| Server IP : 192.158.238.246 / Your IP : 3.15.5.27 Web Server : LiteSpeed System : Linux uniform.iwebfusion.net 4.18.0-553.27.1.lve.1.el8.x86_64 #1 SMP Wed Nov 20 15:58:00 UTC 2024 x86_64 User : jenniferflocom ( 1321) PHP Version : 8.1.32 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : OFF | Pkexec : OFF Directory : /usr/lib/python3.6/site-packages/asn1crypto/__pycache__/ |
Upload File : |
3
��2Z�h � @ st d Z ddlmZmZmZmZ ddlmZ ddlm Z ddl
Z
ddl Z ddl Z ddl
Z
ddlZddlZddlmZ ddlmZmZ dd lmZ dd
lmZmZmZ dd lm Z m Z m Z m Z dd l m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< dd
l=m>Z> ddl?m@Z@mAZAmBZBmCZC G dd� de*�ZDG dd� de*�ZEG dd� de*�ZFG dd� de0�ZGG dd� de3�ZHG dd� de4�ZIG dd � d e"�ZJG d d � d e3�ZKG d d � d e7�ZLed!d"� �ZMG d#d$� d$e%�ZNG d%d&� d&e.�ZOG d'd(� d(e3�ZPG d)d*� d*e6�ZQG d+d,� d,e4�ZRG d-d.� d.e%�ZSG d/d0� d0e3�ZTG d1d2� d2e%�ZUG d3d4� d4e%�ZVG d5d6� d6e%�ZWG d7d8� d8e5�ZXG d9d:� d:e5�ZYG d;d<� d<e4�ZZG d=d>� d>e4�Z[G d?d@� d@e3�Z\G dAdB� dBe3�Z]G dCdD� dDe4�Z^G dEdF� dFe3�Z_G dGdH� dHe4�Z`G dIdJ� dJe%�ZaG dKdL� dLe%�ZbG dMdN� dNe5�ZcG dOdP� dPe4�ZdG dQdR� dRe5�ZeG dSdT� dTe3�ZfG dUdV� dVe6�ZgG dWdX� dXe3�ZhG dYdZ� dZe%�ZiG d[d\� d\e+�ZjG d]d^� d^e+�ZkG d_d`� d`e3�ZlG dadb� dbe4�ZmG dcdd� dde3�ZnG dedf� dfe3�ZoG dgdh� dhe%�ZpG didj� dje4�ZqG dkdl� dle%�ZrG dmdn� dne3�ZsG dodp� dpe3�ZtG dqdr� dre3�ZuG dsdt� dte%�ZvG dudv� dve"�ZwG dwdx� dxe3�ZxG dydz� dze4�ZyG d{d|� d|e3�ZzG d}d~� d~e3�Z{G dd�� d�e4�Z|G d�d�� d�e%�Z}G d�d�� d�e4�Z~G d�d�� d�e3�ZG d�d�� d�e3�Z�G d�d�� d�e.�Z�G d�d�� d�e3�Z�G d�d�� d�e4�Z�G d�d�� d�e.�Z�G d�d�� d�e3�Z�G d�d�� d�e4�Z�G d�d�� d�e3�Z�G d�d�� d�e4�Z�G d�d�� d�e3�Z�G d�d�� d�e.�Z�G d�d�� d�e4�Z�G d�d�� d�e.�Z�G d�d�� d�e3�Z�G d�d�� d�e4�Z�G d�d�� d�e4�Z�G d�d�� d�e4�Z�G d�d�� d�e3�Z�G d�d�� d�e"�Z�G d�d�� d�e+�Z�G d�d�� d�e3�Z�G d�d�� d�e6�Z�G d�d�� d�e3�Z�G d�d�� d�e3�Z�G d�d�� d�e6�Z�G d�d�� d�e'�Z�G d�d�� d�e'�Z�G d�d�� d�e'�Z�G d�d�� d�e'�Z�G d�d d�e'�Z�G d�dĄ d�e'�Z�G d�dƄ d�e3�Z�G d�dȄ d�e3�Z�G d�dʄ d�e'�Z�G d�d̄ d�e3�Z�G d�d΄ d�e3�Z�G d�dЄ d�e6�Z�G d�d҄ d�e.�Z�G d�dԄ d�e6�Z�G d�dք d�e6�Z�G d�d d�e6�Z�G d�dڄ d�e3�Z�G d�d܄ d�e6�Z�G d�dބ d�e3�Z�G d�d� d�e4�Z�G d�d� d�e.�Z�G d�d� d�e3�Z�G d�d� d�e4�Z�G d�d� d�e3�Z�G d�d� d�e3�Z�G d�d� d�e4�Z�G d�d� d�e4�Z�G d�d� d�e3�Z�G d�d� d�e&�Z�dS )�z�
ASN.1 type classes for X.509 certificates. Exports the following items:
- Attributes()
- Certificate()
- Extensions()
- GeneralName()
- GeneralNames()
- Name()
Other type classes are defined that help compose the types listed above.
� )�unicode_literals�division�absolute_import�print_function)�contextmanager)�idnaN� )�unwrap)�
iri_to_uri�
uri_to_iri)� OrderedDict)� type_name�str_cls�
bytes_to_list)�AlgorithmIdentifier�AnyAlgorithmIdentifier�DigestAlgorithm�SignedDigestAlgorithm) �Any� BitString� BMPString�Boolean�Choice�Concat�
Enumerated�GeneralizedTime�
GeneralString� IA5String�Integer�Null�
NumericString�ObjectIdentifier�OctetBitString� OctetString�ParsableOctetString�PrintableString�Sequence�
SequenceOf�Set�SetOf�
TeletexString�UniversalString�UTCTime�
UTF8String�
VisibleString�VOID)�
PublicKeyInfo)� int_to_bytes�int_from_bytes� inet_ntop� inet_ptonc @ s, e Zd ZdZdZdd� Zdd� Zdd� Zd S )
�DNSNamer � c C s
| |k S )N� )�self�otherr7 r7 �/usr/lib/python3.6/x509.py�__ne__L s zDNSName.__ne__c C s& t |t�sdS | j� j� |j� j� kS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2
:param other:
Another DNSName object
:return:
A boolean
F)�
isinstancer5 � __unicode__�lower)r8 r9 r7 r7 r: �__eq__O s
zDNSName.__eq__c C sx t |t�s"ttdt| �t|����|jd�rFd|dd� j| j� }n |j| j�}|| _|| _ d| _
| j dkrtd| _ dS )zd
Sets the value of the DNS name
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
�.� .r N� ) r< r � TypeErrorr r
�
startswith�encode� _encoding�_unicode�contents�_header�_trailer)r8 �value�
encoded_valuer7 r7 r: �set_ s
z DNSName.setN)�__name__�
__module__� __qualname__rF Z_bad_tagr; r? rM r7 r7 r7 r: r5 G s
r5 c @ s, e Zd Zdd� Zdd� Zdd� Zdd� Zd S )
�URIc C sL t |t�s"ttdt| �t|����|| _t|�| _d| _| j dkrHd| _ dS )zb
Sets the value of the string
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
NrB )
r< r rC r r
rG r
rH rI rJ )r8 rK r7 r7 r: rM ~ s
zURI.setc C s
| |k S )Nr7 )r8 r9 r7 r7 r: r; � s z
URI.__ne__c C s" t |t�sdS t| j�t|j�kS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4
:param other:
Another URI object
:return:
A boolean
F)r< rQ r
�native)r8 r9 r7 r7 r: r? � s
z
URI.__eq__c C s, | j dkrdS | jdkr&t| j� �| _| jS )z7
:return:
A unicode string
N� )rH rG r �
_merge_chunks)r8 r7 r7 r: r= � s
zURI.__unicode__N)rN rO rP rM r; r? r= r7 r7 r7 r: rQ | s rQ c @ sN e Zd ZdZdZedd� �Zejdd� �Zdd� Zdd � Z d
d � Z
d d
� Z dS )� EmailAddressNFc C s | j S )z`
:return:
A byte string of the DER-encoded contents of the sequence
)� _contents)r8 r7 r7 r: rH � s zEmailAddress.contentsc C s d| _ || _dS )ze
:param value:
A byte string of the DER-encoded contents of the sequence
FN)� _normalizedrV )r8 rK r7 r7 r: rH � s c C s� t |t�s"ttdt| �t|����|jd�d
krZ|jdd�\}}|jd�d |jd� }n
|jd�}d| _|| _ || _
d| _ | j d kr�d | _ dS ) zb
Sets the value of the string
:param value:
A unicode string
zK
%s value must be a unicode string, not %s
�@r �ascii� @r TNrB ���)
r< r rC r r
�find�rsplitrE rW rG rH rI rJ )r8 rK �mailbox�hostnamerL r7 r7 r: rM � s
zEmailAddress.setc C s^ | j dkrX| j� }|jd�dkr.|jd�| _ n*|jdd�\}}|jd�d |jd� | _ | j S )z7
:return:
A unicode string
NrZ r rY rX r r[ )rG rT r\ �decoder] )r8 rH r^ r_ r7 r7 r: r= � s
zEmailAddress.__unicode__c C s
| |k S )Nr7 )r8 r9 r7 r7 r: r; � s zEmailAddress.__ne__c C s� t |t�sdS | js | j| j� |js2|j|j� | jjd�dksR|jjd�dkr^| j|jkS |jjdd�\}}| jjdd�\}}||kr�dS |j� |j� kr�dS dS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5
:param other:
Another EmailAddress object
:return:
A boolean
FrZ r Tr[ r[ ) r< rU rW rM rR rV r\ r] r> )r8 r9 Z
other_mailboxZother_hostnamer^ r_ r7 r7 r: r? � s
zEmailAddress.__eq__) rN rO rP rV rW �propertyrH �setterrM r= r; r? r7 r7 r7 r: rU � s
rU c @ s: e Zd Zd dd�Zdd� Zedd� �Zdd � Zd
d � ZdS )
� IPAddressNc C s t td���dS )z?
This method is not applicable to IP addresses
z=
IP address values can not be parsed
N)�
ValueErrorr )r8 �specZ spec_paramsr7 r7 r: �parse" s zIPAddress.parsec
C sT t |t�s"ttdt| �t|����|}|jd�dk}d}|rv|jdd�}|d }t|d �}|dk rvttdt| ����|jd�dkr�t j
}|dkr�ttdt| ����d}n$t j }|d kr�ttd
t| ����d }d }|�rd | } | d
|t | � 7 } t
t| d��}d|d t |� | }|| _t||�| | _| j| _d| _| jd k�rPd | _dS )z�
Sets the value of the object
:param value:
A unicode string containing an IPv4 address, IPv4 address with CIDR,
an IPv6 address or IPv6 address with CIDR
zK
%s value must be a unicode string, not %s
�/r r zT
%s value contains a CIDR range less than 0
�:� z�
%s value contains a CIDR range bigger than 128, the maximum
value for an IPv6 address
� z�
%s value contains a CIDR range bigger than 32, the maximum
value for an IPv4 address
rB �1�0� � � Nr[ r[ )r< r rC r r
r\ �split�intrd �socket�AF_INET6�AF_INET�lenr1 �_nativer4 rH Z_bytesrI rJ )
r8 rK �original_valueZhas_cidr�cidr�parts�familyZ cidr_sizeZ
cidr_bytesZ cidr_maskr7 r7 r: rM - sR
z
IPAddress.setc C s� | j dkrdS | jdkr�| j� }t|�}d}|tddg�krjttj|dd� �}|dkr�t|dd� �}n<|tddg�kr�ttj |dd� �}|dkr�t|dd� �}|dk r�dj
|�}t|j d��}|d t |� }|| _| jS )
z�
The a native Python datatype representation of this value
:return:
A unicode string or None
Nrj � r ro � z{0:b}rl rg )
rH rv � __bytes__ru rM r3 rr rs r2 rt �format�rstripr )r8 Z byte_stringZbyte_lenZcidr_intrK Z cidr_bitsrx r7 r7 r: rR t s(
zIPAddress.nativec C s
| |k S )Nr7 )r8 r9 r7 r7 r: r; � s zIPAddress.__ne__c C s t |t�sdS | j� |j� kS )zl
:param other:
Another IPAddress object
:return:
A boolean
F)r< rc r} )r8 r9 r7 r7 r: r? � s
zIPAddress.__eq__)NN) rN rO rP rf rM ra rR r; r? r7 r7 r7 r: rc ! s
G rc c @ s" e Zd ZdefdedeifgZdS )� Attribute�type�valuesre N)rN rO rP r! r) r �_fieldsr7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�
AttributesN)rN rO rP r� � _child_specr7 r7 r7 r: r� � s r� c
@ s$ e Zd Zddddddddd d
� Zd S ) �KeyUsageZdigital_signatureZnon_repudiationZkey_enciphermentZdata_enciphermentZ
key_agreementZ
key_cert_signZcrl_signZ
encipher_onlyZ
decipher_only) r r rm � r| � � � ro N)rN rO rP �_mapr7 r7 r7 r: r� � s r� c @ s, e Zd Zdeddd�fdeddd�fgZdS )�PrivateKeyUsagePeriod�
not_beforer T)�implicit�optional� not_afterr N)rN rO rP r r� r7 r7 r7 r: r� � s r� c @ s e Zd ZdZdZdd� ZdS )�NotReallyTeletexStringa6
OpenSSL (and probably some other libraries) puts ISO-8859-1
into TeletexString instead of ITU T.61. We use Windows-1252 when
decoding since it is a superset of ISO-8859-1, and less likely to
cause encoding issues, but we stay strict with encoding to prevent
us from creating bad data.
�cp1252c C s0 | j dkrdS | jdkr*| j� j| j�| _| jS )z7
:return:
A unicode string
NrS )rH rG rT r` �_decoding_encoding)r8 r7 r7 r: r= � s
z"NotReallyTeletexString.__unicode__N)rN rO rP �__doc__r� r= r7 r7 r7 r: r� � s r� c c s zdt _d V W d dt _X d S )N�teletexr� )r� r� r7 r7 r7 r: �strict_teletex� s
r� c @ s4 e Zd ZdefdefdefdefdefdefgZ dS )�DirectoryString�teletex_string�printable_stringZuniversal_string� utf8_string�
bmp_string�
ia5_stringN)
rN rO rP r� r% r+ r- r r �
_alternativesr7 r7 r7 r: r� � s r� c " @ s� e Zd Zddddddddd d
d d d
ddddddddddddddd d d d d d!d"�!Zd d d d ddd ddddd d
ddddddddd
d d d!dddddddg Zed#d$� �Zed%d&� �Zd'S )(�NameType� common_name�surname�
serial_number� country_name�
locality_name�state_or_province_name�street_address�organization_name�organizational_unit_name�title�business_category� postal_code�telephone_number�name�
given_name�initials�generation_qualifier�unique_identifier� dn_qualifier� pseudonym�organization_identifier�tpm_manufacturer� tpm_model� tpm_version�platform_manufacturer�platform_model�platform_version�
email_address�incorporation_locality� incorporation_state_or_province�incorporation_country�domain_component�name_distinguisher)!z2.5.4.3z2.5.4.4z2.5.4.5z2.5.4.6z2.5.4.7z2.5.4.8z2.5.4.9z2.5.4.10z2.5.4.11z2.5.4.12z2.5.4.15z2.5.4.17z2.5.4.20z2.5.4.41z2.5.4.42z2.5.4.43z2.5.4.44z2.5.4.45z2.5.4.46z2.5.4.65z2.5.4.97z 2.23.133.2.1z 2.23.133.2.2z 2.23.133.2.3z 2.23.133.2.4z 2.23.133.2.5z 2.23.133.2.6z1.2.840.113549.1.9.1z1.3.6.1.4.1.311.60.2.1.1z1.3.6.1.4.1.311.60.2.1.2z1.3.6.1.4.1.311.60.2.1.3z0.9.2342.19200300.100.1.25z0.2.262.1.10.7.20c C s4 | j |�}|| jkr"| jj|�}n
t| j�}||fS )z�
Returns an ordering value for a particular attribute key.
Unrecognized attributes and OIDs will be sorted lexically at the end.
:return:
An orderable value.
)�map�preferred_order�indexru )�clsZ attr_nameZordinalr7 r7 r: �preferred_ordinalB s
zNameType.preferred_ordinalc " C sT ddddddddd d
d d d
ddddddddddddddd d d d d d!d"�!j | j| j�S )#zZ
:return:
A human-friendly unicode string to display to users
z Common NameZSurnamez
Serial Number�CountryZLocalityzState/ProvincezStreet AddressZ OrganizationzOrganizational UnitZTitlezBusiness Categoryz Postal CodezTelephone Number�Namez
Given NameZInitialszGeneration QualifierzUnique Identifierz DN QualifierZ Pseudonymz
Email AddresszIncorporation Localityz Incorporation State/ProvincezIncorporation CountryzDomain ComponentzName DistinguisherzOrganization IdentifierzTPM Manufacturerz TPM Modelz TPM VersionzPlatform ManufacturerzPlatform ModelzPlatform Version)!r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� )�getrR )r8 r7 r7 r: �human_friendlyV sD zNameType.human_friendlyN) rN rO rP r� r� � classmethodr� ra r� r7 r7 r7 r: r� � s� r� c " @ s� e Zd ZdefdefgZd
Zeeeeeeeeeeeeeeeeee eee
eeee eee e e e e e d�!Z
dZedd� �Zdd� Zd d
� Zd d � ZdS )�NameTypeAndValuer� rK )!r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� Nc C s" | j dkr | j| d j�| _ | j S )z�
Returns the value after being processed by the internationalized string
preparation as specified by RFC 5280
:return:
A unicode string
NrK )�_prepped�_ldap_string_preprR )r8 r7 r7 r: �
prepped_value� s
z NameTypeAndValue.prepped_valuec C s
| |k S )Nr7 )r8 r9 r7 r7 r: r; � s zNameTypeAndValue.__ne__c C s2 t |t�sdS |d j| d jkr&dS |j| jkS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another NameTypeAndValue object
:return:
A boolean
Fr� )r< r� rR r� )r8 r9 r7 r7 r: r? � s
zNameTypeAndValue.__eq__c C s� t jdd|�}t jdd|�}tjdkr6t jdd|�}nt jdd|�}t jdd|�}|jd d�}t jd
d|�}djttj|��}t j
d |�}x�|D ]�}tj |�r�t t
d ���tj|�r�t t
d
���tj|�r�t t
d���tj|�r�t t
d���tj|��rt t
d���|dkr�t t
d���q�W d}d}x0|D ](}tj|��r@d}ntj|��r*d}�q*W |�r�tj|d �}tj|d �}|�s�| �s�| �r�t t
d���dt jdd|�j� d }|S )a"
Implements the internationalized string preparation algorithm from
RFC 4518. https://tools.ietf.org/html/rfc4518#section-2
:param string:
A unicode string to prepare
:return:
A prepared unicode string, ready for comparison
u [᠆͏᠋-᠍️-]+rS u [
]� i�� u �[�-�]|�[�-�]|u [--]u? [ -- -------]+u u [ -
-
]ZNFKCzc
X.509 Name objects may not contain unassigned code points
z�
X.509 Name objects may not contain change display or
zzzzdeprecated characters
zc
X.509 Name objects may not contain private use characters
zf
X.509 Name objects may not contain non-character code points
zb
X.509 Name objects may not contain surrogate code points
u �zf
X.509 Name objects may not contain the replacement character
FTr r z{
X.509 Name object contains a malformed bidirectional
sequence
z +z r[ )�re�sub�sys�
maxunicode�replace�joinr� �
stringprepZ map_table_b2� unicodedataZ normalizeZ in_table_a1rd r Z in_table_c8Z in_table_c3Z in_table_c4Z in_table_c5Z in_table_d1Z in_table_d2�strip)r8 �string�charZhas_r_and_al_catZ has_l_catZfirst_is_r_and_alZlast_is_r_and_alr7 r7 r: r� � s^
z"NameTypeAndValue._ldap_string_prep)r� rK )rN rO rP r� r r� � _oid_pairr� r% r" rU r5 r- �
_oid_specsr� ra r� r; r? r� r7 r7 r7 r: r� � sR
r� c @ s< e Zd ZeZedd� �Zdd� Zdd� Zdd� Z d d
� Z
d S ) �RelativeDistinguishedNamec C sD g }| j | �}x*t|j� �D ]}|jd||| f � q W dj|�S )zb
:return:
A unicode string that can be used as a dict key or in a set
z%s: %s� )� _get_values�sorted�keys�appendr� )r8 �outputr� �keyr7 r7 r: �hashableE s
z"RelativeDistinguishedName.hashablec C s
| |k S )Nr7 )r8 r9 r7 r7 r: r; U s z RelativeDistinguishedName.__ne__c C s| t |t�sdS t| �t|�kr"dS | j| �}| j|�}||krBdS | j| �}| j|�}x |D ]}|| || kr\dS q\W dS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another RelativeDistinguishedName object
:return:
A boolean
FT)r< r� ru �
_get_typesr� )r8 r9 Z
self_typesZ other_typesZ self_valuesZ other_valuesZ
type_name_r7 r7 r: r? X s
z RelativeDistinguishedName.__eq__c C s t dd� |D ��S )z�
Returns a set of types contained in an RDN
:param rdn:
A RelativeDistinguishedName object
:return:
A set object with unicode strings of NameTypeAndValue type field
values
c S s g | ]}|d j �qS )r� )rR )�.0�ntvr7 r7 r: �
<listcomp>� s z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rM )r8 �rdnr7 r7 r: r� x s z$RelativeDistinguishedName._get_typesc s i � � fdd�|D � � S )a$
Returns a dict of prepped values contained in an RDN
:param rdn:
A RelativeDistinguishedName object
:return:
A dict object with unicode strings of NameTypeAndValue value field
values that have been prepped for comparison
c s$ g | ] }� j |d j|jfg��qS )r� )�updaterR r� )r� r� )r� r7 r: r� � s z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r7 )r8 r� r7 )r� r: r� � s z%RelativeDistinguishedName._get_valuesN) rN rO rP r� r� ra r� r; r? r� r� r7 r7 r7 r: r� B s r� c @ s, e Zd ZeZedd� �Zdd� Zdd� ZdS )� RDNSequencec C s dj dd� | D ��S )zb
:return:
A unicode string that can be used as a dict key or in a set
� c s s | ] }|j V qd S )N)r� )r� r� r7 r7 r: � <genexpr>� s z'RDNSequence.hashable.<locals>.<genexpr>)r� )r8 r7 r7 r: r� � s
zRDNSequence.hashablec C s
| |k S )Nr7 )r8 r9 r7 r7 r: r; � s zRDNSequence.__ne__c C sL t |t�sdS t| �t|�kr"dS x$t| �D ]\}}|| |kr,dS q,W dS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another RDNSequence object
:return:
A boolean
FT)r< r� ru � enumerate)r8 r9 r� Zself_rdnr7 r7 r: r? � s
zRDNSequence.__eq__N) rN rO rP r� r� ra r� r; r? r7 r7 r7 r: r� � s r� c @ s� e Zd ZdefgZdZdZdZeddd��Z e
dd� �Z dd � Z d
d � Z
d d
� Ze
dd� �Ze
dd� �Zdd� Ze
dd� �Ze
dd� �ZdS )r� rS NFc C s� g }|sd}t }nd}t}tt|j� dd� d��}x�|j� D ]�\}}tj|�}|dkr`t|�}nF|dkrrt|�}n4|t dd d
g�kr�t
dt|�d �}nt
|||�d �}|j t t
||d ��g�� q<W | d
t|�d �S )aT
Creates a Name object from a dict of unicode string keys and values.
The keys should be from NameType._map, or a dotted-integer OID unicode
string.
:param name_dict:
A dict of name information, e.g. {"common_name": "Will Bond",
"country_name": "US", "organization": "Codex Non Sufficit LC"}
:param use_printable:
A bool - if PrintableString should be used for encoding instead of
UTF8String. This is for backwards compatibility with old software.
:return:
An x509.Name object
r� r� c S s t j| d �S )Nr )r� r� )�itemr7 r7 r: �<lambda>� s z Name.build.<locals>.<lambda>)r� r� r� r� r� r� )r� rK )r� rK rS )r- r% r r� �itemsr� r� rU r5 rM r� r� r� r� r� ) r� Z name_dictZ
use_printableZrdnsZ
encoding_nameZencoding_class�attribute_nameZattribute_valuerK r7 r7 r: �build� s8
z
Name.buildc C s | j jS )zb
:return:
A unicode string that can be used as a dict key or in a set
)�chosenr� )r8 r7 r7 r: r� s z
Name.hashablec C s
t | j�S )N)ru r� )r8 r7 r7 r: �__len__ s z Name.__len__c C s
| |k S )Nr7 )r8 r9 r7 r7 r: r; s z Name.__ne__c C s t |t�sdS | j|jkS )z�
Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1
:param other:
Another Name object
:return:
A boolean
F)r< r� r� )r8 r9 r7 r7 r: r? s
z Name.__eq__c C s� | j d kr�t� | _ xr| jjD ]f}x`|D ]X}|d }|| j krp| j | }t|t�s`|g }| j |< |j|d � q&|d | j |< q&W q W | j S )Nr� rK )rv r r� rR r< �listr� )r8 r� �type_val�
field_nameZexistingr7 r7 r: rR % s
z Name.nativec C s | j dk�rt� }d}x`| jD ]V}xP|D ]H}|d j}|}||krd|| g||< || j|d � q(|d ||< q(W q W g }|j� }|dkr�tt|��}x0|D ](}|| } | j| �}
|jd||
f � q�W d} x |D ]} | j d�d kr�d } P q�W | s�d
nd }
|
j
|ddd
� �| _ | j S )zg
:return:
A human-friendly unicode string containing the parts of the name
Nr� rK r� z%s: %sF�,r Tz, z; r[ r[ ) �_human_friendlyr r� r� r� r� �reversedr� �_recursive_humanizer\ r� )r8 �dataZ
last_fieldr� r� r� Zto_joinr� r� rK Z native_valueZ has_comma�elementZ separatorr7 r7 r: r� 5 s6
zName.human_friendlyc s, t |t�r&djt� fdd�|D ���S |jS )z�
Recursively serializes data compiled from the RDNSequence
:param value:
An Asn1Value object, or a list of Asn1Value objects
:return:
A unicode string
z, c s g | ]}� j |��qS r7 )r� )r� Z sub_value)r8 r7 r: r� i s z,Name._recursive_humanize.<locals>.<listcomp>)r< r� r� r� rR )r8 rK r7 )r8 r: r� \ s
zName._recursive_humanizec C s$ | j dkr tj| j� �j� | _ | j S )zZ
:return:
The SHA1 hash of the DER-encoded bytes of this name
N)�_sha1�hashlib�sha1�dump�digest)r8 r7 r7 r: r m s
z Name.sha1c C s$ | j dkr tj| j� �j� | _ | j S )z]
:return:
The SHA-256 hash of the DER-encoded bytes of this name
N)�_sha256r �sha256r r )r8 r7 r7 r: r x s
z Name.sha256)F)rN rO rP r� r� r� r� r r� r� ra r� r� r; r? rR r� r� r r r7 r7 r7 r: r� � s
< ' r� c @ s" e Zd ZdefdeddifgZdS )� AnotherNameZtype_idrK �explicitr N)rN rO rP r! r r� r7 r7 r7 r: r � s r c @ s$ e Zd ZdZdZdefdefgZdS )� CountryNamer �
x121_dcc_code�iso_3166_alpha2_codeN)rN rO rP �class_�tagr r% r� r7 r7 r7 r: r � s r c @ s$ e Zd ZdZdZdefdefgZdS )�AdministrationDomainNamer rm �numeric� printableN)rN rO rP r r r r% r� r7 r7 r7 r: r
� s r
c @ s e Zd ZdefdefgZdS )�PrivateDomainNamer r N)rN rO rP r r% r� r7 r7 r7 r: r � s r c @ sF e Zd Zdeddifdeddd�fded dd�fd
ed dd�fgZd S )
� PersonalNamer� r� r r� r T)r� r� r� rm r� r� N)rN rO rP r% r� r7 r7 r7 r: r � s r c @ sF e Zd Zdeddifdeddd�fded dd�fd
ed dd�fgZd S )
�TeletexPersonalNamer� r� r r� r T)r� r� r� rm r� r� N)rN rO rP r* r� r7 r7 r7 r: r � s r c @ s e Zd ZeZdS )�OrganizationalUnitNamesN)rN rO rP r% r� r7 r7 r7 r: r � s r c @ s e Zd ZeZdS )� TeletexOrganizationalUnitNamesN)rN rO rP r* r� r7 r7 r7 r: r � s r c
@ s� e Zd Zdeddifdeddifdeddd�fded dd�fd
ed dd �fd
eddd�fdeddd�fdeddd�fde ddd�fg Z
dS )�BuiltInStandardAttributesr� r� TZadministration_domain_nameZnetwork_addressr )r� r� Zterminal_identifierr Zprivate_domain_namerm )r r� r� r� Znumeric_user_identifierr| Z
personal_namer� Zorganizational_unit_namesr� N) rN rO rP r r
r r% r r r r� r7 r7 r7 r: r � s r c @ s e Zd ZdefdefgZdS )� BuiltInDomainDefinedAttributer� rK N)rN rO rP r% r� r7 r7 r7 r: r � s r c @ s e Zd ZeZdS )� BuiltInDomainDefinedAttributesN)rN rO rP r r� r7 r7 r7 r: r � s r c @ s e Zd ZdefdefgZdS )� TeletexDomainDefinedAttributer� rK N)rN rO rP r* r� r7 r7 r7 r: r � s r c @ s e Zd ZeZdS )� TeletexDomainDefinedAttributesN)rN rO rP r r� r7 r7 r7 r: r � s r c @ s e Zd ZdefdefgZdS )�PhysicalDeliveryCountryNamer r
N)rN rO rP r r% r� r7 r7 r7 r: r � s r c @ s e Zd ZdefdefgZdS )�
PostalCodeZ numeric_codeZprintable_codeN)rN rO rP r r% r� r7 r7 r7 r: r � s r c @ s( e Zd ZdeddifdeddifgZdS )� PDSParameterr� r� Tr� N)rN rO rP r% r* r� r7 r7 r7 r: r � s r c @ s e Zd ZeZdS )�PrintableAddressN)rN rO rP r% r� r7 r7 r7 r: r � s r c @ s( e Zd ZdeddifdeddifgZdS )�UnformattedPostalAddressZprintable_addressr� Tr� N)rN rO rP r r* r� r7 r7 r7 r: r � s r c @ s* e Zd Zdeddifdeddd�fgZdS ) � E1634AddressZnumberr� r Z sub_addressr T)r� r� N)rN rO rP r r� r7 r7 r7 r: r s r c @ s e Zd ZeZdS )�
NAddressesN)rN rO rP r# r� r7 r7 r7 r: r s r c @ sF e Zd Zdeddd�fdeddd�fdeddd�fd ed
d ifgZd S )
�PresentationAddressZ
p_selectorr T)r r� Z
s_selectorr Z
t_selectorrm Z n_addressesr r� N)rN rO rP r# r r� r7 r7 r7 r: r! s r! c @ s" e Zd ZdefdeddifgZdS )�ExtendedNetworkAddressZe163_4_addressZ psap_addressr� r N)rN rO rP r r! r� r7 r7 r7 r: r" s r" c @ s e Zd Zddddddd�ZdS ) � TerminalTypeZtelexr� Z g3_facsimileZ g4_facsimileZ ia5_terminalZvideotex)r� r| r� r� r� ro N)rN rO rP r� r7 r7 r7 r: r# s r# c @ s@ e Zd Zddddddddd d
d d d
ddddddddddd�ZdS )�ExtensionAttributeTyper� �teletex_common_name�teletex_organization_name�teletex_personal_name� teletex_organization_unit_names�!teletex_domain_defined_attributes�pds_name� physical_delivery_country_namer� � physical_delivery_office_name� physical_delivery_office_number� extension_of_address_components� physical_delivery_personal_name�#physical_delivery_organization_name�.extension_physical_delivery_address_components�unformatted_postal_addressr� �post_office_box_address�poste_restante_address�unique_postal_name�local_postal_attributes�extended_network_address�
terminal_type)r rm r� r| r� r� r� ro � �
� � �
� � r{ � � r6 � � � � N)rN rO rP r� r7 r7 r7 r: r$ * s. r$ c @ s` e Zd ZdeddifdeddifgZd Zeeee e
e ee e
eeeeeeeeeeeeeed�ZdS )
�ExtensionAttribute�extension_attribute_typer� r �extension_attribute_valuer r )r� r% r& r' r( r) r* r+ r� r, r- r. r/ r0 r1 r2 r� r3 r4 r5 r6 r7 r8 N)rG rH )rN rO rP r$ r r� r� r% r* r r r r r r r r" r# r� r7 r7 r7 r: rF F s4 rF c @ s e Zd ZeZdS )�ExtensionAttributesN)rN rO rP rF r� r7 r7 r7 r: rI h s rI c @ s. e Zd ZdefdeddifdeddifgZdS )� ORAddressZ built_in_standard_attributesZ"built_in_domain_defined_attributesr� TZextension_attributesN)rN rO rP r r rI r� r7 r7 r7 r: rJ l s rJ c @ s* e Zd Zdeddd�fdeddifgZdS ) � EDIPartyNameZ
name_assignerr T)r� r� Z
party_namer� r N)rN rO rP r� r� r7 r7 r7 r: rK t s rK c @ s� e Zd Zdeddifdeddifdeddifdedd ifd
ed d ifd
eddifde ddifde
ddifde ddifg Z dd� Z
dd� ZdS )� GeneralName�
other_namer� r Z rfc822_namer �dns_namerm � x400_addressr� Zdirectory_namer r| �edi_party_namer� �uniform_resource_identifierr� �
ip_addressr� Z
registered_idro c C s
| |k S )Nr7 )r8 r9 r7 r7 r: r; � s zGeneralName.__ne__c C sP | j dkrttd| j ���|j dkr4ttd|j ���| j |j krDdS | j|jkS ) z�
Does not support other_name, x400_address or edi_party_name
:param other:
The other GeneralName to compare to
:return:
A boolean
rM rO rP zr
Comparison is not supported for GeneralName objects of
choice %s
za
Comparison is not supported for GeneralName objects of choice
%sF)rM rO rP )rM rO rP )r� rd r r� )r8 r9 r7 r7 r: r? � s
zGeneralName.__eq__N)rN rO rP r rU r5 rJ r� rK rQ rc r! r� r; r? r7 r7 r7 r: rL { s rL c @ s e Zd ZeZdS )� GeneralNamesN)rN rO rP rL r� r7 r7 r7 r: rS � s rS c @ s e Zd ZdefdefgZdS )�TimeZutc_timeZ general_timeN)rN rO rP r, r r� r7 r7 r7 r: rT � s rT c @ s e Zd ZdefdefgZdS )�Validityr� r� N)rN rO rP rT r� r7 r7 r7 r: rU � s rU c @ s( e Zd ZdeddifdeddifgZdS )�BasicConstraints�ca�defaultF�path_len_constraintr� TN)rN rO rP r r r� r7 r7 r7 r: rV � s rV c @ s: e Zd Zdeddd�fdeddd�fdeddd�fgZd S )
�AuthorityKeyIdentifier�key_identifierr T)r� r� �authority_cert_issuerr � authority_cert_serial_numberrm N)rN rO rP r# rS r r� r7 r7 r7 r: rZ � s rZ c @ s( e Zd ZdeddifdeddifgZdS )�DistributionPointName� full_namer� r �name_relative_to_crl_issuerr N)rN rO rP rS r� r� r7 r7 r7 r: r^ � s r^ c
@ s$ e Zd Zddddddddd d
� Zd S ) � ReasonFlagsZunusedZkey_compromiseZ
ca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZ
aa_compromise) r r rm r� r| r� r� r� ro N)rN rO rP r� r7 r7 r7 r: ra � s ra c @ s2 e Zd Zdefdeddd�fdeddd�fgZd S )
�GeneralSubtree�baseZminimumr )r� rX Zmaximumr T)r� r� N)rN rO rP rL r r� r7 r7 r7 r: rb � s rb c @ s e Zd ZeZdS )�GeneralSubtreesN)rN rO rP rb r� r7 r7 r7 r: rd � s rd c @ s, e Zd Zdeddd�fdeddd�fgZdS )�NameConstraintsZpermitted_subtreesr T)r� r� Zexcluded_subtreesr N)rN rO rP rd r� r7 r7 r7 r: re � s re c @ sJ e Zd Zdeddd�fdeddd�fded dd�fgZd
Zed d � �Z d
S )�DistributionPoint�distribution_pointr T)r r� Zreasonsr )r� r� Z
crl_issuerrm Fc C sj | j dkrdd| _ | d }|jdkr.ttd���x4|jD ]*}|jdkr6|j}|j� jd �r6|| _ P q6W | j S ) z_
:return:
None or a unicode string of the distribution point's URL
FNrg r_ z�
CRL distribution points that are relative to the issuer are
not supported
rQ �http://�https://�ldap://�ldaps://)rh ri rj rk )�_urlr� rd r r� rR r> rD )r8 r� � general_name�urlr7 r7 r: rn � s
zDistributionPoint.urlN)
rN rO rP r^ ra rS r� rl ra rn r7 r7 r7 r: rf � s
rf c @ s e Zd ZeZdS )�CRLDistributionPointsN)rN rO rP rf r� r7 r7 r7 r: ro s ro c @ s( e Zd ZdefdefdefdefgZdS )� DisplayTextr� Zvisible_stringr� r� N)rN rO rP r r. r r- r� r7 r7 r7 r: rp s rp c @ s e Zd ZeZdS )�
NoticeNumbersN)rN rO rP r r� r7 r7 r7 r: rq ( s rq c @ s e Zd ZdefdefgZdS )�NoticeReferenceZ organizationZnotice_numbersN)rN rO rP rp rq r� r7 r7 r7 r: rr , s rr c @ s( e Zd ZdeddifdeddifgZdS )�
UserNoticeZ
notice_refr� TZ
explicit_textN)rN rO rP rr rp r� r7 r7 r7 r: rs 3 s rs c @ s e Zd Zddd�ZdS )�PolicyQualifierId� certification_practice_statement� user_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2N)rN rO rP r� r7 r7 r7 r: rt : s rt c @ s* e Zd ZdefdefgZdZeed�Z dS )�PolicyQualifierInfo�policy_qualifier_id� qualifier)ru rv N)rx ry )
rN rO rP rt r r� r� r rs r� r7 r7 r7 r: rw A s
rw c @ s e Zd ZeZdS )�PolicyQualifierInfosN)rN rO rP rw r� r7 r7 r7 r: rz N s rz c @ s e Zd ZddiZdS )�PolicyIdentifierz 2.5.29.32.0Z
any_policyN)rN rO rP r� r7 r7 r7 r: r{ R s r{ c @ s" e Zd ZdefdeddifgZdS )�PolicyInformationZpolicy_identifierZpolicy_qualifiersr� TN)rN rO rP r{ rz r� r7 r7 r7 r: r| X s r| c @ s e Zd ZeZdS )�CertificatePoliciesN)rN rO rP r| r� r7 r7 r7 r: r} _ s r} c @ s e Zd ZdefdefgZdS )�
PolicyMappingZissuer_domain_policyZsubject_domain_policyN)rN rO rP r{ r� r7 r7 r7 r: r~ c s r~ c @ s e Zd ZeZdS )�PolicyMappingsN)rN rO rP r~ r� r7 r7 r7 r: r j s r c @ s, e Zd Zdeddd�fdeddd�fgZdS )�PolicyConstraintsZrequire_explicit_policyr T)r� r� Zinhibit_policy_mappingr N)rN rO rP r r� r7 r7 r7 r: r� n s r� c U @ s� e Zd Zddddddddd d
d d d
ddddddddddddddd d d d d d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdU�TZdVS )W� KeyPurposeIdZany_extended_key_usageZ server_authZ client_authZ code_signingZemail_protectionZipsec_end_systemZ ipsec_tunnelZ
ipsec_user�
time_stampingZ ocsp_signingZdvcsZ eap_over_pppZ eap_over_lanZ scvp_serverZ scvp_clientZ ipsec_ikeZ capwap_acZ
capwap_wtpZ
sip_domainZsecure_shell_clientZsecure_shell_serverZ send_routerZsend_proxied_routerZ
send_ownerZsend_proxied_ownerZcmc_caZcmc_raZ cmc_archiveZbgpspec_routerZ microsoft_trust_list_signingZ microsoft_time_stamp_signingZmicrosoft_server_gatedZmicrosoft_serializedZ
microsoft_efsZmicrosoft_efs_recoveryZmicrosoft_whqlZ
microsoft_nt5Zmicrosoft_oem_whqlZmicrosoft_embedded_ntZmicrosoft_root_list_signerZ!microsoft_qualified_subordinationZmicrosoft_key_recoveryZmicrosoft_document_signingZmicrosoft_lifetime_signingZ microsoft_mobile_device_softwareZmicrosoft_smart_card_logonZapple_x509_basicZ apple_sslZapple_local_cert_genZ
apple_csr_genZapple_revocation_crlZapple_revocation_ocspZ apple_smimeZ apple_eapZ apple_software_update_signingZ apple_ipsecZ apple_ichatZapple_resource_signingZapple_pkinit_clientZapple_pkinit_serverZapple_code_signingZapple_package_signingZapple_id_validationZapple_time_stampingZapple_revocationZapple_passbook_signingZapple_mobile_storeZapple_escrow_serviceZapple_profile_signerZapple_qa_profile_signerZapple_test_mobile_storeZapple_otapki_signerZapple_test_otapki_signerZ)apple_id_validation_record_signing_policyZapple_smp_encryptionZapple_test_smp_encryptionZapple_server_authenticationZapple_pcs_escrow_serviceZpiv_card_authenticationZpiv_content_signingZpkinit_kpclientauthZ pkinit_kpkdcZ adobe_authentic_documents_trustZfpki_pivi_content_signing)Tz 2.5.29.37.0z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2z1.3.6.1.5.5.7.3.3z1.3.6.1.5.5.7.3.4z1.3.6.1.5.5.7.3.5z1.3.6.1.5.5.7.3.6z1.3.6.1.5.5.7.3.7z1.3.6.1.5.5.7.3.8z1.3.6.1.5.5.7.3.9z1.3.6.1.5.5.7.3.10z1.3.6.1.5.5.7.3.13z1.3.6.1.5.5.7.3.14z1.3.6.1.5.5.7.3.15z1.3.6.1.5.5.7.3.16z1.3.6.1.5.5.7.3.17z1.3.6.1.5.5.7.3.18z1.3.6.1.5.5.7.3.19z1.3.6.1.5.5.7.3.20z1.3.6.1.5.5.7.3.21z1.3.6.1.5.5.7.3.22z1.3.6.1.5.5.7.3.23z1.3.6.1.5.5.7.3.24z1.3.6.1.5.5.7.3.25z1.3.6.1.5.5.7.3.26z1.3.6.1.5.5.7.3.27z1.3.6.1.5.5.7.3.28z1.3.6.1.5.5.7.3.29z1.3.6.1.5.5.7.3.30z1.3.6.1.4.1.311.10.3.1z1.3.6.1.4.1.311.10.3.2z1.3.6.1.4.1.311.10.3.3z1.3.6.1.4.1.311.10.3.3.1z1.3.6.1.4.1.311.10.3.4z1.3.6.1.4.1.311.10.3.4.1z1.3.6.1.4.1.311.10.3.5z1.3.6.1.4.1.311.10.3.6z1.3.6.1.4.1.311.10.3.7z1.3.6.1.4.1.311.10.3.8z1.3.6.1.4.1.311.10.3.9z1.3.6.1.4.1.311.10.3.10z1.3.6.1.4.1.311.10.3.11z1.3.6.1.4.1.311.10.3.12z1.3.6.1.4.1.311.10.3.13z1.3.6.1.4.1.311.10.3.14z1.3.6.1.4.1.311.20.2.2z1.2.840.113635.100.1.2z1.2.840.113635.100.1.3z1.2.840.113635.100.1.4z1.2.840.113635.100.1.5z1.2.840.113635.100.1.6z1.2.840.113635.100.1.7z1.2.840.113635.100.1.8z1.2.840.113635.100.1.9z1.2.840.113635.100.1.10z1.2.840.113635.100.1.11z1.2.840.113635.100.1.12z1.2.840.113635.100.1.13z1.2.840.113635.100.1.14z1.2.840.113635.100.1.15z1.2.840.113635.100.1.16z1.2.840.113635.100.1.17z1.2.840.113635.100.1.18z1.2.840.113635.100.1.20z1.2.840.113635.100.1.21z1.2.840.113635.100.1.22z1.2.840.113635.100.1.23z1.2.840.113635.100.1.24z1.2.840.113635.100.1.25z1.2.840.113635.100.1.26z1.2.840.113635.100.1.27z1.2.840.113635.100.1.28z1.2.840.113635.100.1.29z1.2.840.113625.100.1.30z1.2.840.113625.100.1.31z1.2.840.113625.100.1.32z1.2.840.113635.100.1.33z1.2.840.113635.100.1.34z2.16.840.1.101.3.6.8z2.16.840.1.101.3.6.7z1.3.6.1.5.2.3.4z1.3.6.1.5.2.3.5z1.2.840.113583.1.1.5z2.16.840.1.101.3.8.7N)rN rO rP r� r7 r7 r7 r: r� u s� r� c @ s e Zd ZeZdS )�ExtKeyUsageSyntaxN)rN rO rP r� r� r7 r7 r7 r: r� � s r� c @ s e Zd Zddddd�ZdS )� AccessMethod�ocspZ
ca_issuersr� Z
ca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5N)rN rO rP r� r7 r7 r7 r: r� � s r� c @ s e Zd ZdefdefgZdS )�AccessDescription�
access_method�access_locationN)rN rO rP r� rL r� r7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�AuthorityInfoAccessSyntaxN)rN rO rP r� r� r7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�SubjectInfoAccessSyntaxN)rN rO rP r� r� r7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�FeaturesN)rN rO rP r r� r7 r7 r7 r: r� s r� c @ s e Zd ZdefdefgZdS )�EntrustVersionInfoZ entrust_versZentrust_info_flagsN)rN rO rP r r r� r7 r7 r7 r: r� s r� c @ s" e Zd Zddddddddd �Zd
S ) �NetscapeCertificateTypeZ
ssl_clientZ
ssl_serverZemailZobject_signingZreservedZssl_caZemail_caZobject_signing_ca)r r rm r� r| r� r� r� N)rN rO rP r� r7 r7 r7 r: r� s r� c @ s e Zd Zdddd�ZdS )�Version�v1Zv2Zv3)r r rm N)rN rO rP r� r7 r7 r7 r: r� s r� c @ s" e Zd ZdefdefdefgZdS )�TPMSpecificationrz �level�revisionN)rN rO rP r- r r� r7 r7 r7 r: r� s r� c @ s e Zd ZeZdS )�SetOfTPMSpecificationN)rN rO rP r� r� r7 r7 r7 r: r� ( s r� c @ s" e Zd ZdefdefdefgZdS )�TCGSpecificationVersionZ
major_versionZ
minor_versionr� N)rN rO rP r r� r7 r7 r7 r: r� , s r� c @ s e Zd ZdefdefgZdS )�TCGPlatformSpecification�versionZplatform_classN)rN rO rP r� r# r� r7 r7 r7 r: r� 4 s r� c @ s e Zd ZeZdS )� SetOfTCGPlatformSpecificationN)rN rO rP r� r� r7 r7 r7 r: r� ; s r� c @ s e Zd Zddddd�ZdS )�EKGenerationTypeZinternalZinjectedZinternal_revocableZinjected_revocable)r r rm r� N)rN rO rP r� r7 r7 r7 r: r� ? s r� c @ s e Zd Zdddd�ZdS )�EKGenerationLocationr� r� �ek_cert_signer)r r rm N)rN rO rP r� r7 r7 r7 r: r� H s r� c @ s e Zd Zdddd�ZdS )� EKCertificateGenerationLocationr� r� r� )r r rm N)rN rO rP r� r7 r7 r7 r: r� P s r� c @ s e Zd Zdddddddd�Zd S )
�EvaluationAssuranceLevel�level1�level2�level3�level4Zlevel5Zlevel6Zlevel7)r rm r� r| r� r� r� N)rN rO rP r� r7 r7 r7 r: r� X s r� c @ s e Zd Zdddd�ZdS )�EvaluationStatusZdesigned_to_meetZevaluation_in_progressZevaluation_completed)r r rm N)rN rO rP r� r7 r7 r7 r: r� d s r� c @ s e Zd Zdddd�ZdS )�StrengthOfFunctionZbasicZmediumZhigh)r r rm N)rN rO rP r� r7 r7 r7 r: r� l s r� c @ s. e Zd ZdefdeddifdeddifgZdS )� URIReferencerQ Zhash_algorithmr� TZ
hash_valueN)rN rO rP r r r r� r7 r7 r7 r: r� t s r� c
@ st e Zd Zdefdefdefdeddifdedd d
�fd ed d d
�fd
e dd d
�fdedd d
�fde dd d
�fg Z
dS )�CommonCriteriaMeasuresr� Zassurance_levelZevaluation_status�plusrX FZstrengh_of_functionr T)r� r� Z profile_oidr Z profile_urlrm Z
target_oidr� Z
target_urir| N) rN rO rP r r� r� r r� r! r� r� r7 r7 r7 r: r� | s r� c @ s e Zd Zddddd�ZdS )�
SecurityLevelr� r� r� r� )r rm r� r| N)rN rO rP r� r7 r7 r7 r: r� � s r� c @ s( e Zd ZdefdefdeddifgZdS )� FIPSLevelr� r� r� rX FN)rN rO rP r r� r r� r7 r7 r7 r: r� � s r� c @ s� e Zd Zdeddifdeddifdeddd �fd
ed dd �fd ed
dd �fdeddd �fde ddd �fdeddd�fde
ddifg Z dS )�TPMSecurityAssertionsr� rX r� Zfield_upgradableFZek_generation_typer T)r� r� Zek_generation_locationr Z"ek_certificate_generation_locationrm Zcc_infor� Z
fips_levelr| Ziso_9000_certifiedr� )r� rX Z iso_9000_urir� N) rN rO rP r� r r� r� r� r� r� r r� r7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�SetOfTPMSecurityAssertionsN)rN rO rP r� r� r7 r7 r7 r: r� � s r� c @ s& e Zd Zddddddddd d
d �
Zd S )
�SubjectDirectoryAttributeId�supported_algorithms�tpm_specification�tcg_platform_specification�tpm_security_assertions�pda_date_of_birth�pda_place_of_birth�
pda_gender�pda_country_of_citizenship�pda_country_of_residenceZentrust_user_role)
z2.5.4.52z
2.23.133.2.16z
2.23.133.2.17z
2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29N)rN rO rP r� r7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�SetOfGeneralizedTimeN)rN rO rP r r� r7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�SetOfDirectoryStringN)rN rO rP r� r� r7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�SetOfPrintableStringN)rN rO rP r% r� r7 r7 r7 r: r� � s r� c @ s2 e Zd Zdefdeddd�fdeddd�fgZdS ) �SupportedAlgorithmZalgorithm_identifierZintended_usager T)r r� Z intended_certificate_policiesr N)rN rO rP r r� r} r� r7 r7 r7 r: r� � s r� c @ s e Zd ZeZdS )�SetOfSupportedAlgorithmN)rN rO rP r� r� r7 r7 r7 r: r� � s r� c
@ sH e Zd ZdefdefgZdZeee e
e e e
e
e
d� Zdd� ZdeiZdS )�SubjectDirectoryAttributer� r� ) r� r� r� r� r� r� r� r� r� c C s" | d j }|| jkr | j| S tS )Nr� )rR r� r) )r8 Ztype_r7 r7 r: � _values_spec� s
z&SubjectDirectoryAttribute._values_specN)r� r� )rN rO rP r� r r� r� r� r� r� r� r� r� r� r� r� Z_spec_callbacksr7 r7 r7 r: r� � s
r� c @ s e Zd ZeZdS )�SubjectDirectoryAttributesN)rN rO rP r� r� r7 r7 r7 r: r� � s r� c @ s@ e Zd Zddddddddd d
d d d
ddddddddddd�ZdS )� ExtensionId� subject_directory_attributesr[ � key_usage�private_key_usage_period�subject_alt_name�issuer_alt_name�basic_constraints�name_constraints�crl_distribution_points�certificate_policies�policy_mappings�authority_key_identifier�policy_constraints�extended_key_usage� freshest_crl�inhibit_any_policy� authority_information_access�subject_information_access� tls_feature�
ocsp_no_check�entrust_version_extension�netscape_certificate_type�!signed_certificate_timestamp_list)z2.5.29.9z 2.5.29.14z 2.5.29.15z 2.5.29.16z 2.5.29.17z 2.5.29.18z 2.5.29.19z 2.5.29.30z 2.5.29.31z 2.5.29.32z 2.5.29.33z 2.5.29.35z 2.5.29.36z 2.5.29.37z 2.5.29.46z 2.5.29.54z1.3.6.1.5.5.7.1.1z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2N)rN rO rP r� r7 r7 r7 r: r� � s. r� c @ s` e Zd ZdefdeddifdefgZdZee e
e e e e
eeeeeeeeeeeeeeee d�Z dS ) � Extension�extn_id�criticalrX F�
extn_value)r� r[ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� N)r� r� ) rN rO rP r� r r$ r� r� r� r# r� r� rS rV re ro r} r rZ r� r� r r� r� r� r r� r� r� r7 r7 r7 r: r� s6
r� c @ s e Zd ZeZdS )�
ExtensionsN)rN rO rP r� r� r7 r7 r7 r: r� ; s r� c @ sl e Zd Zdeddd�fdefdefdefdefd efd
efd e d d
d�fde dd
d�fde
dd
d�fg
Z dS )�TbsCertificater� r r� )r rX r� � signature�issuerZvalidity�subject�subject_public_key_infoZissuer_unique_idr T)r� r� Zsubject_unique_idrm �
extensionsr� )r r� N) rN rO rP r� r r r� rU r0 r" r� r� r7 r7 r7 r: r� ? s r� c @ s� e Zd ZdefdefdefgZdZdZdZ dZ
dZ dZ dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ dZ dZ dZ dZ!dZ"dZ#dZ$dZ%dZ&dd� Z'e(dd � �Z)e(d
d � �Z*e(d d
� �Z+e(dd� �Z,e(dd� �Z-e(dd� �Z.e(dd� �Z/e(dd� �Z0e(dd� �Z1e(dd� �Z2e(d d � �Z3e(d d � �Z4e(d d!� �Z5e(d"d#� �Z6e(d$d%� �Z7e(d&d'� �Z8e(d(d)� �Z9e(d*d+� �Z:e(d,d-� �Z;e(d.d/� �Z<e(d0d1� �Z=e(d2d3� �Z>e(d4d5� �Z?e(d6d7� �Z@e(d8d9� �ZAe(d:d;� �ZBe(d<d=� �ZCe(d>d?� �ZDe(d@dA� �ZEe(dBdC� �ZFe(dDdE� �ZGe(dFdG� �ZHe(dHdI� �ZIe(dJdK� �ZJdLdM� ZKe(dNdO� �ZLe(dPdQ� �ZMe(dRdS� �ZNe(dTdU� �ZOe(dVdW� �ZPe(dXdY� �ZQe(dZd[� �ZRe(d\d]� �ZSe(d^d_� �ZTe(d`da� �ZUe(dbdc� �ZVddde� ZWdfdg� ZXdhdi� ZYdS )j� Certificate�tbs_certificate�signature_algorithm�signature_valueFNc C sl t � | _xX| d d D ]H}|d j}d| }t| |�rHt| ||d j� |d jr| jj|� qW d| _dS ) zv
Sets common named extensions to private attributes and creates a list
of critical extensions
r� r� r� z _%s_valuer� r� TN)rM �_critical_extensionsrR �hasattr�setattrZparsed�add�_processed_extensions)r8 � extensionr� r� r7 r7 r: �_set_extensionsv s
zCertificate._set_extensionsc C s | j s| j� | jS )z�
Returns a set of the names (or OID if not a known extension) of the
extensions marked as critical
:return:
A set of unicode strings
)r� r� r� )r8 r7 r7 r: �critical_extensions� s
z Certificate.critical_extensionsc C s | j s| j� | jS )z�
This extension is used to constrain the period over which the subject
private key may be used
:return:
None or a PrivateKeyUsagePeriod object
)r� r� � _private_key_usage_period_value)r8 r7 r7 r: � private_key_usage_period_value� s
z*Certificate.private_key_usage_period_valuec C s | j s| j� | jS )z�
This extension is used to contain additional identification attributes
about the subject.
:return:
None or a SubjectDirectoryAttributes object
)r� r� � _subject_directory_attributes)r8 r7 r7 r: �"subject_directory_attributes_value� s
z.Certificate.subject_directory_attributes_valuec C s | j s| j� | jS )z�
This extension is used to help in creating certificate validation paths.
It contains an identifier that should generally, but is not guaranteed
to, be unique.
:return:
None or an OctetString object
)r� r� �_key_identifier_value)r8 r7 r7 r: �key_identifier_value� s z Certificate.key_identifier_valuec C s | j s| j� | jS )z�
This extension is used to define the purpose of the public key
contained within the certificate.
:return:
None or a KeyUsage
)r� r� �_key_usage_value)r8 r7 r7 r: �key_usage_value� s
zCertificate.key_usage_valuec C s | j s| j� | jS )aT
This extension allows for additional names to be associate with the
subject of the certificate. While it may contain a whole host of
possible names, it is usually used to allow certificates to be used
with multiple different domain names.
:return:
None or a GeneralNames object
)r� r� �_subject_alt_name_value)r8 r7 r7 r: �subject_alt_name_value� s z"Certificate.subject_alt_name_valuec C s | j s| j� | jS )z�
This extension allows associating one or more alternative names with
the issuer of the certificate.
:return:
None or an x509.GeneralNames object
)r� r� �_issuer_alt_name_value)r8 r7 r7 r: �issuer_alt_name_value� s
z!Certificate.issuer_alt_name_valuec C s | j s| j� | jS )a'
This extension is used to determine if the subject of the certificate
is a CA, and if so, what the maximum number of intermediate CA certs
after this are, before an end-entity certificate is found.
:return:
None or a BasicConstraints object
)r� r� �_basic_constraints_value)r8 r7 r7 r: �basic_constraints_value� s z#Certificate.basic_constraints_valuec C s | j s| j� | jS )z�
This extension is used in CA certificates, and is used to limit the
possible names of certificates issued.
:return:
None or a NameConstraints object
)r� r� �_name_constraints_value)r8 r7 r7 r: �name_constraints_value� s
z"Certificate.name_constraints_valuec C s | j s| j� | jS )z�
This extension is used to help in locating the CRL for this certificate.
:return:
None or a CRLDistributionPoints object
extension
)r� r� � _crl_distribution_points_value)r8 r7 r7 r: � crl_distribution_points_value
s
z)Certificate.crl_distribution_points_valuec C s | j s| j� | jS )a;
This extension defines policies in CA certificates under which
certificates may be issued. In end-entity certificates, the inclusion
of a policy indicates the issuance of the certificate follows the
policy.
:return:
None or a CertificatePolicies object
)r� r� �_certificate_policies_value)r8 r7 r7 r: �certificate_policies_value s z&Certificate.certificate_policies_valuec C s | j s| j� | jS )z�
This extension allows mapping policy OIDs to other OIDs. This is used
to allow different policies to be treated as equivalent in the process
of validation.
:return:
None or a PolicyMappings object
)r� r� �_policy_mappings_value)r8 r7 r7 r: �policy_mappings_value( s z!Certificate.policy_mappings_valuec C s | j s| j� | jS )z�
This extension helps in identifying the public key with which to
validate the authenticity of the certificate.
:return:
None or an AuthorityKeyIdentifier object
)r� r� � _authority_key_identifier_value)r8 r7 r7 r: � authority_key_identifier_value7 s
z*Certificate.authority_key_identifier_valuec C s | j s| j� | jS )z�
This extension is used to control if policy mapping is allowed and
when policies are required.
:return:
None or a PolicyConstraints object
)r� r� �_policy_constraints_value)r8 r7 r7 r: �policy_constraints_valueE s
z$Certificate.policy_constraints_valuec C s | j s| j� | jS )z�
This extension is used to help locate any available delta CRLs
:return:
None or an CRLDistributionPoints object
)r� r� �_freshest_crl_value)r8 r7 r7 r: �freshest_crl_valueS s z Certificate.freshest_crl_valuec C s | j s| j� | jS )z�
This extension is used to prevent mapping of the any policy to
specific requirements
:return:
None or a Integer object
)r� r� �_inhibit_any_policy_value)r8 r7 r7 r: �inhibit_any_policy_value` s
z$Certificate.inhibit_any_policy_valuec C s | j s| j� | jS )z�
This extension is used to define additional purposes for the public key
beyond what is contained in the basic constraints.
:return:
None or an ExtKeyUsageSyntax object
)r� r� �_extended_key_usage_value)r8 r7 r7 r: �extended_key_usage_valuen s
z$Certificate.extended_key_usage_valuec C s | j s| j� | jS )z�
This extension is used to locate the CA certificate used to sign this
certificate, or the OCSP responder for this certificate.
:return:
None or an AuthorityInfoAccessSyntax object
)r� r� �#_authority_information_access_value)r8 r7 r7 r: �"authority_information_access_value| s
z.Certificate.authority_information_access_valuec C s | j s| j� | jS )z�
This extension is used to access information about the subject of this
certificate.
:return:
None or a SubjectInfoAccessSyntax object
)r� r� �!_subject_information_access_value)r8 r7 r7 r: � subject_information_access_value� s
z,Certificate.subject_information_access_valuec C s | j s| j� | jS )z�
This extension is used to list the TLS features a server must respond
with if a client initiates a request supporting them.
:return:
None or a Features object
)r� r� �_tls_feature_value)r8 r7 r7 r: �tls_feature_value� s
z Certificate.tls_feature_valuec C s | j s| j� | jS )a-
This extension is used on certificates of OCSP responders, indicating
that revocation information for the certificate should never need to
be verified, thus preventing possible loops in path validation.
:return:
None or a Null object (if present)
)r� r� �_ocsp_no_check_value)r8 r7 r7 r: �ocsp_no_check_value� s z Certificate.ocsp_no_check_valuec C s
| d j S )zE
:return:
A byte string of the signature
r� )rR )r8 r7 r7 r: r� � s zCertificate.signaturec C s
| d j S )zj
:return:
A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
r� )�signature_algo)r8 r7 r7 r: r � s zCertificate.signature_algoc C s
| d j S )z�
:return:
A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
"sha384", "sha512", "sha512_224", "sha512_256"
r� )� hash_algo)r8 r7 r7 r: r � s zCertificate.hash_algoc C s | d d S )zT
:return:
The PublicKeyInfo object for this certificate
r� r� r7 )r8 r7 r7 r: �
public_key� s zCertificate.public_keyc C s | d d S )zZ
:return:
The Name object for the subject of this certificate
r� r� r7 )r8 r7 r7 r: r� � s zCertificate.subjectc C s | d d S )zY
:return:
The Name object for the issuer of this certificate
r� r� r7 )r8 r7 r7 r: r� � s zCertificate.issuerc C s | d d j S )zT
:return:
An integer of the certificate's serial number
r� r� )rR )r8 r7 r7 r: r� � s zCertificate.serial_numberc C s | j s
dS | j jS )z�
:return:
None or a byte string of the certificate's key identifier from the
key identifier extension
N)r� rR )r8 r7 r7 r: r[ � s zCertificate.key_identifierc C s. | j dkr(| jjd t| j�jd� | _ | j S )z�
:return:
A byte string of the SHA-256 hash of the issuer concatenated with
the ascii character ":", concatenated with the serial number as
an ascii string
N� :rY )�_issuer_serialr� r r r� rE )r8 r7 r7 r: �
issuer_serial
s
zCertificate.issuer_serialc C s | j s
dS | j d jS )z�
:return:
None or a byte string of the key_identifier from the authority key
identifier extension
Nr[ )r rR )r8 r7 r7 r: r�
s z$Certificate.authority_key_identifierc C sj | j dkrd| j}|r^|d jr^| jd d j}|j� }| jd j}|jd t|�jd� | _ nd| _ | j S )a;
:return:
None or a byte string of the SHA-256 hash of the isser from the
authority key identifier extension concatenated with the ascii
character ":", concatenated with the serial number from the
authority key identifier extension as an ascii string
Fr\ r r] r rY N)�_authority_issuer_serialr rR r� Zuntagr r rE )r8 Zakivr� Zauthority_serialr7 r7 r: �authority_issuer_serial
s
z#Certificate.authority_issuer_serialc C s | j dkr| j| j�| _ | j S )z�
Returns complete CRL URLs - does not include delta CRLs
:return:
A list of zero or more DistributionPoint objects
N)�_crl_distribution_points�!_get_http_crl_distribution_pointsr� )r8 r7 r7 r: r� 2
s
z#Certificate.crl_distribution_pointsc C s | j dkr| j| j�| _ | j S )z�
Returns delta CRL URLs - does not include complete CRLs
:return:
A list of zero or more DistributionPoint objects
N)� _delta_crl_distribution_pointsr r )r8 r7 r7 r: � delta_crl_distribution_points?
s
z)Certificate.delta_crl_distribution_pointsc C sd g }|dkrg S xN|D ]F}|d }|t kr,q|jdkr8qx"|jD ]}|jdkr@|j|� q@W qW |S )a?
Fetches the DistributionPoint object for non-relative, HTTP CRLs
referenced by the certificate
:param crl_distribution_points:
A CRLDistributionPoints object to grab the DistributionPoints from
:return:
A list of zero or more DistributionPoint objects
Nrg r` rQ )r/ r� r� r� )r8 r� r� rg Zdistribution_point_namerm r7 r7 r: r L
s
z-Certificate._get_http_crl_distribution_pointsc C sb | j s
g S g }xN| j D ]D}|d jdkr|d }|jdkr<q|j}|j� jd �r|j|� qW |S )
zx
:return:
A list of zero or more unicode strings of the OCSP URLs for this
cert
r� r� r� rQ �http://�https://�ldap://�ldaps://)r r r r! )r rR r� r> rD r� )r8 r� �entry�locationrn r7 r7 r: � ocsp_urlsk
s
zCertificate.ocsp_urlsc C s� | j dkr�g | _ | jrLx�| jD ](}|jdkr |j| j kr | j j|j� q W nXtjd�}xL| jjD ]@}x:|D ]2}|d jdkrj|d j}|j |�rj| j j|� qjW q`W | j S )z�
:return:
A list of unicode strings of valid domain names for the certificate.
Wildcard certificates will have a domain in the form: *.example.com
NrN zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r� r� rK )
�_valid_domainsr� r� rR r� r� �compiler� r� �match)r8 rm �patternr� Zname_type_valuerK r7 r7 r: �
valid_domains�
s
zCertificate.valid_domainsc C sD | j dkr>g | _ | jr>x&| jD ] }|jdkr | j j|j� q W | j S )zj
:return:
A list of unicode strings of valid IP addresses for the certificate
NrR )�
_valid_ipsr� r� r� rR )r8 rm r7 r7 r: � valid_ips�
s
zCertificate.valid_ipsc C s | j o| j d jS )zW
:return;
A boolean - if the certificate is marked as a CA
rW )r� rR )r8 r7 r7 r: rW �
s zCertificate.cac C s | j s
dS | jd jS )zT
:return;
None or an integer of the maximum path length
NrY )rW r� rR )r8 r7 r7 r: �max_path_length�
s zCertificate.max_path_lengthc C s | j dkr| j| jk| _ | j S )zx
:return:
A boolean - if the certificate is self-issued, as defined by RFC
5280
N)� _self_issuedr� r� )r8 r7 r7 r: � self_issued�
s
zCertificate.self_issuedc C sJ | j dkrDd| _ | jrD| jr>| js*d| _ qD| j| jkrDd| _ nd| _ | j S )a�
:return:
A unicode string of "no" or "maybe". The "maybe" result will
be returned if the certificate issuer and subject are the same.
If a key identifier and authority key identifier are present,
they will need to match otherwise "no" will be returned.
To verify is a certificate is truly self-signed, the signature
will need to be verified. See the certvalidator package for
one possible solution.
N�no�maybe)� _self_signedr. r[ r� )r8 r7 r7 r: � self_signed�
s
zCertificate.self_signedc C s$ | j dkr tj| j� �j� | _ | j S )zk
:return:
The SHA-1 hash of the DER-encoded bytes of this complete certificate
N)r� r r r r )r8 r7 r7 r: r �
s
zCertificate.sha1c C s dj dd� t| j�D ��S )z�
:return:
A unicode string of the SHA-1 hash, formatted using hex encoding
with a space between each pair of characters, all uppercase
r� c s s | ]}d | V qdS )z%02XNr7 )r� �cr7 r7 r: r� s z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r� r r )r8 r7 r7 r: �sha1_fingerprint�
s z Certificate.sha1_fingerprintc C s$ | j dkr tj| j� �j� | _ | j S )zy
:return:
The SHA-256 hash of the DER-encoded bytes of this complete
certificate
N)r r r r r )r8 r7 r7 r: r s
zCertificate.sha256c C s dj dd� t| j�D ��S )z�
:return:
A unicode string of the SHA-256 hash, formatted using hex encoding
with a space between each pair of characters, all uppercase
r� c s s | ]}d | V qdS )z%02XNr7 )r� r3 r7 r7 r: r� s z1Certificate.sha256_fingerprint.<locals>.<genexpr>)r� r r )r8 r7 r7 r: �sha256_fingerprint s z Certificate.sha256_fingerprintc C sP t |t�s ttdt|����|jd�jd�j� }|jd�d
k}| oNt j
d|�}| oZ| }|r�| j sjdS |j d�}xh| j D ]^}|jd�jd�j� }|j d�} t
| �t
|�kr�q|| |kr�d S | j|�}
|
r|| j|| �r|d S q|W dS | js�dS |r�tjntj} t| |�} xD| jD ]:}
|
jd�d k�r(tjntj}t||
�}|| k�rd S �qW dS ) a
Check if a domain name or IP address is valid according to the
certificate
:param domain_ip:
A unicode string of a domain name or IP address
:return:
A boolean - if the domain or IP is valid for the certificate
zL
domain_ip must be a unicode string, not %s
r rY rh r z^\d+\.\d+\.\d+\.\d+$Fr@ Tr[ r[ )r< r rC r r
rE r` r> r\ r� r' r) rp ru �_is_wildcard_domain�_is_wildcard_matchr+ rr rt rs r4 )r8 Z domain_ipZencoded_domain_ipZis_ipv6Zis_ipv4Z is_domain�
domain_labelsZ valid_domainZencoded_valid_domain�valid_domain_labelsZ is_wildcardrz Z
normalized_ipZvalid_ipZ valid_familyZnormalized_valid_ipr7 r7 r: �is_valid_domain_ip sB
z Certificate.is_valid_domain_ipc C sZ |j d�dkrdS |j� jd�}|s(dS |d jd�d kr>dS |d dd� dkrVdS dS )
af
Checks if a domain is a valid wildcard according to
https://tools.ietf.org/html/rfc6125#section-6.4.3
:param domain:
A unicode string of the domain name, where any U-labels from an IDN
have been converted to A-labels
:return:
A boolean - if the domain is a valid wildcard domain
�*r Fr@ r r| zxn--Tr[ )�countr> rp r\ )r8 ZdomainZlabelsr7 r7 r: r6 \ s z Certificate._is_wildcard_domainc C sl |d }|dd� }|d }|dd� }||kr4dS |dkr@dS t jd|jdd� d �}|j|�rhdS dS )
a�
Determines if the labels in a domain are a match for labels from a
wildcard valid domain name
:param domain_labels:
A list of unicode strings, with A-label form for IDNs, of the labels
in the domain name to check
:param valid_domain_labels:
A list of unicode strings, with A-label form for IDNs, of the labels
in a wildcard domain pattern
:return:
A boolean - if the domain matches the valid domain
r r NFr; T�^z.*�$)r� r& r� r' )r8 r8 r9 Zfirst_domain_labelZother_domain_labelsZwildcard_labelZother_valid_domain_labelsZwildcard_regexr7 r7 r: r7 } s
z Certificate._is_wildcard_match)ZrN rO rP r� r r" r� r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r
r r� r r r r r r r% r* r- r1 r� r r� ra r� r� r� r� r� r� r� r� r� r� r� r� r r r r r r r
r r r� r r r r� r� r� r[ r r� r r� r r r$ r) r+ rW r, r. r2 r r4 r r5 r: r6 r7 r7 r7 r7 r: r� N s�
#
B!r� c @ s e Zd ZeZdS )�KeyPurposeIdentifiersN)rN rO rP r� r� r7 r7 r7 r: r? � s r? c @ s e Zd ZeZdS )� SequenceOfAlgorithmIdentifiersN)rN rO rP r r� r7 r7 r7 r: r@ � s r@ c @ sP e Zd Zdeddifdeddd�fdeddifdeddifd ed
dd�fgZd S ) �CertificateAuxZtrustr� TZrejectr )r� r� �aliasZkeyidr9 r N)rN rO rP r? r- r# r@ r� r7 r7 r7 r: rA � s
rA c @ s e Zd ZeegZdS )�TrustedCertificateN)rN rO rP r� rA Z _child_specsr7 r7 r7 r: rC � s rC )�r� Z
__future__r r r r �
contextlibr Z encodingsr r r� rr r� r� r� Z_errorsr Z_irir
r Z _ordereddictr Z_typesr
r r Zalgosr r r r Zcorer r r r r r r r r r r r r r! r" r# r$ r% r& r' r( r) r* r+ r, r- r. r/ r� r0 �utilr1 r2 r3 r4 r5 rQ rU rc r� r� r� r� r� r� r� r� r� r� r� r� r r r
r r r r r r r r r r r r r r r r r r! r" r# r$ rF rI rJ rK rL rS rT rU rV rZ r^ ra rb rd re rf ro rp rq rr rs rt rw rz r{ r| r} r~ r r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r? r@ rA rC r7 r7 r7 r: �<module> s x 59l AU* D
"2%
n
# _