File: //usr/lib/python3.9/site-packages/ipalib/__pycache__/x509.cpython-39.opt-1.pyc
a
�N(i�w � @ s d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl m
Z d dl m
Z
d dlmZ d dlmZmZmZmZ d dlZd dlZd dlmZmZmZmZ d dl m Z m Z d d l m Z m!Z! d dl"Z"zd d
l#m$Z$ W n e%y� d d
l&m$Z$ Y n0 d d l'm(Z( d d l)m*Z* d Z+d
Z,e�-dej.�Z/e�-dej.�Z0dZ1dZ2dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:G dd� d�Z;d d � Z<d d � Z=d d!� Z>d"d#� Z?d$d%� Z@d&d'� ZAdbd(d)�ZBe+fd*d+�ZCd,d-� ZDd.d/� ZEd0d1� ZFdcd2d3�ZGddd4d5�ZHG d6d7� d7ejI�ZJG d8d9� d9ejI�ZKd:d;� ZLG d<d=� d=e jMjN�ZOG d>d?� d?e jMjN�ZPe:eOe9ePiZQd@dA� ZRdBdC� ZSdDdE� ZTdFdG� ZUdHdI� ZVdJdK� ZWdLdM� ZXdNdO� ZYdPdQ� ZZG dRdS� dSej[�Z\dTdU� Z]G dVdW� dWej^�Z_G dXdY� dY�Z`G dZd[� d[e`�ZaG d\d]� d]ea�ZbG d^d_� d_ea�ZcG d`da� daejI�ZddS )e� )�print_functionN)�x509)�default_backend)�
serialization)�Encoding� PublicFormat�
PrivateFormat�load_pem_private_key)�univ�char� namedtype�tag)�decoder�encoder)�rfc2315�rfc2459)�ssl_match_hostname)�errors)�DNSName� s; (-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----)s� -----BEGIN(?: ENCRYPTED)?(?: (?:RSA|DSA|DH|EC))? PRIVATE KEY-----.*?-----END(?: ENCRYPTED)?(?: (?:RSA|DSA|DH|EC))? PRIVATE KEY-----z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2z1.3.6.1.5.5.7.3.3z1.3.6.1.5.5.7.3.4z1.3.6.1.5.2.3.4z1.3.6.1.5.2.3.5z 2.5.29.37.0z1.3.6.1.4.1.3319.6.10.16z1.3.6.1.4.1.311.20.2.3z
1.3.6.1.5.2.2c @ s e Zd ZdZd[dd�Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zed)d*� �Zeejd+�r�ed,d-� �Z ed.d/� �Z ed0d1� �Z ed2d3� �Z ed4d5� �Z ed6d7� �Z!eejd8��rJed9d:� �Z"ed;d<� �Z#ned=d:� �Z"ed>d<� �Z#eejd?��r|ed@dA� �Z$edBdC� �Z%edDdE� �Z&dFdG� Z'edHdI� �Z(edJdK� �Z)edLdM� �Z*edNdO� �Z+dPdQ� Z,edRdS� �Z-dTdU� Z.edVdW� �Z/eejdX��r
dYdZ� Z0dS )\�IPACertificatezf
A proxy class wrapping a python-cryptography certificate representation for
IPA purposes
Nc C s` || _ |du rt� n|� | _| �d�| _| �d�| _| �d�| _| jjdkr\t d| jj ��dS )z�
:param cert: A python-cryptography Certificate object
:param backend: A python-cryptography Backend object
N�subject�issuerZ serialNumberZv3zX.509 %s is not supported)
�_certr �backend� _IPACertificate__get_der_field�_subject�_issuer�_serial_number�version�name�
ValueError)�self�certr � r$ �//usr/lib/python3.9/site-packages/ipalib/x509.py�__init__` s �zIPACertificate.__init__c C s | � tj�| j| j| jd�}|S )N)r r r r )� public_bytesr �DER�
subject_bytes� issuer_bytesr �r" �stater$ r$ r% � __getstate__s s
�zIPACertificate.__getstate__c C s8 |d | _ |d | _|d | _tj|d t� d�| _d S )Nr r r r �r )r r � crypto_x509�load_der_x509_certificater r r+ r$ r$ r% � __setstate__| s
�zIPACertificate.__setstate__c C sJ t |tjtf�r(| �tj�|�tj�kS t |t�rB| �tj�|kS dS dS )z�
Checks equality.
:param other: either cryptography.Certificate or IPACertificate or
bytes representing a DER-formatted certificate
FN)�
isinstancer/ � Certificater r' r r( �bytes�r" �otherr$ r$ r% �__eq__� s
�
zIPACertificate.__eq__c C s | � |� S )z#
Checks not equal.
)r7 r5 r$ r$ r% �__ne__� s zIPACertificate.__ne__c C s
t | j�S )zJ
Computes a hash of the wrapped cryptography.Certificate.
)�hashr �r" r$ r$ r% �__hash__� s zIPACertificate.__hash__c C s\ t �� }t�|�|d< t�|�|d< tj�d�r@t� t�
|��}t� |�|d< t� |�}|S )N�extnID�critical�0.3� extnValue) r Z Extensionr
�ObjectIdentifierZBoolean�pyasn1� __version__�
startswithr �encode� OctetString�Any)r" �oidr= �value�extr$ r$ r% Z__encode_extension� s
z!IPACertificate.__encode_extensionc C s& | j }t�|t�� �d }|| }|S )zO
:returns: a field of the certificate in pyasn1 representation
r )�tbs_certificate_bytesr �decoder ZTBSCertificate)r" �fieldZ
cert_bytesr# r$ r$ r% Z__get_pyasn1_field� s z!IPACertificate.__get_pyasn1_fieldc C s t �| �|��S )z�
:field: the name of the field of the certificate
:returns: bytes representing the value of a certificate field
)r rD �!_IPACertificate__get_pyasn1_field)r" rL r$ r$ r% Z__get_der_field� s z IPACertificate.__get_der_fieldc C s | j �|�S )zB
Serializes the certificate to PEM or DER format.
)r r' )r" �encodingr$ r$ r% r' � s zIPACertificate.public_bytesc C s | j j| j jkS )zT
:returns: True if this certificate is self-signed, False otherwise
)r r r r: r$ r$ r% �is_self_signed� s z IPACertificate.is_self_signedc C s | j �|�S )zL
Counts fingerprint of the wrapped cryptography.Certificate
)r � fingerprint)r" � algorithmr$ r$ r% rP � s zIPACertificate.fingerprintc C s | j S �N)r r: r$ r$ r% r# � s zIPACertificate.certc C s | j jS rR )r �
serial_numberr: r$ r$ r% rS � s z IPACertificate.serial_numberc C s | j S rR )r r: r$ r$ r% �serial_number_bytes� s z"IPACertificate.serial_number_bytesc C s | j jS rR )r r r: r$ r$ r% r � s zIPACertificate.versionc C s | j jS rR )r r r: r$ r$ r% r � s zIPACertificate.subjectc C s | j S rR )r r: r$ r$ r% r) � s z IPACertificate.subject_bytesc C s | j jS )zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
)r �signature_hash_algorithmr: r$ r$ r% rU � s z'IPACertificate.signature_hash_algorithmc C s | j jS )zJ
Returns the ObjectIdentifier of the signature algorithm.
)r �signature_algorithm_oidr: r$ r$ r% rV � s z&IPACertificate.signature_algorithm_oid� signature_algorithm_parametersc C s | j jS rR )r rW r: r$ r$ r% rW � s z-IPACertificate.signature_algorithm_parametersc C s | j jS )z.
Returns the signature bytes.
)r � signaturer: r$ r$ r% rX � s zIPACertificate.signaturec C s | j jS rR )r r r: r$ r$ r% r s zIPACertificate.issuerc C s | j S rR )r r: r$ r$ r% r* s zIPACertificate.issuer_bytesc C s | j jjtjjd�S �N��tzinfo�r �not_valid_before�replace�datetime�timezone�utcr: r$ r$ r% r] s z IPACertificate.not_valid_beforec C s | j jjtjjd�S rY �r �not_valid_afterr^ r_ r` ra r: r$ r$ r% rc s z IPACertificate.not_valid_after�not_valid_before_utcc C s | j jS rR )r rd r: r$ r$ r% rd s z#IPACertificate.not_valid_before_utcc C s | j jS rR )r �not_valid_after_utcr: r$ r$ r% re s z"IPACertificate.not_valid_after_utcc C s | j jjtjjd�S rY r\ r: r$ r$ r% rd s �c C s | j jjtjjd�S rY rb r: r$ r$ r% re $ s ��public_key_algorithm_oidc C s | j jS )zI
Returns the ObjectIdentifier of the public key.
)r rf r: r$ r$ r% rf , s z'IPACertificate.public_key_algorithm_oidc C s | j jS rR )r rJ r: r$ r$ r% rJ 3 s z$IPACertificate.tbs_certificate_bytesc C s | j jS rR )r �
extensionsr: r$ r$ r% rg 7 s zIPACertificate.extensionsc C s
| j �� S rR )r �
public_keyr: r$ r$ r% rh = s zIPACertificate.public_keyc C s | j �� jtjtjd�S )N)rN �format)r rh r' r r( r ZSubjectPublicKeyInfor: r$ r$ r% �public_key_info_bytes@ s
�z$IPACertificate.public_key_info_bytesc C sD z| j j�tjjj�j}W n tjy0 Y d S 0 t dd� |D ��S )Nc s s | ] }|j V qd S rR )�
dotted_string)�.0rG r$ r$ r% � <genexpr>M � z4IPACertificate.extended_key_usage.<locals>.<genexpr>)
r rg Zget_extension_for_oidr/ rG Z ExtensionOIDZEXTENDED_KEY_USAGErH ZExtensionNotFound�set)r" Z
ext_key_usager$ r$ r% �extended_key_usageE s �
z!IPACertificate.extended_key_usagec C sZ | j }|d u rd S t�� }tt|��D ]\}}t�|�||< q&t�|�}| � dt
|v|�S )Nz 2.5.29.37) rp r ZExtKeyUsageSyntax� enumerate�sortedr
r@ r rD �!_IPACertificate__encode_extension�EKU_ANY)r" ZekuZekurfc�irG r$ r$ r% �extended_key_usage_bytesO s
z'IPACertificate.extended_key_usage_bytesc C s` | � � }dd� dd� tttdd� td�}g }|D ]*}|�� }||v r0|�|| |�� �� q0|S )a�
Return SAN general names from a python-cryptography
certificate object. If the SAN extension is not present,
return an empty sequence.
Because python-cryptography does not yet provide a way to
handle unrecognised critical extensions (which may occur),
we must parse the certificate and extract the General Names.
For uniformity with other code, we manually construct values
of python-crytography GeneralName subtypes.
python-cryptography does not yet provide types for
ediPartyName or x400Address, so we drop these name types.
otherNames are NOT instantiated to more specific types where
the type is known. Use ``process_othernames`` to do that.
When python-cryptography can handle certs with unrecognised
critical extensions and implements ediPartyName and
x400Address, this function (and helpers) will be redundant
and should go away.
c S s t �t| ��S rR )r/ Z
RFC822Name�str��xr$ r$ r% �<lambda>w rn z2IPACertificate.san_general_names.<locals>.<lambda>c S s t �t| ��S rR )r/ r rw rx r$ r$ r% rz x rn c S s t �t| ��S rR )r/ ZUniformResourceIdentifierrw rx r$ r$ r% rz } s �)Z
rfc822Name�dNSNameZ
directoryNameZ registeredIDZ iPAddressZuniformResourceIdentifierZ otherName)�-_IPACertificate__pyasn1_get_san_general_names�%_pyasn1_to_cryptography_directoryname�$_pyasn1_to_cryptography_registeredid�!_pyasn1_to_cryptography_ipaddress�!_pyasn1_to_cryptography_othername�getName�append� getComponent)r" �gnsZGENERAL_NAME_CONSTRUCTORS�result�gnZgn_typer$ r$ r% �san_general_names[ s" � �z IPACertificate.san_general_namesc C sz | � d�p g }t�d�}g }|D ]T}|d |kr |d }tj�d�rZtj|t�� d�d }tj|t �
� d�d } qvq |S )Nrg z 2.5.29.17r< r? r> �Zasn1Specr ) rM r
r@ rA rB rC r rK rE r ZSubjectAltName)r" rg ZOID_SANr� rI Zderr$ r$ r% Z __pyasn1_get_san_general_names� s
z-IPACertificate.__pyasn1_get_san_general_namesc C s8 | � � }g }|D ]"}|�� dkr|�t|�� �� q|S )Nr{ )r| r� r� rw r� )r" r� r� r� r$ r$ r% �san_a_label_dns_names� s z$IPACertificate.san_a_label_dns_namesc
C s� i }g |d< }| j jjD ]<}g }|D ]$}|jtjjjkr&|�d|jf� q&|�|� q| j }|r�g |d< }|D ]} |�d| f� qrt
� |t |��
� � d S )Nr Z
commonNameZsubjectAltNameZDNS)r r ZrdnsrG r/ ZNameOIDZ COMMON_NAMEr� rH r� r �match_hostnamer ZToASCII)
r" �hostnameZ
match_certZ
match_subject�rdnZ match_rdn�ava�valuesZ match_sanrH r$ r$ r% r� � s �z IPACertificate.match_hostnamec C s | j jS rR )r �tbs_precertificate_bytesr: r$ r$ r% r� � s z'IPACertificate.tbs_precertificate_bytes�verify_directly_issued_byc C s | j �|�S rR )r r� )r" r r$ r$ r% r� � s z(IPACertificate.verify_directly_issued_by)N)1�__name__�
__module__� __qualname__�__doc__r& r- r1 r7 r8 r; rs rM r r' rO rP �propertyr# rS rT r r r) rU rV �hasattrr/ r3 rW rX r r* r] rc rd re rf rJ rg rh rj rp rv r� r| r� r� r� r� r$ r$ r$ r% r [ s�
0
r c C s" t | t�r| S ttj| t� d��S )z�
Load an X.509 certificate in PEM format.
:returns: a ``IPACertificate`` object.
:raises: ``ValueError`` if unable to load the certificate.
r. )r2 r r/ �load_pem_x509_certificater ��datar$ r$ r% r� � s
�r� c C s" t | t�r| S ttj| t� d��S )z�
Load an X.509 certificate in DER format.
:returns: a ``IPACertificate`` object.
:raises: ``ValueError`` if unable to load the certificate.
r. )r2 r r/ r0 r r� r$ r$ r% r0 � s
�r0 c C s* z
t | �W S ty$ t| � Y S 0 dS )a
Only use this function when you can't be sure what kind of format does
your certificate have, e.g. input certificate files in installers
:returns: a ``IPACertificate`` object.
:raises: ``ValueError`` if unable to load the certificate.
N)r� r! r0 r� r$ r$ r% � load_unknown_x509_certificate� s
r� c C s< t | dd�� }t|�� �W d � S 1 s.0 Y dS )zh
Load a certificate from a PEM file.
Returns a python-cryptography ``Certificate`` object.
�rb)�modeN)�openr� �read��filename�fr$ r$ r% �load_certificate_from_file� s r� c C s t �| �}dd� |D �S )z�
Load a certificate list from a sequence of concatenated PEMs.
Return a list of python-cryptography ``Certificate`` objects.
c S s g | ]}t |d ��qS )r )r� )rl r# r$ r$ r% �
<listcomp> rn z)load_certificate_list.<locals>.<listcomp>)�PEM_CERT_REGEX�findall)r� �certsr$ r$ r% �load_certificate_list� s
r� c C s: t | d�� }t|�� �W d � S 1 s,0 Y dS )zv
Load a certificate list from a PEM file.
Return a list of python-cryptography ``Certificate`` objects.
r� N)r� r� r� r� r$ r$ r% � load_certificate_list_from_file s r� c C sv t � }g }t�t| �D ]Z}t�d|�� �durX|du r>td��|�t|�� ||d�� q|�t|�� d|d�� q|S )a
Load a private key list from a sequence of concatenated PEMs.
:param data: bytes containing the private keys
:param password: bytes, the password to encrypted keys in the bundle
:returns: List of python-cryptography ``PrivateKey`` objects
s ENCRYPTEDNz:Password is required for the encrypted keys in the bundle.r. ) r �re�finditer�PEM_PRIV_REGEX�search�group� RuntimeErrorr� r )r� �passwordZcrypto_backendZ priv_keys�matchr$ r$ r% �load_private_key_list s"
��
��r� c C s� |t kr4t�d| tj�}|s$td��t�|�d��} t� | t
� � �\}}|rTtd��|d t
j krjtd��t� t
|d �t
�� �\}}|r�td��g }|d D ] }t�|�}t|�}|�|� q�|S )
zn
Extract certificates from a PKCS #7 object.
:returns: a ``list`` of ``IPACertificate`` objects.
s- -----BEGIN PKCS7-----(.*?)-----END PKCS7-----znot a valid PKCS#7 PEMr znot a valid PKCS#7 messageZ contentTypez not a PKCS#7 signed data messageZcontentz¬ a valid PKCS#7 signed data messageZ certificates)�PEMr� r� �DOTALLr! �base64Z b64decoder� r rK r Z ContentInfoZ
signedDatar4 Z
SignedDatar rD r0 r� )r� Zdatatyper� Z content_info�tailZ signed_datar� Z certificater$ r$ r% �pkcs7_to_certs/ s2 ��
r� c
C sF z t | � W n4 ty@ } z tjt|�d��W Y d}~n
d}~0 0 dS �zO
Perform cert validation by trying to load it via python-cryptography.
)�errorN)r� r! r �CertificateFormatErrorrw �r# �er$ r$ r% � validate_pem_x509_certificateU s r� c
C sF z t | � W n4 ty@ } z tjt|�d��W Y d}~n
d}~0 0 dS r� )r0 r! r r� rw r� r$ r$ r% � validate_der_x509_certificate_ s r� c
C s~ z@t |d��"}|�| �tj�� W d � n1 s40 Y W n8 ttfyx } z tjt |�d��W Y d}~n
d}~0 0 dS )zm
Write the certificate to a file in PEM format.
:param cert: cryptograpy ``Certificate`` object
�wbN��reason)
r� �writer' r r� �IOError�OSErrorr � FileErrorrw )r# r� �fpr� r$ r$ r% �write_certificatei s
4r� c
C s� zbt |d��D}|dur&t�|�� |� | D ]}|�|�tj�� q*W d � n1 sV0 Y W n8 tt fy� } z t
j t |�d��W Y d}~n
d}~0 0 dS )z�
Write a list of certificates to a file in PEM format.
:param certs: a list of IPACertificate objects to be written to a file
:param filename: a path to the file the certificates should be written into
r� Nr� )
r� �os�fchmod�filenor� r' r r� r� r� r r� rw )r� r� r� r� r# r� r$ r$ r% �write_certificate_listw s 6r� c
C s� |durt �|�}nt �� }zXt|d��:}t�|�� d� |�| jt j
t j |d�� W d � n1 sh0 Y W n8 t
tfy� } z tjt|�d��W Y d}~n
d}~0 0 dS )a
Write a private key to a file in PEM format. Will force 0x600 permissions
on file.
:param priv_key: cryptography ``PrivateKey`` object
:param passwd: ``bytes`` representing the password to store the
private key with
Nr� i� )Zencryption_algorithmr� )r ZBestAvailableEncryptionZ NoEncryptionr� r� r� r� r� Z
private_bytesr r� r ZPKCS8r� r� r r� rw )Zpriv_keyr� �passwdZenc_algr� r� r$ r$ r% �write_pem_private_key� s �*r� c @ sb e Zd Ze�e�de�� je �
e j e j d�d��e�de�
e�� �je �
e j e j d�d���ZdS )�_PrincipalNamez name-typer �Z explicitTag� name-stringr N)r� r� r� r �
NamedTypes� NamedTyper
�Integer�subtyper
�Tag�tagClassContext�tagFormatSimpleZ
SequenceOfr �
GeneralString�
componentTyper$ r$ r$ r% r� � s ���r� c @ sZ e Zd Ze�e�de�� je �
e j e j d�d��e�de
� je �
e j e j d�d���ZdS )�_KRB5PrincipalName�realmr r� �
principalNamer N)r� r� r� r r� r� r r� r� r
r� r� r� r� r� r$ r$ r$ r% r� � s � ��r� c C s` t j| t� d�d }t|d ��dd��dd�}|d d }d
�d d � |D ��}d
||f }|S )Nr� r r� �\�\\�@�\@r� r� �/c s s. | ]&}t |��d d��dd��dd�V qdS )r� r� r� z\/r� r� N)rw r^ )rl �nr$ r$ r% rm � s ���z,_decode_krb5principalname.<locals>.<genexpr>z%s@%s)r rK r� rw r^ �join)r� Z principalr� r r$ r$ r% �_decode_krb5principalname� s �
� r� c s e Zd Z� fdd�Z� ZS )�KRB5PrincipalNamec s t t| ��||� t|�| _d S rR )�superr� r& r� r �r" �type_idrH �� __class__r$ r% r& � s zKRB5PrincipalName.__init__�r� r� r� r& �
__classcell__r$ r$ r� r% r� � s r� c s e Zd Z� fdd�Z� ZS )�UPNc s2 t t| ��||� ttj|t�� d�d �| _d S )Nr� r ) r� r� r& rw r rK r Z
UTF8Stringr r� r� r$ r% r& � s �z UPN.__init__r� r$ r$ r� r% r� � s r� c c sH | D ]>}t |tjj�r<t�|jjtjj�}||j|j�V q|V qdS )z�
Process python-cryptography GeneralName values, yielding
OtherName values of more specific type if type is known.
N) r2 r/ � general_name� OtherName�OTHERNAME_CLASS_MAP�getr� rk rH )r� r� �clsr$ r$ r% �process_othernames� s �r� c
C s\ g }| � � D ]>}|D ]4}t�t|d �tt�|d �d ��}|�|� qq t�t� |��S )N�typerH r )
r� r/ Z
NameAttribute�_pyasn1_to_cryptography_oidrw r rK r� Z
DirectoryName�Name)Zdn�attrsr� r� �attrr$ r$ r% r} � s
�r} c C s t �t| ��S rR )r/ Z RegisteredIDr� �rG r$ r$ r% r~ � s r~ c C s t �t�t| ���S rR )r/ Z IPAddress� ipaddress�
ip_addressr4 )Z octet_stringr$ r$ r% r � s �r c C s t �t| d �t| d ��S )Nztype-idrH )r/ r� r� r4 )Zonr$ r$ r% r� � s
�r� c C s t �t| ��S rR )r/ r@ rw r� r$ r$ r% r� s r� c C s dd� t jjt|�g| � D �S )z�Yield chunks of the specified size from the given string.
The input must be a multiple of the chunk size (otherwise
trailing characters are dropped).
Works on character strings only.
c s s | ]}d � |�V qdS )� N)r� )rl �spanr$ r$ r% rm rn zchunk.<locals>.<genexpr>)�sixZmoves�zip�iter)�size�sr$ r$ r% �chunk s r c C s d� td| ��S )z4Add colons between each nibble pair in a hex string.�:� )r� r )r r$ r$ r% �
add_colons s r c C s t t�| ��d��S )z*Convert bytes to a hex string with colons.zutf-8)r �binasciiZhexlifyrK )�bsr$ r$ r% �to_hex_with_colons s r c @ s. e Zd Ze�d�Zdd� Zdd� Zdd� ZdS ) �UTCr c C s dS )Nr r$ �r" Zdtr$ r$ r% �tzname" s z
UTC.tznamec C s | j S rR ��ZEROr
r$ r$ r% � utcoffset% s z
UTC.utcoffsetc C s | j S rR r r
r$ r$ r% �dst( s zUTC.dstN) r� r� r� r_ Z timedeltar
r r r r$ r$ r$ r% r s
r c C s& | j d u r| jt� d�} t| �d��S )NrZ z%a %b %d %H:%M:%S %Y %Z)r[ r^ r rw �strftime)�tr$ r$ r% �format_datetime, s
r c @ s e Zd ZdZdZdS )�ExternalCATypeZgenericzms-csN)r� r� r� ZGENERIC�MS_CSr$ r$ r$ r% r 2 s r c sB e Zd ZdZd dd�Ze� Zd � fdd� Zdd� Zd d
� Z � Z
S )
�ExternalCAProfilea#
An external CA profile configuration. Currently the only
subclasses are for Microsoft CAs, for providing data in the
"Certificate Template" extension.
Constructing this class will actually return an instance of a
subclass.
Subclasses MUST set ``valid_for``.
Nc C s
|| _ d S rR �Zunparsed_input)r" r r$ r$ r% r& C s zExternalCAProfile.__init__c sv | t urtt | ��| �S |du r(td��|�d�}z t�|d �}t�t|�W S tj j
yp t �t |� Y S 0 dS )z�Construct the ExternalCAProfile value.
Return an instance of a subclass determined by
the format of the argument.
Nzstring argument is requiredr r ) r r� �__new__r! �splitr
r@ �MSCSTemplateV2rA r� � PyAsn1Error�MSCSTemplateV1)r� r �partsZ_oidr� r$ r% r J s
zExternalCAProfile.__new__c C s | j S rR r r: r$ r$ r% r- i s z ExternalCAProfile.__getstate__c C s | � |� d S rR )r& r+ r$ r$ r% r1 l s z ExternalCAProfile.__setstate__)N)N) r� r� r� r� r& ro � valid_forr r- r1 r� r$ r$ r� r% r 7 s
r c @ s. e Zd ZdZeejjg�ZdZ dZ
dd� Z dS )� MSCSTemplatez�
An Microsoft AD-CS Template specifier.
Subclasses MUST set ext_oid.
Subclass constructors MUST set asn1obj.
Nc C s t �| j�S )z"Return DER-encoded extension data.)r rD �asn1objr: r$ r$ r% � get_ext_data s zMSCSTemplate.get_ext_data) r� r� r� r� ro r r rH r �ext_oidr r r$ r$ r$ r% r q s
r c s$ e Zd ZdZdZ� fdd�Z� ZS )r a
A v1 template specifier, per
https://msdn.microsoft.com/en-us/library/cc250011.aspx.
::
CertificateTemplateName ::= SEQUENCE {
Name UTF8String
}
But note that a bare BMPString is used in practice.
z1.3.6.1.4.1.311.20.2c sF t t| ��|� |�d�}t|�dkr.td��t�t|d ��| _ d S )Nr r z<Cannot specify certificate template version when using name.r )
r� r r& r �lenr! r Z BMPStringrw r )r" r r r� r$ r% r& � s
�zMSCSTemplateV1.__init__)r� r� r� r� r! r& r� r$ r$ r� r% r � s
r c s0 e Zd ZdZdZedd� �Z� fdd�Z� ZS )r a�
A v2 template specifier, per
https://msdn.microsoft.com/en-us/library/windows/desktop/aa378274(v=vs.85).aspx
::
CertificateTemplate ::= SEQUENCE {
templateID EncodedObjectID,
templateMajorVersion TemplateVersion,
templateMinorVersion TemplateVersion OPTIONAL
}
TemplateVersion ::= INTEGER (0..4294967295)
z1.3.6.1.4.1.311.21.7c C s" |dk s|dkr t d�| ���d S )Nr l z2Template {} version must be in range 0..4294967295)r! ri )Zdescr� r$ r$ r% �check_version_in_range� s ��z%MSCSTemplateV2.check_version_in_rangec s� t t| ��|� |�d�}t� }t|�dk s8t|�dkr@td��zjt�|d �|d< t |d �}| �
d|� ||d < t|�dkr�t |d �}| �
d
|� t |d �|d < W n t j j
y� td ��Y n0 || _d S )
Nr r � z[Incorrect template specification; required format is: <oid>:<majorVersion>[:<minorVersion>]r �
templateIDr �major�templateMajorVersion�minor�templateMinorVersionz/Could not parse certificate template specifier.)r� r r& r �CertificateTemplateV2r" r! r
r@ �intr# rA r� r r )r" r r �objr& r( r� r$ r% r& � s&
� zMSCSTemplateV2.__init__) r� r� r� r� r! � staticmethodr# r& r� r$ r$ r� r% r � s
r c @ s> e Zd Ze�e�de�� �e�de�� �e� de�� ��Z
dS )r* r% r' r) N) r� r� r� r r� r� r
r@ r� ZOptionalNamedTyper� r$ r$ r$ r% r* � s
�r* )N)N)N)eZ
__future__r r� r r_ �enumr� r� r� Z cryptographyr r/ Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Z,cryptography.hazmat.primitives.serializationr r r r rA Z pyasn1.errorZ pyasn1.typer
r r r
Zpyasn1.codec.derr r Zpyasn1_modulesr r r� Z urllib3.utilr � ImportErrorZurllib3.packagesZipalibr Zipapython.dnsutilr r� r( �compiler� r� r� ZEKU_SERVER_AUTHZEKU_CLIENT_AUTHZEKU_CODE_SIGNINGZEKU_EMAIL_PROTECTIONZEKU_PKINIT_CLIENT_AUTHZEKU_PKINIT_KDCrt ZEKU_PLACEHOLDERZSAN_UPNZSAN_KRB5PRINCIPALNAMEr r� r0 r� r� r� r� r� r� r� r� r� r� r� �Sequencer� r� r� r� r� r� r� r� r� r} r~ r r� r� r r r r[ r r �Enumr r r r r r* r$ r$ r$ r% �<module> s� �� p
&
�
:4