o
    )%a]                     @   s  d dl Z d dlZd dlmZmZ d dlmZmZmZ d dl	m
Z
 d dlmZmZmZ dd Zdd	 Zd
d Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Z d*d+ Z!d,d- Z"d.d/ Z#d0d1 Z$d2d3 Z%d4d5 Z&d6d7 Z'd8d9 Z(d:d; Z)d<d= Z*d>d? Z+ej,j-d@ej,j.dAej,j/dBej,j0dCej,j1dDej,j2dEej,j3dFej,j4dGiZ5dHdI Z6dJdK Z7dLdM Z8dNdO Z9dPdQ Z:dRdS Z;dTdU Z<dVdW Z=dXdY Z>i ej?e$ej@e(ejAe"ejBe'ejCe'ejDe+ejEe#ejFeejGe%ejHe%ejIe9ejJe9ejKeejLe!ejMe:ejNe;ejOe=ZPejCe'ejEe#ejGe%ejQeejReejSeejJe9iZTejUe'ejVeejWeiZXejYe>iZZejYe>iZ[dS )Z    N)utilsx509)_CRL_ENTRY_REASON_ENUM_TO_CODE_DISTPOINT_TYPE_FULLNAME_DISTPOINT_TYPE_RELATIVENAME)	_ASN1Type)CRLEntryExtensionOIDExtensionOIDOCSPExtensionOIDc                 C   sD   |  |}| j|| jj}| j|| jj}| || jjk |S )a  
    Converts a python integer to an ASN1_INTEGER. The returned ASN1_INTEGER
    will not be garbage collected (to support adding them to structs that take
    ownership of the object). Be sure to register it for GC if it will be
    discarded after use.

    )
_int_to_bn_ffigc_libBN_freeBN_to_ASN1_INTEGERNULLopenssl_assertbackendxi r   R/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/encode_asn1.py_encode_asn1_int   s
   
r   c                 C       t | |}| j|| jj}|S N)r   r   r   r   ASN1_INTEGER_freer   r   r   r   _encode_asn1_int_gc+      
r   c                 C   s0   | j  }| j ||t|}| |dk |S )z@
    Create an ASN1_OCTET_STRING from a Python byte string.
       )r   ASN1_OCTET_STRING_newASN1_OCTET_STRING_setlenr   )r   datasresr   r   r   _encode_asn1_str1   s   
r&   c                 C   s<   | j  }| j ||dt|d}| |dk |S )z
    Create an ASN1_UTF8STRING from a Python unicode string.
    This object will be an ASN1_STRING with UTF8 type in OpenSSL and
    can be decoded with ASN1_STRING_to_UTF8.
    utf8r   )r   ASN1_UTF8STRING_newASN1_STRING_setencoder"   r   )r   stringr$   r%   r   r   r   _encode_asn1_utf8_str;   s   
r,   c                 C   r   r   )r&   r   r   r   ASN1_OCTET_STRING_free)r   r#   r$   r   r   r   _encode_asn1_str_gcI   r   r.   c                 C      t | |jS r   )r   
skip_certs)r   inhibit_any_policyr   r   r   _encode_inhibit_any_policyO      r2   c                 C   sh   | j  }|jD ])}d}|D ]"}t| |}| j|| j j}| j ||d|}| |dk d}qq|S )zP
    The X509_NAME created will not be gc'd. Use _encode_name_gc if needed.
    r   r   )	r   X509_NAME_newrdns_encode_name_entryr   r   X509_NAME_ENTRY_freeX509_NAME_add_entryr   )r   namesubjectrdnset_flag	attribute
name_entryr%   r   r   r   _encode_nameS   s   


r@   c                 C   r   r   )r@   r   r   r   X509_NAME_free)r   
attributesr;   r   r   r   _encode_name_gch   r   rC   c                 C   s>   | j  }|D ]}t| |}| j ||}| |dk q|S )z:
    The sk_X509_NAME_ENTRY created will not be gc'd.
    r   )r   sk_X509_NAME_ENTRY_new_nullr7   sk_X509_NAME_ENTRY_pushr   )r   rB   stackr>   r?   r%   r   r   r   _encode_sk_name_entryn   s   

rG   c                 C   sr   |j tju r|jd}n|j tju r|jd}n|jd}t| |jj}| j	
| jj||j j|t|}|S )N	utf_16_be	utf_32_ber'   )_typer   	BMPStringvaluer*   UniversalString_txt2obj_gcoiddotted_stringr   X509_NAME_ENTRY_create_by_OBJr   r   r"   )r   r>   rL   objr?   r   r   r   r7   z   s   r7   c                 C   r/   r   )r   
crl_numberr   extr   r   r   &_encode_crl_number_delta_crl_indicator   r3   rV   c                 C   s   | j  }| || jjk | j|| j j}|jrdnd|_|j	r$dnd|_
|jr,dnd|_|jr4dnd|_|jrAt| |j|_|jrKt| |j|_|jrUt| |j|_|S N   r   )r   ISSUING_DIST_POINT_newr   r   r   r   ISSUING_DIST_POINT_freeonly_contains_user_certsonlyuseronly_contains_ca_certsonlyCAindirect_crlindirectCRLonly_contains_attribute_certsonlyattronly_some_reasons_encode_reasonflagsonlysomereasons	full_name_encode_full_name	distpointrelative_name_encode_relative_name)r   rU   idpr   r   r   _encode_issuing_dist_point   s    
rl   c                 C   sT   | j  }| || jjk | j|| j j}| j |t|j	 }| |dk |S Nr   )
r   ASN1_ENUMERATED_newr   r   r   r   ASN1_ENUMERATED_freeASN1_ENUMERATED_setr   reason)r   
crl_reasonasn1enumr%   r   r   r   _encode_crl_reason   s   

rt   c                 C   sF   | j | jjt|j }| || jjk | j	|| j j
}|S r   )r   ASN1_GENERALIZEDTIME_setr   r   calendartimegminvalidity_date	timetupler   r   ASN1_GENERALIZEDTIME_free)r   rx   timer   r   r   _encode_invalidity_date   s   r|   c                 C   s  | j  }| || jjk | j|| j j}|D ]}| j  }| || jjk | j ||}| |dk t	| |j
j}||_|jr| j  }| || jjk |jD ]i}| j  }	| |	| jjk | j ||	}| |dk t|trt	| tjj|	_t| |d|	j_qUt|tjsJ t	| tjj|	_| j  }
| |
| jjk |
|	j_|jrt| |j|
_ t!| |j"|
_#qU||_$q|S )Nr   ascii)%r   sk_POLICYINFO_new_nullr   r   r   r   sk_POLICYINFO_freePOLICYINFO_newsk_POLICYINFO_push_txt2objpolicy_identifierrP   policyidpolicy_qualifierssk_POLICYQUALINFO_new_nullPOLICYQUALINFO_newsk_POLICYQUALINFO_push
isinstancestrr   OID_CPS_QUALIFIERpqualidr&   r*   dcpsuri
UserNoticeOID_CPS_USER_NOTICEUSERNOTICE_new
usernoticeexplicit_textr,   exptext_encode_notice_referencenotice_reference	noticeref
qualifiers)r   certificate_policiescppolicy_infopir%   rO   pqis	qualifierpqiunr   r   r   _encode_certificate_policies   sV   







r   c                 C   s   |d u r| j jS | j }| || j jk t| |j|_| j }||_|j	D ]}t
| |}| j||}| |dk q(|S rm   )r   r   r   NOTICEREF_newr   r,   organizationsk_ASN1_INTEGER_new_null	noticenosnotice_numbersr   sk_ASN1_INTEGER_push)r   noticenrnotice_stacknumbernumr%   r   r   r   r      s   



r   c                 C   s.   | d}| j|d}| || jjk |S )z_
    Converts a Python string with an ASN.1 object ID in dotted form to a
    ASN1_OBJECT.
    r}   r   )r*   r   OBJ_txt2objr   r   r   r   r:   rR   r   r   r   r      s   
r   c                 C   r   r   )r   r   r   r   ASN1_OBJECT_freer   r   r   r   rN   
  r   rN   c                 C   s
   | j  S r   )r   ASN1_NULL_newrT   r   r   r   _encode_ocsp_nocheck  s   
r   c                 C   sb  | j j}| j  }| j|| j j}||d|j}| |dk ||d|j}| |dk ||d|j	}| |dk ||d|j
}| |dk ||d|j}| |dk ||d|j}| |dk ||d|j}| |dk |jr||d|j}| |dk ||d	|j}| |dk |S ||dd}| |dk ||d	d}| |dk |S )
Nr   r                        )r   ASN1_BIT_STRING_set_bitASN1_BIT_STRING_newr   r   ASN1_BIT_STRING_freedigital_signaturer   content_commitmentkey_enciphermentdata_enciphermentkey_agreementkey_cert_signcrl_signencipher_onlydecipher_only)r   	key_usageset_bitkur%   r   r   r   _encode_key_usage  s8   
r   c                 C   sz   | j  }| || jjk | j|| j j}|jd ur#t| |j|_	|j
d ur/t| |j
|_|jd ur;t| |j|_|S r   )r   AUTHORITY_KEYID_newr   r   r   r   AUTHORITY_KEYID_freekey_identifierr&   keyidauthority_cert_issuer_encode_general_namesissuerauthority_cert_serial_numberr   serial)r   authority_keyidakidr   r   r    _encode_authority_key_identifier5  s"   



r   c                 C   sN   | j  }| j|| j j}|jrdnd|_|jr%|jd ur%t| |j|_|S rW   )	r   BASIC_CONSTRAINTS_newr   r   BASIC_CONSTRAINTS_freecapath_lengthr   pathlen)r   basic_constraintsconstraintsr   r   r   _encode_basic_constraintsL  s   
r   c                    s    j  } | jjk  j| fdd}|D ]'} j  }t |jj	}t
 |j|j ||_ j ||} |dk q|S )Nc                    s    j |  j j jdS )NACCESS_DESCRIPTION_free)r   sk_ACCESS_DESCRIPTION_pop_freer   	addressof_original_lib)r   r   r   r   <lambda>_  s    z,_encode_information_access.<locals>.<lambda>r   )r   sk_ACCESS_DESCRIPTION_new_nullr   r   r   r   ACCESS_DESCRIPTION_newr   access_methodrP   !_encode_general_name_preallocatedaccess_locationlocationmethodsk_ACCESS_DESCRIPTION_push)r   info_accessaiaaccess_descriptionadr   r%   r   r   r   _encode_information_accessZ  s$   

	

r   c                 C   sP   | j  }| || jjk |D ]}t| |}| j ||}| |dk q|S )Nr   )r   GENERAL_NAMES_newr   r   r   _encode_general_namesk_GENERAL_NAME_push)r   namesgeneral_namesr:   gnr%   r   r   r   r   u  s   

r   c                 C   r   r   )r   r   r   r   GENERAL_NAMES_free)r   sanr   r   r   r   _encode_alt_name  s
   
r   c                 C   r/   r   )r.   digest)r   skir   r   r   _encode_subject_key_identifier  r3   r   c                 C   s   | j  }t| || |S r   )r   GENERAL_NAME_newr   )r   r:   r   r   r   r   r     s   
r   c                 C   sL  t |tjr?| || jjk | jj|_| j	 }| || jjk |j
d}| j||t|}| |dk ||j_d S t |tjrn| || jjk | jj|_| j|j
jdd}| || jjk ||j_d S t |tjr| || jjk t| |j
}| jj|_||j_d S t |tjr| || jjk t |j
tjr|j
jjtd|j
j  d }nt |j
tj!r|j
jjtdd> |j
j  d }n|j
j}t"| |}	| jj#|_|	|j_$d S t |tj%rS| || jjk | j& }
| |
| jjk | j|j'jdd}| || jjk | j(d|j
}| j(d	}||d
< | j)| jj|t|j
}|| jjkrB| *  t+d||
_'||
_
| jj,|_|
|j_-d S t |tj.ry| || jjk |j
d}t"| |}| jj/|_||j_0d S t |tj1r| || jjk |j
d}t"| |}| jj2|_||j_3d S t+d4|)Nr'   r   r}   l        r         zunsigned char[]zunsigned char **r   zInvalid ASN.1 dataz!{} is an unknown GeneralName type)5r   r   DNSNamer   r   r   r   GEN_DNStypeASN1_IA5STRING_newrL   r*   r)   r"   r   dNSNameRegisteredIDGEN_RIDr   rP   registeredIDDirectoryNamer@   GEN_DIRNAMEdirectoryName	IPAddress	ipaddressIPv4Networknetwork_addresspackedr   int_to_bytesnum_addressesIPv6Networkr&   	GEN_IPADD	iPAddress	OtherNameOTHERNAME_newtype_idnewd2i_ASN1_TYPE_consume_errors
ValueErrorGEN_OTHERNAME	otherName
RFC822Name	GEN_EMAIL
rfc822NameUniformResourceIdentifierGEN_URIuniformResourceIdentifierformat)r   r:   r   ia5rL   r%   rR   dir_namer  ipaddr
other_namer  r#   data_ptr_ptrasn1_strr   r   r   r     s   











r   c                 C   sR   | j  }| j|| j j}|D ]}t| |j}| j ||}| |dk q|S rm   )	r   sk_ASN1_OBJECT_new_nullr   r   sk_ASN1_OBJECT_freer   rP   sk_ASN1_OBJECT_pushr   )r   extended_key_usageekurO   rR   r%   r   r   r   _encode_extended_key_usage  s   
r/  r   r   r   r   r   r   r   r   c                 C   sL   | j  }| || jjk |D ]}| j |t| d}| |dk q|S rm   )r   r   r   r   r   r   _CRLREASONFLAGS)r   reasonsbitmaskrq   r%   r   r   r   rd     s   

rd   c                 C   4   | j  }| || jjk t|_t| ||j_	|S r   )
r   DIST_POINT_NAME_newr   r   r   r   r  r   r:   fullname)r   rf   dpnr   r   r   rg   	  
   
rg   c                 C   r3  r   )
r   r4  r   r   r   r   r  rG   r:   relativename)r   ri   r6  r   r   r   rj     r7  rj   c                 C   s   | j  }| j|| j j}|D ]F}| j  }| || jjk |jr*t	| |j|_|j
r4t| |j
|_|jr>t| |j|_|jrHt| |j|_| j ||}| |dk q|S rm   )r   sk_DIST_POINT_new_nullr   r   sk_DIST_POINT_freeDIST_POINT_newr   r   r1  rd   rf   rg   rh   ri   rj   
crl_issuerr   	CRLissuersk_DIST_POINT_push)r   cdpscdppointdpr%   r   r   r   _encode_cdps_freshest_crl  s    

rC  c                 C   sV   | j  }| || jjk | j|| j j}t| |j}||_	t| |j
}||_|S r   )r   NAME_CONSTRAINTS_newr   r   r   r   NAME_CONSTRAINTS_free_encode_general_subtreepermitted_subtreespermittedSubtreesexcluded_subtreesexcludedSubtrees)r   name_constraintsnc	permittedexcludedr   r   r   _encode_name_constraints2  s   
rO  c                 C   sb   | j  }| || jjk | j|| j j}|jd ur#t| |j|_	|j
d ur/t| |j
|_|S r   )r   POLICY_CONSTRAINTS_newr   r   r   r   POLICY_CONSTRAINTS_freerequire_explicit_policyr   requireExplicitPolicyinhibit_policy_mappinginhibitPolicyMapping)r   policy_constraintspcr   r   r   _encode_policy_constraintsB  s   


rX  c                 C   sZ   |d u r| j jS | j }|D ]}| j }t| ||_| j||}| |dk q|S rm   )	r   r   r   sk_GENERAL_SUBTREE_new_nullGENERAL_SUBTREE_newr   basesk_GENERAL_SUBTREE_pushr   )r   subtreesgeneral_subtreesr:   gsr%   r   r   r   rF  S  s   

rF  c                 C   sZ   | j  }| || jjk | j|| j j}|D ]}| j ||j}| |dk q|S rm   )	r   sk_SCT_new_nullr   r   r   r   sk_SCT_freesk_SCT_push_sct)r   scts	sct_stacksctr%   r   r   r   -_encode_precert_signed_certificate_timestampsa  s   
rg  c                 C   r/   r   )r.   nonce)r   rh  r   r   r   _encode_noncek  r3   ri  )\rv   r  cryptographyr   r   0cryptography.hazmat.backends.openssl.decode_asn1r   r   r   cryptography.x509.namer   cryptography.x509.oidr   r	   r
   r   r   r&   r,   r.   r2   r@   rC   rG   r7   rV   rl   rt   r|   r   r   r   rN   r   r   r   r   r   r   r   r   r   r   r/  ReasonFlagskey_compromiseca_compromiseaffiliation_changed
supersededcessation_of_operationcertificate_holdprivilege_withdrawnaa_compromiser0  rd   rg   rj   rC  rO  rX  rF  rg  ri  BASIC_CONSTRAINTSSUBJECT_KEY_IDENTIFIER	KEY_USAGESUBJECT_ALTERNATIVE_NAMEISSUER_ALTERNATIVE_NAMEEXTENDED_KEY_USAGEAUTHORITY_KEY_IDENTIFIERCERTIFICATE_POLICIESAUTHORITY_INFORMATION_ACCESSSUBJECT_INFORMATION_ACCESSCRL_DISTRIBUTION_POINTSFRESHEST_CRLINHIBIT_ANY_POLICYOCSP_NO_CHECKNAME_CONSTRAINTSPOLICY_CONSTRAINTS%PRECERT_SIGNED_CERTIFICATE_TIMESTAMPS_EXTENSION_ENCODE_HANDLERS
CRL_NUMBERDELTA_CRL_INDICATORISSUING_DISTRIBUTION_POINT_CRL_EXTENSION_ENCODE_HANDLERSCERTIFICATE_ISSUER
CRL_REASONINVALIDITY_DATE$_CRL_ENTRY_EXTENSION_ENCODE_HANDLERSNONCE'_OCSP_REQUEST_EXTENSION_ENCODE_HANDLERS)_OCSP_BASICRESP_EXTENSION_ENCODE_HANDLERSr   r   r   r   <module>   s   
1 T
	
