3 y�_Y~� @s�ddlmZmZmZddlZddlZddlZddlmZddl m Z mZmZm Z ddlmZddlmZddlmZmZmZmZdd �Zd d�Zdd �Zdd�Zdd�Zdd�Zdd�Zdd�ZGdd�de�Z dd�Z!dd�Z"dd�Z#d d!�Z$d"d#�Z%d$d%�Z&d&d'�Z'd(d)�Z(d*d+�Z)d,d-�Z*d.d/�Z+d0d1�Z,d2d3�Z-d4d5�Z.d6d7�Z/d8d9�Z0d:d;�Z1dZ2d�Z4ej5j6ej5j7ej5j8ej5j9ej5j:ej5j;ej5jd@dA�Z?dBdC�Z@dDdE�ZAdFdG�ZBdHdI�ZCdJdK�ZDdLdM�ZEdNdO�ZFej5jGej5j6ej5j7ej5j8ej5j9ej5j:ej5j;ej5jHej5jKsz$_decode_x509_name..��r)) rZX509_NAME_entry_count�rangeZX509_NAME_get_entryr%Z Cryptography_X509_NAME_ENTRY_set�append�addr�Name) rZ x509_name�count� attributesZprev_set_id�x�entryZ attributeZset_idrrr�_decode_x509_name<s r2cCsV|jj|�}g}x@t|�D]4}|jj||�}|j||jjk�|jt||��qW|S)N) rZsk_GENERAL_NAME_numr*Zsk_GENERAL_NAME_valuerrrr+�_decode_general_name)r�gns�num�names�i�gnrrr�_decode_general_namesNsr9cCs|j|jjkr.t||jj�jd�}tjj |�S|j|jj kr\t||jj�jd�}tjj |�S|j|jj kr�t||jj�}tjtj|��S|j|jjk�rbt||jj�}t|�}|dks�|dk�rNtj|d|d��}tj||dd��}tt|��dd�}|jd�}|dk�rt|�}d||d�k�r6td��tj|jd j|��} n tj|�} tj| �S|j|jjk�r�tj t!||jj"��S|j|jj#k�r�t||jj$�jd�}tj%j |�S|j|jj&k�r�t||jj'j(�} t)||jj'j*�}tj+tj| �|�Stj,d jtj-j.|j|j��|j��dS)N�utf8�� 0r�1zInvalid netmaskz/{}z{} is not a supported typer))/r rZGEN_DNS�_asn1_string_to_bytes�dZdNSNamerrZDNSNameZ_init_without_validationZGEN_URIZuniformResourceIdentifierZUniformResourceIdentifierZGEN_RIDrZregisteredIDZRegisteredIDr!Z GEN_IPADDZ iPAddress�len� ipaddressZ ip_address�bin�int�find� ValueErrorZ ip_networkZexploded�formatZ IPAddressZGEN_DIRNAMEZ DirectoryNamer2Z directoryNameZ GEN_EMAILZ rfc822NameZ RFC822NameZ GEN_OTHERNAMEZ otherName�type_id�_asn1_to_derr#Z OtherNameZUnsupportedGeneralNameTypeZ_GENERAL_NAMES�get)rr8r"r$Zdata_len�baseZnetmask�bits�prefixZiprIr#rrrr3YsP r3cCstj�S)N)rZOCSPNoCheck)r�extrrr�_decode_ocsp_no_check�srPcCs0|jjd|�}|jj||jj�}tjt||��S)NzASN1_INTEGER *)r�cast�gcr�ASN1_INTEGER_freerZ CRLNumber�_asn1_integer_to_int)rrO�asn1_intrrr�_decode_crl_number�srVcCs0|jjd|�}|jj||jj�}tjt||��S)NzASN1_INTEGER *)rrQrRrrSrZDeltaCRLIndicatorrT)rrOrUrrr�_decode_delta_crl_indicator�srWc@seZdZdd�Zdd�ZdS)�_X509ExtensionParsercCs||_||_||_||_dS)N)� ext_count�get_ext�handlers�_backend)�selfrrYrZr[rrr�__init__�sz_X509ExtensionParser.__init__cCspg}t�}�xXt|j|��D�]D}|j||�}|jj||jjjk�|jjj |�}|dk}t jt|j|jjj |��}||kr�t jdj|�|��|tjk�r |jjj|�} t|j| �} t| �jt�}g}x |j�s�|j|jt�j��q�Wt jdd�|D��} |jt j||| ��|j|�qn\|tjk�r||jjj|�} tt|j| ��}|jt�j �|jt j||t j!��|j|�qy|j"|}Wnvt#k �r|jjj|�} |jj| |jjjk�|jjj$| j%| j&�dd�}t j'||�}|jt j|||��YnXX|jjj(|�}||jjjk�r8|jj)�t*dj|��||j|�} |jt j||| ��|j|�qWt j+|�S)NrzDuplicate {} extension foundcSsg|]}t|�qSr)r )r'r0rrr� �sz._X509ExtensionParser.parse..z/The {} extension is invalid and can't be parsed),�setr*rYrZr\rrrrZX509_EXTENSION_get_criticalrr!rZX509_EXTENSION_get_objectZDuplicateExtensionrHrZTLS_FEATUREZX509_EXTENSION_get_datar@rZread_single_elementr Zis_emptyr+Zread_elementrZ as_integerZ TLSFeatureZ Extensionr,ZPRECERT_POISONZcheck_emptyZ PrecertPoisonr[�KeyErrorrr"�lengthZUnrecognizedExtensionZX509V3_EXT_d2iZ_consume_errorsrGZ Extensions)r]Zx509_obj� extensionsZ seen_oidsr7rOZcritZcriticalr$r"Z data_bytesZfeaturesZparsedr#�readerZhandlerZderZunrecognizedZext_datarrr�parse�sh z_X509ExtensionParser.parseN)�__name__� __module__�__qualname__r^rerrrrrX�srXcCs@|jjd|�}|jj||jj�}|jj|�}g}�xt|�D]�}d}|jj||�}tj t ||j��}|j|jj k�r |jj|j�}g}x�t|�D]�} |jj|j| �} tj t || j��}|tjkr�|jj| jjj| jjj�dd�jd�}|j|�q�|tjk�st�t|| jj�} |j| �q�W|jtj||��qW|S)Nz*Cryptography_STACK_OF_ACCESS_DESCRIPTION *cs�jj|�jj�jjd��S)NZACCESS_DESCRIPTION_free)rZsk_ACCESS_DESCRIPTION_pop_freerZ addressofZ _original_lib)r0)rrr�vsz,_decode_information_access..)rrQrRrZsk_ACCESS_DESCRIPTION_numr*Zsk_ACCESS_DESCRIPTION_valuer�methodrrr!r�locationr3r+ZAccessDescription)rZiar5�access_descriptionsr7Zadr$r8r)rr�_decode_information_accessrsrcCst||�}tj|�S)N)rrZAuthorityInformationAccess)r�aiar~rrr�$_decode_authority_information_access�s r�cCst||�}tj|�S)N)rrZSubjectInformationAccess)rr�r~rrr�"_decode_subject_information_access�s r�c Cs�|jjd|�}|jj||jj�}|jj}||d�dk}||d�dk}||d�dk}||d�dk}||d�dk}||d�dk}||d�dk} ||d �dk} ||d �dk}tj||||||| | |� S)NzASN1_BIT_STRING *rrr=��r;)rrQrRrZASN1_BIT_STRING_free�ASN1_BIT_STRING_get_bitrZKeyUsage)rZ bit_stringZget_bitZdigital_signatureZcontent_commitmentZkey_enciphermentZdata_enciphermentZ key_agreementZ key_cert_signZcrl_signZ encipher_onlyZ decipher_onlyrrr�_decode_key_usage�s,r�cCs.|jjd|�}|jj||jj�}t||�}|S)NzGENERAL_NAMES *)rrQrRr�GENERAL_NAMES_freer9)rr4� general_namesrrr�_decode_general_names_extension�s r�cCstjt||��S)N)rZSubjectAlternativeNamer�)rrOrrr�_decode_subject_alt_name�sr�cCstjt||��S)N)rZIssuerAlternativeNamer�)rrOrrr�_decode_issuer_alt_name�sr�cCsF|jjd|�}|jj||jj�}t||j�}t||j�}tj ||d�S)NzNAME_CONSTRAINTS *)Zpermitted_subtreesZexcluded_subtrees) rrQrRrZNAME_CONSTRAINTS_free�_decode_general_subtreesZpermittedSubtreesZexcludedSubtreesrZNameConstraints)rZncZ permittedZexcludedrrr�_decode_name_constraints�sr�cCsl||jjkrdS|jj|�}g}xFt|�D]:}|jj||�}|j||jjk�t||j�}|j |�q*W|S)N) rrrZsk_GENERAL_SUBTREE_numr*Zsk_GENERAL_SUBTREE_valuerr3rLr+)rZstack_subtreesr5Zsubtreesr7r�namerrrr��sr�c Cs�|jjd|�}|jj||jj�}|j|jjkr@t||j�\}}nd}d}|jdk}|j dk}|j dk}|jdk}|j|jjkr�t ||j�}nd}tj|||||||�S)NzISSUING_DIST_POINT *rr)rrQrRrZISSUING_DIST_POINT_free� distpointr�_decode_distpointZonlyuserZonlyCAZindirectCRLZonlyattrZonlysomereasons�_decode_reasonsrZIssuingDistributionPoint) rZidp� full_name� relative_nameZ only_userZonly_caZindirect_crlZ only_attrZonly_some_reasonsrrr�_decode_issuing_dist_point�s* r�cCsD|jjd|�}|jj||jj�}t||j�}t||j�}tj ||�S)NzPOLICY_CONSTRAINTS *) rrQrRrZPOLICY_CONSTRAINTS_freertZrequireExplicitPolicyZinhibitPolicyMappingrZPolicyConstraints)rZpcZrequire_explicit_policyZinhibit_policy_mappingrrr�_decode_policy_constraints�s r�cCs�|jjd|�}|jj||jj�}|jj|�}g}xJt|�D]>}|jj||�}|j||jj k�t jt||��}|j |�q:Wt j|�S)Nz#Cryptography_STACK_OF_ASN1_OBJECT *)rrQrRrZsk_ASN1_OBJECT_freeZsk_ASN1_OBJECT_numr*Zsk_ASN1_OBJECT_valuerrrr!rr+ZExtendedKeyUsage)rZskr5Zekusr7rr$rrr�_decode_extended_key_usagesr�rc Cs�|jjd|�}|jj||jj�}|jj|�}g}x�t|�D]�}d}d}d}d}|jj||�} | j|jj krvt || j�}| j|jj kr�t|| j�}| j |jj kr�t|| j �\}}|jtj||||��q:W|S)Nz"Cryptography_STACK_OF_DIST_POINT *)rrQrRrZCRL_DIST_POINTS_freeZsk_DIST_POINT_numr*Zsk_DIST_POINT_value�reasonsrr�Z CRLissuerr9r�r�r+rZDistributionPoint) r�cdpsr5�dist_pointsr7r�r�Z crl_issuerr�Zcdprrr�_decode_dist_pointss*r�)rr=r�r�r�r�r�r;cCs<g}x.tjt�D] \}}|jj||�r|j|�qWt|�S)N)�sixZ iteritems�_REASON_BIT_MAPPINGrr�r+� frozenset)rr�Zenum_reasonsZbit_position�reasonrrrr�Ss r�c Cs�|jtkr t||jj�}|dfS|jj}|jj|�}t�}x@t |�D]4}|jj ||�}|j||jj k�|jt||��qDWtj|�}d|fS)N)r �_DISTPOINT_TYPE_FULLNAMEr9r��fullnameZrelativenamerZsk_X509_NAME_ENTRY_numr`r*Zsk_X509_NAME_ENTRY_valuerrrr,r%rr&) rr�r�ZrnsZrnumr/r7Zrnr�rrrr�]s r�cCst||�}tj|�S)N)r�rZCRLDistributionPoints)rr�r�rrr�_decode_crl_distribution_pointsvs r�cCst||�}tj|�S)N)r�rZFreshestCRL)rr�r�rrr�_decode_freshest_crl{s r�cCs4|jjd|�}|jj||jj�}t||�}tj|�S)NzASN1_INTEGER *)rrQrRrrSrTrZInhibitAnyPolicy)rrUZ skip_certsrrr�_decode_inhibit_any_policy�s r�cCsnddlm}|jjd|�}|jj||jj�}g}x8t|jj|��D]$}|jj ||�}|j ||||��qBW|S)Nr)�_SignedCertificateTimestampzCryptography_STACK_OF_SCT *)Z)cryptography.hazmat.backends.openssl.x509r�rrQrRrZ SCT_LIST_freer*Z sk_SCT_numZsk_SCT_valuer+)r� asn1_sctsr�Zsctsr7Zsctrrr�_decode_scts�sr�cCstjt||��S)N)rZ)PrecertificateSignedCertificateTimestampsr�)rr�rrr�-_decode_precert_signed_certificate_timestamps�sr�cCstjt||��S)N)rZSignedCertificateTimestampsr�)rr�rrr�%_decode_signed_certificate_timestamps�sr�) rrr=r�r�r�r�r;� � r=r�r�r�r�r;r�r�cCsb|jjd|�}|jj||jj�}|jj|�}ytjt|�St k r\t dj|��YnXdS)NzASN1_ENUMERATED *zUnsupported reason code: {})rrQrRrZASN1_ENUMERATED_freeZASN1_ENUMERATED_getrZ CRLReason�_CRL_ENTRY_REASON_CODE_TO_ENUMrarGrH)r�enum�coderrr�_decode_crl_reason�sr�cCs0|jjd|�}|jj||jj�}tjt||��S)NzASN1_GENERALIZEDTIME *)rrQrRr�ASN1_GENERALIZEDTIME_freerZInvalidityDate�_parse_asn1_generalized_time)rZinv_date�generalized_timerrr�_decode_invalidity_date�s r�cCs4|jjd|�}|jj||jj�}t||�}tj|�S)NzGENERAL_NAMES *)rrQrRrr�r9rZCertificateIssuer)rr4r�rrr�_decode_cert_issuer�s r�csn�jjd�}�jj||�}�j|dk��j|d�jjk��jj|�fdd��}�jj|d|�dd�S)Nzunsigned char **rcs�jj|d�S)Nr)r�OPENSSL_free)r)rrrr{�sz_asn1_to_der..)rrrZ i2d_ASN1_TYPErrrRr)rZ asn1_typerrr)rrrJ�srJcCs@|jj||jj�}|j||jjk�|jj||jj�}|j|�S)N)rZASN1_INTEGER_to_BNrrrrRZBN_freeZ _bn_to_int)rrUZbnrrrrT�srTcCs||jjkrdSt||�SdS)N)rrrT)rrUrrrrt�srtcCs|jj|j|j�dd�S)N)rrr"rb)rrwrrrr@�sr@cCst||�jd�S)Nri)r@r)rrwrrr�_asn1_string_to_asciisr�cs~�jjd�}�jj||�}|dkr2tdj|j��j|d�jjk��jj |�fdd��}�jj |d|�dd�jd�S) Nzunsigned char **rz&Unsupported ASN1 string type. Type: {}rcs�jj|d�S)Nr)rr�)r)rrrr{sz&_asn1_string_to_utf8..r:r))rrrZASN1_STRING_to_UTF8rGrHr rrrRrr)rrwrrr)rrrsrcCs`|j||jjk�|jj||jj�}||jjkrDtdjt||��|jj||jj �}t ||�S)Nz1Couldn't parse ASN.1 time as generalizedtime {!r})rrrrZASN1_TIME_to_generalizedtimerGrHr@rRr�r�)rZ asn1_timer�rrr�_parse_asn1_timesr�cCs"t||jjd|��}tjj|d�S)Nz ASN1_STRING *z %Y%m%d%H%M%SZ)r�rrQ�datetimeZstrptime)rr�Ztimerrrr�'sr�cCs0|jjd|�}|jj||jj�}tjt||��S)NzASN1_OCTET_STRING *)rrQrRrrvrZ OCSPNoncer@)rZnoncerrr� _decode_nonce.sr�)wZ __future__rrrr�rCr�ZcryptographyrZcryptography.hazmat._derrrrr Zcryptography.x509.extensionsr Zcryptography.x509.namerZcryptography.x509.oidrr rrrr%r2r9r3rPrVrW�objectrXrprnrurxrzrr�r�r�r�r�r�r�r�r�r�r�r�Z_DISTPOINT_TYPE_RELATIVENAMEr�ZReasonFlagsZkey_compromiseZ ca_compromiseZaffiliation_changedZ supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZ aa_compromiser�r�r�r�r�r�r�r�r�ZunspecifiedZremove_from_crlr�Z_CRL_ENTRY_REASON_ENUM_TO_CODEr�r�r�rJrTrtr@r�rr�r�r�ZBASIC_CONSTRAINTSZSUBJECT_KEY_IDENTIFIERZ KEY_USAGEZSUBJECT_ALTERNATIVE_NAMEZEXTENDED_KEY_USAGEZAUTHORITY_KEY_IDENTIFIERZAUTHORITY_INFORMATION_ACCESSZSUBJECT_INFORMATION_ACCESSZCERTIFICATE_POLICIESZCRL_DISTRIBUTION_POINTSZFRESHEST_CRLZ OCSP_NO_CHECKZINHIBIT_ANY_POLICYZISSUER_ALTERNATIVE_NAMEZNAME_CONSTRAINTSZPOLICY_CONSTRAINTSZ_EXTENSION_HANDLERS_BASEZ%PRECERT_SIGNED_CERTIFICATE_TIMESTAMPSZ_EXTENSION_HANDLERS_SCTZ CRL_REASONZINVALIDITY_DATEZCERTIFICATE_ISSUERZ_REVOKED_EXTENSION_HANDLERSZ CRL_NUMBERZDELTA_CRL_INDICATORZISSUING_DISTRIBUTION_POINTZ_CRL_EXTENSION_HANDLERSZNONCEZ_OCSP_REQ_EXTENSION_HANDLERSZ"_OCSP_BASICRESP_EXTENSION_HANDLERSZSIGNED_CERTIFICATE_TIMESTAMPSZ'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCTrrrr�s�NQ! -