mxi]m 8ddlmZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z ddlmZddlmZmZmZmZmZmZmZmZddlmZmZdd lmZmZmZm Z dd l!m"Z"m#Z#dd l$m%Z%ejd d d Z&ejNejPejRejTejVejXejZej\ej^fZ0Gdde1Z2 d)dZ3 d*dZ4d+dZ5GddZ6GddZ7Gdde jpZ9Gdde1Z:e jvZ;GddejxZ=e=j}e jzGdde=Z?e jZ@e jZAe jZBe jZCe jZDe jZEe jZFe jZGe jZHGd d!ZIGd"d#ZJGd$d%ZKGd&d'ZLd,d(ZMy)-) annotationsN)Iterable)utils)x509)hashes)dsaeced448ed25519paddingrsax448x25519) CertificateIssuerPrivateKeyTypesCertificatePublicKeyTypes) Extension Extensions ExtensionType_make_sequence_methods)Name _ASN1Type)ObjectIdentifieric eZdZdfd ZxZS)AttributeNotFoundc2t||||_yN)super__init__oid)selfmsgr __class__s M/home/htdocs/ttos/venv/lib/python3.12/site-packages/cryptography/x509/base.pyrzAttributeNotFound.__init__9s )r"strr rreturnNone__name__ __module__ __qualname__r __classcell__r#s@r$rr8s r%rcZ|D]&}|j|jk(stdy)Nz$This extension has already been set.)r ValueError) extension extensionses r$_reject_duplicate_extensionr4>s1 E 55IMM !CD DEr%c:|D]\}}}||k(s tdy)Nz$This attribute has already been set.)r0)r attributesattr_oid_s r$_reject_duplicate_attributer9Hs. %E!Q s?CD DEr%c|j=|j}|r|ntj}|j d|z S|S)zNormalizes a datetime to a naive datetime in UTC. time -- datetime to normalize. Assumed to be in UTC if not timezone aware. Ntzinfo)r< utcoffsetdatetime timedeltareplace)timeoffsets r$_convert_to_naive_utc_timerCRsG  {{!!x'9'9';||4|(611 r%ceZdZejj f ddZed dZed dZd dZ d dZ d dZ y) Attributec.||_||_||_yr)_oid_value_type)r!r valuerIs r$rzAttribute.__init__as    r%c|jSr)rGr!s r$r z Attribute.oidks yyr%c|jSr)rHrLs r$rJzAttribute.valueos {{r%c<d|jd|jdS)Nz)r rJrLs r$__repr__zAttribute.__repr__ss  (4::.CCr%ct|tstS|j|jk(xr4|j|jk(xr|j |j k(Sr) isinstancerENotImplementedr rJrI)r!others r$__eq__zAttribute.__eq__vsS%+! ! HH ! * ekk) * ekk) r%cZt|j|j|jfSr)hashr rJrIrLs r$__hash__zAttribute.__hash__s TXXtzz4::677r%N)r rrJbytesrIintr'r()r'r)r'rYr'r&)rTobjectr'boolr'rZ) r*r+r,r UTF8StringrJrpropertyr rPrUrXr%r$rErE`sv ))//     D 8r%rEcDeZdZ ddZed\ZZZddZddZ y) Attributesc$t||_yr)list _attributes)r!r6s r$rzAttributes.__init__s +r%rfc"d|jdS)Nz ?EEr%N)r6zIterable[Attribute]r'r(r[)r rr'rE) r*r+r,rr__len____iter__ __getitem__rPrjrar%r$rcrcs7,', , &timezoneutcrLs r$rz*_RawRevokedCertificate.revocation_date_utcs($$,,H4E4E4I4I,JJr%c|jSr)rrLs r$r2z!_RawRevokedCertificate.extensionssr%N)rzrZr}rr2rr^rr) r*r+r,rr`rzr}rr2rar%r$rrsu&&+& &##%%KK  r%rceZdZdggf d dZd dZ d dZdd d dZ d ddd ddZy) CertificateSigningRequestBuilderNc.||_||_||_y)zB Creates an empty X.509 certificate request (v1). N) _subject_namerrf)r! subject_namer2r6s r$rz)CertificateSigningRequestBuilder.__init__s*%%r%ct|ts td|j t dt ||j |jS)zF Sets the certificate requestor's distinguished name. Expecting x509.Name object.&The subject name may only be set once.)rRr TypeErrorrr0rrrfr!names r$rz-CertificateSigningRequestBuilder.subject_name sR$%9: :    )EF F/ $""D$4$4  r%ct|ts tdt|j||}t ||j t|jg|j ||jS)zE Adds an X.509 extension to the certificate request. "extension must be an ExtensionType) rRrrrr r4rrrrfr!extvalcriticalr1s r$ add_extensionz.CertificateSigningRequestBuilder.add_extensionsn &-0@A Afjj(F; #It/?/?@/    *d * *     r%)_tagcZt|ts tdt|ts td|t|ts tdt ||j | |j}nd}t|j|jg|j |||fS)zK Adds an X.509 attribute with an OID and associated value. zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type) rRrrrYrr9rfrJrrr)r!r rJrtags r$ add_attributez.CertificateSigningRequestBuilder.add_attribute's#/0=> >%'12 2  JtY$?34 4#C)9)9:  **CC/       2d 2eS 1 2  r% rsa_paddingecdsa_deterministicch|j td|Zt|tjtj fs t dt|tjs t d|%t|tjs t dtj|||||S)zF Signs the request using the requestor's private key. z/A CertificateSigningRequest must have a subjectPadding must be PSS or PKCS1v15&Padding is only supported for RSA keys1Deterministic ECDSA is only supported for EC keys) rr0rRr PSSPKCS1v15rr RSAPrivateKeyr EllipticCurvePrivateKey rust_x509create_x509_csrr! private_key algorithmbackendrrs r$signz%CertificateSigningRequestBuilder.signGs    %NO O  "kGKK9I9I+JK ABBk3+<+<= HII  *k2+E+EFG((        r%)r Name | Noner2list[Extension[ExtensionType]]r60list[tuple[ObjectIdentifier, bytes, int | None]])rrr'r)rrrr]r'r)r rrJrYrz_ASN1Type | Noner'rr) rrr_AllowedHashTypes | Noner typing.Anyr%padding.PSS | padding.PKCS1v15 | Noner bool | Noner'CertificateSigningRequest)r*r+r,rrrrrrar%r$rrs%)57GI &! &3 &E &   # /3 ) ."&      *  H# ! >B+/! 5! ,!  ! ; ! )!  #! r%rceZdZUded<ddddddgf ddZddZddZ ddZddZdd Z dd Z dd Z dddd  dd Z y)CertificateBuilderrrNctj|_||_||_||_||_||_||_||_ yr) rorr_version _issuer_namer _public_keyr_not_valid_before_not_valid_afterr)r! issuer_namer public_keyrznot_valid_beforenot_valid_afterr2s r$rzCertificateBuilder.__init__nsG  ')%+!1 /%r%c t|ts td|j t dt ||j |j|j|j|j|jS)z3 Sets the CA's distinguished name. r%The issuer name may only be set once.) rRrrrr0rrrrrrrrs r$rzCertificateBuilder.issuer_namesx$%9: :    (DE E!            " "  ! !     r%c t|ts td|j t dt |j ||j|j|j|j|jS)z: Sets the requestor's distinguished name. rr) rRrrrr0rrrrrrrrs r$rzCertificateBuilder.subject_namesx$%9: :    )EF F!            " "  ! !     r%c t|tjtjt j tjtjtjtjfs td|j t#dt%|j&|j(||j*|j,|j.|j0S)zT Sets the requestor's public key (as found in the signing request). zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.z$The public key may only be set once.)rRr DSAPublicKeyr RSAPublicKeyr EllipticCurvePublicKeyr Ed25519PublicKeyr Ed448PublicKeyrX25519PublicKeyr X448PublicKeyrrr0rrrrrrr)r!keys r$rzCertificateBuilder.public_keys     ))(($$&&""   !     'CD D!            " "  ! !     r%c \t|ts td|j t d|dkr t d|j dk\r t dt |j|j|j||j|j|jS)z5 Sets the certificate serial number. 'Serial number must be of integral type.'The serial number may only be set once.rz%The serial number should be positive.3The serial number should not be more than 159 bits.) rRrZrrr0 bit_lengthrrrrrrrr!numbers r$rzz CertificateBuilder.serial_numbers&#&EF F    *FG G Q;DE E    # %E "            " "  ! !     r%c t|tjs td|j t dt |}|t kr t d|j||jkDr t dt|j|j|j|j||j|jS)z7 Sets the certificate activation time. Expecting datetime object.z*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rRr>rrr0rC_EARLIEST_UTC_TIMErrrrrrrr!rAs r$rz#CertificateBuilder.not_valid_befores$ 1 1289 9  ! ! -IJ J)$/ $ $$   ,8M8M1M "               ! !     r%c t|tjs td|j t dt |}|t kr t d|j||jkr t dt|j|j|j|j|j||jS)z7 Sets the certificate expiration time. rz)The not valid after may only be set once.zrrr0rCrrrrrrrrrs r$rz"CertificateBuilder.not_valid_afters$ 1 1289 9  ,HI I)$/ $ $N   " " .t--- "              " "      r%c Ht|ts tdt|j||}t ||j t|j|j|j|j|j|jg|j |S)z= Adds an X.509 extension to the certificate. r)rRrrrr r4rrrrrrrrrs r$rz CertificateBuilder.add_extension!s &-0@A Afjj(F; #It/?/?@!              " "  ! ! *d * *  r%rcN|j td|j td|j td|j td|j td|j td|Zt|tjtjfs tdt|tjs td|%t|tjs td t!j"|||||S) zC Signs the certificate using the CA's private key. z&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public keyrrr)rr0rrrrrrRr rrrr rr rrcreate_x509_certificaters r$rzCertificateBuilder.sign7s%    %EF F    $EF F    &FG G  ! ! )NO O  (MN N    #CD D  "kGKK9I9I+JK ABBk3+<+<= HII  *k2+E+EFG00        r%)rrrrrz CertificatePublicKeyTypes | Nonerz int | Nonerdatetime.datetime | Nonerrr2rr'r()rrr'r)rrr'r)rrZr'r)rArr'r)rrrr]r'rr) rrrrrrrrrrr' Certificate) r*r+r,__annotations__rrrrrzrrrrrar%r$rrks//$($(7;$(594857& &"&5 & " & 3 &2&3& && $ $# &#  # J 6 : > # /3  4# 0 >B+/0 50 ,0  0 ; 0 )0  0 r%rceZdZUded<ded<dddggf ddZ ddZ ddZ dd Z dd Z dd Z dddd  dd Z y) CertificateRevocationListBuilderrrlist[RevokedCertificate]_revoked_certificatesNcJ||_||_||_||_||_yr)r _last_update _next_updaterr)r!r last_update next_updater2revoked_certificatess r$rz)CertificateRevocationListBuilder.__init__ns,(''%%9"r%ct|ts td|j t dt ||j |j|j|jS)Nrr) rRrrrr0rrrrr)r!rs r$rz,CertificateRevocationListBuilder.issuer_name|sf+t,9: :    (DE E/            & &   r%crt|tjs td|j t dt |}|t kr t d|j||jkDr t dt|j||j|j|jS)Nr!Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.) rRr>rrr0rCrrrrrr)r!rs r$rz,CertificateRevocationListBuilder.last_updates+x'8'8989 9    (@A A0= + +J     ([4;L;L-LK 0            & &   r%crt|tjs td|j t dt |}|t kr t d|j||jkr t dt|j|j||j|jS)Nrrrz8The next update date must be after the last update date.) rRr>rrr0rCrrrrrr)r!rs r$rz,CertificateRevocationListBuilder.next_updates+x'8'8989 9    (@A A0= + +J     ([4;L;L-LJ 0            & &   r%ct|ts tdt|j||}t ||j t|j|j|jg|j ||jS)zM Adds an X.509 extension to the certificate revocation list. r) rRrrrr r4rrrrrrrs r$rz.CertificateRevocationListBuilder.add_extensions &-0@A Afjj(F; #It/?/?@/          *d * *  & &   r%ct|ts tdt|j|j |j |jg|j|S)z8 Adds a revoked certificate to the CRL. z)Must be an instance of RevokedCertificate) rRrxrrrrrrr)r!revoked_certificates r$add_revoked_certificatez8CertificateRevocationListBuilder.add_revoked_certificatesa -/ABGH H/             >d(( >*= >   r%rc|j td|j td|j td|Zt |t j t jfs tdt |tjs td|%t |tjs tdtj|||||S)NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update timerrr)rr0rrrRr rrrr rr rrcreate_x509_crlrs r$rz%CertificateRevocationListBuilder.signs    $=> >    $AB B    $AB B  "kGKK9I9I+JK ABBk3+<+<= HII  *k2+E+EFG((        r%) rrrrrrr2rrr)rrr'r)rrr'r)rrr'r)rrrr]r'r)rrxr'rr) rrrrrrrrrrr'CertificateRevocationList) r*r+r,rrrrrrrrrar%r$rrjs//33$(0404579; :  :. :. : 3 : 7 :    )   , ) 0 , ) 0 # /3 ) & #5 ) *# $ >B+/$ 5$ ,$  $ ; $ )$  #$ r%rc\eZdZddgf ddZddZ d dZ d dZd d dZy) RevokedCertificateBuilderNc.||_||_||_yrrrs r$rz"RevokedCertificateBuilder.__init__rr%ct|ts td|j t d|dkr t d|j dk\r t dt ||j|jS)Nrrrz$The serial number should be positiverr) rRrZrrr0rr rrrs r$rzz'RevokedCertificateBuilder.serial_numbers&#&EF F    *FG G Q;CD D    # %E ) D))4+;+;  r%ct|tjs td|j t dt |}|t kr t dt|j||jS)Nrz)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.) rRr>rrr0rCrr rrrs r$r}z)RevokedCertificateBuilder.revocation_date#s}$ 1 1289 9  ,HI I)$/ $ $I )   t'7'7  r%ct|ts tdt|j||}t ||j t|j|jg|j |S)Nr) rRrrrr r4rr rrrs r$rz'RevokedCertificateBuilder.add_extension3sn&-0@A Afjj(F; #It/?/?@(     ! ! *d * *  r%c|j td|j tdt|j|jt |j S)Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)rr0rrrr)r!rs r$buildzRevokedCertificateBuilder.buildAse    &NO O  (C &     ! ! t'' (  r%)rzrr}rr2r)rrZr'r )rArr'r )rrrr]r'r r)rrr'rx)r*r+r,rrzr}rrrar%r$r r sj%)4857 &!&2&3 & $ % "  #  /3  "    r%r cZtjtjdddz S)Nbigr)rZ from_bytesosurandomrar%r$random_serial_numberrOs >>"**R.% 0A 55r%)r1zExtension[ExtensionType]r2rr'r()r rr6rr'r()rArr'rr^)N __future__rrr>rtypingrcollections.abcr cryptographyr"cryptography.hazmat.bindings._rustrrcryptography.hazmat.primitivesr)cryptography.hazmat.primitives.asymmetricrr r r r r rr/cryptography.hazmat.primitives.asymmetric.typesrrcryptography.x509.extensionsrrrrcryptography.x509.namerrcryptography.x509.oidrrUnionSHA224SHA256SHA384SHA512SHA3_224SHA3_256SHA3_384SHA3_512_AllowedHashTypes Exceptionrr4r9rCrErcEnumrortrABCMetarxregisterrr rload_pem_x509_certificateload_der_x509_certificateload_pem_x509_certificatesload_pem_x509_csrload_der_x509_csrload_pem_x509_crlload_der_x509_crlrrrr rrar%r$r:s% #  $@1    32&X&&tQ2LL MM MM MM MM OO OO OO OO   E'E.E EE E@E E !8!8HFF( ejj -Y- ##  3;; @I889 / D&??%??&??%??&AA////////m m `| | ~Y Y xF F R6r%