o
    )%a}                     @   s  d dl Z d dlZd dlmZ d dlmZmZmZmZ d dl	m
Z
 d dlmZ d dlmZmZmZmZ dd Zd	d
 Zdd Zdd Zdd Zdd Zdd Zdd ZG dd deZdd Zdd Zdd Zdd  Zd!d" Z d#d$ Z!d%d& Z"d'd( Z#d)d* Z$d+d, Z%d-d. Z&d/d0 Z'd1d2 Z(d3d4 Z)d5d6 Z*d7d8 Z+d9d: Z,d Z-d;Z.d<d= Z/ej0j1ej0j2ej0j3ej0j4ej0j5ej0j6ej0j7ej0j8d>Z9d?d@ Z:dAdB Z;dCdD Z<dEdF Z=dGdH Z>dIdJ Z?dKdL Z@dMdN ZAej0jBej0j1ej0j2ej0j3ej0j4ej0j5ej0j6ej0jCej0j7ej0j8dO
ZDej0jBd ej0j1d;ej0j2dPej0j3dQej0j4dRej0j5dSej0j6dTej0jCdUej0j7dVej0j8dWi
ZEdXdY ZFdZd[ ZGd\d] ZHd^d_ ZId`da ZJdbdc ZKddde ZLdfdg ZMdheNfdidjZOdkdl ZPdmdn ZQdodp ZRi ejSeejTeejUe$ejVe&ejWe,ejXe ejYe"ejZe#ej[eej\e<ej]e=ej^eej_e>ej`e'ejae(ejbe+Zcejde@iZeejfeFejgeGejheHiZiejjeejkeejXe ej`e'ejYe"ejle*ej]e=iZmejneRiZoejneRiZpejqeAiZrdS )q    N)x509)	DERReaderINTEGERNULLSEQUENCE_TLS_FEATURE_TYPE_TO_ENUM)_ASN1_TYPE_TO_ENUM)CRLEntryExtensionOIDCertificatePoliciesOIDExtensionOIDOCSPExtensionOIDc                 C   s   d}| j d|}| j|||d}||d kr,|d }| j d|}| j|||d}| |dk | j ||d d   S )NP   zchar[]   r   )_ffinew_libOBJ_obj2txtopenssl_assertbufferdecode)backendobjbuf_lenbufres r   R/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/decode_asn1.py_obj2txt   s   	r   c                 C   sn   | j |}| || jjk | j |}| || jjk t| |}t| |}t|j	 }t
t
|||S N)r   X509_NAME_ENTRY_get_objectr   r   r   X509_NAME_ENTRY_get_data_asn1_string_to_utf8r   r	   typer   NameAttributeObjectIdentifier)r   x509_name_entryr   datavalueoidr#   r   r   r   _decode_x509_name_entry-   s   


r*   c           	      C   s   | j |}g }d}t|D ](}| j ||}t| |}| j |}||kr-||h n|d | |}qt	dd |D S )Nc                 s   s    | ]}t |V  qd S r   )r   RelativeDistinguishedName).0rdnr   r   r   	<genexpr>H   s    z$_decode_x509_name.<locals>.<genexpr>)
r   X509_NAME_entry_countrangeX509_NAME_get_entryr*   X509_NAME_ENTRY_setappendaddr   Name)	r   	x509_namecount
attributesprev_set_idxentry	attributeset_idr   r   r   _decode_x509_name9   s   
r?   c                 C   sR   | j |}g }t|D ]}| j ||}| || jjk |t| | q|S r   )	r   sk_GENERAL_NAME_numr1   sk_GENERAL_NAME_valuer   r   r   r4   _decode_general_name)r   gnsnumnamesignr   r   r   _decode_general_namesK   s   rH   c                 C   s  |j | jjkrt| |jjd}tj	|S |j | jj
kr.t| |jjd}tj	|S |j | jjkrDt| |jj}tt|S |j | jjkrt| |jj}t|}|dks^|dkrt|d |d  }t||d d  }tt|dd  }|d}|dkrt|}d||d  v rtdt|jd	| }	nt|}	t|	S |j | jjkrt t!| |jj"S |j | jj#krt| |jj$d}tj%	|S |j | jj&krt| |jj'j(}
t)| |jj'j*}t+t|
|S t,d
tj-.|j |j |j )Nutf8          0r+   1zInvalid netmaskz/{}z{} is not a supported type)/r#   r   GEN_DNS_asn1_string_to_bytesddNSNamer   r   DNSName_init_without_validationGEN_URIuniformResourceIdentifierUniformResourceIdentifierGEN_RIDr   registeredIDRegisteredIDr%   	GEN_IPADD	iPAddresslen	ipaddress
ip_addressbinintfind
ValueError
ip_networkexplodedformat	IPAddressGEN_DIRNAMEDirectoryNamer?   directoryName	GEN_EMAIL
rfc822Name
RFC822NameGEN_OTHERNAME	otherNametype_id_asn1_to_derr(   	OtherNameUnsupportedGeneralNameType_GENERAL_NAMESget)r   rG   r'   r)   data_lenbasenetmaskbitsprefixiprp   r(   r   r   r   rB   V   sZ   


rB   c                 C   s   t  S r   )r   OCSPNoCheckr   extr   r   r   _decode_ocsp_no_check   s   r   c                 C   0   | j d|}| j || jj}tt| |S NzASN1_INTEGER *)r   castgcr   ASN1_INTEGER_freer   	CRLNumber_asn1_integer_to_intr   r~   asn1_intr   r   r   _decode_crl_number      r   c                 C   r   r   )r   r   r   r   r   r   DeltaCRLIndicatorr   r   r   r   r   _decode_delta_crl_indicator   r   r   c                   @   s   e Zd Zdd Zdd ZdS )_X509ExtensionParserc                 C   s   || _ || _|| _|| _d S r   )	ext_countget_exthandlers_backend)selfr   r   r   r   r   r   r   __init__   s   
z_X509ExtensionParser.__init__c                 C   sb  g }t  }t| |D ]}| ||}| j|| jjjk | jj	|}|dk}t
t| j| jj|}||v rFt
d|||tjkr| jj|}	t| j|	}
t|
t}g }| ss||t  | ret
dd |D }|t
||| || q|tjkr| jj|}	tt| j|	}|t   |t
||t
!  || qz| j"| }W n9 t#y   | jj|}	| j|	| jjjk | jj$|	j%|	j&d d  }t
'||}|t
||| Y n,w | jj(|}|| jjjkr| j)  t*d||| j|}|t
||| || qt
+|S )Nr   zDuplicate {} extension foundc                 S   s   g | ]}t | qS r   r   )r-   r;   r   r   r   
<listcomp>   s    z._X509ExtensionParser.parse.<locals>.<listcomp>z/The {} extension is invalid and can't be parsed),setr1   r   r   r   r   r   r   r   X509_EXTENSION_get_criticalr   r%   r   X509_EXTENSION_get_objectDuplicateExtensionrf   r   TLS_FEATUREX509_EXTENSION_get_datarP   r   read_single_elementr   is_emptyr4   read_elementr   
as_integer
TLSFeature	Extensionr5   PRECERT_POISONcheck_emptyPrecertPoisonr   KeyErrorr   r'   lengthUnrecognizedExtensionX509V3_EXT_d2i_consume_errorsrc   
Extensions)r   x509_obj
extensions	seen_oidsrF   r~   critcriticalr)   r'   
data_bytesfeaturesparsedr(   readerhandlerderunrecognizedext_datar   r   r   parse   sx   






z_X509ExtensionParser.parseN)__name__
__module____qualname__r   r   r   r   r   r   r      s    r   c                 C   s2  | j d|}| j || jj}| j|}g }t|D ]w}d }| j||}t	t
| |j}|j| j jkr| j|j}g }t|D ]E}	| j|j|	}
t	t
| |
j}|tjkrv| j |
jjj|
jjjd d  d}|| qD|tjks}J t| |
jj}|| qD|t|| qt|S )Nz"Cryptography_STACK_OF_POLICYINFO *ascii)r   r   r   r   CERTIFICATEPOLICIES_freesk_POLICYINFO_numr1   sk_POLICYINFO_valuer   r%   r   policyid
qualifiersr   sk_POLICYQUALINFO_numsk_POLICYQUALINFO_valuepqualidr   CPS_QUALIFIERr   rQ   cpsurir'   r   r   r4   CPS_USER_NOTICE_decode_user_notice
usernoticePolicyInformationCertificatePolicies)r   cprD   certificate_policiesrF   r   pir)   qnumjpqir   r   user_noticer   r   r   _decode_certificate_policies  s<   

r   c           
      C   s   d }d }|j | jjkrt| |j }|j| jjkrIt| |jj}| j|jj}g }t	|D ]}| j
|jj|}t| |}	||	 q-t||}t||S r   )exptextr   r   r"   	noticereforganizationr   sk_ASN1_INTEGER_num	noticenosr1   sk_ASN1_INTEGER_valuer   r4   r   NoticeReference
UserNotice)
r   unexplicit_textnotice_referencer   rD   notice_numbersrF   r   
notice_numr   r   r   r   &  s    
r   c                 C   sB   | j d|}| j || jj}|jdk}t| |j}t	||S )NzBASIC_CONSTRAINTS *   )
r   r   r   r   BASIC_CONSTRAINTS_freeca_asn1_integer_to_int_or_nonepathlenr   BasicConstraints)r   bc_stbasic_constraintsr   path_lengthr   r   r   _decode_basic_constraints>  s   
r   c                 C   s@   | j d|}| j || jj}t| j |j|j	d d  S NzASN1_OCTET_STRING *)
r   r   r   r   ASN1_OCTET_STRING_freer   SubjectKeyIdentifierr   r'   r   r   asn1_stringr   r   r   _decode_subject_key_identifierN  s   r   c                 C   s   | j d|}| j || jj}d }d }|j| j jkr*| j |jj|jj	d d  }|j
| j jkr7t| |j
}t| |j}t|||S )NzAUTHORITY_KEYID *)r   r   r   r   AUTHORITY_KEYID_freekeyidr   r   r'   r   issuerrH   r   serialr   AuthorityKeyIdentifier)r   akidkey_identifierauthority_cert_issuerauthority_cert_serial_numberr   r   r    _decode_authority_key_identifierX  s$   r   c                    s    j d|} j | fdd} j|}g }t|D ]5} j||} |j j j	k t
t |j} |j j j	k t |j}|t
|| q|S )Nz*Cryptography_STACK_OF_ACCESS_DESCRIPTION *c                    s    j |  j j jdS )NACCESS_DESCRIPTION_free)r   sk_ACCESS_DESCRIPTION_pop_freer   	addressof_original_lib)r;   r   r   r   <lambda>s  s    z,_decode_information_access.<locals>.<lambda>)r   r   r   r   sk_ACCESS_DESCRIPTION_numr1   sk_ACCESS_DESCRIPTION_valuer   methodr   r   r%   r   locationrB   r4   AccessDescription)r   iarD   access_descriptionsrF   adr)   rG   r   r   r   _decode_information_accesso  s   
	r  c                 C      t | |}t|S r   )r  r   AuthorityInformationAccessr   aiar  r   r   r   $_decode_authority_information_access     

r  c                 C   r	  r   )r  r   SubjectInformationAccessr  r   r   r   "_decode_subject_information_access  r  r  c                 C   s   | j d|}| j || jj}| jj}||ddk}||ddk}||ddk}||ddk}||ddk}||ddk}||ddk}	||d	dk}
||d
dk}t|||||||	|
|	S )NzASN1_BIT_STRING *r   r   rL                  rJ   )r   r   r   r   ASN1_BIT_STRING_freeASN1_BIT_STRING_get_bitr   KeyUsage)r   
bit_stringget_bitdigital_signaturecontent_commitmentkey_enciphermentdata_enciphermentkey_agreementkey_cert_signcrl_signencipher_onlydecipher_onlyr   r   r   _decode_key_usage  s.   r$  c                 C   s.   | j d|}| j || jj}t| |}|S NzGENERAL_NAMES *)r   r   r   r   GENERAL_NAMES_freerH   r   rC   general_namesr   r   r   _decode_general_names_extension  s   
r)  c                 C      t t| |S r   )r   SubjectAlternativeNamer)  r}   r   r   r   _decode_subject_alt_name     r,  c                 C   r*  r   )r   IssuerAlternativeNamer)  r}   r   r   r   _decode_issuer_alt_name  r-  r/  c                 C   sF   | j d|}| j || jj}t| |j}t| |j}tj	||dS )NzNAME_CONSTRAINTS *)permitted_subtreesexcluded_subtrees)
r   r   r   r   NAME_CONSTRAINTS_free_decode_general_subtreespermittedSubtreesexcludedSubtreesr   NameConstraints)r   nc	permittedexcludedr   r   r   _decode_name_constraints  s   r:  c                 C   sh   || j jkrd S | j|}g }t|D ]}| j||}| || j jk t| |j}|	| q|S r   )
r   r   r   sk_GENERAL_SUBTREE_numr1   sk_GENERAL_SUBTREE_valuer   rB   rw   r4   )r   stack_subtreesrD   subtreesrF   r   namer   r   r   r3    s   r3  c           	   	   C   s   | j d|}| j || jj}|j| j jkr t| |j\}}nd }d }|jdk}|j	dk}|j
dk}|jdk}|j| j jkrFt| |j}nd }t|||||||S )NzISSUING_DIST_POINT *r   )r   r   r   r   ISSUING_DIST_POINT_free	distpointr   _decode_distpointonlyuseronlyCAindirectCRLonlyattronlysomereasons_decode_reasonsr   IssuingDistributionPoint)	r   idp	full_namerelative_name	only_useronly_caindirect_crl	only_attronly_some_reasonsr   r   r   _decode_issuing_dist_point  s,   



rR  c                 C   sD   | j d|}| j || jj}t| |j}t| |j}t	||S )NzPOLICY_CONSTRAINTS *)
r   r   r   r   POLICY_CONSTRAINTS_freer   requireExplicitPolicyinhibitPolicyMappingr   PolicyConstraints)r   pcrequire_explicit_policyinhibit_policy_mappingr   r   r   _decode_policy_constraints  s   rZ  c                 C   s   | j d|}| j || jj}| j|}g }t|D ]}| j||}| || j j	k t
t| |}|| qt
|S )Nz#Cryptography_STACK_OF_ASN1_OBJECT *)r   r   r   r   sk_ASN1_OBJECT_freesk_ASN1_OBJECT_numr1   sk_ASN1_OBJECT_valuer   r   r   r%   r   r4   ExtendedKeyUsage)r   skrD   ekusrF   r   r)   r   r   r   _decode_extended_key_usage  s   
ra  r   c           
   	   C   s   | j d|}| j || jj}| j|}g }t|D ]E}d }d }d }d }| j||}	|	j| j j	kr:t
| |	j}|	j| j j	krGt| |	j}|	j| j j	krVt| |	j\}}|t|||| q|S )Nz"Cryptography_STACK_OF_DIST_POINT *)r   r   r   r   CRL_DIST_POINTS_freesk_DIST_POINT_numr1   sk_DIST_POINT_valuereasonsr   rH  	CRLissuerrH   rA  rB  r4   r   DistributionPoint)
r   cdpsrD   dist_pointsrF   rK  rL  
crl_issuerre  cdpr   r   r   _decode_dist_points  s0   rl  )r   rL   r  r  r  r  r  rJ   c                 C   s6   g }t  D ]\}}| j||r|| qt|S r   )_REASON_BIT_MAPPINGitemsr   r  r4   	frozenset)r   re  enum_reasonsbit_positionreasonr   r   r   rH  P  s   
rH  c           	      C   s   |j tkrt| |jj}|d fS |jj}| j|}t }t	|D ]}| j
||}| || jjk |t| | q!t|}d |fS r   )r#   _DISTPOINT_TYPE_FULLNAMErH   r?  fullnamerelativenamer   sk_X509_NAME_ENTRY_numr   r1   sk_X509_NAME_ENTRY_valuer   r   r   r5   r*   r   r,   )	r   rA  rK  rnsrnumr9   rF   rnrL  r   r   r   rB  Z  s   
	
rB  c                 C   r	  r   )rl  r   CRLDistributionPointsr   rh  ri  r   r   r   _decode_crl_distribution_pointss  r  r}  c                 C   r	  r   )rl  r   FreshestCRLr|  r   r   r   _decode_freshest_crlx  r  r  c                 C   4   | j d|}| j || jj}t| |}t|S r   )r   r   r   r   r   r   r   InhibitAnyPolicy)r   r   
skip_certsr   r   r   _decode_inhibit_any_policy}     

r  c                 C   sj   ddl m} | jd|}| j|| jj}g }t| j|D ]}| j	||}|
|| || q |S )Nr   )_SignedCertificateTimestampzCryptography_STACK_OF_SCT *))cryptography.hazmat.backends.openssl.x509r  r   r   r   r   SCT_LIST_freer1   
sk_SCT_numsk_SCT_valuer4   )r   	asn1_sctsr  sctsrF   sctr   r   r   _decode_scts  s   r  c                 C   r*  r   )r   )PrecertificateSignedCertificateTimestampsr  r   r  r   r   r   -_decode_precert_signed_certificate_timestamps  r-  r  c                 C   r*  r   )r   SignedCertificateTimestampsr  r  r   r   r   %_decode_signed_certificate_timestamps     r  )
r   r   rL   r  r  r  r  rJ   	   
   rL   r  r  r  r  rJ   r  r  c                 C   sZ   | j d|}| j || jj}| j|}ztt| W S  t	y,   t
d|w )NzASN1_ENUMERATED *zUnsupported reason code: {})r   r   r   r   ASN1_ENUMERATED_freeASN1_ENUMERATED_getr   	CRLReason_CRL_ENTRY_REASON_CODE_TO_ENUMr   rc   rf   )r   enumcoder   r   r   _decode_crl_reason  s   r  c                 C   r   )NzASN1_GENERALIZEDTIME *)r   r   r   r   ASN1_GENERALIZEDTIME_freer   InvalidityDate_parse_asn1_generalized_time)r   inv_dategeneralized_timer   r   r   _decode_invalidity_date  s   r  c                 C   r  r%  )r   r   r   r   r&  rH   r   CertificateIssuerr'  r   r   r   _decode_cert_issuer  r  r  c                    sn    j d} j||} |dk  |d  j jk  j | fdd} j |d |d d  S )Nunsigned char **r   c                        j | d S Nr   r   OPENSSL_freer   r   r   r   r         z_asn1_to_der.<locals>.<lambda>)r   r   r   i2d_ASN1_TYPEr   r   r   r   )r   	asn1_typer   r   r   r   r   rq     s   rq   c                 C   s@   | j || jj}| || jjk | j|| j j}| |S r   )r   ASN1_INTEGER_to_BNr   r   r   r   BN_free
_bn_to_int)r   r   bnr   r   r   r     s   
r   c                 C   s   || j jkrd S t| |S r   )r   r   r   )r   r   r   r   r   r     s   
r   c                 C   s   | j |j|jd d  S r   )r   r   r'   r   r   r   r   r   rP     s   rP   c                 C   s   t | |dS )Nr   )rP   r   r   r   r   r   _asn1_string_to_ascii  r  r  returnc                    s~    j d} j||}|dkrtd|j |d  j jk  j 	| fdd} j 
|d |d d  dS )Nr  r+   z&Unsupported ASN1 string type. Type: {}r   c                    r  r  r  r  r   r   r   r     r  z&_asn1_string_to_utf8.<locals>.<lambda>rI   )r   r   r   ASN1_STRING_to_UTF8rc   rf   r#   r   r   r   r   r   )r   r   r   r   r   r   r   r"     s   
 r"   c                 C   s`   |  || jjk | j|| jj}|| jjkr"tdt| || j|| jj	}t
| |S )Nz1Couldn't parse ASN.1 time as generalizedtime {!r})r   r   r   r   ASN1_TIME_to_generalizedtimerc   rf   rP   r   r  r  )r   	asn1_timer  r   r   r   _parse_asn1_time  s   
r  c                 C   s"   t | | jd|}tj|dS )NzASN1_STRING *z%Y%m%d%H%M%SZ)r  r   r   datetimestrptime)r   r  timer   r   r   r  $  s   r  c                 C   s0   | j d|}| j || jj}tt| |S r   )r   r   r   r   r   r   	OCSPNoncerP   )r   noncer   r   r   _decode_nonce+  r   r  )sr  r^   cryptographyr   cryptography.hazmat._derr   r   r   r   cryptography.x509.extensionsr   cryptography.x509.namer	   cryptography.x509.oidr
   r   r   r   r   r*   r?   rH   rB   r   r   r   objectr   r   r   r   r   r   r  r  r  r$  r)  r,  r/  r:  r3  rR  rZ  ra  rs  _DISTPOINT_TYPE_RELATIVENAMErl  ReasonFlagskey_compromiseca_compromiseaffiliation_changed
supersededcessation_of_operationcertificate_holdprivilege_withdrawnaa_compromiserm  rH  rB  r}  r  r  r  r  r  unspecifiedremove_from_crlr  _CRL_ENTRY_REASON_ENUM_TO_CODEr  r  r  rq   r   r   rP   r  strr"   r  r  r  BASIC_CONSTRAINTSSUBJECT_KEY_IDENTIFIER	KEY_USAGESUBJECT_ALTERNATIVE_NAMEEXTENDED_KEY_USAGEAUTHORITY_KEY_IDENTIFIERAUTHORITY_INFORMATION_ACCESSSUBJECT_INFORMATION_ACCESSCERTIFICATE_POLICIESCRL_DISTRIBUTION_POINTSFRESHEST_CRLOCSP_NO_CHECKINHIBIT_ANY_POLICYISSUER_ALTERNATIVE_NAMENAME_CONSTRAINTSPOLICY_CONSTRAINTS_EXTENSION_HANDLERS_BASE%PRECERT_SIGNED_CERTIFICATE_TIMESTAMPS_EXTENSION_HANDLERS_SCT
CRL_REASONINVALIDITY_DATECERTIFICATE_ISSUER_REVOKED_EXTENSION_HANDLERS
CRL_NUMBERDELTA_CRL_INDICATORISSUING_DISTRIBUTION_POINT_CRL_EXTENSION_HANDLERSNONCE_OCSP_REQ_EXTENSION_HANDLERS"_OCSP_BASICRESP_EXTENSION_HANDLERSSIGNED_CERTIFICATE_TIMESTAMPS'_OCSP_SINGLERESP_EXTENSION_HANDLERS_SCTr   r   r   r   <module>   s"  NQ!

-


