o
     `tT                     @   s.  d dl mZmZmZ d dlZd dlZd dlmZmZ d dl	m
Z
 d dlmZmZmZmZmZ d dlmZmZ d dlmZmZ d dlmZmZmZ d d	lmZ eejG d
d deZ eej!G dd deZ"eej#G dd deZ$eej%G dd deZ&eej'j(G dd deZ)dS )    )absolute_importdivisionprint_functionN)utilsx509)UnsupportedAlgorithm)_asn1_integer_to_int_asn1_string_to_bytes_decode_x509_name_obj2txt_parse_asn1_time)_encode_asn1_int_gc_txt2obj_gc)hashesserialization)dsaecrsa)	_ASN1Typec                   @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	e
dZedd Zdd Zedd Zedd Zedd Zedd Zedd Zedd Ze
jd d! Zed"d# Zed$d% Zd&d' Zd(S ))_Certificatec                 C   sZ   || _ || _| j j| j}|dkrtjj| _d S |dkr$tjj| _d S t	d
||)Nr      z{} is not a valid X509 version)_backend_x509_libZX509_get_versionr   Versionv1_versionZv3InvalidVersionformat)selfbackendZ	x509_certversion r"   home/ych/rk3568/buildroot/output/rockchip_rk3568/host/lib/python3.10/site-packages/cryptography/hazmat/backends/openssl/x509.py__init__   s   
z_Certificate.__init__c                 C   s   d | jS )Nz<Certificate(subject={}, ...)>)r   subjectr   r"   r"   r#   __repr__,   s   z_Certificate.__repr__c                 C   ,   t |tjstS | jj| j|j}|dkS Nr   )
isinstancer   CertificateNotImplementedr   r   ZX509_cmpr   r   otherresr"   r"   r#   __eq__/      z_Certificate.__eq__c                 C   
   | |k S Nr"   r   r.   r"   r"   r#   __ne__6      
z_Certificate.__ne__c                 C      t | tjjS r3   hashpublic_bytesr   EncodingDERr&   r"   r"   r#   __hash__9      z_Certificate.__hash__c                 C   s   | S r3   r"   )r   memor"   r"   r#   __deepcopy__<   s   z_Certificate.__deepcopy__c                 C   s*   t || j}|| tjj | S r3   )	r   Hashr   updater:   r   r;   r<   finalize)r   	algorithmhr"   r"   r#   fingerprint?   s   z_Certificate.fingerprintr   c                 C   2   | j j| j}| j || j jjk t| j |S r3   )r   r   ZX509_get_serialNumberr   openssl_assert_ffiNULLr   r   asn1_intr"   r"   r#   serial_numberF      z_Certificate.serial_numberc                 C   sR   | j j| j}|| j jjkr| j   td| j j|| j jj	}| j 
|S )Nz,Certificate public key is of an unknown type)r   r   ZX509_get_pubkeyr   rI   rJ   _consume_errors
ValueErrorgcEVP_PKEY_free_evp_pkey_to_public_keyr   pkeyr"   r"   r#   
public_keyL   s   
z_Certificate.public_keyc                 C      | j j| j}t| j |S r3   )r   r   ZX509_getm_notBeforer   r   r   Z	asn1_timer"   r"   r#   not_valid_beforeW      z_Certificate.not_valid_beforec                 C   rW   r3   )r   r   ZX509_getm_notAfterr   r   rX   r"   r"   r#   not_valid_after\   rZ   z_Certificate.not_valid_afterc                 C   rG   r3   )r   r   ZX509_get_issuer_namer   rH   rI   rJ   r
   r   issuerr"   r"   r#   r]   a   rN   z_Certificate.issuerc                 C   rG   r3   )r   r   ZX509_get_subject_namer   rH   rI   rJ   r
   r   r%   r"   r"   r#   r%   g   rN   z_Certificate.subjectc                 C   0   | j }ztj| W S  ty   td|w Nz)Signature algorithm OID:{} not recognizedsignature_algorithm_oidr   Z_SIG_OIDS_TO_HASHKeyErrorr   r   r   oidr"   r"   r#   signature_hash_algorithmm      z%_Certificate.signature_hash_algorithmc                 C   s^   | j jd}| j j| j jj|| j | j |d | j jjk t| j |d j	}t
|S NzX509_ALGOR **r   )r   rI   newr   X509_get0_signaturerJ   r   rH   r   rD   r   ObjectIdentifierr   Zalgre   r"   r"   r#   rb   w      
z$_Certificate.signature_algorithm_oidc                 C      | j j| jS r3   )r   Z_certificate_extension_parserparser   r&   r"   r"   r#   
extensions      z_Certificate.extensionsc                 C   sR   | j jd}| j j|| j jj| j | j |d | j jjk t| j |d S NzASN1_BIT_STRING **r   )	r   rI   ri   r   rj   rJ   r   rH   r	   r   sigr"   r"   r#   	signature      z_Certificate.signaturec                    d    j jd} j j j|} j |dk  j j| fdd} j j|d |d d  S )Nunsigned char **r   c                        j j| d S r)   r   r   ZOPENSSL_freepointerr&   r"   r#   <lambda>       z4_Certificate.tbs_certificate_bytes.<locals>.<lambda>)	r   rI   ri   r   Zi2d_re_X509_tbsr   rH   rQ   bufferr   ppr/   r"   r&   r#   tbs_certificate_bytes      z"_Certificate.tbs_certificate_bytesc                 C   n   | j  }|tjju r| j j|| j}n|tjju r%| j j	|| j}nt
d| j |dk | j |S Nz/encoding must be an item from the Encoding enum   )r   _create_mem_bio_gcr   r;   PEMr   ZPEM_write_bio_X509r   r<   Zi2d_X509_bio	TypeErrorrH   _read_mem_bior   encodingbior/   r"   r"   r#   r:      s   
z_Certificate.public_bytesN)__name__
__module____qualname__r$   r'   r0   r5   r=   r@   rF   r   Zread_only_propertyr!   propertyrM   rV   rY   r[   r]   r%   rf   rb   cached_propertyrp   ru   r   r:   r"   r"   r"   r#   r      s>    






	
	


	r   c                   @   s:   e Zd Zdd Zedd Zedd Zejdd Z	d	S )
_RevokedCertificatec                 C      || _ || _|| _d S r3   )r   Z_crl_x509_revoked)r   r    ZcrlZx509_revokedr"   r"   r#   r$      s   
z_RevokedCertificate.__init__c                 C   rG   r3   )r   r   ZX509_REVOKED_get0_serialNumberr   rH   rI   rJ   r   rK   r"   r"   r#   rM      s
   z!_RevokedCertificate.serial_numberc                 C   s   t | j| jj| jS r3   )r   r   r   Z X509_REVOKED_get0_revocationDater   r&   r"   r"   r#   revocation_date   s   z#_RevokedCertificate.revocation_datec                 C   rn   r3   )r   Z_revoked_cert_extension_parserro   r   r&   r"   r"   r#   rp      s   z_RevokedCertificate.extensionsN)
r   r   r   r$   r   rM   r   r   r   rp   r"   r"   r"   r#   r      s    

r   c                   @   s   e Zd Zdd Zdd Zdd Zdd Zejd	d
 Z	dd Z
edd Zedd Zedd Zedd Zedd Zedd Zedd Zdd Zdd Zdd  Zd!d" Zd#d$ Zejd%d& Zd'd( Zd)S )*_CertificateRevocationListc                 C      || _ || _d S r3   )r   	_x509_crl)r   r    Zx509_crlr"   r"   r#   r$         
z#_CertificateRevocationList.__init__c                 C   r(   r)   )r*   r   CertificateRevocationListr,   r   r   ZX509_CRL_cmpr   r-   r"   r"   r#   r0      r1   z!_CertificateRevocationList.__eq__c                 C   r2   r3   r"   r4   r"   r"   r#   r5      r6   z!_CertificateRevocationList.__ne__c                 C   sX   t || j}| j }| jj|| j}| j|dk | j|}|	| |
 S )Nr   )r   rA   r   r   r   i2d_X509_CRL_bior   rH   r   rB   rC   )r   rD   rE   r   r/   Zderr"   r"   r#   rF      s   

z&_CertificateRevocationList.fingerprintc                 C   s@   | j j| j}| j || j jjk | j j|| j jj}|S r3   )	r   r   ZX509_CRL_dupr   rH   rI   rJ   rQ   ZX509_CRL_free)r   dupr"   r"   r#   _sorted_crl   s   z&_CertificateRevocationList._sorted_crlc                 C   sh   | j jd}t| j |}| j j| j||}|dkrd S | j |d | j jjk t	| j | j|d S )NzX509_REVOKED **r   )
r   rI   ri   r   r   ZX509_CRL_get0_by_serialr   rH   rJ   r   )r   rM   revokedrL   r/   r"   r"   r#   (get_revoked_certificate_by_serial_number   s   zC_CertificateRevocationList.get_revoked_certificate_by_serial_numberc                 C   r_   r`   ra   rd   r"   r"   r#   rf      rg   z3_CertificateRevocationList.signature_hash_algorithmc                 C   ^   | j jd}| j j| j| j jj| | j |d | j jjk t| j |d j	}t
|S rh   )r   rI   ri   r   X509_CRL_get0_signaturer   rJ   rH   r   rD   r   rk   rl   r"   r"   r#   rb     rm   z2_CertificateRevocationList.signature_algorithm_oidc                 C   rG   r3   )r   r   ZX509_CRL_get_issuerr   rH   rI   rJ   r
   r\   r"   r"   r#   r]     rN   z!_CertificateRevocationList.issuerc                 C   rG   r3   )r   r   ZX509_CRL_get_nextUpdater   rH   rI   rJ   r   )r   nur"   r"   r#   next_update  rN   z&_CertificateRevocationList.next_updatec                 C   rG   r3   )r   r   ZX509_CRL_get_lastUpdater   rH   rI   rJ   r   )r   Zlur"   r"   r#   last_update  rN   z&_CertificateRevocationList.last_updatec                 C   R   | j jd}| j j| j|| j jj | j |d | j jjk t| j |d S rr   )	r   rI   ri   r   r   r   rJ   rH   r	   rs   r"   r"   r#   ru   "  rv   z$_CertificateRevocationList.signaturec                    rw   )Nrx   r   c                    ry   r)   rz   r{   r&   r"   r#   r}   1  r~   z?_CertificateRevocationList.tbs_certlist_bytes.<locals>.<lambda>)	r   rI   ri   r   Zi2d_re_X509_CRL_tbsr   rH   rQ   r   r   r"   r&   r#   tbs_certlist_bytes+  r   z-_CertificateRevocationList.tbs_certlist_bytesc                 C   r   r   )r   r   r   r;   r   r   ZPEM_write_bio_X509_CRLr   r<   r   r   rH   r   r   r"   r"   r#   r:   5     
z'_CertificateRevocationList.public_bytesc                 C   sD   | j j| j}| j j||}| j || j jjk t| j | |S r3   )	r   r   X509_CRL_get_REVOKEDr   Zsk_X509_REVOKED_valuerH   rI   rJ   r   )r   idxr   rr"   r"   r#   _revoked_certC  s   z(_CertificateRevocationList._revoked_certc                 c   s$    t t| D ]}| |V  qd S r3   )rangelenr   )r   ir"   r"   r#   __iter__I  s   z#_CertificateRevocationList.__iter__c                    s   t |tr|t \}}} fddt|||D S t|}|dk r+|t 7 }d|  kr8t k s;t t |S )Nc                    s   g | ]}  |qS r"   )r   ).0r   r&   r"   r#   
<listcomp>P  s    z:_CertificateRevocationList.__getitem__.<locals>.<listcomp>r   )	r*   sliceindicesr   r   operatorindex
IndexErrorr   )r   r   startstopstepr"   r&   r#   __getitem__M  s   


z&_CertificateRevocationList.__getitem__c                 C   s0   | j j| j}|| j jjkrdS | j j|S r)   )r   r   r   r   rI   rJ   Zsk_X509_REVOKED_num)r   r   r"   r"   r#   __len__Y  s   z"_CertificateRevocationList.__len__c                 C   rn   r3   )r   Z_crl_extension_parserro   r   r&   r"   r"   r#   rp   `  rq   z%_CertificateRevocationList.extensionsc                 C   sL   t |tjtjtjfstd| jj	
| j|j}|dkr$| j  dS dS )NzGExpecting one of DSAPublicKey, RSAPublicKey, or EllipticCurvePublicKey.r   FT)r*   r   ZDSAPublicKeyr   ZRSAPublicKeyr   ZEllipticCurvePublicKeyr   r   r   ZX509_CRL_verifyr   Z	_evp_pkeyrO   )r   rV   r/   r"   r"   r#   is_signature_validd  s   
z-_CertificateRevocationList.is_signature_validN)r   r   r   r$   r0   r5   rF   r   r   r   r   r   rf   rb   r]   r   r   ru   r   r:   r   r   r   r   rp   r   r"   r"   r"   r#   r      s<    	
	
	
	




	
r   c                   @   s   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zedd Z	edd Z
edd Zejdd Zdd Zedd Zedd Zedd Zdd ZdS )_CertificateSigningRequestc                 C   r   r3   )r   	_x509_req)r   r    Zx509_reqr"   r"   r#   r$   z  r   z#_CertificateSigningRequest.__init__c                 C   s2   t |tstS | tjj}|tjj}||kS r3   )r*   r   r,   r:   r   r;   r<   )r   r.   Z
self_bytesZother_bytesr"   r"   r#   r0   ~  s
   
z!_CertificateSigningRequest.__eq__c                 C   r2   r3   r"   r4   r"   r"   r#   r5     r6   z!_CertificateSigningRequest.__ne__c                 C   r7   r3   r8   r&   r"   r"   r#   r=     r>   z#_CertificateSigningRequest.__hash__c                 C   sH   | j j| j}| j || j jjk | j j|| j jj}| j 	|S r3   )
r   r   X509_REQ_get_pubkeyr   rH   rI   rJ   rQ   rR   rS   rT   r"   r"   r#   rV     s   z%_CertificateSigningRequest.public_keyc                 C   rG   r3   )r   r   ZX509_REQ_get_subject_namer   rH   rI   rJ   r
   r^   r"   r"   r#   r%     rN   z"_CertificateSigningRequest.subjectc                 C   r_   r`   ra   rd   r"   r"   r#   rf     rg   z3_CertificateSigningRequest.signature_hash_algorithmc                 C   r   rh   )r   rI   ri   r   X509_REQ_get0_signaturer   rJ   rH   r   rD   r   rk   rl   r"   r"   r#   rb     rm   z2_CertificateSigningRequest.signature_algorithm_oidc                    s6    j j j} j j| fdd} j j|S )Nc                    s"    j j|  j j j jjdS )NZX509_EXTENSION_free)r   r   Zsk_X509_EXTENSION_pop_freerI   	addressofZ_original_lib)xr&   r"   r#   r}     s    
z7_CertificateSigningRequest.extensions.<locals>.<lambda>)r   r   ZX509_REQ_get_extensionsr   rI   rQ   Z_csr_extension_parserro   )r   Z	x509_extsr"   r&   r#   rp     s   
	z%_CertificateSigningRequest.extensionsc                 C   r   r   )r   r   r   r;   r   r   ZPEM_write_bio_X509_REQr   r<   Zi2d_X509_REQ_bior   rH   r   r   r"   r"   r#   r:     r   z'_CertificateSigningRequest.public_bytesc                    rw   )Nrx   r   c                    ry   r)   rz   r{   r&   r"   r#   r}     r~   zB_CertificateSigningRequest.tbs_certrequest_bytes.<locals>.<lambda>)	r   rI   ri   r   Zi2d_re_X509_REQ_tbsr   rH   rQ   r   r   r"   r&   r#   tbs_certrequest_bytes  r   z0_CertificateSigningRequest.tbs_certrequest_bytesc                 C   r   rr   )	r   rI   ri   r   r   r   rJ   rH   r	   rs   r"   r"   r#   ru     rv   z$_CertificateSigningRequest.signaturec                 C   sh   | j j| j}| j || j jjk | j j|| j jj}| j j	| j|}|dkr2| j 
  dS dS )Nr   FT)r   r   r   r   rH   rI   rJ   rQ   rR   ZX509_REQ_verifyrO   )r   rU   r/   r"   r"   r#   r     s   
z-_CertificateSigningRequest.is_signature_validc                 C   s   t | j|j}| jj| j|d}|dkrtd||| jj	| j|}| j
|| jjjk | j
| jj|dk | jj|d}| j
|| jjjk |jtjjtjjtjjfvritd||j| jj|d|j| jjj}| j
|| jjjk | jjd|}t| j|S )NzNo {} attribute was foundr   r   z&OID {} has a disallowed ASN.1 type: {}zASN1_STRING *)r   r   Zdotted_stringr   ZX509_REQ_get_attr_by_OBJr   r   ZAttributeNotFoundr   ZX509_REQ_get_attrrH   rI   rJ   ZX509_ATTRIBUTE_countZX509_ATTRIBUTE_get0_typetyper   Z
UTF8StringvalueZPrintableStringZ	IA5StringrP   ZX509_ATTRIBUTE_get0_datacastr	   )r   re   objposattrZ	asn1_typedatar"   r"   r#   get_attribute_for_oid  s>   
z0_CertificateSigningRequest.get_attribute_for_oidN)r   r   r   r$   r0   r5   r=   rV   r   r%   rf   rb   r   r   rp   r:   r   ru   r   r   r"   r"   r"   r#   r   x  s,    

	
	

	

r   c                   @   sh   e Zd Zdd Zedd Zedd Zedd Zed	d
 Zedd Z	dd Z
dd Zdd ZdS )_SignedCertificateTimestampc                 C   r   r3   )r   Z	_sct_list_sct)r   r    Zsct_listZsctr"   r"   r#   r$     s   
z$_SignedCertificateTimestamp.__init__c                 C   ,   | j j| j}|| j jjksJ tjjjS r3   )	r   r   ZSCT_get_versionr   ZSCT_VERSION_V1r   certificate_transparencyr   r   )r   r!   r"   r"   r#   r!     s   
z#_SignedCertificateTimestamp.versionc                 C   sH   | j jd}| j j| j|}|dksJ | j j|d |d d  S Nrx   r   )r   rI   ri   r   ZSCT_get0_log_idr   r   )r   outZlog_id_lengthr"   r"   r#   log_id"  s   z"_SignedCertificateTimestamp.log_idc                 C   s4   | j j| j}|d }tj|d j|d dS )Ni  )microsecond)r   r   ZSCT_get_timestampr   datetimeutcfromtimestampreplace)r   	timestampZmillisecondsr"   r"   r#   r   )  s
   z%_SignedCertificateTimestamp.timestampc                 C   r   r3   )	r   r   ZSCT_get_log_entry_typer   ZCT_LOG_ENTRY_TYPE_PRECERTr   r   ZLogEntryTypeZPRE_CERTIFICATE)r   
entry_typer"   r"   r#   r   1  s   
z&_SignedCertificateTimestamp.entry_typec                 C   sf   | j jd}| j j| j|}| j |dk | j |d | j jjk | j j|d |d d  S r   )	r   rI   ri   r   ZSCT_get0_signaturer   rH   rJ   r   )r   Zptrptrr/   r"   r"   r#   
_signature9  s
   z&_SignedCertificateTimestamp._signaturec                 C   s
   t | jS r3   )r9   r   r&   r"   r"   r#   r=   A  r6   z$_SignedCertificateTimestamp.__hash__c                 C   s   t |tstS | j|jkS r3   )r*   r   r,   r   r4   r"   r"   r#   r0   D  s   
z"_SignedCertificateTimestamp.__eq__c                 C   r2   r3   r"   r4   r"   r"   r#   r5   J  r6   z"_SignedCertificateTimestamp.__ne__N)r   r   r   r$   r   r!   r   r   r   r   r=   r0   r5   r"   r"   r"   r#   r     s    




r   )*
__future__r   r   r   r   r   cryptographyr   r   Zcryptography.exceptionsr   Z0cryptography.hazmat.backends.openssl.decode_asn1r   r	   r
   r   r   Z0cryptography.hazmat.backends.openssl.encode_asn1r   r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r   Zcryptography.x509.namer   Zregister_interfacer+   objectr   ZRevokedCertificater   r   r   ZCertificateSigningRequestr   r   ZSignedCertificateTimestampr   r"   r"   r"   r#   <module>   s2   
 
	
% 
- 