o j1@sBUddlmZddlZddlZddlZddlZddlZddlmZddl m Z ddlm Z ddlm Z m Z mZejdkrCddlmZnddlmZdd lmZmZdd lmZmZmZmZmZdd lmZdd lmZdd lm Z!ddlm"Z#ddlm$Z%ddlm&Z'ddlm(Z)gdZ*eej+ej,ej-ej.ej/fZ0eej1ej2ej3ej4ej5fZ6ee0e6fZ7ee8e de8ffZ9e%j:Z;dede.free)r<rr=rr:r) r?BIO_new BIO_s_memr@_ffinewBIO_new_mem_buflen_openssl_assertNULLgc)r8r<rAdatar6r6r7 _new_mem_bufts   rMr<bytescCs.td}t||}t|d|ddS)zO Copy the contents of an OpenSSL BIO object into a Python byte string. zchar**rN)rErFr?BIO_get_mem_datar8)r< result_buffer buffer_lengthr6r6r7_bio_to_strings  rRboundarywhenNonecCs@t|ts tdt|tjkt||}|dkrtddS)a The the time value of an ASN1 time object. @param boundary: An ASN1_TIME pointer (or an object safely castable to that type) which will have its value set. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. zwhen must be a byte stringrzInvalid stringN) isinstancerN TypeErrorrIrErJr?ASN1_TIME_set_string ValueError)rSrT set_resultr6r6r7_set_asn1_times  r[cCs2t}t|tjkt|tj}t|||S)a Behaves like _set_asn1_time but returns a new ASN1_TIME object. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. )r? ASN1_TIME_newrIrErJrKASN1_TIME_freer[)rTretr6r6r7_new_asn1_times   r_ timestampcCstd|}t|dkrdSt|tjkrtt|Std}t ||t |dtj ktd|d}t|}t|}t |d|S)a] Retrieve the time value of an ASN1 time object. @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to that type) from which the time value will be retrieved. @return: The time value from C{timestamp} as a L{bytes} string in a certain format. Or C{None} if the object contains no time value. z ASN1_STRING*rNzASN1_GENERALIZEDTIME**) rEcastr?ASN1_STRING_lengthASN1_STRING_typeV_ASN1_GENERALIZEDTIMEstringASN1_STRING_get0_datarFASN1_TIME_to_generalizedtimerIrJASN1_GENERALIZEDTIME_free)r`string_timestampgeneralized_timestamp string_data string_resultr6r6r7_get_asn1_times     rmc@s*eZdZd ddZd ddZd d d Zd S)_X509NameInvalidatorr:rUcCs g|_dSr>)_namesselfr6r6r7__init__rBz_X509NameInvalidator.__init__namer"cCs|j|dSr>)roappendrqrsr6r6r7addsz_X509NameInvalidator.addcCs|jD]}|`qdSr>)ro_namerur6r6r7clears z_X509NameInvalidator.clearNr:rUrsr"r:rU)r2r3r4rrrvrxr6r6r6r7rns  rnc@sreZdZdZdZdZdddZdd d Zedd d Z e dd ddZ e dd!ddZ d"ddZ d"ddZdS)#r!zD A class representing an DSA or RSA public key or key pair. FTr:rUcCs"t}t|tj|_d|_dS)NF)r? EVP_PKEY_newrErK EVP_PKEY_free_pkey _initializedrqpkeyr6r6r7rrs z PKey.__init___KeycCsNddlm}m}|jrtt|}tt||St t|}tt||ddS)a Export as a ``cryptography`` key. :rtype: One of ``cryptography``'s `key interfaces`_. .. _key interfaces: https://cryptography.io/en/latest/hazmat/ primitives/asymmetric/rsa/#key-interfaces .. versionadded:: 16.1.0 r)load_der_private_keyload_der_public_keyN)password) ,cryptography.hazmat.primitives.serializationrr _only_publicr)rtypingrar_dump_privatekey_internal)rqrrderr6r6r7to_cryptography_keys    zPKey.to_cryptography_key crypto_keyc Cst|tjtjtjtjtjtj t j t j t jt jf stdddlm}m}m}m}t|tjtjtj t j t jfrCtt||j|jS||j|j|}tt|S)z Construct based on a ``cryptography`` *crypto_key*. :param crypto_key: A ``cryptography`` key. :type crypto_key: One of ``cryptography``'s `key interfaces`_. :rtype: PKey .. versionadded:: 16.1.0 zUnsupported key typer)Encoding NoEncryption PrivateFormat PublicFormat)rVr DSAPrivateKey DSAPublicKeyrEllipticCurvePrivateKeyEllipticCurvePublicKeyrEd25519PrivateKeyEd25519PublicKeyrEd448PrivateKeyEd448PublicKeyr RSAPrivateKey RSAPublicKeyrWrrrrrr.r public_bytesDERSubjectPublicKeyInfo private_bytesPKCS8r-)clsrrrrrrr6r6r7from_cryptography_keysF    zPKey.from_cryptography_keyz`PKey.generate_key is deprecated. You should use the key generation APIs in cryptography instead.typer/bitsc Cs4t|ts tdt|tstd|tkrQ|dkrtdt}t|tj }t |tj t }t |||tj}t|dkt|j|}t|dknD|tkrt}t|tjkt|tj}t||tjdtjtjtj}t|dktt|dktt|j|dkntdd|_dS) a3 Generate a key pair of the given type, with the given number of bits. This generates a key "into" the this object. :param type: The key type. :type type: :py:data:`TYPE_RSA` or :py:data:`TYPE_DSA` :param bits: The number of bits. :type bits: :py:data:`int` ``>= 0`` :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't of the appropriate type. :raises ValueError: If the number of bits isn't an integer of the appropriate size. :return: ``None`` ztype must be an integerzbits must be an integerrzInvalid number of bitszNo such key typeTN)rVr/rWrrYr?BN_newrErKBN_free BN_set_wordRSA_F4RSA_newRSA_generate_key_exrJrIEVP_PKEY_assign_RSAr}rDSA_newDSA_freeDSA_generate_parameters_exDSA_generate_keyEVP_PKEY_set1_DSAr r~)rqrrexponentrresultrresr6r6r7 generate_keyKs6     zPKey.generate_keyzJPKey.check is deprecated. You should use the APIs in cryptography instead.boolcCsd|jrtdt|tjkrtdt|j}t |tj }t |}|dkr-dSt dS)ax Check the consistency of an RSA private key. This is the Python equivalent of OpenSSL's ``RSA_check_key``. :return: ``True`` if key is consistent. :raise OpenSSL.crypto.Error: if the key is inconsistent. :raise TypeError: if the key is of a type which cannot be checked. Only RSA keys can currently be checked. zpublic key onlyz'Only RSA keys can currently be checked.rTN) rrWr? EVP_PKEY_typer EVP_PKEY_RSAEVP_PKEY_get1_RSAr}rErKRSA_free RSA_check_key_raise_current_error)rqrrr6r6r7checks   z PKey.checkcC t|jS)zT Returns the type of the key :return: The type of the key. )r? EVP_PKEY_idr}rpr6r6r7r z PKey.typecCr)zh Returns the number of bits of the key :return: The number of bits of the key. )r? EVP_PKEY_bitsr}rpr6r6r7rrz PKey.bitsNry)r:r)rrr:r!)rr/rr/r:rUr:rr:r/)r2r3r4r5rr~rrr classmethodrr rrrrr6r6r6r7r!s$   9 8  r!csneZdZdZdZdfdd Zedd d Zedd dZedddZ dddZ d ddZ d!ddZ Z S)"_EllipticCurveaZ A representation of a supported elliptic curve. @cvar _curves: :py:obj:`None` until an attempt is made to load the curves. Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve` instances each of which represents one curve supported by the system. @type _curves: :py:type:`NoneType` or :py:type:`set` Notherrr:rcst|tr t|StS)z Implement cooperation with the right-hand side argument of ``!=``. Python 3 seems to have dropped this cooperation in this very narrow circumstance. )rVrsuper__ne__NotImplementedrqr __class__r6r7rs  z_EllipticCurve.__ne__rset[_EllipticCurve]cs>tjd}td|}||tfdd|DS)z Get the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. rzEC_builtin_curve[]c3s|] }|jVqdSr>)from_nidnid).0crrr6r7 sz7_EllipticCurve._load_elliptic_curves..)EC_get_builtin_curvesrErJrFset)rr num_curvesbuiltin_curvesr6rr7_load_elliptic_curvess  z$_EllipticCurve._load_elliptic_curvescCs|jdur |||_|jS)a Get, cache, and return the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. N)_curvesrrr6r6r7_get_elliptic_curvess z#_EllipticCurve._get_elliptic_curvesrr/cCs|||t||dS)a Instantiate a new :py:class:`_EllipticCurve` associated with the given OpenSSL NID. :param lib: The OpenSSL library binding object. :param nid: The OpenSSL NID the resulting curve object will represent. This must be a curve NID (and not, for example, a hash NID) or subsequent operations will fail in unpredictable ways. :type nid: :py:class:`int` :return: The curve object. ascii)rEre OBJ_nid2sndecode)rrrr6r6r7rsz_EllipticCurve.from_nidrsstrrUcCs||_||_||_dS)a :param _lib: The :py:mod:`cryptography` binding instance used to interface with OpenSSL. :param _nid: The OpenSSL NID identifying the curve this object represents. :type _nid: :py:class:`int` :param name: The OpenSSL short name identifying the curve this object represents. :type name: :py:class:`unicode` N)r?_nidrs)rqrrrsr6r6r7rrs  z_EllipticCurve.__init__cCsd|jdS)Nzrsrpr6r6r7__repr__z_EllipticCurve.__repr__cCs|j|j}t|tjS)z Create a new OpenSSL EC_KEY structure initialized to use this curve. The structure is automatically garbage collected when the Python object is garbage collected. )r?EC_KEY_new_by_curve_namerrErK EC_KEY_free)rqkeyr6r6r7 _to_EC_KEYsz_EllipticCurve._to_EC_KEYrrr:r)rrr:r)rrrr/r:r)rrrr/rsrr:rUr:rr:r)r2r3r4r5rrrrrrrrrr __classcell__r6r6rr7rs      rzSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.rcCs ttS)a Return a set of objects representing the elliptic curves supported in the OpenSSL build in use. The curve objects have a :py:class:`unicode` ``name`` attribute by which they identify themselves. The curve objects are useful as values for the argument accepted by :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be used for ECDHE key exchange. )rrr?r6r6r6r7r+s r+zRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.rsrcCs(tD] }|j|kr|Sqtd|)aT Return a single curve object selected by name. See :py:func:`get_elliptic_curves` for information about curve objects. :param name: The OpenSSL short name identifying the curve object to retrieve. :type name: :py:class:`unicode` If the named curve is not supported then :py:class:`ValueError` is raised. zunknown curve name)r+rsrY)rscurver6r6r7r*0s   r*zUX509Name support in pyOpenSSL is deprecated. You should use the APIs in cryptography.csreZdZdZd ddZd!fd d Zd"d dZd#ddZd#ddZd$ddZ d%ddZ d&ddZ d'ddZ Z S)(r"a An X.509 Distinguished Name. :ivar countryName: The country of the entity. :ivar C: Alias for :py:attr:`countryName`. :ivar stateOrProvinceName: The state or province of the entity. :ivar ST: Alias for :py:attr:`stateOrProvinceName`. :ivar localityName: The locality of the entity. :ivar L: Alias for :py:attr:`localityName`. :ivar organizationName: The organization name of the entity. :ivar O: Alias for :py:attr:`organizationName`. :ivar organizationalUnitName: The organizational unit of the entity. :ivar OU: Alias for :py:attr:`organizationalUnitName` :ivar commonName: The common name of the entity. :ivar CN: Alias for :py:attr:`commonName`. :ivar emailAddress: The e-mail address of the entity. rsr:rUcCs t|j}t|tj|_dS)z Create a new X509Name, copying the given X509Name instance. :param name: The name to copy. :type name: :py:class:`X509Name` N)r? X509_NAME_duprwrErKX509_NAME_freerur6r6r7rrds zX509Name.__init__rvaluerc s|dr t||St|turtdt|jddtt |}|tj kr?zt Wt dt y>Yt dwtt|jD]%}t|j|}t|}t|}||krlt|j|}t|nqGt|trw|d}t|j|tj|t|dd}|st dSdS) N_z$attribute name must be string, not 'z.200'No such attributeutf-8r) startswithr __setattr__rrrWr2r? OBJ_txt2nid _byte_string NID_undefrr AttributeErrorrangeX509_NAME_entry_countrwX509_NAME_get_entryX509_NAME_ENTRY_get_object OBJ_obj2nidX509_NAME_delete_entryX509_NAME_ENTRY_freerVencodeX509_NAME_add_entry_by_NID MBSTRING_UTF8rH) rqrsrrientent_objent_nid add_resultrr6r7rnsD           zX509Name.__setattr__ str | Nonec Cstt|}|tjkr!ztWtdty Ytdwt|j|d}|dkr/dSt |j|}t |}t d}t ||}t|dkzt |d|ddd}Wt|d|St|dw)a  Find attribute. An X509Name object has the following attributes: countryName (alias C), stateOrProvince (alias ST), locality (alias L), organization (alias O), organizationalUnit (alias OU), commonName (alias CN) and more... rrNunsigned char**rr)r?rrrrr rX509_NAME_get_index_by_NIDrwrX509_NAME_ENTRY_get_datarErFASN1_STRING_to_UTF8rIr8r OPENSSL_free) rqrsr entry_indexentryrLrP data_lengthrr6r6r7 __getattr__s0      zX509Name.__getattr__rrcCs"t|tstSt|j|jdkSNrrVr"rr? X509_NAME_cmprwrr6r6r7__eq__ zX509Name.__eq__cCs"t|tstSt|j|jdkSrrrr6r6r7__lt__rzX509Name.__lt__cCsDtdd}t|j|t|}t|tjkdt | dS)z6 String representation of an X509Name r;izr) rErFr?X509_NAME_onelinerwrHrIrJformatrer)rqrP format_resultr6r6r7rs  zX509Name.__repr__r/cCr)a& Return an integer representation of the first four bytes of the MD5 digest of the DER representation of the name. This is the Python equivalent of OpenSSL's ``X509_NAME_hash``. :return: The (integer) hash of this name. :rtype: :py:class:`int` )r?X509_NAME_hashrwrpr6r6r7hash z X509Name.hashrNcCsNtd}t|j|}t|dkt|d|dd}t|d|S)z Return the DER encoding of this name. :return: The DER encoded form of this name. :rtype: :py:class:`bytes` r rN)rErFr? i2d_X509_NAMErwrIr8r )rqrP encode_resultrlr6r6r7rs  z X509Name.derlist[tuple[bytes, bytes]]c Csg}tt|jD]7}t|j|}t|}t|}t|}t|}t t |t |dd}| t ||fq |S)z Returns the components of this name, as a sequence of 2-tuples. :return: The components of this name. :rtype: :py:class:`list` of ``name, value`` tuples. N)rr?rrwrrr rrrEr8rfrbrtre) rqrrrfnamefvalrrsrr6r6r7get_componentss    zX509Name.get_componentsrz)rsrrrr:rU)rsrr:rrrrr:rN)r:r )r2r3r4r5rrrrrrrrrr#rr6r6rr7r"Fs  ' (    r"c@seZdZdZddddZededd Zdfd d ZedgddZe ddhddZ diddZ djddZ e ddkddZ e ddld!d"Zdmd$d%Zdnd'd(Zdid)d*Ze d+dod-d.Zdid/d0Ze d1dpd3d4Ze d5dpd6d7Zdqd9d:Zdrd=d>Zdsd?d@ZdtdCdDZe dEdudFdGZdsdHdIZe dJdudKdLZdvdNdOZdwdQdRZe dSdxdTdUZe dVdydXdYZ e dZdxd[d\Z!e d]dzd_d`Z"didadbZ#dcS){rz An X.509 certificate. r:rUcCs:t}t|tjkt|tj|_t|_ t|_ dSr>) r?X509_newrIrErJrK X509_free_x509rn_issuer_invalidator_subject_invalidator)rqr r6r6r7rrs  z X509.__init__r rcCs.||}t|tj|_t|_t|_|Sr>) __new__rErKr?r&r'rnr(r))rr certr6r6r7_from_raw_x509_ptrs zX509._from_raw_x509_ptrx509.CertificatecCsddlm}tt|}||S)z Export as a ``cryptography`` certificate. :rtype: ``cryptography.x509.Certificate`` .. versionadded:: 17.1.0 r)load_der_x509_certificate)cryptography.x509r.r'r)rqr.rr6r6r7to_cryptography"s  zX509.to_cryptography crypto_certcCs6t|tjs tdddlm}||j}tt |S)z Construct based on a ``cryptography`` *crypto_cert*. :param crypto_key: A ``cryptography`` X.509 certificate. :type crypto_key: ``cryptography.x509.Certificate`` :rtype: X509 .. versionadded:: 17.1.0 zMust be a certificaterr) rVr CertificaterWrrrrr,r)rr1rrr6r6r7from_cryptography/s    zX509.from_cryptographyzYX509.set_version is deprecated. You should use cryptography's CertificateBuilder instead.versionr/cCs,t|ts tdtt|j|dkdS)a  Set the version number of the certificate. Note that the version value is zero-based, eg. a value of 0 is V1. :param version: The version number of the certificate. :type version: :py:class:`int` :return: ``None`` zversion must be an integerrN)rVr/rWrIr?X509_set_versionr')rqr5r6r6r7 set_versionCs zX509.set_versioncCr)z Return the version number of the certificate. :return: The version number of the certificate. :rtype: :py:class:`int` )r?X509_get_versionr'rpr6r6r7 get_versionV zX509.get_versionr!cCsFtt}t|j|_|jtjkrtt |jtj |_d|_ |S)z{ Get the public key of the certificate. :return: The public key. :rtype: :py:class:`PKey` T) r!r*r?X509_get_pubkeyr'r}rErJrrKr|rrr6r6r7 get_pubkey_s  zX509.get_pubkeyzXX509.set_pubkey is deprecated. You should use cryptography's CertificateBuilder instead.rcCs2t|ts tdt|j|j}t|dkdS)z Set the public key of the certificate. :param pkey: The public key. :type pkey: :py:class:`PKey` :return: :py:data:`None` pkey must be a PKey instancerN)rVr!rWr?X509_set_pubkeyr'r}rI)rqrrZr6r6r7 set_pubkeyns zX509.set_pubkeyzRX509.sign is deprecated. You should use cryptography's CertificateBuilder instead.digestrcCspt|ts td|jrtd|jstdtt|}|t j kr'tdt |j |j |}t|dkdS)a Sign the certificate with this key and digest type. :param pkey: The key to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use. :type digest: :py:class:`str` :return: :py:data:`None` r=zKey only has public partzKey is uninitializedNo such digest methodrN)rVr!rWrrYr~r?EVP_get_digestbynamerrErJ X509_signr'r}rI)rqrr@evp_md sign_resultr6r6r7signs  z X509.signrNcCsZt|j}td}t|tjtj|t|d}|tjkr%t dt t |S)z Return the signature algorithm used in the certificate. :return: The name of the algorithm. :rtype: :py:class:`bytes` :raises ValueError: If the signature algorithm is undefined. .. versionadded:: 0.13 zASN1_OBJECT **rzUndefined signature algorithm) r?X509_get0_tbs_sigalgr'rErFX509_ALGOR_get0rJrrrYre OBJ_nid2ln)rqsig_algalgrr6r6r7get_signature_algorithms  zX509.get_signature_algorithm digest_namecCstt|}|tjkrtdtdtj}tdd}t||d<t |j |||}t |dkd ddt ||dDS) a5 Return the digest of the X509 object. :param digest_name: The name of the digest algorithm to use. :type digest_name: :py:class:`str` :return: The digest of the object, formatted as :py:const:`b":"`-delimited hex pairs. :rtype: :py:class:`bytes` rAzunsigned char[]zunsigned int[]rr:cSsg|]}t|qSr6)rupper)rchr6r6r7 s zX509.digest..)r?rBrrErJrYrFEVP_MAX_MD_SIZErH X509_digestr'rIjoinr8)rqrMr@rP result_length digest_resultr6r6r7r@s     z X509.digestcCr)z Return the hash of the X509 subject. :return: The hash of the subject. :rtype: :py:class:`int` )r?X509_subject_name_hashr'rpr6r6r7subject_name_hashr:zX509.subject_name_hashz_X509.set_serial_number is deprecated. You should use cryptography's CertificateBuilder instead.serialcCst|ts tdt|dd}|d}td}t||}t |tj kt |dtj }t |dt |tj kt |tj}t|j|}t |dkdS)z Set the serial number of the certificate. :param serial: The new serial number. :type serial: :py:class:`int` :return: :py:data`None` zserial must be an integerNrzBIGNUM**rr)rVr/rWhexrrErFr? BN_hex2bnrIrJBN_to_ASN1_INTEGERrrKASN1_INTEGER_freeX509_set_serialNumberr')rqrY hex_serialhex_serial_bytes bignum_serialr asn1_serialrZr6r6r7set_serial_numbers    zX509.set_serial_numberc Cspt|j}t|tj}z$t|}zt|}t|d}|Wt |Wt |St |wt |w)zx Return the serial number of this certificate. :return: The serial number. :rtype: int ) r?X509_get_serialNumberr'ASN1_INTEGER_to_BNrErJ BN_bn2hexrer/r r)rqrcrbr`hexstring_serialrYr6r6r7get_serial_numbers       zX509.get_serial_numberzaX509.gmtime_adj_notAfter is deprecated. You should use cryptography's CertificateBuilder instead.amountcC.t|ts tdt|j}t||dS)z Adjust the time stamp on which the certificate stops being valid. :param int amount: The number of seconds by which to adjust the timestamp. :return: ``None`` amount must be an integerN)rVr/rWr?X509_getm_notAfterr'X509_gmtime_adj)rqrknotAfterr6r6r7gmtime_adj_notAfters  zX509.gmtime_adj_notAfterzbX509.gmtime_adj_notBefore is deprecated. You should use cryptography's CertificateBuilder instead.cCrl)z Adjust the timestamp on which the certificate starts being valid. :param amount: The number of seconds by which to adjust the timestamp. :return: ``None`` rmN)rVr/rWr?X509_getm_notBeforer'ro)rqrk notBeforer6r6r7gmtime_adj_notBefore"s  zX509.gmtime_adj_notBeforercCsT|}|dur td|d}tj|d}tjj}tj|jdd}||kS)z Check whether the certificate has expired. :return: ``True`` if the certificate has expired, ``False`` otherwise. :rtype: bool NzUnable to determine notAfterrz %Y%m%d%H%M%SZ)tzinfo) get_notAfterrYrdatetimestrptimetimezoneutcnowreplace)rq time_bytes time_string not_afterUTCutcnowr6r6r7 has_expired3s zX509.has_expiredwhichr9cCst||jSr>)rmr')rqrr6r6r7_get_boundary_timeDrzX509._get_boundary_timecC |tjS)a  Get the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType )rr?rrrpr6r6r7 get_notBeforeG zX509.get_notBeforeCallable[..., Any]rTcCst||j|Sr>)r[r')rqrrTr6r6r7_set_boundary_timeTszX509._set_boundary_timez[X509.set_notBefore is deprecated. You should use cryptography's CertificateBuilder instead.cC|tj|S)z Set the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` )rr?rrrqrTr6r6r7 set_notBeforeYzX509.set_notBeforecCr)a  Get the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType )rr?rnrpr6r6r7rvjrzX509.get_notAfterzZX509.set_notAfter is deprecated. You should use cryptography's CertificateBuilder instead.cCr)z Set the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` )rr?rnrr6r6r7 set_notAfterwrzX509.set_notAfterr"cCs0tt}||j|_t|jtjk||_|Sr>) objectr*r"r'rwrIrErJ_owner)rqrrsr6r6r7 _get_names  zX509._get_namerscCs0t|ts td||j|j}t|dkdS)Nzname must be an X509Namer)rVr"rWr'rwrI)rqrrsrZr6r6r7 _set_names zX509._set_namezPX509.get_issuer is deprecated. You should use cryptography's X.509 APIs instead.cC|tj}|j||S)a Return the issuer of this certificate. This creates a new :class:`X509Name` that wraps the underlying issuer name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this issuer. :return: The issuer of this certificate. :rtype: :class:`X509Name` )rr?X509_get_issuer_namer(rvrur6r6r7 get_issuer  zX509.get_issuerzXX509.set_issuer is deprecated. You should use cryptography's CertificateBuilder instead.issuercC|tj||jdS)z Set the issuer of this certificate. :param issuer: The issuer. :type issuer: :py:class:`X509Name` :return: ``None`` N)rr?X509_set_issuer_namer(rx)rqrr6r6r7 set_issuer zX509.set_issuerzQX509.get_subject is deprecated. You should use cryptography's X.509 APIs instead.cCr)a Return the subject of this certificate. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate. :rtype: :class:`X509Name` )rr?X509_get_subject_namer)rvrur6r6r7 get_subjectrzX509.get_subjectzYX509.set_subject is deprecated. You should use cryptography's CertificateBuilder instead.subjectcCr)z Set the subject of this certificate. :param subject: The subject. :type subject: :py:class:`X509Name` :return: ``None`` N)rr?X509_set_subject_namer)rx)rqrr6r6r7 set_subjectrzX509.set_subjectcCr)z Get the number of extensions on this certificate. :return: The number of extensions. :rtype: :py:class:`int` .. versionadded:: 0.12 )r?X509_get_ext_countr'rpr6r6r7get_extension_counts zX509.get_extension_countNry)r rr:r)r:r-)r1r-r:r)r5r/r:rUr)r:r!)rr!r:rU)rr!r@rr:rUr$)rMrr:rN)rYr/r:rU)rkr/r:rUr)rrr:r9)r:r9)rrrTrNr:rU)rTrNr:rU)rrr:r")rrrsr"r:rU)r:r")rr"r:rU)rr"r:rU)$r2r3r4r5rrrr,r0r4r r7r9r<r?rFrLr@rXrdrjrqrtrrrrrrvrrrrrrrrr6r6r6r7r s                               rc@seZdZUdZejZded<ejZ ded<ej Z ded<ej Z ded<ejZded<ejZded<ejZded <ejZded <ejZded <ejZded <d S)r&a  Flags for X509 verification, used to change the behavior of :class:`X509Store`. See `OpenSSL Verification Flags`_ for details. .. _OpenSSL Verification Flags: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html r/ CRL_CHECK CRL_CHECK_ALLIGNORE_CRITICAL X509_STRICTALLOW_PROXY_CERTS POLICY_CHECKEXPLICIT_POLICY INHIBIT_MAPCHECK_SS_SIGNATURE PARTIAL_CHAINN)r2r3r4r5r?X509_V_FLAG_CRL_CHECKr__annotations__X509_V_FLAG_CRL_CHECK_ALLrX509_V_FLAG_IGNORE_CRITICALrX509_V_FLAG_X509_STRICTrX509_V_FLAG_ALLOW_PROXY_CERTSrX509_V_FLAG_POLICY_CHECKrX509_V_FLAG_EXPLICIT_POLICYrX509_V_FLAG_INHIBIT_MAPrX509_V_FLAG_CHECK_SS_SIGNATURErX509_V_FLAG_PARTIAL_CHAINrr6r6r6r7r&s  r&c@sPeZdZdZdddZddd Zdd d ZdddZd ddZ d!d"ddZ dS)#r#a An X.509 store. An X.509 store is used to describe a context in which to verify a certificate. A description of a context may include a set of certificates to trust, a set of certificate revocation lists, verification flags and more. An X.509 store, being only a description, cannot be used by itself to verify a certificate. To carry out the actual verification process, see :class:`X509StoreContext`. r:rUcCst}t|tj|_dSr>)r?X509_STORE_newrErKX509_STORE_free_storerqstorer6r6r7rrszX509Store.__init__r+rcCs0t|tstt|j|j}t|dkdS)a Adds a trusted certificate to this store. Adding a certificate with this method adds this certificate as a *trusted* certificate. :param X509 cert: The certificate to add to this store. :raises TypeError: If the certificate is not an :class:`X509`. :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your certificate. :return: ``None`` if the certificate was added successfully. rN)rVrrWr?X509_STORE_add_certrr'rI)rqr+rr6r6r7add_certs zX509Store.add_certcrlx509.CertificateRevocationListcCsvt|tjr*ddlm}t||j}t |t j }t |t j kt |tj}ntdt t|j|dkdS)a Add a certificate revocation list to this store. The certificate revocation lists added to a store will only be used if the associated flags are configured to check certificate revocation lists. .. versionadded:: 16.1.0 :param crl: The certificate revocation list to add to this store. :type crl: ``cryptography.x509.CertificateRevocationList`` :return: ``None`` if the certificate revocation list was added successfully. rr2z?CRL must be of type cryptography.x509.CertificateRevocationListN)rVr CertificateRevocationListrrrMrrr?d2i_X509_CRL_biorErJrIrK X509_CRL_freerWX509_STORE_add_crlr)rqrrr< openssl_crlr6r6r7add_crl.s  zX509Store.add_crlflagsr/cCstt|j|dkdS)a Set verification flags to this store. Verification flags can be combined by oring them together. .. note:: Setting a verification flag sometimes requires clients to add additional information to the store, otherwise a suitable error will be raised. For example, in setting flags to enable CRL checking a suitable CRL must be added to the store otherwise an error will be raised. .. versionadded:: 16.1.0 :param int flags: The verification flags to set on this store. See :class:`X509StoreFlags` for available constants. :return: ``None`` if the verification flags were successfully set. rN)rIr?X509_STORE_set_flagsr)rqrr6r6r7 set_flagsLszX509Store.set_flagsvfy_timedatetime.datetimecCsFt}t|tj}t|t|t t |j |dkdS)a Set the time against which the certificates are verified. Normally the current time is used. .. note:: For example, you can determine if a certificate was valid at a given time. .. versionadded:: 17.0.0 :param datetime vfy_time: The verification time to set on this store. :return: ``None`` if the verification time was successfully set. rN) r?X509_VERIFY_PARAM_newrErKX509_VERIFY_PARAM_freeX509_VERIFY_PARAM_set_timecalendartimegm timetuplerIX509_STORE_set1_paramr)rqrparamr6r6r7set_timeds zX509Store.set_timeNcafileStrOrBytesPath | NonecapathcCsR|durtj}nt|}|durtj}nt|}t|j||}|s'tdSdS)a Let X509Store know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If *capath* is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *cafile* or *capath* may be ``None``. .. note:: Both *cafile* and *capath* may be set simultaneously. Call this method multiple times to add more than one location. For example, CA certificates, and certificate revocation list bundles may be passed in *cafile* in subsequent calls to this method. .. versionadded:: 20.0 :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: ``None`` if the locations were set successfully. :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None`` or the locations could not be set for any reason. N)rErJ _path_bytesr?X509_STORE_load_locationsrr)rqrr load_resultr6r6r7load_locations|s# zX509Store.load_locationsry)r+rr:rU)rrr:rU)rr/r:rU)rrr:rUr>)rrrrr:rU) r2r3r4r5rrrrrrrr6r6r6r7r#s    r#cs"eZdZdZd fd d ZZS) r%z An exception raised when an error occurred while verifying a certificate using `OpenSSL.X509StoreContext.verify_certificate`. :ivar certificate: The certificate which caused verificate failure. :type certificate: :class:`X509` messagererrors list[Any] certificaterr:rUcst|||_||_dSr>)rrrrr)rqrrrrr6r7rrs  zX509StoreContextError.__init__)rrrrrrr:rU)r2r3r4r5rrrr6r6rr7r%sr%c@sbeZdZdZ ddd d Zed ddZed!ddZd"ddZd#ddZ d$ddZ d%ddZ dS)&r$a9 An X.509 store context. An X.509 store context is used to carry out the actual verification process of a certificate in a described context. For describing such a context, see :class:`X509Store`. :param X509Store store: The certificates which will be trusted for the purposes of any verifications. :param X509 certificate: The certificate to be verified. :param chain: List of untrusted certificates that may be used for building the certificate chain. May be ``None``. :type chain: :class:`list` of :class:`X509` Nrr#rrchainSequence[X509] | Noner:rUcCs||_||_|||_dSr>)r_cert_build_certificate_stack_chain)rqrrrr6r6r7rrszX509StoreContext.__init__ certificatescCsd dd}|dust|dkrtjSt}t|tjkt||}|D]'}t|ts0t dtt |j dkt ||j dkrLt |j tq%|S) Nsrr:rUcSs8tt|D] }t||}t|qt|dSr>)rr? sk_X509_num sk_X509_valuer& sk_X509_free)rrxr6r6r7cleanups  z:X509StoreContext._build_certificate_stack..cleanuprz+One of the elements is not an X509 instance)rrr:rU)rHrErJr?sk_X509_new_nullrIrKrVrrW X509_up_refr' sk_X509_pushr&r)rrstackr+r6r6r7rs    z)X509StoreContext._build_certificate_stack store_ctxrr%cCs\ttt|d}t|t||g}t|}t|}t |}t |||S)z Convert an OpenSSL native context error failure into a Python exception. When a call to native OpenSSL X509_verify_cert fails, additional information about the failure can be obtained from the store context. r) rErer?X509_verify_cert_error_stringX509_STORE_CTX_get_errorrX509_STORE_CTX_get_error_depthX509_STORE_CTX_get_current_certX509_duprr,r%)rrrr'rpycertr6r6r7_exception_from_contexts     z(X509StoreContext._exception_from_contextcCsjt}t|tjkt|tj}t||jj|j j |j }t|dkt |}|dkr3| ||S)a3 Verifies the certificate and runs an X509_STORE_CTX containing the results. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. rr)r?X509_STORE_CTX_newrIrErJrKX509_STORE_CTX_freeX509_STORE_CTX_initrrr'rX509_verify_certr)rqrr^r6r6r7_verify_certificates    z$X509StoreContext._verify_certificatecCs ||_dS)z Set the context's X.509 store. .. versionadded:: 0.15 :param X509Store store: The store description which will be used for the purposes of any *future* verifications. N)rrr6r6r7 set_store+s zX509StoreContext.set_storecCs |dS)a" Verify a certificate in a context. .. versionadded:: 0.15 :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. N)rrpr6r6r7verify_certificate6rz#X509StoreContext.verify_certificate list[X509]cCst|}t|}t|tjkg}tt|D]}t||}t|tjkt |}| |qt ||S)aR Verify a certificate in a context and return the complete validated chain. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. .. versionadded:: 20.0 ) rr?X509_STORE_CTX_get1_chainrIrErJrrrrr,rtr)rqr cert_stackrrr+rr6r6r7get_verified_chainBs     z#X509StoreContext.get_verified_chainr>)rr#rrrrr:rU)rrr:rU)rrr:r%r)rr#r:rUry)r:r) r2r3r4r5rr staticmethodrrrrrrr6r6r6r7r$s       r$rcCsvt|tr |d}t|}|tkrt|tjtjtj}n|t kr*t |tj}nt d|tjkr6t t |S)a Load a certificate (X509) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param bytes buffer: The buffer the certificate is stored in :return: The X509 object r3type argument must be FILETYPE_PEM or FILETYPE_ASN1)rVrrrMrr?PEM_read_bio_X509rErJr d2i_X509_biorYrrr,)rr8r<r r6r6r7r,_s   r,r+cCsnt}|tkrt||j}n|tkrt||j}n|tkr)t||jdd}nt dt |dkt |S)a Dump the certificate *cert* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXT) :param cert: The certificate to dump :return: The buffer with the dumped certificate in rCtype argument must be FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXTr) rMrr?PEM_write_bio_X509r'r i2d_X509_bior X509_print_exrYrIrR)rr+r< result_coder6r6r7r'|s  r'rcCsPt}|tkr tj}n |tkrtj}ntd|||j}|dkr$tt |S)z Dump a public key to a buffer. :param type: The file type (one of :data:`FILETYPE_PEM` or :data:`FILETYPE_ASN1`). :param PKey pkey: The public key to dump :return: The buffer with the dumped key in it. :rtype: bytes rr) rMrr?PEM_write_bio_PUBKEYri2d_PUBKEY_biorYr}rrR)rrr< write_bior r6r6r7r)s  r)cipherr passphrasePassphraseCallableT | Nonec Cst}t|ts td|dur)|durtdtt|}|tjkr(t dntj}t ||}|t krIt ||j |tjd|j|j}|n4|tkrUt||j }n(|tkryt|j tjkrftdtt|j tj}t||d}nt dt|dkt|S)a Dump the private key *pkey* into a buffer string encoded with the type *type*. Optionally (if *type* is :const:`FILETYPE_PEM`) encrypting it using *cipher* and *passphrase*. :param type: The file type (one of :const:`FILETYPE_PEM`, :const:`FILETYPE_ASN1`, or :const:`FILETYPE_TEXT`) :param PKey pkey: The PKey to dump :param cipher: (optional) if encrypted PEM format, the cipher to use :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The buffer with the dumped key in :rtype: bytes .. deprecated:: 26.3.0 Use the serialization APIs on ``cryptography`` private key types instead. zpkey must be a PKeyNzDif a value is given for cipher one must also be given for passphrasezInvalid cipher namerz-Only RSA keys are supported for FILETYPE_TEXTr)rMrVr!rWr?EVP_get_cipherbynamerrErJrY_PassphraseHelperrPEM_write_bio_PrivateKeyr}callback callback_argsraise_if_problemri2d_PrivateKey_biorrrrKrr RSA_printrIrR) rrrrr< cipher_objhelperr rr6r6r7r(sJ     r(zGdump_privatekey is deprecated. You should use the APIs in cryptography.rc@sPeZdZ  ddd d ZedddZedddZefd ddZd!ddZ dS)"rFrr/rr more_argsrtruncater:rUcCs4|tkr |dur td||_||_||_g|_dS)Nz0only FILETYPE_PEM key format supports encryption)rrY _passphrase _more_args _truncate _problems)rqrrrrr6r6r7rr s z_PassphraseHelper.__init__rcCs<|jdurtjSt|jtst|jrtd|jStd)Npem_password_cb2Last argument must be a byte string or a callable.) rrErJrVrNcallabler_read_passphraserWrpr6r6r7rs z_PassphraseHelper.callbackcCs4|jdurtjSt|jtst|jrtjStd)Nr#)rrErJrVrNr$rWrpr6r6r7r$s z_PassphraseHelper.callback_args exceptionTypetype[Exception]cCs6|jrzt|Wn |yYnw|jddSr)r!_exception_from_error_queuepop)rqr&r6r6r7r/s   z"_PassphraseHelper.raise_if_problembufsizerwflaguserdatac CszUt|jr|jr||||}n||}n |jdusJ|j}t|ts*tdt||kr>|jr:|d|}ntdtt|D] }|||d||<qDt|WSt yn}z |j |WYd}~dSd}~ww)NzBytes expectedz+passphrase returned by callback is too longrr) r$rrrVrNrYrHr r Exceptionr!rt)rqr*r+r,r-rrer6r6r7r%9s.      z"_PassphraseHelper._read_passphraseN)FF) rr/rrrrrrr:rUr)r&r'r:rU) r*rr+r/r,rr-rr:r/) r2r3r4rrpropertyrrr rr%r6r6r6r7rs     r str | bytescCst|tr |d}t|}|tkrt|tjtjtj}n|t kr*t |tj}nt d|tjkr6t t t }t|tj|_d|_|S)a< Load a public key from a buffer. :param type: The file type (one of :data:`FILETYPE_PEM`, :data:`FILETYPE_ASN1`). :param buffer: The buffer the key is stored in. :type buffer: A Python string object, either unicode or bytestring. :return: The PKey object. :rtype: :class:`PKey` rrT)rVrrrMrr?PEM_read_bio_PUBKEYrErJrd2i_PUBKEY_biorYrr!r*rKr|r}r)rr8r<evp_pkeyrr6r6r7r.Vs   r.cCst|tr |d}t|}t||}|tkr't|tj |j |j }| n|t kr3t|tj }ntd|tj kr?ttt}t|tj|_|S)a Load a private key (PKey) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the key is stored in :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The PKey object rr)rVrrrMrrr?PEM_read_bio_PrivateKeyrErJrrrrd2i_PrivateKey_biorYrr!r*rKr|r})rr8rr<rr4rr6r6r7r-xs"      r-r>)r8r9r:r)r<rr:rN)rSrrTrNr:rU)rTrNr:r)r`rr:r9)r:r)rsrr:r)rr/r8rNr:r)rr/r+rr:rN)rr/rr!r:rN)NN) rr/rr!rrrrr:rN)rr/r8r1r:r!)rr/r8r1rrr:r!)g __future__rrrw functoolssysrbase64rcollections.abcrrrrr version_infowarningsr typing_extensions cryptographyr r )cryptography.hazmat.primitives.asymmetricrrrrr OpenSSL._utilrrrrr(rrErr?r _make_assertrr__all__rrrrr _PrivateKeyrrrrr _PublicKeyrrNPassphraseCallableTSSL_FILETYPE_PEMrrSSL_FILETYPE_ASN1rrrr EVP_PKEY_DSAr EVP_PKEY_DHr0 EVP_PKEY_ECr1r.r rrIrMrRr[r_rmrnr!rr+r*total_orderingr"rr&r#r%r$r,r'r)r(rr2DeprecationWarningrr.r-r6r6r6r7s                   Jg  Ce+    I N%