U m5{i]m @s@ddlmZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddlmZddlmZmZmZmZmZmZmZmZddlmZmZdd lmZmZmZm Z dd l!m"Z"m#Z#dd l$m%Z%ed d d Z&ej'ej(ej)ej*ej+ej,ej-ej.ej/fZ0Gddde1Z2ddddddZ3ddddddZ4dddddZ5Gdd d Z6Gd!d"d"Z7Gd#d$d$e j8Z9Gd%d&d&e1Z:e j;Z;Gd'd(d(eje j=Gd*d+d+e=Z?e j@Z@e jAZAe jBZBe jCZCe jDZDe jEZEe jFZFe jGZGe jHZHGd,d-d-ZIGd.d/d/ZJGd0d1d1ZKGd2d3d3ZLd4d5d6d7ZMdS)8) annotationsN)Iterable)utils)x509)hashes)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificatePublicKeyTypes) Extension Extensions ExtensionType_make_sequence_methods)Name _ASN1Type)ObjectIdentifierics&eZdZddddfdd ZZS)AttributeNotFoundstrrNone)msgoidreturncst|||_dSN)super__init__r)selfrr __class__:/tmp/pip-unpacked-wheel-6hw_jadn/cryptography/x509/base.pyr!9s zAttributeNotFound.__init____name__ __module__ __qualname__r! __classcell__r%r%r#r&r8srzExtension[ExtensionType]list[Extension[ExtensionType]]r) extension extensionsrcCs"|D]}|j|jkrtdqdS)Nz$This extension has already been set.)r ValueError)r-r.er%r%r&_reject_duplicate_extension>s r1r0list[tuple[ObjectIdentifier, bytes, int | None]])r attributesrcCs$|D]\}}}||krtdqdS)Nz$This attribute has already been set.)r/)rr3Zattr_oid_r%r%r&_reject_duplicate_attributeHsr5datetime.datetimetimercCs:|jdk r2|}|r|nt}|jdd|S|SdS)zNormalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. Ntzinfo)r: utcoffsetdatetime timedeltareplace)r8offsetr%r%r&_convert_to_naive_utc_timeRs  r@c@sxeZdZejjfdddddddZeddd d Zeddd d Zd dddZ dddddZ ddddZ dS) Attributerbytesintr)rvalue_typercCs||_||_||_dSr)_oid_valuerE)r"rrDrEr%r%r&r!aszAttribute.__init__rcCs|jSr)rFr"r%r%r&rksz Attribute.oidcCs|jSr)rGrIr%r%r&rDoszAttribute.valuercCsd|jd|jdS)Nz)rrDrIr%r%r&__repr__sszAttribute.__repr__objectbool)otherrcCs2t|tstS|j|jko0|j|jko0|j|jkSr) isinstancerANotImplementedrrDrE)r"rNr%r%r&__eq__vs    zAttribute.__eq__cCst|j|j|jfSr)hashrrDrErIr%r%r&__hash__szAttribute.__hash__N) r(r)r*rZ UTF8StringrDr!propertyrrKrQrSr%r%r%r&rA`s  rAc@sHeZdZdddddZed\ZZZddd d Zd d d ddZ dS) AttributeszIterable[Attribute]r)r3rcCst||_dSr)list _attributes)r"r3r%r%r&r!szAttributes.__init__rWrrHcCsd|jdS)Nz r<timezoneutcrIr%r%r&resz*_RawRevokedCertificate.revocation_date_utccCs|jSr)rnrIr%r%r&r.sz!_RawRevokedCertificate.extensionsN) r(r)r*r!rTrcrdrer.r%r%r%r&ris  ric @seZdZdggfddddddZddd d d Zd d ddddZdddddddddZd"ddddddddddd d!ZdS)# CertificateSigningRequestBuilderN Name | Noner,r2) subject_namer.r3cCs||_||_||_dS)zB Creates an empty X.509 certificate request (v1). N) _subject_namernrW)r"rwr.r3r%r%r&r!s z)CertificateSigningRequestBuilder.__init__rnamercCs4t|tstd|jdk r$tdt||j|jS)zF Sets the certificate requestor's distinguished name. Expecting x509.Name object.N&The subject name may only be set once.)rOr TypeErrorrxr/rurnrWr"rzr%r%r&rw s  z-CertificateSigningRequestBuilder.subject_namerrMextvalcriticalrcCsDt|tstdt|j||}t||jt|j|j|f|j S)zE Adds an X.509 extension to the certificate request. "extension must be an ExtensionType) rOrr}rrr1rnrurxrWr"rrr-r%r%r& add_extensions   z.CertificateSigningRequestBuilder.add_extension)_tagrrBz_ASN1Type | None)rrDrrcCs|t|tstdt|ts$td|dk r>t|ts>tdt||j|dk rZ|j}nd}t|j |j |j|||ffS)zK Adds an X.509 attribute with an OID and associated value. zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type) rOrr}rBrr5rWrDrurxrn)r"rrDrtagr%r%r& add_attribute's   z.CertificateSigningRequestBuilder.add_attribute rsa_paddingecdsa_deterministicr_AllowedHashTypes | None typing.Any%padding.PSS | padding.PKCS1v15 | None bool | NoneCertificateSigningRequest private_key algorithmbackendrrrcCsv|jdkrtd|dk rHt|tjtjfs4tdt|tjsHtd|dk rdt|t j sdtdt |||||S)zF Signs the request using the requestor's private key. Nz/A CertificateSigningRequest must have a subjectPadding must be PSS or PKCS1v15&Padding is only supported for RSA keys1Deterministic ECDSA is only supported for EC keys) rxr/rOr PSSPKCS1v15r}r RSAPrivateKeyrEllipticCurvePrivateKey rust_x509Zcreate_x509_csrr"rrrrrr%r%r&signGs&   z%CertificateSigningRequestBuilder.sign)N)r(r)r*r!rwrrrr%r%r%r&rus  $ruc @seZdZUded<ddddddgfddddddddd d d Zd dd ddZd dd ddZdddddZdddddZdddddZ dddddZ d d!dd"d#d$Z d/ddd%d&d'd(d)d*d+d,d-d.Z dS)0CertificateBuilderr,rnNrvz CertificatePublicKeyTypes | None int | Nonedatetime.datetime | Noner) issuer_namerw public_keyrcnot_valid_beforenot_valid_afterr.rcCs6tj|_||_||_||_||_||_||_||_ dSr) r]r__version _issuer_namerx _public_keyrl_not_valid_before_not_valid_afterrn)r"rrwrrcrrr.r%r%r&r!ns zCertificateBuilder.__init__rrycCsDt|tstd|jdk r$tdt||j|j|j|j |j |j S)z3 Sets the CA's distinguished name. r{N%The issuer name may only be set once.) rOrr}rr/rrxrrlrrrnr~r%r%r&rs  zCertificateBuilder.issuer_namecCsDt|tstd|jdk r$tdt|j||j|j|j |j |j S)z: Sets the requestor's distinguished name. r{Nr|) rOrr}rxr/rrrrlrrrnr~r%r%r&rws  zCertificateBuilder.subject_namer)keyrc Cs`t|tjtjtjtjt j t j t jfs.td|jdk r@tdt|j|j||j|j|j|jS)zT Sets the requestor's public key (as found in the signing request). zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rOrZ DSAPublicKeyr Z RSAPublicKeyrZEllipticCurvePublicKeyr ZEd25519PublicKeyr ZEd448PublicKeyrZX25519PublicKeyr Z X448PublicKeyr}rr/rrrxrlrrrn)r"rr%r%r&rs2  zCertificateBuilder.public_keyrCnumberrcCsht|tstd|jdk r$td|dkr4td|dkrHtdt|j|j|j ||j |j |j S)z5 Sets the certificate serial number. 'Serial number must be of integral type.N'The serial number may only be set once.rz%The serial number should be positive.3The serial number should not be more than 159 bits.) rOrCr}rlr/ bit_lengthrrrxrrrrnr"rr%r%r&rcs&   z CertificateBuilder.serial_numberr6r7cCszt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j |j |j ||j|j S)z7 Sets the certificate activation time. Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rOr<r}rr/r@_EARLIEST_UTC_TIMErrrrxrrlrnr"r8r%r%r&rs,  z#CertificateBuilder.not_valid_beforecCszt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j |j |j |j||j S)z7 Sets the certificate expiration time. rNz)The not valid after may only be set once.ztd|jdk rZ||jkrZtdt|j ||j|j |j S)Nr!Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) rOr<r}rr/r@rrrrrnr)r"rr%r%r&rs(  z,CertificateRevocationListBuilder.last_update)rrcCsrt|tjstd|jdk r&tdt|}|tkr>td|jdk rZ||jkrZtdt|j |j||j |j S)Nrrrz8The next update date must be after the last update date.) rOr<r}rr/r@rrrrrnr)r"rr%r%r&rs(  z,CertificateRevocationListBuilder.next_updaterrMrcCsLt|tstdt|j||}t||jt|j|j |j |j|f|j S)zM Adds an X.509 extension to the certificate revocation list. r) rOrr}rrr1rnrrrrrrr%r%r&rs   z.CertificateRevocationListBuilder.add_extensionrb)revoked_certificatercCs2t|tstdt|j|j|j|j|j|fS)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rOrbr}rrrrrnr)r"rr%r%r&add_revoked_certificates  z8CertificateRevocationListBuilder.add_revoked_certificaterrrrrrCertificateRevocationListrcCs|jdkrtd|jdkr$td|jdkr6td|dk rlt|tjtjfsXtdt|t j sltd|dk rt|t j stdt |||||S)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timerrr)rr/rrrOr rrr}r rrrrZcreate_x509_crlrr%r%r&rs.     z%CertificateRevocationListBuilder.sign)N) r(r)r*rr!rrrrrrr%r%r%r&rjs$ rc@sjeZdZddgfddddddZddd d d Zd dd ddZddddddZddddddZdS)RevokedCertificateBuilderNrrr,rjcCs||_||_||_dSrrkror%r%r&r!sz"RevokedCertificateBuilder.__init__rCrcCsXt|tstd|jdk r$td|dkr4td|dkrHtdt||j|jS)Nrrrz$The serial number should be positiverr) rOrCr}rlr/rrrmrnrr%r%r&rcs   z'RevokedCertificateBuilder.serial_numberr6r7cCsNt|tjstd|jdk r&tdt|}|tkr>tdt|j||j S)Nrz)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) rOr<r}rmr/r@rrrlrnrr%r%r&rd#s  z)RevokedCertificateBuilder.revocation_daterrMrcCsDt|tstdt|j||}t||jt|j|j |j|fS)Nr) rOrr}rrr1rnrrlrmrr%r%r&r3s   z'RevokedCertificateBuilder.add_extensionrrb)rrcCs:|jdkrtd|jdkr$tdt|j|jt|jS)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)rlr/rmrirrn)r"rr%r%r&buildAs  zRevokedCertificateBuilder.build)N)r(r)r*r!rcrdrrr%r%r%r&rs rrCrHcCsttddd?S)Nbigr)rC from_bytesosurandomr%r%r%r&random_serial_numberOsr)N __future__rrfr<rtypingrqcollections.abcrZ cryptographyrZ"cryptography.hazmat.bindings._rustrrZcryptography.hazmat.primitivesrZ)cryptography.hazmat.primitives.asymmetricrrr r r r r rZ/cryptography.hazmat.primitives.asymmetric.typesrrZcryptography.x509.extensionsrrrrZcryptography.x509.namerrZcryptography.x509.oidrrUnionSHA224SHA256SHA384SHA512ZSHA3_224ZSHA3_256ZSHA3_384ZSHA3_512Z_AllowedHashTypes Exceptionrr1r5r@rArUEnumr]r`rABCMetarbregisterrirrZload_pem_x509_certificateZload_der_x509_certificateZload_pem_x509_certificatesZload_pem_x509_csrZload_der_x509_csrZload_pem_x509_crlZload_der_x509_crlrurrrrr%r%r%r&sn     (     $ "pI