| Server IP : 198.38.94.13 / Your IP : 216.73.217.33 Web Server : Apache System : Linux d4744.dxb1.stableserver.net 5.14.0-611.49.1.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Apr 21 16:39:08 EDT 2026 x86_64 User : revivere ( 1140) PHP Version : 8.2.33 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/ |
Upload File : |
o
;j�/ � @ s d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dl m Z m
Z
m Z d dl m
Z
d dlmZmZ d dlZd dlmZ d dlmZ d dlmZmZ d d lmZmZm Z m Z m Z d d
l m Z m!Z! d d l"m#Z# d dl$Z%d dl&m' m(Z( d dl)Z%d dl*Z%d d l+m,Z,m-Z- zd dl.Z.d
Z/W n e0y� dZ/Y nw e1dd� ej2�3d�D ��Z4e�5e6�Z7e(�8dddddddddd� �Z9e(�8ed ej:j;fd ej:j<fd ej:j=fd ej:j>fd ej:j?fd!ej:j@fd"ej:jAfd#ej:jBfd$ej:jCfd%ej:jDfd&ej:jEfd'ej:jFfg ��ZGe(�8i d(d)�d*d+�d,d-�d.d/�d0d1�d2d3�d4d5�d6d7�d8d9�d:d;�d<d=�d>d?�d@dA�dBdC�dDdE�dFdG�dHdI�dJdKdLdMdN���ZHe(�8i d(ejIjJ�d*ejIjK�d,ejIjL�d.ejIjM�d0ejIjN�d2ejIjO�d4ejIjP�d6ejIjQ�d8ejIjR�d:ejIjS�d<ejIjT�d>ejIjU�d@ejIjV�dBejIjW�dDejIjX�dFejIjY�dHd�dejIjZejIj[ejIj\dN���Z]e(�8ej^j_ej^j`ej^jadO��Zbe(�8e�cdP�e�cdQ�e�cdR�e�cdS�e�cdT�e�cdU�e�cdV�e�cdW�e�cdX�e�cdY�e�cdZ�e�cd[�e�cd\�d]�
�Zde(�8ejejfejejge#jhd^��Zid_Zjd`ZkdaZlG dbdc� dce
�ZmddZndeZodfZpG dgdh� dhe-�ZqG didj� djeq�ZrG dkdl� dleq�ZsG dmdn� dneq�ZtG dodp� dpeq�ZuG dqdr� dreq�ZvG dsdt� dte-�ZwG dudv� dvew�ZxG dwdx� dxew�ZyG dydz� dzew�Zzd{d|� Z{ }�d"d~d�Z|�d#d�d��Z} � �d$d�d��Z~�d%d�d��Z�d&d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z��d'd�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z��d(d�d��Z��d'd�d��Z��d)d�d��Z��d'd�d��Z��d'd�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z��d*d�d��Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d Z�d�dĄ Z�d�dƄ Z�d�dȄ Z�d�dʄ Z�d�d̄ Z�d�d΄ Z�d�dЄ Z�d�d҄ Z�d�dԄ Z�d�dք Z�d�d Z�d�dڄ Z�d�d܄ Z�d�dބ Z�d�d� Z�d�d� Z�d�d� Z�e(�8i d(e��d*e��d,e��d.e��d0e��d2e��d�e��d4e��d6e��d8e��d�e��d:e��d<e��d>e��d@e��dBe��dDe��e�e�e�e�e�e�e�d���Z��d'd�d�Z�d�d� Z�d�d� Z�d�d� Z�d�d� Z��d+d�d�Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z�d�d�� Z��d �d� Z��d�d� Z��d�d� Z��d�d� Z��d�d � Z��d
�d � Z��d �d
� Z��d�d� Zd�d� ZÐd�d� ZĐd�d� ZŐd�d� ZƐd�d� Zǐd�d� ZȐd �d � Zɐd �d � Zʐd �d!� Z�e(�8i ej�e��ej�e��ej�e��ej�e��ej�e��ej�e��ej�e��ej�e��ej�e��ej�e��ej�e��ej�eej�eÓej�eēej�eœej�eƓej�eǓej�e�ej�e�ej�e�ej�e�ej�e�i��Z�dS (, � N)� OrderedDict)�datetime� timedelta�timezone)�Enum)�urlparse�
urlunparse)�x509)�InvalidSignature)�hashes�
serialization)�ec�ed448�ed25519�padding�rsa)�pkcs7�pkcs12)�SubjectInformationAccessOID)�CommandExecutionError�SaltInvocationErrorTFc c s � | ]}t |�V qd S �N)�int��.0�x� r �C/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/x509.py� <genexpr>! � � r �.)�
commonName)Z localityName)ZstateOrProvinceName)ZorganizationName)ZorganizationUnitName)Z givenName)Zsurname)ZEmailZ emailAddress)Z serialNumber) �CN�L�ST�O�OU�GN�SN�MAIL� SERIALNUMBER�Cr$ r# ZSTREETr% r& r" r) r( r' ZUIDr* �basicConstraints)zX509v3 Basic Constraints�keyUsage)zX509v3 Key Usage�extendedKeyUsage)zX509v3 Extended Key Usage�subjectKeyIdentifier)z X509v3 Subject Key Identifier�authorityKeyIdentifier)z X509v3 Authority Key Identifier�
issuerAltName)z X509v3 Issuer Alternative NameZissuserAltName�authorityInfoAccess)z Authority Information Access�subjectAltName)z X509v3 Subject Alternative Name�crlDistributionPoints)z X509v3 CRL Distribution Points�issuingDistributionPoint)z!X509v3 Issuing Distribution Point�certificatePolicies)zX509v3 Certificate Policies�policyConstraints)zX509v3 Policy Constraints�inhibitAnyPolicy)zX509v3 Inhibit Any Policy�nameConstraints)zX509v3 Name Constraints�noCheck)z
OCSP No Check�
tlsfeature)z TLS Feature� nsComment)zNetscape Comment)zNetscape Certificate Type)zX509v3 CRLNumber)zX509v3 Delta CRL Indicator)zx509v3 Freshest CRL)�
nsCertType� cRLNumber�deltaCRLIndicator� freshestCRL)�certificateIssuer� CRLReason�invalidityDatez1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2z1.3.6.1.5.5.7.3.3z1.3.6.1.5.5.7.3.4z1.3.6.1.5.5.7.3.8z1.3.6.1.5.5.7.3.9z1.3.6.1.4.1.311.20.2.2z1.3.6.1.5.2.3.5z1.3.6.1.5.5.7.3.17z1.3.6.1.4.1.311.2.1.21z1.3.6.1.4.1.311.2.1.22z1.3.6.1.4.1.311.10.3.1z1.3.6.1.4.1.311.10.3.4)
Z
serverAuthZ
clientAuthZ codeSigningZemailProtectionZ timeStampingZ OCSPSigningZmsSmartcardLoginZ pkInitKDCZipsecIKEZ msCodeIndZ msCodeComZ msCTLSignZmsEFS)�OCSPZ caIssuersZ caRepository)r, r- r. r/ r0 r1 r2 r3 r4 r6 r7 r8 r9 r: r; r< r= )r0 r2 r> r? r@ r1 r5 )r2 r0 r1 r4 c @ s e Zd ZdZdZdZdZdS )�KEY_TYPE� � � � N)�__name__�
__module__� __qualname__�RSA�EC�ED25519�ED448r r r r rE � s
rE s
-----BEGINs -----ENDz%Y-%m-%d %H:%M:%Sc @ � e Zd ZdZdS )�DeserializationErrorz�
Raised when the input format of a private key/certificate/CSR/CRL is unsupported
or could not be loaded for various reasons.
N�rJ rK rL �__doc__r r r r rR � � rR c @ rQ )�CertDeserializationErrorzv
Raised when the input format of a certificate is unsupported
or could not be loaded for various reasons.
NrS r r r r rV � rU rV c @ rQ )�PrivDeserializationErrorzv
Raised when the input format of a private key is unsupported
or could not be loaded for various reasons.
NrS r r r r rW � rU rW c @ rQ )�PubDeserializationErrorzu
Raised when the input format of a public key is unsupported
or could not be loaded for various reasons.
NrS r r r r rX � rU rX c @ rQ )�CRLDeserializationErrorzn
Raised when the input format of a CRL is unsupported
or could not be loaded for various reasons.
NrS r r r r rY � rU rY c @ rQ )�CSRDeserializationErrorzn
Raised when the input format of a CSR is unsupported
or could not be loaded for various reasons.
NrS r r r r rZ � rU rZ c @ rQ )�
PasswordErrorzq
Raised when a private key or PKCS#12 container could be loaded, but the provided password has an issue.
NrS r r r r r[ � rU r[ c � e Zd ZdZ� fdd�Z� ZS )�InvalidPasswordzt
Raised when the provided password could not be used to decrypt an encrypted private key/PKCS#12 container.
c � t � �d� d S )Nz&Bad decrypt - is the password correct?��super�__init__��self�� __class__r r ra � zInvalidPassword.__init__�rJ rK rL rT ra �
__classcell__r r rd r r] s r] c r\ )�MissingPasswordz�
Raised when a private key is encrypted, but no password was provided.
At least in cryptography releases 46+, this cannot be determined for PKCS#12 format,
where it's always InvalidPassword.
c r^ )Nz4Private key is encrypted. Please provide a password.r_ rb rd r r ra rf zMissingPassword.__init__rg r r rd r ri
s ri c r\ )�SuperfluousPasswordz�
Raised when a private key is not encrypted, but a password was provided.
Cannot be determined for PKCS#12 format, where it's always InvalidPassword.
c r^ )Nz7Private key is unencrypted. Please remove the password.r_ rb rd r r ra rf z SuperfluousPassword.__init__rg r r rd r rj s rj c C s� t �� D ]"\}}|D ]}|| v r%tjj�dd|� d|� �� | �|�| |< q
qt�� D ]"\}}|D ]}|| v rLtjj�dd|� d|� �� | �|�| |< q1q+| S )z�
Ensures the deprecated long form of Name Attribute and
extension definitions is still recognized, but warned about.
� Potassium�Found �4 in keyword args. Please migrate to the short name: )�NAME_ATTRS_ALT_NAMES�items�salt�utils�versions�
warn_until�pop�EXTENSIONS_ALT_NAMES)�kwargs�name�
long_names� long_name�extnamer r r �ensure_cert_kwargs_compat s* ������r{ � c
K s. d}d}|s
t | |d�} nd} t| �} d}|rt|�}|r"t|�}nd}| �� }|}|r/| }n |r<t ||d�}|�� }n|rCt|�}n |rJ|�� }ntd��|s]|s]t|�� | �s]td��tj | |d�}t
|ph|
�}|� |�� |st|j
n|�}|
r�t�|
t�jtjd�ntjtjd �}
| r�t�| t�jtjd�n tjtjd �t| d
� } |�|
��| �}g }tD ]+}|tvr�q�||
v r�|
| }|du r�q�t|||||d �\}}|j||d �}|� |� q�|�rt� � D ]-\}}t ||v |tv|t v f�r�q�z|j �!|�}|�|j"|j#�}W q� tj$�y Y q�w || ||fS )
z�
Parse the input into a CertificateBuilder, which can be used
to sign the certificate or be inspected for changes.
Also returns signing private key (if available), associated private key
and associated signing certificate.
NF��
passphraseTz�This certificate is not self-signed (signing_cert is set) and thus needs public_key, private_key or csr to derive public key to sign�?Signing private key does not match the certificate's public key)�
serial_number�
public_key��tzinfo��tz��days)�ca_crt�subject_pubkey�ca_pub��critical)%� load_privkey�_get_serial_number�load_csr� load_certr� � load_pubkeyr �is_pair�cx509ZCertificateBuilder�_get_dn� subject_name� issuer_name�subjectr �strptime�TIME_FMT�replacer �utc�nowr Znot_valid_before�not_valid_after�EXTENSIONS_OID� CERT_EXTS�_create_extension�
add_extension�appendro �any�
CSR_FORBIDDEN�
extensionsZget_extension_for_oid�valuer� �ExtensionNotFound)�signing_private_keyZ skip_load_signing_private_key� signing_private_key_passphrase� signing_certr� � private_key�private_key_passphrase�csrr� r� Z
not_before� not_after�
days_validrv r� Z self_signedZprivate_key_loaded�builderr� Z ext_presentrz �val�extr� �oidr r r � build_crt8 s� �
�
��� ���
�� ���
��
��� � r� c K s� t | |d�} | �� }t�� }t|p|�}|�|�}t�� D ]%\}}t|t v|t
v f�r,q ||v rBt ||| |d�\} }
|j | |
d�}q || fS )z�
Parse the input into a CertificateSigningRequestBuilder, which can be used
to sign the CSR or be inspected for changes.
Also returns associated private key.
r} )r� r� )
r� r� r� Z CertificateSigningRequestBuilderr� r� r� ro r� r� r� r� r� ) r� r� r� rv r� r� r� rz r� r� r� r r r � build_csr� s,
��
���r� �d c C s0 |pi }|r
t |�}t| |d�} |r t|�� | �s td��t�� }|r)|�|j�}|� t
j t j
d��}|�t
j t j
d�t|d� �}|D ]�}d } }
} d|v r]t
�|d t�jt j
d�}
d|v re|d } d |v r�t |d �} | j} z| j}
W n ty� | jjt j
d�}
Y nw | s�td
��t| �} |
r�|s�t
j t j
d�|
kr�qDd |v r�t
�|d t�jt j
d�} nt
j t j
d�} tj| | d �}
|�d
i ��� D ] \}}|tvr�t � d|� q�t ||�\}}|
j ||d�}
q�|� |
�!� �}qD|�� D ] \}}|t"v�rt � d|� q�t |||d�\}}|j ||d�}q�|| fS )z�
Parse the input into a CertificateRevocationListBuilder, which can be used
to sign the CRL or be inspected for changes.
Also returns signing private key.
r} r r� r� Nr� r� r� � certificatez!Need serial_number or certificate�revocation_date)r� r� r� z(Ignoring invalid CRL entry extension: %sr� z"Ignoring invalid CRL extension: %s)r� )#r� r� r� r� r r� Z CertificateRevocationListBuilderr� r� Z last_updater r� r r� Z next_updater r� r� r� r� Znot_valid_after_utc�AttributeErrorr� r� ZRevokedCertificateBuilder�getro �EXTENSIONS_CRL_ENTRY_OID�log�warningr� r� Zadd_revoked_certificate�build�CRL_EXTS)r� Zrevokedr� r� Zinclude_expiredr� r� r� Zrevr� r� r� Zrev_certZ revoked_certrz r� r� r� r r r � build_crl� s� �� � �
����
�r� � c C s | dvrt d��tjd| d�S )z%
Generate an RSA private key
)r� i i z4RSA key size must be either 2048, 3072 or 4096 bits.i )Zpublic_exponentZkey_size)r r �generate_private_key�Zkeysizer r r �generate_rsa_privkey. s
�r� � c C s* | dvrt d��t�ttd| � d��� �S )z0
Generate an elliptic curve private key
)r� i� i z.EC key size must be either 256, 384, 521 bits.ZSECPZR1)r r
r� �getattrr� r r r �generate_ec_privkey9 s r� c C �
t j�� S )z)
Generate an ed25519 private key
)r �Ed25519PrivateKey�generater r r r �generate_ed25519_privkeyB �
r� c C r� )z'
Generate an ed448 private key
)r �Ed448PrivateKeyr� r r r r �generate_ed448_privkeyI r� r� c
C s6 z t t| �� �� W S ty } ztd�|�d}~ww )zB
Returns an instance of a hashing algorithm, if available
zPThe selected hashing algorithm does not exist in the cryptography python libraryN)r� r �upperr� r )�digest�errr r r �get_hashing_algorithmP s ����r� c C sz d}t | tjtjf�r
d}t | tjtjf�rd}t | tjtj f�r#d}t | t
j t
j f�r.d}|du s4|r6|S t
t|�� �S )zq
Checks which type of private/public key a class instance is.
Returns None if it is not a valid key.
Nr r
r r )�
isinstancer �
RSAPrivateKey� RSAPublicKeyr
�EllipticCurvePrivateKey�EllipticCurvePublicKeyr r� �Ed25519PublicKeyr r� �Ed448PublicKeyr� rE r� )�key� as_string�key_typer r r � get_key_type] s r� c C s& t |�}|du r td��t| |�� �S )z>
Checks whether a public key belongs to a private key
N�Did not recognize key type)r� r � match_pubkeyr� )�pubkeyZprivkeyZ privkey_typer r r r� p s r� c C sd t | �}t |�}|du s|du rtd��||krdS |tjtjfv r*| �� |�� kS t| �t|�kS )z5
Checks whether two public keys are the same
Nr� F)r� r rE rM rN Zpublic_numbers�to_pem)Zpubkey_aZpubkey_bZ
pubkey_a_typeZ
pubkey_b_typer r r r� z s r� c sp � s|S t �� �� t�� D ]"\}}|D ]}||v r.tjj�dd|� d|� �� |�|�||< qq
t �� D ]"\}}|D ]}||v rUtjj�dd|� d|� �� |�|�||< q:q4d|v r�t
� fdd�t D ��rl|�d� nEd� vsyt � d t
tf�szn7z|d �� d � � �d� W n& ttfy� z� d |d |d< � �d� W n ty� Y nw Y nw |�� � |S )z�
Merge a signing policy, taking care that the different methods
of specifying RDN do not lead to unexpected results.
This is found in utils since the state module needs
access as well to check for expected changes.
rk rl rm r� c 3 s � | ]}|� v V qd S r r r ��policyr r r � r z'merge_signing_policy.<locals>.<genexpr>)�copy�deepcopyrn ro rp rq rr rs rt ru r� �NAME_ATTRS_OIDr� �dict�list�updater� �
ValueError� TypeError)r� rv rw rx ry rz r r� r �merge_signing_policy� sT
��� ��� ���
r� c C �^ z | j tjjtjjd�W S ttfy Y nw z| � tjj�W S ttfy. Y td��w )z�
Returns the PEM-encoded serialization of a public key, certificate,
certificate signing request or certificate revocation list.
This does not work for private keys.
��formatz$Could not serialize parameter to PEM) � public_bytesr �EncodingZPEM� PublicFormat�SubjectPublicKeyInfor� r� r �Z pub_or_certr r r r� � � ���r� c C r� )z�
Returns the DER-encoded serialization of a public key, certificate,
certificate signing request or certificate revocation list.
This does not work for private keys.
r� z$Could not serialize parameter to DER) r� r r� ZDERr� r� r� r� r r� r r r �to_der� r� r� c
C s� t | d�r$t| tjtjtjtj f�r|r| ddfS | S t
d| j j � ���t
| �} |dur0|�� nd}t| v r|ztj| |d�} |rF| ddfW S | W S ttfy{ } z%t|�}d|v s^d|v rbt� |�d|v rjt� |�d |v rrt� |�td
�|�d}~ww ztj| |d�}|js�t d ��|r�|jd |fW S |jW S ty� } zt|�}d|v s�d
|v r�t� |�W Y d}~n(d}~w ty� } zdt|�v r�t� |�W Y d}~n
d}~w t y� Y nw ztj | |d�} |r�| ddfW S | W S t�y } zt|�}d|v �sd|v �r
t� |�W Y d}~td��d}~w t�yB } z t|�}d|v �r,t� |�d|v �r5t� |�W Y d}~td��d}~ww )z�
Return a private key instance from
* a class instance
* a file path on the local system
* a string (PEM)
* bytes (hex, base64, raw)
Valid encodings are PEM, DER and PKCS12.
Z
private_bytesNz.Passed object is not a known private key, but )�password�pem� Bad decryptzIncorrect passwordzprivate key is encryptedz but private key is not encryptedz&Could not load PEM-encoded private keyz3PKCS12-encoded blob does not contain a private key.r �Invalid password�derz private key is not encryptedz>Could not deserialize binary data, neither as DER nor PKCS#12.) �hasattrr� r r� r
r� r r� r r� r re rJ �load_file_or_bytes�encode� PEM_BEGINr Zload_pem_private_keyr� r� �strr] ri rj rW r � load_pkcs12r� r r� Zload_der_private_key)�pkr~ � get_encodingr� �err_str�loadedr r r r� � s�
��
� ���� � �� �� �
� ���
����r� c
C s� t | d�r t| tjtjtjtj f�r| S t
d| j j � ���t
| �} t| v r=zt�| �W S ty< } ztd�|�d}~ww zt�| �W S tyT } ztd�|�d}~ww )z�
Return a public key instance from
* a class instance
* a file path on the local system
* a string (PEM)
* bytes (hex, base64, raw)
Valid encodings are PEM and DER.
r� z'Passed object is not a public key, but z&Could not load PEM-encoded public key.Nz&Could not load DER-encoded public key.)r� r� r r� r
r� r r� r r� r re rJ r� r� r Zload_pem_public_keyr� rX Zload_der_public_key)r r r� r r r r� B s>
�� � ����
��r� c
C s� t | tj�r|r | g fS |r| ddfS | S t| �} t| v r�t| �}d|d vrtz9t�|�d��}|s4|rNg }|D ]}z
|�t�|�� W q8 t yM Y q8w |rU||fW S |r^|d|dfW S |W S t t
fys } zt d�|�d}~ww z#t �
|d �}|r�|�d�|fW S |r�|�d�d|dfW S |�d�W S t y� } zt d�|�d}~ww zt�| �}|r�|dddfW S |r�|g fW S |W S t y� Y nw z8|dur�t |t�s�|�� }t�| |�}|s�|r�d d
� |jD �}|r�|jj|fW S |r�|jjd ||fW S |jjW S t �y' } zt|�} d | v �sd
| v �r t� �W Y d}~nd}~w t�y0 Y nw z"t �| �}|�rB|�d�|fW S |�rO|�d�d|dfW S |d W S t �y` Y t d��w )z�
Return a certificate instance from
* a class instance
* a file path on the local system
* a string (PEM)
* bytes (hex, base64, raw)
Valid encodings are PEM, DER, PKCS7 (as PEM and DER) and PKCS12.
Ns -----BEGIN PKCS7r r� z'Could not load PEM-encoded certificate.Z pkcs7_pemz&Could not load PEM-encoded PKCS#7 blobr� c S � g | ]}|j �qS r )r� r r r r �
<listcomp>� � z load_cert.<locals>.<listcomp>r r� r� Z pkcs7_derzFCould not deserialize binary data, neither as DER nor PKCS#7, PKCS#12.)r� r� � Certificater� r� �
split_pemsZload_pem_x509_certificatert r� r� �
IndexErrorrV r Zload_pem_pkcs7_certificatesZload_der_x509_certificate�bytesr� r r Zadditional_certs�certr� r r] r� Zload_der_pkcs7_certificates)
r
r~ Z
load_chainr �pemsr �chainr� r� r r r r r� h s�
�
���� ����
�
���
��r� c
C � t | tj�r|r
| ddfS | S t| �} t| v r8zt�| �}|r$|dfW S |W S ty7 } ztd�|�d}~ww zt�| �}|rE|dfW S |W S tyX } ztd�|�d}~ww )z�
Return a CRL instance from
* a class instance
* a file path on the local system
* a string (PEM)
* bytes (hex, base64, raw)
Valid encodings are PEM and DER.
Nr� z7Could not load PEM-encoded certificate revocation list.r� z7Could not load DER-encoded certificate revocation list.) r� r� ZCertificateRevocationListr� r� Zload_pem_x509_crlr� rY Zload_der_x509_crl)Zcrlr r r� r r r �load_crl� �@
����
����r c
C r )z�
Return a CSR instance from
* a class instance
* a file path on the local system
* a string (PEM)
* bytes (hex, base64, raw)
Valid encodings are PEM and DER.
Nr� z7Could not load PEM-encoded certificate signing request.r� z7Could not load DER-encoded certificate signing request.) r� r� ZCertificateSigningRequestr� r� Zload_pem_x509_csrr� rZ Zload_der_x509_csr)r� r r r� r r r r� � r r� c C s t |�}|tjkrBz.| jjdkr(|�| j| jt� t�
| j �tj j �| j � W dS |�| j| jt�
� | j � W dS tyA Y dS w |tjkrbz|�| j| jt�| j �� W dS tya Y dS w |tjtjfv r�z |�| j| j� W dS ty Y dS w td��)z�
Verifies that the signature on a certificate was made
by a public key.
This functionality is currently not exposed by cryptography
since it does not imply the certificate chain is valid.
z1.2.840.113549.1.1.10TFzAInvalid public key type, can only process rsa, ec, ed25519, ed448)r� rE rM Zsignature_algorithm_oid�
dotted_stringZverifyZ signatureZtbs_certificate_bytesr ZPSSZMGF1Zsignature_hash_algorithmZAUTOZPKCS1v15r
rN r
ZECDSArO rP r )r
r� r� r r r �verify_signature sX
���� �
� � ��r c C s( zt j�| �W S ttfy Y dS w )z�
A wrapper around os.path.isfile that ignores ValueError exceptions which
can be raised if the input to isfile is too long.
F)�os�path�isfiler� r� )r r r r r F s �r c C sn t jj�| �} g }g }| �d�D ]$}|�� sq|�t�r |g}q|�|� |�t �r4|�d�
|�� g }q|S )zH
Returns a list of PEM strings from a possibly concatenated one
T� ) rp rq Z stringutils�to_bytes�
splitlines�strip�
startswithr� r� �PEM_END�join)r �splitsZcur�liner r r r
R s
�r
c C s� t | �r tjj�| d�� }|�� } W d � n1 sw Y t| t�ra| �d�r4t �
| dd� �} n-t � � | v r?| �
� } n"zt�| �} W n ty` zt �
| �} W n ty] Y nw Y nw t| t�sjtd��| S )z�
Tries to load a reference and return its bytes.
Can be a file path on the local system, a string and bytes (hex/base64-encoded, raw)
�rbNzb64:rI zpCould not load provided source. You need to pass an existing file, (PEM|hex|base64)-encoded string or raw bytes.)r rp rq �filesZfopen�readr� r r �base64� b64decoder� �decoder� r �fromhexr� r )Zfob�fr r r r� g s0
�
���
�r� c C s* | t vr td| � ���t | ||||d�S )NzUnknown extension )r� r� r� )�EXTENSION_BUILDERSr )rw r� r� r� r� r r r r� � s
�r� c
K s z| � dd�}W n ty d}Y nw t| t�rNz t| �� �\} }| d dk| d< d| v r6t| d �| d< W n ttfyM } zt d|� ��|�d }~ww zt
� | d | � d��|fW S typ } zt d|� ��|�d }~w t tfy� } zt |�|�d }~ww )Nr� F�ca�true�pathlenz+Invalid configuration for basicContraints: z-Undefined required key for basicConstraints: )
r� r� r� r � _deserialize_openssl_confstring�lowerr �KeyErrorr� r r� �BasicConstraintsr� �r� rv r� r� r r r �_create_basic_constraints� sF �
���������
��r2 c
K s~ d| v }d| v d| v d| v d| v d| v d| v d| v d | v d
| v d � }z t jd i |��|fW S ty> } zt|�|�d }~ww )
Nr� �digitalSignature�nonRepudiation�keyEncipherment�dataEncipherment� keyAgreement� keyCertSign�cRLSign� encipherOnly� decipherOnly) �digital_signature�content_commitment�key_encipherment�data_encipherment�
key_agreement�
key_cert_sign�crl_sign�
encipher_only�
decipher_onlyr )r� �KeyUsager� r �r� rv r� �argsr� r r r �_create_key_usage� s" �
��rH c K sx d| v }t | t�rt| �\} }t| �} t | t�s| g} g }| D ]}|dkr&q |�t�|�p2tt|��� q t� |�|fS �Nr� )
r� r r- r� r� �EXTENDED_KEY_USAGE_OIDr� �_get_oidr� �ExtendedKeyUsage)r� rv r� �usages�usager r r �_create_extended_key_usage� s
rO c
K s� d| v rt d��| dkr-|std��z tj�|�dfW S ty, } ztd�|�d }~ww t| t�rOz t� | �
dd��} W n t yN } zt d �|�d }~ww t| t�sXt d
��t�| �dfS ) Nr� z3subjectKeyIdentifier must be marked as non-critical�hashz@Cannot calculate digest for subjectKeyIdentifier: missing pubkeyFz5subjectKeyIdentifier: subject_pubkey was not a pubkey�:� z Value must be precomputed hashz&Value must be a (hex-)digest or pubkey) r � RuntimeErrorr� �SubjectKeyIdentifierZfrom_public_keyr� r� r r r' r� r� )r� r� rv r� r r r � _create_subject_key_identifier� s: �
�����
��
rU c
K s� d| v rt d��|s|std��t| t�rt| �\} }d d d d�}d| v r}|rRz
|j�tj�j j
|d< W n tj yI tj �
|�� �j|d< Y n tyQ Y nw |d sm|rmz tj �
|�j|d< W n tyl Y nw | d dkr}|d d u r}td��| �d �dks�d | v r�|d d u r�zt�|j�g|d
< |j|d < W n' ttfy� } zd |d
< |d < | d dkr�td �|�W Y d }~nd }~ww |s�t d
��tj di |��dfS )Nr� z5authorityKeyIdentifier must be marked as non-criticalzDNeed CA certificate or CA pubkey to calculate authorityKeyIdentifier)�key_identifier�authority_cert_issuer� authority_cert_serial_number�keyidrV �alwayszICould not retrieve authorityKeyIdentifier keyid, but it was set to always�issuerrW rX z\Could not add authority_cert_issuer and authority_cert_serial_number, but was set to always.z'authorityKeyIdentifier cannot be empty.Fr )r rS r� r r- r� �get_extension_for_classr� rT r� r� r� �AuthorityKeyIdentifierZfrom_issuer_public_keyr� rV � Exceptionr r� �
DirectoryNamer[ r� r� r� )r� r� r� rv �_rG r� r r r � _create_authority_key_identifier� s� ��
��
��
� � �
� �� �� ��� ra c K � t | |�\}}t�|�|fS r )�_parse_issuer_general_namer� �IssuerAlternativeName�r� r� rv �parsedr� r r r �_create_issuer_alt_name) � rg c K rb r )rc r� �CertificateIssuerre r r r �_create_certificate_issuer. rh rj c
C sV d| v }t | t�rAg }| D ].}t |t�r-d|v r-|jddd�\}}|�|�� |�� f� q
t |t�r;|�t|�� �� q
t |�} nt | t�rRt
| dd�\} }t | �} g }t dd� | D ��r�|sct d ��z|�t
�|j�tj�jj�� t d
d� | D ��} W n" tjy� } zt|�|�d }~w ty� } ztd �|�d }~ww |�t| �� ||fS ) Nr� rQ rF ��maxsplitT��multiplec s s � | ]}|d kV qdS ))r[ r� Nr r r r r r C r z-_parse_issuer_general_name.<locals>.<genexpr>z,Need CA certificate to copy to issuerAltNamec s s � | ] }|d dkr|V qdS )r r[ Nr r r r r r O s � zpIt seems your version of cryptography does not have an internal API that the issuer:copy functionality relies on)r� r� r �splitr� r r� �extendro �tupler- r� rS r� r� r� r\ r� �SubjectAlternativeName�_general_namesr� r r� �_parse_general_names) r� r� r� �list_r �k�vrf r� r r r rc 3 sR
�
���
�����rc c K s� t | t�rdd� | �d�D �} nt | t�r dd� | �� D �} n t | t�r+dd� | D �} g }| D ]3\}}z
t�|�p>tt|��}W n t yT } zt d|� ��|�d }~ww t
|�}|� t �
||�� q/t �|�dfS )Nc s s* � | ]}|� � d kr|� � �d�V qdS )r� �;N�r ro r r r r r ] s �( z0_create_authority_info_access.<locals>.<genexpr>�,c s s$ � | ]
\}}|d kr||fV qdS �r� Nr �r rv rw r r r r _ s �" c s s2 � | ]}|� � D ]
\}}|d kr||fV qqdS r{ )ro )r r rv rw r r r r a s �0 zUnknown access OID: F)r� r ro r� ro r� �
ACCESS_OIDr� rK r �_get_gnr� r� ZAccessDescription�AuthorityInformationAccess)r� rv rf r� � general_namer� r r r � _create_authority_info_access[ s"
��r� c K s� d| v }t | t�rAg }| D ].}t |t�r-d|v r-|jddd�\}}|�|�� |�� f� q
t |t�r;|�t|�� �� q
t |�} n
t | t�rNt
| dd�\} }t | �}t �
|�|fS )Nr� rQ rF rk Trm )r� r� r ro r� r r� rp ro rq r- rt r� rr )r� rv r� ru r rv rw rf r r r �_create_subject_alt_namen s
�
r� c K s t | �\}}t�|�|fS r )�_parse_distribution_pointsr� �CRLDistributionPoints)r� rv rf r� r r r � _create_crl_distribution_points� � r� c K s t | �\}}t�|�dfS �NF)r� r� � FreshestCRL)r� rv rf r` r r r �_create_freshest_crl� r� r� c
C s� d| v }t | t�rt| dd�\} }n7t | t�rIg }| D ])}t |t�r;d|v r;|jddd�\}}|�|�� |�� f� q|dkrD|�|� qt|�} g }| D ]�}d } } }
} t |t�r�|� d�}|� d�} |� d �}
|� d
�} |r�t |t�sz|g}d d � |D �}| r�t
| �} |
r�t |
t�s�|
g}
t d
d � |
D ��}
| r�z t dd � | D ��} W n t
y� } zt| �| �d } ~ ww n|f}|r�t |�}z|�tj|| | |
d�� W qM t
tfy� } zt| �| �d } ~ ww ||fS )Nr� Trm rQ rF rk �fullname� relativename� crlissuer�reasonsc s � � | ]
}|j d dd�V qdS �rQ rF rk N�ro r r r r r � � � z-_parse_distribution_points.<locals>.<genexpr>c s r� r� r� r r r r r � s �
�c s � � | ]}t �|�V qd S r �r� � ReasonFlagsr r r r r � � � )� full_name�
relative_namer� �
crl_issuer)r� r r- r� ro r� r rq r� r� �_get_rdnrt � frozensetr� r r� ZDistributionPointr� )
r� r� ru r rv rw rf �dpointr� r� r� r� r� r r r r� � st
�
�
�����
��r� c
K s& t | t�s td��| �dd�}| �dd�}| �dd�}| �dd�}| �dd�}| �d�}| �d �}| �d
�} |rKt |t�s@|g}d d � |D �}t|�}|rQt|�}| rpz td
d � | D ��} W n tyo }
zt|
�|
�d }
~
ww zt j
||||| ||d�|fW S tt fy� }
zt|
�|
�d }
~
ww )Nz-issuingDistributionPoint must be a dictionaryr� F�onlyuser�onlyCA�onlyAA� indirectCRLr� r� �onlysomereasonsc s r� r� r� r r r r r � r� z5_create_issuing_distribution_point.<locals>.<genexpr>c s r� r r� r r r r r � r� )r� r� �only_contains_user_certs�only_contains_ca_certs�only_some_reasons� indirect_crl� only_contains_attribute_certs) r� r� r r� r� rt r� r� r� r� �IssuingDistributionPointr� ) r� rv r� r� ZonlycaZonlyaaZ indirectcrlr� r� r� r� r r r �"_create_issuing_distribution_point� sP
��� �
��r� c K sP t | t�r5z | �d�}dd� | �d�D �}dd� |D �}t�|�|fW S ty4 } ztd�|�d }~ww | �dd�}g }| � � D ]_\}}|dkrJqAg } |D ]E}
t |
t�r[| �
|
� qNd } |
�d �} |
�d
�}
|
�d �}|
r�z tj | |
d �} W n t y� } zt|�|�d }~ww | �
tj
| |d
�� qN|�
tjt|�| d�� qAt�|�|fS )Nr� c s s( � | ]}|� � d krt|� � �V qdS r{ )r rK r r r r r � s � �z/_create_certificate_policies.<locals>.<genexpr>rz c S s g | ] }t j|d d��qS )N��policy_identifier�policy_qualifiers)r� �PolicyInformation)r �pr r r r � s ��z0_create_certificate_policies.<locals>.<listcomp>zLcertificatePolicies defined as string must be a comma-separated list of OID.F� organizationZ
noticeNumbers�text)r� �notice_numbers)�notice_reference�
explicit_textr� )r� r r ro r� �CertificatePoliciesr r r� ro r� ZNoticeReferencer� Z
UserNoticer� rK )r� rv r� Zpolicy_identifiersZpolicy_informationr� rf �polid�
qualifiersZparsed_qualifiersZqual�noticer� r� r� r r r � _create_certificate_policies� sh
������
�
�� ����r� c
K s� d| v }t | t�rt| �\} }d| v rt| d �nd d| v r$t| d �nd d�}z tjdi |��|fW S ttfyF } zt|�|�d }~ww )Nr� �requireExplicitPolicy�inhibitPolicyMapping)�require_explicit_policy�inhibit_policy_mappingr ) r� r r- r r� �PolicyConstraintsr� r� r rF r r r �_create_policy_constraints s
��
��r� c
K s� t | t�s d| v nd}t | t�r t| �\} }ttt| ���} zt�t | t�r(| n| d �|fW S tyC } zt d|� ��|�d }~w t
t fyU } zt |�|�d }~ww )Nr� Fr� z-Undefined required key for inhibitAnyPolicy: ) r� r r r- �next�iterr� �InhibitAnyPolicyr/ r r� r� r1 r r r �_create_inhibit_any_policy4 s&
����
��r� c K s: d| v }t | t�rPi }| �� D ]=\}}|dvrqg }|D ])}t |t�r<d|v r<|jddd�\}} |�|�� | �� f� q |dkrE|�|� q t|�||< q|} n t | t�rptdd� | �d�D ��}
d d
� |
D �d d
� |
D �d�} d | v rzt| d �nd d
| v r�t| d
�nd d�} t | �
� �s�t d��t j
di | ��|fS )Nr� )� permitted�excludedrQ rF rk c s s � | ]
}|� � �d �V qdS )rx Nry r r r r r W r� z+_create_name_constraints.<locals>.<genexpr>rz c S �* g | ]}|d dkr|d j ddd��qS )r r� rF rQ rk r� r r r r r Y � $z,_create_name_constraints.<locals>.<listcomp>c S r� )r r� rF rQ rk r� r r r r r \ r� r� r� )�permitted_subtrees�excluded_subtreesz-nameConstraints needs at least one definitionr )r� r� ro r ro r� r rq rt r� �valuesr r� �NameConstraints) r� rv r� rf Zscope� constraintsru r rv rw ro rG r r r �_create_name_constraintsF s>
�
���
� r� c K s t �� dt| �v fS rI )r� � OCSPNoCheckr �r� rv r r r �_create_no_checkm s r� c
K sj t | t�rdd� | �d�D �} d| v }z dd� | D �}W n ty- } zt|�|�d }~ww t�|�|fS )Nc S s g | ]}|� � �qS r �r r r r r r s � z&_create_tlsfeature.<locals>.<listcomp>rz r� c S s g | ] }|d krt tj|��qS r� )r� r� ZTLSFeatureTyper r r r r v s )r� r ro r� r r� �
TLSFeature)r� rv r� �typesr� r r r �_create_tlsfeatureq s
��r� c K � t d��)Nz'nsComment is currently not implemented.�r r� r r r �_create_ns_comment| � r� c K r� )Nz(nsCertType is currently not implemented.r� r� r r r �_create_ns_cert_type� r� r� c
K s8 z
t �t| ��dfW S ty } ztd�|�d }~ww )NFz?cRLNumber must be an integer and must be marked as non-critical)r� � CRLNumberr r� r )r� rv r� r r r �_create_crl_number� s ����r� c K sF dt | �v }t�dt | ��} t| �dkrtd��t�t| d ��|fS )Nr� z[\d]+rF zGdeltaCRLIndicator must contain a single integer pointing to a cRLNumberr )r �re�findall�lenr r� �DeltaCRLIndicatorr )r� rv r� r r r �_create_delta_crl_indicator� s �r� c
K s| d}t | t�rt| �\} }n
d| v rd}dd� | D �} zt�t�tt| ����|fW S ty= } zt t|��|�d }~ww )NFr� Tc S s g | ]}|d kr|�qS r� r r r r r r � s z&_create_crl_reason.<locals>.<listcomp>)
r� r r- r� rB r� r� r� r� r r1 r r r �_create_crl_reason� s
��r� c
K sr t | t�s td��| �d�}|r| jddd�d } z t�t�| t ��|fW S t
y8 } ztt|��|�d }~ww )Nz invalidityDate must be a stringr� � rF rk ) r� r r r ro r� �InvalidityDater r� r� r� r1 r r r �_create_invalidity_date� s
���r� rA r@ )r; r< r= r> r? rB rC c C st | � d�}|r| dd � �d��� } dd� | �d�D �}|r,dd� dd� |D �D �|fS dd � d
d� |D �D �|fS ) Nr� � rz c s s � | ]}|� � V qd S r r� r r r r r � r z2_deserialize_openssl_confstring.<locals>.<genexpr>c s s$ � | ]
\}}|� � |� � fV qd S r r� r| r r r r � s
� �
�c s �. � | ]}d |v r|j d dd�n|dfV qdS �rQ rF rk Z __present__Nr� r r r r r � s
� �
�c S s i | ] \}}|� � |� � �qS r r� r| r r r �
<dictcomp>� s ��z3_deserialize_openssl_confstring.<locals>.<dictcomp>c s r� r� r� r r r r r � s �
�)r r ro )Zconfrn r� ro r r r r- � s&
������r- c C s� ddd�}t jjt jjt jjt jjt jjt jjd�}g }| D ]�\}}|�� }|dkr/t |�}n�|dkr8t
|�}n�|dkrjzt � |�}W n� t
yi zt �|�}W n t
yf } z td|� d ��|�d }~ww Y n_w |d
kr�|jd d d
�}t|�d kr�|\}} || �} d �|| f�}n=||d dd�}n4|dkr�t|�}
|
jr�||
j�} t|
j| |
j|
j|
j|
jf�}n|dkr�||ddd�}n|dkr�td��||v r�z |� || |�� W q t
t fy� } zt|�|�d }~ww td|� d���|S )NFc
S s� z| � d�}W n ty tdt| �j� d| � d���w |r*|s%td��| �d�} | � d�}|rL|s7td��|r=td��| d d � } | � d�rLtd
��trlz t� | ��
� }W nh tj yk } ztt |��|�d }~ww | srtd ��z| j d d
� W n t
y� } ztd�|�d }~ww | �d�D ],}|s�td��t�d|�}|d ur�tdtt|�� ��d d � � d|�� � d| � d���q�| }|r�d|� �S |r�d|� �S |S )Nr zExpected string value, got z: `�`z,Leading dots are not allowed in this contextz*.z)Wildcards are not allowed in this contextz5Wildcards and leading dots cannot be present togetherrG z Empty labelz Empty domain�ascii)�encodingz^Cannot encode non-ASCII strings to internationalized domain name format, missing library: idnaz Empty Labelz[^A-Za-z\d\-\.]zCodepoint U+00z
at position z of 'z
' not allowed)r r� r �typerJ r �lstrip�HAS_IDNA�idnar� r& Z IDNAErrorr �UnicodeEncodeErrorro r� �search�hex�ord�group�end) r� �allow_leading_dot�allow_wildcardZhas_dotZ has_wildcard�retr� �elem�invalidr r r � idna_encode� st ���
�
������ .��
z)_parse_general_names.<locals>.idna_encode)�email�uri�dns�rid�ip�dirnamer� r� r� zProvided value z4 does not seem to be an IP address or network range.r� �@rF rk r T)r� r� r� )r� r� Z othernamez&otherName is currently not implementedzGeneralName type z is invalid)FF) r� r� �
RFC822Name�UniformResourceIdentifier�DNSName� RegisteredID� IPAddressr_ r. r� rK � ipaddress�
ip_addressr� �
ip_networkr �rsplitr� r r �netlocr �schemer �params�query�fragmentr r� r� ) r� r� Z valid_typesrf �typrw r� r �user�domain�urlr r r rt � sx
9�
������
��
��rt c C s4 t | ��d�rt | ��d�rtd| � ���t�| �S )N)�0�1�2z 0123456789.z
Invalid oid: )r r r r r� �ObjectIdentifier)r� r r r rK ^ s
rK c
C sv zt j�| �j}t|�dkrtd��|d W S ty* } ztd| � ��|�d }~w ty: } ztd�|�d }~ww )NrF zPSpecified string is not a Relative Distinguished Name, but a Distinguished Name.r zFailed parsing rdn string: �BAt least cryptography v37 is required for parsing RFC4514 strings.) r� �Name�from_rfc4514_string�rdnsr� r r� r r� )Zrdnr r� r r r r� d s$ �
�����r� c C s t | jddd�f�d S )NrQ rF rk r )rt ro ��gnr r r r~ u s r~ c
C sr | d u rt �� S t| t�r| S z t�| �dd��} W n ttt fy& Y nw t| t�r2t�
| d�S t d| � ���)NrQ rR �bigz Could not parse serial number ) r� Zrandom_serial_numberr� r r r' r� r� r� r� �
from_bytesr )Zsnr r r r� y s
�
r� c
C s� t | t�rBztj�| �}td dkr t�|jd d d� �W S |W S ty1 } ztd�|�d }~w t yA } ztd�|�d }~ww t | t
�rQt�dd� | D ��S t | t �rug }t �
� D ]\}}|| v ro|�t�|| | �� q\t�|�S td��) Nr �% ���z%Failed parsing rfc4514 dirName stringr c S � g | ]}t |��qS r )r� r r r r r � r� z_get_dn.<locals>.<listcomp>z6Need string, list or dict to parse distinguished names)r� r r� r r �CRYPTOGRAPHY_VERSIONr r� r r� r� r� r� ro r� Z
NameAttributer )�dnrf r� rw r� r r r r� � s>
�������
�
r� c sR t � t�r � �� � t� �d dkrd� � d�� fdd�tdt� �d�D ���� S )z$
Nicely formats hex strings
rG r r rQ c s g | ]
}� ||d � �qS )rG r )r �i��hex_strr r r � s z pretty_hex.<locals>.<listcomp>)r� r r� r� r �ranger� r% r r% r �
pretty_hex� s
(r( c C s t | d��S )zA
Converts decimal values to nicely formatted hex strings
�X)r( )Zdecvalr r r �dec2hex� s r* c C s� t | tj�r d| j� �S t | tj�rd| j�� � �S t | tj�r'd| jj� �S t | tj�r3d| j� �S t | tj �r@d| jj
� �S t | tj �rLd| j� �S t | �S )zC
Returns a valid OpenSSL string for a GeneralName instance
zDNS:zdirName:zIP:zmail:zRID:zURI:)
r� r� r r� r_ �rfc4514_stringr �explodedr r r r r r r r r � render_gn� s r- c C sD d| j i}t| j�}|tv r|�t| | �� |S t| j�|d< |S )zK
Render an Extension instance to a dict for informational purposes
r� r� )r� r� r� �EXTENSION_RENDERERSr� r )r� r� r r r r �render_extension� s
�r/ c C � | j j| j jd�S )N)r* r, )r� r* Z path_length�r� r r r �_render_basic_constraints� � r2 c
C sT | j j| j j| j jr| j jnd| j j| j jr| j jnd| j j| j j| j j| j j d� S )NF) r9 r6 r; r3 r: r7 r8 r5 r4 )
r� rB r? r@ rD r< rC rA r> r= r1 r r r �_render_key_usage� s �r4 c C sZ zdd� | j jp g D �}W d|iS ty, t�dt| j ��}dd� |D �}Y d|iS w )Nc S s" g | ]
}|j d kr |j n|j�qS )� Unknown OID)�_namer r r r r r � s ��z._render_extended_key_usage.<locals>.<listcomp>z1\<ObjectIdentifier\(oid=[\d\.]+, name=([\w]+)\)\>c S s( g | ]}d |d kr|d n|d �qS )r5 rF r r r r r r r � s ( r� )r� Z_usagesr� r� r� r )r� rM r r r �_render_extended_key_usage� s
�
�
��r7 c C s dt | jj�iS �Nr� )r( r� r� r1 r r r � _render_subject_key_identifier� rf r9 c C sN | j jr
t| j j�nd dd� | j jpg D �pd | j jr#t| j j�d�S d d�S )Nc S r! r �r- r r r r r � r� z4_render_authority_key_identifier.<locals>.<listcomp>)rY r[ Z issuer_sn)r� rV r( rW rX r* r1 r r r � _render_authority_key_identifier� s ���r; c
s| zdd� | j jjp
g D �}W d|iS ty= ddddddd �� � fd
d�t�d d �� �� d
�t| j ��D �}Y d|iS w )Nc S r! r r: r r r r r
r� z)_render_general_names.<locals>.<listcomp>r� r� r r� r� ZdirName)r r r r r r_ c s" g | ]
\}}� | � d |� ��qS )rQ r )r r r ��prefixesr r r s ��z\<(�|z)\(value='([^']+)'\)\>r� )r� rs r� r� r� r r )r� �renderedr r< r �_render_general_names s& ��
���r@ c C sn g }z#| j jD ]}|�|jjdkr|jjn|jjt|jj �i� qW d|iS ty6 t | j �}Y d|iS w )Nr5 r� )
r� Z
_descriptionsr� Z
access_methodr6 r r- Zaccess_locationr� r )r� r? � descriptionr r r � _render_authority_info_access s �
��� � �rB c C s� g }z:| j jD ]0}|�dd� |jpg D �dd� |jpg D �ttdd� |jp&g D ���|jr2|j� � nd d�� qW d|iS t
yM t | j �}Y d|iS w )Nc S r! r r: r r r r r 8 r� z/_render_distribution_points.<locals>.<listcomp>c S r! r r: r r r r r 9 r� c s � � | ]}|j V qd S r �r� r r r r r : � � z._render_distribution_points.<locals>.<genexpr>)r� r� r� r� r� ) r� Z_distribution_pointsr� r� r� r� �sortedr� r� r+ r� r )r� Zdpointsr� r r r �_render_distribution_points2 s$ ���� � �rG c C sd dd� | j jpg D �ttdd� | j jpg D ���| j jr"| j j�� nd | j j| j j| j j | j j
d�S )Nc S r! r r: r r r r r I r� z6_render_issuing_distribution_point.<locals>.<listcomp>c s rC r rD r r r r r K rE z5_render_issuing_distribution_point.<locals>.<genexpr>)r� Zonysomereasonsr� r� r� r� r� ) r� r� r� rF r� r� r+ r� r� r� r� r1 r r r �"_render_issuing_distribution_pointG s ���rH c C s� g }zO| j jD ]E}|jj}|dkr|jj}g }|jpg D ](}t|t�r+|�d|i� q d }}|j r:|j j
}|j j }|�|||j d�� q |�||i� qW d|iS t
yb t| j �}Y d|iS w )Nr5 Zpractice_statement)Z
organizataionr� r� r� )r� Z _policiesr� r6 r r� r� r r� r� r� r� r� r� )r� Zpoliciesr� r� r� r� r� r� r r r � _render_certificate_policiesY s8
��� � �rI c C r0 )N)r� r� )r� r� r� r1 r r r �_render_policy_constraintsv s �rJ c C � d| j jiS r8 )r� Z
skip_certsr1 r r r �_render_inhibit_any_policy} � rL c C s. dd� | j jpg D �dd� | j jpg D �d�S )Nc S r! r r: r r r r r � r� z,_render_name_constraints.<locals>.<listcomp>c S r! r r: r r r r r � r� )r� r� )r� r� r� r1 r r r �_render_name_constraints� s �rN c C s ddiS )Nr� Tr r1 r r r �_render_no_check� r� rO c C st zdd� | j jD �}W d|iS ty9 g }dt| j �v r#|�d� dt| j �v r4|�d� Y d|iS Y d|iS w )Nc S r r )rw r r r r r � r z&_render_tlsfeature.<locals>.<listcomp>Zstatus_requestZstatus_request_v2r� )r� Z _featuresr� r r� )r� Zfeaturesr r r �_render_tlsfeature� s �
��rP c C rK r8 )r� Z
crl_numberr1 r r r �_render_crl_number� rM rQ c C s d| j jj iS r8 )r� �reasonr1 r r r �_render_crl_reason� s rS c C s d| j j�t�iS r8 )r� Zinvalidity_date�strftimer� r1 r r r �_render_invalidity_date� r3 rU ) FNNNNNNNNNNr| )NN)NNFr� N)r� )r� )Fr� )NFF)NNNr )�r$ r� r �loggingZos.pathr r� � collectionsr r r r �enumr � urllib.parser r Z cryptographyr r� Zcryptography.exceptionsr
Z cryptography.hazmat.primitivesr r Z)cryptography.hazmat.primitives.asymmetricr
r r r r Z,cryptography.hazmat.primitives.serializationr r Zcryptography.x509.oidr Zsalt.utils.filesrp Zsalt.utils.immutabletypesrq ZimmutabletypesZsalt.utils.stringutilsZsalt.utils.versionsZsalt.exceptionsr r r� r� � ImportErrorrq � __version__ro r" � getLoggerrJ r� Zfreezern ZNameOIDZ COUNTRY_NAMEZSTATE_OR_PROVINCE_NAMEZ
LOCALITY_NAMEZSTREET_ADDRESSZORGANIZATION_NAMEZORGANIZATIONAL_UNIT_NAMEZ COMMON_NAMEZ
EMAIL_ADDRESSZSURNAMEZ
GIVEN_NAMEZUSER_IDZ
SERIAL_NUMBERr� ru Z ExtensionOIDZBASIC_CONSTRAINTSZ KEY_USAGEZEXTENDED_KEY_USAGEZSUBJECT_KEY_IDENTIFIERZAUTHORITY_KEY_IDENTIFIERZISSUER_ALTERNATIVE_NAMEZ AUTHORITY_INFORMATION_ACCESSZSUBJECT_ALTERNATIVE_NAMEZCRL_DISTRIBUTION_POINTSZISSUING_DISTRIBUTION_POINTZCERTIFICATE_POLICIESZPOLICY_CONSTRAINTSZINHIBIT_ANY_POLICYZNAME_CONSTRAINTSZ
OCSP_NO_CHECKZ TLS_FEATUREZ
CRL_NUMBERZDELTA_CRL_INDICATORZ FRESHEST_CRLr� ZCRLEntryExtensionOIDZCERTIFICATE_ISSUERZ
CRL_REASONZINVALIDITY_DATEr� r rJ Z AuthorityInformationAccessOIDrD Z
CA_ISSUERSZ
CA_REPOSITORYr} r� r� r� rE r� r r� rR rV rW rX rY rZ r[ r] ri rj r{ r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r r� r r r
r� r� r2 rH rO rU ra rg rj rc r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r� r) r- rt rK r� r~ r� r� r( r* r- r/ r2 r4 r7 r9 r; r@ rB rG rH rI rJ rL rN rO rP rQ rS rU r0 rE rL rT r] rd ri r rr r� r� r� r� r� r� r� r� r� r� r� rB r� r. r r r r �<module> s� �
��
���������� �
� � �
���������������� �
� � �
��������� ����
� " � S
8 X & a $$5 C(8(3'
�������� �
� � �
������� r
�������� �
� � �
�������