Your IP : 216.73.216.213
U�XDE � @ sD d Z d d l m Z m Z m Z m Z d d l m Z d d l Z d d l Z d d l
Z
d d l Z d d l Z d d l
Z
d d l m Z d d l m Z m Z d d l m Z d d l m Z m Z m Z d d
l m Z m Z d d l m Z m Z m Z m Z m! Z! m" Z" m# Z# m$ Z$ m% Z% m& Z& m' Z' m( Z( m) Z) m* Z* m+ Z+ m, Z, m- Z- m. Z. m/ Z/ m0 Z0 m1 Z1 m2 Z2 m3 Z3 m4 Z4 m5 Z5 m6 Z6 m7 Z7 d d l8 m9 Z9 d d
l: m; Z; m< Z< m= Z= m> Z> Gd d � d e% � Z? Gd d � d e% � Z@ Gd d � d e% � ZA Gd d � d e+ � ZB Gd d � d e. � ZC Gd d � d e/ � ZD Gd d � d e � ZE Gd d � d e. � ZF Gd d � d e! � ZG Gd d! � d! e) � ZH Gd" d# � d# e. � ZI Gd$ d% � d% e1 � ZJ Gd& d' � d' e/ � ZK Gd( d) � d) e! � ZL Gd* d+ � d+ e. � ZM Gd, d- � d- e! � ZN Gd. d/ � d/ e! � ZO Gd0 d1 � d1 e! � ZP Gd2 d3 � d3 e0 � ZQ Gd4 d5 � d5 e0 � ZR Gd6 d7 � d7 e/ � ZS Gd8 d9 � d9 e/ � ZT Gd: d; � d; e. � ZU Gd< d= � d= e. � ZV Gd> d? � d? e/ � ZW Gd@ dA � dA e. � ZX GdB dC � dC e/ � ZY GdD dE � dE e! � ZZ GdF dG � dG e! � Z[ GdH dI � dI e0 � Z\ GdJ dK � dK e/ � Z] GdL dM � dM e0 � Z^ GdN dO � dO e. � Z_ GdP dQ � dQ e1 � Z` GdR dS � dS e. � Za GdT dU � dU e! � Zb GdV dW � dW e& � Zc GdX dY � dY e& � Zd GdZ d[ � d[ e. � Ze Gd\ d] � d] e/ � Zf Gd^ d_ � d_ e. � Zg Gd` da � da e. � Zh Gdb dc � dc e! � Zi Gdd de � de e/ � Zj Gdf dg � dg e! � Zk Gdh di � di e. � Zl Gdj dk � dk e. � Zm Gdl dm � dm e. � Zn Gdn do � do e! � Zo Gdp dq � dq e � Zp Gdr ds � ds e. � Zq Gdt du � du e/ � Zr Gdv dw � dw e. � Zs Gdx dy � dy e. � Zt Gdz d{ � d{ e/ � Zu Gd| d} � d} e! � Zv Gd~ d � d e/ � Zw Gd� d� � d� e. � Zx Gd� d� � d� e. � Zy Gd� d� � d� e) � Zz Gd� d� � d� e. � Z{ Gd� d� � d� e/ � Z| Gd� d� � d� e) � Z} Gd� d� � d� e. � Z~ Gd� d� � d� e/ � Z Gd� d� � d� e. � Z� Gd� d� � d� e/ � Z� Gd� d� � d� e. � Z� Gd� d� � d� e) � Z� Gd� d� � d� e/ � Z� Gd� d� � d� e) � Z� Gd� d� � d� e. � Z� Gd� d� � d� e/ � Z� Gd� d� � d� e/ � Z� Gd� d� � d� e/ � Z� Gd� d� � d� e. � Z� Gd� d� � d� e � Z� Gd� d� � d� e) � Z� Gd� d� � d� e. � Z� Gd� d� � d� e/ � Z� Gd� d� � d� e& � Z� Gd� d� � d� e. � Z� Gd� d� � d� e. � Z� Gd� d� � d� e/ � Z� Gd� d� � d� e/ � Z� Gd� d� � d� e. � Z� Gd� d� � d� e" � Z� d S)�z�
ASN.1 type classes for X.509 certificates. Exports the following items:
- Attributes()
- Certificate()
- Extensions()
- GeneralName()
- GeneralNames()
- Name()
Other type classes are defined that help compose the types listed above.
� )�unicode_literals�division�absolute_import�print_function)�idnaN� )�unwrap)�
iri_to_uri�
uri_to_iri)� OrderedDict)� type_name�str_cls�
bytes_to_list)�AlgorithmIdentifier�SignedDigestAlgorithm)�Any� BitString� BMPString�Boolean�Choice�Concat�GeneralizedTime�
GeneralString� IA5String�Integer�Null�
NumericString�ObjectIdentifier�OctetBitString� OctetString�ParsableOctetString�PrintableString�Sequence�
SequenceOf�Set�SetOf�
TeletexString�UniversalString�UTCTime�
UTF8String�
VisibleString�VOID)�
PublicKeyInfo)� int_to_bytes�int_from_bytes� inet_ntop� inet_ptonc @ s@ e Z d Z d Z d Z d d � Z d d � Z d d � Z d S)
�DNSNamer � c C s | | k S)N� )�self�otherr3 r3 �@/opt/alt/python35/lib/python3.5/site-packages/asn1crypto/x509.py�__ne__J s zDNSName.__ne__c C s5 t | t � s d S| j � j � | j � j � k S)z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2
:param other:
Another DNSName object
:return:
A boolean
F)�
isinstancer1 � __unicode__�lower)r4 r5 r3 r3 r6 �__eq__M s zDNSName.__eq__c C s� t | t � s3 t t d t | � t | � � � � | j d � re d | d d � j | j � } n | j | j � } | | _ | | _ d | _
| j d k r� d | _ d S)zd
Sets the value of the DNS name
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
�.� .r N� ) r8 r
� TypeErrorr r �
startswith�encode� _encoding�_unicode�contents�_header�_trailer)r4 �value�
encoded_valuer3 r3 r6 �set] s # z DNSName.setN)�__name__�
__module__� __qualname__rB Z_bad_tagr7 r; rI r3 r3 r3 r6 r1 E s
r1 c @ s@ e Z d Z d d � Z d d � Z d d � Z d d � Z d S)
�URIc C sp t | t � s3 t t d t | � t | � � � � | | _ t | � | _ d | _ | j d k rl d | _ d S)zb
Sets the value of the string
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
Nr> )
r8 r
r? r r rC r rD rE rF )r4 rG r3 r3 r6 rI | s zURI.setc C s | | k S)Nr3 )r4 r5 r3 r3 r6 r7 � s z
URI.__ne__c C s/ t | t � s d St | j � t | j � k S)z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4
:param other:
Another URI object
:return:
A boolean
F)r8 rM r �native)r4 r5 r3 r3 r6 r; � s z
URI.__eq__c C s> | j d k r d S| j d k r7 t | j � � | _ | j S)z7
:return:
A unicode string
N� )rD rC r
�
_merge_chunks)r4 r3 r3 r6 r9 � s
zURI.__unicode__N)rJ rK rL rI r7 r; r9 r3 r3 r3 r6 rM z s rM c @ ss e Z d Z d Z d Z e d d � � Z e j d d � � Z d d � Z d d � Z d
d � Z
d d
� Z d S)� EmailAddressNFc C s | j S)z`
:return:
A byte string of the DER-encoded contents of the sequence
)� _contents)r4 r3 r3 r6 rD � s zEmailAddress.contentsc C s d | _ | | _ d S)ze
:param value:
A byte string of the DER-encoded contents of the sequence
FN)� _normalizedrR )r4 rG r3 r3 r6 rD � s c C s� t | t � s3 t t d t | � t | � � � � | j d � d
k r� | j d d � \ } } | j d � d | j d � } n | j d � } d | _ | | _ | | _
d | _ | j d k r� d | _ d S) zb
Sets the value of the string
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
�@r �ascii� @r TNr> ���)
r8 r
r? r r �find�rsplitrA rS rC rD rE rF )r4 rG �mailbox�hostnamerH r3 r3 r6 rI � s # zEmailAddress.setc C s� | j d k r� | j � } | j d � d k rE | j d � | _ n; | j d d � \ } } | j d � d | j d � | _ | j S)z7
:return:
A unicode string
NrV r rU rT r rW )rC rP rX �decoderY )r4 rD rZ r[ r3 r3 r6 r9 � s #zEmailAddress.__unicode__c C s | | k S)Nr3 )r4 r5 r3 r3 r6 r7 � s zEmailAddress.__ne__c C s� t | t � s d S| j s, | j | j � | j sE | j | j � | j j d � d k su | j j d � d k r� | j | j k S| j j d d � \ } } | j j d d � \ } } | | k r� d S| j � | j � k r� d Sd S)z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5
:param other:
Another EmailAddress object
:return:
A boolean
FrV r TrW rW ) r8 rQ rS rI rN rR rX rY r: )r4 r5 Z
other_mailboxZother_hostnamerZ r[ r3 r3 r6 r; � s 0 zEmailAddress.__eq__) rJ rK rL rR rS �propertyrD �setterrI r9 r7 r; r3 r3 r3 r6 rQ � s
rQ c @ sX e Z d Z d d d d � Z d d � Z e d d � � Z d d � Z d
d � Z d S) � IPAddressNc C s t t d � � � d S)z?
This method is not applicable to IP addresses
z=
IP address values can not be parsed
N)�
ValueErrorr )r4 �specZ spec_paramsr3 r3 r6 �parse s zIPAddress.parsec
C s� t | t � s3 t t d t | � t | � � � � | } | j d � d k } d } | r� | j d d � } | d } t | d � } | d k r� t t d t | � � � � | j d � d k r� t j
} | d k r� t t d t | � � � � d } n6 t j } | d k r+t t d
t | � � � � d } d } | r�d | } | d
| t | � 7} t
t | d � � } d | d t | � | } | | _ t | | � | | _ | j | _ d | _ | j d k r�d | _ d S)z�
Sets the value of the object
:param value:
A unicode string containing an IPv4 address, IPv4 address with CIDR,
an IPv6 address or IPv6 address with CIDR
zK
%s value must be a unicode string, not %s
�/r r zT
%s value contains a CIDR range less than 0
�:� z�
%s value contains a CIDR range bigger than 128, the maximum
value for an IPv6 address
� z�
%s value contains a CIDR range bigger than 32, the maximum
value for an IPv4 address
r> �1�0� s � NrW rW )r8 r
r? r r rX �split�intr` �socket�AF_INET6�AF_INET�lenr- �_nativer0 rD Z_bytesrE rF )
r4 rG Zoriginal_valueZhas_cidr�cidr�parts�familyZ cidr_sizeZ
cidr_bytesZ cidr_maskr3 r3 r6 rI + sR
z
IPAddress.setc C sC | j d k r d S| j d k r<| j � } t | � } d } | t d d g � k r� t t j | d d � � } | d k r� t | d d � � } nV | t d d g � k r� t t j | d d � � } | d k r� t | d d � � } | d k r3d j
| � } t | j d � � } | d t | � } | | _ | j S)
z�
The a native Python datatype representation of this value
:return:
A unicode string or None
Nrf � r rj � z{0:b}rh rc )
rD rq � __bytes__rp rI r/ rm rn r. ro �format�rstripr
)r4 Z byte_stringZbyte_lenZcidr_intrG Z cidr_bitsrr r3 r3 r6 rN r s( zIPAddress.nativec C s | | k S)Nr3 )r4 r5 r3 r3 r6 r7 � s zIPAddress.__ne__c C s) t | t � s d S| j � | j � k S)zl
:param other:
Another IPAddress object
:return:
A boolean
F)r8 r_ rw )r4 r5 r3 r3 r6 r; � s zIPAddress.__eq__) rJ rK rL rb rI r] rN r7 r; r3 r3 r3 r6 r_ s
G r_ c @ s1 e Z d Z d e f d e d e i f g Z d S)� Attribute�type�valuesra N)rJ rK rL r r% r �_fieldsr3 r3 r3 r6 rz � s rz c @ s e Z d Z e Z d S)�
AttributesN)rJ rK rL rz � _child_specr3 r3 r3 r6 r~ � s r~ c @ sL e Z d Z d d d d d d d d d d
d d d
d d d d d i Z d S)�KeyUsager Zdigital_signaturer Znon_repudiationri Zkey_encipherment� Zdata_enciphermentrv Z
key_agreement� Z
key_cert_sign� Zcrl_sign� Z
encipher_onlyrj Z
decipher_onlyN)rJ rK rL �_mapr3 r3 r3 r6 r� � s r� c @ sR e Z d Z d e d d d d d d i f d e d d d d d d i f g Z d
S) �PrivateKeyUsagePeriod�
not_before�tag_type�implicit�tagr �optionalT� not_afterr N)rJ rK rL r r} r3 r3 r3 r6 r� � s r� c @ sL e Z d Z d e f d e f d e f d e f d e f d e f g Z d S)�DirectoryString�teletex_string�printable_stringZuniversal_string� utf8_string�
bmp_string�
ia5_stringN)
rJ rK rL r& r! r' r) r r �
_alternativesr3 r3 r3 r6 r� � s r� c 6 @ s0 e Z d Z d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" d# d$ d% d& d' d( d) d* d+ d, d- d. d/ d0 d1 d2 d3 d4 d5 d6 i Z d2 d0 d. d d d d d d
d d d d d d d" d d d d( d& d d, d4 d6 d* g Z e d7 d8 � � Z e d9 d: � � Z d; S)<�NameTypez2.5.4.3� common_namez2.5.4.4�surnamez2.5.4.5�
serial_numberz2.5.4.6� country_namez2.5.4.7�
locality_namez2.5.4.8�state_or_province_namez2.5.4.9�street_addressz2.5.4.10�organization_namez2.5.4.11�organizational_unit_namez2.5.4.12�titlez2.5.4.15�business_categoryz2.5.4.17� postal_codez2.5.4.20�telephone_numberz2.5.4.41�namez2.5.4.42�
given_namez2.5.4.43�initialsz2.5.4.44�generation_qualifierz2.5.4.45�unique_identifierz2.5.4.46� dn_qualifierz2.5.4.65� pseudonymz2.5.4.97�organization_identifierz1.2.840.113549.1.9.1�
email_addressz1.3.6.1.4.1.311.60.2.1.1�incorporation_localityz1.3.6.1.4.1.311.60.2.1.2� incorporation_state_or_provincez1.3.6.1.4.1.311.60.2.1.3�incorporation_countryz0.9.2342.19200300.100.1.25�domain_componentz0.2.262.1.10.7.20�name_distinguisherc C sL | j | � } | | j k r3 | j j | � } n t | j � } | | f S)z�
Returns an ordering value for a particular attribute key.
Unrecognized attributes and OIDs will be sorted lexically at the end.
:return:
An orderable value.
)�map�preferred_order�indexrp )�cls� attr_nameZordinalr3 r3 r6 �preferred_ordinal s
zNameType.preferred_ordinalc 6 C s� d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" d# d$ d% d& d' d( d) d* d+ d, d- d. d/ d0 d1 d2 d3 d4 d5 d6 i j | j | j � S)7zZ
:return:
A human-friendly unicode string to display to users
r� z Common Namer� ZSurnamer� z
Serial Numberr� �Countryr� ZLocalityr� zState/Provincer� zStreet Addressr� Z Organizationr� zOrganizational Unitr� ZTitler� zBusiness Categoryr� z Postal Coder� zTelephone Numberr� �Namer� z
Given Namer� ZInitialsr� zGeneration Qualifierr� zUnique Identifierr� z DN Qualifierr� Z Pseudonymr� z
Email Addressr� zIncorporation Localityr� z Incorporation State/Provincer� zIncorporation Countryr� zDomain Componentr� zName Distinguisherr� zOrganization Identifier)�getrN )r4 r3 r3 r6 �human_friendly& s8 zNameType.human_friendlyN) rJ rK rL r� r� � classmethodr� r] r� r3 r3 r3 r6 r� � sn r� c 6 @ s e Z d Z d e f d e f g Z d' Z d e d e d e d e d e d e d e d
e d e d e d
e d e d e d e d e d e d e d e d e d e d e
d e d e d e d e d e d e i Z d Z
e d d � � Z d! d" � Z d# d$ � Z d% d& � Z d S)(�NameTypeAndValuer{ rG r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� Nc C s/ | j d k r( | j | d j � | _ | j S)z�
Returns the value after being processed by the internationalized string
preparation as specified by RFC 5280
:return:
A unicode string
NrG )�_prepped�_ldap_string_preprN )r4 r3 r3 r6 �
prepped_valueu s
z NameTypeAndValue.prepped_valuec C s | | k S)Nr3 )r4 r5 r3 r3 r6 r7 � s zNameTypeAndValue.__ne__c C sA t | t � s d S| d j | d j k r1 d S| j | j k S)z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another NameTypeAndValue object
:return:
A boolean
Fr{ )r8 r� rN r� )r4 r5 r3 r3 r6 r; � s
zNameTypeAndValue.__eq__c C sf t j d d | � } t j d d | � } t j d k rQ t j d d | � } n t j d d | � } t j d d | � } | j d d � } t j d
d | � } d j t t j | � � } t j
d | � } x� | D]� } t j | � r� t t
d � � � t j | � r t t
d
� � � t j | � r?t t
d � � � t j | � r`t t
d � � � t j | � r�t t
d � � � | d k r� t t
d � � � q� Wd } d } x; | D]3 } t j | � r�d } q�t j | � r�d } q�W| r?t j | d � } t j | d � } | s-| s-| r?t t
d � � � d t j d d | � j � d } | S)a"
Implements the internationalized string preparation algorithm from
RFC 4518. https://tools.ietf.org/html/rfc4518#section-2
:param string:
A unicode string to prepare
:return:
A prepared unicode string, ready for comparison
u [᠆͏᠋-᠍️-]+rO u [
]� i�� u �[�-�]|�[�-�]|u [--]u? [ -- -------]+u u [ -
-
]�NFKCzc
X.509 Name objects may not contain unassigned code points
z�
X.509 Name objects may not contain change display or
zzzzdeprecated characters
zc
X.509 Name objects may not contain private use characters
zf
X.509 Name objects may not contain non-character code points
zb
X.509 Name objects may not contain surrogate code points
u �zf
X.509 Name objects may not contain the replacement character
FTr r z{
X.509 Name object contains a malformed bidirectional
sequence
z +z rW )�re�sub�sys�
maxunicode�replace�joinr� �
stringprepZ map_table_b2� unicodedata� normalizeZ in_table_a1r` r Z in_table_c8Z in_table_c3Z in_table_c4Z in_table_c5Z in_table_d1Z in_table_d2�strip)r4 �string�charZhas_r_and_al_catZ has_l_catZfirst_is_r_and_alZlast_is_r_and_alr3 r3 r6 r� � s^
#z"NameTypeAndValue._ldap_string_prep)r{ rG )rJ rK rL r� r r} � _oid_pairr� r! r rQ r1 �
_oid_specsr� r] r� r7 r; r� r3 r3 r3 r6 r� L sF r� c @ sX e Z d Z e Z e d d � � Z d d � Z d d � Z d d � Z d d
� Z
d S) �RelativeDistinguishedNamec C sZ g } | j | � } x5 t | j � � D]! } | j d | | | f � q( Wd j | � S)zb
:return:
A unicode string that can be used as a dict key or in a set
z%s: %s� )� _get_values�sorted�keys�appendr� )r4 �outputr| �keyr3 r3 r6 �hashable s
z"RelativeDistinguishedName.hashablec C s | | k S)Nr3 )r4 r5 r3 r3 r6 r7 s z RelativeDistinguishedName.__ne__c C s� t | t � s d St | � t | � k r/ d S| j | � } | j | � } | | k r] d S| j | � } | j | � } x& | D] } | | | | k r� d Sq� Wd S)z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another RelativeDistinguishedName object
:return:
A boolean
FT)r8 r� rp �
_get_typesr� )r4 r5 Z
self_typesZ other_typesZ self_valuesZ other_valuesZ
type_name_r3 r3 r6 r; s
z RelativeDistinguishedName.__eq__c C s t d d � | D� � S)z�
Returns a set of types contained in an RDN
:param rdn:
A RelativeDistinguishedName object
:return:
A set object with unicode strings of NameTypeAndValue type field
values
c S s g | ] } | d j � q S)r{ )rN )�.0�ntvr3 r3 r6 �
<listcomp>H s z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rI )r4 �rdnr3 r3 r6 r� < s z$RelativeDistinguishedName._get_typesc s! i � � f d d � | D� � S)a$
Returns a dict of prepped values contained in an RDN
:param rdn:
A RelativeDistinguishedName object
:return:
A dict object with unicode strings of NameTypeAndValue value field
values that have been prepped for comparison
c s2 g | ]( } � j | d j | j f g � � q S)r{ )�updaterN r� )r� r� )r� r3 r6 r� W s z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r3 )r4 r� r3 )r� r6 r� J s z%RelativeDistinguishedName._get_valuesN) rJ rK rL r� r r] r� r7 r; r� r� r3 r3 r3 r6 r� s r� c @ s@ e Z d Z e Z e d d � � Z d d � Z d d � Z d S)� RDNSequencec C s d j d d � | D� � S)zb
:return:
A unicode string that can be used as a dict key or in a set
� c s s | ] } | j Vq d S)N)r� )r� r� r3 r3 r6 � <genexpr>h s z'RDNSequence.hashable.<locals>.<genexpr>)r� )r4 r3 r3 r6 r� ^ s
zRDNSequence.hashablec C s | | k S)Nr3 )r4 r5 r3 r3 r6 r7 j s zRDNSequence.__ne__c C sd t | t � s d St | � t | � k r/ d Sx. t | � D] \ } } | | | k r< d Sq< Wd S)z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another RDNSequence object
:return:
A boolean
FT)r8 r� rp � enumerate)r4 r5 r� Zself_rdnr3 r3 r6 r; m s zRDNSequence.__eq__N) rJ rK rL r� r r] r� r7 r; r3 r3 r3 r6 r� [ s r� c @ s� e Z d Z d e f g Z d Z d Z d Z e d d d � � Z e
d d � � Z d d � Z d
d � Z
d d
� Z e
d d � � Z e
d d � � Z d d � Z e
d d � � Z e
d d � � Z d S)r� rO NFc C sB g } | s d } t } n d } t } t t | j � d d d � �� } x� | j � D]� \ } } t j | � } | d k r� t | � } no | d k r� t | � } nT | t d d d
g � k r� t
d d d t | � � } n t
d | d | | � � } | j t t
d
| d | i � g � � qX W| d d d t | � � S)aS
Creates a Name object from a dict of unicode string keys and values.
The keys should be from NameType._map, or a dotted-integer OID unicode
string.
:param name_dict:
A dict of name information, e.g. {"common_name": "Will Bond",
"country_name": "US", "organization": "Codex Non Sufficit LC"}
:param use_printable:
A bool - if PrintableString should be used for encoding instead of
UTF8String. This is for backwards compatiblity with old software.
:return:
An x509.Name object
r� r� r� c S s t j | d � S)Nr )r� r� )�itemr3 r3 r6 �<lambda>� s z Name.build.<locals>.<lambda>r� r� r� r� r� r� rG r{ rO )r) r! r r� �itemsr� r� rQ r1 rI r� r� r� r� r� ) r� Z name_dictZ
use_printableZrdnsZ
encoding_nameZencoding_class�attribute_nameZattribute_valuerG r3 r3 r6 �build� s8 z
Name.buildc C s
| j j S)zb
:return:
A unicode string that can be used as a dict key or in a set
)�chosenr� )r4 r3 r3 r6 r� � s z
Name.hashablec C s
t | j � S)N)rp r� )r4 r3 r3 r6 �__len__� s z Name.__len__c C s | | k S)Nr3 )r4 r5 r3 r3 r6 r7 � s z Name.__ne__c C s# t | t � s d S| j | j k S)z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another Name object
:return:
A boolean
F)r8 r� r� )r4 r5 r3 r3 r6 r; � s z Name.__eq__c C s� | j d k r� t � | _ x� | j j D]� } x| | D]t } | d } | | j k r� | j | } t | t � s� | g } | j | <| j | d � q5 | d | j | <q5 Wq( W| j S)Nr{ rG )rq r r� rN r8 �listr� )r4 r� �type_val�
field_name�existingr3 r3 r6 rN � s
z Name.nativec C su | j d k rnt � } d } xx | j D]m } xd | D]\ } | d j } | } | | k r� | | g | | <| | j | d � q5 | d | | <q5 Wq( Wg } | j � } | d k r� t t | � � } x> | D]6 } | | } | j | � }
| j d | |
f � q� Wd } x* | D]" } | j d � d k rd } PqW| sId
n d }
|
j
| d d d
� � | _ | j S)zg
:return:
A human-friendly unicode string containing the parts of the name
Nr{ rG r� z%s: %sF�,r Tz, z; rW rW ) �_human_friendlyr r� r� r� r� �reversedr� �_recursive_humanizerX r� )r4 �dataZ
last_fieldr� r� r� Zto_joinr� r� rG Z native_valueZ has_comma�element� separatorr3 r3 r6 r� � s6
zName.human_friendlyc s< t | t � r5 d j t � f d d � | D� � � S| j S)z�
Recursively serializes data compiled from the RDNSequence
:param value:
An Asn1Value object, or a list of Asn1Value objects
:return:
A unicode string
z, c s g | ] } � j | � � q Sr3 )r� )r� Z sub_value)r4 r3 r6 r� - s z,Name._recursive_humanize.<locals>.<listcomp>)r8 r� r� r� rN )r4 rG r3 )r4 r6 r� s zName._recursive_humanizec C s4 | j d k r- t j | j � � j � | _ | j S)zZ
:return:
The SHA1 hash of the DER-encoded bytes of this name
N)�_sha1�hashlib�sha1�dump�digest)r4 r3 r3 r6 r� 1 s z Name.sha1c C s4 | j d k r- t j | j � � j � | _ | j S)z]
:return:
The SHA-256 hash of the DER-encoded bytes of this name
N)�_sha256r� �sha256r� r� )r4 r3 r3 r6 r� < s z Name.sha256)rJ rK rL r� r� r� r� r� r� r� r] r� r� r7 r; rN r� r� r� r� r3 r3 r3 r6 r� � s < ' r� c @ s7 e Z d Z d e f d e d d d d i f g Z d S)� AnotherNameZtype_idrG r� �explicitr� r N)rJ rK rL r r r} r3 r3 r3 r6 r� H s r� c @ s4 e Z d Z d Z d Z d e f d e f g Z d S)� CountryNamer �
x121_dcc_code�iso_3166_alpha2_codeN)rJ rK rL �class_r� r r! r� r3 r3 r3 r6 r� O s r� c @ s4 e Z d Z d Z d Z d e f d e f g Z d S)�AdministrationDomainNamer ri �numeric� printableN)rJ rK rL r r� r r! r� r3 r3 r3 r6 r Y s r c @ s( e Z d Z d e f d e f g Z d S)�PrivateDomainNamer r N)rJ rK rL r r! r� r3 r3 r3 r6 r c s r c @ s� e Z d Z d e d d d d i f d e d d d d d d i f d
e d d d d d d i f d e d d d d
d d i f g Z d S)� PersonalNamer� r� r� r� r r� r r� Tr� ri r� r� N)rJ rK rL r! r} r3 r3 r3 r6 r j s r c @ s� e Z d Z d e d d d d i f d e d d d d d d i f d
e d d d d d d i f d e d d d d
d d i f g Z d S)�TeletexPersonalNamer� r� r� r� r r� r r� Tr� ri r� r� N)rJ rK rL r& r} r3 r3 r3 r6 r s s r c @ s e Z d Z e Z d S)�OrganizationalUnitNamesN)rJ rK rL r! r r3 r3 r3 r6 r | s r c @ s e Z d Z e Z d S)� TeletexOrganizationalUnitNamesN)rJ rK rL r& r r3 r3 r3 r6 r � s r c @ s e Z d Z d e d d i f d e d d i f d e d d d d d d i f d
e d d d d d d i f d e d d
d d d d i f d e d d d d d d i f d e d d d d d d i f d e d d d d d d i f d e d d d d d d i f g Z
d S)�BuiltInStandardAttributesr� r� TZadministration_domain_nameZnetwork_addressr� r� r� r Zterminal_identifierr Zprivate_domain_namer� ri r� r� Znumeric_user_identifierrv Z
personal_namer� Zorganizational_unit_namesr� N) rJ rK rL r� r r r! r r r r} r3 r3 r3 r6 r � s r c @ s( e Z d Z d e f d e f g Z d S)� BuiltInDomainDefinedAttributer{ rG N)rJ rK rL r! r} r3 r3 r3 r6 r
� s r
c @ s e Z d Z e Z d S)� BuiltInDomainDefinedAttributesN)rJ rK rL r
r r3 r3 r3 r6 r � s r c @ s( e Z d Z d e f d e f g Z d S)� TeletexDomainDefinedAttributer{ rG N)rJ rK rL r& r} r3 r3 r3 r6 r � s r c @ s e Z d Z e Z d S)� TeletexDomainDefinedAttributesN)rJ rK rL r r r3 r3 r3 r6 r
� s r
c @ s( e Z d Z d e f d e f g Z d S)�PhysicalDeliveryCountryNamer� r� N)rJ rK rL r r! r� r3 r3 r3 r6 r � s r c @ s( e Z d Z d e f d e f g Z d S)�
PostalCodeZ numeric_codeZprintable_codeN)rJ rK rL r r! r� r3 r3 r3 r6 r � s r c @ s: e Z d Z d e d d i f d e d d i f g Z d S)� PDSParameterr� r� Tr� N)rJ rK rL r! r& r} r3 r3 r3 r6 r � s r c @ s e Z d Z e Z d S)�PrintableAddressN)rJ rK rL r! r r3 r3 r3 r6 r � s r c @ s: e Z d Z d e d d i f d e d d i f g Z d S)�UnformattedPostalAddressZprintable_addressr� Tr� N)rJ rK rL r r& r} r3 r3 r3 r6 r � s r c @ sL e Z d Z d e d d d d i f d e d d d d d d i f g Z d
S) � E1634Address�numberr� r� r� r Z sub_addressr r� TN)rJ rK rL r r} r3 r3 r3 r6 r � s r c @ s e Z d Z e Z d S)�
NAddressesN)rJ rK rL r r r3 r3 r3 r6 r � s r c
@ s� e Z d Z d e d d d d d d i f d e d d d d d d i f d
e d d d d d d i f d e d d d d
i f g Z d S)�PresentationAddressZ
p_selectorr� r� r� r r� TZ
s_selectorr Z
t_selectorri Z n_addressesr� N)rJ rK rL r r r} r3 r3 r3 r6 r � s r c @ s7 e Z d Z d e f d e d d d d i f g Z d S)�ExtendedNetworkAddressZe163_4_addressZ psap_addressr� r� r� r N)rJ rK rL r r r� r3 r3 r3 r6 r � s r c @ s: e Z d Z d d d d d d d d d d
d d i Z d
S)� TerminalTyper� Ztelexrv Zteletexr� Z g3_facsimiler� Z g4_facsimiler� Z ia5_terminalrj ZvideotexN)rJ rK rL r� r3 r3 r3 r6 r � s r c . @ s� e Z d Z d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" d# d$ d% d& d' d( d) d* d+ d, d- d. i Z d/ S)0�ExtensionAttributeTyper r� ri �teletex_common_namer� �teletex_organization_namerv �teletex_personal_namer� � teletex_organization_unit_namesr� �!teletex_domain_defined_attributesr� �pds_namerj � physical_delivery_country_name� r� �
� physical_delivery_office_name� � physical_delivery_office_number� � extension_of_address_components�
� physical_delivery_personal_name� �#physical_delivery_organization_name� �.extension_physical_delivery_address_componentsru �unformatted_postal_address� r� � �post_office_box_addressr2 �poste_restante_address� �unique_postal_name� �local_postal_attributes� �extended_network_address� �
terminal_typeN)rJ rK rL r� r3 r3 r3 r6 r � s. r c . @ s� e Z d Z d e d d d d i f d e d d d d i f g Z d! Z d e d
e d e d e d
e
d e d e d e d e
d e d e d e d e d e d e d e d e d e d e d e d e d e d e i Z d S)"�ExtensionAttribute�extension_attribute_typer� r� r� r �extension_attribute_valuer� r r� r r r r r r r r� r# r% r' r) r+ r- r. r� r1 r2 r4 r6 r8 r: N)r< r= )rJ rK rL r r r} r� r! r& r r r
r r r r r r r� r3 r3 r3 r6 r;
s4 r; c @ s e Z d Z e Z d S)�ExtensionAttributesN)rJ rK rL r; r r3 r3 r3 r6 r> , s r> c @ sC e Z d Z d e f d e d d i f d e d d i f g Z d S)� ORAddressZ built_in_standard_attributesZ"built_in_domain_defined_attributesr� TZextension_attributesN)rJ rK rL r r r> r} r3 r3 r3 r6 r? 0 s r? c @ sL e Z d Z d e d d d d d d i f d e d d d d i f g Z d
S) � EDIPartyNameZ
name_assignerr� r� r� r r� TZ
party_namer N)rJ rK rL r� r} r3 r3 r3 r6 r@ 8 s r@ c @ s e Z d Z d e d d d d i f d e d d d d i f d e d d d d i f d
e d d d d i f d e d d
d d i f d e d d d d i f d e d d d d i f d e
d d d d i f d e d d d d i f g Z d d � Z
d d � Z d S) � GeneralName�
other_namer� r� r� r Z rfc822_namer �dns_nameri � x400_addressr� Zdirectory_namer� rv �edi_party_namer� �uniform_resource_identifierr� �
ip_addressr� Z
registered_idrj c C s | | k S)Nr3 )r4 r5 r3 r3 r6 r7 L s zGeneralName.__ne__c C st | j d k r' t t d | j � � � | j d k rN t t d | j � � � | j | j k rd d S| j | j k S) z�
Does not support other_name, x400_address or edi_party_name
:param other:
The other GeneralName to compare to
:return:
A boolean
rB rD rE zr
Comparison is not supported for GeneralName objects of
choice %s
za
Comparison is not supported for GeneralName objects of choice
%sF)rB rD rE )rB rD rE )r� r` r r� )r4 r5 r3 r3 r6 r; O s zGeneralName.__eq__N)rJ rK rL r� rQ r1 r? r� r@ rM r_ r r� r7 r; r3 r3 r3 r6 rA ? s rA c @ s e Z d Z e Z d S)� GeneralNamesN)rJ rK rL rA r r3 r3 r3 r6 rH q s rH c @ s( e Z d Z d e f d e f g Z d S)�TimeZutc_timeZ general_timeN)rJ rK rL r( r r� r3 r3 r3 r6 rI u s rI c @ s( e Z d Z d e f d e f g Z d S)�Validityr� r� N)rJ rK rL rI r} r3 r3 r3 r6 rJ | s rJ c @ s: e Z d Z d e d d i f d e d d i f g Z d S)�BasicConstraints�ca�defaultF�path_len_constraintr� TN)rJ rK rL r r r} r3 r3 r3 r6 rK � s rK c
@ sp e Z d Z d e d d d d d d i f d e d d d d d d i f d
e d d d d d d i f g Z d S)
�AuthorityKeyIdentifier�key_identifierr� r� r� r r� T�authority_cert_issuerr � authority_cert_serial_numberri N)rJ rK rL r rH r r} r3 r3 r3 r6 rO � s rO c @ sF e Z d Z d e d d d d i f d e d d d d i f g Z d S) �DistributionPointName� full_namer� r� r� r �name_relative_to_crl_issuerr N)rJ rK rL rH r� r� r3 r3 r3 r6 rS � s rS c @ sL e Z d Z d d d d d d d d d d
d d d
d d d d d i Z d S)� ReasonFlagsr Zunusedr Zkey_compromiseri Z
ca_compromiser� Zaffiliation_changedrv Z
supersededr� Zcessation_of_operationr� Zcertificate_holdr� Zprivilege_withdrawnrj Z
aa_compromiseN)rJ rK rL r� r3 r3 r3 r6 rV � s rV c
@ s[ e Z d Z d e f d e d d d d d d i f d e d d d d d
d i f g Z d S)
�GeneralSubtree�baseZminimumr� r� r� r rM Zmaximumr r� TN)rJ rK rL rA r r} r3 r3 r3 r6 rW � s rW c @ s e Z d Z e Z d S)�GeneralSubtreesN)rJ rK rL rW r r3 r3 r3 r6 rY � s rY c @ sR e Z d Z d e d d d d d d i f d e d d d d d d i f g Z d
S) �NameConstraintsZpermitted_subtreesr� r� r� r r� TZexcluded_subtreesr N)rJ rK rL rY r} r3 r3 r3 r6 rZ � s rZ c
@ s� e Z d Z d e d d d d d d i f d e d d d d
d d i f d e d d d d d d i f g Z d
Z e d d � � Z d S)�DistributionPoint�distribution_pointr� r� r� r r� TZreasonsr� r Z
crl_issuerri Fc C s� | j d k r� d | _ | d } | j d k rC t t d � � � xI | j D]> } | j d k rM | j } | d d � d k rM | | _ PqM W| j S)
z_
:return:
None or a unicode string of the distribution point's URL
FNr\ rT z�
CRL distribution points that are relative to the issuer are
not supported
rF r r� zhttp://)�_urlr� r` r r� rN )r4 r� � general_name�urlr3 r3 r6 r_ � s
zDistributionPoint.urlN)
rJ rK rL rS rV rH r} r] r] r_ r3 r3 r3 r6 r[ � s
$r[ c @ s e Z d Z e Z d S)�CRLDistributionPointsN)rJ rK rL r[ r r3 r3 r3 r6 r` � s r` c @ s: e Z d Z d e f d e f d e f d e f g Z d S)� DisplayTextr� Zvisible_stringr� r� N)rJ rK rL r r* r r) r� r3 r3 r3 r6 ra � s ra c @ s e Z d Z e Z d S)�
NoticeNumbersN)rJ rK rL r r r3 r3 r3 r6 rb � s rb c @ s( e Z d Z d e f d e f g Z d S)�NoticeReferenceZ organizationZnotice_numbersN)rJ rK rL ra rb r} r3 r3 r3 r6 rc � s rc c @ s: e Z d Z d e d d i f d e d d i f g Z d S)�
UserNoticeZ
notice_refr� TZ
explicit_textN)rJ rK rL rc ra r} r3 r3 r3 r6 rd � s rd c @ s" e Z d Z d d d d i Z d S)�PolicyQualifierIdz1.3.6.1.5.5.7.2.1� certification_practice_statementz1.3.6.1.5.5.7.2.2� user_noticeN)rJ rK rL r� r3 r3 r3 r6 re � s re c @ s@ e Z d Z d e f d e f g Z d Z d e d e i Z d S)�PolicyQualifierInfo�policy_qualifier_id� qualifierrf rg N)ri rj )
rJ rK rL re r r} r� r rd r� r3 r3 r3 r6 rh s
rh c @ s e Z d Z e Z d S)�PolicyQualifierInfosN)rJ rK rL rh r r3 r3 r3 r6 rk s rk c @ s e Z d Z d d i Z d S)�PolicyIdentifierz 2.5.29.32.0Z
any_policyN)rJ rK rL r� r3 r3 r3 r6 rl s rl c @ s1 e Z d Z d e f d e d d i f g Z d S)�PolicyInformationZpolicy_identifierZpolicy_qualifiersr� TN)rJ rK rL rl rk r} r3 r3 r3 r6 rm s rm c @ s e Z d Z e Z d S)�CertificatePoliciesN)rJ rK rL rm r r3 r3 r3 r6 rn # s rn c @ s( e Z d Z d e f d e f g Z d S)�
PolicyMappingZissuer_domain_policyZsubject_domain_policyN)rJ rK rL rl r} r3 r3 r3 r6 ro ' s ro c @ s e Z d Z e Z d S)�PolicyMappingsN)rJ rK rL ro r r3 r3 r3 r6 rp . s rp c @ sR e Z d Z d e d d d d d d i f d e d d d d d d i f g Z d
S) �PolicyConstraintsZrequire_explicit_policyr� r� r� r r� TZinhibit_policy_mappingr N)rJ rK rL r r} r3 r3 r3 r6 rq 2 s rq c � @ s� e Z d Z d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" d# d$ d% d& d' d( d) d* d+ d, d- d. d/ d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 d: d; d< d= d> d? d@ dA dB dC dD dE dF dG dH dI dJ dK dL dM dN dO dP dQ dR dS dT dU dV dW dX dY dZ d[ d\ d] d^ d_ d` da db dc dd de df dg dh di dj dk dl dm dn do dp dq dr ds dt du dv dw dx dy dz d{ d| d} d~ d d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� d� iM Z d� S)�� KeyPurposeIdz 2.5.29.37.0Zany_extended_key_usagez1.3.6.1.5.5.7.3.1Z server_authz1.3.6.1.5.5.7.3.2Z client_authz1.3.6.1.5.5.7.3.3Z code_signingz1.3.6.1.5.5.7.3.4Zemail_protectionz1.3.6.1.5.5.7.3.5Zipsec_end_systemz1.3.6.1.5.5.7.3.6Z ipsec_tunnelz1.3.6.1.5.5.7.3.7Z
ipsec_userz1.3.6.1.5.5.7.3.8�
time_stampingz1.3.6.1.5.5.7.3.9Z ocsp_signingz1.3.6.1.5.5.7.3.10Zdvcsz1.3.6.1.5.5.7.3.13Z eap_over_pppz1.3.6.1.5.5.7.3.14Z eap_over_lanz1.3.6.1.5.5.7.3.15Z scvp_serverz1.3.6.1.5.5.7.3.16Z scvp_clientz1.3.6.1.5.5.7.3.17Z ipsec_ikez1.3.6.1.5.5.7.3.18Z capwap_acz1.3.6.1.5.5.7.3.19Z
capwap_wtpz1.3.6.1.5.5.7.3.20Z
sip_domainz1.3.6.1.5.5.7.3.21Zsecure_shell_clientz1.3.6.1.5.5.7.3.22Zsecure_shell_serverz1.3.6.1.5.5.7.3.23Z send_routerz1.3.6.1.5.5.7.3.24Zsend_proxied_routerz1.3.6.1.5.5.7.3.25Z
send_ownerz1.3.6.1.5.5.7.3.26Zsend_proxied_ownerz1.3.6.1.5.5.7.3.27Zcmc_caz1.3.6.1.5.5.7.3.28Zcmc_raz1.3.6.1.5.5.7.3.29Z cmc_archivez1.3.6.1.5.5.7.3.30Zbgpspec_routerz1.3.6.1.4.1.311.10.3.1Z microsoft_trust_list_signingz1.3.6.1.4.1.311.10.3.2Z microsoft_time_stamp_signingz1.3.6.1.4.1.311.10.3.3Zmicrosoft_server_gatedz1.3.6.1.4.1.311.10.3.3.1Zmicrosoft_serializedz1.3.6.1.4.1.311.10.3.4Z
microsoft_efsz1.3.6.1.4.1.311.10.3.4.1Zmicrosoft_efs_recoveryz1.3.6.1.4.1.311.10.3.5Zmicrosoft_whqlz1.3.6.1.4.1.311.10.3.6Z
microsoft_nt5z1.3.6.1.4.1.311.10.3.7Zmicrosoft_oem_whqlz1.3.6.1.4.1.311.10.3.8Zmicrosoft_embedded_ntz1.3.6.1.4.1.311.10.3.9Zmicrosoft_root_list_signerz1.3.6.1.4.1.311.10.3.10Z!microsoft_qualified_subordinationz1.3.6.1.4.1.311.10.3.11Zmicrosoft_key_recoveryz1.3.6.1.4.1.311.10.3.12Zmicrosoft_document_signingz1.3.6.1.4.1.311.10.3.13Zmicrosoft_lifetime_signingz1.3.6.1.4.1.311.10.3.14Z microsoft_mobile_device_softwarez1.2.840.113635.100.1.2Zapple_x509_basicz1.2.840.113635.100.1.3Z apple_sslz1.2.840.113635.100.1.4Zapple_local_cert_genz1.2.840.113635.100.1.5Z
apple_csr_genz1.2.840.113635.100.1.6Zapple_revocation_crlz1.2.840.113635.100.1.7Zapple_revocation_ocspz1.2.840.113635.100.1.8Z apple_smimez1.2.840.113635.100.1.9Z apple_eapz1.2.840.113635.100.1.10Z apple_software_update_signingz1.2.840.113635.100.1.11Z apple_ipsecz1.2.840.113635.100.1.12Z apple_ichatz1.2.840.113635.100.1.13Zapple_resource_signingz1.2.840.113635.100.1.14Zapple_pkinit_clientz1.2.840.113635.100.1.15Zapple_pkinit_serverz1.2.840.113635.100.1.16Zapple_code_signingz1.2.840.113635.100.1.17Zapple_package_signingz1.2.840.113635.100.1.18Zapple_id_validationz1.2.840.113635.100.1.20Zapple_time_stampingz1.2.840.113635.100.1.21Zapple_revocationz1.2.840.113635.100.1.22Zapple_passbook_signingz1.2.840.113635.100.1.23Zapple_mobile_storez1.2.840.113635.100.1.24Zapple_escrow_servicez1.2.840.113635.100.1.25Zapple_profile_signerz1.2.840.113635.100.1.26Zapple_qa_profile_signerz1.2.840.113635.100.1.27Zapple_test_mobile_storez1.2.840.113635.100.1.28Zapple_otapki_signerz1.2.840.113635.100.1.29Zapple_test_otapki_signerz1.2.840.113625.100.1.30Z)apple_id_validation_record_signing_policyz1.2.840.113625.100.1.31Zapple_smp_encryptionz1.2.840.113625.100.1.32Zapple_test_smp_encryptionz1.2.840.113635.100.1.33Zapple_server_authenticationz1.2.840.113635.100.1.34Zapple_pcs_escrow_serviceN)rJ rK rL r� r3 r3 r3 r6 rr 9 s� rr c @ s e Z d Z e Z d S)�ExtKeyUsageSyntaxN)rJ rK rL rr r r3 r3 r3 r6 rt � s rt c @ s. e Z d Z d d d d d d d d i Z d S)
� AccessMethodz1.3.6.1.5.5.7.48.1�ocspz1.3.6.1.5.5.7.48.2Z
ca_issuersz1.3.6.1.5.5.7.48.3rs z1.3.6.1.5.5.7.48.5Z
ca_repositoryN)rJ rK rL r� r3 r3 r3 r6 ru � s ru c @ s( e Z d Z d e f d e f g Z d S)�AccessDescription�
access_method�access_locationN)rJ rK rL ru rA r} r3 r3 r3 r6 rw � s rw c @ s e Z d Z e Z d S)�AuthorityInfoAccessSyntaxN)rJ rK rL rw r r3 r3 r3 r6 rz � s rz c @ s e Z d Z e Z d S)�SubjectInfoAccessSyntaxN)rJ rK rL rw r r3 r3 r3 r6 r{ � s r{ c @ s e Z d Z e Z d S)�FeaturesN)rJ rK rL r r r3 r3 r3 r6 r| � s r| c @ s( e Z d Z d e f d e f g Z d S)�EntrustVersionInfoZ entrust_versZentrust_info_flagsN)rJ rK rL r r r} r3 r3 r3 r6 r} � s r} c @ sF e Z d Z d d d d d d d d d d
d d d
d d d i Z d S)�NetscapeCertificateTyper Z
ssl_clientr Z
ssl_serverri �emailr� Zobject_signingrv �reservedr� Zssl_car� Zemail_car� Zobject_signing_caN)rJ rK rL r� r3 r3 r3 r6 r~ � s r~ c , @ s� e Z d Z d d d d d d d d d d
d d d
d d d d d d d d d d d d d d d d d d d d! d" d# d$ d% d& d' d( d) d* d+ d, i Z d- S).� ExtensionIdz2.5.29.9� subject_directory_attributesz 2.5.29.14rP z 2.5.29.15� key_usagez 2.5.29.16�private_key_usage_periodz 2.5.29.17�subject_alt_namez 2.5.29.18�issuer_alt_namez 2.5.29.19�basic_constraintsz 2.5.29.30�name_constraintsz 2.5.29.31�crl_distribution_pointsz 2.5.29.32�certificate_policiesz 2.5.29.33�policy_mappingsz 2.5.29.35�authority_key_identifierz 2.5.29.36�policy_constraintsz 2.5.29.37�extended_key_usagez 2.5.29.46� freshest_crlz 2.5.29.54�inhibit_any_policyz1.3.6.1.5.5.7.1.1� authority_information_accessz1.3.6.1.5.5.7.1.11�subject_information_accessz1.3.6.1.5.5.7.1.24� tls_featurez1.3.6.1.5.5.7.48.1.5�
ocsp_no_checkz1.2.840.113533.7.65.0�entrust_version_extensionz2.16.840.1.113730.1.1�netscape_certificate_typeN)rJ rK rL r� r3 r3 r3 r6 r� � s, r� c , @ s� e Z d Z d e f d e d d i f d e f g Z d Z d e d e d e
d e d
e d e d e
d
e d e d e d e d e d e d e d e d e d e d e d e d e d e d e i Z d S) � Extension�extn_id�criticalrM F�
extn_valuer� rP r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� N)r� r� ) rJ rK rL r� r r r} r� r~ r r� r� rH rK rZ r` rn rp rO rq rt r rz r{ r| r r} r~ r� r3 r3 r3 r6 r� � s4 r� c @ s e Z d Z e Z d S)�
ExtensionsN)rJ rK rL r� r r3 r3 r3 r6 r� s r� c @ s( e Z d Z d d d d d d i Z d S)�Versionr �v1r Zv2ri Zv3N)rJ rK rL r� r3 r3 r3 r6 r� s r� c @ s� e Z d Z d e d d d d d d i f d e f d e f d
e f d e f d e f d
e f d e d d d d d d i f d e d d d d d d i f d e
d d d d d d i f g
Z d S)�TbsCertificate�versionr� r� r� r rM r� r� � signature�issuerZvalidity�subject�subject_public_key_infoZissuer_unique_idr� r r� TZsubject_unique_idri �
extensionsr� N) rJ rK rL r� r r r� rJ r, r r� r} r3 r3 r3 r6 r� s r� c @ s- e Z d Z d e f d e f d e f g Z d Z d Z d Z d Z
d Z d Z d Z
d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z d Z! d Z" d Z# d Z$ d Z% d d � Z& e' d d � � Z( e' d
d � � Z) e' d d
� � Z* e' d d � � Z+ e' d d � � Z, e' d d � � Z- e' d d � � Z. e' d d � � Z/ e' d d � � Z0 e' d d � � Z1 e' d d � � Z2 e' d d � � Z3 e' d d! � � Z4 e' d" d# � � Z5 e' d$ d% � � Z6 e' d& d' � � Z7 e' d( d) � � Z8 e' d* d+ � � Z9 e' d, d- � � Z: e' d. d/ � � Z; e' d0 d1 � � Z< e' d2 d3 � � Z= e' d4 d5 � � Z> e' d6 d7 � � Z? e' d8 d9 � � Z@ e' d: d; � � ZA e' d< d= � � ZB e' d> d? � � ZC e' d@ dA � � ZD e' dB dC � � ZE e' dD dE � � ZF e' dF dG � � ZG e' dH dI � � ZH dJ dK � ZI e' dL dM � � ZJ e' dN dO � � ZK e' dP dQ � � ZL e' dR dS � � ZM e' dT dU � � ZN e' dV dW � � ZO e' dX dY � � ZP e' dZ d[ � � ZQ e' d\ d] � � ZR e' d^ d_ � � ZS d` da � ZT db dc � ZU dd de � ZV d S)f� Certificate�tbs_certificate�signature_algorithm�signature_valueFNc C s� t � | _ xp | d d D]` } | d j } d | } t | | � r^ t | | | d j � | d j r | j j | � q Wd | _ d S) zv
Sets common named extensions to private attributes and creates a list
of critical extensions
r� r� r� z _%s_valuer� r� TN)rI �_critical_extensionsrN �hasattr�setattr�parsed�add�_processed_extensions)r4 � extensionr� r� r3 r3 r6 �_set_extensionsP s
zCertificate._set_extensionsc C s | j s | j � | j S)z�
Returns a set of the names (or OID if not a known extension) of the
extensions marked as critical
:return:
A set of unicode strings
)r� r� r� )r4 r3 r3 r6 �critical_extensionsb s
z Certificate.critical_extensionsc C s | j s | j � | j S)z�
This extension is used to contain additional identification attributes
about the subject.
:return:
None or an Attributes object
)r� r� �_key_identifier_value)r4 r3 r3 r6 �"subject_directory_attributes_valuep s
z.Certificate.subject_directory_attributes_valuec C s | j s | j � | j S)z�
This extension is used to help in creating certificate validation paths.
It contains an identifier that should generally, but is not guaranteed
to, be unique.
:return:
None or an OctetString object
)r� r� r� )r4 r3 r3 r6 �key_identifier_value~ s
z Certificate.key_identifier_valuec C s | j s | j � | j S)z�
This extension is used to define the purpose of the public key
contained within the certificate.
:return:
None or a KeyUsage
)r� r� �_key_usage_value)r4 r3 r3 r6 �key_usage_value� s
zCertificate.key_usage_valuec C s | j s | j � | j S)aT
This extension allows for additional names to be associate with the
subject of the certificate. While it may contain a whole host of
possible names, it is usually used to allow certificates to be used
with multiple different domain names.
:return:
None or a GeneralNames object
)r� r� �_subject_alt_name_value)r4 r3 r3 r6 �subject_alt_name_value� s
z"Certificate.subject_alt_name_valuec C s | j s | j � | j S)z�
This extension allows associating one or more alternative names with
the issuer of the certificate.
:return:
None or an x509.GeneralNames object
)r� r� �_issuer_alt_name_value)r4 r3 r3 r6 �issuer_alt_name_value� s
z!Certificate.issuer_alt_name_valuec C s | j s | j � | j S)a'
This extension is used to determine if the subject of the certificate
is a CA, and if so, what the maximum number of intermediate CA certs
after this are, before an end-entity certificate is found.
:return:
None or a BasicConstraints object
)r� r� �_basic_constraints_value)r4 r3 r3 r6 �basic_constraints_value� s
z#Certificate.basic_constraints_valuec C s | j s | j � | j S)z�
This extension is used in CA certificates, and is used to limit the
possible names of certificates issued.
:return:
None or a NameConstraints object
)r� r� �_name_constraints_value)r4 r3 r3 r6 �name_constraints_value� s
z"Certificate.name_constraints_valuec C s | j s | j � | j S)z�
This extension is used to help in locating the CRL for this certificate.
:return:
None or a CRLDistributionPoints object
extension
)r� r� � _crl_distribution_points_value)r4 r3 r3 r6 � crl_distribution_points_value� s
z)Certificate.crl_distribution_points_valuec C s | j s | j � | j S)a;
This extension defines policies in CA certificates under which
certificates may be issued. In end-entity certificates, the inclusion
of a policy indicates the issuance of the certificate follows the
policy.
:return:
None or a CertificatePolicies object
)r� r� �_certificate_policies_value)r4 r3 r3 r6 �certificate_policies_value� s
z&Certificate.certificate_policies_valuec C s | j s | j � | j S)z�
This extension allows mapping policy OIDs to other OIDs. This is used
to allow different policies to be treated as equivalent in the process
of validation.
:return:
None or a PolicyMappings object
)r� r� �_policy_mappings_value)r4 r3 r3 r6 �policy_mappings_value� s
z!Certificate.policy_mappings_valuec C s | j s | j � | j S)z�
This extension helps in identifying the public key with which to
validate the authenticity of the certificate.
:return:
None or an AuthorityKeyIdentifier object
)r� r� � _authority_key_identifier_value)r4 r3 r3 r6 � authority_key_identifier_value s
z*Certificate.authority_key_identifier_valuec C s | j s | j � | j S)z�
This extension is used to control if policy mapping is allowed and
when policies are required.
:return:
None or a PolicyConstraints object
)r� r� �_policy_constraints_value)r4 r3 r3 r6 �policy_constraints_value s
z$Certificate.policy_constraints_valuec C s | j s | j � | j S)z�
This extension is used to help locate any available delta CRLs
:return:
None or an CRLDistributionPoints object
)r� r� �_freshest_crl_value)r4 r3 r3 r6 �freshest_crl_value s
z Certificate.freshest_crl_valuec C s | j s | j � | j S)z�
This extension is used to prevent mapping of the any policy to
specific requirements
:return:
None or a Integer object
)r� r� �_inhibit_any_policy_value)r4 r3 r3 r6 �inhibit_any_policy_value, s
z$Certificate.inhibit_any_policy_valuec C s | j s | j � | j S)z�
This extension is used to define additional purposes for the public key
beyond what is contained in the basic constraints.
:return:
None or an ExtKeyUsageSyntax object
)r� r� �_extended_key_usage_value)r4 r3 r3 r6 �extended_key_usage_value: s
z$Certificate.extended_key_usage_valuec C s | j s | j � | j S)z�
This extension is used to locate the CA certificate used to sign this
certificate, or the OCSP responder for this certificate.
:return:
None or an AuthorityInfoAccessSyntax object
)r� r� �#_authority_information_access_value)r4 r3 r3 r6 �"authority_information_access_valueH s
z.Certificate.authority_information_access_valuec C s | j s | j � | j S)z�
This extension is used to access information about the subject of this
certificate.
:return:
None or a SubjectInfoAccessSyntax object
)r� r� �!_subject_information_access_value)r4 r3 r3 r6 � subject_information_access_valueV s
z,Certificate.subject_information_access_valuec C s | j s | j � | j S)z�
This extension is used to list the TLS features a server must respond
with if a client initiates a request supporting them.
:return:
None or a Features object
)r� r� �_tls_feature_value)r4 r3 r3 r6 �tls_feature_valued s
z Certificate.tls_feature_valuec C s | j s | j � | j S)a-
This extension is used on certificates of OCSP responders, indicating
that revocation information for the certificate should never need to
be verified, thus preventing possible loops in path validation.
:return:
None or a Null object (if present)
)r� r� �_ocsp_no_check_value)r4 r3 r3 r6 �ocsp_no_check_valuer s
z Certificate.ocsp_no_check_valuec C s | d j S)zE
:return:
A byte string of the signature
r� )rN )r4 r3 r3 r6 r� � s zCertificate.signaturec C s | d j S)zj
:return:
A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
r� )�signature_algo)r4 r3 r3 r6 r� � s zCertificate.signature_algoc C s | d j S)z�
:return:
A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
"sha384", "sha512", "sha512_224", "sha512_256"
r� )� hash_algo)r4 r3 r3 r6 r� � s zCertificate.hash_algoc C s | d d S)zT
:return:
The PublicKeyInfo object for this certificate
r� r� r3 )r4 r3 r3 r6 �
public_key� s zCertificate.public_keyc C s | d d S)zZ
:return:
The Name object for the subject of this certificate
r� r� r3 )r4 r3 r3 r6 r� � s zCertificate.subjectc C s | d d S)zY
:return:
The Name object for the issuer of this certificate
r� r� r3 )r4 r3 r3 r6 r� � s zCertificate.issuerc C s | d d j S)zT
:return:
An integer of the certificate's serial number
r� r� )rN )r4 r3 r3 r6 r� � s zCertificate.serial_numberc C s | j s
d S| j j S)z�
:return:
None or a byte string of the certificate's key identifier from the
key identifier extension
N)r� rN )r4 r3 r3 r6 rP � s zCertificate.key_identifierc C s? | j d k r8 | j j d t | j � j d � | _ | j S)z�
:return:
A byte string of the SHA-256 hash of the issuer concatenated with
the ascii character ":", concatenated with the serial number as
an ascii string
N� :rU )�_issuer_serialr� r� r
r� rA )r4 r3 r3 r6 �
issuer_serial� s )zCertificate.issuer_serialc C s | j s
d S| j d j S)z�
:return:
None or a byte string of the key_identifier from the authority key
identifier extension
NrP )r� rN )r4 r3 r3 r6 r� � s z$Certificate.authority_key_identifierc C s� | j d k r� | j } | r� | d j r� | j d d j } | j � } | j d j } | j d t | � j d � | _ n d | _ | j S)a;
:return:
None or a byte string of the SHA-256 hash of the isser from the
authority key identifier extension concatenated with the ascii
character ":", concatenated with the serial number from the
authority key identifier extension as an ascii string
FrQ r rR r� rU N)�_authority_issuer_serialr� rN r� Zuntagr� r
rA )r4 Zakivr� Zauthority_serialr3 r3 r6 �authority_issuer_serial� s
& z#Certificate.authority_issuer_serialc C s+ | j d k r$ | j | j � | _ | j S)z�
Returns complete CRL URLs - does not include delta CRLs
:return:
A list of zero or more DistributionPoint objects
N)�_crl_distribution_points�!_get_http_crl_distribution_pointsr� )r4 r3 r3 r6 r� � s z#Certificate.crl_distribution_pointsc C s+ | j d k r$ | j | j � | _ | j S)z�
Returns delta CRL URLs - does not include complete CRLs
:return:
A list of zero or more DistributionPoint objects
N)� _delta_crl_distribution_pointsr� r� )r4 r3 r3 r6 � delta_crl_distribution_points s z)Certificate.delta_crl_distribution_pointsc C s� g } | d k r g Sxi | D]a } | d } | t k r< q | j d k rN q x- | j D]" } | j d k rX | j | � qX Wq W| S)a?
Fetches the DistributionPoint object for non-relative, HTTP CRLs
referenced by the certificate
:param crl_distribution_points:
A CRLDistributionPoints object to grab the DistributionPoints from
:return:
A list of zero or more DistributionPoint objects
Nr\ rU rF )r+ r� r� r� )r4 r� r� r\ Zdistribution_point_namer^ r3 r3 r6 r� s
z-Certificate._get_http_crl_distribution_pointsc C s� | j s
g Sg } xr | j D]g } | d j d k r | d } | j d k rR q | j } | j � d d � d k r | j | � q W| S)zx
:return:
A list of zero or more unicode strings of the OCSP URLs for this
cert
rx rv ry rF r r� zhttp://)r� rN r� r: r� )r4 r� �entry�locationr_ r3 r3 r6 � ocsp_urls7 s
zCertificate.ocsp_urlsc C s� | j d k r� g | _ | j rl x� | j D]: } | j d k r+ | j | j k r+ | j j | j � q+ Wnv t j d � } xd | j j D]V } xM | D]E } | d j d k r� | d j } | j | � r� | j j | � q� Wq� W| j S)z�
:return:
A list of unicode strings of valid domain names for the certificate.
Wildcard certificates will have a domain in the form: *.example.com
NrC zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r{ r� rG )
�_valid_domainsr� r� rN r� r� �compiler� r� �match)r4 r^ �patternr� Zname_type_valuerG r3 r3 r6 �
valid_domainsM s !
zCertificate.valid_domainsc C s^ | j d k rW g | _ | j rW x3 | j D]( } | j d k r+ | j j | j � q+ W| j S)zj
:return:
A list of unicode strings of valid IP addresses for the certificate
NrG )�
_valid_ipsr� r� r� rN )r4 r^ r3 r3 r6 � valid_ipsp s zCertificate.valid_ipsc C s | j o | j d j S)zW
:return;
A boolean - if the certificate is marked as a CA
rL )r� rN )r4 r3 r3 r6 rL � s zCertificate.cac C s | j s
d S| j d j S)zT
:return;
None or an integer of the maximum path length
NrN )rL r� rN )r4 r3 r3 r6 �max_path_length� s zCertificate.max_path_lengthc C s+ | j d k r$ | j | j k | _ | j S)zx
:return:
A boolean - if the certificate is self-issued, as defined by RFC
5280
N)� _self_issuedr� r� )r4 r3 r3 r6 � self_issued� s zCertificate.self_issuedc C sm | j d k rf d | _ | j rf | j r] | j s? d | _ qf | j | j k rf d | _ n d | _ | j S)a�
:return:
A unicode string of "yes", "no" or "maybe". The "maybe" result will
be returned if the certificate does not contain a key identifier
extension, but is issued by the subject. In this case the
certificate signature will need to be verified using the subject
public key to determine a "yes" or "no" answer.
N�no�yes�maybe)� _self_signedr� rP r� )r4 r3 r3 r6 � self_signed� s zCertificate.self_signedc C s4 | j d k r- t j | j � � j � | _ | j S)zk
:return:
The SHA-1 hash of the DER-encoded bytes of this complete certificate
N)r� r� r� r� r� )r4 r3 r3 r6 r� � s zCertificate.sha1c C s# d j d d � t | j � D� � S)z�
:return:
A unicode string of the SHA-1 hash, formatted using hex encoding
with a space between each pair of characters, all uppercase
r� c s s | ] } d | Vq d S)z%02XNr3 )r� �cr3 r3 r6 r� � s z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r� r r� )r4 r3 r3 r6 �sha1_fingerprint� s z Certificate.sha1_fingerprintc C s4 | j d k r- t j | j � � j � | _ | j S)zy
:return:
The SHA-256 hash of the DER-encoded bytes of this complete
certificate
N)r� r� r� r� r� )r4 r3 r3 r6 r� � s zCertificate.sha256c C s� t | t � s* t t d t | � � � � | j d � j d � j � } | j d � d
k } | os t j
d | � } | o� | } | rA| j s� d S| j d � } x� | j D]� } | j d � j d � j � } | j d � } t
| � t
| � k r� q� | | k rd S| j | � }
|
r� | j | | � r� d Sq� Wd S| j sNd S| r]t j n t j } t | | � } xW | j D]L }
|
j d � d k r�t j n t j } t | |
� } | | k rd SqWd S) a
Check if a domain name or IP address is valid according to the
certificate
:param domain_ip:
A unicode string of a domain name or IP address
:return:
A boolean - if the domain or IP is valid for the certificate
zL
domain_ip must be a unicode string, not %s
r rU rd r z^\d+\.\d+\.\d+\.\d+$Fr< TrW rW )r8 r
r? r r rA r\ r: rX r� r� r� rk rp �_is_wildcard_domain�_is_wildcard_matchr� rm ro rn r0 )r4 Z domain_ipZencoded_domain_ipZis_ipv6Zis_ipv4Z is_domain�
domain_labelsZ valid_domainZencoded_valid_domain�valid_domain_labelsZ is_wildcardrt Z
normalized_ipZvalid_ipZ valid_familyZnormalized_valid_ipr3 r3 r6 �is_valid_domain_ip� sB ' z Certificate.is_valid_domain_ipc C sw | j d � d k r d S| j � j d � } | s8 d S| d j d � d k rU d S| d d d � d k rs d Sd S)
af
Checks if a domain is a valid wildcard according to
https://tools.ietf.org/html/rfc6125#section-6.4.3
:param domain:
A unicode string of the domain name, where any U-labels from an IDN
have been converted to A-labels
:return:
A boolean - if the domain is a valid wildcard domain
�*r Fr< r rv zxn--TrW )�countr: rk rX )r4 �domain�labelsr3 r3 r6 r�
s z Certificate._is_wildcard_domainc C s� | d } | d d � } | d } | d d � } | | k rD d S| d k rT d St j d | j d d � d � } | j | � r� d Sd S)
a�
Determines if the labels in a domain are a match for labels from a
wildcard valid domain name
:param domain_labels:
A list of unicode strings, with A-label form for IDNs, of the labels
in the domain name to check
:param valid_domain_labels:
A list of unicode strings, with A-label form for IDNs, of the labels
in a wildcard domain pattern
:return:
A boolean - if the domain matches the valid domain
r r NFr� T�^z.*�$)r� r� r� r� )r4 r� r� Zfirst_domain_labelZother_domain_labelsZwildcard_labelZother_valid_domain_labelsZwildcard_regexr3 r3 r6 r� <
s
#z Certificate._is_wildcard_match)WrJ rK rL r� r r r} r� r� Z _subject_directory_attributesr� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r] r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� rP r� r� r� r� r� r� r� r� r� rL r� r� r� r� r� r� r� r� r� r3 r3 r3 r6 r� ) s�
#
B !r� c @ s e Z d Z e Z d S)�KeyPurposeIdentifiersN)rJ rK rL rr r r3 r3 r3 r6 r f
s r c @ s e Z d Z e Z d S)� SequenceOfAlgorithmIdentifiersN)rJ rK rL r r r3 r3 r3 r6 r j
s r c @ s� e Z d Z d e d d i f d e d d d d d d i f d e d d i f d
e d d i f d e d d d d d d i f g Z d
S)�CertificateAuxZtrustr� TZrejectr� r� r� r �aliasZkeyidr5 r N)rJ rK rL r r) r r r} r3 r3 r3 r6 r n
s
r c @ s e Z d Z e e g Z d S)�TrustedCertificateN)rJ rK rL r� r Z _child_specsr3 r3 r3 r6 r x
s r )��__doc__�
__future__r r r r � encodingsr r� r� rm r� r� r� Z_errorsr Z_irir r
Z _ordereddictr �_typesr r
r Zalgosr r �corer r r r r r r r r r r r r r r r r! r" r# r$ r% r& r' r( r) r* r+ r� r, �utilr- r. r/ r0 r1 rM rQ r_ rz r~ r� r� r� r� r� r� r� r� r� r� r r r r r r r r
r r r
r r r r r r r r r r r r; r> r? r@ rA rH rI rJ rK rO rS rV rW rY rZ r[ r` ra rb rc rd re rh rk rl rm rn ro rp rq rr rt ru rw rz r{ r| r} r~ r� r� r� r� r� r� r r r r r3 r3 r3 r6 �<module> s� " � "59l� }�U*�
"2%
b
"� � � @