U c6{i)7@s^UddlmZddlZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z ddlm Z ddlmZmZmZejdkrddlmZn4ejd kred Zd d d dddZn ddlmZddlmZmZddlmZmZmZmZmZddlm Z ddlm!Z"ddlm#Z$ddlm%Z&ddlm'Z(ddlm)Z*ddlm+Z,ddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2gZ-eej.ej/ej0ej1ej2fZ3eej4ej5ej6ej7ej8fZ9ee3e9fZ:ee;ed3e;ffZd4e?d<e(j@ZAd4e?d<d5ZBe(jCZDd4e?d<e(jEZFd4e?d<e(jGZHd4e?d6<e(jIZJd4e?d7<Gd8d d eKZLe e$eLZMe*eLZNdvd9d:d;dd?d@dAZPd:d>dBdCdDdEZQd>d:dFdGdHZRd:d9dIdJdKZSGdLdMdMZTGdNd!d!ZUGdOdPdPZVedQdRdSdTd.ZWedUd dPdVdWd-ZXejYGdXd#d#ZZedYGdZd"d"Z[ed[Gd\d$d$Z\Gd]ddZ]Gd^d(d(Z^Gd_d%d%Z_Gd`d'd'eKZ`Gdad&d&Zad4d>ddbdcd/Zbd4dd>ddded)Zcd4d!d>dfdgd,Zddwd4d!dhdid>djdkd+ZeGdldmdmZfd4dnd!dbdod2Zgdxd4dndid!dpdqd1Zhd4d$d>drdsd*ZieiZjejeiekd[eld*dtd4d>d$dbdud0ZmemZnejemekd[eld0dtdS)y) annotationsN) b16encode)IterableSequence)partial)AnyCallableUnion) ) deprecated)r TstrobjectzCallable[[_T], _T])msgkwargsreturncKsddS)NcSs|SN)frr2/tmp/pip-unpacked-wheel-41p89xha/OpenSSL/crypto.pyzdeprecated..r)rrrrrr sr )utilsx509)dsaeced448ed25519rsa)StrOrBytesPath) byte_string)exception_from_error_queue)ffi)lib) make_assert) path_bytes FILETYPE_ASN1 FILETYPE_PEM FILETYPE_TEXTTYPE_DSATYPE_RSAX509ErrorPKey X509ExtensionX509NameX509Req X509StoreX509StoreContextX509StoreContextErrorX509StoreFlagsdump_certificatedump_certificate_requestdump_privatekeydump_publickeyget_elliptic_curveget_elliptic_curvesload_certificateload_certificate_requestload_privatekeyload_publickey.intiTYPE_DHTYPE_ECc@seZdZdZdS)r.z7 An error occurred in an `OpenSSL.crypto` API. N)__name__ __module__ __qualname____doc__rrrrr.ts bytes | Noner)bufferrcCsn|dkrtt}tj}n2td|}t|t|}|fdddddd}t|tj kt ||}|S)z Allocate a new OpenSSL memory BIO. Arrange for the garbage collector to clean it up automatically. :param buffer: None or some bytes to use to put into the BIO so that they can be read out. Nchar[]r)biorefrcSs t|Sr)_libBIO_free)rKrLrrrfreesz_new_mem_buf..free) rMZBIO_newZ BIO_s_memrN_ffinewZBIO_new_mem_buflen_openssl_assertNULLgc)rIrKrOdatarrr _new_mem_buf~s   rWbytes)rKrcCs.td}t||}t|d|ddS)zO Copy the contents of an OpenSSL BIO object into a Python byte string. zchar**rN)rPrQrMZBIO_get_mem_datarI)rK result_bufferZ buffer_lengthrrr_bio_to_strings  rZNone)boundarywhenrcCs@t|tstdt|tjkt||}|dkrtt|Std}t ||t |dtj ktd|d}t|}t|}t |d|SdS)a] Retrieve the time value of an ASN1 time object. @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to that type) from which the time value will be retrieved. @return: The time value from C{timestamp} as a L{bytes} string in a certain format. Or C{None} if the object contains no time value. ASN1_STRING*rNzASN1_GENERALIZEDTIME**) rPcastrMASN1_STRING_lengthZASN1_STRING_typeZV_ASN1_GENERALIZEDTIMEstringASN1_STRING_get0_datarQZASN1_TIME_to_generalizedtimerSrTZASN1_GENERALIZEDTIME_free)rfZstring_timestampZgeneralized_timestampZ string_data string_resultrrr_get_asn1_times     rmc@s8eZdZddddZdddddZddd d Zd S) _X509NameInvalidatorr[rcCs g|_dSr)_namesselfrrr__init__sz_X509NameInvalidator.__init__r1namercCs|j|dSr)rpappendrrrurrraddsz_X509NameInvalidator.addcCs|jD]}|`qdSr)rp_namerwrrrclears z_X509NameInvalidator.clearN)rDrErFrsrxrzrrrrrnsrnc@seZdZdZdZdZddddZddd d Zeddd d d Z ddddddZ ddddZ ddddZ ddddZ dS)r/zD A class representing an DSA or RSA public key or key pair. FTr[rocCs"t}t|tj|_d|_dS)NF)rMZ EVP_PKEY_newrPrU EVP_PKEY_free_pkey _initializedrrpkeyrrrrssz PKey.__init___KeycCsRddlm}m}|jr0tt|}tt||St t|}tt||ddSdS)a Export as a ``cryptography`` key. :rtype: One of ``cryptography``'s `key interfaces`_. .. _key interfaces: https://cryptography.io/en/latest/hazmat/ primitives/asymmetric/rsa/#key-interfaces .. versionadded:: 16.1.0 r)load_der_private_keyload_der_public_keyN)password) ,cryptography.hazmat.primitives.serializationrr _only_publicr:r(typingrhrr9)rrrrderrrrto_cryptography_keys   zPKey.to_cryptography_key) crypto_keyrc Cst|tjtjtjtjtjtj t j t j t jt jf s:tdddlm}m}m}m}t|tjtjtj t j t jfrtt||j|jS||j|j|}tt|SdS)z Construct based on a ``cryptography`` *crypto_key*. :param crypto_key: A ``cryptography`` key. :type crypto_key: One of ``cryptography``'s `key interfaces`_. :rtype: PKey .. versionadded:: 16.1.0 zUnsupported key typer)Encoding NoEncryption PrivateFormat PublicFormatN)r^r DSAPrivateKey DSAPublicKeyrEllipticCurvePrivateKeyEllipticCurvePublicKeyrEd25519PrivateKeyEd25519PublicKeyrEd448PrivateKeyEd448PublicKeyr RSAPrivateKey RSAPublicKeyr_rrrrrr@r( public_bytesDERZSubjectPublicKeyInfoZ private_bytesZPKCS8r?)clsrrrrrrrrrfrom_cryptography_keysL  zPKey.from_cryptography_keyrA)typebitsrc Cs6t|tstdt|ts$td|tkr|dkr= 0`` :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't of the appropriate type. :raises ValueError: If the number of bits isn't an integer of the appropriate size. :return: ``None`` ztype must be an integerzbits must be an integerrzInvalid number of bitszNo such key typeTN)r^rAr_r,r`rMZBN_newrPrUBN_freeZ BN_set_wordZRSA_F4ZRSA_newZRSA_generate_key_exrTrSZEVP_PKEY_assign_RSAr|r+ZDSA_newZDSA_freeZDSA_generate_parameters_exZDSA_generate_keyZEVP_PKEY_set1_DSAr.r})rrrrexponentr resultrresrrr generate_keyUsB     zPKey.generate_keyboolcCsd|jrtdt|tjkr*tdt|j}t |tj }t |}|dkrZdSt dS)ax Check the consistency of an RSA private key. This is the Python equivalent of OpenSSL's ``RSA_check_key``. :return: ``True`` if key is consistent. :raise OpenSSL.crypto.Error: if the key is inconsistent. :raise TypeError: if the key is of a type which cannot be checked. Only RSA keys can currently be checked. zpublic key onlyz'Only RSA keys can currently be checked.rTN) rr_rMZ EVP_PKEY_typer EVP_PKEY_RSAEVP_PKEY_get1_RSAr|rPrURSA_freeZ RSA_check_key_raise_current_error)rrr rrrrchecks   z PKey.checkcCs t|jS)zT Returns the type of the key :return: The type of the key. )rM EVP_PKEY_idr|rqrrrrsz PKey.typecCs t|jS)zh Returns the number of bits of the key :return: The number of bits of the key. )rMZ EVP_PKEY_bitsr|rqrrrrsz PKey.bitsN)rDrErFrGrr}rsr classmethodrrrrrrrrrr/s98cseZdZdZdZdddfdd Zeddd d d Zeddd d d ZeddddddZ dddddddZ ddddZ ddddZ Z S)_EllipticCurveaZ A representation of a supported elliptic curve. @cvar _curves: :py:obj:`None` until an attempt is made to load the curves. Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve` instances each of which represents one curve supported by the system. @type _curves: :py:type:`NoneType` or :py:type:`set` Nrrotherrcst|trt|StS)z Implement cooperation with the right-hand side argument of ``!=``. Python 3 seems to have dropped this cooperation in this very narrow circumstance. )r^rsuper__ne__NotImplementedrrr __class__rrrs  z_EllipticCurve.__ne__set[_EllipticCurve])r%rcs>tjd}td|}||tfdd|DS)z Get the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. rzEC_builtin_curve[]c3s|]}|jVqdSr)from_nidnid).0crr%rr sz7_EllipticCurve._load_elliptic_curves..)ZEC_get_builtin_curvesrPrTrQset)rr%Z num_curvesZbuiltin_curvesrrr_load_elliptic_curvess   z$_EllipticCurve._load_elliptic_curvescCs|jdkr|||_|jS)a Get, cache, and return the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. N)_curvesrrrrr_get_elliptic_curvess  z#_EllipticCurve._get_elliptic_curvesrA)r%rrcCs|||t||dS)a Instantiate a new :py:class:`_EllipticCurve` associated with the given OpenSSL NID. :param lib: The OpenSSL library binding object. :param nid: The OpenSSL NID the resulting curve object will represent. This must be a curve NID (and not, for example, a hash NID) or subsequent operations will fail in unpredictable ways. :type nid: :py:class:`int` :return: The curve object. ascii)rPrj OBJ_nid2sndecode)rr%rrrrrsz_EllipticCurve.from_nidrr[)r%rrurcCs||_||_||_dS)a :param _lib: The :py:mod:`cryptography` binding instance used to interface with OpenSSL. :param _nid: The OpenSSL NID identifying the curve this object represents. :type _nid: :py:class:`int` :param name: The OpenSSL short name identifying the curve this object represents. :type name: :py:class:`unicode` N)rM_nidru)rrr%rrurrrrss z_EllipticCurve.__init__rocCsd|jdS)Nzrurqrrr__repr__sz_EllipticCurve.__repr__cCs|j|j}t|tjS)z Create a new OpenSSL EC_KEY structure initialized to use this curve. The structure is automatically garbage collected when the Python object is garbage collected. )rMZEC_KEY_new_by_curve_namerrPrUZ EC_KEY_free)rrkeyrrr _to_EC_KEYsz_EllipticCurve._to_EC_KEY)rDrErFrGrrrrrrrsrr __classcell__rrrrrs   rzSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.rrocCs ttS)a Return a set of objects representing the elliptic curves supported in the OpenSSL build in use. The curve objects have a :py:class:`unicode` ``name`` attribute by which they identify themselves. The curve objects are useful as values for the argument accepted by :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be used for ECDHE key exchange. )rrrMrrrrr<szRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.rtcCs,tD]}|j|kr|Sqtd|dS)aT Return a single curve object selected by name. See :py:func:`get_elliptic_curves` for information about curve objects. :param name: The OpenSSL short name identifying the curve object to retrieve. :type name: :py:class:`unicode` If the named curve is not supported then :py:class:`ValueError` is raised. zunknown curve nameN)r<rur`)ruZcurverrrr;2s   cseZdZdZdddddZddddfd d Zdd dd d ZdddddZdddddZddddZ ddddZ ddddZ ddddZ Z S) r1a An X.509 Distinguished Name. :ivar countryName: The country of the entity. :ivar C: Alias for :py:attr:`countryName`. :ivar stateOrProvinceName: The state or province of the entity. :ivar ST: Alias for :py:attr:`stateOrProvinceName`. :ivar localityName: The locality of the entity. :ivar L: Alias for :py:attr:`localityName`. :ivar organizationName: The organization name of the entity. :ivar O: Alias for :py:attr:`organizationName`. :ivar organizationalUnitName: The organizational unit of the entity. :ivar OU: Alias for :py:attr:`organizationalUnitName` :ivar commonName: The common name of the entity. :ivar CN: Alias for :py:attr:`commonName`. :ivar emailAddress: The e-mail address of the entity. r[rtcCs t|j}t|tj|_dS)z Create a new X509Name, copying the given X509Name instance. :param name: The name to copy. :type name: :py:class:`X509Name` N)rMZ X509_NAME_dupryrPrUZX509_NAME_freerwrrrrsbs zX509Name.__init__rr)ruvaluerc s|drt||St|tk rr) rPrQrMZX509_NAME_onelineryrRrSrTformatrjr)rrrYZ format_resultrrrrs zX509Name.__repr__rAcCs t|jS)a& Return an integer representation of the first four bytes of the MD5 digest of the DER representation of the name. This is the Python equivalent of OpenSSL's ``X509_NAME_hash``. :return: The (integer) hash of this name. :rtype: :py:class:`int` )rMZX509_NAME_hashryrqrrrhashs z X509Name.hashrXcCsNtd}t|j|}t|dkt|d|dd}t|d|S)z Return the DER encoding of this name. :return: The DER encoded form of this name. :rtype: :py:class:`bytes` rrN)rPrQrMZ i2d_X509_NAMEryrSrIr)rrrYZ encode_resultrlrrrrs   z X509Name.derzlist[tuple[bytes, bytes]]c Csg}tt|jD]n}t|j|}t|}t|}t|}t|}t t |t |dd}| t ||fq|S)z Returns the components of this name, as a sequence of 2-tuples. :return: The components of this name. :rtype: :py:class:`list` of ``name, value`` tuples. N)rrMrryrrrrrrPrIrkrirvrj) rrrrrfnameZfvalrrurrrrget_componentss     zX509Name.get_components)rDrErFrGrsrrrrrrrrrrrrrr1Hs '( zZX509Extension support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c@seZdZUdZdddddddddd Zed d d d Zejdej dej diZ de d<dd ddZ dd ddZdd ddZdd ddZdd ddZdS)r0zu An X.509 v3 certificate extension. .. deprecated:: 23.3.0 Use cryptography's X509 APIs instead. NrXrz X509 | Noner[) type_namecriticalrsubjectissuerrcCstd}t|tjtjtjtjdt||dk rRt|tsJtd|j |_ |dk rtt|tsltd|j |_ |rd|}t tj|||}|tjkrt t|tj|_dS)a Initializes an X509 extension. :param type_name: The name of the type of extension_ to create. :type type_name: :py:data:`bytes` :param bool critical: A flag indicating whether this is a critical extension. :param value: The OpenSSL textual representation of the extension's value. :type value: :py:data:`bytes` :param subject: Optional X509 certificate to use as subject. :type subject: :py:class:`X509` :param issuer: Optional X509 certificate to use as issuer. :type issuer: :py:class:`X509` .. _extension: https://www.openssl.org/docs/manmaster/man5/ x509v3_config.html#STANDARD-EXTENSIONS z X509V3_CTX*rNzissuer must be an X509 instancez subject must be an X509 instances critical,)rPrQrMZX509V3_set_ctxrTZX509V3_set_ctx_nodbr^r-r__x509Z issuer_certZ subject_certZX509V3_EXT_nconfrrUX509_EXTENSION_free _extension)rrrrrrrctx extensionrrrrss"     zX509Extension.__init__rrocCstt|jSr)rMrX509_EXTENSION_get_objectrrqrrrr\s zX509Extension._nidemailDNSURIztyping.ClassVar[dict[int, str]] _prefixesrc Cstdt|j}t|tj}g}tt|D]}t ||}z|j |j }Wn:t k rt }t|||t|dYq4Xt|jjj|jjjddd}||d|q4d|S)NzGENERAL_NAMES*r:z, )rPrhrMZX509V3_EXT_d2irrUZGENERAL_NAMES_freerZsk_GENERAL_NAME_numZsk_GENERAL_NAME_valuerrKeyErrorrWZGENERAL_NAME_printrvrZrrIdZia5rVlengthjoin)rrnamespartsrrulabelrKrrrr_subjectAltNameStringhs&    z#X509Extension._subjectAltNameStringcCsFtj|jkr|St}t||jdd}t|dkt| dS)zF :return: a nice text representation of the extension rr) rMZNID_subject_alt_namerrrWZX509V3_EXT_printrrSrZr)rrrKZ print_resultrrr__str__~s   zX509Extension.__str__cCs t|jS)zk Returns the critical field of this X.509 extension. :return: The critical field. )rMZX509_EXTENSION_get_criticalrrqrrr get_criticalszX509Extension.get_criticalcCs<t|j}t|}t|}|tjkr4t|SdSdS)z Returns the short type name of this X.509 extension. The result is a byte string such as :py:const:`b"basicConstraints"`. :return: The short type name. :rtype: :py:data:`bytes` .. versionadded:: 0.12 sUNDEFN)rMrrrrrPrTrj)rrobjrbufrrrget_short_names     zX509Extension.get_short_namecCs@t|j}td|}t|}t|}t||ddS)z Returns the data of the X509 extension, encoded as ASN.1. :return: The ASN.1 encoded data of this X509 extension. :rtype: :py:data:`bytes` .. versionadded:: 0.12 rgN)rMZX509_EXTENSION_get_datarrPrhrkrirI)rrZ octet_resultrlZ char_result result_lengthrrrget_datas    zX509Extension.get_data)NN)rDrErFrGrspropertyrrMZ GEN_EMAILZGEN_DNSZGEN_URIr__annotations__rrrrr rrrrr0 s$  E  zPCSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c@seZdZdZddddZddddZeddd d d Zd dd ddZd dddZ dddddZ ddddZ ddddZ dddddZ ddd d!Zd d"dd#d$d%Zd d&d d'd(Zd)S)*r2z An X.509 certificate signing requests. .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. r[rocCs&t}t|tj|_|ddSr)rMZ X509_REQ_newrPrU X509_REQ_free_req set_version)rrreqrrrrsszX509Req.__init__zx509.CertificateSigningRequestcCsddlm}tt|}||S)z Export as a ``cryptography`` certificate signing request. :rtype: ``cryptography.x509.CertificateSigningRequest`` .. versionadded:: 17.1.0 r)load_der_x509_csr)cryptography.x509r"_dump_certificate_request_internalr()rrrrrrrto_cryptographys  zX509Req.to_cryptography) crypto_reqrcCs6t|tjstdddlm}||j}tt |S)a Construct based on a ``cryptography`` *crypto_req*. :param crypto_req: A ``cryptography`` X.509 certificate signing request :type crypto_req: ``cryptography.x509.CertificateSigningRequest`` :rtype: X509Req .. versionadded:: 17.1.0 z%Must be a certificate signing requestrr) r^rZCertificateSigningRequestr_rrrr"_load_certificate_request_internalr()rrrrrrrfrom_cryptographys    zX509Req.from_cryptographyr/rrcCs t|j|j}t|dkdS)z Set the public key of the certificate signing request. :param pkey: The public key to use. :type pkey: :py:class:`PKey` :return: ``None`` rN)rMZX509_REQ_set_pubkeyrr|rSrrrrarrr set_pubkeys zX509Req.set_pubkeycCsDtt}t|j|_t|jtjkt |jtj |_d|_ |S)z Get the public key of the certificate signing request. :return: The public key. :rtype: :py:class:`PKey` T) r/__new__rMZX509_REQ_get_pubkeyrr|rSrPrTrUr{rr~rrr get_pubkeys  zX509Req.get_pubkeyrAversionrcCs@t|tstd|dkr"tdt|j|}t|dkdS)z Set the version subfield (RFC 2986, section 4.1) of the certificate request. :param int version: The version number. :return: ``None`` zversion must be an intrz9Invalid version. The only valid version for X509Req is 0.rN)r^rAr_r`rMZX509_REQ_set_versionrrS)rrrrarrrr s zX509Req.set_versioncCs t|jS)z Get the version subfield (RFC 2459, section 4.1.2.1) of the certificate request. :return: The value of the version subfield. :rtype: :py:class:`int` )rMZX509_REQ_get_versionrrqrrr get_versionszX509Req.get_versionr1cCs2tt}t|j|_t|jtjk||_ |S)a Return the subject of this certificate signing request. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate signing request. Modifying it will modify the underlying signing request, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate signing request. :rtype: :class:`X509Name` ) r1rrMZX509_REQ_get_subject_namerryrSrPrT_ownerrwrrr get_subject$s zX509Req.get_subjectIterable[X509Extension] extensionsrcCs|tjdtddt}t|tjkt|tj }|D]$}t |t sNt dt ||jq8t|j|}t|dkdS)z Add extensions to the certificate signing request. :param extensions: The X.509 extensions to add. :type extensions: iterable of :py:class:`X509Extension` :return: ``None`` This API is deprecated and will be removed in a future version of pyOpenSSL. You should use pyca/cryptography's X.509 APIs instead. stacklevel+One of the elements is not an X509ExtensionrN)warningswarnDeprecationWarningrMZsk_X509_EXTENSION_new_nullrSrPrTrUZsk_X509_EXTENSION_freer^r0r`Zsk_X509_EXTENSION_pushrZX509_REQ_add_extensionsr)rrr%stackextrrrradd_extensions:s  zX509Req.add_extensionszlist[X509Extension]cCs~tjdtddg}t|j}t|dd}tt |D]:}t t }t t ||}t|tj|_||q>|S)z Get X.509 extensions in the certificate signing request. :return: The X.509 extensions in this request. :rtype: :py:class:`list` of :py:class:`X509Extension` objects. .. versionadded:: 0.15 r&r'r(cSst|ttjdS)Nr)rMZsk_X509_EXTENSION_pop_freerP addressofZ _original_lib)xrrrrrs z(X509Req.get_extensions..)r+r,r-rMZX509_REQ_get_extensionsrrPrUrZsk_X509_EXTENSION_numr0rX509_EXTENSION_dupZsk_X509_EXTENSION_valuerrrv)rrextsZnative_exts_objrr/rrrrget_extensions[s&      zX509Req.get_extensionsrrdigestrcCs^|jrtd|jstdtt|}|tjkrrrrrr2s  !&c@seZdZdZddddZeddddd Zd dd d Zed dd ddZdddddZ ddddZ ddddZ dddddZ ddddddZ d dd!d"Zdd d#d$d%Zddd&d'Zddd(d)d*Zddd+d,Zddd-d.d/Zddd-d0d1Zd2dd3d4Zdd5d6d7d8Zd5dd9d:Zd;d dd<d=d>Zd dd?d@dAZd5ddBdCZd dd?dDdEZddFd6dGdHZddFddIdJdKZdFddLdMZdFddNdOdPZdFddQdRZ dFddSdTdUZ!dddVdWZ"dXddYdZd[Z#dd\d]d^d_Z$d`S)ar-z An X.509 certificate. r[rocCs:t}t|tjkt|tj|_t|_ t|_ dSr) rMZX509_newrSrPrTrU X509_freerrn_issuer_invalidator_subject_invalidator)rrrrrrrss z X509.__init__r)rrcCs.||}t|tj|_t|_t|_|Sr) rrPrUrMr?rrnr@rA)rrcertrrr_from_raw_x509_ptrs  zX509._from_raw_x509_ptrzx509.CertificatecCsddlm}tt|}||S)z Export as a ``cryptography`` certificate. :rtype: ``cryptography.x509.Certificate`` .. versionadded:: 17.1.0 r)load_der_x509_certificate)rrDr7r()rrrDrrrrrs  zX509.to_cryptography) crypto_certrcCs6t|tjstdddlm}||j}tt |S)z Construct based on a ``cryptography`` *crypto_cert*. :param crypto_key: A ``cryptography`` X.509 certificate. :type crypto_key: ``cryptography.x509.Certificate`` :rtype: X509 .. versionadded:: 17.1.0 zMust be a certificaterr) r^rZ Certificater_rrrrr=r()rrErrrrrrs   zX509.from_cryptographyrArcCs,t|tstdtt|j|dkdS)a  Set the version number of the certificate. Note that the version value is zero-based, eg. a value of 0 is V1. :param version: The version number of the certificate. :type version: :py:class:`int` :return: ``None`` zversion must be an integerrN)r^rAr_rSrMZX509_set_versionr)rrrrrrrs zX509.set_versioncCs t|jS)z Return the version number of the certificate. :return: The version number of the certificate. :rtype: :py:class:`int` )rMZX509_get_versionrrqrrrr szX509.get_versionr/cCsFtt}t|j|_|jtjkr*tt |jtj |_d|_ |S)z{ Get the public key of the certificate. :return: The public key. :rtype: :py:class:`PKey` T) r/rrMZX509_get_pubkeyrr|rPrTrrUr{rr~rrrrs  zX509.get_pubkeyrcCs2t|tstdt|j|j}t|dkdS)z Set the public key of the certificate. :param pkey: The public key. :type pkey: :py:class:`PKey` :return: :py:data:`None` r=rN)r^r/r_rMZX509_set_pubkeyrr|rSrrrrr s zX509.set_pubkeyrr6cCspt|tstd|jr td|js.tdtt|}|t j krNtdt |j |j |}t|dkdS)a Sign the certificate with this key and digest type. :param pkey: The key to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use. :type digest: :py:class:`str` :return: :py:data:`None` r=zKey only has public partr8r9rN)r^r/r_rr`r}rMr:rrPrTZ X509_signrr|rS)rrrr7Zevp_mdr;rrrr<s  z X509.signrXcCsZt|j}td}t|tjtj|t|d}|tjkrJt dt t |S)z Return the signature algorithm used in the certificate. :return: The name of the algorithm. :rtype: :py:class:`bytes` :raises ValueError: If the signature algorithm is undefined. .. versionadded:: 0.13 zASN1_OBJECT **rzUndefined signature algorithm) rMZX509_get0_tbs_sigalgrrPrQZX509_ALGOR_get0rTrrr`rjZ OBJ_nid2ln)rrZsig_algZalgrrrrget_signature_algorithm7s   zX509.get_signature_algorithm) digest_namercCstt|}|tjkr tdtdtj}tdd}t||d<t |j |||}t |dkd ddt ||dDS) a5 Return the digest of the X509 object. :param digest_name: The name of the digest algorithm to use. :type digest_name: :py:class:`str` :return: The digest of the object, formatted as :py:const:`b":"`-delimited hex pairs. :rtype: :py:class:`bytes` r9zunsigned char[]zunsigned int[]rr:cSsg|]}t|qSr)rupper)rchrrr cszX509.digest..)rMr:rrPrTr`rQZEVP_MAX_MD_SIZErRZ X509_digestrrSrrI)rrrGr7rYr Z digest_resultrrrr7Js$     z X509.digestcCs t|jS)z Return the hash of the X509 subject. :return: The hash of the subject. :rtype: :py:class:`int` )rMZX509_subject_name_hashrrqrrrsubject_name_hashiszX509.subject_name_hash)serialrcCst|tstdt|dd}|d}td}t||}t |tj kt |dtj }t |dt |tj kt |tj}t|j|}t |dkdS)z Set the serial number of the certificate. :param serial: The new serial number. :type serial: :py:class:`int` :return: :py:data`None` zserial must be an integerr'NrzBIGNUM**rr)r^rAr_hexrrPrQrMZ BN_hex2bnrSrTZBN_to_ASN1_INTEGERrrUZASN1_INTEGER_freeZX509_set_serialNumberr)rrrM hex_serialZhex_serial_bytes bignum_serialr asn1_serialrarrrset_serial_numberrs    zX509.set_serial_numberc Csht|j}t|tj}zt dt |j}t |tj|_|S)a Get a specific extension of the certificate by index. Extensions on a certificate are kept in order. The index parameter selects which extension will be returned. :param int index: The index of the extension to retrieve. :return: The extension at the specified index. :rtype: :py:class:`X509Extension` :raises IndexError: If the extension index was out of bounds. .. versionadded:: 0.12 r&r'r(zextension index out of bounds)r+r,r-r0rrMZ X509_get_extrrrPrT IndexErrorr3rUr)rrrtr/rrrr get_extensionws   zX509.get_extensionN)%rDrErFrGrsrrCrrrr rrr<rFr7rLrRrTrYr[rfrhrirjrlr]rmrnrorprqr"rrrsr0rvrrrrr-sF            c@seZdZUdZejZded<ejZ ded<ej Z ded<ej Z ded<ejZded<ejZded<ejZded <ejZded <ejZded <ejZded <d S)r6a  Flags for X509 verification, used to change the behavior of :class:`X509Store`. See `OpenSSL Verification Flags`_ for details. .. _OpenSSL Verification Flags: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html rA CRL_CHECK CRL_CHECK_ALLIGNORE_CRITICAL X509_STRICTALLOW_PROXY_CERTS POLICY_CHECKEXPLICIT_POLICY INHIBIT_MAPCHECK_SS_SIGNATURE PARTIAL_CHAINN)rDrErFrGrMZX509_V_FLAG_CRL_CHECKrwr ZX509_V_FLAG_CRL_CHECK_ALLrxZX509_V_FLAG_IGNORE_CRITICALryZX509_V_FLAG_X509_STRICTrzZX509_V_FLAG_ALLOW_PROXY_CERTSr{ZX509_V_FLAG_POLICY_CHECKr|ZX509_V_FLAG_EXPLICIT_POLICYr}ZX509_V_FLAG_INHIBIT_MAPr~ZX509_V_FLAG_CHECK_SS_SIGNATURErZX509_V_FLAG_PARTIAL_CHAINrrrrrr6s  c@sreZdZdZddddZddddd Zd dd d d ZdddddZdddddZdddddddZ dS)r3a An X.509 store. An X.509 store is used to describe a context in which to verify a certificate. A description of a context may include a set of certificates to trust, a set of certificate revocation lists, verification flags and more. An X.509 store, being only a description, cannot be used by itself to verify a certificate. To carry out the actual verification process, see :class:`X509StoreContext`. r[rocCst}t|tj|_dSr)rMZX509_STORE_newrPrUZX509_STORE_free_storerrstorerrrrsszX509Store.__init__r-)rBrcCs0t|tstt|j|j}t|dkdS)a Adds a trusted certificate to this store. Adding a certificate with this method adds this certificate as a *trusted* certificate. :param X509 cert: The certificate to add to this store. :raises TypeError: If the certificate is not an :class:`X509`. :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your certificate. :return: ``None`` if the certificate was added successfully. rN)r^r-r_rMZX509_STORE_add_certrrrS)rrrBrrrradd_certs zX509Store.add_certzx509.CertificateRevocationList)crlrcCsvt|tjrTddlm}t||j}t |t j }t |t j kt |tj}ntdt t|j|dkdS)a Add a certificate revocation list to this store. The certificate revocation lists added to a store will only be used if the associated flags are configured to check certificate revocation lists. .. versionadded:: 16.1.0 :param crl: The certificate revocation list to add to this store. :type crl: ``cryptography.x509.CertificateRevocationList`` :return: ``None`` if the certificate revocation list was added successfully. rrz?CRL must be of type cryptography.x509.CertificateRevocationListN)r^rZCertificateRevocationListrrrWrrrMZd2i_X509_CRL_biorPrTrSrUZ X509_CRL_freer_ZX509_STORE_add_crlr)rrrrrKZ openssl_crlrrradd_crls  zX509Store.add_crlrA)flagsrcCstt|j|dkdS)a Set verification flags to this store. Verification flags can be combined by oring them together. .. note:: Setting a verification flag sometimes requires clients to add additional information to the store, otherwise a suitable error will be raised. For example, in setting flags to enable CRL checking a suitable CRL must be added to the store otherwise an error will be raised. .. versionadded:: 16.1.0 :param int flags: The verification flags to set on this store. See :class:`X509StoreFlags` for available constants. :return: ``None`` if the verification flags were successfully set. rN)rSrMZX509_STORE_set_flagsr)rrrrrr set_flagsszX509Store.set_flagszdatetime.datetime)vfy_timercCsFt}t|tj}t|t|t t |j |dkdS)a Set the time against which the certificates are verified. Normally the current time is used. .. note:: For example, you can determine if a certificate was valid at a given time. .. versionadded:: 17.0.0 :param datetime vfy_time: The verification time to set on this store. :return: ``None`` if the verification time was successfully set. rN) rMZX509_VERIFY_PARAM_newrPrUZX509_VERIFY_PARAM_freeZX509_VERIFY_PARAM_set_timecalendartimegm timetuplerSZX509_STORE_set1_paramr)rrrparamrrrset_times zX509Store.set_timeNzStrOrBytesPath | None)cafilecapathrcCsN|dkrtj}nt|}|dkr(tj}nt|}t|j||}|sJtdS)a Let X509Store know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If *capath* is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *cafile* or *capath* may be ``None``. .. note:: Both *cafile* and *capath* may be set simultaneously. Call this method multiple times to add more than one location. For example, CA certificates, and certificate revocation list bundles may be passed in *cafile* in subsequent calls to this method. .. versionadded:: 20.0 :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: ``None`` if the locations were set successfully. :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None`` or the locations could not be set for any reason. N)rPrT _path_bytesrMZX509_STORE_load_locationsrr)rrrrZ load_resultrrrload_locations&s#zX509Store.load_locations)N) rDrErFrGrsrrrrrrrrrr3s cs,eZdZdZdddddfdd ZZS) r5z An exception raised when an error occurred while verifying a certificate using `OpenSSL.X509StoreContext.verify_certificate`. :ivar certificate: The certificate which caused verificate failure. :type certificate: :class:`X509` rz list[Any]r-r[)messageerrors certificatercst|||_||_dSr)rrsrr)rrrrrrrrrscs zX509StoreContextError.__init__)rDrErFrGrsrrrrrr5Zsc@seZdZdZdddddddd Zeddd d d Zed ddddZd dddZdddddZ ddddZ ddddZ dS)r4a9 An X.509 store context. An X.509 store context is used to carry out the actual verification process of a certificate in a described context. For describing such a context, see :class:`X509Store`. :param X509Store store: The certificates which will be trusted for the purposes of any verifications. :param X509 certificate: The certificate to be verified. :param chain: List of untrusted certificates that may be used for building the certificate chain. May be ``None``. :type chain: :class:`list` of :class:`X509` Nr3r-zSequence[X509] | Noner[)rrchainrcCs||_||_|||_dSr)r_cert_build_certificate_stack_chain)rrrrrrrrrs{szX509StoreContext.__init__) certificatesrcCsddddd}|dks$t|dkr*tjSt}t|tjkt||}|D]N}t|tsft dtt |j dkt ||j dkrPt |j tqP|S)Nrr[)srcSs8tt|D]}t||}t|qt|dSr)rrM sk_X509_num sk_X509_valuer? sk_X509_free)rrr2rrrcleanups  z:X509StoreContext._build_certificate_stack..cleanuprz+One of the elements is not an X509 instance)rRrPrTrMZsk_X509_new_nullrSrUr^r-r_Z X509_up_refrZ sk_X509_pushr?r)rrr.rBrrrrs   z)X509StoreContext._build_certificate_stackrr5) store_ctxrcCs\ttt|d}t|t||g}t|}t|}t |}t |||S)z Convert an OpenSSL native context error failure into a Python exception. When a call to native OpenSSL X509_verify_cert fails, additional information about the failure can be obtained from the store context. r) rPrjrMZX509_verify_cert_error_stringZX509_STORE_CTX_get_errorrZX509_STORE_CTX_get_error_depthZX509_STORE_CTX_get_current_certZX509_dupr-rCr5)rrrrrpycertrrr_exception_from_contexts    z(X509StoreContext._exception_from_contextrocCsjt}t|tjkt|tj}t||jj|j j |j }t|dkt |}|dkrf| ||S)a3 Verifies the certificate and runs an X509_STORE_CTX containing the results. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. rr)rMZX509_STORE_CTX_newrSrPrTrUZX509_STORE_CTX_freeZX509_STORE_CTX_initrrrrZX509_verify_certr)rrrrdrrr_verify_certificates    z$X509StoreContext._verify_certificate)rrcCs ||_dS)z Set the context's X.509 store. .. versionadded:: 0.15 :param X509Store store: The store description which will be used for the purposes of any *future* verifications. N)rrrrr set_stores zX509StoreContext.set_storecCs |dS)a" Verify a certificate in a context. .. versionadded:: 0.15 :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. N)rrqrrrverify_certificates z#X509StoreContext.verify_certificatez list[X509]cCst|}t|}t|tjkg}tt|D]2}t||}t|tjkt |}| |q2t ||S)aR Verify a certificate in a context and return the complete validated chain. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. .. versionadded:: 20.0 ) rrMZX509_STORE_CTX_get1_chainrSrPrTrrrr-rCrvr)rrrZ cert_stackrrrBrrrrget_verified_chains      z#X509StoreContext.get_verified_chain)N) rDrErFrGrs staticmethodrrrrrrrrrrr4ks   )rrIrcCsvt|tr|d}t|}|tkrg s   )N)NN)N)o __future__rrr^ functoolssysrr+base64rcollections.abcrrrrrr version_infor TypeVarZ_TZtyping_extensionsZ cryptographyrrZ)cryptography.hazmat.primitives.asymmetricrrrrr Z OpenSSL._utilr!r"rr#rr$rPr%rMr&Z _make_assertr'r__all__rrrrrZ _PrivateKeyrrrrrZ _PublicKeyrrXZPassphraseCallableTZSSL_FILETYPE_PEMr)r ZSSL_FILETYPE_ASN1r(r*rr,Z EVP_PKEY_DSAr+Z EVP_PKEY_DHrBZ EVP_PKEY_ECrCrr.rrSrWrZrbrermrnr/rr<r;total_orderingr1r0r2r-r6r3r5r4r=r7r:r9rr@r?r8rrDr-r>rrrrrs(                  BgC+sm+EN%)