관리-도구
편집 파일: x509.cpython-36.pyc
3 T��e�T � @ s. d dl mZmZmZ d dlZd dlZd dlmZmZ d dl m Z d dl m Z m Z mZmZmZ d dlmZmZ d dlmZmZ d dlmZmZmZ d d lm Z ej ej �G d d � d e ��Z ej ej!�G d d � d e ��Z"ej ej#�G dd� de ��Z$ej ej%�G dd� de ��Z&ej ej'j(�G dd� de ��Z)dS )� )�absolute_import�division�print_functionN)�utils�x509)�UnsupportedAlgorithm)�_asn1_integer_to_int�_asn1_string_to_bytes�_decode_x509_name�_obj2txt�_parse_asn1_time)�_encode_asn1_int_gc� _txt2obj_gc)�hashes� serialization)�dsa�ec�rsa)� _ASN1Typec @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zd d � Zd d� Z e j d�Z e dd� �Ze dd� �Zdd� Ze dd� �Ze dd� �Ze dd� �Ze d d � �Ze d d � �Ze d d!� �Ze jd"d#� �Ze d$d%� �Ze d&d'� �Zd(d)� Zd*S )+� _Certificatec C sZ || _ || _| j jj| j�}|dkr0tjj| _n&|dkrDtjj| _ntj dj |�|��d S )Nr � z {} is not a valid X509 version) �_backend�_x509�_libZX509_get_versionr �Version�v1�_versionZv3ZInvalidVersion�format)�self�backendZ x509_cert�version� r! � /usr/lib64/python3.6/x509.py�__init__ s z_Certificate.__init__c C s dj | j�S )Nz <Certificate(subject={}, ...)>)r �subject)r r! r! r" �__repr__, s z_Certificate.__repr__c C s, t |tj�stS | jjj| j|j�}|dkS )Nr )� isinstancer � Certificate�NotImplementedr r ZX509_cmpr )r �other�resr! r! r" �__eq__/ s z_Certificate.__eq__c C s | |k S )Nr! )r r) r! r! r" �__ne__6 s z_Certificate.__ne__c C s t | jtjj��S )N)�hash� public_bytesr �Encoding�DER)r r! r! r" �__hash__9 s z_Certificate.__hash__c C s | S )Nr! )r �memor! r! r" � __deepcopy__< s z_Certificate.__deepcopy__c C s* t j|| j�}|j| jtjj�� |j� S )N) r �Hashr �updater. r r/ r0 �finalize)r � algorithm�hr! r! r" � fingerprint? s z_Certificate.fingerprintr c C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_get_serialNumberr �openssl_assert�_ffi�NULLr )r �asn1_intr! r! r" � serial_numberF s z_Certificate.serial_numberc C s | j S )N)r> )r r! r! r" �serialL s z_Certificate.serialc C sR | j jj| j�}|| j jjkr0| j j� td��| j jj|| j jj �}| j j |�S )Nz,Certificate public key is of an unknown type) r r ZX509_get_pubkeyr r; r< �_consume_errors� ValueError�gc� EVP_PKEY_free�_evp_pkey_to_public_key)r �pkeyr! r! r" � public_keyP s z_Certificate.public_keyc C s | j jj| j�}t| j |�S )N)r r ZX509_getm_notBeforer r )r � asn1_timer! r! r" �not_valid_before[ s z _Certificate.not_valid_beforec C s | j jj| j�}t| j |�S )N)r r ZX509_getm_notAfterr r )r rG r! r! r" �not_valid_after` s z _Certificate.not_valid_afterc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_get_issuer_namer r: r; r< r )r �issuerr! r! r" rJ e s z_Certificate.issuerc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_get_subject_namer r: r; r< r )r r$ r! r! r" r$ k s z_Certificate.subjectc C s8 | j }y tj| S tk r2 tdj|���Y nX d S )Nz)Signature algorithm OID:{} not recognized)�signature_algorithm_oidr �_SIG_OIDS_TO_HASH�KeyErrorr r )r �oidr! r! r" �signature_hash_algorithmq s z%_Certificate.signature_hash_algorithmc C s^ | j jjd�}| j jj| j jj|| j� | j j|d | j jjk� t| j |d j �}t j |�S )Nz X509_ALGOR **r ) r r; �newr �X509_get0_signaturer< r r: r r7 r �ObjectIdentifier)r �algrN r! r! r" rK { s z$_Certificate.signature_algorithm_oidc C s | j jj| j�S )N)r Z _certificate_extension_parser�parser )r r! r! r" � extensions� s z_Certificate.extensionsc C sR | j jjd�}| j jj|| j jj| j� | j j|d | j jjk� t| j |d �S )NzASN1_BIT_STRING **r ) r r; rP r rQ r< r r: r )r �sigr! r! r" � signature� s z_Certificate.signaturec sd � j jjd�}� j jj� j|�}� j j|dk� � j jj|� fdd��}� j jj|d |�d d � S )Nzunsigned char **r c s � j jj| d �S )Nr )r r � OPENSSL_free)�pointer)r r! r" �<lambda>� s z4_Certificate.tbs_certificate_bytes.<locals>.<lambda>) r r; rP r Zi2d_re_X509_tbsr r: rB �buffer)r �ppr* r! )r r" �tbs_certificate_bytes� s z"_Certificate.tbs_certificate_bytesc C sn | j j� }|tjjkr*| j jj|| j�}n(|tjjkrJ| j jj || j�}nt d��| j j |dk� | j j |�S )Nz/encoding must be an item from the Encoding enum� ) r �_create_mem_bio_gcr r/ �PEMr ZPEM_write_bio_X509r r0 Z i2d_X509_bio� TypeErrorr: � _read_mem_bio)r �encoding�bior* r! r! r" r. � s z_Certificate.public_bytesN) �__name__� __module__� __qualname__r# r% r+ r, r1 r3 r9 r Zread_only_propertyr �propertyr> r? rF rH rI rJ r$ rO rK �cached_propertyrU rW r] r. r! r! r! r" r s* r c @ s: e Zd Zdd� Zedd� �Zedd� �Zejdd� �Z d S ) �_RevokedCertificatec C s || _ || _|| _d S )N)r Z_crl� _x509_revoked)r r ZcrlZ x509_revokedr! r! r" r# � s z _RevokedCertificate.__init__c C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r Z X509_REVOKED_get0_serialNumberrk r: r; r< r )r r= r! r! r" r> � s z!_RevokedCertificate.serial_numberc C s t | j| jjj| j��S )N)r r r Z X509_REVOKED_get0_revocationDaterk )r r! r! r" �revocation_date� s z#_RevokedCertificate.revocation_datec C s | j jj| j�S )N)r Z _revoked_cert_extension_parserrT rk )r r! r! r" rU � s z _RevokedCertificate.extensionsN) re rf rg r# rh r> rl r ri rU r! r! r! r" rj � s rj c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zejd d � �Z d d � Z e d d� �Z e dd� �Z e dd� �Ze dd� �Ze dd� �Ze dd� �Ze dd� �Zdd � Zd d � Zd d � Zd!d"� Zd#d$� Zejd%d&� �Zd'd(� Zd)S )*�_CertificateRevocationListc C s || _ || _d S )N)r � _x509_crl)r r Zx509_crlr! r! r" r# � s z#_CertificateRevocationList.__init__c C s, t |tj�stS | jjj| j|j�}|dkS )Nr )r& r �CertificateRevocationListr( r r Z X509_CRL_cmprn )r r) r* r! r! r" r+ � s z!_CertificateRevocationList.__eq__c C s | |k S )Nr! )r r) r! r! r" r, � s z!_CertificateRevocationList.__ne__c C sX t j|| j�}| jj� }| jjj|| j�}| jj|dk� | jj|�}|j |� |j � S )Nr^ ) r r4 r r_ r �i2d_X509_CRL_biorn r: rb r5 r6 )r r7 r8 rd r* Zderr! r! r" r9 � s z&_CertificateRevocationList.fingerprintc C s@ | j jj| j�}| j j|| j jjk� | j jj|| j jj�}|S )N) r r Z X509_CRL_duprn r: r; r< rB Z X509_CRL_free)r �dupr! r! r" � _sorted_crl� s z&_CertificateRevocationList._sorted_crlc C sl | j jjd�}t| j |�}| j jj| j||�}|dkr:d S | j j|d | j jjk� t | j | j|d �S d S )NzX509_REVOKED **r ) r r; rP r r ZX509_CRL_get0_by_serialrr r: r< rj )r r> �revokedr= r* r! r! r" �(get_revoked_certificate_by_serial_number� s zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberc C s8 | j }y tj| S tk r2 tdj|���Y nX d S )Nz)Signature algorithm OID:{} not recognized)rK r rL rM r r )r rN r! r! r" rO s z3_CertificateRevocationList.signature_hash_algorithmc C s^ | j jjd�}| j jj| j| j jj|� | j j|d | j jjk� t| j |d j �}t j |�S )Nz X509_ALGOR **r ) r r; rP r �X509_CRL_get0_signaturern r< r: r r7 r rR )r rS rN r! r! r" rK s z2_CertificateRevocationList.signature_algorithm_oidc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_CRL_get_issuerrn r: r; r< r )r rJ r! r! r" rJ s z!_CertificateRevocationList.issuerc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_CRL_get_nextUpdatern r: r; r< r )r Znur! r! r" � next_update s z&_CertificateRevocationList.next_updatec C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_CRL_get_lastUpdatern r: r; r< r )r Zlur! r! r" � last_update s z&_CertificateRevocationList.last_updatec C sR | j jjd�}| j jj| j|| j jj� | j j|d | j jjk� t| j |d �S )NzASN1_BIT_STRING **r ) r r; rP r ru rn r< r: r )r rV r! r! r" rW & s z$_CertificateRevocationList.signaturec sd � j jjd�}� j jj� j|�}� j j|dk� � j jj|� fdd��}� j jj|d |�d d � S )Nzunsigned char **r c s � j jj| d �S )Nr )r r rX )rY )r r! r" rZ 5 s z?_CertificateRevocationList.tbs_certlist_bytes.<locals>.<lambda>) r r; rP r Zi2d_re_X509_CRL_tbsrn r: rB r[ )r r\ r* r! )r r" �tbs_certlist_bytes/ s z-_CertificateRevocationList.tbs_certlist_bytesc C sn | j j� }|tjjkr*| j jj|| j�}n(|tjjkrJ| j jj || j�}nt d��| j j |dk� | j j |�S )Nz/encoding must be an item from the Encoding enumr^ ) r r_ r r/ r` r ZPEM_write_bio_X509_CRLrn r0 rp ra r: rb )r rc rd r* r! r! r" r. 9 s z'_CertificateRevocationList.public_bytesc C sD | j jj| j�}| j jj||�}| j j|| j jjk� t| j | |�S )N) r r �X509_CRL_get_REVOKEDrn Zsk_X509_REVOKED_valuer: r; r< rj )r �idxrs �rr! r! r" � _revoked_certG s z(_CertificateRevocationList._revoked_certc c s& x t t| ��D ]}| j|�V qW d S )N)�range�lenr| )r �ir! r! r" �__iter__M s z#_CertificateRevocationList.__iter__c s� t |t�r8|jt� ��\}}}� fdd�t|||�D �S tj|�}|dk rV|t� �7 }d| kolt� �k n svt�� j|�S d S )Nc s g | ]}� j |��qS r! )r| )�.0r )r r! r" � <listcomp>T s z:_CertificateRevocationList.__getitem__.<locals>.<listcomp>r ) r& �slice�indicesr~ r} �operator�index� IndexErrorr| )r rz �start�stop�stepr! )r r" � __getitem__Q s z&_CertificateRevocationList.__getitem__c C s4 | j jj| j�}|| j jjkr"dS | j jj|�S d S )Nr )r r ry rn r; r< Zsk_X509_REVOKED_num)r rs r! r! r" �__len__] s z"_CertificateRevocationList.__len__c C s | j jj| j�S )N)r Z_crl_extension_parserrT rn )r r! r! r" rU d s z%_CertificateRevocationList.extensionsc C sL t |tjtjtjf�s td��| jj j | j |j �}|dkrH| jj � dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.r^ FT)r& r Z DSAPublicKeyr Z RSAPublicKeyr ZEllipticCurvePublicKeyra r r ZX509_CRL_verifyrn Z _evp_pkeyr@ )r rF r* r! r! r" �is_signature_validh s z-_CertificateRevocationList.is_signature_validN)re rf rg r# r+ r, r9 r ri rr rt rh rO rK rJ rv rw rW rx r. r| r� r� r� rU r� r! r! r! r" rm � s( rm c @ s� e Zd Zdd� Zdd� Zdd� Zdd� Zd d � Zed d � �Z ed d� �Z edd� �Z e j dd� �Zdd� Zedd� �Zedd� �Zedd� �Zdd � Zd S ) �_CertificateSigningRequestc C s || _ || _d S )N)r � _x509_req)r r Zx509_reqr! r! r" r# ~ s z#_CertificateSigningRequest.__init__c C s2 t |t�stS | jtjj�}|jtjj�}||kS )N)r& r� r( r. r r/ r0 )r r) Z self_bytesZ other_bytesr! r! r" r+ � s z!_CertificateSigningRequest.__eq__c C s | |k S )Nr! )r r) r! r! r" r, � s z!_CertificateSigningRequest.__ne__c C s t | jtjj��S )N)r- r. r r/ r0 )r r! r! r" r1 � s z#_CertificateSigningRequest.__hash__c C sH | j jj| j�}| j j|| j jjk� | j jj|| j jj�}| j j |�S )N) r r �X509_REQ_get_pubkeyr� r: r; r< rB rC rD )r rE r! r! r" rF � s z%_CertificateSigningRequest.public_keyc C s2 | j jj| j�}| j j|| j jjk� t| j |�S )N)r r ZX509_REQ_get_subject_namer� r: r; r< r )r r$ r! r! r" r$ � s z"_CertificateSigningRequest.subjectc C s8 | j }y tj| S tk r2 tdj|���Y nX d S )Nz)Signature algorithm OID:{} not recognized)rK r rL rM r r )r rN r! r! r" rO � s z3_CertificateSigningRequest.signature_hash_algorithmc C s^ | j jjd�}| j jj| j| j jj|� | j j|d | j jjk� t| j |d j �}t j |�S )Nz X509_ALGOR **r ) r r; rP r �X509_REQ_get0_signaturer� r< r: r r7 r rR )r rS rN r! r! r" rK � s z2_CertificateSigningRequest.signature_algorithm_oidc s6 � j jj� j�}� j jj|� fdd��}� j jj|�S )Nc s" � j jj| � j jj� j jjd��S )NZX509_EXTENSION_free)r r Zsk_X509_EXTENSION_pop_freer; Z addressofZ _original_lib)�x)r r! r" rZ � s z7_CertificateSigningRequest.extensions.<locals>.<lambda>)r r ZX509_REQ_get_extensionsr� r; rB Z_csr_extension_parserrT )r Z x509_extsr! )r r" rU � s z%_CertificateSigningRequest.extensionsc C sn | j j� }|tjjkr*| j jj|| j�}n(|tjjkrJ| j jj || j�}nt d��| j j |dk� | j j |�S )Nz/encoding must be an item from the Encoding enumr^ ) r r_ r r/ r` r ZPEM_write_bio_X509_REQr� r0 Zi2d_X509_REQ_biora r: rb )r rc rd r* r! r! r" r. � s z'_CertificateSigningRequest.public_bytesc sd � j jjd�}� j jj� j|�}� j j|dk� � j jj|� fdd��}� j jj|d |�d d � S )Nzunsigned char **r c s � j jj| d �S )Nr )r r rX )rY )r r! r" rZ � s zB_CertificateSigningRequest.tbs_certrequest_bytes.<locals>.<lambda>) r r; rP r Zi2d_re_X509_REQ_tbsr� r: rB r[ )r r\ r* r! )r r" �tbs_certrequest_bytes� s z0_CertificateSigningRequest.tbs_certrequest_bytesc C sR | j jjd�}| j jj| j|| j jj� | j j|d | j jjk� t| j |d �S )NzASN1_BIT_STRING **r ) r r; rP r r� r� r< r: r )r rV r! r! r" rW � s z$_CertificateSigningRequest.signaturec C sh | j jj| j�}| j j|| j jjk� | j jj|| j jj�}| j jj | j|�}|dkrd| j j � dS dS )Nr^ FT) r r r� r� r: r; r< rB rC ZX509_REQ_verifyr@ )r rE r* r! r! r" r� � s z-_CertificateSigningRequest.is_signature_validc C s t | j|j�}| jjj| j|d�}|dkr<tjdj|�|��| jjj | j|�}| jj || jj j k� | jj | jjj |�dk� | jjj|d�}| jj || jj j k� |jtjjtjjtjjfkr�tdj||j���| jjj|d|j| jj j �}| jj || jj j k� | jj jd|�}t| j|�S )Nr^ zNo {} attribute was foundr z&OID {} has a disallowed ASN.1 type: {}z ASN1_STRING *���r� )r r Z dotted_stringr ZX509_REQ_get_attr_by_OBJr� r ZAttributeNotFoundr ZX509_REQ_get_attrr: r; r< ZX509_ATTRIBUTE_countZX509_ATTRIBUTE_get0_type�typer Z UTF8String�valueZPrintableStringZ IA5StringrA ZX509_ATTRIBUTE_get0_data�castr )r rN �obj�pos�attrZ asn1_type�datar! r! r" �get_attribute_for_oid� s0 z0_CertificateSigningRequest.get_attribute_for_oidN)re rf rg r# r+ r, r1 rF rh r$ rO rK r ri rU r. r� rW r� r� r! r! r! r" r� | s r� c @ sh e Zd Zdd� Zedd� �Zedd� �Zedd� �Zed d � �Zed d � �Z d d� Z dd� Z dd� Z dS )�_SignedCertificateTimestampc C s || _ || _|| _d S )N)r Z _sct_list�_sct)r r Zsct_listZsctr! r! r" r# s z$_SignedCertificateTimestamp.__init__c C s, | j jj| j�}|| j jjks"t�tjjj S )N) r r ZSCT_get_versionr� ZSCT_VERSION_V1�AssertionErrorr �certificate_transparencyr r )r r r! r! r" r s z#_SignedCertificateTimestamp.versionc C sH | j jjd�}| j jj| j|�}|dks,t�| j jj|d |�d d � S )Nzunsigned char **r )r r; rP r ZSCT_get0_log_idr� r� r[ )r �outZ log_id_lengthr! r! r" �log_id& s z"_SignedCertificateTimestamp.log_idc C s4 | j jj| j�}|d }tjj|d �j|d d�S )Ni� )Z microsecond)r r ZSCT_get_timestampr� �datetimeZutcfromtimestamp�replace)r � timestampZ millisecondsr! r! r" r� - s z%_SignedCertificateTimestamp.timestampc C s, | j jj| j�}|| j jjks"t�tjjj S )N) r r ZSCT_get_log_entry_typer� ZCT_LOG_ENTRY_TYPE_PRECERTr� r r� Z LogEntryTypeZPRE_CERTIFICATE)r � entry_typer! r! r" r� 5 s z&_SignedCertificateTimestamp.entry_typec C sf | j jjd�}| j jj| j|�}| j j|dk� | j j|d | j jjk� | j jj|d |�d d � S )Nzunsigned char **r ) r r; rP r ZSCT_get0_signaturer� r: r< r[ )r Zptrptrr* r! r! r" � _signature= s z&_SignedCertificateTimestamp._signaturec C s t | j�S )N)r- r� )r r! r! r" r1 E s z$_SignedCertificateTimestamp.__hash__c C s t |t�stS | j|jkS )N)r& r� r( r� )r r) r! r! r" r+ H s z"_SignedCertificateTimestamp.__eq__c C s | |k S )Nr! )r r) r! r! r" r, N s z"_SignedCertificateTimestamp.__ne__N) re rf rg r# rh r r� r� r� r� r1 r+ r, r! r! r! r" r� s r� )*Z __future__r r r r� r� Z cryptographyr r Zcryptography.exceptionsr Z0cryptography.hazmat.backends.openssl.decode_asn1r r r r r Z0cryptography.hazmat.backends.openssl.encode_asn1r r Z cryptography.hazmat.primitivesr r Z)cryptography.hazmat.primitives.asymmetricr r r Zcryptography.x509.namer Zregister_interfacer' �objectr ZRevokedCertificaterj ro rm ZCertificateSigningRequestr� r� ZSignedCertificateTimestampr� r! r! r! r" �<module> s. % -