡t | ¡|g}t | ¡}t |¡}t	 
|¡}t|||ƒS )zú
        Convert an OpenSSL native context error failure into a Python
        exception.

        When a call to native OpenSSL X509_verify_cert fails, additional
        information about the failure can be obtained from the store context.
        rÂ   )rD   r^   rA   ZX509_verify_cert_error_stringZX509_STORE_CTX_get_errorr´   ZX509_STORE_CTX_get_error_depthZX509_STORE_CTX_get_current_certZX509_dupr   r9  r%   )r—  rŠ  r‹  rå   rŽ  Úpycertr8   r8   r9   Ú_exception_from_contextÀ  s    	ÿÿüý


z(X509StoreContext._exception_from_contextrc   c                 C  sj   t  ¡ }t|tjkƒ t |t j¡}t  || jj| j	j
| j¡}t|dkƒ t  |¡}|dkrf|  |¡‚|S )a3  
        Verifies the certificate and runs an X509_STORE_CTX containing the
        results.

        :raises X509StoreContextError: If an error occurred when validating a
          certificate in the context. Sets ``certificate`` attribute to
          indicate which certificate caused the error.
        r�   r   )rA   ZX509_STORE_CTX_newrG   rD   rH   rI   ZX509_STORE_CTX_freeZX509_STORE_CTX_initrw  rŽ  rå   r�  ZX509_verify_certr™  )rf   r—  rX   r8   r8   r9   Ú_verify_certificateÚ  s    	   ÿ

z$X509StoreContext._verify_certificate)ry  r<   c                 C  s
   || _ dS )zÖ
        Set the context's X.509 store.

        .. versionadded:: 0.15

        :param X509Store store: The store description which will be used for
            the purposes of any *future* verifications.
        N)rw  rx  r8   r8   r9   Ú	set_storeò  s    	zX509StoreContext.set_storec                 C  s   |   ¡  dS )a"  
        Verify a certificate in a context.

        .. versionadded:: 0.15

        :raises X509StoreContextError: If an error occurred when validating a
          certificate in the context. Sets ``certificate`` attribute to
          indicate which certificate caused the error.
        N)rš  re   r8   r8   r9   Úverify_certificateý  s    
z#X509StoreContext.verify_certificatez
list[X509]c                 C  st   |   ¡ }t |¡}t|tjkƒ g }tt |¡ƒD ]2}t ||¡}t|tjkƒ t	 
|¡}| |¡ q2t |¡ |S )aR  
        Verify a certificate in a context and return the complete validated
        chain.

        :raises X509StoreContextError: If an error occurred when validating a
          certificate in the context. Sets ``certificate`` attribute to
          indicate which certificate caused the error.

        .. versionadded:: 20.0
        )rš  rA   ZX509_STORE_CTX_get1_chainrG   rD   rH   rÊ   r“  r”  r   r9  rj   r•  )rf   r—  Z
cert_stackr“   rÐ   r8  r˜  r8   r8   r9   Úget_verified_chain	  s    


z#X509StoreContext.get_verified_chain)N)r4   r5   r6   r7   rg   Ústaticmethodr�  r™  rš  r›  rœ  r�  r8   r8   r8   r9   r$   ˆ  s    ü
)rŽ   r;   r<   c                 C  sv   t |tƒr| d¡}t|ƒ}| tkr<t |tjtjtj¡}n | t	krTt 
|tj¡}ntdƒ‚|tjkrltƒ  t |¡S )a  
    Load a certificate (X509) from the string *buffer* encoded with the
    type *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)

    :param bytes buffer: The buffer the certificate is stored in

    :return: The X509 object
    r²   ú3type argument must be FILETYPE_PEM or FILETYPE_ASN1)rR   rµ   rÏ   rK   r   rA   ZPEM_read_bio_X509rD   rH   r   Zd2i_X509_biorT   rš   r   r9  )rŽ   r;   r>   r   r8   r8   r9   r-   &  s    


)rŽ   r8  r<   c                 C  sn   t ƒ }| tkrt ||j¡}n<| tkr6t ||j¡}n$| tkrRt ||jdd¡}nt	dƒ‚t
|dkƒ t|ƒS )a  
    Dump the certificate *cert* into a buffer string encoded with the type
    *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1, or
        FILETYPE_TEXT)
    :param cert: The certificate to dump
    :return: The buffer with the dumped certificate in
    r   úCtype argument must be FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXTr�   )rK   r   rA   ZPEM_write_bio_X509rå   r   Zi2d_X509_bior   ZX509_print_exrT   rG   rN   )rŽ   r8  r>   Úresult_coder8   r8   r9   r'   C  s    
ÿ)rŽ   rs   r<   c                 C  sP   t ƒ }| tkrtj}n| tkr&tj}ntdƒ‚|||jƒ}|dkrHtƒ  t	|ƒS )zú
    Dump a public key to a buffer.

    :param type: The file type (one of :data:`FILETYPE_PEM` or
        :data:`FILETYPE_ASN1`).
    :param PKey pkey: The public key to dump
    :return: The buffer with the dumped key in it.
    :rtype: bytes
    rŸ  r�   )
rK   r   rA   ZPEM_write_bio_PUBKEYr   Zi2d_PUBKEY_biorT   rp   rš   rN   )rŽ   rs   r>   Z	write_bior¡  r8   r8   r9   r*   _  s    
rÓ   úPassphraseCallableT | None)rŽ   rs   ÚcipherÚ
passphraser<   c           	   	   C  s  t ƒ }t|tƒstdƒ‚|dk	rR|dkr0tdƒ‚t t|ƒ¡}|tjkrXt	dƒ‚ntj}t
| |ƒ}| tkr’t ||j|tjd|j|j¡}| ¡  nh| tkrªt ||j¡}nP| tkròt |j¡tjkrÌtdƒ‚t t |j¡tj¡}t ||d¡}nt	dƒ‚t|dkƒ t|ƒS )a…  
    Dump the private key *pkey* into a buffer string encoded with the type
    *type*.  Optionally (if *type* is :const:`FILETYPE_PEM`) encrypting it
    using *cipher* and *passphrase*.

    :param type: The file type (one of :const:`FILETYPE_PEM`,
        :const:`FILETYPE_ASN1`, or :const:`FILETYPE_TEXT`)
    :param PKey pkey: The PKey to dump
    :param cipher: (optional) if encrypted PEM format, the cipher to use
    :param passphrase: (optional) if encrypted PEM format, this can be either
        the passphrase to use, or a callback for providing the passphrase.

    :return: The buffer with the dumped key in
    :rtype: bytes
    zpkey must be a PKeyNzDif a value is given for cipher one must also be given for passphrasezInvalid cipher namer   z-Only RSA keys are supported for FILETYPE_TEXTr   )rK   rR   r   rS   rA   ZEVP_get_cipherbynamerÇ   rD   rH   rT   Ú_PassphraseHelperr   ZPEM_write_bio_PrivateKeyrp   ÚcallbackÚcallback_argsÚraise_if_problemr   Zi2d_PrivateKey_bior   rœ   r—   rI   r˜   r™   Z	RSA_printrG   rN   )	rŽ   rs   r£  r¤  r>   Z
cipher_objÚhelperr¡  r   r8   r8   r9   r)   x  sH    
ÿ


ù	
ÿc                   @  sr   e Zd Zdddddddœdd„Zed	d
œdd„ƒZed	d
œdd„ƒZefdddœdd„Zd	dd	d	ddœdd„Z	dS )r¥  Fr1   r¢  r–   rO   )rŽ   r¤  Ú	more_argsÚtruncater<   c                 C  s4   |t kr|d k	rtdƒ‚|| _|| _|| _g | _d S )Nz0only FILETYPE_PEM key format supports encryption)r   rT   Ú_passphraseÚ
_more_argsÚ	_truncateÚ	_problems)rf   rŽ   r¤  rª  r«  r8   r8   r9   rg   ¾  s    ÿz_PassphraseHelper.__init__r   rc   c                 C  s@   | j d krtjS t| j tƒs&t| j ƒr4t d| j¡S tdƒ‚d S )NZpem_password_cbú2Last argument must be a byte string or a callable.)	r¬  rD   rH   rR   rL   Úcallabler¦  Ú_read_passphraserS   re   r8   r8   r9   r¦  Î  s    
ÿz_PassphraseHelper.callbackc                 C  s8   | j d krtjS t| j tƒs&t| j ƒr,tjS tdƒ‚d S )Nr°  )r¬  rD   rH   rR   rL   r±  rS   re   r8   r8   r9   r§  Ù  s    
ÿz_PassphraseHelper.callback_argsztype[Exception])ÚexceptionTyper<   c                 C  s8   | j r4zt|ƒ W n |k
r&   Y nX | j  d¡‚d S rÙ   )r¯  Ú_exception_from_error_queueÚpop)rf   r³  r8   r8   r9   r¨  ä  s    z"_PassphraseHelper.raise_if_problem)rû   ÚsizeÚrwflagÚuserdatar<   c              
   C  sä   zªt | jƒr.| jr"|  |||¡}qB|  |¡}n| jd k	s<t‚| j}t|tƒsTtdƒ‚t|ƒ|kr|| jrt|d |… }ntdƒ‚t	t|ƒƒD ]}|||d … ||< qˆt|ƒW S  t
k
rÞ } z| j |¡ W Y ¢dS d }~X Y nX d S )NzBytes expectedz+passphrase returned by callback is too longr�   r   )r±  r¬  r­  ÚAssertionErrorrR   rL   rT   rF   r®  rÊ   Ú	Exceptionr¯  rj   )rf   rû   r¶  r·  r¸  r“   rÐ   Úer8   r8   r9   r²  î  s*    

ÿ
z"_PassphraseHelper._read_passphraseN)FF)
r4   r5   r6   rg   rÿ   r¦  r§  r   r¨  r²  r8   r8   r8   r9   r¥  ½  s     û


r¥  zstr | bytesc                 C  s�   t |tƒr| d¡}t|ƒ}| tkr<t |tjtjtj¡}n | t	krTt 
|tj¡}ntdƒ‚|tjkrltƒ  t t¡}t |tj¡|_d|_|S )a<  
    Load a public key from a buffer.

    :param type: The file type (one of :data:`FILETYPE_PEM`,
        :data:`FILETYPE_ASN1`).
    :param buffer: The buffer the key is stored in.
    :type buffer: A Python string object, either unicode or bytestring.
    :return: The PKey object.
    :rtype: :class:`PKey`
    r²   rŸ  T)rR   rµ   rÏ   rK   r   rA   ZPEM_read_bio_PUBKEYrD   rH   r   Zd2i_PUBKEY_biorT   rš   r   r  rI   ro   rp   rx   )rŽ   r;   r>   Úevp_pkeyrs   r8   r8   r9   r0   	  s&    

   ÿ

)rŽ   r;   r¤  r<   c                 C  sœ   t |tƒr| d¡}t|ƒ}t| |ƒ}| tkrNt |tj	|j
|j¡}| ¡  n | tkrft |tj	¡}ntdƒ‚|tj	kr~tƒ  t t¡}t |tj¡|_|S )a³  
    Load a private key (PKey) from the string *buffer* encoded with the type
    *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)
    :param buffer: The buffer the key is stored in
    :param passphrase: (optional) if encrypted PEM format, this can be
                       either the passphrase to use, or a callback for
                       providing the passphrase.

    :return: The PKey object
    r²   rŸ  )rR   rµ   rÏ   rK   r¥  r   rA   ZPEM_read_bio_PrivateKeyrD   rH   r¦  r§  r¨  r   Zd2i_PrivateKey_biorT   rš   r   r  rI   ro   rp   )rŽ   r;   r¤  r>   r©  r¼  rs   r8   r8   r9   r/   -	  s(    


   ÿ


)rŽ   r  r<   c                 C  sn   t ƒ }| tkrt ||j¡}n<| tkr6t ||j¡}n$| tkrRt ||jdd¡}nt	dƒ‚t
|dkƒ t|ƒS )av  
    Dump the certificate request *req* into a buffer string encoded with the
    type *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)
    :param req: The certificate request to dump
    :return: The buffer with the dumped certificate request in


    .. deprecated:: 24.2.0
       Use `cryptography.x509.CertificateSigningRequest` instead.
    r   r   )rK   r   rA   ZPEM_write_bio_X509_REQr  r   Zi2d_X509_REQ_bior   ZX509_REQ_print_exrT   rG   rN   )rŽ   r  r>   r¡  r8   r8   r9   r(   V	  s    ÿc                 C  sˆ   t |tƒr| d¡}t|ƒ}| tkr<t |tjtjtj¡}n | t	krTt 
|tj¡}ntdƒ‚t|tjkƒ t t¡}t |tj¡|_|S )a—  
    Load a certificate request (X509Req) from the string *buffer* encoded with
    the type *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)
    :param buffer: The buffer the certificate request is stored in
    :return: The X509Req object

    .. deprecated:: 24.2.0
       Use `cryptography.x509.load_der_x509_csr` or
       `cryptography.x509.load_pem_x509_csr` instead.
    r²   rŸ  )rR   rµ   rÏ   rK   r   rA   ZPEM_read_bio_X509_REQrD   rH   r   Zd2i_X509_REQ_biorT   rG   Ú_X509ReqInternalr  rI   r  r  )rŽ   r;   r>   r  Zx509reqr8   r8   r9   r.   „	  s    


)N)NN)N)pÚ
__future__r   r€  rT  Ú	functoolsÚtypingr  Úbase64r   Úcollections.abcr   r   r   Úosr   r   r	   r
   Zcryptographyr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r   r   r   ZOpenSSL._utilr   rÇ   r   r´  r   rD   r   rA   r   Z_make_assertr   rˆ  Ú__all__r€   r‚   r„   r†   rˆ   Z_PrivateKeyr�   rƒ   r…   r‡   r‰   Z
_PublicKeyrt   rµ   rL   r…  ZPassphraseCallableTZSSL_FILETYPE_PEMr   r   ZSSL_FILETYPE_ASN1r   r   r—   r   ZEVP_PKEY_DSAr   ZEVP_PKEY_DHr2   ZEVP_PKEY_ECr3   rº  r   rš   rG   rK   rN   rV   rY   ra   rb   r   rž   r,   r½   Ú
deprecatedr4   r!  r+   Útotal_orderingr!   r    r"  r"   r½  r   r&   r#   r%   r$   r-   r'   r*   r)   r¥  r0   r/   r(   r  r.   r  r8   r8   r8   r9   Ú<module>   sB   çüÿüÿ
	 Bgøø C +ø uø   o )   üEN% ý) ø ø