File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/OpenSSL/__pycache__/crypto.cpython-310.pyc
Back
o ;j�7 � @ s� U d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl m Z m Z d dlm Z d dlmZmZmZ ejdkrId dlmZ nejd k rYe�d �Zdwdd�Znd dlmZ d dlmZmZ d dlmZmZm Z m Z m Z d dl m Z d dl m!Z" d dl m#Z$ d dl m%Z& d dl m'Z( d dl m)Z* d dl m+Z, g d �Z-eej.ej/e j0e j1e j2f Z3eej4ej5e j6e j7e j8f Z9ee3e9f Z:ee;ed e;f f Z<e(j=Z>d e?d < e(j@ZAd e?d < d!ZBe(jCZDd e?d"< e(jEZFd e?d#< e(jGZHd e?d$< e(jIZJd e?d%< G d&d'� d'eK�ZLe e$eL�ZMe*eL�ZNdxdyd+d,�ZOdzd/d0�ZPd{d4d5�ZQd|d6d7�ZRd}d9d:�ZSG d;d<� d<�ZTG d=d>� d>�ZUG d?d@� d@�ZVedA�d~dCdD��ZWedE�ddGdH��ZXejYG dIdJ� dJ��ZZedK�G dLdM� dM��Z[edN�G dOdP� dP��Z\G dQdR� dR�Z]G dSdT� dT�Z^G dUdV� dV�Z_G dWdX� dXeK�Z`G dYdZ� dZ�Zad�d\d]�Zbd�d_d`�Zcd�dbdc�Zd d�d�dhdi�ZeG djdk� dk�Zfd�dmdn�Zg dxd�dodp�Zhd�drds�ZieiZjejeiekdNeldsdt� d�dudv�ZmemZnejemekdNeldvdt� dS )�� )� annotationsN)� b16encode)�Iterable�Sequence)�partial)�Any�Callable�Union)� � )� deprecated)r � �T�msg�str�kwargs�object�return�Callable[[_T], _T]c K s dd� S )Nc S s | S �N� )�fr r �B/opt/saltstack/salt/lib/python3.10/site-packages/OpenSSL/crypto.py�<lambda> s z deprecated.<locals>.<lambda>r )r r r r r r s r )�utils�x509)�dsa�ec�ed448�ed25519�rsa)�StrOrBytesPath)� byte_string)�exception_from_error_queue)�ffi)�lib)� make_assert)� path_bytes)� FILETYPE_ASN1� FILETYPE_PEM� FILETYPE_TEXT�TYPE_DSA�TYPE_RSA�X509�Error�PKey� X509Extension�X509Name�X509Req� X509Store�X509StoreContext�X509StoreContextError�X509StoreFlags�dump_certificate�dump_certificate_request�dump_privatekey�dump_publickey�get_elliptic_curve�get_elliptic_curves�load_certificate�load_certificate_request�load_privatekey�load_publickey.�intr) r( i�� r, r+ �TYPE_DH�TYPE_ECc @ s e Zd ZdZdS )r. z7 An error occurred in an `OpenSSL.crypto` API. N)�__name__� __module__� __qualname__�__doc__r r r r r. t s r. �buffer� bytes | Noner c C sf | du rt �t �� �}t j}nt�d| �}t �|t| ��}|fd dd�}t|tj k� t� ||�}|S ) z� Allocate a new OpenSSL memory BIO. Arrange for the garbage collector to clean it up automatically. :param buffer: None or some bytes to use to put into the BIO so that they can be read out. N�char[]�bior �refr c S s t �| �S r )�_lib�BIO_free)rK rL r r r �free� � z_new_mem_buf.<locals>.free)rK r rL r r r ) rM ZBIO_newZ BIO_s_memrN �_ffi�newZBIO_new_mem_buf�len�_openssl_assert�NULL�gc)rH rK rO �datar r r � _new_mem_buf~ s rX rK �bytesc C s. t �d�}t�| |�}t �|d |�dd� S )zO Copy the contents of an OpenSSL BIO object into a Python byte string. zchar**r N)rQ rR rM ZBIO_get_mem_datarH )rK � result_bufferZ buffer_lengthr r r �_bio_to_string� s r[ �boundary�when�Nonec C s@ t |t�s td��t| tjk� t�| |�}|dkr td��dS )a� The the time value of an ASN1 time object. @param boundary: An ASN1_TIME pointer (or an object safely castable to that type) which will have its value set. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. zwhen must be a byte stringr zInvalid stringN) � isinstancerY � TypeErrorrT rQ rU rM ZASN1_TIME_set_string� ValueError)r\ r] � set_resultr r r �_set_asn1_time� s �rc c C s2 t �� }t|tjk� t�|t j�}t|| � |S )a� Behaves like _set_asn1_time but returns a new ASN1_TIME object. @param when: A string representation of the desired time value. @raise TypeError: If C{when} is not a L{bytes} string. @raise ValueError: If C{when} does not represent a time in the required format. @raise RuntimeError: If the time value cannot be set for some other (unspecified) reason. )rM Z ASN1_TIME_newrT rQ rU rV ZASN1_TIME_freerc )r] �retr r r �_new_asn1_time� s re � timestampc C s� t �d| �}t�|�dkrdS t�|�tjkr t �t�|��S t �d�}t� | |� t |d t j k� t �d|d �}t�|�}t �|�}t� |d � |S )a] Retrieve the time value of an ASN1 time object. @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to that type) from which the time value will be retrieved. @return: The time value from C{timestamp} as a L{bytes} string in a certain format. Or C{None} if the object contains no time value. � ASN1_STRING*r NzASN1_GENERALIZEDTIME**) rQ �castrM �ASN1_STRING_lengthZASN1_STRING_typeZV_ASN1_GENERALIZEDTIME�string�ASN1_STRING_get0_datarR Z ASN1_TIME_to_generalizedtimerT rU ZASN1_GENERALIZEDTIME_free)rf Zstring_timestampZgeneralized_timestampZ string_data� string_resultr r r �_get_asn1_time� s rm c @ s* e Zd Zd dd�Zd dd�Zd d d �Zd S )�_X509NameInvalidatorr r^ c C s g | _ d S r )�_names��selfr r r �__init__� rP z _X509NameInvalidator.__init__�namer1 c C s | j �|� d S r )ro �append�rq rs r r r �add� s z_X509NameInvalidator.addc C s | j D ]}|`qd S r )ro �_nameru r r r �clear� s �z_X509NameInvalidator.clearN�r r^ �rs r1 r r^ )rD rE rF rr rv rx r r r r rn � s rn c @ sb e Zd ZdZdZdZddd�Zd d d �Zed d d ��Z d dd�Z d dd�Z d dd�Z d dd�Z dS )!r/ zD A class representing an DSA or RSA public key or key pair. FTr r^ c C s" t �� }t�|t j�| _d| _d S )NF)rM Z EVP_PKEY_newrQ rV � EVP_PKEY_free�_pkey� _initialized�rq �pkeyr r r rr � s z PKey.__init__�_Keyc C sN ddl m}m} | jrtt| �}t�t||��S t t| �}t�t||dd��S )a Export as a ``cryptography`` key. :rtype: One of ``cryptography``'s `key interfaces`_. .. _key interfaces: https://cryptography.io/en/latest/hazmat/ primitives/asymmetric/rsa/#key-interfaces .. versionadded:: 16.1.0 r )�load_der_private_key�load_der_public_keyN)�password) �,cryptography.hazmat.primitives.serializationr� r� � _only_publicr: r( �typingrh r� r9 )rq r� r� �derr r r �to_cryptography_key s zPKey.to_cryptography_key� crypto_keyc C s� t |tjtjtjtjtjtj t j t j t jt jf �s td��ddlm}m}m}m} t |tjtjtj t j t jf�rCtt|�|j|j��S |�|j|j |� �}t t|�S )z� Construct based on a ``cryptography`` *crypto_key*. :param crypto_key: A ``cryptography`` key. :type crypto_key: One of ``cryptography``'s `key interfaces`_. :rtype: PKey .. versionadded:: 16.1.0 zUnsupported key typer )�Encoding� NoEncryption� PrivateFormat� PublicFormat) r_ r � DSAPrivateKey� DSAPublicKeyr �EllipticCurvePrivateKey�EllipticCurvePublicKeyr �Ed25519PrivateKey�Ed25519PublicKeyr �Ed448PrivateKey�Ed448PublicKeyr � RSAPrivateKey� RSAPublicKeyr` r� r� r� r� r� r@ r( � public_bytes�DERZSubjectPublicKeyInfoZ private_bytesZPKCS8r? )�clsr� r� r� r� r� r� r r r �from_cryptography_key sF ���� �� � zPKey.from_cryptography_key�typerA �bitsc C s4 t |t�s td��t |t�std��|tkrQ|dkr td��t�� }t�|tj �}t� |tj � t� � }t� |||tj�}t|dk� t�| j|�}t|dk� nD|tkr�t�� }t|tjk� t�|tj�}t�||tjdtjtjtj�}t|dk� tt�|�dk� tt�| j|�dk� ntd��d| _dS ) a3 Generate a key pair of the given type, with the given number of bits. This generates a key "into" the this object. :param type: The key type. :type type: :py:data:`TYPE_RSA` or :py:data:`TYPE_DSA` :param bits: The number of bits. :type bits: :py:data:`int` ``>= 0`` :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't of the appropriate type. :raises ValueError: If the number of bits isn't an integer of the appropriate size. :return: ``None`` ztype must be an integerzbits must be an integerr zInvalid number of bits� zNo such key typeTN)r_ rA r` r, ra rM ZBN_newrQ rV �BN_freeZ BN_set_wordZRSA_F4ZRSA_newZRSA_generate_key_exrU rT ZEVP_PKEY_assign_RSAr| r+ ZDSA_newZDSA_freeZDSA_generate_parameters_exZDSA_generate_keyZEVP_PKEY_set1_DSAr. r} )rq r� r� Zexponentr �resultr �resr r r � generate_keyU s6 � zPKey.generate_key�boolc C sd | j rtd��t�| �� �tjkrtd��t�| j�}t� |tj �}t� |�}|dkr-dS t � dS )ax Check the consistency of an RSA private key. This is the Python equivalent of OpenSSL's ``RSA_check_key``. :return: ``True`` if key is consistent. :raise OpenSSL.crypto.Error: if the key is inconsistent. :raise TypeError: if the key is of a type which cannot be checked. Only RSA keys can currently be checked. zpublic key onlyz'Only RSA keys can currently be checked.r� TN) r� r` rM Z EVP_PKEY_typer� � EVP_PKEY_RSA�EVP_PKEY_get1_RSAr| rQ rV �RSA_freeZ RSA_check_key�_raise_current_error)rq r r� r r r �check� s z PKey.checkc C � t �| j�S )zT Returns the type of the key :return: The type of the key. )rM � EVP_PKEY_idr| rp r r r r� � � z PKey.typec C r� )zh Returns the number of bits of the key :return: The number of bits of the key. )rM Z EVP_PKEY_bitsr| rp r r r r� � r� z PKey.bitsNry )r r� )r� r� r r/ )r� rA r� rA r r^ �r r� �r rA )rD rE rF rG r� r} rr r� � classmethodr� r� r� r� r� r r r r r/ � s 9 8 r/ c sn e Zd ZdZdZd � fdd� Zed d d ��Zed d d��Zed dd��Z d dd�Z d dd�Z d!dd�Z � Z S )"�_EllipticCurveaZ A representation of a supported elliptic curve. @cvar _curves: :py:obj:`None` until an attempt is made to load the curves. Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve` instances each of which represents one curve supported by the system. @type _curves: :py:type:`NoneType` or :py:type:`set` N�otherr r r� c s t |t�r t� �|�S tS )z� Implement cooperation with the right-hand side argument of ``!=``. Python 3 seems to have dropped this cooperation in this very narrow circumstance. )r_ r� �super�__ne__�NotImplemented�rq r� �� __class__r r r� � s z_EllipticCurve.__ne__r% �set[_EllipticCurve]c s> �� tjd�}t�d|�}�� ||� t� �fdd�|D ��S )z� Get the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. r zEC_builtin_curve[]c 3 s � | ] }� � �|j�V qd S r )�from_nid�nid)�.0�c�r� r% r r � <genexpr>� s � z7_EllipticCurve._load_elliptic_curves.<locals>.<genexpr>)ZEC_get_builtin_curvesrQ rU rR �set)r� r% Z num_curvesZbuiltin_curvesr r� r �_load_elliptic_curves� s z$_EllipticCurve._load_elliptic_curvesc C s | j du r | �|�| _ | j S )a Get, cache, and return the curves supported by OpenSSL. :param lib: The OpenSSL library binding object. :return: A :py:type:`set` of ``cls`` instances giving the names of the elliptic curves the underlying library supports. N)�_curvesr� r� r r r �_get_elliptic_curves� s z#_EllipticCurve._get_elliptic_curvesr� rA c C s | ||t �|�|���d��S )a� Instantiate a new :py:class:`_EllipticCurve` associated with the given OpenSSL NID. :param lib: The OpenSSL library binding object. :param nid: The OpenSSL NID the resulting curve object will represent. This must be a curve NID (and not, for example, a hash NID) or subsequent operations will fail in unpredictable ways. :type nid: :py:class:`int` :return: The curve object. �ascii)rQ rj � OBJ_nid2sn�decode)r� r% r� r r r r� � s z_EllipticCurve.from_nidrs r r^ c C s || _ || _|| _dS )a� :param _lib: The :py:mod:`cryptography` binding instance used to interface with OpenSSL. :param _nid: The OpenSSL NID identifying the curve this object represents. :type _nid: :py:class:`int` :param name: The OpenSSL short name identifying the curve this object represents. :type name: :py:class:`unicode` N)rM �_nidrs )rq r% r� rs r r r rr s z_EllipticCurve.__init__c C s d| j �d�S )Nz<Curve �>�rs rp r r r �__repr__ � z_EllipticCurve.__repr__c C s | j �| j�}t�|t j�S )z� Create a new OpenSSL EC_KEY structure initialized to use this curve. The structure is automatically garbage collected when the Python object is garbage collected. )rM ZEC_KEY_new_by_curve_namer� rQ rV Z EC_KEY_free)rq �keyr r r � _to_EC_KEY s z_EllipticCurve._to_EC_KEY�r� r r r� )r% r r r� )r% r r� rA r r� )r% r r� rA rs r r r^ �r r �r r )rD rE rF rG r� r� r� r� r� r� rr r� r� � __classcell__r r r� r r� � s r� zSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.r� c C s t �t�S )a� Return a set of objects representing the elliptic curves supported in the OpenSSL build in use. The curve objects have a :py:class:`unicode` ``name`` attribute by which they identify themselves. The curve objects are useful as values for the argument accepted by :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be used for ECDHE key exchange. )r� r� rM r r r r r< s r< zRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.rs c C s( t � D ] }|j| kr| S qtd| ��)aT Return a single curve object selected by name. See :py:func:`get_elliptic_curves` for information about curve objects. :param name: The OpenSSL short name identifying the curve object to retrieve. :type name: :py:class:`unicode` If the named curve is not supported then :py:class:`ValueError` is raised. zunknown curve name)r< rs ra )rs Zcurver r r r; 2 s � r; c sr e Zd ZdZd dd�Zd!� fd d � Zd"d d�Zd#dd�Zd#dd�Zd$dd�Z d%dd�Z d&dd �Z d'd d �Z � Z S )(r1 a An X.509 Distinguished Name. :ivar countryName: The country of the entity. :ivar C: Alias for :py:attr:`countryName`. :ivar stateOrProvinceName: The state or province of the entity. :ivar ST: Alias for :py:attr:`stateOrProvinceName`. :ivar localityName: The locality of the entity. :ivar L: Alias for :py:attr:`localityName`. :ivar organizationName: The organization name of the entity. :ivar O: Alias for :py:attr:`organizationName`. :ivar organizationalUnitName: The organizational unit of the entity. :ivar OU: Alias for :py:attr:`organizationalUnitName` :ivar commonName: The common name of the entity. :ivar CN: Alias for :py:attr:`commonName`. :ivar emailAddress: The e-mail address of the entity. rs r r^ c C s t �|j�}t�|t j�| _dS )z� Create a new X509Name, copying the given X509Name instance. :param name: The name to copy. :type name: :py:class:`X509Name` N)rM Z X509_NAME_duprw rQ rV ZX509_NAME_freeru r r r rr b s zX509Name.__init__r �valuer c s |� d�r t� �||�S t|�tur tdt|�jd�d���t�t |��}|tj kr?zt � W t d�� t y> Y t d��w tt�| j��D ]%}t�| j|�}t�|�}t�|�}||krlt�| j|�}t�|� nqGt|t�rw|�d�}t�| j|tj|t|�dd�}|s�t � d S d S ) N�_z$attribute name must be string, not 'z.200�'�No such attribute�utf-8���r )� startswithr� � __setattr__r� r r` rD rM � OBJ_txt2nid� _byte_string� NID_undefr� r. �AttributeError�range�X509_NAME_entry_countrw �X509_NAME_get_entry�X509_NAME_ENTRY_get_object� OBJ_obj2nidZX509_NAME_delete_entryZX509_NAME_ENTRY_freer_ �encodeZX509_NAME_add_entry_by_NIDZ MBSTRING_UTF8rS ) rq rs r� r� �i�entZent_objZent_nid� add_resultr� r r r� l sD �� �� � � �zX509Name.__setattr__� str | Nonec C s� t �t|��}|t jkr!zt� W td�� ty Y td��w t �| j|d�}|dkr/dS t � | j|�}t � |�}t � d�}t � ||�}t|dk� zt �|d |�dd� �d�}W t �|d � |S t �|d � w )a Find attribute. An X509Name object has the following attributes: countryName (alias C), stateOrProvince (alias ST), locality (alias L), organization (alias O), organizationalUnit (alias OU), commonName (alias CN) and more... r� r� N�unsigned char**r r� )rM r� r� r� r� r. r� ZX509_NAME_get_index_by_NIDrw r� �X509_NAME_ENTRY_get_datarQ rR ZASN1_STRING_to_UTF8rT rH r� � OPENSSL_free) rq rs r� Z entry_index�entryrW rZ Z data_lengthr� r r r � __getattr__� s0 �� ��zX509Name.__getattr__r� r� c C s" t |t�stS t�| j|j�dkS �Nr �r_ r1 r� rM Z X509_NAME_cmprw r� r r r �__eq__� � zX509Name.__eq__c C s" t |t�stS t�| j|j�dk S r� r� r� r r r �__lt__� r� zX509Name.__lt__c C sD t �dd�}t�| j|t|��}t|t jk� d�t � |�� d��S )z6 String representation of an X509Name rJ i z<X509Name object '{}'>r� ) rQ rR rM ZX509_NAME_onelinerw rS rT rU �formatrj r� )rq rZ Z format_resultr r r r� � s ��zX509Name.__repr__rA c C r� )a& Return an integer representation of the first four bytes of the MD5 digest of the DER representation of the name. This is the Python equivalent of OpenSSL's ``X509_NAME_hash``. :return: The (integer) hash of this name. :rtype: :py:class:`int` )rM ZX509_NAME_hashrw rp r r r �hash� � z X509Name.hashrY c C sN t �d�}t�| j|�}t|dk� t �|d |�dd� }t�|d � |S )z� Return the DER encoding of this name. :return: The DER encoded form of this name. :rtype: :py:class:`bytes` r� r N)rQ rR rM Z i2d_X509_NAMErw rT rH r� )rq rZ Z encode_resultrl r r r r� � s z X509Name.der�list[tuple[bytes, bytes]]c C s� g }t t�| j��D ]7}t�| j|�}t�|�}t�|�}t�|�}t�|�}t � t� |�t� |��dd� }|� t �|�|f� q |S )z� Returns the components of this name, as a sequence of 2-tuples. :return: The components of this name. :rtype: :py:class:`list` of ``name, value`` tuples. N)r� rM r� rw r� r� r� r� r� rQ rH rk ri rt rj ) rq r� r� r� �fnameZfvalr� rs r� r r r �get_components� s ��zX509Name.get_componentsrz )rs r r� r r r^ )rs r r r� r� r� r� �r rY )r r� )rD rE rF rG rr r� r� r� r� r� r� r� r� r� r r r� r r1 H s ' ( r1 zZX509Extension support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c @ s� e Zd ZU dZ d"d#d d�Zed$dd��Zejdej dej diZ de d< d%dd�Z d%dd�Zd&d d �Zd'd d �Zd'd d!�ZdS )(r0 zu An X.509 v3 certificate extension. .. deprecated:: 23.3.0 Use cryptography's X509 APIs instead. N� type_namerY �criticalr� r� �subject� X509 | None�issuerr r^ c C s� t �d�}t�|t jt jt jt jd� t�|� |dur)t|t�s%td��|j |_ |dur:t|t�s6td��|j |_ |r@d| }t� t j|||�}|t jkrQt � t �|tj�| _dS )a� Initializes an X509 extension. :param type_name: The name of the type of extension_ to create. :type type_name: :py:data:`bytes` :param bool critical: A flag indicating whether this is a critical extension. :param value: The OpenSSL textual representation of the extension's value. :type value: :py:data:`bytes` :param subject: Optional X509 certificate to use as subject. :type subject: :py:class:`X509` :param issuer: Optional X509 certificate to use as issuer. :type issuer: :py:class:`X509` .. _extension: https://www.openssl.org/docs/manmaster/man5/ x509v3_config.html#STANDARD-EXTENSIONS z X509V3_CTX*r Nz issuer must be an X509 instancez subject must be an X509 instances critical,)rQ rR rM ZX509V3_set_ctxrU ZX509V3_set_ctx_nodbr_ r- r` �_x509Z issuer_certZ subject_certZX509V3_EXT_nconfr� rV �X509_EXTENSION_free� _extension)rq r� r� r� r� r� �ctx� extensionr r r rr s" zX509Extension.__init__r c C s t �t �| j��S r )rM r� �X509_EXTENSION_get_objectr� rp r r r r� \ s �zX509Extension._nid�email�DNSZURIz typing.ClassVar[dict[int, str]]� _prefixesr c C s� t �dt�| j��}t �|tj�}g }tt�|��D ]Q}t� ||�}z| j |j }W n t yF t � }t�||� |�t|��d�� Y qw t �d|jj�}t �t�|�t�|��d d � �d�}|�|d | � qd�|�S )NzGENERAL_NAMES*r� rg �:z, )rQ rh rM ZX509V3_EXT_d2ir� rV ZGENERAL_NAMES_freer� Zsk_GENERAL_NAME_numZsk_GENERAL_NAME_valuer r� �KeyErrorrX ZGENERAL_NAME_printrt r[ r� �dZia5rH rk ri �join) rq �names�partsr� rs ZlabelrK Z asn1_stringr� r r r �_subjectAltNameStringh s2 � ���� z#X509Extension._subjectAltNameStringc C sF t j| jkr | �� S t� }t �|| jdd�}t|dk� t|�� d�S )zF :return: a nice text representation of the extension r r� ) rM ZNID_subject_alt_namer� r rX ZX509V3_EXT_printr� rT r[ r� )rq rK Z print_resultr r r �__str__� s zX509Extension.__str__c C r� )zk Returns the critical field of this X.509 extension. :return: The critical field. )rM ZX509_EXTENSION_get_criticalr� rp r r r � get_critical� r� zX509Extension.get_criticalc C s8 t �| j�}t �|�}t �|�}|tjkrt�|�S dS )z� Returns the short type name of this X.509 extension. The result is a byte string such as :py:const:`b"basicConstraints"`. :return: The short type name. :rtype: :py:data:`bytes` .. versionadded:: 0.12 s UNDEF)rM r r� r� r� rQ rU rj )rq �objr� �bufr r r �get_short_name� s z X509Extension.get_short_namec C s@ t �| j�}t�d|�}t �|�}t �|�}t�||�dd� S )z� Returns the data of the X509 extension, encoded as ASN.1. :return: The ASN.1 encoded data of this X509 extension. :rtype: :py:data:`bytes` .. versionadded:: 0.12 rg N)rM ZX509_EXTENSION_get_datar� rQ rh rk ri rH )rq Z octet_resultrl Z char_result� result_lengthr r r �get_data� s zX509Extension.get_data�NN) r� rY r� r� r� rY r� r� r� r� r r^ r� r� r� r� )rD rE rF rG rr �propertyr� rM Z GEN_EMAILZGEN_DNSZGEN_URIr �__annotations__r r r r r r r r r r0 s �E � r0 zPCSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c @ s� e Zd ZdZd*dd�Zd+dd�Zed,d d ��Zd-dd�Zd.dd�Z d/dd�Z d0dd�Z d1dd�Z d2d d �Z d3d d!�Zd4d$d%�Zd5d'd(�Zd)S )6r2 z� An X.509 certificate signing requests. .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. r r^ c C s& t �� }t�|t j�| _| �d� d S r� )rM Z X509_REQ_newrQ rV � X509_REQ_free�_req� set_version)rq �reqr r r rr � s zX509Req.__init__� x509.CertificateSigningRequestc C � ddl m} tt| �}||�S )z� Export as a ``cryptography`` certificate signing request. :rtype: ``cryptography.x509.CertificateSigningRequest`` .. versionadded:: 17.1.0 r )�load_der_x509_csr)�cryptography.x509r �"_dump_certificate_request_internalr( )rq r r� r r r �to_cryptography� s zX509Req.to_cryptography� crypto_reqc C �6 t |tj�s td��ddlm} |�|j�}tt |�S )a Construct based on a ``cryptography`` *crypto_req*. :param crypto_req: A ``cryptography`` X.509 certificate signing request :type crypto_req: ``cryptography.x509.CertificateSigningRequest`` :rtype: X509Req .. versionadded:: 17.1.0 z%Must be a certificate signing requestr �r� ) r_ r ZCertificateSigningRequestr` r� r� r� r� �"_load_certificate_request_internalr( )r� r r� r� r r r �from_cryptography� s zX509Req.from_cryptographyr r/ c C s t �| j|j�}t|dk� dS )z� Set the public key of the certificate signing request. :param pkey: The public key to use. :type pkey: :py:class:`PKey` :return: ``None`` r� N)rM ZX509_REQ_set_pubkeyr r| rT �rq r rb r r r � set_pubkey� s zX509Req.set_pubkeyc C sD t �t �}t�| j�|_t|jtjk� t� |jtj �|_d|_ |S )z� Get the public key of the certificate signing request. :return: The public key. :rtype: :py:class:`PKey` T) r/ �__new__rM ZX509_REQ_get_pubkeyr r| rT rQ rU rV r{ r� r~ r r r � get_pubkey� s zX509Req.get_pubkey�versionrA c C s@ t |t�s td��|dkrtd��t�| j|�}t|dk� dS )z� Set the version subfield (RFC 2986, section 4.1) of the certificate request. :param int version: The version number. :return: ``None`` zversion must be an intr z9Invalid version. The only valid version for X509Req is 0.r� N)r_ rA r` ra rM ZX509_REQ_set_versionr rT )rq r) rb r r r r s �zX509Req.set_versionc C r� )z� Get the version subfield (RFC 2459, section 4.1.2.1) of the certificate request. :return: The value of the version subfield. :rtype: :py:class:`int` )rM ZX509_REQ_get_versionr rp r r r � get_version s zX509Req.get_versionr1 c C s2 t �t �}t�| j�|_t|jtjk� | |_ |S )a� Return the subject of this certificate signing request. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate signing request. Modifying it will modify the underlying signing request, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate signing request. :rtype: :class:`X509Name` ) r1 r' rM ZX509_REQ_get_subject_namer rw rT rQ rU �_ownerru r r r � get_subject& s zX509Req.get_subject� extensions�Iterable[X509Extension]c C s| t jdtdd� t�� }t|tjk� t�|tj �}|D ]}t |t �s't d��t� ||j� q t�| j|�}t|dk� dS )z� Add extensions to the certificate signing request. :param extensions: The X.509 extensions to add. :type extensions: iterable of :py:class:`X509Extension` :return: ``None`` ��This API is deprecated and will be removed in a future version of pyOpenSSL. You should use pyca/cryptography's X.509 APIs instead.� �� stacklevel�+One of the elements is not an X509Extensionr� N)�warnings�warn�DeprecationWarningrM Zsk_X509_EXTENSION_new_nullrT rQ rU rV Zsk_X509_EXTENSION_freer_ r0 ra Zsk_X509_EXTENSION_pushr� ZX509_REQ_add_extensionsr )rq r- �stack�extr� r r r �add_extensions< s � zX509Req.add_extensions�list[X509Extension]c C s~ t jdtdd� g }t�| j�}t�|dd� �}tt� |��D ] }t � t �}t� t� ||��}t�|tj�|_|�|� q |S )z� Get X.509 extensions in the certificate signing request. :return: The X.509 extensions in this request. :rtype: :py:class:`list` of :py:class:`X509Extension` objects. .. versionadded:: 0.15 r/ r0 r1 c S s t �| t�t jd��S )Nr� )rM Zsk_X509_EXTENSION_pop_freerQ � addressofZ _original_lib)�xr r r r t s �z(X509Req.get_extensions.<locals>.<lambda>)r4 r5 r6 rM ZX509_REQ_get_extensionsr rQ rV r� Zsk_X509_EXTENSION_numr0 r' �X509_EXTENSION_dupZsk_X509_EXTENSION_valuer� r� rt )rq ZextsZnative_exts_objr� r8 r r r r �get_extensions] s& � � � zX509Req.get_extensions�digestr c C s^ |j rtd��|jstd��t�t|��}|tjkr td��t�| j |j |�}t |dk� dS )aa Sign the certificate signing request with this key and digest type. :param pkey: The key pair to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use for the signature, e.g. :py:data:`"sha256"`. :type digest: :py:class:`str` :return: ``None`` zKey has only public part�Key is uninitialized�No such digest methodr N) r� ra r} rM �EVP_get_digestbynamer� rQ rU Z X509_REQ_signr r| rT )rq r r? Z digest_obj� sign_resultr r r �sign� s z X509Req.signr� c C s4 t |t�s td��t�| j|j�}|dkrt� |S )a@ Verifies the signature on this certificate signing request. :param PKey key: A public key. :return: ``True`` if the signature is correct. :rtype: bool :raises OpenSSL.crypto.Error: If the signature is invalid or there is a problem verifying the signature. � pkey must be a PKey instancer )r_ r/ r` rM ZX509_REQ_verifyr r| r� )rq r r� r r r �verify� s zX509Req.verifyNry )r r )r r r r2 �r r/ r r^ �r r/ �r) rA r r^ r� �r r1 �r- r. r r^ )r r: �r r/ r? r r r^ )r r/ r r� )rD rE rF rG rr r r� r$ r& r( r r* r, r9 r> rD rF r r r r r2 � s ! &r2 c @ sX e Zd ZdZd`dd�Zedadd ��Zdbd d �Zedcdd��Zdddd�Z dedd�Z dfdd�Z dgdd�Z dhd d �Z did!d"�Zdjd$d%�Zded&d'�Zdkd)d*�Zded+d,�Zdld.d/�Zdld0d1�Zdmd3d4�Zdnd7d8�Zdod9d:�Zdpd=d>�Zdqd?d@�ZdodAdB�ZdqdCdD�ZdrdFdG�Z dsdIdJ�Z dtdKdL�Z dudNdO�Z dtdPdQ�Z dvdSdT�Z!dedUdV�Z"dwdYdZ�Z#dxd]d^�Z$d_S )yr- z An X.509 certificate. r r^ c C s: t �� }t|tjk� t�|t j�| _t� | _ t� | _ d S r ) rM ZX509_newrT rQ rU rV � X509_freer� rn �_issuer_invalidator�_subject_invalidator)rq r r r r rr � s z X509.__init__r r c C s. | � | �}t�|tj�|_t� |_t� |_|S r ) r' rQ rV rM rM r� rn rN rO )r� r �certr r r �_from_raw_x509_ptr� s zX509._from_raw_x509_ptr�x509.Certificatec C r )z� Export as a ``cryptography`` certificate. :rtype: ``cryptography.x509.Certificate`` .. versionadded:: 17.1.0 r )�load_der_x509_certificate)r rS r7 r( )rq rS r� r r r r � s zX509.to_cryptography� crypto_certc C r! )z� Construct based on a ``cryptography`` *crypto_cert*. :param crypto_key: A ``cryptography`` X.509 certificate. :type crypto_key: ``cryptography.x509.Certificate`` :rtype: X509 .. versionadded:: 17.1.0 zMust be a certificater r" ) r_ r � Certificater` r� r� r� r� r= r( )r� rT r� r� r r r r$ � s zX509.from_cryptographyr) rA c C s, t |t�s td��tt�| j|�dk� dS )a Set the version number of the certificate. Note that the version value is zero-based, eg. a value of 0 is V1. :param version: The version number of the certificate. :type version: :py:class:`int` :return: ``None`` zversion must be an integerr� N)r_ rA r` rT rM ZX509_set_versionr� )rq r) r r r r � s zX509.set_versionc C r� )z� Return the version number of the certificate. :return: The version number of the certificate. :rtype: :py:class:`int` )rM ZX509_get_versionr� rp r r r r* � � zX509.get_versionr/ c C sF t �t �}t�| j�|_|jtjkrt� t� |jtj �|_d|_ |S )z{ Get the public key of the certificate. :return: The public key. :rtype: :py:class:`PKey` T) r/ r' rM ZX509_get_pubkeyr� r| rQ rU r� rV r{ r� r~ r r r r( � s zX509.get_pubkeyr c C s2 t |t�s td��t�| j|j�}t|dk� dS )z� Set the public key of the certificate. :param pkey: The public key. :type pkey: :py:class:`PKey` :return: :py:data:`None` rE r� N)r_ r/ r` rM ZX509_set_pubkeyr� r| rT r% r r r r& s zX509.set_pubkeyr? r c C sp t |t�s td��|jrtd��|jstd��t�t|��}|t j kr'td��t� | j |j |�}t|dk� dS )a Sign the certificate with this key and digest type. :param pkey: The key to sign with. :type pkey: :py:class:`PKey` :param digest: The name of the message digest to use. :type digest: :py:class:`str` :return: :py:data:`None` rE zKey only has public partr@ rA r N)r_ r/ r` r� ra r} rM rB r� rQ rU Z X509_signr� r| rT )rq r r? Zevp_mdrC r r r rD s z X509.signrY c C sZ t �| j�}t�d�}t �|tjtj|� t �|d �}|t jkr%t d��t� t � |��S )z� Return the signature algorithm used in the certificate. :return: The name of the algorithm. :rtype: :py:class:`bytes` :raises ValueError: If the signature algorithm is undefined. .. versionadded:: 0.13 zASN1_OBJECT **r z Undefined signature algorithm) rM ZX509_get0_tbs_sigalgr� rQ rR ZX509_ALGOR_get0rU r� r� ra rj Z OBJ_nid2ln)rq Zsig_algZalgr� r r r �get_signature_algorithm9 s z X509.get_signature_algorithm� digest_namec C s� t �t|��}|tjkrtd��t�dt j�}t�dd�}t|�|d< t � | j |||�}t |dk� d� dd� t� ||d �D ��S ) a5 Return the digest of the X509 object. :param digest_name: The name of the digest algorithm to use. :type digest_name: :py:class:`str` :return: The digest of the object, formatted as :py:const:`b":"`-delimited hex pairs. :rtype: :py:class:`bytes` rA zunsigned char[]zunsigned int[]r� r � :c S s g | ]}t |��� �qS r )r �upper)r� �chr r r � <listcomp>e s ��z X509.digest.<locals>.<listcomp>)rM rB r� rQ rU ra rR ZEVP_MAX_MD_SIZErS Z X509_digestr� rT r rH )rq rX r? rZ r Z digest_resultr r r r? L s � ��z X509.digestc C r� )z� Return the hash of the X509 subject. :return: The hash of the subject. :rtype: :py:class:`int` )rM ZX509_subject_name_hashr� rp r r r �subject_name_hashk rV zX509.subject_name_hash�serialc C s� t |t�s td��t|�dd� }|�d�}t�d�}t�||�}t |tj k� t� |d tj �}t� |d � t |tj k� t� |tj�}t�| j|�}t |dk� dS )z� Set the serial number of the certificate. :param serial: The new serial number. :type serial: :py:class:`int` :return: :py:data`None` zserial must be an integerr0 Nr� zBIGNUM**r r� )r_ rA r` �hexr� rQ rR rM Z BN_hex2bnrT rU ZBN_to_ASN1_INTEGERr� rV ZASN1_INTEGER_freeZX509_set_serialNumberr� )rq r^ � hex_serialZhex_serial_bytes� bignum_serialr� � asn1_serialrb r r r �set_serial_numbert s zX509.set_serial_numberc C sp t �| j�}t �|tj�}z$t �|�}zt�|�}t|d�}|W t � |� W t � |� S t � |� w t � |� w )zx Return the serial number of this certificate. :return: The serial number. :rtype: int � ) rM ZX509_get_serialNumberr� ZASN1_INTEGER_to_BNrQ rU Z BN_bn2hexrj rA r� r� )rq rb ra r` Zhexstring_serialr^ r r r �get_serial_number� s � zX509.get_serial_number�amountc C �. t |t�s td��t�| j�}t�||� dS )z� Adjust the time stamp on which the certificate stops being valid. :param int amount: The number of seconds by which to adjust the timestamp. :return: ``None`` �amount must be an integerN)r_ rA r` rM �X509_getm_notAfterr� �X509_gmtime_adj)rq rf ZnotAfterr r r �gmtime_adj_notAfter� s zX509.gmtime_adj_notAfterc C rg )z� Adjust the timestamp on which the certificate starts being valid. :param amount: The number of seconds by which to adjust the timestamp. :return: ``None`` rh N)r_ rA r` rM �X509_getm_notBeforer� rj )rq rf Z notBeforer r r �gmtime_adj_notBefore� s zX509.gmtime_adj_notBeforer� c C sT | � � }|du r td��|�d�}tj�|d�}tjj}tj�|�jdd�}||k S )z� Check whether the certificate has expired. :return: ``True`` if the certificate has expired, ``False`` otherwise. :rtype: bool Nz Unable to determine notAfterr� z %Y%m%d%H%M%SZ)�tzinfo) � get_notAfterra r� �datetime�strptime�timezone�utc�now�replace)rq Z time_bytesZ time_stringZ not_after�UTC�utcnowr r r � has_expired� s zX509.has_expired�whichrI c C s t || j��S r )rm r� )rq ry r r r �_get_boundary_time� r� zX509._get_boundary_timec C � | � tj�S )a Get the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType )rz rM rl rp r r r � get_notBefore� � zX509.get_notBefore�Callable[..., Any]r] c C s t || j�|�S r )rc r� )rq ry r] r r r �_set_boundary_time� s zX509._set_boundary_timec C � | � tj|�S )z� Set the timestamp at which the certificate starts being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` )r rM rl �rq r] r r r � set_notBefore� � zX509.set_notBeforec C r{ )a Get the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :return: A timestamp string, or ``None`` if there is none. :rtype: bytes or NoneType )rz rM ri rp r r r ro � r} zX509.get_notAfterc C r� )z� Set the timestamp at which the certificate stops being valid. The timestamp is formatted as an ASN.1 TIME:: YYYYMMDDhhmmssZ :param bytes when: A timestamp string. :return: ``None`` )r rM ri r� r r r � set_notAfter� r� zX509.set_notAfterr1 c C s0 t �t �}|| j�|_t|jtjk� | |_|S r )r1 r' r� rw rT rQ rU r+ )rq ry rs r r r � _get_name s zX509._get_namers c C s0 t |t�s td��|| j|j�}t|dk� d S )Nzname must be an X509Namer� )r_ r1 r` r� rw rT )rq ry rs rb r r r � _set_name s zX509._set_namec C � | � tj�}| j�|� |S )a� Return the issuer of this certificate. This creates a new :class:`X509Name` that wraps the underlying issuer name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this issuer. :return: The issuer of this certificate. :rtype: :class:`X509Name` )r� rM ZX509_get_issuer_namerN rv ru r r r � get_issuer � zX509.get_issuerr� c C � | � tj|� | j�� dS )z� Set the issuer of this certificate. :param issuer: The issuer. :type issuer: :py:class:`X509Name` :return: ``None`` N)r� rM ZX509_set_issuer_namerN rx )rq r� r r r � set_issuer- � zX509.set_issuerc C r� )a� Return the subject of this certificate. This creates a new :class:`X509Name` that wraps the underlying subject name field on the certificate. Modifying it will modify the underlying certificate, and will have the effect of modifying any other :class:`X509Name` that refers to this subject. :return: The subject of this certificate. :rtype: :class:`X509Name` )r� rM ZX509_get_subject_namerO rv ru r r r r, 9 r� zX509.get_subjectr� c C r� )z� Set the subject of this certificate. :param subject: The subject. :type subject: :py:class:`X509Name` :return: ``None`` N)r� rM ZX509_set_subject_namerO rx )rq r� r r r � set_subjectI r� zX509.set_subjectc C r� )z� Get the number of extensions on this certificate. :return: The number of extensions. :rtype: :py:class:`int` .. versionadded:: 0.12 )rM ZX509_get_ext_countr� rp r r r �get_extension_countU s zX509.get_extension_countr- r. c C sN t jdtdd� |D ]}t|t�std��t�| j|j d�}t |dk� q dS )z� Add extensions to the certificate. :param extensions: The extensions to add. :type extensions: An iterable of :py:class:`X509Extension` objects. :return: ``None`` r/ r0 r1 r3 r� r� N) r4 r5 r6 r_ r0 ra rM Z X509_add_extr� r� rT )rq r- r8 r� r r r r9 ` s � �zX509.add_extensions�indexr0 c C s^ t jdtdd� t�t�}t�| j|�|_|jt j kr t d��t� |j�}t � |tj�|_|S )a� Get a specific extension of the certificate by index. Extensions on a certificate are kept in order. The index parameter selects which extension will be returned. :param int index: The index of the extension to retrieve. :return: The extension at the specified index. :rtype: :py:class:`X509Extension` :raises IndexError: If the extension index was out of bounds. .. versionadded:: 0.12 r/ r0 r1 z extension index out of bounds)r4 r5 r6 r0 r' rM Z X509_get_extr� r� rQ rU � IndexErrorr= rV r� )rq r� r8 r r r r � get_extensiony s � zX509.get_extensionNry )r r r r- )r rR )rT rR r r- rI r� rH rG rL r� )rX r r rY )r^ rA r r^ )rf rA r r^ r� )ry r r rI )r rI )ry r~ r] rY r r^ )r] rY r r^ )ry r r r1 )ry r rs r1 r r^ rJ )r� r1 r r^ )r� r1 r r^ rK )r� rA r r0 )%rD rE rF rG rr r� rQ r r$ r r* r( r& rD rW r? r] rc re rk rm rx rz r| r r� ro r� r� r� r� r� r, r� r� r9 r� r r r r r- � sH r- c @ s� e Zd ZU dZejZded< ejZ ded< ej Z ded< ej Z ded< ejZded< ejZded< ejZded < ejZded < ejZded < ejZded < d S )r6 a Flags for X509 verification, used to change the behavior of :class:`X509Store`. See `OpenSSL Verification Flags`_ for details. .. _OpenSSL Verification Flags: https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html rA � CRL_CHECK� CRL_CHECK_ALL�IGNORE_CRITICAL� X509_STRICT�ALLOW_PROXY_CERTS� POLICY_CHECK�EXPLICIT_POLICY� INHIBIT_MAP�CHECK_SS_SIGNATURE� PARTIAL_CHAINN)rD rE rF rG rM ZX509_V_FLAG_CRL_CHECKr� r ZX509_V_FLAG_CRL_CHECK_ALLr� ZX509_V_FLAG_IGNORE_CRITICALr� ZX509_V_FLAG_X509_STRICTr� Z X509_V_FLAG_ALLOW_PROXY_CERTSr� ZX509_V_FLAG_POLICY_CHECKr� ZX509_V_FLAG_EXPLICIT_POLICYr� ZX509_V_FLAG_INHIBIT_MAPr� Z X509_V_FLAG_CHECK_SS_SIGNATUREr� ZX509_V_FLAG_PARTIAL_CHAINr� r r r r r6 � s r6 c @ sP e Zd ZdZd dd�Zd dd �Zd d d �Zd dd�Zd dd�Z d!d"dd�Z dS )#r3 a� An X.509 store. An X.509 store is used to describe a context in which to verify a certificate. A description of a context may include a set of certificates to trust, a set of certificate revocation lists, verification flags and more. An X.509 store, being only a description, cannot be used by itself to verify a certificate. To carry out the actual verification process, see :class:`X509StoreContext`. r r^ c C s t �� }t�|t j�| _d S r )rM ZX509_STORE_newrQ rV ZX509_STORE_free�_store�rq �storer r r rr � s zX509Store.__init__rP r- c C s0 t |t�st� �t�| j|j�}t|dk� dS )a� Adds a trusted certificate to this store. Adding a certificate with this method adds this certificate as a *trusted* certificate. :param X509 cert: The certificate to add to this store. :raises TypeError: If the certificate is not an :class:`X509`. :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your certificate. :return: ``None`` if the certificate was added successfully. r� N)r_ r- r` rM ZX509_STORE_add_certr� r� rT )rq rP r� r r r �add_cert� s zX509Store.add_cert�crl� x509.CertificateRevocationListc C sv t |tj�r*ddlm} t|�|j��}t� |t j �}t |t j k� t � |tj�}ntd��t t�| j|�dk� dS )a� Add a certificate revocation list to this store. The certificate revocation lists added to a store will only be used if the associated flags are configured to check certificate revocation lists. .. versionadded:: 16.1.0 :param crl: The certificate revocation list to add to this store. :type crl: ``cryptography.x509.CertificateRevocationList`` :return: ``None`` if the certificate revocation list was added successfully. r r" z?CRL must be of type cryptography.x509.CertificateRevocationListN)r_ r ZCertificateRevocationListr� r� rX r� r� rM Zd2i_X509_CRL_biorQ rU rT rV Z X509_CRL_freer` ZX509_STORE_add_crlr� )rq r� r� rK Z openssl_crlr r r �add_crl� s �zX509Store.add_crl�flagsrA c C s t t�| j|�dk� dS )a� Set verification flags to this store. Verification flags can be combined by oring them together. .. note:: Setting a verification flag sometimes requires clients to add additional information to the store, otherwise a suitable error will be raised. For example, in setting flags to enable CRL checking a suitable CRL must be added to the store otherwise an error will be raised. .. versionadded:: 16.1.0 :param int flags: The verification flags to set on this store. See :class:`X509StoreFlags` for available constants. :return: ``None`` if the verification flags were successfully set. r N)rT rM ZX509_STORE_set_flagsr� )rq r� r r r � set_flags� s zX509Store.set_flags�vfy_time�datetime.datetimec C sF t �� }t�|t j�}t �|t�|�� �� t t � | j |�dk� dS )a� Set the time against which the certificates are verified. Normally the current time is used. .. note:: For example, you can determine if a certificate was valid at a given time. .. versionadded:: 17.0.0 :param datetime vfy_time: The verification time to set on this store. :return: ``None`` if the verification time was successfully set. r N) rM ZX509_VERIFY_PARAM_newrQ rV ZX509_VERIFY_PARAM_freeZX509_VERIFY_PARAM_set_time�calendar�timegm� timetuplerT ZX509_STORE_set1_paramr� )rq r� �paramr r r �set_time s �zX509Store.set_timeN�cafile�StrOrBytesPath | None�capathc C sR |du rt j}nt|�}|du rt j}nt|�}t�| j||�}|s't� dS dS )a� Let X509Store know where we can find trusted certificates for the certificate chain. Note that the certificates have to be in PEM format. If *capath* is passed, it must be a directory prepared using the ``c_rehash`` tool included with OpenSSL. Either, but not both, of *cafile* or *capath* may be ``None``. .. note:: Both *cafile* and *capath* may be set simultaneously. Call this method multiple times to add more than one location. For example, CA certificates, and certificate revocation list bundles may be passed in *cafile* in subsequent calls to this method. .. versionadded:: 20.0 :param cafile: In which file we can find the certificates (``bytes`` or ``unicode``). :param capath: In which directory we can find the certificates (``bytes`` or ``unicode``). :return: ``None`` if the locations were set successfully. :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None`` or the locations could not be set for any reason. N)rQ rU � _path_bytesrM ZX509_STORE_load_locationsr� r� )rq r� r� Z load_resultr r r �load_locations( s #� �zX509Store.load_locationsry )rP r- r r^ )r� r� r r^ )r� rA r r^ )r� r� r r^ r )r� r� r� r� r r^ ) rD rE rF rG rr r� r� r� r� r� r r r r r3 � s �r3 c s" e Zd ZdZd � fd d � Z� ZS ) r5 z� An exception raised when an error occurred while verifying a certificate using `OpenSSL.X509StoreContext.verify_certificate`. :ivar certificate: The certificate which caused verificate failure. :type certificate: :class:`X509` �messager �errors� list[Any]� certificater- r r^ c s t � �|� || _|| _d S r )r� rr r� r� )rq r� r� r� r� r r rr e s z X509StoreContextError.__init__)r� r r� r� r� r- r r^ )rD rE rF rG rr r� r r r� r r5 \ s r5 c @ sb e Zd ZdZ d d d d �Zed dd��Zed!dd��Zd"dd�Zd#dd�Z d$dd�Z d%d d �Z dS )&r4 a9 An X.509 store context. An X.509 store context is used to carry out the actual verification process of a certificate in a described context. For describing such a context, see :class:`X509Store`. :param X509Store store: The certificates which will be trusted for the purposes of any verifications. :param X509 certificate: The certificate to be verified. :param chain: List of untrusted certificates that may be used for building the certificate chain. May be ``None``. :type chain: :class:`list` of :class:`X509` Nr� r3 r� r- �chain�Sequence[X509] | Noner r^ c C s || _ || _| �|�| _d S r )r� �_cert�_build_certificate_stack�_chain)rq r� r� r� r r r rr } s zX509StoreContext.__init__� certificatesc C s� d dd�}| d u st | �dkrtjS t�� }t|tjk� t�||�}| D ]'}t|t�s0t d��tt� |j �dk� t� ||j �dkrLt� |j � t� q%|S ) N�sr r r^ c S s8 t t�| ��D ] }t�| |�}t�|� qt�| � d S r )r� rM � sk_X509_num� sk_X509_valuerM � sk_X509_free)r� r� r< r r r �cleanup� s z:X509StoreContext._build_certificate_stack.<locals>.cleanupr z+One of the elements is not an X509 instance)r� r r r^ )rS rQ rU rM Zsk_X509_new_nullrT rV r_ r- r` Z X509_up_refr� Z sk_X509_pushrM r� )r� r� r7 rP r r r r� � s �z)X509StoreContext._build_certificate_stack� store_ctxr r5 c C s\ t �t�t�| ����d�}t�| �t�| �|g}t�| �}t�|�}t � |�}t |||�S )z� Convert an OpenSSL native context error failure into a Python exception. When a call to native OpenSSL X509_verify_cert fails, additional information about the failure can be obtained from the store context. r� ) rQ rj rM Z X509_verify_cert_error_stringZX509_STORE_CTX_get_errorr� Z X509_STORE_CTX_get_error_depthZ X509_STORE_CTX_get_current_certZX509_dupr- rQ r5 )r� r� r� r� r� �pycertr r r �_exception_from_context� s ���� z(X509StoreContext._exception_from_contextc C sj t �� }t|tjk� t�|t j�}t �|| jj| j j | j �}t|dk� t � |�}|dkr3| � |��|S )a3 Verifies the certificate and runs an X509_STORE_CTX containing the results. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. r� r )rM ZX509_STORE_CTX_newrT rQ rU rV ZX509_STORE_CTX_freeZX509_STORE_CTX_initr� r� r� r� ZX509_verify_certr� )rq r� rd r r r �_verify_certificate� s � z$X509StoreContext._verify_certificatec C s || _ dS )z� Set the context's X.509 store. .. versionadded:: 0.15 :param X509Store store: The store description which will be used for the purposes of any *future* verifications. N)r� r� r r r � set_store� s zX509StoreContext.set_storec C s | � � dS )a" Verify a certificate in a context. .. versionadded:: 0.15 :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. N)r� rp r r r �verify_certificate� r� z#X509StoreContext.verify_certificate� list[X509]c C st | � � }t�|�}t|tjk� g }tt�|��D ]}t�||�}t|tjk� t � |�}|� |� qt� |� |S )aR Verify a certificate in a context and return the complete validated chain. :raises X509StoreContextError: If an error occurred when validating a certificate in the context. Sets ``certificate`` attribute to indicate which certificate caused the error. .. versionadded:: 20.0 ) r� rM ZX509_STORE_CTX_get1_chainrT rQ rU r� r� r� r- rQ rt r� )rq r� Z cert_stackr� r� rP r� r r r �get_verified_chain� s z#X509StoreContext.get_verified_chainr )r� r3 r� r- r� r� r r^ )r� r� r r^ )r� r r r5 r� )r� r3 r r^ ry )r r� ) rD rE rF rG rr � staticmethodr� r� r� r� r� r� r r r r r4 m s � r4 r� c C sv t |t�r |�d�}t|�}| tkr t�|tjtjtj�}n| t kr*t� |tj�}nt d��|tjkr6t � t �|�S )a Load a certificate (X509) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param bytes buffer: The buffer the certificate is stored in :return: The X509 object r� �3type argument must be FILETYPE_PEM or FILETYPE_ASN1)r_ r r� rX r) rM ZPEM_read_bio_X509rQ rU r( Z d2i_X509_biora r� r- rQ )r� rH rK r r r r r= s r= rP c C sn t � }| tkrt�||j�}n | tkrt�||j�}n| tkr)t�||jdd�}nt d��t |dk� t |�S )a Dump the certificate *cert* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXT) :param cert: The certificate to dump :return: The buffer with the dumped certificate in r �Ctype argument must be FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXTr� ) rX r) rM ZPEM_write_bio_X509r� r( Z i2d_X509_bior* Z X509_print_exra rT r[ )r� rP rK � result_coder r r r7 ( s � r7 r c C sP t � }| tkr tj}n | tkrtj}ntd��|||j�}|dkr$t� t |�S )z� Dump a public key to a buffer. :param type: The file type (one of :data:`FILETYPE_PEM` or :data:`FILETYPE_ASN1`). :param PKey pkey: The public key to dump :return: The buffer with the dumped key in it. :rtype: bytes r� r� ) rX r) rM ZPEM_write_bio_PUBKEYr( Zi2d_PUBKEY_biora r| r� r[ )r� r rK Z write_bior� r r r r: D s r: �cipherr� � passphrase�PassphraseCallableT | Nonec C s t � }t|t�s td��|dur)|du rtd��t�t|��}|tjkr(t d��ntj}t | |�}| t krIt� ||j |tjd|j|j�}|�� n4| tkrUt�||j �}n(| tkryt�|j �tjkrftd��t�t�|j �tj�}t�||d�}nt d��t|dk� t|�S )a� Dump the private key *pkey* into a buffer string encoded with the type *type*. Optionally (if *type* is :const:`FILETYPE_PEM`) encrypting it using *cipher* and *passphrase*. :param type: The file type (one of :const:`FILETYPE_PEM`, :const:`FILETYPE_ASN1`, or :const:`FILETYPE_TEXT`) :param PKey pkey: The PKey to dump :param cipher: (optional) if encrypted PEM format, the cipher to use :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The buffer with the dumped key in :rtype: bytes zpkey must be a PKeyNzDif a value is given for cipher one must also be given for passphrasezInvalid cipher namer z-Only RSA keys are supported for FILETYPE_TEXTr� ) rX r_ r/ r` rM ZEVP_get_cipherbynamer� rQ rU ra �_PassphraseHelperr) ZPEM_write_bio_PrivateKeyr| �callback� callback_args�raise_if_problemr( Zi2d_PrivateKey_bior* r� r� rV r� r� Z RSA_printrT r[ ) r� r r� r� rK Z cipher_obj�helperr� r r r r r9 ] sJ � � � � r9 c @ sP e Zd Z d d d d �Zed dd��Zed dd��Zefd dd�Zd!dd�Z d S )"r� Fr� rA r� r� � more_argsr� �truncater r^ c C s4 |t kr |d ur td��|| _|| _|| _g | _d S )Nz0only FILETYPE_PEM key format supports encryption)r) ra � _passphrase� _more_args� _truncate� _problems)rq r� r� r� r� r r r rr � s � z_PassphraseHelper.__init__r c C s< | j d u rtjS t| j t�st| j �rt�d| j�S td��)NZpem_password_cb�2Last argument must be a byte string or a callable.) r� rQ rU r_ rY �callabler� �_read_passphraser` rp r r r r� � s �z_PassphraseHelper.callbackc C s4 | j d u rtjS t| j t�st| j �rtjS td��)Nr� )r� rQ rU r_ rY r� r` rp r r r r� � s �z _PassphraseHelper.callback_args� exceptionType�type[Exception]c C s6 | j rzt|� W n |y Y nw | j �d��d S r� )r� �_exception_from_error_queue�pop)rq r� r r r r� � s � �z"_PassphraseHelper.raise_if_problemr �size�rwflag�userdatac C s� zUt | j�r| jr| �|||�}n| �|�}n | jd us J �| j}t|t�s*td��t|�|kr>| jr:|d |� }ntd��tt|��D ] }|||d � ||< qDt|�W S t yn } z | j � |� W Y d }~dS d }~ww )NzBytes expectedz+passphrase returned by callback is too longr� r ) r� r� r� r_ rY ra rS r� r� � Exceptionr� rt )rq r r� r� r� r� r� �er r r r� � s. � ��z"_PassphraseHelper._read_passphraseN)FF) r� rA r� r� r� r� r� r� r r^ r� )r� r� r r^ ) r r r� rA r� r r� r r rA ) rD rE rF rr r r� r� r. r� r� r r r r r� � s � r� � str | bytesc C s� t |t�r |�d�}t|�}| tkr t�|tjtjtj�}n| t kr*t� |tj�}nt d��|tjkr6t � t �t �}t�|tj�|_d|_|S )a< Load a public key from a buffer. :param type: The file type (one of :data:`FILETYPE_PEM`, :data:`FILETYPE_ASN1`). :param buffer: The buffer the key is stored in. :type buffer: A Python string object, either unicode or bytestring. :return: The PKey object. :rtype: :class:`PKey` r� r� T)r_ r r� rX r) rM ZPEM_read_bio_PUBKEYrQ rU r( Zd2i_PUBKEY_biora r� r/ r' rV r{ r| r� )r� rH rK �evp_pkeyr r r r r@ � s � r@ c C s� t |t�r |�d�}t|�}t| |�}| tkr't�|tj |j |j �}|� � n| t kr3t�|tj �}ntd��|tj kr?t� t�t�}t�|tj�|_|S )a� Load a private key (PKey) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the key is stored in :param passphrase: (optional) if encrypted PEM format, this can be either the passphrase to use, or a callback for providing the passphrase. :return: The PKey object r� r� )r_ r r� rX r� r) rM ZPEM_read_bio_PrivateKeyrQ rU r� r� r� r( Zd2i_PrivateKey_biora r� r/ r' rV r{ r| )r� rH r� rK r� r� r r r r r? s" � r? r c C sn t � }| tkrt�||j�}n | tkrt�||j�}n| tkr)t�||jdd�}nt d��t |dk� t |�S )av Dump the certificate request *req* into a buffer string encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param req: The certificate request to dump :return: The buffer with the dumped certificate request in .. deprecated:: 24.2.0 Use `cryptography.x509.CertificateSigningRequest` instead. r r� ) rX r) rM ZPEM_write_bio_X509_REQr r( Zi2d_X509_REQ_bior* ZX509_REQ_print_exra rT r[ )r� r rK r� r r r r8 ; s � r8 r� c C s� t |t�r |�d�}t|�}| tkr t�|tjtjtj�}n| t kr*t� |tj�}nt d��t |tjk� t �t �}t�|tj�|_|S )a� Load a certificate request (X509Req) from the string *buffer* encoded with the type *type*. :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1) :param buffer: The buffer the certificate request is stored in :return: The X509Req object .. deprecated:: 24.2.0 Use `cryptography.x509.load_der_x509_csr` or `cryptography.x509.load_pem_x509_csr` instead. r� r� )r_ r r� rX r) rM ZPEM_read_bio_X509_REQrQ rU r( Zd2i_X509_REQ_biora rT r2 r' rV r r )r� rH rK r Zx509reqr r r r> i s r> )r r r r r r r )rH rI r r )rK r r rY )r\ r r] rY r r^ )r] rY r r )rf r r rI )r r� )rs r r r� )r� rA rH rY r r- )r� rA rP r- r rY )r� rA r r/ r rY r ) r� rA r r/ r� r� r� r� r rY )r� rA rH r� r r/ )r� rA rH r� r� r� r r/ )r� rA r r2 r rY )r� rA rH rY r r2 )o� __future__r r� rp � functools�sysr� r4 �base64r �collections.abcr r r r r r � version_infor �TypeVarZ_TZtyping_extensionsZ cryptographyr r Z)cryptography.hazmat.primitives.asymmetricr r r r r Z OpenSSL._utilr! r" r� r# r� r$ rQ r% rM r& Z _make_assertr' r� �__all__r� r� r� r� r� Z _PrivateKeyr� r� r� r� r� Z _PublicKeyr� rY ZPassphraseCallableTZSSL_FILETYPE_PEMr) r ZSSL_FILETYPE_ASN1r( r* r� r, Z EVP_PKEY_DSAr+ Z EVP_PKEY_DHrB Z EVP_PKEY_ECrC r� r. r� rT rX r[ rc re rm rn r/ r� r< r; �total_orderingr1 r0 r2 r- r6 r3 r5 r4 r= r7 r: r9 r� r@ r? r8 r rD r6 r> r# r r r r �<module> s� ���� Bg� � C� -� s m + �E N% � ) � �
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings