?????????????? ?????????????? ?????????????? ?????????????? __init__.py000064400000002303152572326550006667 0ustar00# coding: utf-8 from __future__ import unicode_literals, division, absolute_import, print_function from .version import __version__, __version_info__ __all__ = [ '__version__', '__version_info__', 'load_order', ] def load_order(): """ Returns a list of the module and sub-module names for asn1crypto in dependency load order, for the sake of live reloading code :return: A list of unicode strings of module names, as they would appear in sys.modules, ordered by which module should be reloaded first """ return [ 'asn1crypto._errors', 'asn1crypto._int', 'asn1crypto._ordereddict', 'asn1crypto._teletex_codec', 'asn1crypto._types', 'asn1crypto._inet', 'asn1crypto._iri', 'asn1crypto.version', 'asn1crypto.pem', 'asn1crypto.util', 'asn1crypto.parser', 'asn1crypto.core', 'asn1crypto.algos', 'asn1crypto.keys', 'asn1crypto.x509', 'asn1crypto.crl', 'asn1crypto.csr', 'asn1crypto.ocsp', 'asn1crypto.cms', 'asn1crypto.pdf', 'asn1crypto.pkcs12', 'asn1crypto.tsp', 'asn1crypto', ] _errors.py000064400000002056152572326550006610 0ustar00# coding: utf-8 """ Exports the following items: - unwrap() - APIException() """ from __future__ import unicode_literals, division, absolute_import, print_function import re import textwrap class APIException(Exception): """ An exception indicating an API has been removed from asn1crypto """ pass def unwrap(string, *params): """ Takes a multi-line string and does the following: - dedents - converts newlines with text before and after into a single line - strips leading and trailing whitespace :param string: The string to format :param *params: Params to interpolate into the string :return: The formatted string """ output = textwrap.dedent(string) # Unwrap lines, taking into account bulleted lists, ordered lists and # underlines consisting of = signs if output.find('\n') != -1: output = re.sub('(?<=\\S)\n(?=[^ \n\t\\d\\*\\-=])', ' ', output) if params: output = output % params output = output.strip() return output _inet.py000064400000011065152572326550006233 0ustar00# coding: utf-8 from __future__ import unicode_literals, division, absolute_import, print_function import socket import struct from ._errors import unwrap from ._types import byte_cls, bytes_to_list, str_cls, type_name def inet_ntop(address_family, packed_ip): """ Windows compatibility shim for socket.inet_ntop(). :param address_family: socket.AF_INET for IPv4 or socket.AF_INET6 for IPv6 :param packed_ip: A byte string of the network form of an IP address :return: A unicode string of the IP address """ if address_family not in set([socket.AF_INET, socket.AF_INET6]): raise ValueError(unwrap( ''' address_family must be socket.AF_INET (%s) or socket.AF_INET6 (%s), not %s ''', repr(socket.AF_INET), repr(socket.AF_INET6), repr(address_family) )) if not isinstance(packed_ip, byte_cls): raise TypeError(unwrap( ''' packed_ip must be a byte string, not %s ''', type_name(packed_ip) )) required_len = 4 if address_family == socket.AF_INET else 16 if len(packed_ip) != required_len: raise ValueError(unwrap( ''' packed_ip must be %d bytes long - is %d ''', required_len, len(packed_ip) )) if address_family == socket.AF_INET: return '%d.%d.%d.%d' % tuple(bytes_to_list(packed_ip)) octets = struct.unpack(b'!HHHHHHHH', packed_ip) runs_of_zero = {} longest_run = 0 zero_index = None for i, octet in enumerate(octets + (-1,)): if octet != 0: if zero_index is not None: length = i - zero_index if length not in runs_of_zero: runs_of_zero[length] = zero_index longest_run = max(longest_run, length) zero_index = None elif zero_index is None: zero_index = i hexed = [hex(o)[2:] for o in octets] if longest_run < 2: return ':'.join(hexed) zero_start = runs_of_zero[longest_run] zero_end = zero_start + longest_run return ':'.join(hexed[:zero_start]) + '::' + ':'.join(hexed[zero_end:]) def inet_pton(address_family, ip_string): """ Windows compatibility shim for socket.inet_ntop(). :param address_family: socket.AF_INET for IPv4 or socket.AF_INET6 for IPv6 :param ip_string: A unicode string of an IP address :return: A byte string of the network form of the IP address """ if address_family not in set([socket.AF_INET, socket.AF_INET6]): raise ValueError(unwrap( ''' address_family must be socket.AF_INET (%s) or socket.AF_INET6 (%s), not %s ''', repr(socket.AF_INET), repr(socket.AF_INET6), repr(address_family) )) if not isinstance(ip_string, str_cls): raise TypeError(unwrap( ''' ip_string must be a unicode string, not %s ''', type_name(ip_string) )) if address_family == socket.AF_INET: octets = ip_string.split('.') error = len(octets) != 4 if not error: ints = [] for o in octets: o = int(o) if o > 255 or o < 0: error = True break ints.append(o) if error: raise ValueError(unwrap( ''' ip_string must be a dotted string with four integers in the range of 0 to 255, got %s ''', repr(ip_string) )) return struct.pack(b'!BBBB', *ints) error = False omitted = ip_string.count('::') if omitted > 1: error = True elif omitted == 0: octets = ip_string.split(':') error = len(octets) != 8 else: begin, end = ip_string.split('::') begin_octets = begin.split(':') end_octets = end.split(':') missing = 8 - len(begin_octets) - len(end_octets) octets = begin_octets + (['0'] * missing) + end_octets if not error: ints = [] for o in octets: o = int(o, 16) if o > 65535 or o < 0: error = True break ints.append(o) return struct.pack(b'!HHHHHHHH', *ints) raise ValueError(unwrap( ''' ip_string must be a valid ipv6 string, got %s ''', repr(ip_string) )) _int.py000064400000000756152572326550006073 0ustar00# coding: utf-8 from __future__ import unicode_literals, division, absolute_import, print_function def fill_width(bytes_, width): """ Ensure a byte string representing a positive integer is a specific width (in bytes) :param bytes_: The integer byte string :param width: The desired width as an integer :return: A byte string of the width specified """ while len(bytes_) < width: bytes_ = b'\x00' + bytes_ return bytes_ _iri.py000064400000021035152572326550006055 0ustar00# coding: utf-8 """ Functions to convert unicode IRIs into ASCII byte string URIs and back. Exports the following items: - iri_to_uri() - uri_to_iri() """ from __future__ import unicode_literals, division, absolute_import, print_function from encodings import idna # noqa import codecs import re import sys from ._errors import unwrap from ._types import byte_cls, str_cls, type_name, bytes_to_list, int_types if sys.version_info < (3,): from urlparse import urlsplit, urlunsplit from urllib import ( quote as urlquote, unquote as unquote_to_bytes, ) else: from urllib.parse import ( quote as urlquote, unquote_to_bytes, urlsplit, urlunsplit, ) def iri_to_uri(value, normalize=False): """ Encodes a unicode IRI into an ASCII byte string URI :param value: A unicode string of an IRI :param normalize: A bool that controls URI normalization :return: A byte string of the ASCII-encoded URI """ if not isinstance(value, str_cls): raise TypeError(unwrap( ''' value must be a unicode string, not %s ''', type_name(value) )) scheme = None # Python 2.6 doesn't split properly is the URL doesn't start with http:// or https:// if sys.version_info < (2, 7) and not value.startswith('http://') and not value.startswith('https://'): real_prefix = None prefix_match = re.match('^[^:]*://', value) if prefix_match: real_prefix = prefix_match.group(0) value = 'http://' + value[len(real_prefix):] parsed = urlsplit(value) if real_prefix: value = real_prefix + value[7:] scheme = _urlquote(real_prefix[:-3]) else: parsed = urlsplit(value) if scheme is None: scheme = _urlquote(parsed.scheme) hostname = parsed.hostname if hostname is not None: hostname = hostname.encode('idna') # RFC 3986 allows userinfo to contain sub-delims username = _urlquote(parsed.username, safe='!$&\'()*+,;=') password = _urlquote(parsed.password, safe='!$&\'()*+,;=') port = parsed.port if port is not None: port = str_cls(port).encode('ascii') netloc = b'' if username is not None: netloc += username if password: netloc += b':' + password netloc += b'@' if hostname is not None: netloc += hostname if port is not None: default_http = scheme == b'http' and port == b'80' default_https = scheme == b'https' and port == b'443' if not normalize or (not default_http and not default_https): netloc += b':' + port # RFC 3986 allows a path to contain sub-delims, plus "@" and ":" path = _urlquote(parsed.path, safe='/!$&\'()*+,;=@:') # RFC 3986 allows the query to contain sub-delims, plus "@", ":" , "/" and "?" query = _urlquote(parsed.query, safe='/?!$&\'()*+,;=@:') # RFC 3986 allows the fragment to contain sub-delims, plus "@", ":" , "/" and "?" fragment = _urlquote(parsed.fragment, safe='/?!$&\'()*+,;=@:') if normalize and query is None and fragment is None and path == b'/': path = None # Python 2.7 compat if path is None: path = '' output = urlunsplit((scheme, netloc, path, query, fragment)) if isinstance(output, str_cls): output = output.encode('latin1') return output def uri_to_iri(value): """ Converts an ASCII URI byte string into a unicode IRI :param value: An ASCII-encoded byte string of the URI :return: A unicode string of the IRI """ if not isinstance(value, byte_cls): raise TypeError(unwrap( ''' value must be a byte string, not %s ''', type_name(value) )) parsed = urlsplit(value) scheme = parsed.scheme if scheme is not None: scheme = scheme.decode('ascii') username = _urlunquote(parsed.username, remap=[':', '@']) password = _urlunquote(parsed.password, remap=[':', '@']) hostname = parsed.hostname if hostname: hostname = hostname.decode('idna') port = parsed.port if port and not isinstance(port, int_types): port = port.decode('ascii') netloc = '' if username is not None: netloc += username if password: netloc += ':' + password netloc += '@' if hostname is not None: netloc += hostname if port is not None: netloc += ':' + str_cls(port) path = _urlunquote(parsed.path, remap=['/'], preserve=True) query = _urlunquote(parsed.query, remap=['&', '='], preserve=True) fragment = _urlunquote(parsed.fragment) return urlunsplit((scheme, netloc, path, query, fragment)) def _iri_utf8_errors_handler(exc): """ Error handler for decoding UTF-8 parts of a URI into an IRI. Leaves byte sequences encoded in %XX format, but as part of a unicode string. :param exc: The UnicodeDecodeError exception :return: A 2-element tuple of (replacement unicode string, integer index to resume at) """ bytes_as_ints = bytes_to_list(exc.object[exc.start:exc.end]) replacements = ['%%%02x' % num for num in bytes_as_ints] return (''.join(replacements), exc.end) codecs.register_error('iriutf8', _iri_utf8_errors_handler) def _urlquote(string, safe=''): """ Quotes a unicode string for use in a URL :param string: A unicode string :param safe: A unicode string of character to not encode :return: None (if string is None) or an ASCII byte string of the quoted string """ if string is None or string == '': return None # Anything already hex quoted is pulled out of the URL and unquoted if # possible escapes = [] if re.search('%[0-9a-fA-F]{2}', string): # Try to unquote any percent values, restoring them if they are not # valid UTF-8. Also, requote any safe chars since encoded versions of # those are functionally different than the unquoted ones. def _try_unescape(match): byte_string = unquote_to_bytes(match.group(0)) unicode_string = byte_string.decode('utf-8', 'iriutf8') for safe_char in list(safe): unicode_string = unicode_string.replace(safe_char, '%%%02x' % ord(safe_char)) return unicode_string string = re.sub('(?:%[0-9a-fA-F]{2})+', _try_unescape, string) # Once we have the minimal set of hex quoted values, removed them from # the string so that they are not double quoted def _extract_escape(match): escapes.append(match.group(0).encode('ascii')) return '\x00' string = re.sub('%[0-9a-fA-F]{2}', _extract_escape, string) output = urlquote(string.encode('utf-8'), safe=safe.encode('utf-8')) if not isinstance(output, byte_cls): output = output.encode('ascii') # Restore the existing quoted values that we extracted if len(escapes) > 0: def _return_escape(_): return escapes.pop(0) output = re.sub(b'%00', _return_escape, output) return output def _urlunquote(byte_string, remap=None, preserve=None): """ Unquotes a URI portion from a byte string into unicode using UTF-8 :param byte_string: A byte string of the data to unquote :param remap: A list of characters (as unicode) that should be re-mapped to a %XX encoding. This is used when characters are not valid in part of a URL. :param preserve: A bool - indicates that the chars to be remapped if they occur in non-hex form, should be preserved. E.g. / for URL path. :return: A unicode string """ if byte_string is None: return byte_string if byte_string == b'': return '' if preserve: replacements = ['\x1A', '\x1C', '\x1D', '\x1E', '\x1F'] preserve_unmap = {} for char in remap: replacement = replacements.pop(0) preserve_unmap[replacement] = char byte_string = byte_string.replace(char.encode('ascii'), replacement.encode('ascii')) byte_string = unquote_to_bytes(byte_string) if remap: for char in remap: byte_string = byte_string.replace(char.encode('ascii'), ('%%%02x' % ord(char)).encode('ascii')) output = byte_string.decode('utf-8', 'iriutf8') if preserve: for replacement, original in preserve_unmap.items(): output = output.replace(replacement, original) return output _ordereddict.py000064400000010665152572326550007571 0ustar00# Copyright (c) 2009 Raymond Hettinger # # Permission is hereby granted, free of charge, to any person # obtaining a copy of this software and associated documentation files # (the "Software"), to deal in the Software without restriction, # including without limitation the rights to use, copy, modify, merge, # publish, distribute, sublicense, and/or sell copies of the Software, # and to permit persons to whom the Software is furnished to do so, # subject to the following conditions: # # The above copyright notice and this permission notice shall be # included in all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, # EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES # OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND # NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING # FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR # OTHER DEALINGS IN THE SOFTWARE. import sys if not sys.version_info < (2, 7): from collections import OrderedDict else: from UserDict import DictMixin class OrderedDict(dict, DictMixin): def __init__(self, *args, **kwds): if len(args) > 1: raise TypeError('expected at most 1 arguments, got %d' % len(args)) try: self.__end except AttributeError: self.clear() self.update(*args, **kwds) def clear(self): self.__end = end = [] end += [None, end, end] # sentinel node for doubly linked list self.__map = {} # key --> [key, prev, next] dict.clear(self) def __setitem__(self, key, value): if key not in self: end = self.__end curr = end[1] curr[2] = end[1] = self.__map[key] = [key, curr, end] dict.__setitem__(self, key, value) def __delitem__(self, key): dict.__delitem__(self, key) key, prev, next_ = self.__map.pop(key) prev[2] = next_ next_[1] = prev def __iter__(self): end = self.__end curr = end[2] while curr is not end: yield curr[0] curr = curr[2] def __reversed__(self): end = self.__end curr = end[1] while curr is not end: yield curr[0] curr = curr[1] def popitem(self, last=True): if not self: raise KeyError('dictionary is empty') if last: key = reversed(self).next() else: key = iter(self).next() value = self.pop(key) return key, value def __reduce__(self): items = [[k, self[k]] for k in self] tmp = self.__map, self.__end del self.__map, self.__end inst_dict = vars(self).copy() self.__map, self.__end = tmp if inst_dict: return (self.__class__, (items,), inst_dict) return self.__class__, (items,) def keys(self): return list(self) setdefault = DictMixin.setdefault update = DictMixin.update pop = DictMixin.pop values = DictMixin.values items = DictMixin.items iterkeys = DictMixin.iterkeys itervalues = DictMixin.itervalues iteritems = DictMixin.iteritems def __repr__(self): if not self: return '%s()' % (self.__class__.__name__,) return '%s(%r)' % (self.__class__.__name__, self.items()) def copy(self): return self.__class__(self) @classmethod def fromkeys(cls, iterable, value=None): d = cls() for key in iterable: d[key] = value return d def __eq__(self, other): if isinstance(other, OrderedDict): if len(self) != len(other): return False for p, q in zip(self.items(), other.items()): if p != q: return False return True return dict.__eq__(self, other) def __ne__(self, other): return not self == other _teletex_codec.py000064400000011675152572326550010112 0ustar00# coding: utf-8 """ Implementation of the teletex T.61 codec. Exports the following items: - register() """ from __future__ import unicode_literals, division, absolute_import, print_function import codecs class TeletexCodec(codecs.Codec): def encode(self, input_, errors='strict'): return codecs.charmap_encode(input_, errors, ENCODING_TABLE) def decode(self, input_, errors='strict'): return codecs.charmap_decode(input_, errors, DECODING_TABLE) class TeletexIncrementalEncoder(codecs.IncrementalEncoder): def encode(self, input_, final=False): return codecs.charmap_encode(input_, self.errors, ENCODING_TABLE)[0] class TeletexIncrementalDecoder(codecs.IncrementalDecoder): def decode(self, input_, final=False): return codecs.charmap_decode(input_, self.errors, DECODING_TABLE)[0] class TeletexStreamWriter(TeletexCodec, codecs.StreamWriter): pass class TeletexStreamReader(TeletexCodec, codecs.StreamReader): pass def teletex_search_function(name): """ Search function for teletex codec that is passed to codecs.register() """ if name != 'teletex': return None return codecs.CodecInfo( name='teletex', encode=TeletexCodec().encode, decode=TeletexCodec().decode, incrementalencoder=TeletexIncrementalEncoder, incrementaldecoder=TeletexIncrementalDecoder, streamreader=TeletexStreamReader, streamwriter=TeletexStreamWriter, ) def register(): """ Registers the teletex codec """ codecs.register(teletex_search_function) # http://en.wikipedia.org/wiki/ITU_T.61 DECODING_TABLE = ( '\u0000' '\u0001' '\u0002' '\u0003' '\u0004' '\u0005' '\u0006' '\u0007' '\u0008' '\u0009' '\u000A' '\u000B' '\u000C' '\u000D' '\u000E' '\u000F' '\u0010' '\u0011' '\u0012' '\u0013' '\u0014' '\u0015' '\u0016' '\u0017' '\u0018' '\u0019' '\u001A' '\u001B' '\u001C' '\u001D' '\u001E' '\u001F' '\u0020' '\u0021' '\u0022' '\ufffe' '\ufffe' '\u0025' '\u0026' '\u0027' '\u0028' '\u0029' '\u002A' '\u002B' '\u002C' '\u002D' '\u002E' '\u002F' '\u0030' '\u0031' '\u0032' '\u0033' '\u0034' '\u0035' '\u0036' '\u0037' '\u0038' '\u0039' '\u003A' '\u003B' '\u003C' '\u003D' '\u003E' '\u003F' '\u0040' '\u0041' '\u0042' '\u0043' '\u0044' '\u0045' '\u0046' '\u0047' '\u0048' '\u0049' '\u004A' '\u004B' '\u004C' '\u004D' '\u004E' '\u004F' '\u0050' '\u0051' '\u0052' '\u0053' '\u0054' '\u0055' '\u0056' '\u0057' '\u0058' '\u0059' '\u005A' '\u005B' '\ufffe' '\u005D' '\ufffe' '\u005F' '\ufffe' '\u0061' '\u0062' '\u0063' '\u0064' '\u0065' '\u0066' '\u0067' '\u0068' '\u0069' '\u006A' '\u006B' '\u006C' '\u006D' '\u006E' '\u006F' '\u0070' '\u0071' '\u0072' '\u0073' '\u0074' '\u0075' '\u0076' '\u0077' '\u0078' '\u0079' '\u007A' '\ufffe' '\u007C' '\ufffe' '\ufffe' '\u007F' '\u0080' '\u0081' '\u0082' '\u0083' '\u0084' '\u0085' '\u0086' '\u0087' '\u0088' '\u0089' '\u008A' '\u008B' '\u008C' '\u008D' '\u008E' '\u008F' '\u0090' '\u0091' '\u0092' '\u0093' '\u0094' '\u0095' '\u0096' '\u0097' '\u0098' '\u0099' '\u009A' '\u009B' '\u009C' '\u009D' '\u009E' '\u009F' '\u00A0' '\u00A1' '\u00A2' '\u00A3' '\u0024' '\u00A5' '\u0023' '\u00A7' '\u00A4' '\ufffe' '\ufffe' '\u00AB' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\u00B0' '\u00B1' '\u00B2' '\u00B3' '\u00D7' '\u00B5' '\u00B6' '\u00B7' '\u00F7' '\ufffe' '\ufffe' '\u00BB' '\u00BC' '\u00BD' '\u00BE' '\u00BF' '\ufffe' '\u0300' '\u0301' '\u0302' '\u0303' '\u0304' '\u0306' '\u0307' '\u0308' '\ufffe' '\u030A' '\u0327' '\u0332' '\u030B' '\u0328' '\u030C' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\ufffe' '\u2126' '\u00C6' '\u00D0' '\u00AA' '\u0126' '\ufffe' '\u0132' '\u013F' '\u0141' '\u00D8' '\u0152' '\u00BA' '\u00DE' '\u0166' '\u014A' '\u0149' '\u0138' '\u00E6' '\u0111' '\u00F0' '\u0127' '\u0131' '\u0133' '\u0140' '\u0142' '\u00F8' '\u0153' '\u00DF' '\u00FE' '\u0167' '\u014B' '\ufffe' ) ENCODING_TABLE = codecs.charmap_build(DECODING_TABLE) _types.py000064400000001653152572326550006442 0ustar00# coding: utf-8 from __future__ import unicode_literals, division, absolute_import, print_function import inspect import sys if sys.version_info < (3,): str_cls = unicode # noqa byte_cls = str int_types = (int, long) # noqa def bytes_to_list(byte_string): return [ord(b) for b in byte_string] chr_cls = chr else: str_cls = str byte_cls = bytes int_types = int bytes_to_list = list def chr_cls(num): return bytes([num]) def type_name(value): """ Returns a user-readable name for the type of an object :param value: A value to get the type name of :return: A unicode string of the object's type name """ if inspect.isclass(value): cls = value else: cls = value.__class__ if cls.__module__ in set(['builtins', '__builtin__']): return cls.__name__ return '%s.%s' % (cls.__module__, cls.__name__) algos.py000064400000106033152572326550006242 0ustar00# coding: utf-8 """ ASN.1 type classes for various algorithms using in various aspects of public key cryptography. Exports the following items: - AlgorithmIdentifier() - AnyAlgorithmIdentifier() - DigestAlgorithm() - DigestInfo() - DSASignature() - EncryptionAlgorithm() - HmacAlgorithm() - KdfAlgorithm() - Pkcs5MacAlgorithm() - SignedDigestAlgorithm() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function from ._errors import unwrap from ._int import fill_width from .util import int_from_bytes, int_to_bytes from .core import ( Any, Choice, Integer, Null, ObjectIdentifier, OctetString, Sequence, Void, ) # Structures and OIDs in this file are pulled from # https://tools.ietf.org/html/rfc3279, https://tools.ietf.org/html/rfc4055, # https://tools.ietf.org/html/rfc5758, https://tools.ietf.org/html/rfc7292, # http://www.emc.com/collateral/white-papers/h11302-pkcs5v2-1-password-based-cryptography-standard-wp.pdf class AlgorithmIdentifier(Sequence): _fields = [ ('algorithm', ObjectIdentifier), ('parameters', Any, {'optional': True}), ] class _ForceNullParameters(object): """ Various structures based on AlgorithmIdentifier require that the parameters field be core.Null() for certain OIDs. This mixin ensures that happens. """ # The following attribute, plus the parameters spec callback and custom # __setitem__ are all to handle a situation where parameters should not be # optional and must be Null for certain OIDs. More info at # https://tools.ietf.org/html/rfc4055#page-15 and # https://tools.ietf.org/html/rfc4055#section-2.1 _null_algos = set([ '1.2.840.113549.1.1.1', # rsassa_pkcs1v15 / rsaes_pkcs1v15 / rsa '1.2.840.113549.1.1.11', # sha256_rsa '1.2.840.113549.1.1.12', # sha384_rsa '1.2.840.113549.1.1.13', # sha512_rsa '1.2.840.113549.1.1.14', # sha224_rsa '1.3.14.3.2.26', # sha1 '2.16.840.1.101.3.4.2.4', # sha224 '2.16.840.1.101.3.4.2.1', # sha256 '2.16.840.1.101.3.4.2.2', # sha384 '2.16.840.1.101.3.4.2.3', # sha512 ]) def _parameters_spec(self): if self._oid_pair == ('algorithm', 'parameters'): algo = self['algorithm'].native if algo in self._oid_specs: return self._oid_specs[algo] if self['algorithm'].dotted in self._null_algos: return Null return None _spec_callbacks = { 'parameters': _parameters_spec } # We have to override this since the spec callback uses the value of # algorithm to determine the parameter spec, however default values are # assigned before setting a field, so a default value can't be based on # another field value (unless it is a default also). Thus we have to # manually check to see if the algorithm was set and parameters is unset, # and then fix the value as appropriate. def __setitem__(self, key, value): res = super(_ForceNullParameters, self).__setitem__(key, value) if key != 'algorithm': return res if self['algorithm'].dotted not in self._null_algos: return res if self['parameters'].__class__ != Void: return res self['parameters'] = Null() return res class HmacAlgorithmId(ObjectIdentifier): _map = { '1.3.14.3.2.10': 'des_mac', '1.2.840.113549.2.7': 'sha1', '1.2.840.113549.2.8': 'sha224', '1.2.840.113549.2.9': 'sha256', '1.2.840.113549.2.10': 'sha384', '1.2.840.113549.2.11': 'sha512', '1.2.840.113549.2.12': 'sha512_224', '1.2.840.113549.2.13': 'sha512_256', '2.16.840.1.101.3.4.2.13': 'sha3_224', '2.16.840.1.101.3.4.2.14': 'sha3_256', '2.16.840.1.101.3.4.2.15': 'sha3_384', '2.16.840.1.101.3.4.2.16': 'sha3_512', } class HmacAlgorithm(Sequence): _fields = [ ('algorithm', HmacAlgorithmId), ('parameters', Any, {'optional': True}), ] class DigestAlgorithmId(ObjectIdentifier): _map = { '1.2.840.113549.2.2': 'md2', '1.2.840.113549.2.5': 'md5', '1.3.14.3.2.26': 'sha1', '2.16.840.1.101.3.4.2.4': 'sha224', '2.16.840.1.101.3.4.2.1': 'sha256', '2.16.840.1.101.3.4.2.2': 'sha384', '2.16.840.1.101.3.4.2.3': 'sha512', '2.16.840.1.101.3.4.2.5': 'sha512_224', '2.16.840.1.101.3.4.2.6': 'sha512_256', '2.16.840.1.101.3.4.2.7': 'sha3_224', '2.16.840.1.101.3.4.2.8': 'sha3_256', '2.16.840.1.101.3.4.2.9': 'sha3_384', '2.16.840.1.101.3.4.2.10': 'sha3_512', '2.16.840.1.101.3.4.2.11': 'shake128', '2.16.840.1.101.3.4.2.12': 'shake256', '2.16.840.1.101.3.4.2.17': 'shake128_len', '2.16.840.1.101.3.4.2.18': 'shake256_len', } class DigestAlgorithm(_ForceNullParameters, Sequence): _fields = [ ('algorithm', DigestAlgorithmId), ('parameters', Any, {'optional': True}), ] # This structure is what is signed with a SignedDigestAlgorithm class DigestInfo(Sequence): _fields = [ ('digest_algorithm', DigestAlgorithm), ('digest', OctetString), ] class MaskGenAlgorithmId(ObjectIdentifier): _map = { '1.2.840.113549.1.1.8': 'mgf1', } class MaskGenAlgorithm(Sequence): _fields = [ ('algorithm', MaskGenAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'mgf1': DigestAlgorithm } class TrailerField(Integer): _map = { 1: 'trailer_field_bc', } class RSASSAPSSParams(Sequence): _fields = [ ( 'hash_algorithm', DigestAlgorithm, { 'explicit': 0, 'default': {'algorithm': 'sha1'}, } ), ( 'mask_gen_algorithm', MaskGenAlgorithm, { 'explicit': 1, 'default': { 'algorithm': 'mgf1', 'parameters': {'algorithm': 'sha1'}, }, } ), ( 'salt_length', Integer, { 'explicit': 2, 'default': 20, } ), ( 'trailer_field', TrailerField, { 'explicit': 3, 'default': 'trailer_field_bc', } ), ] class SignedDigestAlgorithmId(ObjectIdentifier): _map = { '1.3.14.3.2.3': 'md5_rsa', '1.3.14.3.2.29': 'sha1_rsa', '1.3.14.7.2.3.1': 'md2_rsa', '1.2.840.113549.1.1.2': 'md2_rsa', '1.2.840.113549.1.1.4': 'md5_rsa', '1.2.840.113549.1.1.5': 'sha1_rsa', '1.2.840.113549.1.1.14': 'sha224_rsa', '1.2.840.113549.1.1.11': 'sha256_rsa', '1.2.840.113549.1.1.12': 'sha384_rsa', '1.2.840.113549.1.1.13': 'sha512_rsa', '1.2.840.113549.1.1.10': 'rsassa_pss', '1.2.840.10040.4.3': 'sha1_dsa', '1.3.14.3.2.13': 'sha1_dsa', '1.3.14.3.2.27': 'sha1_dsa', '2.16.840.1.101.3.4.3.1': 'sha224_dsa', '2.16.840.1.101.3.4.3.2': 'sha256_dsa', '1.2.840.10045.4.1': 'sha1_ecdsa', '1.2.840.10045.4.3.1': 'sha224_ecdsa', '1.2.840.10045.4.3.2': 'sha256_ecdsa', '1.2.840.10045.4.3.3': 'sha384_ecdsa', '1.2.840.10045.4.3.4': 'sha512_ecdsa', '2.16.840.1.101.3.4.3.9': 'sha3_224_ecdsa', '2.16.840.1.101.3.4.3.10': 'sha3_256_ecdsa', '2.16.840.1.101.3.4.3.11': 'sha3_384_ecdsa', '2.16.840.1.101.3.4.3.12': 'sha3_512_ecdsa', # For when the digest is specified elsewhere in a Sequence '1.2.840.113549.1.1.1': 'rsassa_pkcs1v15', '1.2.840.10040.4.1': 'dsa', '1.2.840.10045.4': 'ecdsa', # RFC 8410 -- https://tools.ietf.org/html/rfc8410 '1.3.101.112': 'ed25519', '1.3.101.113': 'ed448', } _reverse_map = { 'dsa': '1.2.840.10040.4.1', 'ecdsa': '1.2.840.10045.4', 'md2_rsa': '1.2.840.113549.1.1.2', 'md5_rsa': '1.2.840.113549.1.1.4', 'rsassa_pkcs1v15': '1.2.840.113549.1.1.1', 'rsassa_pss': '1.2.840.113549.1.1.10', 'sha1_dsa': '1.2.840.10040.4.3', 'sha1_ecdsa': '1.2.840.10045.4.1', 'sha1_rsa': '1.2.840.113549.1.1.5', 'sha224_dsa': '2.16.840.1.101.3.4.3.1', 'sha224_ecdsa': '1.2.840.10045.4.3.1', 'sha224_rsa': '1.2.840.113549.1.1.14', 'sha256_dsa': '2.16.840.1.101.3.4.3.2', 'sha256_ecdsa': '1.2.840.10045.4.3.2', 'sha256_rsa': '1.2.840.113549.1.1.11', 'sha384_ecdsa': '1.2.840.10045.4.3.3', 'sha384_rsa': '1.2.840.113549.1.1.12', 'sha512_ecdsa': '1.2.840.10045.4.3.4', 'sha512_rsa': '1.2.840.113549.1.1.13', 'sha3_224_ecdsa': '2.16.840.1.101.3.4.3.9', 'sha3_256_ecdsa': '2.16.840.1.101.3.4.3.10', 'sha3_384_ecdsa': '2.16.840.1.101.3.4.3.11', 'sha3_512_ecdsa': '2.16.840.1.101.3.4.3.12', 'ed25519': '1.3.101.112', 'ed448': '1.3.101.113', } class SignedDigestAlgorithm(_ForceNullParameters, Sequence): _fields = [ ('algorithm', SignedDigestAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'rsassa_pss': RSASSAPSSParams, } @property def signature_algo(self): """ :return: A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa", "ed25519" or "ed448" """ algorithm = self['algorithm'].native algo_map = { 'md2_rsa': 'rsassa_pkcs1v15', 'md5_rsa': 'rsassa_pkcs1v15', 'sha1_rsa': 'rsassa_pkcs1v15', 'sha224_rsa': 'rsassa_pkcs1v15', 'sha256_rsa': 'rsassa_pkcs1v15', 'sha384_rsa': 'rsassa_pkcs1v15', 'sha512_rsa': 'rsassa_pkcs1v15', 'rsassa_pkcs1v15': 'rsassa_pkcs1v15', 'rsassa_pss': 'rsassa_pss', 'sha1_dsa': 'dsa', 'sha224_dsa': 'dsa', 'sha256_dsa': 'dsa', 'dsa': 'dsa', 'sha1_ecdsa': 'ecdsa', 'sha224_ecdsa': 'ecdsa', 'sha256_ecdsa': 'ecdsa', 'sha384_ecdsa': 'ecdsa', 'sha512_ecdsa': 'ecdsa', 'sha3_224_ecdsa': 'ecdsa', 'sha3_256_ecdsa': 'ecdsa', 'sha3_384_ecdsa': 'ecdsa', 'sha3_512_ecdsa': 'ecdsa', 'ecdsa': 'ecdsa', 'ed25519': 'ed25519', 'ed448': 'ed448', } if algorithm in algo_map: return algo_map[algorithm] raise ValueError(unwrap( ''' Signature algorithm not known for %s ''', algorithm )) @property def hash_algo(self): """ :return: A unicode string of "md2", "md5", "sha1", "sha224", "sha256", "sha384", "sha512", "sha512_224", "sha512_256" or "shake256" """ algorithm = self['algorithm'].native algo_map = { 'md2_rsa': 'md2', 'md5_rsa': 'md5', 'sha1_rsa': 'sha1', 'sha224_rsa': 'sha224', 'sha256_rsa': 'sha256', 'sha384_rsa': 'sha384', 'sha512_rsa': 'sha512', 'sha1_dsa': 'sha1', 'sha224_dsa': 'sha224', 'sha256_dsa': 'sha256', 'sha1_ecdsa': 'sha1', 'sha224_ecdsa': 'sha224', 'sha256_ecdsa': 'sha256', 'sha384_ecdsa': 'sha384', 'sha512_ecdsa': 'sha512', 'ed25519': 'sha512', 'ed448': 'shake256', } if algorithm in algo_map: return algo_map[algorithm] if algorithm == 'rsassa_pss': return self['parameters']['hash_algorithm']['algorithm'].native raise ValueError(unwrap( ''' Hash algorithm not known for %s ''', algorithm )) class Pbkdf2Salt(Choice): _alternatives = [ ('specified', OctetString), ('other_source', AlgorithmIdentifier), ] class Pbkdf2Params(Sequence): _fields = [ ('salt', Pbkdf2Salt), ('iteration_count', Integer), ('key_length', Integer, {'optional': True}), ('prf', HmacAlgorithm, {'default': {'algorithm': 'sha1'}}), ] class KdfAlgorithmId(ObjectIdentifier): _map = { '1.2.840.113549.1.5.12': 'pbkdf2' } class KdfAlgorithm(Sequence): _fields = [ ('algorithm', KdfAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'pbkdf2': Pbkdf2Params } class DHParameters(Sequence): """ Original Name: DHParameter Source: ftp://ftp.rsasecurity.com/pub/pkcs/ascii/pkcs-3.asc section 9 """ _fields = [ ('p', Integer), ('g', Integer), ('private_value_length', Integer, {'optional': True}), ] class KeyExchangeAlgorithmId(ObjectIdentifier): _map = { '1.2.840.113549.1.3.1': 'dh', } class KeyExchangeAlgorithm(Sequence): _fields = [ ('algorithm', KeyExchangeAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'dh': DHParameters, } class Rc2Params(Sequence): _fields = [ ('rc2_parameter_version', Integer, {'optional': True}), ('iv', OctetString), ] class Rc5ParamVersion(Integer): _map = { 16: 'v1-0' } class Rc5Params(Sequence): _fields = [ ('version', Rc5ParamVersion), ('rounds', Integer), ('block_size_in_bits', Integer), ('iv', OctetString, {'optional': True}), ] class Pbes1Params(Sequence): _fields = [ ('salt', OctetString), ('iterations', Integer), ] class CcmParams(Sequence): # https://tools.ietf.org/html/rfc5084 # aes_ICVlen: 4 | 6 | 8 | 10 | 12 | 14 | 16 _fields = [ ('aes_nonce', OctetString), ('aes_icvlen', Integer), ] class PSourceAlgorithmId(ObjectIdentifier): _map = { '1.2.840.113549.1.1.9': 'p_specified', } class PSourceAlgorithm(Sequence): _fields = [ ('algorithm', PSourceAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'p_specified': OctetString } class RSAESOAEPParams(Sequence): _fields = [ ( 'hash_algorithm', DigestAlgorithm, { 'explicit': 0, 'default': {'algorithm': 'sha1'} } ), ( 'mask_gen_algorithm', MaskGenAlgorithm, { 'explicit': 1, 'default': { 'algorithm': 'mgf1', 'parameters': {'algorithm': 'sha1'} } } ), ( 'p_source_algorithm', PSourceAlgorithm, { 'explicit': 2, 'default': { 'algorithm': 'p_specified', 'parameters': b'' } } ), ] class DSASignature(Sequence): """ An ASN.1 class for translating between the OS crypto library's representation of an (EC)DSA signature and the ASN.1 structure that is part of various RFCs. Original Name: DSS-Sig-Value Source: https://tools.ietf.org/html/rfc3279#section-2.2.2 """ _fields = [ ('r', Integer), ('s', Integer), ] @classmethod def from_p1363(cls, data): """ Reads a signature from a byte string encoding accordint to IEEE P1363, which is used by Microsoft's BCryptSignHash() function. :param data: A byte string from BCryptSignHash() :return: A DSASignature object """ r = int_from_bytes(data[0:len(data) // 2]) s = int_from_bytes(data[len(data) // 2:]) return cls({'r': r, 's': s}) def to_p1363(self): """ Dumps a signature to a byte string compatible with Microsoft's BCryptVerifySignature() function. :return: A byte string compatible with BCryptVerifySignature() """ r_bytes = int_to_bytes(self['r'].native) s_bytes = int_to_bytes(self['s'].native) int_byte_length = max(len(r_bytes), len(s_bytes)) r_bytes = fill_width(r_bytes, int_byte_length) s_bytes = fill_width(s_bytes, int_byte_length) return r_bytes + s_bytes class EncryptionAlgorithmId(ObjectIdentifier): _map = { '1.3.14.3.2.7': 'des', '1.2.840.113549.3.7': 'tripledes_3key', '1.2.840.113549.3.2': 'rc2', '1.2.840.113549.3.4': 'rc4', '1.2.840.113549.3.9': 'rc5', # From http://csrc.nist.gov/groups/ST/crypto_apps_infra/csor/algorithms.html#AES '2.16.840.1.101.3.4.1.1': 'aes128_ecb', '2.16.840.1.101.3.4.1.2': 'aes128_cbc', '2.16.840.1.101.3.4.1.3': 'aes128_ofb', '2.16.840.1.101.3.4.1.4': 'aes128_cfb', '2.16.840.1.101.3.4.1.5': 'aes128_wrap', '2.16.840.1.101.3.4.1.6': 'aes128_gcm', '2.16.840.1.101.3.4.1.7': 'aes128_ccm', '2.16.840.1.101.3.4.1.8': 'aes128_wrap_pad', '2.16.840.1.101.3.4.1.21': 'aes192_ecb', '2.16.840.1.101.3.4.1.22': 'aes192_cbc', '2.16.840.1.101.3.4.1.23': 'aes192_ofb', '2.16.840.1.101.3.4.1.24': 'aes192_cfb', '2.16.840.1.101.3.4.1.25': 'aes192_wrap', '2.16.840.1.101.3.4.1.26': 'aes192_gcm', '2.16.840.1.101.3.4.1.27': 'aes192_ccm', '2.16.840.1.101.3.4.1.28': 'aes192_wrap_pad', '2.16.840.1.101.3.4.1.41': 'aes256_ecb', '2.16.840.1.101.3.4.1.42': 'aes256_cbc', '2.16.840.1.101.3.4.1.43': 'aes256_ofb', '2.16.840.1.101.3.4.1.44': 'aes256_cfb', '2.16.840.1.101.3.4.1.45': 'aes256_wrap', '2.16.840.1.101.3.4.1.46': 'aes256_gcm', '2.16.840.1.101.3.4.1.47': 'aes256_ccm', '2.16.840.1.101.3.4.1.48': 'aes256_wrap_pad', # From PKCS#5 '1.2.840.113549.1.5.13': 'pbes2', '1.2.840.113549.1.5.1': 'pbes1_md2_des', '1.2.840.113549.1.5.3': 'pbes1_md5_des', '1.2.840.113549.1.5.4': 'pbes1_md2_rc2', '1.2.840.113549.1.5.6': 'pbes1_md5_rc2', '1.2.840.113549.1.5.10': 'pbes1_sha1_des', '1.2.840.113549.1.5.11': 'pbes1_sha1_rc2', # From PKCS#12 '1.2.840.113549.1.12.1.1': 'pkcs12_sha1_rc4_128', '1.2.840.113549.1.12.1.2': 'pkcs12_sha1_rc4_40', '1.2.840.113549.1.12.1.3': 'pkcs12_sha1_tripledes_3key', '1.2.840.113549.1.12.1.4': 'pkcs12_sha1_tripledes_2key', '1.2.840.113549.1.12.1.5': 'pkcs12_sha1_rc2_128', '1.2.840.113549.1.12.1.6': 'pkcs12_sha1_rc2_40', # PKCS#1 v2.2 '1.2.840.113549.1.1.1': 'rsaes_pkcs1v15', '1.2.840.113549.1.1.7': 'rsaes_oaep', } class EncryptionAlgorithm(_ForceNullParameters, Sequence): _fields = [ ('algorithm', EncryptionAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'des': OctetString, 'tripledes_3key': OctetString, 'rc2': Rc2Params, 'rc5': Rc5Params, 'aes128_cbc': OctetString, 'aes192_cbc': OctetString, 'aes256_cbc': OctetString, 'aes128_ofb': OctetString, 'aes192_ofb': OctetString, 'aes256_ofb': OctetString, # From RFC5084 'aes128_ccm': CcmParams, 'aes192_ccm': CcmParams, 'aes256_ccm': CcmParams, # From PKCS#5 'pbes1_md2_des': Pbes1Params, 'pbes1_md5_des': Pbes1Params, 'pbes1_md2_rc2': Pbes1Params, 'pbes1_md5_rc2': Pbes1Params, 'pbes1_sha1_des': Pbes1Params, 'pbes1_sha1_rc2': Pbes1Params, # From PKCS#12 'pkcs12_sha1_rc4_128': Pbes1Params, 'pkcs12_sha1_rc4_40': Pbes1Params, 'pkcs12_sha1_tripledes_3key': Pbes1Params, 'pkcs12_sha1_tripledes_2key': Pbes1Params, 'pkcs12_sha1_rc2_128': Pbes1Params, 'pkcs12_sha1_rc2_40': Pbes1Params, # PKCS#1 v2.2 'rsaes_oaep': RSAESOAEPParams, } @property def kdf(self): """ Returns the name of the key derivation function to use. :return: A unicode from of one of the following: "pbkdf1", "pbkdf2", "pkcs12_kdf" """ encryption_algo = self['algorithm'].native if encryption_algo == 'pbes2': return self['parameters']['key_derivation_func']['algorithm'].native if encryption_algo.find('.') == -1: if encryption_algo.find('_') != -1: encryption_algo, _ = encryption_algo.split('_', 1) if encryption_algo == 'pbes1': return 'pbkdf1' if encryption_algo == 'pkcs12': return 'pkcs12_kdf' raise ValueError(unwrap( ''' Encryption algorithm "%s" does not have a registered key derivation function ''', encryption_algo )) raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s", can not determine key derivation function ''', encryption_algo )) @property def kdf_hmac(self): """ Returns the HMAC algorithm to use with the KDF. :return: A unicode string of one of the following: "md2", "md5", "sha1", "sha224", "sha256", "sha384", "sha512" """ encryption_algo = self['algorithm'].native if encryption_algo == 'pbes2': return self['parameters']['key_derivation_func']['parameters']['prf']['algorithm'].native if encryption_algo.find('.') == -1: if encryption_algo.find('_') != -1: _, hmac_algo, _ = encryption_algo.split('_', 2) return hmac_algo raise ValueError(unwrap( ''' Encryption algorithm "%s" does not have a registered key derivation function ''', encryption_algo )) raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s", can not determine key derivation hmac algorithm ''', encryption_algo )) @property def kdf_salt(self): """ Returns the byte string to use as the salt for the KDF. :return: A byte string """ encryption_algo = self['algorithm'].native if encryption_algo == 'pbes2': salt = self['parameters']['key_derivation_func']['parameters']['salt'] if salt.name == 'other_source': raise ValueError(unwrap( ''' Can not determine key derivation salt - the reserved-for-future-use other source salt choice was specified in the PBKDF2 params structure ''' )) return salt.native if encryption_algo.find('.') == -1: if encryption_algo.find('_') != -1: return self['parameters']['salt'].native raise ValueError(unwrap( ''' Encryption algorithm "%s" does not have a registered key derivation function ''', encryption_algo )) raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s", can not determine key derivation salt ''', encryption_algo )) @property def kdf_iterations(self): """ Returns the number of iterations that should be run via the KDF. :return: An integer """ encryption_algo = self['algorithm'].native if encryption_algo == 'pbes2': return self['parameters']['key_derivation_func']['parameters']['iteration_count'].native if encryption_algo.find('.') == -1: if encryption_algo.find('_') != -1: return self['parameters']['iterations'].native raise ValueError(unwrap( ''' Encryption algorithm "%s" does not have a registered key derivation function ''', encryption_algo )) raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s", can not determine key derivation iterations ''', encryption_algo )) @property def key_length(self): """ Returns the key length to pass to the cipher/kdf. The PKCS#5 spec does not specify a way to store the RC5 key length, however this tends not to be a problem since OpenSSL does not support RC5 in PKCS#8 and OS X does not provide an RC5 cipher for use in the Security Transforms library. :raises: ValueError - when the key length can not be determined :return: An integer representing the length in bytes """ encryption_algo = self['algorithm'].native if encryption_algo[0:3] == 'aes': return { 'aes128_': 16, 'aes192_': 24, 'aes256_': 32, }[encryption_algo[0:7]] cipher_lengths = { 'des': 8, 'tripledes_3key': 24, } if encryption_algo in cipher_lengths: return cipher_lengths[encryption_algo] if encryption_algo == 'rc2': rc2_parameter_version = self['parameters']['rc2_parameter_version'].native # See page 24 of # http://www.emc.com/collateral/white-papers/h11302-pkcs5v2-1-password-based-cryptography-standard-wp.pdf encoded_key_bits_map = { 160: 5, # 40-bit 120: 8, # 64-bit 58: 16, # 128-bit } if rc2_parameter_version in encoded_key_bits_map: return encoded_key_bits_map[rc2_parameter_version] if rc2_parameter_version >= 256: return rc2_parameter_version if rc2_parameter_version is None: return 4 # 32-bit default raise ValueError(unwrap( ''' Invalid RC2 parameter version found in EncryptionAlgorithm parameters ''' )) if encryption_algo == 'pbes2': key_length = self['parameters']['key_derivation_func']['parameters']['key_length'].native if key_length is not None: return key_length # If the KDF params don't specify the key size, we can infer it from # the encryption scheme for all schemes except for RC5. However, in # practical terms, neither OpenSSL or OS X support RC5 for PKCS#8 # so it is unlikely to be an issue that is run into. return self['parameters']['encryption_scheme'].key_length if encryption_algo.find('.') == -1: return { 'pbes1_md2_des': 8, 'pbes1_md5_des': 8, 'pbes1_md2_rc2': 8, 'pbes1_md5_rc2': 8, 'pbes1_sha1_des': 8, 'pbes1_sha1_rc2': 8, 'pkcs12_sha1_rc4_128': 16, 'pkcs12_sha1_rc4_40': 5, 'pkcs12_sha1_tripledes_3key': 24, 'pkcs12_sha1_tripledes_2key': 16, 'pkcs12_sha1_rc2_128': 16, 'pkcs12_sha1_rc2_40': 5, }[encryption_algo] raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s" ''', encryption_algo )) @property def encryption_mode(self): """ Returns the name of the encryption mode to use. :return: A unicode string from one of the following: "cbc", "ecb", "ofb", "cfb", "wrap", "gcm", "ccm", "wrap_pad" """ encryption_algo = self['algorithm'].native if encryption_algo[0:7] in set(['aes128_', 'aes192_', 'aes256_']): return encryption_algo[7:] if encryption_algo[0:6] == 'pbes1_': return 'cbc' if encryption_algo[0:7] == 'pkcs12_': return 'cbc' if encryption_algo in set(['des', 'tripledes_3key', 'rc2', 'rc5']): return 'cbc' if encryption_algo == 'pbes2': return self['parameters']['encryption_scheme'].encryption_mode raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s" ''', encryption_algo )) @property def encryption_cipher(self): """ Returns the name of the symmetric encryption cipher to use. The key length can be retrieved via the .key_length property to disabiguate between different variations of TripleDES, AES, and the RC* ciphers. :return: A unicode string from one of the following: "rc2", "rc5", "des", "tripledes", "aes" """ encryption_algo = self['algorithm'].native if encryption_algo[0:7] in set(['aes128_', 'aes192_', 'aes256_']): return 'aes' if encryption_algo in set(['des', 'rc2', 'rc5']): return encryption_algo if encryption_algo == 'tripledes_3key': return 'tripledes' if encryption_algo == 'pbes2': return self['parameters']['encryption_scheme'].encryption_cipher if encryption_algo.find('.') == -1: return { 'pbes1_md2_des': 'des', 'pbes1_md5_des': 'des', 'pbes1_md2_rc2': 'rc2', 'pbes1_md5_rc2': 'rc2', 'pbes1_sha1_des': 'des', 'pbes1_sha1_rc2': 'rc2', 'pkcs12_sha1_rc4_128': 'rc4', 'pkcs12_sha1_rc4_40': 'rc4', 'pkcs12_sha1_tripledes_3key': 'tripledes', 'pkcs12_sha1_tripledes_2key': 'tripledes', 'pkcs12_sha1_rc2_128': 'rc2', 'pkcs12_sha1_rc2_40': 'rc2', }[encryption_algo] raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s" ''', encryption_algo )) @property def encryption_block_size(self): """ Returns the block size of the encryption cipher, in bytes. :return: An integer that is the block size in bytes """ encryption_algo = self['algorithm'].native if encryption_algo[0:7] in set(['aes128_', 'aes192_', 'aes256_']): return 16 cipher_map = { 'des': 8, 'tripledes_3key': 8, 'rc2': 8, } if encryption_algo in cipher_map: return cipher_map[encryption_algo] if encryption_algo == 'rc5': return self['parameters']['block_size_in_bits'].native // 8 if encryption_algo == 'pbes2': return self['parameters']['encryption_scheme'].encryption_block_size if encryption_algo.find('.') == -1: return { 'pbes1_md2_des': 8, 'pbes1_md5_des': 8, 'pbes1_md2_rc2': 8, 'pbes1_md5_rc2': 8, 'pbes1_sha1_des': 8, 'pbes1_sha1_rc2': 8, 'pkcs12_sha1_rc4_128': 0, 'pkcs12_sha1_rc4_40': 0, 'pkcs12_sha1_tripledes_3key': 8, 'pkcs12_sha1_tripledes_2key': 8, 'pkcs12_sha1_rc2_128': 8, 'pkcs12_sha1_rc2_40': 8, }[encryption_algo] raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s" ''', encryption_algo )) @property def encryption_iv(self): """ Returns the byte string of the initialization vector for the encryption scheme. Only the PBES2 stores the IV in the params. For PBES1, the IV is derived from the KDF and this property will return None. :return: A byte string or None """ encryption_algo = self['algorithm'].native if encryption_algo in set(['rc2', 'rc5']): return self['parameters']['iv'].native # For DES/Triple DES and AES the IV is the entirety of the parameters octet_string_iv_oids = set([ 'des', 'tripledes_3key', 'aes128_cbc', 'aes192_cbc', 'aes256_cbc', 'aes128_ofb', 'aes192_ofb', 'aes256_ofb', ]) if encryption_algo in octet_string_iv_oids: return self['parameters'].native if encryption_algo == 'pbes2': return self['parameters']['encryption_scheme'].encryption_iv # All of the PBES1 algos use their KDF to create the IV. For the pbkdf1, # the KDF is told to generate a key that is an extra 8 bytes long, and # that is used for the IV. For the PKCS#12 KDF, it is called with an id # of 2 to generate the IV. In either case, we can't return the IV # without knowing the user's password. if encryption_algo.find('.') == -1: return None raise ValueError(unwrap( ''' Unrecognized encryption algorithm "%s" ''', encryption_algo )) class Pbes2Params(Sequence): _fields = [ ('key_derivation_func', KdfAlgorithm), ('encryption_scheme', EncryptionAlgorithm), ] class Pbmac1Params(Sequence): _fields = [ ('key_derivation_func', KdfAlgorithm), ('message_auth_scheme', HmacAlgorithm), ] class Pkcs5MacId(ObjectIdentifier): _map = { '1.2.840.113549.1.5.14': 'pbmac1', } class Pkcs5MacAlgorithm(Sequence): _fields = [ ('algorithm', Pkcs5MacId), ('parameters', Any), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'pbmac1': Pbmac1Params, } EncryptionAlgorithm._oid_specs['pbes2'] = Pbes2Params class AnyAlgorithmId(ObjectIdentifier): _map = {} def _setup(self): _map = self.__class__._map for other_cls in (EncryptionAlgorithmId, SignedDigestAlgorithmId, DigestAlgorithmId): for oid, name in other_cls._map.items(): _map[oid] = name class AnyAlgorithmIdentifier(_ForceNullParameters, Sequence): _fields = [ ('algorithm', AnyAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = {} def _setup(self): Sequence._setup(self) specs = self.__class__._oid_specs for other_cls in (EncryptionAlgorithm, SignedDigestAlgorithm): for oid, spec in other_cls._oid_specs.items(): specs[oid] = spec cms.py000064400000066200152572326550005720 0ustar00# coding: utf-8 """ ASN.1 type classes for cryptographic message syntax (CMS). Structures are also compatible with PKCS#7. Exports the following items: - AuthenticatedData() - AuthEnvelopedData() - CompressedData() - ContentInfo() - DigestedData() - EncryptedData() - EnvelopedData() - SignedAndEnvelopedData() - SignedData() Other type classes are defined that help compose the types listed above. Most CMS structures in the wild are formatted as ContentInfo encapsulating one of the other types. """ from __future__ import unicode_literals, division, absolute_import, print_function try: import zlib except (ImportError): zlib = None from .algos import ( _ForceNullParameters, DigestAlgorithm, EncryptionAlgorithm, EncryptionAlgorithmId, HmacAlgorithm, KdfAlgorithm, RSAESOAEPParams, SignedDigestAlgorithm, ) from .core import ( Any, BitString, Choice, Enumerated, GeneralizedTime, Integer, ObjectIdentifier, OctetBitString, OctetString, ParsableOctetString, Sequence, SequenceOf, SetOf, UTCTime, UTF8String, ) from .crl import CertificateList from .keys import PublicKeyInfo from .ocsp import OCSPResponse from .x509 import Attributes, Certificate, Extensions, GeneralName, GeneralNames, Name # These structures are taken from # ftp://ftp.rsasecurity.com/pub/pkcs/ascii/pkcs-6.asc class ExtendedCertificateInfo(Sequence): _fields = [ ('version', Integer), ('certificate', Certificate), ('attributes', Attributes), ] class ExtendedCertificate(Sequence): _fields = [ ('extended_certificate_info', ExtendedCertificateInfo), ('signature_algorithm', SignedDigestAlgorithm), ('signature', OctetBitString), ] # These structures are taken from https://tools.ietf.org/html/rfc5652, # https://tools.ietf.org/html/rfc5083, http://tools.ietf.org/html/rfc2315, # https://tools.ietf.org/html/rfc5940, https://tools.ietf.org/html/rfc3274, # https://tools.ietf.org/html/rfc3281 class CMSVersion(Integer): _map = { 0: 'v0', 1: 'v1', 2: 'v2', 3: 'v3', 4: 'v4', 5: 'v5', } class CMSAttributeType(ObjectIdentifier): _map = { '1.2.840.113549.1.9.3': 'content_type', '1.2.840.113549.1.9.4': 'message_digest', '1.2.840.113549.1.9.5': 'signing_time', '1.2.840.113549.1.9.6': 'counter_signature', # https://datatracker.ietf.org/doc/html/rfc2633#section-2.5.2 '1.2.840.113549.1.9.15': 'smime_capabilities', # https://tools.ietf.org/html/rfc2633#page-26 '1.2.840.113549.1.9.16.2.11': 'encrypt_key_pref', # https://tools.ietf.org/html/rfc3161#page-20 '1.2.840.113549.1.9.16.2.14': 'signature_time_stamp_token', # https://tools.ietf.org/html/rfc6211#page-5 '1.2.840.113549.1.9.52': 'cms_algorithm_protection', # https://docs.microsoft.com/en-us/previous-versions/hh968145(v%3Dvs.85) '1.3.6.1.4.1.311.2.4.1': 'microsoft_nested_signature', # Some places refer to this as SPC_RFC3161_OBJID, others szOID_RFC3161_counterSign. # https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/ns-wincrypt-crypt_algorithm_identifier # refers to szOID_RFC3161_counterSign as "1.2.840.113549.1.9.16.1.4", # but that OID is also called szOID_TIMESTAMP_TOKEN. Because of there being # no canonical source for this OID, we give it our own name '1.3.6.1.4.1.311.3.3.1': 'microsoft_time_stamp_token', } class Time(Choice): _alternatives = [ ('utc_time', UTCTime), ('generalized_time', GeneralizedTime), ] class ContentType(ObjectIdentifier): _map = { '1.2.840.113549.1.7.1': 'data', '1.2.840.113549.1.7.2': 'signed_data', '1.2.840.113549.1.7.3': 'enveloped_data', '1.2.840.113549.1.7.4': 'signed_and_enveloped_data', '1.2.840.113549.1.7.5': 'digested_data', '1.2.840.113549.1.7.6': 'encrypted_data', '1.2.840.113549.1.9.16.1.2': 'authenticated_data', '1.2.840.113549.1.9.16.1.9': 'compressed_data', '1.2.840.113549.1.9.16.1.23': 'authenticated_enveloped_data', } class CMSAlgorithmProtection(Sequence): _fields = [ ('digest_algorithm', DigestAlgorithm), ('signature_algorithm', SignedDigestAlgorithm, {'implicit': 1, 'optional': True}), ('mac_algorithm', HmacAlgorithm, {'implicit': 2, 'optional': True}), ] class SetOfContentType(SetOf): _child_spec = ContentType class SetOfOctetString(SetOf): _child_spec = OctetString class SetOfTime(SetOf): _child_spec = Time class SetOfAny(SetOf): _child_spec = Any class SetOfCMSAlgorithmProtection(SetOf): _child_spec = CMSAlgorithmProtection class CMSAttribute(Sequence): _fields = [ ('type', CMSAttributeType), ('values', None), ] _oid_specs = {} def _values_spec(self): return self._oid_specs.get(self['type'].native, SetOfAny) _spec_callbacks = { 'values': _values_spec } class CMSAttributes(SetOf): _child_spec = CMSAttribute class IssuerSerial(Sequence): _fields = [ ('issuer', GeneralNames), ('serial', Integer), ('issuer_uid', OctetBitString, {'optional': True}), ] class AttCertVersion(Integer): _map = { 0: 'v1', 1: 'v2', } class AttCertSubject(Choice): _alternatives = [ ('base_certificate_id', IssuerSerial, {'explicit': 0}), ('subject_name', GeneralNames, {'explicit': 1}), ] class AttCertValidityPeriod(Sequence): _fields = [ ('not_before_time', GeneralizedTime), ('not_after_time', GeneralizedTime), ] class AttributeCertificateInfoV1(Sequence): _fields = [ ('version', AttCertVersion, {'default': 'v1'}), ('subject', AttCertSubject), ('issuer', GeneralNames), ('signature', SignedDigestAlgorithm), ('serial_number', Integer), ('att_cert_validity_period', AttCertValidityPeriod), ('attributes', Attributes), ('issuer_unique_id', OctetBitString, {'optional': True}), ('extensions', Extensions, {'optional': True}), ] class AttributeCertificateV1(Sequence): _fields = [ ('ac_info', AttributeCertificateInfoV1), ('signature_algorithm', SignedDigestAlgorithm), ('signature', OctetBitString), ] class DigestedObjectType(Enumerated): _map = { 0: 'public_key', 1: 'public_key_cert', 2: 'other_objy_types', } class ObjectDigestInfo(Sequence): _fields = [ ('digested_object_type', DigestedObjectType), ('other_object_type_id', ObjectIdentifier, {'optional': True}), ('digest_algorithm', DigestAlgorithm), ('object_digest', OctetBitString), ] class Holder(Sequence): _fields = [ ('base_certificate_id', IssuerSerial, {'implicit': 0, 'optional': True}), ('entity_name', GeneralNames, {'implicit': 1, 'optional': True}), ('object_digest_info', ObjectDigestInfo, {'implicit': 2, 'optional': True}), ] class V2Form(Sequence): _fields = [ ('issuer_name', GeneralNames, {'optional': True}), ('base_certificate_id', IssuerSerial, {'explicit': 0, 'optional': True}), ('object_digest_info', ObjectDigestInfo, {'explicit': 1, 'optional': True}), ] class AttCertIssuer(Choice): _alternatives = [ ('v1_form', GeneralNames), ('v2_form', V2Form, {'implicit': 0}), ] class IetfAttrValue(Choice): _alternatives = [ ('octets', OctetString), ('oid', ObjectIdentifier), ('string', UTF8String), ] class IetfAttrValues(SequenceOf): _child_spec = IetfAttrValue class IetfAttrSyntax(Sequence): _fields = [ ('policy_authority', GeneralNames, {'implicit': 0, 'optional': True}), ('values', IetfAttrValues), ] class SetOfIetfAttrSyntax(SetOf): _child_spec = IetfAttrSyntax class SvceAuthInfo(Sequence): _fields = [ ('service', GeneralName), ('ident', GeneralName), ('auth_info', OctetString, {'optional': True}), ] class SetOfSvceAuthInfo(SetOf): _child_spec = SvceAuthInfo class RoleSyntax(Sequence): _fields = [ ('role_authority', GeneralNames, {'implicit': 0, 'optional': True}), ('role_name', GeneralName, {'explicit': 1}), ] class SetOfRoleSyntax(SetOf): _child_spec = RoleSyntax class ClassList(BitString): _map = { 0: 'unmarked', 1: 'unclassified', 2: 'restricted', 3: 'confidential', 4: 'secret', 5: 'top_secret', } class SecurityCategory(Sequence): _fields = [ ('type', ObjectIdentifier, {'implicit': 0}), ('value', Any, {'explicit': 1}), ] class SetOfSecurityCategory(SetOf): _child_spec = SecurityCategory class Clearance(Sequence): _fields = [ ('policy_id', ObjectIdentifier), ('class_list', ClassList, {'default': set(['unclassified'])}), ('security_categories', SetOfSecurityCategory, {'optional': True}), ] class SetOfClearance(SetOf): _child_spec = Clearance class BigTime(Sequence): _fields = [ ('major', Integer), ('fractional_seconds', Integer), ('sign', Integer, {'optional': True}), ] class LeapData(Sequence): _fields = [ ('leap_time', BigTime), ('action', Integer), ] class SetOfLeapData(SetOf): _child_spec = LeapData class TimingMetrics(Sequence): _fields = [ ('ntp_time', BigTime), ('offset', BigTime), ('delay', BigTime), ('expiration', BigTime), ('leap_event', SetOfLeapData, {'optional': True}), ] class SetOfTimingMetrics(SetOf): _child_spec = TimingMetrics class TimingPolicy(Sequence): _fields = [ ('policy_id', SequenceOf, {'spec': ObjectIdentifier}), ('max_offset', BigTime, {'explicit': 0, 'optional': True}), ('max_delay', BigTime, {'explicit': 1, 'optional': True}), ] class SetOfTimingPolicy(SetOf): _child_spec = TimingPolicy class AttCertAttributeType(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.10.1': 'authentication_info', '1.3.6.1.5.5.7.10.2': 'access_identity', '1.3.6.1.5.5.7.10.3': 'charging_identity', '1.3.6.1.5.5.7.10.4': 'group', '2.5.4.72': 'role', '2.5.4.55': 'clearance', '1.3.6.1.4.1.601.10.4.1': 'timing_metrics', '1.3.6.1.4.1.601.10.4.2': 'timing_policy', } class AttCertAttribute(Sequence): _fields = [ ('type', AttCertAttributeType), ('values', None), ] _oid_specs = { 'authentication_info': SetOfSvceAuthInfo, 'access_identity': SetOfSvceAuthInfo, 'charging_identity': SetOfIetfAttrSyntax, 'group': SetOfIetfAttrSyntax, 'role': SetOfRoleSyntax, 'clearance': SetOfClearance, 'timing_metrics': SetOfTimingMetrics, 'timing_policy': SetOfTimingPolicy, } def _values_spec(self): return self._oid_specs.get(self['type'].native, SetOfAny) _spec_callbacks = { 'values': _values_spec } class AttCertAttributes(SequenceOf): _child_spec = AttCertAttribute class AttributeCertificateInfoV2(Sequence): _fields = [ ('version', AttCertVersion), ('holder', Holder), ('issuer', AttCertIssuer), ('signature', SignedDigestAlgorithm), ('serial_number', Integer), ('att_cert_validity_period', AttCertValidityPeriod), ('attributes', AttCertAttributes), ('issuer_unique_id', OctetBitString, {'optional': True}), ('extensions', Extensions, {'optional': True}), ] class AttributeCertificateV2(Sequence): # Handle the situation where a V2 cert is encoded as V1 _bad_tag = 1 _fields = [ ('ac_info', AttributeCertificateInfoV2), ('signature_algorithm', SignedDigestAlgorithm), ('signature', OctetBitString), ] class OtherCertificateFormat(Sequence): _fields = [ ('other_cert_format', ObjectIdentifier), ('other_cert', Any), ] class CertificateChoices(Choice): _alternatives = [ ('certificate', Certificate), ('extended_certificate', ExtendedCertificate, {'implicit': 0}), ('v1_attr_cert', AttributeCertificateV1, {'implicit': 1}), ('v2_attr_cert', AttributeCertificateV2, {'implicit': 2}), ('other', OtherCertificateFormat, {'implicit': 3}), ] def validate(self, class_, tag, contents): """ Ensures that the class and tag specified exist as an alternative. This custom version fixes parsing broken encodings there a V2 attribute # certificate is encoded as a V1 :param class_: The integer class_ from the encoded value header :param tag: The integer tag from the encoded value header :param contents: A byte string of the contents of the value - used when the object is explicitly tagged :raises: ValueError - when value is not a valid alternative """ super(CertificateChoices, self).validate(class_, tag, contents) if self._choice == 2: if AttCertVersion.load(Sequence.load(contents)[0].dump()).native == 'v2': self._choice = 3 class CertificateSet(SetOf): _child_spec = CertificateChoices class ContentInfo(Sequence): _fields = [ ('content_type', ContentType), ('content', Any, {'explicit': 0, 'optional': True}), ] _oid_pair = ('content_type', 'content') _oid_specs = {} class SetOfContentInfo(SetOf): _child_spec = ContentInfo class EncapsulatedContentInfo(Sequence): _fields = [ ('content_type', ContentType), ('content', ParsableOctetString, {'explicit': 0, 'optional': True}), ] _oid_pair = ('content_type', 'content') _oid_specs = {} class IssuerAndSerialNumber(Sequence): _fields = [ ('issuer', Name), ('serial_number', Integer), ] class SignerIdentifier(Choice): _alternatives = [ ('issuer_and_serial_number', IssuerAndSerialNumber), ('subject_key_identifier', OctetString, {'implicit': 0}), ] class DigestAlgorithms(SetOf): _child_spec = DigestAlgorithm class CertificateRevocationLists(SetOf): _child_spec = CertificateList class SCVPReqRes(Sequence): _fields = [ ('request', ContentInfo, {'explicit': 0, 'optional': True}), ('response', ContentInfo), ] class OtherRevInfoFormatId(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.16.2': 'ocsp_response', '1.3.6.1.5.5.7.16.4': 'scvp', } class OtherRevocationInfoFormat(Sequence): _fields = [ ('other_rev_info_format', OtherRevInfoFormatId), ('other_rev_info', Any), ] _oid_pair = ('other_rev_info_format', 'other_rev_info') _oid_specs = { 'ocsp_response': OCSPResponse, 'scvp': SCVPReqRes, } class RevocationInfoChoice(Choice): _alternatives = [ ('crl', CertificateList), ('other', OtherRevocationInfoFormat, {'implicit': 1}), ] class RevocationInfoChoices(SetOf): _child_spec = RevocationInfoChoice class SignerInfo(Sequence): _fields = [ ('version', CMSVersion), ('sid', SignerIdentifier), ('digest_algorithm', DigestAlgorithm), ('signed_attrs', CMSAttributes, {'implicit': 0, 'optional': True}), ('signature_algorithm', SignedDigestAlgorithm), ('signature', OctetString), ('unsigned_attrs', CMSAttributes, {'implicit': 1, 'optional': True}), ] class SignerInfos(SetOf): _child_spec = SignerInfo class SignedData(Sequence): _fields = [ ('version', CMSVersion), ('digest_algorithms', DigestAlgorithms), ('encap_content_info', None), ('certificates', CertificateSet, {'implicit': 0, 'optional': True}), ('crls', RevocationInfoChoices, {'implicit': 1, 'optional': True}), ('signer_infos', SignerInfos), ] def _encap_content_info_spec(self): # If the encap_content_info is version v1, then this could be a PKCS#7 # structure, or a CMS structure. CMS wraps the encoded value in an # Octet String tag. # If the version is greater than 1, it is definite CMS if self['version'].native != 'v1': return EncapsulatedContentInfo # Otherwise, the ContentInfo spec from PKCS#7 will be compatible with # CMS v1 (which only allows Data, an Octet String) and PKCS#7, which # allows Any return ContentInfo _spec_callbacks = { 'encap_content_info': _encap_content_info_spec } class OriginatorInfo(Sequence): _fields = [ ('certs', CertificateSet, {'implicit': 0, 'optional': True}), ('crls', RevocationInfoChoices, {'implicit': 1, 'optional': True}), ] class RecipientIdentifier(Choice): _alternatives = [ ('issuer_and_serial_number', IssuerAndSerialNumber), ('subject_key_identifier', OctetString, {'implicit': 0}), ] class KeyEncryptionAlgorithmId(ObjectIdentifier): _map = { '1.2.840.113549.1.1.1': 'rsaes_pkcs1v15', '1.2.840.113549.1.1.7': 'rsaes_oaep', '2.16.840.1.101.3.4.1.5': 'aes128_wrap', '2.16.840.1.101.3.4.1.8': 'aes128_wrap_pad', '2.16.840.1.101.3.4.1.25': 'aes192_wrap', '2.16.840.1.101.3.4.1.28': 'aes192_wrap_pad', '2.16.840.1.101.3.4.1.45': 'aes256_wrap', '2.16.840.1.101.3.4.1.48': 'aes256_wrap_pad', } _reverse_map = { 'rsa': '1.2.840.113549.1.1.1', 'rsaes_pkcs1v15': '1.2.840.113549.1.1.1', 'rsaes_oaep': '1.2.840.113549.1.1.7', 'aes128_wrap': '2.16.840.1.101.3.4.1.5', 'aes128_wrap_pad': '2.16.840.1.101.3.4.1.8', 'aes192_wrap': '2.16.840.1.101.3.4.1.25', 'aes192_wrap_pad': '2.16.840.1.101.3.4.1.28', 'aes256_wrap': '2.16.840.1.101.3.4.1.45', 'aes256_wrap_pad': '2.16.840.1.101.3.4.1.48', } class KeyEncryptionAlgorithm(_ForceNullParameters, Sequence): _fields = [ ('algorithm', KeyEncryptionAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'rsaes_oaep': RSAESOAEPParams, } class KeyTransRecipientInfo(Sequence): _fields = [ ('version', CMSVersion), ('rid', RecipientIdentifier), ('key_encryption_algorithm', KeyEncryptionAlgorithm), ('encrypted_key', OctetString), ] class OriginatorIdentifierOrKey(Choice): _alternatives = [ ('issuer_and_serial_number', IssuerAndSerialNumber), ('subject_key_identifier', OctetString, {'implicit': 0}), ('originator_key', PublicKeyInfo, {'implicit': 1}), ] class OtherKeyAttribute(Sequence): _fields = [ ('key_attr_id', ObjectIdentifier), ('key_attr', Any), ] class RecipientKeyIdentifier(Sequence): _fields = [ ('subject_key_identifier', OctetString), ('date', GeneralizedTime, {'optional': True}), ('other', OtherKeyAttribute, {'optional': True}), ] class KeyAgreementRecipientIdentifier(Choice): _alternatives = [ ('issuer_and_serial_number', IssuerAndSerialNumber), ('r_key_id', RecipientKeyIdentifier, {'implicit': 0}), ] class RecipientEncryptedKey(Sequence): _fields = [ ('rid', KeyAgreementRecipientIdentifier), ('encrypted_key', OctetString), ] class RecipientEncryptedKeys(SequenceOf): _child_spec = RecipientEncryptedKey class KeyAgreeRecipientInfo(Sequence): _fields = [ ('version', CMSVersion), ('originator', OriginatorIdentifierOrKey, {'explicit': 0}), ('ukm', OctetString, {'explicit': 1, 'optional': True}), ('key_encryption_algorithm', KeyEncryptionAlgorithm), ('recipient_encrypted_keys', RecipientEncryptedKeys), ] class KEKIdentifier(Sequence): _fields = [ ('key_identifier', OctetString), ('date', GeneralizedTime, {'optional': True}), ('other', OtherKeyAttribute, {'optional': True}), ] class KEKRecipientInfo(Sequence): _fields = [ ('version', CMSVersion), ('kekid', KEKIdentifier), ('key_encryption_algorithm', KeyEncryptionAlgorithm), ('encrypted_key', OctetString), ] class PasswordRecipientInfo(Sequence): _fields = [ ('version', CMSVersion), ('key_derivation_algorithm', KdfAlgorithm, {'implicit': 0, 'optional': True}), ('key_encryption_algorithm', KeyEncryptionAlgorithm), ('encrypted_key', OctetString), ] class OtherRecipientInfo(Sequence): _fields = [ ('ori_type', ObjectIdentifier), ('ori_value', Any), ] class RecipientInfo(Choice): _alternatives = [ ('ktri', KeyTransRecipientInfo), ('kari', KeyAgreeRecipientInfo, {'implicit': 1}), ('kekri', KEKRecipientInfo, {'implicit': 2}), ('pwri', PasswordRecipientInfo, {'implicit': 3}), ('ori', OtherRecipientInfo, {'implicit': 4}), ] class RecipientInfos(SetOf): _child_spec = RecipientInfo class EncryptedContentInfo(Sequence): _fields = [ ('content_type', ContentType), ('content_encryption_algorithm', EncryptionAlgorithm), ('encrypted_content', OctetString, {'implicit': 0, 'optional': True}), ] class EnvelopedData(Sequence): _fields = [ ('version', CMSVersion), ('originator_info', OriginatorInfo, {'implicit': 0, 'optional': True}), ('recipient_infos', RecipientInfos), ('encrypted_content_info', EncryptedContentInfo), ('unprotected_attrs', CMSAttributes, {'implicit': 1, 'optional': True}), ] class SignedAndEnvelopedData(Sequence): _fields = [ ('version', CMSVersion), ('recipient_infos', RecipientInfos), ('digest_algorithms', DigestAlgorithms), ('encrypted_content_info', EncryptedContentInfo), ('certificates', CertificateSet, {'implicit': 0, 'optional': True}), ('crls', CertificateRevocationLists, {'implicit': 1, 'optional': True}), ('signer_infos', SignerInfos), ] class DigestedData(Sequence): _fields = [ ('version', CMSVersion), ('digest_algorithm', DigestAlgorithm), ('encap_content_info', None), ('digest', OctetString), ] def _encap_content_info_spec(self): # If the encap_content_info is version v1, then this could be a PKCS#7 # structure, or a CMS structure. CMS wraps the encoded value in an # Octet String tag. # If the version is greater than 1, it is definite CMS if self['version'].native != 'v1': return EncapsulatedContentInfo # Otherwise, the ContentInfo spec from PKCS#7 will be compatible with # CMS v1 (which only allows Data, an Octet String) and PKCS#7, which # allows Any return ContentInfo _spec_callbacks = { 'encap_content_info': _encap_content_info_spec } class EncryptedData(Sequence): _fields = [ ('version', CMSVersion), ('encrypted_content_info', EncryptedContentInfo), ('unprotected_attrs', CMSAttributes, {'implicit': 1, 'optional': True}), ] class AuthenticatedData(Sequence): _fields = [ ('version', CMSVersion), ('originator_info', OriginatorInfo, {'implicit': 0, 'optional': True}), ('recipient_infos', RecipientInfos), ('mac_algorithm', HmacAlgorithm), ('digest_algorithm', DigestAlgorithm, {'implicit': 1, 'optional': True}), # This does not require the _spec_callbacks approach of SignedData and # DigestedData since AuthenticatedData was not part of PKCS#7 ('encap_content_info', EncapsulatedContentInfo), ('auth_attrs', CMSAttributes, {'implicit': 2, 'optional': True}), ('mac', OctetString), ('unauth_attrs', CMSAttributes, {'implicit': 3, 'optional': True}), ] class AuthEnvelopedData(Sequence): _fields = [ ('version', CMSVersion), ('originator_info', OriginatorInfo, {'implicit': 0, 'optional': True}), ('recipient_infos', RecipientInfos), ('auth_encrypted_content_info', EncryptedContentInfo), ('auth_attrs', CMSAttributes, {'implicit': 1, 'optional': True}), ('mac', OctetString), ('unauth_attrs', CMSAttributes, {'implicit': 2, 'optional': True}), ] class CompressionAlgorithmId(ObjectIdentifier): _map = { '1.2.840.113549.1.9.16.3.8': 'zlib', } class CompressionAlgorithm(Sequence): _fields = [ ('algorithm', CompressionAlgorithmId), ('parameters', Any, {'optional': True}), ] class CompressedData(Sequence): _fields = [ ('version', CMSVersion), ('compression_algorithm', CompressionAlgorithm), ('encap_content_info', EncapsulatedContentInfo), ] _decompressed = None @property def decompressed(self): if self._decompressed is None: if zlib is None: raise SystemError('The zlib module is not available') self._decompressed = zlib.decompress(self['encap_content_info']['content'].native) return self._decompressed class RecipientKeyIdentifier(Sequence): _fields = [ ('subjectKeyIdentifier', OctetString), ('date', GeneralizedTime, {'optional': True}), ('other', OtherKeyAttribute, {'optional': True}), ] class SMIMEEncryptionKeyPreference(Choice): _alternatives = [ ('issuer_and_serial_number', IssuerAndSerialNumber, {'implicit': 0}), ('recipientKeyId', RecipientKeyIdentifier, {'implicit': 1}), ('subjectAltKeyIdentifier', PublicKeyInfo, {'implicit': 2}), ] class SMIMEEncryptionKeyPreferences(SetOf): _child_spec = SMIMEEncryptionKeyPreference class SMIMECapabilityIdentifier(Sequence): _fields = [ ('capability_id', EncryptionAlgorithmId), ('parameters', Any, {'optional': True}), ] class SMIMECapabilites(SequenceOf): _child_spec = SMIMECapabilityIdentifier class SetOfSMIMECapabilites(SetOf): _child_spec = SMIMECapabilites ContentInfo._oid_specs = { 'data': OctetString, 'signed_data': SignedData, 'enveloped_data': EnvelopedData, 'signed_and_enveloped_data': SignedAndEnvelopedData, 'digested_data': DigestedData, 'encrypted_data': EncryptedData, 'authenticated_data': AuthenticatedData, 'compressed_data': CompressedData, 'authenticated_enveloped_data': AuthEnvelopedData, } EncapsulatedContentInfo._oid_specs = { 'signed_data': SignedData, 'enveloped_data': EnvelopedData, 'signed_and_enveloped_data': SignedAndEnvelopedData, 'digested_data': DigestedData, 'encrypted_data': EncryptedData, 'authenticated_data': AuthenticatedData, 'compressed_data': CompressedData, 'authenticated_enveloped_data': AuthEnvelopedData, } CMSAttribute._oid_specs = { 'content_type': SetOfContentType, 'message_digest': SetOfOctetString, 'signing_time': SetOfTime, 'counter_signature': SignerInfos, 'signature_time_stamp_token': SetOfContentInfo, 'cms_algorithm_protection': SetOfCMSAlgorithmProtection, 'microsoft_nested_signature': SetOfContentInfo, 'microsoft_time_stamp_token': SetOfContentInfo, 'encrypt_key_pref': SMIMEEncryptionKeyPreferences, 'smime_capabilities': SetOfSMIMECapabilites, } core.py000064400000515334152572326550006075 0ustar00# coding: utf-8 """ ASN.1 type classes for universal types. Exports the following items: - load() - Any() - Asn1Value() - BitString() - BMPString() - Boolean() - CharacterString() - Choice() - EmbeddedPdv() - Enumerated() - GeneralizedTime() - GeneralString() - GraphicString() - IA5String() - InstanceOf() - Integer() - IntegerBitString() - IntegerOctetString() - Null() - NumericString() - ObjectDescriptor() - ObjectIdentifier() - OctetBitString() - OctetString() - PrintableString() - Real() - RelativeOid() - Sequence() - SequenceOf() - Set() - SetOf() - TeletexString() - UniversalString() - UTCTime() - UTF8String() - VideotexString() - VisibleString() - VOID - Void() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function from datetime import datetime, timedelta from fractions import Fraction import binascii import copy import math import re import sys from . import _teletex_codec from ._errors import unwrap from ._ordereddict import OrderedDict from ._types import type_name, str_cls, byte_cls, int_types, chr_cls from .parser import _parse, _dump_header from .util import int_to_bytes, int_from_bytes, timezone, extended_datetime, create_timezone, utc_with_dst if sys.version_info <= (3,): from cStringIO import StringIO as BytesIO range = xrange # noqa _PY2 = True else: from io import BytesIO _PY2 = False _teletex_codec.register() CLASS_NUM_TO_NAME_MAP = { 0: 'universal', 1: 'application', 2: 'context', 3: 'private', } CLASS_NAME_TO_NUM_MAP = { 'universal': 0, 'application': 1, 'context': 2, 'private': 3, 0: 0, 1: 1, 2: 2, 3: 3, } METHOD_NUM_TO_NAME_MAP = { 0: 'primitive', 1: 'constructed', } _OID_RE = re.compile(r'^\d+(\.\d+)*$') # A global tracker to ensure that _setup() is called for every class, even # if is has been called for a parent class. This allows different _fields # definitions for child classes. Without such a construct, the child classes # would just see the parent class attributes and would use them. _SETUP_CLASSES = {} def load(encoded_data, strict=False): """ Loads a BER/DER-encoded byte string and construct a universal object based on the tag value: - 1: Boolean - 2: Integer - 3: BitString - 4: OctetString - 5: Null - 6: ObjectIdentifier - 7: ObjectDescriptor - 8: InstanceOf - 9: Real - 10: Enumerated - 11: EmbeddedPdv - 12: UTF8String - 13: RelativeOid - 16: Sequence, - 17: Set - 18: NumericString - 19: PrintableString - 20: TeletexString - 21: VideotexString - 22: IA5String - 23: UTCTime - 24: GeneralizedTime - 25: GraphicString - 26: VisibleString - 27: GeneralString - 28: UniversalString - 29: CharacterString - 30: BMPString :param encoded_data: A byte string of BER or DER-encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :raises: ValueError - when strict is True and trailing data is present ValueError - when the encoded value tag a tag other than listed above ValueError - when the ASN.1 header length is longer than the data TypeError - when encoded_data is not a byte string :return: An instance of the one of the universal classes """ return Asn1Value.load(encoded_data, strict=strict) class Asn1Value(object): """ The basis of all ASN.1 values """ # The integer 0 for primitive, 1 for constructed method = None # An integer 0 through 3 - see CLASS_NUM_TO_NAME_MAP for value class_ = None # An integer 1 or greater indicating the tag number tag = None # An alternate tag allowed for this type - used for handling broken # structures where a string value is encoded using an incorrect tag _bad_tag = None # If the value has been implicitly tagged implicit = False # If explicitly tagged, a tuple of 2-element tuples containing the # class int and tag int, from innermost to outermost explicit = None # The BER/DER header bytes _header = None # Raw encoded value bytes not including class, method, tag, length header contents = None # The BER/DER trailer bytes _trailer = b'' # The native python representation of the value - this is not used by # some classes since they utilize _bytes or _unicode _native = None @classmethod def load(cls, encoded_data, strict=False, **kwargs): """ Loads a BER/DER-encoded byte string using the current class as the spec :param encoded_data: A byte string of BER or DER-encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :return: An instance of the current class """ if not isinstance(encoded_data, byte_cls): raise TypeError('encoded_data must be a byte string, not %s' % type_name(encoded_data)) spec = None if cls.tag is not None: spec = cls value, _ = _parse_build(encoded_data, spec=spec, spec_params=kwargs, strict=strict) return value def __init__(self, explicit=None, implicit=None, no_explicit=False, tag_type=None, class_=None, tag=None, optional=None, default=None, contents=None, method=None): """ The optional parameter is not used, but rather included so we don't have to delete it from the parameter dictionary when passing as keyword args :param explicit: An int tag number for explicit tagging, or a 2-element tuple of class and tag. :param implicit: An int tag number for implicit tagging, or a 2-element tuple of class and tag. :param no_explicit: If explicit tagging info should be removed from this instance. Used internally to allow contructing the underlying value that has been wrapped in an explicit tag. :param tag_type: None for normal values, or one of "implicit", "explicit" for tagged values. Deprecated in favor of explicit and implicit params. :param class_: The class for the value - defaults to "universal" if tag_type is None, otherwise defaults to "context". Valid values include: - "universal" - "application" - "context" - "private" Deprecated in favor of explicit and implicit params. :param tag: The integer tag to override - usually this is used with tag_type or class_. Deprecated in favor of explicit and implicit params. :param optional: Dummy parameter that allows "optional" key in spec param dicts :param default: The default value to use if the value is currently None :param contents: A byte string of the encoded contents of the value :param method: The method for the value - no default value since this is normally set on a class. Valid values include: - "primitive" or 0 - "constructed" or 1 :raises: ValueError - when implicit, explicit, tag_type, class_ or tag are invalid values """ try: if self.__class__ not in _SETUP_CLASSES: cls = self.__class__ # Allow explicit to be specified as a simple 2-element tuple # instead of requiring the user make a nested tuple if cls.explicit is not None and isinstance(cls.explicit[0], int_types): cls.explicit = (cls.explicit, ) if hasattr(cls, '_setup'): self._setup() _SETUP_CLASSES[cls] = True # Normalize tagging values if explicit is not None: if isinstance(explicit, int_types): if class_ is None: class_ = 'context' explicit = (class_, explicit) # Prevent both explicit and tag_type == 'explicit' if tag_type == 'explicit': tag_type = None tag = None if implicit is not None: if isinstance(implicit, int_types): if class_ is None: class_ = 'context' implicit = (class_, implicit) # Prevent both implicit and tag_type == 'implicit' if tag_type == 'implicit': tag_type = None tag = None # Convert old tag_type API to explicit/implicit params if tag_type is not None: if class_ is None: class_ = 'context' if tag_type == 'explicit': explicit = (class_, tag) elif tag_type == 'implicit': implicit = (class_, tag) else: raise ValueError(unwrap( ''' tag_type must be one of "implicit", "explicit", not %s ''', repr(tag_type) )) if explicit is not None: # Ensure we have a tuple of 2-element tuples if len(explicit) == 2 and isinstance(explicit[1], int_types): explicit = (explicit, ) for class_, tag in explicit: invalid_class = None if isinstance(class_, int_types): if class_ not in CLASS_NUM_TO_NAME_MAP: invalid_class = class_ else: if class_ not in CLASS_NAME_TO_NUM_MAP: invalid_class = class_ class_ = CLASS_NAME_TO_NUM_MAP[class_] if invalid_class is not None: raise ValueError(unwrap( ''' explicit class must be one of "universal", "application", "context", "private", not %s ''', repr(invalid_class) )) if tag is not None: if not isinstance(tag, int_types): raise TypeError(unwrap( ''' explicit tag must be an integer, not %s ''', type_name(tag) )) if self.explicit is None: self.explicit = ((class_, tag), ) else: self.explicit = self.explicit + ((class_, tag), ) elif implicit is not None: class_, tag = implicit if class_ not in CLASS_NAME_TO_NUM_MAP: raise ValueError(unwrap( ''' implicit class must be one of "universal", "application", "context", "private", not %s ''', repr(class_) )) if tag is not None: if not isinstance(tag, int_types): raise TypeError(unwrap( ''' implicit tag must be an integer, not %s ''', type_name(tag) )) self.class_ = CLASS_NAME_TO_NUM_MAP[class_] self.tag = tag self.implicit = True else: if class_ is not None: if class_ not in CLASS_NAME_TO_NUM_MAP: raise ValueError(unwrap( ''' class_ must be one of "universal", "application", "context", "private", not %s ''', repr(class_) )) self.class_ = CLASS_NAME_TO_NUM_MAP[class_] if self.class_ is None: self.class_ = 0 if tag is not None: self.tag = tag if method is not None: if method not in set(["primitive", 0, "constructed", 1]): raise ValueError(unwrap( ''' method must be one of "primitive" or "constructed", not %s ''', repr(method) )) if method == "primitive": method = 0 elif method == "constructed": method = 1 self.method = method if no_explicit: self.explicit = None if contents is not None: self.contents = contents elif default is not None: self.set(default) except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while constructing %s' % type_name(self),) + args raise e def __str__(self): """ Since str is different in Python 2 and 3, this calls the appropriate method, __unicode__() or __bytes__() :return: A unicode string """ if _PY2: return self.__bytes__() else: return self.__unicode__() def __repr__(self): """ :return: A unicode string """ if _PY2: return '<%s %s b%s>' % (type_name(self), id(self), repr(self.dump())) else: return '<%s %s %s>' % (type_name(self), id(self), repr(self.dump())) def __bytes__(self): """ A fall-back method for print() in Python 2 :return: A byte string of the output of repr() """ return self.__repr__().encode('utf-8') def __unicode__(self): """ A fall-back method for print() in Python 3 :return: A unicode string of the output of repr() """ return self.__repr__() def _new_instance(self): """ Constructs a new copy of the current object, preserving any tagging :return: An Asn1Value object """ new_obj = self.__class__() new_obj.class_ = self.class_ new_obj.tag = self.tag new_obj.implicit = self.implicit new_obj.explicit = self.explicit return new_obj def __copy__(self): """ Implements the copy.copy() interface :return: A new shallow copy of the current Asn1Value object """ new_obj = self._new_instance() new_obj._copy(self, copy.copy) return new_obj def __deepcopy__(self, memo): """ Implements the copy.deepcopy() interface :param memo: A dict for memoization :return: A new deep copy of the current Asn1Value object """ new_obj = self._new_instance() memo[id(self)] = new_obj new_obj._copy(self, copy.deepcopy) return new_obj def copy(self): """ Copies the object, preserving any special tagging from it :return: An Asn1Value object """ return copy.deepcopy(self) def retag(self, tagging, tag=None): """ Copies the object, applying a new tagging to it :param tagging: A dict containing the keys "explicit" and "implicit". Legacy API allows a unicode string of "implicit" or "explicit". :param tag: A integer tag number. Only used when tagging is a unicode string. :return: An Asn1Value object """ # This is required to preserve the old API if not isinstance(tagging, dict): tagging = {tagging: tag} new_obj = self.__class__(explicit=tagging.get('explicit'), implicit=tagging.get('implicit')) new_obj._copy(self, copy.deepcopy) return new_obj def untag(self): """ Copies the object, removing any special tagging from it :return: An Asn1Value object """ new_obj = self.__class__() new_obj._copy(self, copy.deepcopy) return new_obj def _copy(self, other, copy_func): """ Copies the contents of another Asn1Value object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ if self.__class__ != other.__class__: raise TypeError(unwrap( ''' Can not copy values from %s object to %s object ''', type_name(other), type_name(self) )) self.contents = other.contents self._native = copy_func(other._native) def debug(self, nest_level=1): """ Show the binary data and parsed data in a tree structure """ prefix = ' ' * nest_level # This interacts with Any and moves the tag, implicit, explicit, _header, # contents, _footer to the parsed value so duplicate data isn't present has_parsed = hasattr(self, 'parsed') _basic_debug(prefix, self) if has_parsed: self.parsed.debug(nest_level + 2) elif hasattr(self, 'chosen'): self.chosen.debug(nest_level + 2) else: if _PY2 and isinstance(self.native, byte_cls): print('%s Native: b%s' % (prefix, repr(self.native))) else: print('%s Native: %s' % (prefix, self.native)) def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ contents = self.contents # If the length is indefinite, force the re-encoding if self._header is not None and self._header[-1:] == b'\x80': force = True if self._header is None or force: if isinstance(self, Constructable) and self._indefinite: self.method = 0 header = _dump_header(self.class_, self.method, self.tag, self.contents) if self.explicit is not None: for class_, tag in self.explicit: header = _dump_header(class_, 1, tag, header + self.contents) + header self._header = header self._trailer = b'' return self._header + contents + self._trailer class ValueMap(): """ Basic functionality that allows for mapping values from ints or OIDs to python unicode strings """ # A dict from primitive value (int or OID) to unicode string. This needs # to be defined in the source code _map = None # A dict from unicode string to int/OID. This is automatically generated # from _map the first time it is needed _reverse_map = None def _setup(self): """ Generates _reverse_map from _map """ cls = self.__class__ if cls._map is None or cls._reverse_map is not None: return cls._reverse_map = {} for key, value in cls._map.items(): cls._reverse_map[value] = key class Castable(object): """ A mixin to handle converting an object between different classes that represent the same encoded value, but with different rules for converting to and from native Python values """ def cast(self, other_class): """ Converts the current object into an object of a different class. The new class must use the ASN.1 encoding for the value. :param other_class: The class to instantiate the new object from :return: An instance of the type other_class """ if other_class.tag != self.__class__.tag: raise TypeError(unwrap( ''' Can not covert a value from %s object to %s object since they use different tags: %d versus %d ''', type_name(other_class), type_name(self), other_class.tag, self.__class__.tag )) new_obj = other_class() new_obj.class_ = self.class_ new_obj.implicit = self.implicit new_obj.explicit = self.explicit new_obj._header = self._header new_obj.contents = self.contents new_obj._trailer = self._trailer if isinstance(self, Constructable): new_obj.method = self.method new_obj._indefinite = self._indefinite return new_obj class Constructable(object): """ A mixin to handle string types that may be constructed from chunks contained within an indefinite length BER-encoded container """ # Instance attribute indicating if an object was indefinite # length when parsed - affects parsing and dumping _indefinite = False def _merge_chunks(self): """ :return: A concatenation of the native values of the contained chunks """ if not self._indefinite: return self._as_chunk() pointer = 0 contents_len = len(self.contents) output = None while pointer < contents_len: # We pass the current class as the spec so content semantics are preserved sub_value, pointer = _parse_build(self.contents, pointer, spec=self.__class__) if output is None: output = sub_value._merge_chunks() else: output += sub_value._merge_chunks() if output is None: return self._as_chunk() return output def _as_chunk(self): """ A method to return a chunk of data that can be combined for constructed method values :return: A native Python value that can be added together. Examples include byte strings, unicode strings or tuples. """ return self.contents def _setable_native(self): """ Returns a native value that can be round-tripped into .set(), to result in a DER encoding. This differs from .native in that .native is designed for the end use, and may account for the fact that the merged value is further parsed as ASN.1, such as in the case of ParsableOctetString() and ParsableOctetBitString(). :return: A python value that is valid to pass to .set() """ return self.native def _copy(self, other, copy_func): """ Copies the contents of another Constructable object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(Constructable, self)._copy(other, copy_func) # We really don't want to dump BER encodings, so if we see an # indefinite encoding, let's re-encode it if other._indefinite: self.set(other._setable_native()) class Void(Asn1Value): """ A representation of an optional value that is not present. Has .native property and .dump() method to be compatible with other value classes. """ contents = b'' def __eq__(self, other): """ :param other: The other Primitive to compare to :return: A boolean """ return other.__class__ == self.__class__ def __nonzero__(self): return False def __len__(self): return 0 def __iter__(self): return iter(()) @property def native(self): """ The native Python datatype representation of this value :return: None """ return None def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ return b'' VOID = Void() class Any(Asn1Value): """ A value class that can contain any value, and allows for easy parsing of the underlying encoded value using a spec. This is normally contained in a Structure that has an ObjectIdentifier field and _oid_pair and _oid_specs defined. """ # The parsed value object _parsed = None def __init__(self, value=None, **kwargs): """ Sets the value of the object before passing to Asn1Value.__init__() :param value: An Asn1Value object that will be set as the parsed value """ Asn1Value.__init__(self, **kwargs) try: if value is not None: if not isinstance(value, Asn1Value): raise TypeError(unwrap( ''' value must be an instance of Asn1Value, not %s ''', type_name(value) )) self._parsed = (value, value.__class__, None) self.contents = value.dump() except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while constructing %s' % type_name(self),) + args raise e @property def native(self): """ The native Python datatype representation of this value :return: The .native value from the parsed value object """ if self._parsed is None: self.parse() return self._parsed[0].native @property def parsed(self): """ Returns the parsed object from .parse() :return: The object returned by .parse() """ if self._parsed is None: self.parse() return self._parsed[0] def parse(self, spec=None, spec_params=None): """ Parses the contents generically, or using a spec with optional params :param spec: A class derived from Asn1Value that defines what class_ and tag the value should have, and the semantics of the encoded value. The return value will be of this type. If omitted, the encoded value will be decoded using the standard universal tag based on the encoded tag number. :param spec_params: A dict of params to pass to the spec object :return: An object of the type spec, or if not present, a child of Asn1Value """ if self._parsed is None or self._parsed[1:3] != (spec, spec_params): try: passed_params = spec_params or {} _tag_type_to_explicit_implicit(passed_params) if self.explicit is not None: if 'explicit' in passed_params: passed_params['explicit'] = self.explicit + passed_params['explicit'] else: passed_params['explicit'] = self.explicit contents = self._header + self.contents + self._trailer parsed_value, _ = _parse_build( contents, spec=spec, spec_params=passed_params ) self._parsed = (parsed_value, spec, spec_params) # Once we've parsed the Any value, clear any attributes from this object # since they are now duplicate self.tag = None self.explicit = None self.implicit = False self._header = b'' self.contents = contents self._trailer = b'' except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(self),) + args raise e return self._parsed[0] def _copy(self, other, copy_func): """ Copies the contents of another Any object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(Any, self)._copy(other, copy_func) self._parsed = copy_func(other._parsed) def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ if self._parsed is None: self.parse() return self._parsed[0].dump(force=force) class Choice(Asn1Value): """ A class to handle when a value may be one of several options """ # The index in _alternatives of the validated alternative _choice = None # The name of the chosen alternative _name = None # The Asn1Value object for the chosen alternative _parsed = None # Choice overrides .contents to be a property so that the code expecting # the .contents attribute will get the .contents of the chosen alternative _contents = None # A list of tuples in one of the following forms. # # Option 1, a unicode string field name and a value class # # ("name", Asn1ValueClass) # # Option 2, same as Option 1, but with a dict of class params # # ("name", Asn1ValueClass, {'explicit': 5}) _alternatives = None # A dict that maps tuples of (class_, tag) to an index in _alternatives _id_map = None # A dict that maps alternative names to an index in _alternatives _name_map = None @classmethod def load(cls, encoded_data, strict=False, **kwargs): """ Loads a BER/DER-encoded byte string using the current class as the spec :param encoded_data: A byte string of BER or DER encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :return: A instance of the current class """ if not isinstance(encoded_data, byte_cls): raise TypeError('encoded_data must be a byte string, not %s' % type_name(encoded_data)) value, _ = _parse_build(encoded_data, spec=cls, spec_params=kwargs, strict=strict) return value def _setup(self): """ Generates _id_map from _alternatives to allow validating contents """ cls = self.__class__ cls._id_map = {} cls._name_map = {} for index, info in enumerate(cls._alternatives): if len(info) < 3: info = info + ({},) cls._alternatives[index] = info id_ = _build_id_tuple(info[2], info[1]) cls._id_map[id_] = index cls._name_map[info[0]] = index def __init__(self, name=None, value=None, **kwargs): """ Checks to ensure implicit tagging is not being used since it is incompatible with Choice, then forwards on to Asn1Value.__init__() :param name: The name of the alternative to be set - used with value. Alternatively this may be a dict with a single key being the name and the value being the value, or a two-element tuple of the name and the value. :param value: The alternative value to set - used with name :raises: ValueError - when implicit param is passed (or legacy tag_type param is "implicit") """ _tag_type_to_explicit_implicit(kwargs) Asn1Value.__init__(self, **kwargs) try: if kwargs.get('implicit') is not None: raise ValueError(unwrap( ''' The Choice type can not be implicitly tagged even if in an implicit module - due to its nature any tagging must be explicit ''' )) if name is not None: if isinstance(name, dict): if len(name) != 1: raise ValueError(unwrap( ''' When passing a dict as the "name" argument to %s, it must have a single key/value - however %d were present ''', type_name(self), len(name) )) name, value = list(name.items())[0] if isinstance(name, tuple): if len(name) != 2: raise ValueError(unwrap( ''' When passing a tuple as the "name" argument to %s, it must have two elements, the name and value - however %d were present ''', type_name(self), len(name) )) value = name[1] name = name[0] if name not in self._name_map: raise ValueError(unwrap( ''' The name specified, "%s", is not a valid alternative for %s ''', name, type_name(self) )) self._choice = self._name_map[name] _, spec, params = self._alternatives[self._choice] if not isinstance(value, spec): value = spec(value, **params) else: value = _fix_tagging(value, params) self._parsed = value except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while constructing %s' % type_name(self),) + args raise e @property def contents(self): """ :return: A byte string of the DER-encoded contents of the chosen alternative """ if self._parsed is not None: return self._parsed.contents return self._contents @contents.setter def contents(self, value): """ :param value: A byte string of the DER-encoded contents of the chosen alternative """ self._contents = value @property def name(self): """ :return: A unicode string of the field name of the chosen alternative """ if not self._name: self._name = self._alternatives[self._choice][0] return self._name def parse(self): """ Parses the detected alternative :return: An Asn1Value object of the chosen alternative """ if self._parsed is None: try: _, spec, params = self._alternatives[self._choice] self._parsed, _ = _parse_build(self._contents, spec=spec, spec_params=params) except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(self),) + args raise e return self._parsed @property def chosen(self): """ :return: An Asn1Value object of the chosen alternative """ return self.parse() @property def native(self): """ The native Python datatype representation of this value :return: The .native value from the contained value object """ return self.chosen.native def validate(self, class_, tag, contents): """ Ensures that the class and tag specified exist as an alternative :param class_: The integer class_ from the encoded value header :param tag: The integer tag from the encoded value header :param contents: A byte string of the contents of the value - used when the object is explicitly tagged :raises: ValueError - when value is not a valid alternative """ id_ = (class_, tag) if self.explicit is not None: if self.explicit[-1] != id_: raise ValueError(unwrap( ''' %s was explicitly tagged, but the value provided does not match the class and tag ''', type_name(self) )) ((class_, _, tag, _, _, _), _) = _parse(contents, len(contents)) id_ = (class_, tag) if id_ in self._id_map: self._choice = self._id_map[id_] return # This means the Choice was implicitly tagged if self.class_ is not None and self.tag is not None: if len(self._alternatives) > 1: raise ValueError(unwrap( ''' %s was implicitly tagged, but more than one alternative exists ''', type_name(self) )) if id_ == (self.class_, self.tag): self._choice = 0 return asn1 = self._format_class_tag(class_, tag) asn1s = [self._format_class_tag(pair[0], pair[1]) for pair in self._id_map] raise ValueError(unwrap( ''' Value %s did not match the class and tag of any of the alternatives in %s: %s ''', asn1, type_name(self), ', '.join(asn1s) )) def _format_class_tag(self, class_, tag): """ :return: A unicode string of a human-friendly representation of the class and tag """ return '[%s %s]' % (CLASS_NUM_TO_NAME_MAP[class_].upper(), tag) def _copy(self, other, copy_func): """ Copies the contents of another Choice object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(Choice, self)._copy(other, copy_func) self._choice = other._choice self._name = other._name self._parsed = copy_func(other._parsed) def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ # If the length is indefinite, force the re-encoding if self._header is not None and self._header[-1:] == b'\x80': force = True self._contents = self.chosen.dump(force=force) if self._header is None or force: self._header = b'' if self.explicit is not None: for class_, tag in self.explicit: self._header = _dump_header(class_, 1, tag, self._header + self._contents) + self._header return self._header + self._contents class Concat(object): """ A class that contains two or more encoded child values concatentated together. THIS IS NOT PART OF THE ASN.1 SPECIFICATION! This exists to handle the x509.TrustedCertificate() class for OpenSSL certificates containing extra information. """ # A list of the specs of the concatenated values _child_specs = None _children = None @classmethod def load(cls, encoded_data, strict=False): """ Loads a BER/DER-encoded byte string using the current class as the spec :param encoded_data: A byte string of BER or DER encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :return: A Concat object """ return cls(contents=encoded_data, strict=strict) def __init__(self, value=None, contents=None, strict=False): """ :param value: A native Python datatype to initialize the object value with :param contents: A byte string of the encoded contents of the value :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists in contents :raises: ValueError - when an error occurs with one of the children TypeError - when an error occurs with one of the children """ if contents is not None: try: contents_len = len(contents) self._children = [] offset = 0 for spec in self._child_specs: if offset < contents_len: child_value, offset = _parse_build(contents, pointer=offset, spec=spec) else: child_value = spec() self._children.append(child_value) if strict and offset != contents_len: extra_bytes = contents_len - offset raise ValueError('Extra data - %d bytes of trailing data were provided' % extra_bytes) except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while constructing %s' % type_name(self),) + args raise e if value is not None: if self._children is None: self._children = [None] * len(self._child_specs) for index, data in enumerate(value): self.__setitem__(index, data) def __str__(self): """ Since str is different in Python 2 and 3, this calls the appropriate method, __unicode__() or __bytes__() :return: A unicode string """ if _PY2: return self.__bytes__() else: return self.__unicode__() def __bytes__(self): """ A byte string of the DER-encoded contents """ return self.dump() def __unicode__(self): """ :return: A unicode string """ return repr(self) def __repr__(self): """ :return: A unicode string """ return '<%s %s %s>' % (type_name(self), id(self), repr(self.dump())) def __copy__(self): """ Implements the copy.copy() interface :return: A new shallow copy of the Concat object """ new_obj = self.__class__() new_obj._copy(self, copy.copy) return new_obj def __deepcopy__(self, memo): """ Implements the copy.deepcopy() interface :param memo: A dict for memoization :return: A new deep copy of the Concat object and all child objects """ new_obj = self.__class__() memo[id(self)] = new_obj new_obj._copy(self, copy.deepcopy) return new_obj def copy(self): """ Copies the object :return: A Concat object """ return copy.deepcopy(self) def _copy(self, other, copy_func): """ Copies the contents of another Concat object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ if self.__class__ != other.__class__: raise TypeError(unwrap( ''' Can not copy values from %s object to %s object ''', type_name(other), type_name(self) )) self._children = copy_func(other._children) def debug(self, nest_level=1): """ Show the binary data and parsed data in a tree structure """ prefix = ' ' * nest_level print('%s%s Object #%s' % (prefix, type_name(self), id(self))) print('%s Children:' % (prefix,)) for child in self._children: child.debug(nest_level + 2) def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ contents = b'' for child in self._children: contents += child.dump(force=force) return contents @property def contents(self): """ :return: A byte string of the DER-encoded contents of the children """ return self.dump() def __len__(self): """ :return: Integer """ return len(self._children) def __getitem__(self, key): """ Allows accessing children by index :param key: An integer of the child index :raises: KeyError - when an index is invalid :return: The Asn1Value object of the child specified """ if key > len(self._child_specs) - 1 or key < 0: raise KeyError(unwrap( ''' No child is definition for position %d of %s ''', key, type_name(self) )) return self._children[key] def __setitem__(self, key, value): """ Allows settings children by index :param key: An integer of the child index :param value: An Asn1Value object to set the child to :raises: KeyError - when an index is invalid ValueError - when the value is not an instance of Asn1Value """ if key > len(self._child_specs) - 1 or key < 0: raise KeyError(unwrap( ''' No child is defined for position %d of %s ''', key, type_name(self) )) if not isinstance(value, Asn1Value): raise ValueError(unwrap( ''' Value for child %s of %s is not an instance of asn1crypto.core.Asn1Value ''', key, type_name(self) )) self._children[key] = value def __iter__(self): """ :return: An iterator of child values """ return iter(self._children) class Primitive(Asn1Value): """ Sets the class_ and method attributes for primitive, universal values """ class_ = 0 method = 0 def __init__(self, value=None, default=None, contents=None, **kwargs): """ Sets the value of the object before passing to Asn1Value.__init__() :param value: A native Python datatype to initialize the object value with :param default: The default value if no value is specified :param contents: A byte string of the encoded contents of the value """ Asn1Value.__init__(self, **kwargs) try: if contents is not None: self.contents = contents elif value is not None: self.set(value) elif default is not None: self.set(default) except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while constructing %s' % type_name(self),) + args raise e def set(self, value): """ Sets the value of the object :param value: A byte string """ if not isinstance(value, byte_cls): raise TypeError(unwrap( ''' %s value must be a byte string, not %s ''', type_name(self), type_name(value) )) self._native = value self.contents = value self._header = None if self._trailer != b'': self._trailer = b'' def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ # If the length is indefinite, force the re-encoding if self._header is not None and self._header[-1:] == b'\x80': force = True if force: native = self.native self.contents = None self.set(native) return Asn1Value.dump(self) def __ne__(self, other): return not self == other def __eq__(self, other): """ :param other: The other Primitive to compare to :return: A boolean """ if not isinstance(other, Primitive): return False if self.contents != other.contents: return False # We compare class tag numbers since object tag numbers could be # different due to implicit or explicit tagging if self.__class__.tag != other.__class__.tag: return False if self.__class__ == other.__class__ and self.contents == other.contents: return True # If the objects share a common base class that is not too low-level # then we can compare the contents self_bases = (set(self.__class__.__bases__) | set([self.__class__])) - set([Asn1Value, Primitive, ValueMap]) other_bases = (set(other.__class__.__bases__) | set([other.__class__])) - set([Asn1Value, Primitive, ValueMap]) if self_bases | other_bases: return self.contents == other.contents # When tagging is going on, do the extra work of constructing new # objects to see if the dumped representation are the same if self.implicit or self.explicit or other.implicit or other.explicit: return self.untag().dump() == other.untag().dump() return self.dump() == other.dump() class AbstractString(Constructable, Primitive): """ A base class for all strings that have a known encoding. In general, we do not worry ourselves with confirming that the decoded values match a specific set of characters, only that they are decoded into a Python unicode string """ # The Python encoding name to use when decoding or encoded the contents _encoding = 'latin1' # Instance attribute of (possibly-merged) unicode string _unicode = None def set(self, value): """ Sets the value of the string :param value: A unicode string """ if not isinstance(value, str_cls): raise TypeError(unwrap( ''' %s value must be a unicode string, not %s ''', type_name(self), type_name(value) )) self._unicode = value self.contents = value.encode(self._encoding) self._header = None if self._indefinite: self._indefinite = False self.method = 0 if self._trailer != b'': self._trailer = b'' def __unicode__(self): """ :return: A unicode string """ if self.contents is None: return '' if self._unicode is None: self._unicode = self._merge_chunks().decode(self._encoding) return self._unicode def _copy(self, other, copy_func): """ Copies the contents of another AbstractString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(AbstractString, self)._copy(other, copy_func) self._unicode = other._unicode @property def native(self): """ The native Python datatype representation of this value :return: A unicode string or None """ if self.contents is None: return None return self.__unicode__() class Boolean(Primitive): """ Represents a boolean in both ASN.1 and Python """ tag = 1 def set(self, value): """ Sets the value of the object :param value: True, False or another value that works with bool() """ self._native = bool(value) self.contents = b'\x00' if not value else b'\xff' self._header = None if self._trailer != b'': self._trailer = b'' # Python 2 def __nonzero__(self): """ :return: True or False """ return self.__bool__() def __bool__(self): """ :return: True or False """ return self.contents != b'\x00' @property def native(self): """ The native Python datatype representation of this value :return: True, False or None """ if self.contents is None: return None if self._native is None: self._native = self.__bool__() return self._native class Integer(Primitive, ValueMap): """ Represents an integer in both ASN.1 and Python """ tag = 2 def set(self, value): """ Sets the value of the object :param value: An integer, or a unicode string if _map is set :raises: ValueError - when an invalid value is passed """ if isinstance(value, str_cls): if self._map is None: raise ValueError(unwrap( ''' %s value is a unicode string, but no _map provided ''', type_name(self) )) if value not in self._reverse_map: raise ValueError(unwrap( ''' %s value, %s, is not present in the _map ''', type_name(self), value )) value = self._reverse_map[value] elif not isinstance(value, int_types): raise TypeError(unwrap( ''' %s value must be an integer or unicode string when a name_map is provided, not %s ''', type_name(self), type_name(value) )) self._native = self._map[value] if self._map and value in self._map else value self.contents = int_to_bytes(value, signed=True) self._header = None if self._trailer != b'': self._trailer = b'' def __int__(self): """ :return: An integer """ return int_from_bytes(self.contents, signed=True) @property def native(self): """ The native Python datatype representation of this value :return: An integer or None """ if self.contents is None: return None if self._native is None: self._native = self.__int__() if self._map is not None and self._native in self._map: self._native = self._map[self._native] return self._native class _IntegerBitString(object): """ A mixin for IntegerBitString and BitString to parse the contents as an integer. """ # Tuple of 1s and 0s; set through native _unused_bits = () def _as_chunk(self): """ Parse the contents of a primitive BitString encoding as an integer value. Allows reconstructing indefinite length values. :raises: ValueError - when an invalid value is passed :return: A list with one tuple (value, bits, unused_bits) where value is an integer with the value of the BitString, bits is the bit count of value and unused_bits is a tuple of 1s and 0s. """ if self._indefinite: # return an empty chunk, for cases like \x23\x80\x00\x00 return [] unused_bits_len = ord(self.contents[0]) if _PY2 else self.contents[0] value = int_from_bytes(self.contents[1:]) bits = (len(self.contents) - 1) * 8 if not unused_bits_len: return [(value, bits, ())] if len(self.contents) == 1: # Disallowed by X.690 §8.6.2.3 raise ValueError('Empty bit string has {0} unused bits'.format(unused_bits_len)) if unused_bits_len > 7: # Disallowed by X.690 §8.6.2.2 raise ValueError('Bit string has {0} unused bits'.format(unused_bits_len)) unused_bits = _int_to_bit_tuple(value & ((1 << unused_bits_len) - 1), unused_bits_len) value >>= unused_bits_len bits -= unused_bits_len return [(value, bits, unused_bits)] def _chunks_to_int(self): """ Combines the chunks into a single value. :raises: ValueError - when an invalid value is passed :return: A tuple (value, bits, unused_bits) where value is an integer with the value of the BitString, bits is the bit count of value and unused_bits is a tuple of 1s and 0s. """ if not self._indefinite: # Fast path return self._as_chunk()[0] value = 0 total_bits = 0 unused_bits = () # X.690 §8.6.3 allows empty indefinite encodings for chunk, bits, unused_bits in self._merge_chunks(): if total_bits & 7: # Disallowed by X.690 §8.6.4 raise ValueError('Only last chunk in a bit string may have unused bits') total_bits += bits value = (value << bits) | chunk return value, total_bits, unused_bits def _copy(self, other, copy_func): """ Copies the contents of another _IntegerBitString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(_IntegerBitString, self)._copy(other, copy_func) self._unused_bits = other._unused_bits @property def unused_bits(self): """ The unused bits of the bit string encoding. :return: A tuple of 1s and 0s """ # call native to set _unused_bits self.native return self._unused_bits class BitString(_IntegerBitString, Constructable, Castable, Primitive, ValueMap): """ Represents a bit string from ASN.1 as a Python tuple of 1s and 0s """ tag = 3 _size = None def _setup(self): """ Generates _reverse_map from _map """ ValueMap._setup(self) cls = self.__class__ if cls._map is not None: cls._size = max(self._map.keys()) + 1 def set(self, value): """ Sets the value of the object :param value: An integer or a tuple of integers 0 and 1 :raises: ValueError - when an invalid value is passed """ if isinstance(value, set): if self._map is None: raise ValueError(unwrap( ''' %s._map has not been defined ''', type_name(self) )) bits = [0] * self._size self._native = value for index in range(0, self._size): key = self._map.get(index) if key is None: continue if key in value: bits[index] = 1 value = ''.join(map(str_cls, bits)) elif value.__class__ == tuple: if self._map is None: self._native = value else: self._native = set() for index, bit in enumerate(value): if bit: name = self._map.get(index, index) self._native.add(name) value = ''.join(map(str_cls, value)) else: raise TypeError(unwrap( ''' %s value must be a tuple of ones and zeros or a set of unicode strings, not %s ''', type_name(self), type_name(value) )) if self._map is not None: if len(value) > self._size: raise ValueError(unwrap( ''' %s value must be at most %s bits long, specified was %s long ''', type_name(self), self._size, len(value) )) # A NamedBitList must have trailing zero bit truncated. See # https://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf # section 11.2, # https://tools.ietf.org/html/rfc5280#page-134 and # https://www.ietf.org/mail-archive/web/pkix/current/msg10443.html value = value.rstrip('0') size = len(value) size_mod = size % 8 extra_bits = 0 if size_mod != 0: extra_bits = 8 - size_mod value += '0' * extra_bits size_in_bytes = int(math.ceil(size / 8)) if extra_bits: extra_bits_byte = int_to_bytes(extra_bits) else: extra_bits_byte = b'\x00' if value == '': value_bytes = b'' else: value_bytes = int_to_bytes(int(value, 2)) if len(value_bytes) != size_in_bytes: value_bytes = (b'\x00' * (size_in_bytes - len(value_bytes))) + value_bytes self.contents = extra_bits_byte + value_bytes self._unused_bits = (0,) * extra_bits self._header = None if self._indefinite: self._indefinite = False self.method = 0 if self._trailer != b'': self._trailer = b'' def __getitem__(self, key): """ Retrieves a boolean version of one of the bits based on a name from the _map :param key: The unicode string of one of the bit names :raises: ValueError - when _map is not set or the key name is invalid :return: A boolean if the bit is set """ is_int = isinstance(key, int_types) if not is_int: if not isinstance(self._map, dict): raise ValueError(unwrap( ''' %s._map has not been defined ''', type_name(self) )) if key not in self._reverse_map: raise ValueError(unwrap( ''' %s._map does not contain an entry for "%s" ''', type_name(self), key )) if self._native is None: self.native if self._map is None: if len(self._native) >= key + 1: return bool(self._native[key]) return False if is_int: key = self._map.get(key, key) return key in self._native def __setitem__(self, key, value): """ Sets one of the bits based on a name from the _map :param key: The unicode string of one of the bit names :param value: A boolean value :raises: ValueError - when _map is not set or the key name is invalid """ is_int = isinstance(key, int_types) if not is_int: if self._map is None: raise ValueError(unwrap( ''' %s._map has not been defined ''', type_name(self) )) if key not in self._reverse_map: raise ValueError(unwrap( ''' %s._map does not contain an entry for "%s" ''', type_name(self), key )) if self._native is None: self.native if self._map is None: new_native = list(self._native) max_key = len(new_native) - 1 if key > max_key: new_native.extend([0] * (key - max_key)) new_native[key] = 1 if value else 0 self._native = tuple(new_native) else: if is_int: key = self._map.get(key, key) if value: if key not in self._native: self._native.add(key) else: if key in self._native: self._native.remove(key) self.set(self._native) @property def native(self): """ The native Python datatype representation of this value :return: If a _map is set, a set of names, or if no _map is set, a tuple of integers 1 and 0. None if no value. """ # For BitString we default the value to be all zeros if self.contents is None: if self._map is None: self.set(()) else: self.set(set()) if self._native is None: int_value, bit_count, self._unused_bits = self._chunks_to_int() bits = _int_to_bit_tuple(int_value, bit_count) if self._map: self._native = set() for index, bit in enumerate(bits): if bit: name = self._map.get(index, index) self._native.add(name) else: self._native = bits return self._native class OctetBitString(Constructable, Castable, Primitive): """ Represents a bit string in ASN.1 as a Python byte string """ tag = 3 # Instance attribute of (possibly-merged) byte string _bytes = None # Tuple of 1s and 0s; set through native _unused_bits = () def set(self, value): """ Sets the value of the object :param value: A byte string :raises: ValueError - when an invalid value is passed """ if not isinstance(value, byte_cls): raise TypeError(unwrap( ''' %s value must be a byte string, not %s ''', type_name(self), type_name(value) )) self._bytes = value # Set the unused bits to 0 self.contents = b'\x00' + value self._unused_bits = () self._header = None if self._indefinite: self._indefinite = False self.method = 0 if self._trailer != b'': self._trailer = b'' def __bytes__(self): """ :return: A byte string """ if self.contents is None: return b'' if self._bytes is None: if not self._indefinite: self._bytes, self._unused_bits = self._as_chunk()[0] else: chunks = self._merge_chunks() self._unused_bits = () for chunk in chunks: if self._unused_bits: # Disallowed by X.690 §8.6.4 raise ValueError('Only last chunk in a bit string may have unused bits') self._unused_bits = chunk[1] self._bytes = b''.join(chunk[0] for chunk in chunks) return self._bytes def _copy(self, other, copy_func): """ Copies the contents of another OctetBitString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(OctetBitString, self)._copy(other, copy_func) self._bytes = other._bytes self._unused_bits = other._unused_bits def _as_chunk(self): """ Allows reconstructing indefinite length values :raises: ValueError - when an invalid value is passed :return: List with one tuple, consisting of a byte string and an integer (unused bits) """ unused_bits_len = ord(self.contents[0]) if _PY2 else self.contents[0] if not unused_bits_len: return [(self.contents[1:], ())] if len(self.contents) == 1: # Disallowed by X.690 §8.6.2.3 raise ValueError('Empty bit string has {0} unused bits'.format(unused_bits_len)) if unused_bits_len > 7: # Disallowed by X.690 §8.6.2.2 raise ValueError('Bit string has {0} unused bits'.format(unused_bits_len)) mask = (1 << unused_bits_len) - 1 last_byte = ord(self.contents[-1]) if _PY2 else self.contents[-1] # zero out the unused bits in the last byte. zeroed_byte = last_byte & ~mask value = self.contents[1:-1] + (chr(zeroed_byte) if _PY2 else bytes((zeroed_byte,))) unused_bits = _int_to_bit_tuple(last_byte & mask, unused_bits_len) return [(value, unused_bits)] @property def native(self): """ The native Python datatype representation of this value :return: A byte string or None """ if self.contents is None: return None return self.__bytes__() @property def unused_bits(self): """ The unused bits of the bit string encoding. :return: A tuple of 1s and 0s """ # call native to set _unused_bits self.native return self._unused_bits class IntegerBitString(_IntegerBitString, Constructable, Castable, Primitive): """ Represents a bit string in ASN.1 as a Python integer """ tag = 3 def set(self, value): """ Sets the value of the object :param value: An integer :raises: ValueError - when an invalid value is passed """ if not isinstance(value, int_types): raise TypeError(unwrap( ''' %s value must be a positive integer, not %s ''', type_name(self), type_name(value) )) if value < 0: raise ValueError(unwrap( ''' %s value must be a positive integer, not %d ''', type_name(self), value )) self._native = value # Set the unused bits to 0 self.contents = b'\x00' + int_to_bytes(value, signed=True) self._unused_bits = () self._header = None if self._indefinite: self._indefinite = False self.method = 0 if self._trailer != b'': self._trailer = b'' @property def native(self): """ The native Python datatype representation of this value :return: An integer or None """ if self.contents is None: return None if self._native is None: self._native, __, self._unused_bits = self._chunks_to_int() return self._native class OctetString(Constructable, Castable, Primitive): """ Represents a byte string in both ASN.1 and Python """ tag = 4 # Instance attribute of (possibly-merged) byte string _bytes = None def set(self, value): """ Sets the value of the object :param value: A byte string """ if not isinstance(value, byte_cls): raise TypeError(unwrap( ''' %s value must be a byte string, not %s ''', type_name(self), type_name(value) )) self._bytes = value self.contents = value self._header = None if self._indefinite: self._indefinite = False self.method = 0 if self._trailer != b'': self._trailer = b'' def __bytes__(self): """ :return: A byte string """ if self.contents is None: return b'' if self._bytes is None: self._bytes = self._merge_chunks() return self._bytes def _copy(self, other, copy_func): """ Copies the contents of another OctetString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(OctetString, self)._copy(other, copy_func) self._bytes = other._bytes @property def native(self): """ The native Python datatype representation of this value :return: A byte string or None """ if self.contents is None: return None return self.__bytes__() class IntegerOctetString(Constructable, Castable, Primitive): """ Represents a byte string in ASN.1 as a Python integer """ tag = 4 # An explicit length in bytes the integer should be encoded to. This should # generally not be used since DER defines a canonical encoding, however some # use of this, such as when storing elliptic curve private keys, requires an # exact number of bytes, even if the leading bytes are null. _encoded_width = None def set(self, value): """ Sets the value of the object :param value: An integer :raises: ValueError - when an invalid value is passed """ if not isinstance(value, int_types): raise TypeError(unwrap( ''' %s value must be a positive integer, not %s ''', type_name(self), type_name(value) )) if value < 0: raise ValueError(unwrap( ''' %s value must be a positive integer, not %d ''', type_name(self), value )) self._native = value self.contents = int_to_bytes(value, signed=False, width=self._encoded_width) self._header = None if self._indefinite: self._indefinite = False self.method = 0 if self._trailer != b'': self._trailer = b'' @property def native(self): """ The native Python datatype representation of this value :return: An integer or None """ if self.contents is None: return None if self._native is None: self._native = int_from_bytes(self._merge_chunks()) return self._native def set_encoded_width(self, width): """ Set the explicit enoding width for the integer :param width: An integer byte width to encode the integer to """ self._encoded_width = width # Make sure the encoded value is up-to-date with the proper width if self.contents is not None and len(self.contents) != width: self.set(self.native) class ParsableOctetString(Constructable, Castable, Primitive): tag = 4 _parsed = None # Instance attribute of (possibly-merged) byte string _bytes = None def __init__(self, value=None, parsed=None, **kwargs): """ Allows providing a parsed object that will be serialized to get the byte string value :param value: A native Python datatype to initialize the object value with :param parsed: If value is None and this is an Asn1Value object, this will be set as the parsed value, and the value will be obtained by calling .dump() on this object. """ set_parsed = False if value is None and parsed is not None and isinstance(parsed, Asn1Value): value = parsed.dump() set_parsed = True Primitive.__init__(self, value=value, **kwargs) if set_parsed: self._parsed = (parsed, parsed.__class__, None) def set(self, value): """ Sets the value of the object :param value: A byte string """ if not isinstance(value, byte_cls): raise TypeError(unwrap( ''' %s value must be a byte string, not %s ''', type_name(self), type_name(value) )) self._bytes = value self.contents = value self._header = None if self._indefinite: self._indefinite = False self.method = 0 if self._trailer != b'': self._trailer = b'' def parse(self, spec=None, spec_params=None): """ Parses the contents generically, or using a spec with optional params :param spec: A class derived from Asn1Value that defines what class_ and tag the value should have, and the semantics of the encoded value. The return value will be of this type. If omitted, the encoded value will be decoded using the standard universal tag based on the encoded tag number. :param spec_params: A dict of params to pass to the spec object :return: An object of the type spec, or if not present, a child of Asn1Value """ if self._parsed is None or self._parsed[1:3] != (spec, spec_params): parsed_value, _ = _parse_build(self.__bytes__(), spec=spec, spec_params=spec_params) self._parsed = (parsed_value, spec, spec_params) return self._parsed[0] def __bytes__(self): """ :return: A byte string """ if self.contents is None: return b'' if self._bytes is None: self._bytes = self._merge_chunks() return self._bytes def _setable_native(self): """ Returns a byte string that can be passed into .set() :return: A python value that is valid to pass to .set() """ return self.__bytes__() def _copy(self, other, copy_func): """ Copies the contents of another ParsableOctetString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(ParsableOctetString, self)._copy(other, copy_func) self._bytes = other._bytes self._parsed = copy_func(other._parsed) @property def native(self): """ The native Python datatype representation of this value :return: A byte string or None """ if self.contents is None: return None if self._parsed is not None: return self._parsed[0].native else: return self.__bytes__() @property def parsed(self): """ Returns the parsed object from .parse() :return: The object returned by .parse() """ if self._parsed is None: self.parse() return self._parsed[0] def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ # If the length is indefinite, force the re-encoding if self._indefinite: force = True if force: if self._parsed is not None: native = self.parsed.dump(force=force) else: native = self.native self.contents = None self.set(native) return Asn1Value.dump(self) class ParsableOctetBitString(ParsableOctetString): tag = 3 def set(self, value): """ Sets the value of the object :param value: A byte string :raises: ValueError - when an invalid value is passed """ if not isinstance(value, byte_cls): raise TypeError(unwrap( ''' %s value must be a byte string, not %s ''', type_name(self), type_name(value) )) self._bytes = value # Set the unused bits to 0 self.contents = b'\x00' + value self._header = None if self._indefinite: self._indefinite = False self.method = 0 if self._trailer != b'': self._trailer = b'' def _as_chunk(self): """ Allows reconstructing indefinite length values :raises: ValueError - when an invalid value is passed :return: A byte string """ unused_bits_len = ord(self.contents[0]) if _PY2 else self.contents[0] if unused_bits_len: raise ValueError('ParsableOctetBitString should have no unused bits') return self.contents[1:] class Null(Primitive): """ Represents a null value in ASN.1 as None in Python """ tag = 5 contents = b'' def set(self, value): """ Sets the value of the object :param value: None """ self.contents = b'' @property def native(self): """ The native Python datatype representation of this value :return: None """ return None class ObjectIdentifier(Primitive, ValueMap): """ Represents an object identifier in ASN.1 as a Python unicode dotted integer string """ tag = 6 # A unicode string of the dotted form of the object identifier _dotted = None @classmethod def map(cls, value): """ Converts a dotted unicode string OID into a mapped unicode string :param value: A dotted unicode string OID :raises: ValueError - when no _map dict has been defined on the class TypeError - when value is not a unicode string :return: A mapped unicode string """ if cls._map is None: raise ValueError(unwrap( ''' %s._map has not been defined ''', type_name(cls) )) if not isinstance(value, str_cls): raise TypeError(unwrap( ''' value must be a unicode string, not %s ''', type_name(value) )) return cls._map.get(value, value) @classmethod def unmap(cls, value): """ Converts a mapped unicode string value into a dotted unicode string OID :param value: A mapped unicode string OR dotted unicode string OID :raises: ValueError - when no _map dict has been defined on the class or the value can't be unmapped TypeError - when value is not a unicode string :return: A dotted unicode string OID """ if cls not in _SETUP_CLASSES: cls()._setup() _SETUP_CLASSES[cls] = True if cls._map is None: raise ValueError(unwrap( ''' %s._map has not been defined ''', type_name(cls) )) if not isinstance(value, str_cls): raise TypeError(unwrap( ''' value must be a unicode string, not %s ''', type_name(value) )) if value in cls._reverse_map: return cls._reverse_map[value] if not _OID_RE.match(value): raise ValueError(unwrap( ''' %s._map does not contain an entry for "%s" ''', type_name(cls), value )) return value def set(self, value): """ Sets the value of the object :param value: A unicode string. May be a dotted integer string, or if _map is provided, one of the mapped values. :raises: ValueError - when an invalid value is passed """ if not isinstance(value, str_cls): raise TypeError(unwrap( ''' %s value must be a unicode string, not %s ''', type_name(self), type_name(value) )) self._native = value if self._map is not None: if value in self._reverse_map: value = self._reverse_map[value] self.contents = b'' first = None for index, part in enumerate(value.split('.')): part = int(part) # The first two parts are merged into a single byte if index == 0: first = part continue elif index == 1: if first > 2: raise ValueError(unwrap( ''' First arc must be one of 0, 1 or 2, not %s ''', repr(first) )) elif first < 2 and part >= 40: raise ValueError(unwrap( ''' Second arc must be less than 40 if first arc is 0 or 1, not %s ''', repr(part) )) part = (first * 40) + part encoded_part = chr_cls(0x7F & part) part = part >> 7 while part > 0: encoded_part = chr_cls(0x80 | (0x7F & part)) + encoded_part part = part >> 7 self.contents += encoded_part self._header = None if self._trailer != b'': self._trailer = b'' def __unicode__(self): """ :return: A unicode string """ return self.dotted @property def dotted(self): """ :return: A unicode string of the object identifier in dotted notation, thus ignoring any mapped value """ if self._dotted is None: output = [] part = 0 for byte in self.contents: if _PY2: byte = ord(byte) part = part * 128 part += byte & 127 # Last byte in subidentifier has the eighth bit set to 0 if byte & 0x80 == 0: if len(output) == 0: if part >= 80: output.append(str_cls(2)) output.append(str_cls(part - 80)) elif part >= 40: output.append(str_cls(1)) output.append(str_cls(part - 40)) else: output.append(str_cls(0)) output.append(str_cls(part)) else: output.append(str_cls(part)) part = 0 self._dotted = '.'.join(output) return self._dotted @property def native(self): """ The native Python datatype representation of this value :return: A unicode string or None. If _map is not defined, the unicode string is a string of dotted integers. If _map is defined and the dotted string is present in the _map, the mapped value is returned. """ if self.contents is None: return None if self._native is None: self._native = self.dotted if self._map is not None and self._native in self._map: self._native = self._map[self._native] return self._native class ObjectDescriptor(Primitive): """ Represents an object descriptor from ASN.1 - no Python implementation """ tag = 7 class InstanceOf(Primitive): """ Represents an instance from ASN.1 - no Python implementation """ tag = 8 class Real(Primitive): """ Represents a real number from ASN.1 - no Python implementation """ tag = 9 class Enumerated(Integer): """ Represents a enumerated list of integers from ASN.1 as a Python unicode string """ tag = 10 def set(self, value): """ Sets the value of the object :param value: An integer or a unicode string from _map :raises: ValueError - when an invalid value is passed """ if not isinstance(value, int_types) and not isinstance(value, str_cls): raise TypeError(unwrap( ''' %s value must be an integer or a unicode string, not %s ''', type_name(self), type_name(value) )) if isinstance(value, str_cls): if value not in self._reverse_map: raise ValueError(unwrap( ''' %s value "%s" is not a valid value ''', type_name(self), value )) value = self._reverse_map[value] elif value not in self._map: raise ValueError(unwrap( ''' %s value %s is not a valid value ''', type_name(self), value )) Integer.set(self, value) @property def native(self): """ The native Python datatype representation of this value :return: A unicode string or None """ if self.contents is None: return None if self._native is None: self._native = self._map[self.__int__()] return self._native class UTF8String(AbstractString): """ Represents a UTF-8 string from ASN.1 as a Python unicode string """ tag = 12 _encoding = 'utf-8' class RelativeOid(ObjectIdentifier): """ Represents an object identifier in ASN.1 as a Python unicode dotted integer string """ tag = 13 class Sequence(Asn1Value): """ Represents a sequence of fields from ASN.1 as a Python object with a dict-like interface """ tag = 16 class_ = 0 method = 1 # A list of child objects, in order of _fields children = None # Sequence overrides .contents to be a property so that the mutated state # of child objects can be checked to ensure everything is up-to-date _contents = None # Variable to track if the object has been mutated _mutated = False # A list of tuples in one of the following forms. # # Option 1, a unicode string field name and a value class # # ("name", Asn1ValueClass) # # Option 2, same as Option 1, but with a dict of class params # # ("name", Asn1ValueClass, {'explicit': 5}) _fields = [] # A dict with keys being the name of a field and the value being a unicode # string of the method name on self to call to get the spec for that field _spec_callbacks = None # A dict that maps unicode string field names to an index in _fields _field_map = None # A list in the same order as _fields that has tuples in the form (class_, tag) _field_ids = None # An optional 2-element tuple that defines the field names of an OID field # and the field that the OID should be used to help decode. Works with the # _oid_specs attribute. _oid_pair = None # A dict with keys that are unicode string OID values and values that are # Asn1Value classes to use for decoding a variable-type field. _oid_specs = None # A 2-element tuple of the indexes in _fields of the OID and value fields _oid_nums = None # Predetermined field specs to optimize away calls to _determine_spec() _precomputed_specs = None def __init__(self, value=None, default=None, **kwargs): """ Allows setting field values before passing everything else along to Asn1Value.__init__() :param value: A native Python datatype to initialize the object value with :param default: The default value if no value is specified """ Asn1Value.__init__(self, **kwargs) check_existing = False if value is None and default is not None: check_existing = True if self.children is None: if self.contents is None: check_existing = False else: self._parse_children() value = default if value is not None: try: # Fields are iterated in definition order to allow things like # OID-based specs. Otherwise sometimes the value would be processed # before the OID field, resulting in invalid value object creation. if self._fields: keys = [info[0] for info in self._fields] unused_keys = set(value.keys()) else: keys = value.keys() unused_keys = set(keys) for key in keys: # If we are setting defaults, but a real value has already # been set for the field, then skip it if check_existing: index = self._field_map[key] if index < len(self.children) and self.children[index] is not VOID: if key in unused_keys: unused_keys.remove(key) continue if key in value: self.__setitem__(key, value[key]) unused_keys.remove(key) if len(unused_keys): raise ValueError(unwrap( ''' One or more unknown fields was passed to the constructor of %s: %s ''', type_name(self), ', '.join(sorted(list(unused_keys))) )) except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while constructing %s' % type_name(self),) + args raise e @property def contents(self): """ :return: A byte string of the DER-encoded contents of the sequence """ if self.children is None: return self._contents if self._is_mutated(): self._set_contents() return self._contents @contents.setter def contents(self, value): """ :param value: A byte string of the DER-encoded contents of the sequence """ self._contents = value def _is_mutated(self): """ :return: A boolean - if the sequence or any children (recursively) have been mutated """ mutated = self._mutated if self.children is not None: for child in self.children: if isinstance(child, Sequence) or isinstance(child, SequenceOf): mutated = mutated or child._is_mutated() return mutated def _lazy_child(self, index): """ Builds a child object if the child has only been parsed into a tuple so far """ child = self.children[index] if child.__class__ == tuple: child = self.children[index] = _build(*child) return child def __len__(self): """ :return: Integer """ # We inline this check to prevent method invocation each time if self.children is None: self._parse_children() return len(self.children) def __getitem__(self, key): """ Allows accessing fields by name or index :param key: A unicode string of the field name, or an integer of the field index :raises: KeyError - when a field name or index is invalid :return: The Asn1Value object of the field specified """ # We inline this check to prevent method invocation each time if self.children is None: self._parse_children() if not isinstance(key, int_types): if key not in self._field_map: raise KeyError(unwrap( ''' No field named "%s" defined for %s ''', key, type_name(self) )) key = self._field_map[key] if key >= len(self.children): raise KeyError(unwrap( ''' No field numbered %s is present in this %s ''', key, type_name(self) )) try: return self._lazy_child(key) except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(self),) + args raise e def __setitem__(self, key, value): """ Allows settings fields by name or index :param key: A unicode string of the field name, or an integer of the field index :param value: A native Python datatype to set the field value to. This method will construct the appropriate Asn1Value object from _fields. :raises: ValueError - when a field name or index is invalid """ # We inline this check to prevent method invocation each time if self.children is None: self._parse_children() if not isinstance(key, int_types): if key not in self._field_map: raise KeyError(unwrap( ''' No field named "%s" defined for %s ''', key, type_name(self) )) key = self._field_map[key] field_name, field_spec, value_spec, field_params, _ = self._determine_spec(key) new_value = self._make_value(field_name, field_spec, value_spec, field_params, value) invalid_value = False if isinstance(new_value, Any): invalid_value = new_value.parsed is None else: invalid_value = new_value.contents is None if invalid_value: raise ValueError(unwrap( ''' Value for field "%s" of %s is not set ''', field_name, type_name(self) )) self.children[key] = new_value if self._native is not None: self._native[self._fields[key][0]] = self.children[key].native self._mutated = True def __delitem__(self, key): """ Allows deleting optional or default fields by name or index :param key: A unicode string of the field name, or an integer of the field index :raises: ValueError - when a field name or index is invalid, or the field is not optional or defaulted """ # We inline this check to prevent method invocation each time if self.children is None: self._parse_children() if not isinstance(key, int_types): if key not in self._field_map: raise KeyError(unwrap( ''' No field named "%s" defined for %s ''', key, type_name(self) )) key = self._field_map[key] name, _, params = self._fields[key] if not params or ('default' not in params and 'optional' not in params): raise ValueError(unwrap( ''' Can not delete the value for the field "%s" of %s since it is not optional or defaulted ''', name, type_name(self) )) if 'optional' in params: self.children[key] = VOID if self._native is not None: self._native[name] = None else: self.__setitem__(key, None) self._mutated = True def __iter__(self): """ :return: An iterator of field key names """ for info in self._fields: yield info[0] def _set_contents(self, force=False): """ Updates the .contents attribute of the value with the encoded value of all of the child objects :param force: Ensure all contents are in DER format instead of possibly using cached BER-encoded data """ if self.children is None: self._parse_children() contents = BytesIO() for index, info in enumerate(self._fields): child = self.children[index] if child is None: child_dump = b'' elif child.__class__ == tuple: if force: child_dump = self._lazy_child(index).dump(force=force) else: child_dump = child[3] + child[4] + child[5] else: child_dump = child.dump(force=force) # Skip values that are the same as the default if info[2] and 'default' in info[2]: default_value = info[1](**info[2]) if default_value.dump() == child_dump: continue contents.write(child_dump) self._contents = contents.getvalue() self._header = None if self._trailer != b'': self._trailer = b'' def _setup(self): """ Generates _field_map, _field_ids and _oid_nums for use in parsing """ cls = self.__class__ cls._field_map = {} cls._field_ids = [] cls._precomputed_specs = [] for index, field in enumerate(cls._fields): if len(field) < 3: field = field + ({},) cls._fields[index] = field cls._field_map[field[0]] = index cls._field_ids.append(_build_id_tuple(field[2], field[1])) if cls._oid_pair is not None: cls._oid_nums = (cls._field_map[cls._oid_pair[0]], cls._field_map[cls._oid_pair[1]]) for index, field in enumerate(cls._fields): has_callback = cls._spec_callbacks is not None and field[0] in cls._spec_callbacks is_mapped_oid = cls._oid_nums is not None and cls._oid_nums[1] == index if has_callback or is_mapped_oid: cls._precomputed_specs.append(None) else: cls._precomputed_specs.append((field[0], field[1], field[1], field[2], None)) def _determine_spec(self, index): """ Determine how a value for a field should be constructed :param index: The field number :return: A tuple containing the following elements: - unicode string of the field name - Asn1Value class of the field spec - Asn1Value class of the value spec - None or dict of params to pass to the field spec - None or Asn1Value class indicating the value spec was derived from an OID or a spec callback """ name, field_spec, field_params = self._fields[index] value_spec = field_spec spec_override = None if self._spec_callbacks is not None and name in self._spec_callbacks: callback = self._spec_callbacks[name] spec_override = callback(self) if spec_override: # Allow a spec callback to specify both the base spec and # the override, for situations such as OctetString and parse_as if spec_override.__class__ == tuple and len(spec_override) == 2: field_spec, value_spec = spec_override if value_spec is None: value_spec = field_spec spec_override = None # When no field spec is specified, use a single return value as that elif field_spec is None: field_spec = spec_override value_spec = field_spec spec_override = None else: value_spec = spec_override elif self._oid_nums is not None and self._oid_nums[1] == index: oid = self._lazy_child(self._oid_nums[0]).native if oid in self._oid_specs: spec_override = self._oid_specs[oid] value_spec = spec_override return (name, field_spec, value_spec, field_params, spec_override) def _make_value(self, field_name, field_spec, value_spec, field_params, value): """ Contructs an appropriate Asn1Value object for a field :param field_name: A unicode string of the field name :param field_spec: An Asn1Value class that is the field spec :param value_spec: An Asn1Value class that is the vaue spec :param field_params: None or a dict of params for the field spec :param value: The value to construct an Asn1Value object from :return: An instance of a child class of Asn1Value """ if value is None and 'optional' in field_params: return VOID specs_different = field_spec != value_spec is_any = issubclass(field_spec, Any) if issubclass(value_spec, Choice): is_asn1value = isinstance(value, Asn1Value) is_tuple = isinstance(value, tuple) and len(value) == 2 is_dict = isinstance(value, dict) and len(value) == 1 if not is_asn1value and not is_tuple and not is_dict: raise ValueError(unwrap( ''' Can not set a native python value to %s, which has the choice type of %s - value must be an instance of Asn1Value ''', field_name, type_name(value_spec) )) if is_tuple or is_dict: value = value_spec(value) if not isinstance(value, value_spec): wrapper = value_spec() wrapper.validate(value.class_, value.tag, value.contents) wrapper._parsed = value new_value = wrapper else: new_value = value elif isinstance(value, field_spec): new_value = value if specs_different: new_value.parse(value_spec) elif (not specs_different or is_any) and not isinstance(value, value_spec): if (not is_any or specs_different) and isinstance(value, Asn1Value): raise TypeError(unwrap( ''' %s value must be %s, not %s ''', field_name, type_name(value_spec), type_name(value) )) new_value = value_spec(value, **field_params) else: if isinstance(value, value_spec): new_value = value else: if isinstance(value, Asn1Value): raise TypeError(unwrap( ''' %s value must be %s, not %s ''', field_name, type_name(value_spec), type_name(value) )) new_value = value_spec(value) # For when the field is OctetString or OctetBitString with embedded # values we need to wrap the value in the field spec to get the # appropriate encoded value. if specs_different and not is_any: wrapper = field_spec(value=new_value.dump(), **field_params) wrapper._parsed = (new_value, new_value.__class__, None) new_value = wrapper new_value = _fix_tagging(new_value, field_params) return new_value def _parse_children(self, recurse=False): """ Parses the contents and generates Asn1Value objects based on the definitions from _fields. :param recurse: If child objects that are Sequence or SequenceOf objects should be recursively parsed :raises: ValueError - when an error occurs parsing child objects """ cls = self.__class__ if self._contents is None: if self._fields: self.children = [VOID] * len(self._fields) for index, (_, _, params) in enumerate(self._fields): if 'default' in params: if cls._precomputed_specs[index]: field_name, field_spec, value_spec, field_params, _ = cls._precomputed_specs[index] else: field_name, field_spec, value_spec, field_params, _ = self._determine_spec(index) self.children[index] = self._make_value(field_name, field_spec, value_spec, field_params, None) return try: self.children = [] contents_length = len(self._contents) child_pointer = 0 field = 0 field_len = len(self._fields) parts = None again = child_pointer < contents_length while again: if parts is None: parts, child_pointer = _parse(self._contents, contents_length, pointer=child_pointer) again = child_pointer < contents_length if field < field_len: _, field_spec, value_spec, field_params, spec_override = ( cls._precomputed_specs[field] or self._determine_spec(field)) # If the next value is optional or default, allow it to be absent if field_params and ('optional' in field_params or 'default' in field_params): if self._field_ids[field] != (parts[0], parts[2]) and field_spec != Any: # See if the value is a valid choice before assuming # that we have a missing optional or default value choice_match = False if issubclass(field_spec, Choice): try: tester = field_spec(**field_params) tester.validate(parts[0], parts[2], parts[4]) choice_match = True except (ValueError): pass if not choice_match: if 'optional' in field_params: self.children.append(VOID) else: self.children.append(field_spec(**field_params)) field += 1 again = True continue if field_spec is None or (spec_override and issubclass(field_spec, Any)): field_spec = value_spec spec_override = None if spec_override: child = parts + (field_spec, field_params, value_spec) else: child = parts + (field_spec, field_params) # Handle situations where an optional or defaulted field definition is incorrect elif field_len > 0 and field + 1 <= field_len: missed_fields = [] prev_field = field - 1 while prev_field >= 0: prev_field_info = self._fields[prev_field] if len(prev_field_info) < 3: break if 'optional' in prev_field_info[2] or 'default' in prev_field_info[2]: missed_fields.append(prev_field_info[0]) prev_field -= 1 plural = 's' if len(missed_fields) > 1 else '' missed_field_names = ', '.join(missed_fields) raise ValueError(unwrap( ''' Data for field %s (%s class, %s method, tag %s) does not match the field definition%s of %s ''', field + 1, CLASS_NUM_TO_NAME_MAP.get(parts[0]), METHOD_NUM_TO_NAME_MAP.get(parts[1]), parts[2], plural, missed_field_names )) else: child = parts if recurse: child = _build(*child) if isinstance(child, (Sequence, SequenceOf)): child._parse_children(recurse=True) self.children.append(child) field += 1 parts = None index = len(self.children) while index < field_len: name, field_spec, field_params = self._fields[index] if 'default' in field_params: self.children.append(field_spec(**field_params)) elif 'optional' in field_params: self.children.append(VOID) else: raise ValueError(unwrap( ''' Field "%s" is missing from structure ''', name )) index += 1 except (ValueError, TypeError) as e: self.children = None args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(self),) + args raise e def spec(self, field_name): """ Determines the spec to use for the field specified. Depending on how the spec is determined (_oid_pair or _spec_callbacks), it may be necessary to set preceding field values before calling this. Usually specs, if dynamic, are controlled by a preceding ObjectIdentifier field. :param field_name: A unicode string of the field name to get the spec for :return: A child class of asn1crypto.core.Asn1Value that the field must be encoded using """ if not isinstance(field_name, str_cls): raise TypeError(unwrap( ''' field_name must be a unicode string, not %s ''', type_name(field_name) )) if self._fields is None: raise ValueError(unwrap( ''' Unable to retrieve spec for field %s in the class %s because _fields has not been set ''', repr(field_name), type_name(self) )) index = self._field_map[field_name] info = self._determine_spec(index) return info[2] @property def native(self): """ The native Python datatype representation of this value :return: An OrderedDict or None. If an OrderedDict, all child values are recursively converted to native representation also. """ if self.contents is None: return None if self._native is None: if self.children is None: self._parse_children(recurse=True) try: self._native = OrderedDict() for index, child in enumerate(self.children): if child.__class__ == tuple: child = _build(*child) self.children[index] = child try: name = self._fields[index][0] except (IndexError): name = str_cls(index) self._native[name] = child.native except (ValueError, TypeError) as e: self._native = None args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(self),) + args raise e return self._native def _copy(self, other, copy_func): """ Copies the contents of another Sequence object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(Sequence, self)._copy(other, copy_func) if self.children is not None: self.children = [] for child in other.children: if child.__class__ == tuple: self.children.append(child) else: self.children.append(child.copy()) def debug(self, nest_level=1): """ Show the binary data and parsed data in a tree structure """ if self.children is None: self._parse_children() prefix = ' ' * nest_level _basic_debug(prefix, self) for field_name in self: child = self._lazy_child(self._field_map[field_name]) if child is not VOID: print('%s Field "%s"' % (prefix, field_name)) child.debug(nest_level + 3) def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ # If the length is indefinite, force the re-encoding if self._header is not None and self._header[-1:] == b'\x80': force = True # We can't force encoding if we don't have a spec if force and self._fields == [] and self.__class__ is Sequence: force = False if force: self._set_contents(force=force) if self._fields and self.children is not None: for index, (field_name, _, params) in enumerate(self._fields): if self.children[index] is not VOID: continue if 'default' in params or 'optional' in params: continue raise ValueError(unwrap( ''' Field "%s" is missing from structure ''', field_name )) return Asn1Value.dump(self) class SequenceOf(Asn1Value): """ Represents a sequence (ordered) of a single type of values from ASN.1 as a Python object with a list-like interface """ tag = 16 class_ = 0 method = 1 # A list of child objects children = None # SequenceOf overrides .contents to be a property so that the mutated state # of child objects can be checked to ensure everything is up-to-date _contents = None # Variable to track if the object has been mutated _mutated = False # An Asn1Value class to use when parsing children _child_spec = None def __init__(self, value=None, default=None, contents=None, spec=None, **kwargs): """ Allows setting child objects and the _child_spec via the spec parameter before passing everything else along to Asn1Value.__init__() :param value: A native Python datatype to initialize the object value with :param default: The default value if no value is specified :param contents: A byte string of the encoded contents of the value :param spec: A class derived from Asn1Value to use to parse children """ if spec: self._child_spec = spec Asn1Value.__init__(self, **kwargs) try: if contents is not None: self.contents = contents else: if value is None and default is not None: value = default if value is not None: for index, child in enumerate(value): self.__setitem__(index, child) # Make sure a blank list is serialized if self.contents is None: self._set_contents() except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while constructing %s' % type_name(self),) + args raise e @property def contents(self): """ :return: A byte string of the DER-encoded contents of the sequence """ if self.children is None: return self._contents if self._is_mutated(): self._set_contents() return self._contents @contents.setter def contents(self, value): """ :param value: A byte string of the DER-encoded contents of the sequence """ self._contents = value def _is_mutated(self): """ :return: A boolean - if the sequence or any children (recursively) have been mutated """ mutated = self._mutated if self.children is not None: for child in self.children: if isinstance(child, Sequence) or isinstance(child, SequenceOf): mutated = mutated or child._is_mutated() return mutated def _lazy_child(self, index): """ Builds a child object if the child has only been parsed into a tuple so far """ child = self.children[index] if child.__class__ == tuple: child = _build(*child) self.children[index] = child return child def _make_value(self, value): """ Constructs a _child_spec value from a native Python data type, or an appropriate Asn1Value object :param value: A native Python value, or some child of Asn1Value :return: An object of type _child_spec """ if isinstance(value, self._child_spec): new_value = value elif issubclass(self._child_spec, Any): if isinstance(value, Asn1Value): new_value = value else: raise ValueError(unwrap( ''' Can not set a native python value to %s where the _child_spec is Any - value must be an instance of Asn1Value ''', type_name(self) )) elif issubclass(self._child_spec, Choice): if not isinstance(value, Asn1Value): raise ValueError(unwrap( ''' Can not set a native python value to %s where the _child_spec is the choice type %s - value must be an instance of Asn1Value ''', type_name(self), self._child_spec.__name__ )) if not isinstance(value, self._child_spec): wrapper = self._child_spec() wrapper.validate(value.class_, value.tag, value.contents) wrapper._parsed = value value = wrapper new_value = value else: return self._child_spec(value=value) params = {} if self._child_spec.explicit: params['explicit'] = self._child_spec.explicit if self._child_spec.implicit: params['implicit'] = (self._child_spec.class_, self._child_spec.tag) return _fix_tagging(new_value, params) def __len__(self): """ :return: An integer """ # We inline this checks to prevent method invocation each time if self.children is None: self._parse_children() return len(self.children) def __getitem__(self, key): """ Allows accessing children via index :param key: Integer index of child """ # We inline this checks to prevent method invocation each time if self.children is None: self._parse_children() return self._lazy_child(key) def __setitem__(self, key, value): """ Allows overriding a child via index :param key: Integer index of child :param value: Native python datatype that will be passed to _child_spec to create new child object """ # We inline this checks to prevent method invocation each time if self.children is None: self._parse_children() new_value = self._make_value(value) # If adding at the end, create a space for the new value if key == len(self.children): self.children.append(None) if self._native is not None: self._native.append(None) self.children[key] = new_value if self._native is not None: self._native[key] = self.children[key].native self._mutated = True def __delitem__(self, key): """ Allows removing a child via index :param key: Integer index of child """ # We inline this checks to prevent method invocation each time if self.children is None: self._parse_children() self.children.pop(key) if self._native is not None: self._native.pop(key) self._mutated = True def __iter__(self): """ :return: An iter() of child objects """ # We inline this checks to prevent method invocation each time if self.children is None: self._parse_children() for index in range(0, len(self.children)): yield self._lazy_child(index) def __contains__(self, item): """ :param item: An object of the type cls._child_spec :return: A boolean if the item is contained in this SequenceOf """ if item is None or item is VOID: return False if not isinstance(item, self._child_spec): raise TypeError(unwrap( ''' Checking membership in %s is only available for instances of %s, not %s ''', type_name(self), type_name(self._child_spec), type_name(item) )) for child in self: if child == item: return True return False def append(self, value): """ Allows adding a child to the end of the sequence :param value: Native python datatype that will be passed to _child_spec to create new child object """ # We inline this checks to prevent method invocation each time if self.children is None: self._parse_children() self.children.append(self._make_value(value)) if self._native is not None: self._native.append(self.children[-1].native) self._mutated = True def _set_contents(self, force=False): """ Encodes all child objects into the contents for this object :param force: Ensure all contents are in DER format instead of possibly using cached BER-encoded data """ if self.children is None: self._parse_children() contents = BytesIO() for child in self: contents.write(child.dump(force=force)) self._contents = contents.getvalue() self._header = None if self._trailer != b'': self._trailer = b'' def _parse_children(self, recurse=False): """ Parses the contents and generates Asn1Value objects based on the definitions from _child_spec. :param recurse: If child objects that are Sequence or SequenceOf objects should be recursively parsed :raises: ValueError - when an error occurs parsing child objects """ try: self.children = [] if self._contents is None: return contents_length = len(self._contents) child_pointer = 0 while child_pointer < contents_length: parts, child_pointer = _parse(self._contents, contents_length, pointer=child_pointer) if self._child_spec: child = parts + (self._child_spec,) else: child = parts if recurse: child = _build(*child) if isinstance(child, (Sequence, SequenceOf)): child._parse_children(recurse=True) self.children.append(child) except (ValueError, TypeError) as e: self.children = None args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(self),) + args raise e def spec(self): """ Determines the spec to use for child values. :return: A child class of asn1crypto.core.Asn1Value that child values must be encoded using """ return self._child_spec @property def native(self): """ The native Python datatype representation of this value :return: A list or None. If a list, all child values are recursively converted to native representation also. """ if self.contents is None: return None if self._native is None: if self.children is None: self._parse_children(recurse=True) try: self._native = [child.native for child in self] except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(self),) + args raise e return self._native def _copy(self, other, copy_func): """ Copies the contents of another SequenceOf object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects """ super(SequenceOf, self)._copy(other, copy_func) if self.children is not None: self.children = [] for child in other.children: if child.__class__ == tuple: self.children.append(child) else: self.children.append(child.copy()) def debug(self, nest_level=1): """ Show the binary data and parsed data in a tree structure """ if self.children is None: self._parse_children() prefix = ' ' * nest_level _basic_debug(prefix, self) for child in self: child.debug(nest_level + 1) def dump(self, force=False): """ Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value """ # If the length is indefinite, force the re-encoding if self._header is not None and self._header[-1:] == b'\x80': force = True if force: self._set_contents(force=force) return Asn1Value.dump(self) class Set(Sequence): """ Represents a set of fields (unordered) from ASN.1 as a Python object with a dict-like interface """ method = 1 class_ = 0 tag = 17 # A dict of 2-element tuples in the form (class_, tag) as keys and integers # as values that are the index of the field in _fields _field_ids = None def _setup(self): """ Generates _field_map, _field_ids and _oid_nums for use in parsing """ cls = self.__class__ cls._field_map = {} cls._field_ids = {} cls._precomputed_specs = [] for index, field in enumerate(cls._fields): if len(field) < 3: field = field + ({},) cls._fields[index] = field cls._field_map[field[0]] = index cls._field_ids[_build_id_tuple(field[2], field[1])] = index if cls._oid_pair is not None: cls._oid_nums = (cls._field_map[cls._oid_pair[0]], cls._field_map[cls._oid_pair[1]]) for index, field in enumerate(cls._fields): has_callback = cls._spec_callbacks is not None and field[0] in cls._spec_callbacks is_mapped_oid = cls._oid_nums is not None and cls._oid_nums[1] == index if has_callback or is_mapped_oid: cls._precomputed_specs.append(None) else: cls._precomputed_specs.append((field[0], field[1], field[1], field[2], None)) def _parse_children(self, recurse=False): """ Parses the contents and generates Asn1Value objects based on the definitions from _fields. :param recurse: If child objects that are Sequence or SequenceOf objects should be recursively parsed :raises: ValueError - when an error occurs parsing child objects """ cls = self.__class__ if self._contents is None: if self._fields: self.children = [VOID] * len(self._fields) for index, (_, _, params) in enumerate(self._fields): if 'default' in params: if cls._precomputed_specs[index]: field_name, field_spec, value_spec, field_params, _ = cls._precomputed_specs[index] else: field_name, field_spec, value_spec, field_params, _ = self._determine_spec(index) self.children[index] = self._make_value(field_name, field_spec, value_spec, field_params, None) return try: child_map = {} contents_length = len(self.contents) child_pointer = 0 seen_field = 0 while child_pointer < contents_length: parts, child_pointer = _parse(self.contents, contents_length, pointer=child_pointer) id_ = (parts[0], parts[2]) field = self._field_ids.get(id_) if field is None: raise ValueError(unwrap( ''' Data for field %s (%s class, %s method, tag %s) does not match any of the field definitions ''', seen_field, CLASS_NUM_TO_NAME_MAP.get(parts[0]), METHOD_NUM_TO_NAME_MAP.get(parts[1]), parts[2], )) _, field_spec, value_spec, field_params, spec_override = ( cls._precomputed_specs[field] or self._determine_spec(field)) if field_spec is None or (spec_override and issubclass(field_spec, Any)): field_spec = value_spec spec_override = None if spec_override: child = parts + (field_spec, field_params, value_spec) else: child = parts + (field_spec, field_params) if recurse: child = _build(*child) if isinstance(child, (Sequence, SequenceOf)): child._parse_children(recurse=True) child_map[field] = child seen_field += 1 total_fields = len(self._fields) for index in range(0, total_fields): if index in child_map: continue name, field_spec, value_spec, field_params, spec_override = ( cls._precomputed_specs[index] or self._determine_spec(index)) if field_spec is None or (spec_override and issubclass(field_spec, Any)): field_spec = value_spec spec_override = None missing = False if not field_params: missing = True elif 'optional' not in field_params and 'default' not in field_params: missing = True elif 'optional' in field_params: child_map[index] = VOID elif 'default' in field_params: child_map[index] = field_spec(**field_params) if missing: raise ValueError(unwrap( ''' Missing required field "%s" from %s ''', name, type_name(self) )) self.children = [] for index in range(0, total_fields): self.children.append(child_map[index]) except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(self),) + args raise e def _set_contents(self, force=False): """ Encodes all child objects into the contents for this object. This method is overridden because a Set needs to be encoded by removing defaulted fields and then sorting the fields by tag. :param force: Ensure all contents are in DER format instead of possibly using cached BER-encoded data """ if self.children is None: self._parse_children() child_tag_encodings = [] for index, child in enumerate(self.children): child_encoding = child.dump(force=force) # Skip encoding defaulted children name, spec, field_params = self._fields[index] if 'default' in field_params: if spec(**field_params).dump() == child_encoding: continue child_tag_encodings.append((child.tag, child_encoding)) child_tag_encodings.sort(key=lambda ct: ct[0]) self._contents = b''.join([ct[1] for ct in child_tag_encodings]) self._header = None if self._trailer != b'': self._trailer = b'' class SetOf(SequenceOf): """ Represents a set (unordered) of a single type of values from ASN.1 as a Python object with a list-like interface """ tag = 17 def _set_contents(self, force=False): """ Encodes all child objects into the contents for this object. This method is overridden because a SetOf needs to be encoded by sorting the child encodings. :param force: Ensure all contents are in DER format instead of possibly using cached BER-encoded data """ if self.children is None: self._parse_children() child_encodings = [] for child in self: child_encodings.append(child.dump(force=force)) self._contents = b''.join(sorted(child_encodings)) self._header = None if self._trailer != b'': self._trailer = b'' class EmbeddedPdv(Sequence): """ A sequence structure """ tag = 11 class NumericString(AbstractString): """ Represents a numeric string from ASN.1 as a Python unicode string """ tag = 18 _encoding = 'latin1' class PrintableString(AbstractString): """ Represents a printable string from ASN.1 as a Python unicode string """ tag = 19 _encoding = 'latin1' class TeletexString(AbstractString): """ Represents a teletex string from ASN.1 as a Python unicode string """ tag = 20 _encoding = 'teletex' class VideotexString(OctetString): """ Represents a videotex string from ASN.1 as a Python byte string """ tag = 21 class IA5String(AbstractString): """ Represents an IA5 string from ASN.1 as a Python unicode string """ tag = 22 _encoding = 'ascii' class AbstractTime(AbstractString): """ Represents a time from ASN.1 as a Python datetime.datetime object """ @property def _parsed_time(self): """ The parsed datetime string. :raises: ValueError - when an invalid value is passed :return: A dict with the parsed values """ string = str_cls(self) m = self._TIMESTRING_RE.match(string) if not m: raise ValueError(unwrap( ''' Error parsing %s to a %s ''', string, type_name(self), )) groups = m.groupdict() tz = None if groups['zulu']: tz = timezone.utc elif groups['dsign']: sign = 1 if groups['dsign'] == '+' else -1 tz = create_timezone(sign * timedelta( hours=int(groups['dhour']), minutes=int(groups['dminute'] or 0) )) if groups['fraction']: # Compute fraction in microseconds fract = Fraction( int(groups['fraction']), 10 ** len(groups['fraction']) ) * 1000000 if groups['minute'] is None: fract *= 3600 elif groups['second'] is None: fract *= 60 fract_usec = int(fract.limit_denominator(1)) else: fract_usec = 0 return { 'year': int(groups['year']), 'month': int(groups['month']), 'day': int(groups['day']), 'hour': int(groups['hour']), 'minute': int(groups['minute'] or 0), 'second': int(groups['second'] or 0), 'tzinfo': tz, 'fraction': fract_usec, } @property def native(self): """ The native Python datatype representation of this value :return: A datetime.datetime object, asn1crypto.util.extended_datetime object or None. The datetime object is usually timezone aware. If it's naive, then it's in the sender's local time; see X.680 sect. 42.3 """ if self.contents is None: return None if self._native is None: parsed = self._parsed_time fraction = parsed.pop('fraction', 0) value = self._get_datetime(parsed) if fraction: value += timedelta(microseconds=fraction) self._native = value return self._native class UTCTime(AbstractTime): """ Represents a UTC time from ASN.1 as a timezone aware Python datetime.datetime object """ tag = 23 # Regular expression for UTCTime as described in X.680 sect. 43 and ISO 8601 _TIMESTRING_RE = re.compile(r''' ^ # YYMMDD (?P\d{2}) (?P\d{2}) (?P\d{2}) # hhmm or hhmmss (?P\d{2}) (?P\d{2}) (?P\d{2})? # Matches nothing, needed because GeneralizedTime uses this. (?P) # Z or [-+]hhmm (?: (?PZ) | (?: (?P[-+]) (?P\d{2}) (?P\d{2}) ) ) $ ''', re.X) def set(self, value): """ Sets the value of the object :param value: A unicode string or a datetime.datetime object :raises: ValueError - when an invalid value is passed """ if isinstance(value, datetime): if not value.tzinfo: raise ValueError('Must be timezone aware') # Convert value to UTC. value = value.astimezone(utc_with_dst) if not 1950 <= value.year <= 2049: raise ValueError('Year of the UTCTime is not in range [1950, 2049], use GeneralizedTime instead') value = value.strftime('%y%m%d%H%M%SZ') if _PY2: value = value.decode('ascii') AbstractString.set(self, value) # Set it to None and let the class take care of converting the next # time that .native is called self._native = None def _get_datetime(self, parsed): """ Create a datetime object from the parsed time. :return: An aware datetime.datetime object """ # X.680 only specifies that UTCTime is not using a century. # So "18" could as well mean 2118 or 1318. # X.509 and CMS specify to use UTCTime for years earlier than 2050. # Assume that UTCTime is only used for years [1950, 2049]. if parsed['year'] < 50: parsed['year'] += 2000 else: parsed['year'] += 1900 return datetime(**parsed) class GeneralizedTime(AbstractTime): """ Represents a generalized time from ASN.1 as a Python datetime.datetime object or asn1crypto.util.extended_datetime object in UTC """ tag = 24 # Regular expression for GeneralizedTime as described in X.680 sect. 42 and ISO 8601 _TIMESTRING_RE = re.compile(r''' ^ # YYYYMMDD (?P\d{4}) (?P\d{2}) (?P\d{2}) # hh or hhmm or hhmmss (?P\d{2}) (?: (?P\d{2}) (?P\d{2})? )? # Optional fraction; [.,]dddd (one or more decimals) # If Seconds are given, it's fractions of Seconds. # Else if Minutes are given, it's fractions of Minutes. # Else it's fractions of Hours. (?: [,.] (?P\d+) )? # Optional timezone. If left out, the time is in local time. # Z or [-+]hh or [-+]hhmm (?: (?PZ) | (?: (?P[-+]) (?P\d{2}) (?P\d{2})? ) )? $ ''', re.X) def set(self, value): """ Sets the value of the object :param value: A unicode string, a datetime.datetime object or an asn1crypto.util.extended_datetime object :raises: ValueError - when an invalid value is passed """ if isinstance(value, (datetime, extended_datetime)): if not value.tzinfo: raise ValueError('Must be timezone aware') # Convert value to UTC. value = value.astimezone(utc_with_dst) if value.microsecond: fraction = '.' + str(value.microsecond).zfill(6).rstrip('0') else: fraction = '' value = value.strftime('%Y%m%d%H%M%S') + fraction + 'Z' if _PY2: value = value.decode('ascii') AbstractString.set(self, value) # Set it to None and let the class take care of converting the next # time that .native is called self._native = None def _get_datetime(self, parsed): """ Create a datetime object from the parsed time. :return: A datetime.datetime object or asn1crypto.util.extended_datetime object. It may or may not be aware. """ if parsed['year'] == 0: # datetime does not support year 0. Use extended_datetime instead. return extended_datetime(**parsed) else: return datetime(**parsed) class GraphicString(AbstractString): """ Represents a graphic string from ASN.1 as a Python unicode string """ tag = 25 # This is technically not correct since this type can contain any charset _encoding = 'latin1' class VisibleString(AbstractString): """ Represents a visible string from ASN.1 as a Python unicode string """ tag = 26 _encoding = 'latin1' class GeneralString(AbstractString): """ Represents a general string from ASN.1 as a Python unicode string """ tag = 27 # This is technically not correct since this type can contain any charset _encoding = 'latin1' class UniversalString(AbstractString): """ Represents a universal string from ASN.1 as a Python unicode string """ tag = 28 _encoding = 'utf-32-be' class CharacterString(AbstractString): """ Represents a character string from ASN.1 as a Python unicode string """ tag = 29 # This is technically not correct since this type can contain any charset _encoding = 'latin1' class BMPString(AbstractString): """ Represents a BMP string from ASN.1 as a Python unicode string """ tag = 30 _encoding = 'utf-16-be' def _basic_debug(prefix, self): """ Prints out basic information about an Asn1Value object. Extracted for reuse among different classes that customize the debug information. :param prefix: A unicode string of spaces to prefix output line with :param self: The object to print the debugging information about """ print('%s%s Object #%s' % (prefix, type_name(self), id(self))) if self._header: print('%s Header: 0x%s' % (prefix, binascii.hexlify(self._header or b'').decode('utf-8'))) has_header = self.method is not None and self.class_ is not None and self.tag is not None if has_header: method_name = METHOD_NUM_TO_NAME_MAP.get(self.method) class_name = CLASS_NUM_TO_NAME_MAP.get(self.class_) if self.explicit is not None: for class_, tag in self.explicit: print( '%s %s tag %s (explicitly tagged)' % ( prefix, CLASS_NUM_TO_NAME_MAP.get(class_), tag ) ) if has_header: print('%s %s %s %s' % (prefix, method_name, class_name, self.tag)) elif self.implicit: if has_header: print('%s %s %s tag %s (implicitly tagged)' % (prefix, method_name, class_name, self.tag)) elif has_header: print('%s %s %s tag %s' % (prefix, method_name, class_name, self.tag)) if self._trailer: print('%s Trailer: 0x%s' % (prefix, binascii.hexlify(self._trailer or b'').decode('utf-8'))) print('%s Data: 0x%s' % (prefix, binascii.hexlify(self.contents or b'').decode('utf-8'))) def _tag_type_to_explicit_implicit(params): """ Converts old-style "tag_type" and "tag" params to "explicit" and "implicit" :param params: A dict of parameters to convert from tag_type/tag to explicit/implicit """ if 'tag_type' in params: if params['tag_type'] == 'explicit': params['explicit'] = (params.get('class', 2), params['tag']) elif params['tag_type'] == 'implicit': params['implicit'] = (params.get('class', 2), params['tag']) del params['tag_type'] del params['tag'] if 'class' in params: del params['class'] def _fix_tagging(value, params): """ Checks if a value is properly tagged based on the spec, and re/untags as necessary :param value: An Asn1Value object :param params: A dict of spec params :return: An Asn1Value that is properly tagged """ _tag_type_to_explicit_implicit(params) retag = False if 'implicit' not in params: if value.implicit is not False: retag = True else: if isinstance(params['implicit'], tuple): class_, tag = params['implicit'] else: tag = params['implicit'] class_ = 'context' if value.implicit is False: retag = True elif value.class_ != CLASS_NAME_TO_NUM_MAP[class_] or value.tag != tag: retag = True if params.get('explicit') != value.explicit: retag = True if retag: return value.retag(params) return value def _build_id_tuple(params, spec): """ Builds a 2-element tuple used to identify fields by grabbing the class_ and tag from an Asn1Value class and the params dict being passed to it :param params: A dict of params to pass to spec :param spec: An Asn1Value class :return: A 2-element integer tuple in the form (class_, tag) """ # Handle situations where the spec is not known at setup time if spec is None: return (None, None) required_class = spec.class_ required_tag = spec.tag _tag_type_to_explicit_implicit(params) if 'explicit' in params: if isinstance(params['explicit'], tuple): required_class, required_tag = params['explicit'] else: required_class = 2 required_tag = params['explicit'] elif 'implicit' in params: if isinstance(params['implicit'], tuple): required_class, required_tag = params['implicit'] else: required_class = 2 required_tag = params['implicit'] if required_class is not None and not isinstance(required_class, int_types): required_class = CLASS_NAME_TO_NUM_MAP[required_class] required_class = params.get('class_', required_class) required_tag = params.get('tag', required_tag) return (required_class, required_tag) def _int_to_bit_tuple(value, bits): """ Format value as a tuple of 1s and 0s. :param value: A non-negative integer to format :param bits: Number of bits in the output :return: A tuple of 1s and 0s with bits members. """ if not value and not bits: return () result = tuple(map(int, format(value, '0{0}b'.format(bits)))) if len(result) != bits: raise ValueError('Result too large: {0} > {1}'.format(len(result), bits)) return result _UNIVERSAL_SPECS = { 1: Boolean, 2: Integer, 3: BitString, 4: OctetString, 5: Null, 6: ObjectIdentifier, 7: ObjectDescriptor, 8: InstanceOf, 9: Real, 10: Enumerated, 11: EmbeddedPdv, 12: UTF8String, 13: RelativeOid, 16: Sequence, 17: Set, 18: NumericString, 19: PrintableString, 20: TeletexString, 21: VideotexString, 22: IA5String, 23: UTCTime, 24: GeneralizedTime, 25: GraphicString, 26: VisibleString, 27: GeneralString, 28: UniversalString, 29: CharacterString, 30: BMPString } def _build(class_, method, tag, header, contents, trailer, spec=None, spec_params=None, nested_spec=None): """ Builds an Asn1Value object generically, or using a spec with optional params :param class_: An integer representing the ASN.1 class :param method: An integer representing the ASN.1 method :param tag: An integer representing the ASN.1 tag :param header: A byte string of the ASN.1 header (class, method, tag, length) :param contents: A byte string of the ASN.1 value :param trailer: A byte string of any ASN.1 trailer (only used by indefinite length encodings) :param spec: A class derived from Asn1Value that defines what class_ and tag the value should have, and the semantics of the encoded value. The return value will be of this type. If omitted, the encoded value will be decoded using the standard universal tag based on the encoded tag number. :param spec_params: A dict of params to pass to the spec object :param nested_spec: For certain Asn1Value classes (such as OctetString and BitString), the contents can be further parsed and interpreted as another Asn1Value. This parameter controls the spec for that sub-parsing. :return: An object of the type spec, or if not specified, a child of Asn1Value """ if spec_params is not None: _tag_type_to_explicit_implicit(spec_params) if header is None: return VOID header_set = False # If an explicit specification was passed in, make sure it matches if spec is not None: # If there is explicit tagging and contents, we have to split # the header and trailer off before we do the parsing no_explicit = spec_params and 'no_explicit' in spec_params if not no_explicit and (spec.explicit or (spec_params and 'explicit' in spec_params)): if spec_params: value = spec(**spec_params) else: value = spec() original_explicit = value.explicit explicit_info = reversed(original_explicit) parsed_class = class_ parsed_method = method parsed_tag = tag to_parse = contents explicit_header = header explicit_trailer = trailer or b'' for expected_class, expected_tag in explicit_info: if parsed_class != expected_class: raise ValueError(unwrap( ''' Error parsing %s - explicitly-tagged class should have been %s, but %s was found ''', type_name(value), CLASS_NUM_TO_NAME_MAP.get(expected_class), CLASS_NUM_TO_NAME_MAP.get(parsed_class, parsed_class) )) if parsed_method != 1: raise ValueError(unwrap( ''' Error parsing %s - explicitly-tagged method should have been %s, but %s was found ''', type_name(value), METHOD_NUM_TO_NAME_MAP.get(1), METHOD_NUM_TO_NAME_MAP.get(parsed_method, parsed_method) )) if parsed_tag != expected_tag: raise ValueError(unwrap( ''' Error parsing %s - explicitly-tagged tag should have been %s, but %s was found ''', type_name(value), expected_tag, parsed_tag )) info, _ = _parse(to_parse, len(to_parse)) parsed_class, parsed_method, parsed_tag, parsed_header, to_parse, parsed_trailer = info if not isinstance(value, Choice): explicit_header += parsed_header explicit_trailer = parsed_trailer + explicit_trailer value = _build(*info, spec=spec, spec_params={'no_explicit': True}) value._header = explicit_header value._trailer = explicit_trailer value.explicit = original_explicit header_set = True else: if spec_params: value = spec(contents=contents, **spec_params) else: value = spec(contents=contents) if spec is Any: pass elif isinstance(value, Choice): value.validate(class_, tag, contents) try: # Force parsing the Choice now value.contents = header + value.contents header = b'' value.parse() except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(value),) + args raise e else: if class_ != value.class_: raise ValueError(unwrap( ''' Error parsing %s - class should have been %s, but %s was found ''', type_name(value), CLASS_NUM_TO_NAME_MAP.get(value.class_), CLASS_NUM_TO_NAME_MAP.get(class_, class_) )) if method != value.method: # Allow parsing a primitive method as constructed if the value # is indefinite length. This is to allow parsing BER. ber_indef = method == 1 and value.method == 0 and trailer == b'\x00\x00' if not ber_indef or not isinstance(value, Constructable): raise ValueError(unwrap( ''' Error parsing %s - method should have been %s, but %s was found ''', type_name(value), METHOD_NUM_TO_NAME_MAP.get(value.method), METHOD_NUM_TO_NAME_MAP.get(method, method) )) else: value.method = method value._indefinite = True if tag != value.tag: if isinstance(value._bad_tag, tuple): is_bad_tag = tag in value._bad_tag else: is_bad_tag = tag == value._bad_tag if not is_bad_tag: raise ValueError(unwrap( ''' Error parsing %s - tag should have been %s, but %s was found ''', type_name(value), value.tag, tag )) # For explicitly tagged, un-speced parsings, we use a generic container # since we will be parsing the contents and discarding the outer object # anyway a little further on elif spec_params and 'explicit' in spec_params: original_value = Asn1Value(contents=contents, **spec_params) original_explicit = original_value.explicit to_parse = contents explicit_header = header explicit_trailer = trailer or b'' for expected_class, expected_tag in reversed(original_explicit): info, _ = _parse(to_parse, len(to_parse)) _, _, _, parsed_header, to_parse, parsed_trailer = info explicit_header += parsed_header explicit_trailer = parsed_trailer + explicit_trailer value = _build(*info, spec=spec, spec_params={'no_explicit': True}) value._header = header + value._header value._trailer += trailer or b'' value.explicit = original_explicit header_set = True # If no spec was specified, allow anything and just process what # is in the input data else: if tag not in _UNIVERSAL_SPECS: raise ValueError(unwrap( ''' Unknown element - %s class, %s method, tag %s ''', CLASS_NUM_TO_NAME_MAP.get(class_), METHOD_NUM_TO_NAME_MAP.get(method), tag )) spec = _UNIVERSAL_SPECS[tag] value = spec(contents=contents, class_=class_) ber_indef = method == 1 and value.method == 0 and trailer == b'\x00\x00' if ber_indef and isinstance(value, Constructable): value._indefinite = True value.method = method if not header_set: value._header = header value._trailer = trailer or b'' # Destroy any default value that our contents have overwritten value._native = None if nested_spec: try: value.parse(nested_spec) except (ValueError, TypeError) as e: args = e.args[1:] e.args = (e.args[0] + '\n while parsing %s' % type_name(value),) + args raise e return value def _parse_build(encoded_data, pointer=0, spec=None, spec_params=None, strict=False): """ Parses a byte string generically, or using a spec with optional params :param encoded_data: A byte string that contains BER-encoded data :param pointer: The index in the byte string to parse from :param spec: A class derived from Asn1Value that defines what class_ and tag the value should have, and the semantics of the encoded value. The return value will be of this type. If omitted, the encoded value will be decoded using the standard universal tag based on the encoded tag number. :param spec_params: A dict of params to pass to the spec object :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :return: A 2-element tuple: - 0: An object of the type spec, or if not specified, a child of Asn1Value - 1: An integer indicating how many bytes were consumed """ encoded_len = len(encoded_data) info, new_pointer = _parse(encoded_data, encoded_len, pointer) if strict and new_pointer != pointer + encoded_len: extra_bytes = pointer + encoded_len - new_pointer raise ValueError('Extra data - %d bytes of trailing data were provided' % extra_bytes) return (_build(*info, spec=spec, spec_params=spec_params), new_pointer) crl.py000064400000037350152572326550005722 0ustar00# coding: utf-8 """ ASN.1 type classes for certificate revocation lists (CRL). Exports the following items: - CertificateList() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function import hashlib from .algos import SignedDigestAlgorithm from .core import ( Boolean, Enumerated, GeneralizedTime, Integer, ObjectIdentifier, OctetBitString, ParsableOctetString, Sequence, SequenceOf, ) from .x509 import ( AuthorityInfoAccessSyntax, AuthorityKeyIdentifier, CRLDistributionPoints, DistributionPointName, GeneralNames, Name, ReasonFlags, Time, ) # The structures in this file are taken from https://tools.ietf.org/html/rfc5280 class Version(Integer): _map = { 0: 'v1', 1: 'v2', 2: 'v3', } class IssuingDistributionPoint(Sequence): _fields = [ ('distribution_point', DistributionPointName, {'explicit': 0, 'optional': True}), ('only_contains_user_certs', Boolean, {'implicit': 1, 'default': False}), ('only_contains_ca_certs', Boolean, {'implicit': 2, 'default': False}), ('only_some_reasons', ReasonFlags, {'implicit': 3, 'optional': True}), ('indirect_crl', Boolean, {'implicit': 4, 'default': False}), ('only_contains_attribute_certs', Boolean, {'implicit': 5, 'default': False}), ] class TBSCertListExtensionId(ObjectIdentifier): _map = { '2.5.29.18': 'issuer_alt_name', '2.5.29.20': 'crl_number', '2.5.29.27': 'delta_crl_indicator', '2.5.29.28': 'issuing_distribution_point', '2.5.29.35': 'authority_key_identifier', '2.5.29.46': 'freshest_crl', '1.3.6.1.5.5.7.1.1': 'authority_information_access', } class TBSCertListExtension(Sequence): _fields = [ ('extn_id', TBSCertListExtensionId), ('critical', Boolean, {'default': False}), ('extn_value', ParsableOctetString), ] _oid_pair = ('extn_id', 'extn_value') _oid_specs = { 'issuer_alt_name': GeneralNames, 'crl_number': Integer, 'delta_crl_indicator': Integer, 'issuing_distribution_point': IssuingDistributionPoint, 'authority_key_identifier': AuthorityKeyIdentifier, 'freshest_crl': CRLDistributionPoints, 'authority_information_access': AuthorityInfoAccessSyntax, } class TBSCertListExtensions(SequenceOf): _child_spec = TBSCertListExtension class CRLReason(Enumerated): _map = { 0: 'unspecified', 1: 'key_compromise', 2: 'ca_compromise', 3: 'affiliation_changed', 4: 'superseded', 5: 'cessation_of_operation', 6: 'certificate_hold', 8: 'remove_from_crl', 9: 'privilege_withdrawn', 10: 'aa_compromise', } @property def human_friendly(self): """ :return: A unicode string with revocation description that is suitable to show to end-users. Starts with a lower case letter and phrased in such a way that it makes sense after the phrase "because of" or "due to". """ return { 'unspecified': 'an unspecified reason', 'key_compromise': 'a compromised key', 'ca_compromise': 'the CA being compromised', 'affiliation_changed': 'an affiliation change', 'superseded': 'certificate supersession', 'cessation_of_operation': 'a cessation of operation', 'certificate_hold': 'a certificate hold', 'remove_from_crl': 'removal from the CRL', 'privilege_withdrawn': 'privilege withdrawl', 'aa_compromise': 'the AA being compromised', }[self.native] class CRLEntryExtensionId(ObjectIdentifier): _map = { '2.5.29.21': 'crl_reason', '2.5.29.23': 'hold_instruction_code', '2.5.29.24': 'invalidity_date', '2.5.29.29': 'certificate_issuer', } class CRLEntryExtension(Sequence): _fields = [ ('extn_id', CRLEntryExtensionId), ('critical', Boolean, {'default': False}), ('extn_value', ParsableOctetString), ] _oid_pair = ('extn_id', 'extn_value') _oid_specs = { 'crl_reason': CRLReason, 'hold_instruction_code': ObjectIdentifier, 'invalidity_date': GeneralizedTime, 'certificate_issuer': GeneralNames, } class CRLEntryExtensions(SequenceOf): _child_spec = CRLEntryExtension class RevokedCertificate(Sequence): _fields = [ ('user_certificate', Integer), ('revocation_date', Time), ('crl_entry_extensions', CRLEntryExtensions, {'optional': True}), ] _processed_extensions = False _critical_extensions = None _crl_reason_value = None _invalidity_date_value = None _certificate_issuer_value = None _issuer_name = False def _set_extensions(self): """ Sets common named extensions to private attributes and creates a list of critical extensions """ self._critical_extensions = set() for extension in self['crl_entry_extensions']: name = extension['extn_id'].native attribute_name = '_%s_value' % name if hasattr(self, attribute_name): setattr(self, attribute_name, extension['extn_value'].parsed) if extension['critical'].native: self._critical_extensions.add(name) self._processed_extensions = True @property def critical_extensions(self): """ Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings """ if not self._processed_extensions: self._set_extensions() return self._critical_extensions @property def crl_reason_value(self): """ This extension indicates the reason that a certificate was revoked. :return: None or a CRLReason object """ if self._processed_extensions is False: self._set_extensions() return self._crl_reason_value @property def invalidity_date_value(self): """ This extension indicates the suspected date/time the private key was compromised or the certificate became invalid. This would usually be before the revocation date, which is when the CA processed the revocation. :return: None or a GeneralizedTime object """ if self._processed_extensions is False: self._set_extensions() return self._invalidity_date_value @property def certificate_issuer_value(self): """ This extension indicates the issuer of the certificate in question, and is used in indirect CRLs. CRL entries without this extension are for certificates issued from the last seen issuer. :return: None or an x509.GeneralNames object """ if self._processed_extensions is False: self._set_extensions() return self._certificate_issuer_value @property def issuer_name(self): """ :return: None, or an asn1crypto.x509.Name object for the issuer of the cert """ if self._issuer_name is False: self._issuer_name = None if self.certificate_issuer_value: for general_name in self.certificate_issuer_value: if general_name.name == 'directory_name': self._issuer_name = general_name.chosen break return self._issuer_name class RevokedCertificates(SequenceOf): _child_spec = RevokedCertificate class TbsCertList(Sequence): _fields = [ ('version', Version, {'optional': True}), ('signature', SignedDigestAlgorithm), ('issuer', Name), ('this_update', Time), ('next_update', Time, {'optional': True}), ('revoked_certificates', RevokedCertificates, {'optional': True}), ('crl_extensions', TBSCertListExtensions, {'explicit': 0, 'optional': True}), ] class CertificateList(Sequence): _fields = [ ('tbs_cert_list', TbsCertList), ('signature_algorithm', SignedDigestAlgorithm), ('signature', OctetBitString), ] _processed_extensions = False _critical_extensions = None _issuer_alt_name_value = None _crl_number_value = None _delta_crl_indicator_value = None _issuing_distribution_point_value = None _authority_key_identifier_value = None _freshest_crl_value = None _authority_information_access_value = None _issuer_cert_urls = None _delta_crl_distribution_points = None _sha1 = None _sha256 = None def _set_extensions(self): """ Sets common named extensions to private attributes and creates a list of critical extensions """ self._critical_extensions = set() for extension in self['tbs_cert_list']['crl_extensions']: name = extension['extn_id'].native attribute_name = '_%s_value' % name if hasattr(self, attribute_name): setattr(self, attribute_name, extension['extn_value'].parsed) if extension['critical'].native: self._critical_extensions.add(name) self._processed_extensions = True @property def critical_extensions(self): """ Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings """ if not self._processed_extensions: self._set_extensions() return self._critical_extensions @property def issuer_alt_name_value(self): """ This extension allows associating one or more alternative names with the issuer of the CRL. :return: None or an x509.GeneralNames object """ if self._processed_extensions is False: self._set_extensions() return self._issuer_alt_name_value @property def crl_number_value(self): """ This extension adds a monotonically increasing number to the CRL and is used to distinguish different versions of the CRL. :return: None or an Integer object """ if self._processed_extensions is False: self._set_extensions() return self._crl_number_value @property def delta_crl_indicator_value(self): """ This extension indicates a CRL is a delta CRL, and contains the CRL number of the base CRL that it is a delta from. :return: None or an Integer object """ if self._processed_extensions is False: self._set_extensions() return self._delta_crl_indicator_value @property def issuing_distribution_point_value(self): """ This extension includes information about what types of revocations and certificates are part of the CRL. :return: None or an IssuingDistributionPoint object """ if self._processed_extensions is False: self._set_extensions() return self._issuing_distribution_point_value @property def authority_key_identifier_value(self): """ This extension helps in identifying the public key with which to validate the authenticity of the CRL. :return: None or an AuthorityKeyIdentifier object """ if self._processed_extensions is False: self._set_extensions() return self._authority_key_identifier_value @property def freshest_crl_value(self): """ This extension is used in complete CRLs to indicate where a delta CRL may be located. :return: None or a CRLDistributionPoints object """ if self._processed_extensions is False: self._set_extensions() return self._freshest_crl_value @property def authority_information_access_value(self): """ This extension is used to provide a URL with which to download the certificate used to sign this CRL. :return: None or an AuthorityInfoAccessSyntax object """ if self._processed_extensions is False: self._set_extensions() return self._authority_information_access_value @property def issuer(self): """ :return: An asn1crypto.x509.Name object for the issuer of the CRL """ return self['tbs_cert_list']['issuer'] @property def authority_key_identifier(self): """ :return: None or a byte string of the key_identifier from the authority key identifier extension """ if not self.authority_key_identifier_value: return None return self.authority_key_identifier_value['key_identifier'].native @property def issuer_cert_urls(self): """ :return: A list of unicode strings that are URLs that should contain either an individual DER-encoded X.509 certificate, or a DER-encoded CMS message containing multiple certificates """ if self._issuer_cert_urls is None: self._issuer_cert_urls = [] if self.authority_information_access_value: for entry in self.authority_information_access_value: if entry['access_method'].native == 'ca_issuers': location = entry['access_location'] if location.name != 'uniform_resource_identifier': continue url = location.native if url.lower()[0:7] == 'http://': self._issuer_cert_urls.append(url) return self._issuer_cert_urls @property def delta_crl_distribution_points(self): """ Returns delta CRL URLs - only applies to complete CRLs :return: A list of zero or more DistributionPoint objects """ if self._delta_crl_distribution_points is None: self._delta_crl_distribution_points = [] if self.freshest_crl_value is not None: for distribution_point in self.freshest_crl_value: distribution_point_name = distribution_point['distribution_point'] # RFC 5280 indicates conforming CA should not use the relative form if distribution_point_name.name == 'name_relative_to_crl_issuer': continue # This library is currently only concerned with HTTP-based CRLs for general_name in distribution_point_name.chosen: if general_name.name == 'uniform_resource_identifier': self._delta_crl_distribution_points.append(distribution_point) return self._delta_crl_distribution_points @property def signature(self): """ :return: A byte string of the signature """ return self['signature'].native @property def sha1(self): """ :return: The SHA1 hash of the DER-encoded bytes of this certificate list """ if self._sha1 is None: self._sha1 = hashlib.sha1(self.dump()).digest() return self._sha1 @property def sha256(self): """ :return: The SHA-256 hash of the DER-encoded bytes of this certificate list """ if self._sha256 is None: self._sha256 = hashlib.sha256(self.dump()).digest() return self._sha256 csr.py000064400000006726152572326550005734 0ustar00# coding: utf-8 """ ASN.1 type classes for certificate signing requests (CSR). Exports the following items: - CertificationRequest() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function from .algos import SignedDigestAlgorithm from .core import ( Any, BitString, BMPString, Integer, ObjectIdentifier, OctetBitString, Sequence, SetOf, UTF8String ) from .keys import PublicKeyInfo from .x509 import DirectoryString, Extensions, Name # The structures in this file are taken from https://tools.ietf.org/html/rfc2986 # and https://tools.ietf.org/html/rfc2985 class Version(Integer): _map = { 0: 'v1', } class CSRAttributeType(ObjectIdentifier): _map = { '1.2.840.113549.1.9.7': 'challenge_password', '1.2.840.113549.1.9.9': 'extended_certificate_attributes', '1.2.840.113549.1.9.14': 'extension_request', # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/a5eaae36-e9f3-4dc5-a687-bfa7115954f1 '1.3.6.1.4.1.311.13.2.2': 'microsoft_enrollment_csp_provider', # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/7c677cba-030d-48be-ba2b-01e407705f34 '1.3.6.1.4.1.311.13.2.3': 'microsoft_os_version', # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/64e5ff6d-c6dd-4578-92f7-b3d895f9b9c7 '1.3.6.1.4.1.311.21.20': 'microsoft_request_client_info', } class SetOfDirectoryString(SetOf): _child_spec = DirectoryString class Attribute(Sequence): _fields = [ ('type', ObjectIdentifier), ('values', SetOf, {'spec': Any}), ] class SetOfAttributes(SetOf): _child_spec = Attribute class SetOfExtensions(SetOf): _child_spec = Extensions class MicrosoftEnrollmentCSProvider(Sequence): _fields = [ ('keyspec', Integer), ('cspname', BMPString), # cryptographic service provider name ('signature', BitString), ] class SetOfMicrosoftEnrollmentCSProvider(SetOf): _child_spec = MicrosoftEnrollmentCSProvider class MicrosoftRequestClientInfo(Sequence): _fields = [ ('clientid', Integer), ('machinename', UTF8String), ('username', UTF8String), ('processname', UTF8String), ] class SetOfMicrosoftRequestClientInfo(SetOf): _child_spec = MicrosoftRequestClientInfo class CRIAttribute(Sequence): _fields = [ ('type', CSRAttributeType), ('values', Any), ] _oid_pair = ('type', 'values') _oid_specs = { 'challenge_password': SetOfDirectoryString, 'extended_certificate_attributes': SetOfAttributes, 'extension_request': SetOfExtensions, 'microsoft_enrollment_csp_provider': SetOfMicrosoftEnrollmentCSProvider, 'microsoft_os_version': SetOfDirectoryString, 'microsoft_request_client_info': SetOfMicrosoftRequestClientInfo, } class CRIAttributes(SetOf): _child_spec = CRIAttribute class CertificationRequestInfo(Sequence): _fields = [ ('version', Version), ('subject', Name), ('subject_pk_info', PublicKeyInfo), ('attributes', CRIAttributes, {'implicit': 0, 'optional': True}), ] class CertificationRequest(Sequence): _fields = [ ('certification_request_info', CertificationRequestInfo), ('signature_algorithm', SignedDigestAlgorithm), ('signature', OctetBitString), ] keys.py000064400000111747152572326550006120 0ustar00# coding: utf-8 """ ASN.1 type classes for public and private keys. Exports the following items: - DSAPrivateKey() - ECPrivateKey() - EncryptedPrivateKeyInfo() - PrivateKeyInfo() - PublicKeyInfo() - RSAPrivateKey() - RSAPublicKey() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function import hashlib import math from ._errors import unwrap, APIException from ._types import type_name, byte_cls from .algos import _ForceNullParameters, DigestAlgorithm, EncryptionAlgorithm, RSAESOAEPParams, RSASSAPSSParams from .core import ( Any, Asn1Value, BitString, Choice, Integer, IntegerOctetString, Null, ObjectIdentifier, OctetBitString, OctetString, ParsableOctetString, ParsableOctetBitString, Sequence, SequenceOf, SetOf, ) from .util import int_from_bytes, int_to_bytes class OtherPrimeInfo(Sequence): """ Source: https://tools.ietf.org/html/rfc3447#page-46 """ _fields = [ ('prime', Integer), ('exponent', Integer), ('coefficient', Integer), ] class OtherPrimeInfos(SequenceOf): """ Source: https://tools.ietf.org/html/rfc3447#page-46 """ _child_spec = OtherPrimeInfo class RSAPrivateKeyVersion(Integer): """ Original Name: Version Source: https://tools.ietf.org/html/rfc3447#page-45 """ _map = { 0: 'two-prime', 1: 'multi', } class RSAPrivateKey(Sequence): """ Source: https://tools.ietf.org/html/rfc3447#page-45 """ _fields = [ ('version', RSAPrivateKeyVersion), ('modulus', Integer), ('public_exponent', Integer), ('private_exponent', Integer), ('prime1', Integer), ('prime2', Integer), ('exponent1', Integer), ('exponent2', Integer), ('coefficient', Integer), ('other_prime_infos', OtherPrimeInfos, {'optional': True}) ] class RSAPublicKey(Sequence): """ Source: https://tools.ietf.org/html/rfc3447#page-44 """ _fields = [ ('modulus', Integer), ('public_exponent', Integer) ] class DSAPrivateKey(Sequence): """ The ASN.1 structure that OpenSSL uses to store a DSA private key that is not part of a PKCS#8 structure. Reversed engineered from english-language description on linked OpenSSL documentation page. Original Name: None Source: https://www.openssl.org/docs/apps/dsa.html """ _fields = [ ('version', Integer), ('p', Integer), ('q', Integer), ('g', Integer), ('public_key', Integer), ('private_key', Integer), ] class _ECPoint(): """ In both PublicKeyInfo and PrivateKeyInfo, the EC public key is a byte string that is encoded as a bit string. This class adds convenience methods for converting to and from the byte string to a pair of integers that are the X and Y coordinates. """ @classmethod def from_coords(cls, x, y): """ Creates an ECPoint object from the X and Y integer coordinates of the point :param x: The X coordinate, as an integer :param y: The Y coordinate, as an integer :return: An ECPoint object """ x_bytes = int(math.ceil(math.log(x, 2) / 8.0)) y_bytes = int(math.ceil(math.log(y, 2) / 8.0)) num_bytes = max(x_bytes, y_bytes) byte_string = b'\x04' byte_string += int_to_bytes(x, width=num_bytes) byte_string += int_to_bytes(y, width=num_bytes) return cls(byte_string) def to_coords(self): """ Returns the X and Y coordinates for this EC point, as native Python integers :return: A 2-element tuple containing integers (X, Y) """ data = self.native first_byte = data[0:1] # Uncompressed if first_byte == b'\x04': remaining = data[1:] field_len = len(remaining) // 2 x = int_from_bytes(remaining[0:field_len]) y = int_from_bytes(remaining[field_len:]) return (x, y) if first_byte not in set([b'\x02', b'\x03']): raise ValueError(unwrap( ''' Invalid EC public key - first byte is incorrect ''' )) raise ValueError(unwrap( ''' Compressed representations of EC public keys are not supported due to patent US6252960 ''' )) class ECPoint(OctetString, _ECPoint): pass class ECPointBitString(OctetBitString, _ECPoint): pass class SpecifiedECDomainVersion(Integer): """ Source: http://www.secg.org/sec1-v2.pdf page 104 """ _map = { 1: 'ecdpVer1', 2: 'ecdpVer2', 3: 'ecdpVer3', } class FieldType(ObjectIdentifier): """ Original Name: None Source: http://www.secg.org/sec1-v2.pdf page 101 """ _map = { '1.2.840.10045.1.1': 'prime_field', '1.2.840.10045.1.2': 'characteristic_two_field', } class CharacteristicTwoBasis(ObjectIdentifier): """ Original Name: None Source: http://www.secg.org/sec1-v2.pdf page 102 """ _map = { '1.2.840.10045.1.2.1.1': 'gn_basis', '1.2.840.10045.1.2.1.2': 'tp_basis', '1.2.840.10045.1.2.1.3': 'pp_basis', } class Pentanomial(Sequence): """ Source: http://www.secg.org/sec1-v2.pdf page 102 """ _fields = [ ('k1', Integer), ('k2', Integer), ('k3', Integer), ] class CharacteristicTwo(Sequence): """ Original Name: Characteristic-two Source: http://www.secg.org/sec1-v2.pdf page 101 """ _fields = [ ('m', Integer), ('basis', CharacteristicTwoBasis), ('parameters', Any), ] _oid_pair = ('basis', 'parameters') _oid_specs = { 'gn_basis': Null, 'tp_basis': Integer, 'pp_basis': Pentanomial, } class FieldID(Sequence): """ Source: http://www.secg.org/sec1-v2.pdf page 100 """ _fields = [ ('field_type', FieldType), ('parameters', Any), ] _oid_pair = ('field_type', 'parameters') _oid_specs = { 'prime_field': Integer, 'characteristic_two_field': CharacteristicTwo, } class Curve(Sequence): """ Source: http://www.secg.org/sec1-v2.pdf page 104 """ _fields = [ ('a', OctetString), ('b', OctetString), ('seed', OctetBitString, {'optional': True}), ] class SpecifiedECDomain(Sequence): """ Source: http://www.secg.org/sec1-v2.pdf page 103 """ _fields = [ ('version', SpecifiedECDomainVersion), ('field_id', FieldID), ('curve', Curve), ('base', ECPoint), ('order', Integer), ('cofactor', Integer, {'optional': True}), ('hash', DigestAlgorithm, {'optional': True}), ] class NamedCurve(ObjectIdentifier): """ Various named curves Original Name: None Source: https://tools.ietf.org/html/rfc3279#page-23, https://tools.ietf.org/html/rfc5480#page-5 """ _map = { # https://tools.ietf.org/html/rfc3279#page-23 '1.2.840.10045.3.0.1': 'c2pnb163v1', '1.2.840.10045.3.0.2': 'c2pnb163v2', '1.2.840.10045.3.0.3': 'c2pnb163v3', '1.2.840.10045.3.0.4': 'c2pnb176w1', '1.2.840.10045.3.0.5': 'c2tnb191v1', '1.2.840.10045.3.0.6': 'c2tnb191v2', '1.2.840.10045.3.0.7': 'c2tnb191v3', '1.2.840.10045.3.0.8': 'c2onb191v4', '1.2.840.10045.3.0.9': 'c2onb191v5', '1.2.840.10045.3.0.10': 'c2pnb208w1', '1.2.840.10045.3.0.11': 'c2tnb239v1', '1.2.840.10045.3.0.12': 'c2tnb239v2', '1.2.840.10045.3.0.13': 'c2tnb239v3', '1.2.840.10045.3.0.14': 'c2onb239v4', '1.2.840.10045.3.0.15': 'c2onb239v5', '1.2.840.10045.3.0.16': 'c2pnb272w1', '1.2.840.10045.3.0.17': 'c2pnb304w1', '1.2.840.10045.3.0.18': 'c2tnb359v1', '1.2.840.10045.3.0.19': 'c2pnb368w1', '1.2.840.10045.3.0.20': 'c2tnb431r1', '1.2.840.10045.3.1.2': 'prime192v2', '1.2.840.10045.3.1.3': 'prime192v3', '1.2.840.10045.3.1.4': 'prime239v1', '1.2.840.10045.3.1.5': 'prime239v2', '1.2.840.10045.3.1.6': 'prime239v3', # https://tools.ietf.org/html/rfc5480#page-5 # http://www.secg.org/SEC2-Ver-1.0.pdf '1.2.840.10045.3.1.1': 'secp192r1', '1.2.840.10045.3.1.7': 'secp256r1', '1.3.132.0.1': 'sect163k1', '1.3.132.0.2': 'sect163r1', '1.3.132.0.3': 'sect239k1', '1.3.132.0.4': 'sect113r1', '1.3.132.0.5': 'sect113r2', '1.3.132.0.6': 'secp112r1', '1.3.132.0.7': 'secp112r2', '1.3.132.0.8': 'secp160r1', '1.3.132.0.9': 'secp160k1', '1.3.132.0.10': 'secp256k1', '1.3.132.0.15': 'sect163r2', '1.3.132.0.16': 'sect283k1', '1.3.132.0.17': 'sect283r1', '1.3.132.0.22': 'sect131r1', '1.3.132.0.23': 'sect131r2', '1.3.132.0.24': 'sect193r1', '1.3.132.0.25': 'sect193r2', '1.3.132.0.26': 'sect233k1', '1.3.132.0.27': 'sect233r1', '1.3.132.0.28': 'secp128r1', '1.3.132.0.29': 'secp128r2', '1.3.132.0.30': 'secp160r2', '1.3.132.0.31': 'secp192k1', '1.3.132.0.32': 'secp224k1', '1.3.132.0.33': 'secp224r1', '1.3.132.0.34': 'secp384r1', '1.3.132.0.35': 'secp521r1', '1.3.132.0.36': 'sect409k1', '1.3.132.0.37': 'sect409r1', '1.3.132.0.38': 'sect571k1', '1.3.132.0.39': 'sect571r1', # https://tools.ietf.org/html/rfc5639#section-4.1 '1.3.36.3.3.2.8.1.1.1': 'brainpoolp160r1', '1.3.36.3.3.2.8.1.1.2': 'brainpoolp160t1', '1.3.36.3.3.2.8.1.1.3': 'brainpoolp192r1', '1.3.36.3.3.2.8.1.1.4': 'brainpoolp192t1', '1.3.36.3.3.2.8.1.1.5': 'brainpoolp224r1', '1.3.36.3.3.2.8.1.1.6': 'brainpoolp224t1', '1.3.36.3.3.2.8.1.1.7': 'brainpoolp256r1', '1.3.36.3.3.2.8.1.1.8': 'brainpoolp256t1', '1.3.36.3.3.2.8.1.1.9': 'brainpoolp320r1', '1.3.36.3.3.2.8.1.1.10': 'brainpoolp320t1', '1.3.36.3.3.2.8.1.1.11': 'brainpoolp384r1', '1.3.36.3.3.2.8.1.1.12': 'brainpoolp384t1', '1.3.36.3.3.2.8.1.1.13': 'brainpoolp512r1', '1.3.36.3.3.2.8.1.1.14': 'brainpoolp512t1', } _key_sizes = { # Order values used to compute these sourced from # http://cr.openjdk.java.net/~vinnie/7194075/webrev-3/src/share/classes/sun/security/ec/CurveDB.java.html '1.2.840.10045.3.0.1': 21, '1.2.840.10045.3.0.2': 21, '1.2.840.10045.3.0.3': 21, '1.2.840.10045.3.0.4': 21, '1.2.840.10045.3.0.5': 24, '1.2.840.10045.3.0.6': 24, '1.2.840.10045.3.0.7': 24, '1.2.840.10045.3.0.8': 24, '1.2.840.10045.3.0.9': 24, '1.2.840.10045.3.0.10': 25, '1.2.840.10045.3.0.11': 30, '1.2.840.10045.3.0.12': 30, '1.2.840.10045.3.0.13': 30, '1.2.840.10045.3.0.14': 30, '1.2.840.10045.3.0.15': 30, '1.2.840.10045.3.0.16': 33, '1.2.840.10045.3.0.17': 37, '1.2.840.10045.3.0.18': 45, '1.2.840.10045.3.0.19': 45, '1.2.840.10045.3.0.20': 53, '1.2.840.10045.3.1.2': 24, '1.2.840.10045.3.1.3': 24, '1.2.840.10045.3.1.4': 30, '1.2.840.10045.3.1.5': 30, '1.2.840.10045.3.1.6': 30, # Order values used to compute these sourced from # http://www.secg.org/SEC2-Ver-1.0.pdf # ceil(n.bit_length() / 8) '1.2.840.10045.3.1.1': 24, '1.2.840.10045.3.1.7': 32, '1.3.132.0.1': 21, '1.3.132.0.2': 21, '1.3.132.0.3': 30, '1.3.132.0.4': 15, '1.3.132.0.5': 15, '1.3.132.0.6': 14, '1.3.132.0.7': 14, '1.3.132.0.8': 21, '1.3.132.0.9': 21, '1.3.132.0.10': 32, '1.3.132.0.15': 21, '1.3.132.0.16': 36, '1.3.132.0.17': 36, '1.3.132.0.22': 17, '1.3.132.0.23': 17, '1.3.132.0.24': 25, '1.3.132.0.25': 25, '1.3.132.0.26': 29, '1.3.132.0.27': 30, '1.3.132.0.28': 16, '1.3.132.0.29': 16, '1.3.132.0.30': 21, '1.3.132.0.31': 24, '1.3.132.0.32': 29, '1.3.132.0.33': 28, '1.3.132.0.34': 48, '1.3.132.0.35': 66, '1.3.132.0.36': 51, '1.3.132.0.37': 52, '1.3.132.0.38': 72, '1.3.132.0.39': 72, # Order values used to compute these sourced from # https://tools.ietf.org/html/rfc5639#section-3 # ceil(q.bit_length() / 8) '1.3.36.3.3.2.8.1.1.1': 20, '1.3.36.3.3.2.8.1.1.2': 20, '1.3.36.3.3.2.8.1.1.3': 24, '1.3.36.3.3.2.8.1.1.4': 24, '1.3.36.3.3.2.8.1.1.5': 28, '1.3.36.3.3.2.8.1.1.6': 28, '1.3.36.3.3.2.8.1.1.7': 32, '1.3.36.3.3.2.8.1.1.8': 32, '1.3.36.3.3.2.8.1.1.9': 40, '1.3.36.3.3.2.8.1.1.10': 40, '1.3.36.3.3.2.8.1.1.11': 48, '1.3.36.3.3.2.8.1.1.12': 48, '1.3.36.3.3.2.8.1.1.13': 64, '1.3.36.3.3.2.8.1.1.14': 64, } @classmethod def register(cls, name, oid, key_size): """ Registers a new named elliptic curve that is not included in the default list of named curves :param name: A unicode string of the curve name :param oid: A unicode string of the dotted format OID :param key_size: An integer of the number of bytes the private key should be encoded to """ cls._map[oid] = name if cls._reverse_map is not None: cls._reverse_map[name] = oid cls._key_sizes[oid] = key_size class ECDomainParameters(Choice): """ Source: http://www.secg.org/sec1-v2.pdf page 102 """ _alternatives = [ ('specified', SpecifiedECDomain), ('named', NamedCurve), ('implicit_ca', Null), ] @property def key_size(self): if self.name == 'implicit_ca': raise ValueError(unwrap( ''' Unable to calculate key_size from ECDomainParameters that are implicitly defined by the CA key ''' )) if self.name == 'specified': order = self.chosen['order'].native return math.ceil(math.log(order, 2.0) / 8.0) oid = self.chosen.dotted if oid not in NamedCurve._key_sizes: raise ValueError(unwrap( ''' The asn1crypto.keys.NamedCurve %s does not have a registered key length, please call asn1crypto.keys.NamedCurve.register() ''', repr(oid) )) return NamedCurve._key_sizes[oid] class ECPrivateKeyVersion(Integer): """ Original Name: None Source: http://www.secg.org/sec1-v2.pdf page 108 """ _map = { 1: 'ecPrivkeyVer1', } class ECPrivateKey(Sequence): """ Source: http://www.secg.org/sec1-v2.pdf page 108 """ _fields = [ ('version', ECPrivateKeyVersion), ('private_key', IntegerOctetString), ('parameters', ECDomainParameters, {'explicit': 0, 'optional': True}), ('public_key', ECPointBitString, {'explicit': 1, 'optional': True}), ] # Ensures the key is set to the correct length when encoding _key_size = None # This is necessary to ensure the private_key IntegerOctetString is encoded properly def __setitem__(self, key, value): res = super(ECPrivateKey, self).__setitem__(key, value) if key == 'private_key': if self._key_size is None: # Infer the key_size from the existing private key if possible pkey_contents = self['private_key'].contents if isinstance(pkey_contents, byte_cls) and len(pkey_contents) > 1: self.set_key_size(len(self['private_key'].contents)) elif self._key_size is not None: self._update_key_size() elif key == 'parameters' and isinstance(self['parameters'], ECDomainParameters) and \ self['parameters'].name != 'implicit_ca': self.set_key_size(self['parameters'].key_size) return res def set_key_size(self, key_size): """ Sets the key_size to ensure the private key is encoded to the proper length :param key_size: An integer byte length to encode the private_key to """ self._key_size = key_size self._update_key_size() def _update_key_size(self): """ Ensure the private_key explicit encoding width is set """ if self._key_size is not None and isinstance(self['private_key'], IntegerOctetString): self['private_key'].set_encoded_width(self._key_size) class DSAParams(Sequence): """ Parameters for a DSA public or private key Original Name: Dss-Parms Source: https://tools.ietf.org/html/rfc3279#page-9 """ _fields = [ ('p', Integer), ('q', Integer), ('g', Integer), ] class Attribute(Sequence): """ Source: https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.501-198811-S!!PDF-E&type=items page 8 """ _fields = [ ('type', ObjectIdentifier), ('values', SetOf, {'spec': Any}), ] class Attributes(SetOf): """ Source: https://tools.ietf.org/html/rfc5208#page-3 """ _child_spec = Attribute class PrivateKeyAlgorithmId(ObjectIdentifier): """ These OIDs for various public keys are reused when storing private keys inside of a PKCS#8 structure Original Name: None Source: https://tools.ietf.org/html/rfc3279 """ _map = { # https://tools.ietf.org/html/rfc3279#page-19 '1.2.840.113549.1.1.1': 'rsa', # https://tools.ietf.org/html/rfc4055#page-8 '1.2.840.113549.1.1.10': 'rsassa_pss', # https://tools.ietf.org/html/rfc3279#page-18 '1.2.840.10040.4.1': 'dsa', # https://tools.ietf.org/html/rfc3279#page-13 '1.2.840.10045.2.1': 'ec', # https://tools.ietf.org/html/rfc8410#section-9 '1.3.101.110': 'x25519', '1.3.101.111': 'x448', '1.3.101.112': 'ed25519', '1.3.101.113': 'ed448', } class PrivateKeyAlgorithm(_ForceNullParameters, Sequence): """ Original Name: PrivateKeyAlgorithmIdentifier Source: https://tools.ietf.org/html/rfc5208#page-3 """ _fields = [ ('algorithm', PrivateKeyAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'dsa': DSAParams, 'ec': ECDomainParameters, 'rsassa_pss': RSASSAPSSParams, } class PrivateKeyInfo(Sequence): """ Source: https://tools.ietf.org/html/rfc5208#page-3 """ _fields = [ ('version', Integer), ('private_key_algorithm', PrivateKeyAlgorithm), ('private_key', ParsableOctetString), ('attributes', Attributes, {'implicit': 0, 'optional': True}), ] def _private_key_spec(self): algorithm = self['private_key_algorithm']['algorithm'].native return { 'rsa': RSAPrivateKey, 'rsassa_pss': RSAPrivateKey, 'dsa': Integer, 'ec': ECPrivateKey, # These should be treated as opaque octet strings according # to RFC 8410 'x25519': OctetString, 'x448': OctetString, 'ed25519': OctetString, 'ed448': OctetString, }[algorithm] _spec_callbacks = { 'private_key': _private_key_spec } _algorithm = None _bit_size = None _public_key = None _fingerprint = None @classmethod def wrap(cls, private_key, algorithm): """ Wraps a private key in a PrivateKeyInfo structure :param private_key: A byte string or Asn1Value object of the private key :param algorithm: A unicode string of "rsa", "dsa" or "ec" :return: A PrivateKeyInfo object """ if not isinstance(private_key, byte_cls) and not isinstance(private_key, Asn1Value): raise TypeError(unwrap( ''' private_key must be a byte string or Asn1Value, not %s ''', type_name(private_key) )) if algorithm == 'rsa' or algorithm == 'rsassa_pss': if not isinstance(private_key, RSAPrivateKey): private_key = RSAPrivateKey.load(private_key) params = Null() elif algorithm == 'dsa': if not isinstance(private_key, DSAPrivateKey): private_key = DSAPrivateKey.load(private_key) params = DSAParams() params['p'] = private_key['p'] params['q'] = private_key['q'] params['g'] = private_key['g'] public_key = private_key['public_key'] private_key = private_key['private_key'] elif algorithm == 'ec': if not isinstance(private_key, ECPrivateKey): private_key = ECPrivateKey.load(private_key) else: private_key = private_key.copy() params = private_key['parameters'] del private_key['parameters'] else: raise ValueError(unwrap( ''' algorithm must be one of "rsa", "dsa", "ec", not %s ''', repr(algorithm) )) private_key_algo = PrivateKeyAlgorithm() private_key_algo['algorithm'] = PrivateKeyAlgorithmId(algorithm) private_key_algo['parameters'] = params container = cls() container._algorithm = algorithm container['version'] = Integer(0) container['private_key_algorithm'] = private_key_algo container['private_key'] = private_key # Here we save the DSA public key if possible since it is not contained # within the PKCS#8 structure for a DSA key if algorithm == 'dsa': container._public_key = public_key return container # This is necessary to ensure any contained ECPrivateKey is the # correct size def __setitem__(self, key, value): res = super(PrivateKeyInfo, self).__setitem__(key, value) algorithm = self['private_key_algorithm'] # When possible, use the parameter info to make sure the private key encoding # retains any necessary leading bytes, instead of them being dropped if (key == 'private_key_algorithm' or key == 'private_key') and \ algorithm['algorithm'].native == 'ec' and \ isinstance(algorithm['parameters'], ECDomainParameters) and \ algorithm['parameters'].name != 'implicit_ca' and \ isinstance(self['private_key'], ParsableOctetString) and \ isinstance(self['private_key'].parsed, ECPrivateKey): self['private_key'].parsed.set_key_size(algorithm['parameters'].key_size) return res def unwrap(self): """ Unwraps the private key into an RSAPrivateKey, DSAPrivateKey or ECPrivateKey object :return: An RSAPrivateKey, DSAPrivateKey or ECPrivateKey object """ raise APIException( 'asn1crypto.keys.PrivateKeyInfo().unwrap() has been removed, ' 'please use oscrypto.asymmetric.PrivateKey().unwrap() instead') @property def curve(self): """ Returns information about the curve used for an EC key :raises: ValueError - when the key is not an EC key :return: A two-element tuple, with the first element being a unicode string of "implicit_ca", "specified" or "named". If the first element is "implicit_ca", the second is None. If "specified", the second is an OrderedDict that is the native version of SpecifiedECDomain. If "named", the second is a unicode string of the curve name. """ if self.algorithm != 'ec': raise ValueError(unwrap( ''' Only EC keys have a curve, this key is %s ''', self.algorithm.upper() )) params = self['private_key_algorithm']['parameters'] chosen = params.chosen if params.name == 'implicit_ca': value = None else: value = chosen.native return (params.name, value) @property def hash_algo(self): """ Returns the name of the family of hash algorithms used to generate a DSA key :raises: ValueError - when the key is not a DSA key :return: A unicode string of "sha1" or "sha2" """ if self.algorithm != 'dsa': raise ValueError(unwrap( ''' Only DSA keys are generated using a hash algorithm, this key is %s ''', self.algorithm.upper() )) byte_len = math.log(self['private_key_algorithm']['parameters']['q'].native, 2) / 8 return 'sha1' if byte_len <= 20 else 'sha2' @property def algorithm(self): """ :return: A unicode string of "rsa", "rsassa_pss", "dsa" or "ec" """ if self._algorithm is None: self._algorithm = self['private_key_algorithm']['algorithm'].native return self._algorithm @property def bit_size(self): """ :return: The bit size of the private key, as an integer """ if self._bit_size is None: if self.algorithm == 'rsa' or self.algorithm == 'rsassa_pss': prime = self['private_key'].parsed['modulus'].native elif self.algorithm == 'dsa': prime = self['private_key_algorithm']['parameters']['p'].native elif self.algorithm == 'ec': prime = self['private_key'].parsed['private_key'].native self._bit_size = int(math.ceil(math.log(prime, 2))) modulus = self._bit_size % 8 if modulus != 0: self._bit_size += 8 - modulus return self._bit_size @property def byte_size(self): """ :return: The byte size of the private key, as an integer """ return int(math.ceil(self.bit_size / 8)) @property def public_key(self): """ :return: If an RSA key, an RSAPublicKey object. If a DSA key, an Integer object. If an EC key, an ECPointBitString object. """ raise APIException( 'asn1crypto.keys.PrivateKeyInfo().public_key has been removed, ' 'please use oscrypto.asymmetric.PrivateKey().public_key.unwrap() instead') @property def public_key_info(self): """ :return: A PublicKeyInfo object derived from this private key. """ raise APIException( 'asn1crypto.keys.PrivateKeyInfo().public_key_info has been removed, ' 'please use oscrypto.asymmetric.PrivateKey().public_key.asn1 instead') @property def fingerprint(self): """ Creates a fingerprint that can be compared with a public key to see if the two form a pair. This fingerprint is not compatible with fingerprints generated by any other software. :return: A byte string that is a sha256 hash of selected components (based on the key type) """ raise APIException( 'asn1crypto.keys.PrivateKeyInfo().fingerprint has been removed, ' 'please use oscrypto.asymmetric.PrivateKey().fingerprint instead') class EncryptedPrivateKeyInfo(Sequence): """ Source: https://tools.ietf.org/html/rfc5208#page-4 """ _fields = [ ('encryption_algorithm', EncryptionAlgorithm), ('encrypted_data', OctetString), ] # These structures are from https://tools.ietf.org/html/rfc3279 class ValidationParms(Sequence): """ Source: https://tools.ietf.org/html/rfc3279#page-10 """ _fields = [ ('seed', BitString), ('pgen_counter', Integer), ] class DomainParameters(Sequence): """ Source: https://tools.ietf.org/html/rfc3279#page-10 """ _fields = [ ('p', Integer), ('g', Integer), ('q', Integer), ('j', Integer, {'optional': True}), ('validation_params', ValidationParms, {'optional': True}), ] class PublicKeyAlgorithmId(ObjectIdentifier): """ Original Name: None Source: https://tools.ietf.org/html/rfc3279 """ _map = { # https://tools.ietf.org/html/rfc3279#page-19 '1.2.840.113549.1.1.1': 'rsa', # https://tools.ietf.org/html/rfc3447#page-47 '1.2.840.113549.1.1.7': 'rsaes_oaep', # https://tools.ietf.org/html/rfc4055#page-8 '1.2.840.113549.1.1.10': 'rsassa_pss', # https://tools.ietf.org/html/rfc3279#page-18 '1.2.840.10040.4.1': 'dsa', # https://tools.ietf.org/html/rfc3279#page-13 '1.2.840.10045.2.1': 'ec', # https://tools.ietf.org/html/rfc3279#page-10 '1.2.840.10046.2.1': 'dh', # https://tools.ietf.org/html/rfc8410#section-9 '1.3.101.110': 'x25519', '1.3.101.111': 'x448', '1.3.101.112': 'ed25519', '1.3.101.113': 'ed448', } class PublicKeyAlgorithm(_ForceNullParameters, Sequence): """ Original Name: AlgorithmIdentifier Source: https://tools.ietf.org/html/rfc5280#page-18 """ _fields = [ ('algorithm', PublicKeyAlgorithmId), ('parameters', Any, {'optional': True}), ] _oid_pair = ('algorithm', 'parameters') _oid_specs = { 'dsa': DSAParams, 'ec': ECDomainParameters, 'dh': DomainParameters, 'rsaes_oaep': RSAESOAEPParams, 'rsassa_pss': RSASSAPSSParams, } class PublicKeyInfo(Sequence): """ Original Name: SubjectPublicKeyInfo Source: https://tools.ietf.org/html/rfc5280#page-17 """ _fields = [ ('algorithm', PublicKeyAlgorithm), ('public_key', ParsableOctetBitString), ] def _public_key_spec(self): algorithm = self['algorithm']['algorithm'].native return { 'rsa': RSAPublicKey, 'rsaes_oaep': RSAPublicKey, 'rsassa_pss': RSAPublicKey, 'dsa': Integer, # We override the field spec with ECPoint so that users can easily # decompose the byte string into the constituent X and Y coords 'ec': (ECPointBitString, None), 'dh': Integer, # These should be treated as opaque bit strings according # to RFC 8410, and need not even be valid ASN.1 'x25519': (OctetBitString, None), 'x448': (OctetBitString, None), 'ed25519': (OctetBitString, None), 'ed448': (OctetBitString, None), }[algorithm] _spec_callbacks = { 'public_key': _public_key_spec } _algorithm = None _bit_size = None _fingerprint = None _sha1 = None _sha256 = None @classmethod def wrap(cls, public_key, algorithm): """ Wraps a public key in a PublicKeyInfo structure :param public_key: A byte string or Asn1Value object of the public key :param algorithm: A unicode string of "rsa" :return: A PublicKeyInfo object """ if not isinstance(public_key, byte_cls) and not isinstance(public_key, Asn1Value): raise TypeError(unwrap( ''' public_key must be a byte string or Asn1Value, not %s ''', type_name(public_key) )) if algorithm != 'rsa' and algorithm != 'rsassa_pss': raise ValueError(unwrap( ''' algorithm must "rsa", not %s ''', repr(algorithm) )) algo = PublicKeyAlgorithm() algo['algorithm'] = PublicKeyAlgorithmId(algorithm) algo['parameters'] = Null() container = cls() container['algorithm'] = algo if isinstance(public_key, Asn1Value): public_key = public_key.untag().dump() container['public_key'] = ParsableOctetBitString(public_key) return container def unwrap(self): """ Unwraps an RSA public key into an RSAPublicKey object. Does not support DSA or EC public keys since they do not have an unwrapped form. :return: An RSAPublicKey object """ raise APIException( 'asn1crypto.keys.PublicKeyInfo().unwrap() has been removed, ' 'please use oscrypto.asymmetric.PublicKey().unwrap() instead') @property def curve(self): """ Returns information about the curve used for an EC key :raises: ValueError - when the key is not an EC key :return: A two-element tuple, with the first element being a unicode string of "implicit_ca", "specified" or "named". If the first element is "implicit_ca", the second is None. If "specified", the second is an OrderedDict that is the native version of SpecifiedECDomain. If "named", the second is a unicode string of the curve name. """ if self.algorithm != 'ec': raise ValueError(unwrap( ''' Only EC keys have a curve, this key is %s ''', self.algorithm.upper() )) params = self['algorithm']['parameters'] chosen = params.chosen if params.name == 'implicit_ca': value = None else: value = chosen.native return (params.name, value) @property def hash_algo(self): """ Returns the name of the family of hash algorithms used to generate a DSA key :raises: ValueError - when the key is not a DSA key :return: A unicode string of "sha1" or "sha2" or None if no parameters are present """ if self.algorithm != 'dsa': raise ValueError(unwrap( ''' Only DSA keys are generated using a hash algorithm, this key is %s ''', self.algorithm.upper() )) parameters = self['algorithm']['parameters'] if parameters.native is None: return None byte_len = math.log(parameters['q'].native, 2) / 8 return 'sha1' if byte_len <= 20 else 'sha2' @property def algorithm(self): """ :return: A unicode string of "rsa", "rsassa_pss", "dsa" or "ec" """ if self._algorithm is None: self._algorithm = self['algorithm']['algorithm'].native return self._algorithm @property def bit_size(self): """ :return: The bit size of the public key, as an integer """ if self._bit_size is None: if self.algorithm == 'ec': self._bit_size = int(((len(self['public_key'].native) - 1) / 2) * 8) else: if self.algorithm == 'rsa' or self.algorithm == 'rsassa_pss': prime = self['public_key'].parsed['modulus'].native elif self.algorithm == 'dsa': prime = self['algorithm']['parameters']['p'].native self._bit_size = int(math.ceil(math.log(prime, 2))) modulus = self._bit_size % 8 if modulus != 0: self._bit_size += 8 - modulus return self._bit_size @property def byte_size(self): """ :return: The byte size of the public key, as an integer """ return int(math.ceil(self.bit_size / 8)) @property def sha1(self): """ :return: The SHA1 hash of the DER-encoded bytes of this public key info """ if self._sha1 is None: self._sha1 = hashlib.sha1(byte_cls(self['public_key'])).digest() return self._sha1 @property def sha256(self): """ :return: The SHA-256 hash of the DER-encoded bytes of this public key info """ if self._sha256 is None: self._sha256 = hashlib.sha256(byte_cls(self['public_key'])).digest() return self._sha256 @property def fingerprint(self): """ Creates a fingerprint that can be compared with a private key to see if the two form a pair. This fingerprint is not compatible with fingerprints generated by any other software. :return: A byte string that is a sha256 hash of selected components (based on the key type) """ raise APIException( 'asn1crypto.keys.PublicKeyInfo().fingerprint has been removed, ' 'please use oscrypto.asymmetric.PublicKey().fingerprint instead') ocsp.py000064400000045120152572326550006100 0ustar00# coding: utf-8 """ ASN.1 type classes for the online certificate status protocol (OCSP). Exports the following items: - OCSPRequest() - OCSPResponse() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function from ._errors import unwrap from .algos import DigestAlgorithm, SignedDigestAlgorithm from .core import ( Boolean, Choice, Enumerated, GeneralizedTime, IA5String, Integer, Null, ObjectIdentifier, OctetBitString, OctetString, ParsableOctetString, Sequence, SequenceOf, ) from .crl import AuthorityInfoAccessSyntax, CRLReason from .keys import PublicKeyAlgorithm from .x509 import Certificate, GeneralName, GeneralNames, Name # The structures in this file are taken from https://tools.ietf.org/html/rfc6960 class Version(Integer): _map = { 0: 'v1' } class CertId(Sequence): _fields = [ ('hash_algorithm', DigestAlgorithm), ('issuer_name_hash', OctetString), ('issuer_key_hash', OctetString), ('serial_number', Integer), ] class ServiceLocator(Sequence): _fields = [ ('issuer', Name), ('locator', AuthorityInfoAccessSyntax), ] class RequestExtensionId(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.48.1.7': 'service_locator', } class RequestExtension(Sequence): _fields = [ ('extn_id', RequestExtensionId), ('critical', Boolean, {'default': False}), ('extn_value', ParsableOctetString), ] _oid_pair = ('extn_id', 'extn_value') _oid_specs = { 'service_locator': ServiceLocator, } class RequestExtensions(SequenceOf): _child_spec = RequestExtension class Request(Sequence): _fields = [ ('req_cert', CertId), ('single_request_extensions', RequestExtensions, {'explicit': 0, 'optional': True}), ] _processed_extensions = False _critical_extensions = None _service_locator_value = None def _set_extensions(self): """ Sets common named extensions to private attributes and creates a list of critical extensions """ self._critical_extensions = set() for extension in self['single_request_extensions']: name = extension['extn_id'].native attribute_name = '_%s_value' % name if hasattr(self, attribute_name): setattr(self, attribute_name, extension['extn_value'].parsed) if extension['critical'].native: self._critical_extensions.add(name) self._processed_extensions = True @property def critical_extensions(self): """ Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings """ if not self._processed_extensions: self._set_extensions() return self._critical_extensions @property def service_locator_value(self): """ This extension is used when communicating with an OCSP responder that acts as a proxy for OCSP requests :return: None or a ServiceLocator object """ if self._processed_extensions is False: self._set_extensions() return self._service_locator_value class Requests(SequenceOf): _child_spec = Request class ResponseType(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.48.1.1': 'basic_ocsp_response', } class AcceptableResponses(SequenceOf): _child_spec = ResponseType class PreferredSignatureAlgorithm(Sequence): _fields = [ ('sig_identifier', SignedDigestAlgorithm), ('cert_identifier', PublicKeyAlgorithm, {'optional': True}), ] class PreferredSignatureAlgorithms(SequenceOf): _child_spec = PreferredSignatureAlgorithm class TBSRequestExtensionId(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.48.1.2': 'nonce', '1.3.6.1.5.5.7.48.1.4': 'acceptable_responses', '1.3.6.1.5.5.7.48.1.8': 'preferred_signature_algorithms', } class TBSRequestExtension(Sequence): _fields = [ ('extn_id', TBSRequestExtensionId), ('critical', Boolean, {'default': False}), ('extn_value', ParsableOctetString), ] _oid_pair = ('extn_id', 'extn_value') _oid_specs = { 'nonce': OctetString, 'acceptable_responses': AcceptableResponses, 'preferred_signature_algorithms': PreferredSignatureAlgorithms, } class TBSRequestExtensions(SequenceOf): _child_spec = TBSRequestExtension class TBSRequest(Sequence): _fields = [ ('version', Version, {'explicit': 0, 'default': 'v1'}), ('requestor_name', GeneralName, {'explicit': 1, 'optional': True}), ('request_list', Requests), ('request_extensions', TBSRequestExtensions, {'explicit': 2, 'optional': True}), ] class Certificates(SequenceOf): _child_spec = Certificate class Signature(Sequence): _fields = [ ('signature_algorithm', SignedDigestAlgorithm), ('signature', OctetBitString), ('certs', Certificates, {'explicit': 0, 'optional': True}), ] class OCSPRequest(Sequence): _fields = [ ('tbs_request', TBSRequest), ('optional_signature', Signature, {'explicit': 0, 'optional': True}), ] _processed_extensions = False _critical_extensions = None _nonce_value = None _acceptable_responses_value = None _preferred_signature_algorithms_value = None def _set_extensions(self): """ Sets common named extensions to private attributes and creates a list of critical extensions """ self._critical_extensions = set() for extension in self['tbs_request']['request_extensions']: name = extension['extn_id'].native attribute_name = '_%s_value' % name if hasattr(self, attribute_name): setattr(self, attribute_name, extension['extn_value'].parsed) if extension['critical'].native: self._critical_extensions.add(name) self._processed_extensions = True @property def critical_extensions(self): """ Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings """ if not self._processed_extensions: self._set_extensions() return self._critical_extensions @property def nonce_value(self): """ This extension is used to prevent replay attacks by including a unique, random value with each request/response pair :return: None or an OctetString object """ if self._processed_extensions is False: self._set_extensions() return self._nonce_value @property def acceptable_responses_value(self): """ This extension is used to allow the client and server to communicate with alternative response formats other than just basic_ocsp_response, although no other formats are defined in the standard. :return: None or an AcceptableResponses object """ if self._processed_extensions is False: self._set_extensions() return self._acceptable_responses_value @property def preferred_signature_algorithms_value(self): """ This extension is used by the client to define what signature algorithms are preferred, including both the hash algorithm and the public key algorithm, with a level of detail down to even the public key algorithm parameters, such as curve name. :return: None or a PreferredSignatureAlgorithms object """ if self._processed_extensions is False: self._set_extensions() return self._preferred_signature_algorithms_value class OCSPResponseStatus(Enumerated): _map = { 0: 'successful', 1: 'malformed_request', 2: 'internal_error', 3: 'try_later', 5: 'sign_required', 6: 'unauthorized', } class ResponderId(Choice): _alternatives = [ ('by_name', Name, {'explicit': 1}), ('by_key', OctetString, {'explicit': 2}), ] # Custom class to return a meaningful .native attribute from CertStatus() class StatusGood(Null): def set(self, value): """ Sets the value of the object :param value: None or 'good' """ if value is not None and value != 'good' and not isinstance(value, Null): raise ValueError(unwrap( ''' value must be one of None, "good", not %s ''', repr(value) )) self.contents = b'' @property def native(self): return 'good' # Custom class to return a meaningful .native attribute from CertStatus() class StatusUnknown(Null): def set(self, value): """ Sets the value of the object :param value: None or 'unknown' """ if value is not None and value != 'unknown' and not isinstance(value, Null): raise ValueError(unwrap( ''' value must be one of None, "unknown", not %s ''', repr(value) )) self.contents = b'' @property def native(self): return 'unknown' class RevokedInfo(Sequence): _fields = [ ('revocation_time', GeneralizedTime), ('revocation_reason', CRLReason, {'explicit': 0, 'optional': True}), ] class CertStatus(Choice): _alternatives = [ ('good', StatusGood, {'implicit': 0}), ('revoked', RevokedInfo, {'implicit': 1}), ('unknown', StatusUnknown, {'implicit': 2}), ] class CrlId(Sequence): _fields = [ ('crl_url', IA5String, {'explicit': 0, 'optional': True}), ('crl_num', Integer, {'explicit': 1, 'optional': True}), ('crl_time', GeneralizedTime, {'explicit': 2, 'optional': True}), ] class SingleResponseExtensionId(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.48.1.3': 'crl', '1.3.6.1.5.5.7.48.1.6': 'archive_cutoff', # These are CRLEntryExtension values from # https://tools.ietf.org/html/rfc5280 '2.5.29.21': 'crl_reason', '2.5.29.24': 'invalidity_date', '2.5.29.29': 'certificate_issuer', # https://tools.ietf.org/html/rfc6962.html#page-13 '1.3.6.1.4.1.11129.2.4.5': 'signed_certificate_timestamp_list', } class SingleResponseExtension(Sequence): _fields = [ ('extn_id', SingleResponseExtensionId), ('critical', Boolean, {'default': False}), ('extn_value', ParsableOctetString), ] _oid_pair = ('extn_id', 'extn_value') _oid_specs = { 'crl': CrlId, 'archive_cutoff': GeneralizedTime, 'crl_reason': CRLReason, 'invalidity_date': GeneralizedTime, 'certificate_issuer': GeneralNames, 'signed_certificate_timestamp_list': OctetString, } class SingleResponseExtensions(SequenceOf): _child_spec = SingleResponseExtension class SingleResponse(Sequence): _fields = [ ('cert_id', CertId), ('cert_status', CertStatus), ('this_update', GeneralizedTime), ('next_update', GeneralizedTime, {'explicit': 0, 'optional': True}), ('single_extensions', SingleResponseExtensions, {'explicit': 1, 'optional': True}), ] _processed_extensions = False _critical_extensions = None _crl_value = None _archive_cutoff_value = None _crl_reason_value = None _invalidity_date_value = None _certificate_issuer_value = None def _set_extensions(self): """ Sets common named extensions to private attributes and creates a list of critical extensions """ self._critical_extensions = set() for extension in self['single_extensions']: name = extension['extn_id'].native attribute_name = '_%s_value' % name if hasattr(self, attribute_name): setattr(self, attribute_name, extension['extn_value'].parsed) if extension['critical'].native: self._critical_extensions.add(name) self._processed_extensions = True @property def critical_extensions(self): """ Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings """ if not self._processed_extensions: self._set_extensions() return self._critical_extensions @property def crl_value(self): """ This extension is used to locate the CRL that a certificate's revocation is contained within. :return: None or a CrlId object """ if self._processed_extensions is False: self._set_extensions() return self._crl_value @property def archive_cutoff_value(self): """ This extension is used to indicate the date at which an archived (historical) certificate status entry will no longer be available. :return: None or a GeneralizedTime object """ if self._processed_extensions is False: self._set_extensions() return self._archive_cutoff_value @property def crl_reason_value(self): """ This extension indicates the reason that a certificate was revoked. :return: None or a CRLReason object """ if self._processed_extensions is False: self._set_extensions() return self._crl_reason_value @property def invalidity_date_value(self): """ This extension indicates the suspected date/time the private key was compromised or the certificate became invalid. This would usually be before the revocation date, which is when the CA processed the revocation. :return: None or a GeneralizedTime object """ if self._processed_extensions is False: self._set_extensions() return self._invalidity_date_value @property def certificate_issuer_value(self): """ This extension indicates the issuer of the certificate in question. :return: None or an x509.GeneralNames object """ if self._processed_extensions is False: self._set_extensions() return self._certificate_issuer_value class Responses(SequenceOf): _child_spec = SingleResponse class ResponseDataExtensionId(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.48.1.2': 'nonce', '1.3.6.1.5.5.7.48.1.9': 'extended_revoke', } class ResponseDataExtension(Sequence): _fields = [ ('extn_id', ResponseDataExtensionId), ('critical', Boolean, {'default': False}), ('extn_value', ParsableOctetString), ] _oid_pair = ('extn_id', 'extn_value') _oid_specs = { 'nonce': OctetString, 'extended_revoke': Null, } class ResponseDataExtensions(SequenceOf): _child_spec = ResponseDataExtension class ResponseData(Sequence): _fields = [ ('version', Version, {'explicit': 0, 'default': 'v1'}), ('responder_id', ResponderId), ('produced_at', GeneralizedTime), ('responses', Responses), ('response_extensions', ResponseDataExtensions, {'explicit': 1, 'optional': True}), ] class BasicOCSPResponse(Sequence): _fields = [ ('tbs_response_data', ResponseData), ('signature_algorithm', SignedDigestAlgorithm), ('signature', OctetBitString), ('certs', Certificates, {'explicit': 0, 'optional': True}), ] class ResponseBytes(Sequence): _fields = [ ('response_type', ResponseType), ('response', ParsableOctetString), ] _oid_pair = ('response_type', 'response') _oid_specs = { 'basic_ocsp_response': BasicOCSPResponse, } class OCSPResponse(Sequence): _fields = [ ('response_status', OCSPResponseStatus), ('response_bytes', ResponseBytes, {'explicit': 0, 'optional': True}), ] _processed_extensions = False _critical_extensions = None _nonce_value = None _extended_revoke_value = None def _set_extensions(self): """ Sets common named extensions to private attributes and creates a list of critical extensions """ self._critical_extensions = set() for extension in self['response_bytes']['response'].parsed['tbs_response_data']['response_extensions']: name = extension['extn_id'].native attribute_name = '_%s_value' % name if hasattr(self, attribute_name): setattr(self, attribute_name, extension['extn_value'].parsed) if extension['critical'].native: self._critical_extensions.add(name) self._processed_extensions = True @property def critical_extensions(self): """ Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings """ if not self._processed_extensions: self._set_extensions() return self._critical_extensions @property def nonce_value(self): """ This extension is used to prevent replay attacks on the request/response exchange :return: None or an OctetString object """ if self._processed_extensions is False: self._set_extensions() return self._nonce_value @property def extended_revoke_value(self): """ This extension is used to signal that the responder will return a "revoked" status for non-issued certificates. :return: None or a Null object (if present) """ if self._processed_extensions is False: self._set_extensions() return self._extended_revoke_value @property def basic_ocsp_response(self): """ A shortcut into the BasicOCSPResponse sequence :return: None or an asn1crypto.ocsp.BasicOCSPResponse object """ return self['response_bytes']['response'].parsed @property def response_data(self): """ A shortcut into the parsed, ResponseData sequence :return: None or an asn1crypto.ocsp.ResponseData object """ return self['response_bytes']['response'].parsed['tbs_response_data'] parser.py000064400000021723152572326550006433 0ustar00# coding: utf-8 """ Functions for parsing and dumping using the ASN.1 DER encoding. Exports the following items: - emit() - parse() - peek() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function import sys from ._types import byte_cls, chr_cls, type_name from .util import int_from_bytes, int_to_bytes _PY2 = sys.version_info <= (3,) _INSUFFICIENT_DATA_MESSAGE = 'Insufficient data - %s bytes requested but only %s available' _MAX_DEPTH = 10 def emit(class_, method, tag, contents): """ Constructs a byte string of an ASN.1 DER-encoded value This is typically not useful. Instead, use one of the standard classes from asn1crypto.core, or construct a new class with specific fields, and call the .dump() method. :param class_: An integer ASN.1 class value: 0 (universal), 1 (application), 2 (context), 3 (private) :param method: An integer ASN.1 method value: 0 (primitive), 1 (constructed) :param tag: An integer ASN.1 tag value :param contents: A byte string of the encoded byte contents :return: A byte string of the ASN.1 DER value (header and contents) """ if not isinstance(class_, int): raise TypeError('class_ must be an integer, not %s' % type_name(class_)) if class_ < 0 or class_ > 3: raise ValueError('class_ must be one of 0, 1, 2 or 3, not %s' % class_) if not isinstance(method, int): raise TypeError('method must be an integer, not %s' % type_name(method)) if method < 0 or method > 1: raise ValueError('method must be 0 or 1, not %s' % method) if not isinstance(tag, int): raise TypeError('tag must be an integer, not %s' % type_name(tag)) if tag < 0: raise ValueError('tag must be greater than zero, not %s' % tag) if not isinstance(contents, byte_cls): raise TypeError('contents must be a byte string, not %s' % type_name(contents)) return _dump_header(class_, method, tag, contents) + contents def parse(contents, strict=False): """ Parses a byte string of ASN.1 BER/DER-encoded data. This is typically not useful. Instead, use one of the standard classes from asn1crypto.core, or construct a new class with specific fields, and call the .load() class method. :param contents: A byte string of BER/DER-encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :raises: ValueError - when the contents do not contain an ASN.1 header or are truncated in some way TypeError - when contents is not a byte string :return: A 6-element tuple: - 0: integer class (0 to 3) - 1: integer method - 2: integer tag - 3: byte string header - 4: byte string content - 5: byte string trailer """ if not isinstance(contents, byte_cls): raise TypeError('contents must be a byte string, not %s' % type_name(contents)) contents_len = len(contents) info, consumed = _parse(contents, contents_len) if strict and consumed != contents_len: raise ValueError('Extra data - %d bytes of trailing data were provided' % (contents_len - consumed)) return info def peek(contents): """ Parses a byte string of ASN.1 BER/DER-encoded data to find the length This is typically used to look into an encoded value to see how long the next chunk of ASN.1-encoded data is. Primarily it is useful when a value is a concatenation of multiple values. :param contents: A byte string of BER/DER-encoded data :raises: ValueError - when the contents do not contain an ASN.1 header or are truncated in some way TypeError - when contents is not a byte string :return: An integer with the number of bytes occupied by the ASN.1 value """ if not isinstance(contents, byte_cls): raise TypeError('contents must be a byte string, not %s' % type_name(contents)) info, consumed = _parse(contents, len(contents)) return consumed def _parse(encoded_data, data_len, pointer=0, lengths_only=False, depth=0): """ Parses a byte string into component parts :param encoded_data: A byte string that contains BER-encoded data :param data_len: The integer length of the encoded data :param pointer: The index in the byte string to parse from :param lengths_only: A boolean to cause the call to return a 2-element tuple of the integer number of bytes in the header and the integer number of bytes in the contents. Internal use only. :param depth: The recursion depth when evaluating indefinite-length encoding. :return: A 2-element tuple: - 0: A tuple of (class_, method, tag, header, content, trailer) - 1: An integer indicating how many bytes were consumed """ if depth > _MAX_DEPTH: raise ValueError('Indefinite-length recursion limit exceeded') start = pointer if data_len < pointer + 1: raise ValueError(_INSUFFICIENT_DATA_MESSAGE % (1, data_len - pointer)) first_octet = ord(encoded_data[pointer]) if _PY2 else encoded_data[pointer] pointer += 1 tag = first_octet & 31 constructed = (first_octet >> 5) & 1 # Base 128 length using 8th bit as continuation indicator if tag == 31: tag = 0 while True: if data_len < pointer + 1: raise ValueError(_INSUFFICIENT_DATA_MESSAGE % (1, data_len - pointer)) num = ord(encoded_data[pointer]) if _PY2 else encoded_data[pointer] pointer += 1 if num == 0x80 and tag == 0: raise ValueError('Non-minimal tag encoding') tag *= 128 tag += num & 127 if num >> 7 == 0: break if tag < 31: raise ValueError('Non-minimal tag encoding') if data_len < pointer + 1: raise ValueError(_INSUFFICIENT_DATA_MESSAGE % (1, data_len - pointer)) length_octet = ord(encoded_data[pointer]) if _PY2 else encoded_data[pointer] pointer += 1 trailer = b'' if length_octet >> 7 == 0: contents_end = pointer + (length_octet & 127) else: length_octets = length_octet & 127 if length_octets: if data_len < pointer + length_octets: raise ValueError(_INSUFFICIENT_DATA_MESSAGE % (length_octets, data_len - pointer)) pointer += length_octets contents_end = pointer + int_from_bytes(encoded_data[pointer - length_octets:pointer], signed=False) else: # To properly parse indefinite length values, we need to scan forward # parsing headers until we find a value with a length of zero. If we # just scanned looking for \x00\x00, nested indefinite length values # would not work. if not constructed: raise ValueError('Indefinite-length element must be constructed') contents_end = pointer while data_len < contents_end + 2 or encoded_data[contents_end:contents_end+2] != b'\x00\x00': _, contents_end = _parse(encoded_data, data_len, contents_end, lengths_only=True, depth=depth+1) contents_end += 2 trailer = b'\x00\x00' if contents_end > data_len: raise ValueError(_INSUFFICIENT_DATA_MESSAGE % (contents_end - pointer, data_len - pointer)) if lengths_only: return (pointer, contents_end) return ( ( first_octet >> 6, constructed, tag, encoded_data[start:pointer], encoded_data[pointer:contents_end-len(trailer)], trailer ), contents_end ) def _dump_header(class_, method, tag, contents): """ Constructs the header bytes for an ASN.1 object :param class_: An integer ASN.1 class value: 0 (universal), 1 (application), 2 (context), 3 (private) :param method: An integer ASN.1 method value: 0 (primitive), 1 (constructed) :param tag: An integer ASN.1 tag value :param contents: A byte string of the encoded byte contents :return: A byte string of the ASN.1 DER header """ header = b'' id_num = 0 id_num |= class_ << 6 id_num |= method << 5 if tag >= 31: cont_bit = 0 while tag > 0: header = chr_cls(cont_bit | (tag & 0x7f)) + header if not cont_bit: cont_bit = 0x80 tag = tag >> 7 header = chr_cls(id_num | 31) + header else: header += chr_cls(id_num | tag) length = len(contents) if length <= 127: header += chr_cls(length) else: length_bytes = int_to_bytes(length) header += chr_cls(0x80 | len(length_bytes)) header += length_bytes return header pdf.py000064400000004312152572326550005703 0ustar00# coding: utf-8 """ ASN.1 type classes for PDF signature structures. Adds extra oid mapping and value parsing to asn1crypto.x509.Extension() and asn1crypto.xms.CMSAttribute(). """ from __future__ import unicode_literals, division, absolute_import, print_function from .cms import CMSAttributeType, CMSAttribute from .core import ( Boolean, Integer, Null, ObjectIdentifier, OctetString, Sequence, SequenceOf, SetOf, ) from .crl import CertificateList from .ocsp import OCSPResponse from .x509 import ( Extension, ExtensionId, GeneralName, KeyPurposeId, ) class AdobeArchiveRevInfo(Sequence): _fields = [ ('version', Integer) ] class AdobeTimestamp(Sequence): _fields = [ ('version', Integer), ('location', GeneralName), ('requires_auth', Boolean, {'optional': True, 'default': False}), ] class OtherRevInfo(Sequence): _fields = [ ('type', ObjectIdentifier), ('value', OctetString), ] class SequenceOfCertificateList(SequenceOf): _child_spec = CertificateList class SequenceOfOCSPResponse(SequenceOf): _child_spec = OCSPResponse class SequenceOfOtherRevInfo(SequenceOf): _child_spec = OtherRevInfo class RevocationInfoArchival(Sequence): _fields = [ ('crl', SequenceOfCertificateList, {'explicit': 0, 'optional': True}), ('ocsp', SequenceOfOCSPResponse, {'explicit': 1, 'optional': True}), ('other_rev_info', SequenceOfOtherRevInfo, {'explicit': 2, 'optional': True}), ] class SetOfRevocationInfoArchival(SetOf): _child_spec = RevocationInfoArchival ExtensionId._map['1.2.840.113583.1.1.9.2'] = 'adobe_archive_rev_info' ExtensionId._map['1.2.840.113583.1.1.9.1'] = 'adobe_timestamp' ExtensionId._map['1.2.840.113583.1.1.10'] = 'adobe_ppklite_credential' Extension._oid_specs['adobe_archive_rev_info'] = AdobeArchiveRevInfo Extension._oid_specs['adobe_timestamp'] = AdobeTimestamp Extension._oid_specs['adobe_ppklite_credential'] = Null KeyPurposeId._map['1.2.840.113583.1.1.5'] = 'pdf_signing' CMSAttributeType._map['1.2.840.113583.1.1.8'] = 'adobe_revocation_info_archival' CMSAttribute._oid_specs['adobe_revocation_info_archival'] = SetOfRevocationInfoArchival pem.py000064400000014001152572326550005707 0ustar00# coding: utf-8 """ Encoding DER to PEM and decoding PEM to DER. Exports the following items: - armor() - detect() - unarmor() """ from __future__ import unicode_literals, division, absolute_import, print_function import base64 import re import sys from ._errors import unwrap from ._types import type_name as _type_name, str_cls, byte_cls if sys.version_info < (3,): from cStringIO import StringIO as BytesIO else: from io import BytesIO def detect(byte_string): """ Detect if a byte string seems to contain a PEM-encoded block :param byte_string: A byte string to look through :return: A boolean, indicating if a PEM-encoded block is contained in the byte string """ if not isinstance(byte_string, byte_cls): raise TypeError(unwrap( ''' byte_string must be a byte string, not %s ''', _type_name(byte_string) )) return byte_string.find(b'-----BEGIN') != -1 or byte_string.find(b'---- BEGIN') != -1 def armor(type_name, der_bytes, headers=None): """ Armors a DER-encoded byte string in PEM :param type_name: A unicode string that will be capitalized and placed in the header and footer of the block. E.g. "CERTIFICATE", "PRIVATE KEY", etc. This will appear as "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----". :param der_bytes: A byte string to be armored :param headers: An OrderedDict of the header lines to write after the BEGIN line :return: A byte string of the PEM block """ if not isinstance(der_bytes, byte_cls): raise TypeError(unwrap( ''' der_bytes must be a byte string, not %s ''' % _type_name(der_bytes) )) if not isinstance(type_name, str_cls): raise TypeError(unwrap( ''' type_name must be a unicode string, not %s ''', _type_name(type_name) )) type_name = type_name.upper().encode('ascii') output = BytesIO() output.write(b'-----BEGIN ') output.write(type_name) output.write(b'-----\n') if headers: for key in headers: output.write(key.encode('ascii')) output.write(b': ') output.write(headers[key].encode('ascii')) output.write(b'\n') output.write(b'\n') b64_bytes = base64.b64encode(der_bytes) b64_len = len(b64_bytes) i = 0 while i < b64_len: output.write(b64_bytes[i:i + 64]) output.write(b'\n') i += 64 output.write(b'-----END ') output.write(type_name) output.write(b'-----\n') return output.getvalue() def _unarmor(pem_bytes): """ Convert a PEM-encoded byte string into one or more DER-encoded byte strings :param pem_bytes: A byte string of the PEM-encoded data :raises: ValueError - when the pem_bytes do not appear to be PEM-encoded bytes :return: A generator of 3-element tuples in the format: (object_type, headers, der_bytes). The object_type is a unicode string of what is between "-----BEGIN " and "-----". Examples include: "CERTIFICATE", "PUBLIC KEY", "PRIVATE KEY". The headers is a dict containing any lines in the form "Name: Value" that are right after the begin line. """ if not isinstance(pem_bytes, byte_cls): raise TypeError(unwrap( ''' pem_bytes must be a byte string, not %s ''', _type_name(pem_bytes) )) # Valid states include: "trash", "headers", "body" state = 'trash' headers = {} base64_data = b'' object_type = None found_start = False found_end = False for line in pem_bytes.splitlines(False): if line == b'': continue if state == "trash": # Look for a starting line since some CA cert bundle show the cert # into in a parsed format above each PEM block type_name_match = re.match(b'^(?:---- |-----)BEGIN ([A-Z0-9 ]+)(?: ----|-----)', line) if not type_name_match: continue object_type = type_name_match.group(1).decode('ascii') found_start = True state = 'headers' continue if state == 'headers': if line.find(b':') == -1: state = 'body' else: decoded_line = line.decode('ascii') name, value = decoded_line.split(':', 1) headers[name] = value.strip() continue if state == 'body': if line[0:5] in (b'-----', b'---- '): der_bytes = base64.b64decode(base64_data) yield (object_type, headers, der_bytes) state = 'trash' headers = {} base64_data = b'' object_type = None found_end = True continue base64_data += line if not found_start or not found_end: raise ValueError(unwrap( ''' pem_bytes does not appear to contain PEM-encoded data - no BEGIN/END combination found ''' )) def unarmor(pem_bytes, multiple=False): """ Convert a PEM-encoded byte string into a DER-encoded byte string :param pem_bytes: A byte string of the PEM-encoded data :param multiple: If True, function will return a generator :raises: ValueError - when the pem_bytes do not appear to be PEM-encoded bytes :return: A 3-element tuple (object_name, headers, der_bytes). The object_name is a unicode string of what is between "-----BEGIN " and "-----". Examples include: "CERTIFICATE", "PUBLIC KEY", "PRIVATE KEY". The headers is a dict containing any lines in the form "Name: Value" that are right after the begin line. """ generator = _unarmor(pem_bytes) if not multiple: return next(generator) return generator pkcs12.py000064400000010726152572326550006243 0ustar00# coding: utf-8 """ ASN.1 type classes for PKCS#12 files. Exports the following items: - CertBag() - CrlBag() - Pfx() - SafeBag() - SecretBag() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function from .algos import DigestInfo from .cms import ContentInfo, SignedData from .core import ( Any, BMPString, Integer, ObjectIdentifier, OctetString, ParsableOctetString, Sequence, SequenceOf, SetOf, ) from .keys import PrivateKeyInfo, EncryptedPrivateKeyInfo from .x509 import Certificate, KeyPurposeId # The structures in this file are taken from https://tools.ietf.org/html/rfc7292 class MacData(Sequence): _fields = [ ('mac', DigestInfo), ('mac_salt', OctetString), ('iterations', Integer, {'default': 1}), ] class Version(Integer): _map = { 3: 'v3' } class AttributeType(ObjectIdentifier): _map = { # https://tools.ietf.org/html/rfc2985#page-18 '1.2.840.113549.1.9.20': 'friendly_name', '1.2.840.113549.1.9.21': 'local_key_id', # https://support.microsoft.com/en-us/kb/287547 '1.3.6.1.4.1.311.17.1': 'microsoft_local_machine_keyset', # https://github.com/frohoff/jdk8u-dev-jdk/blob/master/src/share/classes/sun/security/pkcs12/PKCS12KeyStore.java # this is a set of OIDs, representing key usage, the usual value is a SET of one element OID 2.5.29.37.0 '2.16.840.1.113894.746875.1.1': 'trusted_key_usage', } class SetOfAny(SetOf): _child_spec = Any class SetOfBMPString(SetOf): _child_spec = BMPString class SetOfOctetString(SetOf): _child_spec = OctetString class SetOfKeyPurposeId(SetOf): _child_spec = KeyPurposeId class Attribute(Sequence): _fields = [ ('type', AttributeType), ('values', None), ] _oid_specs = { 'friendly_name': SetOfBMPString, 'local_key_id': SetOfOctetString, 'microsoft_csp_name': SetOfBMPString, 'trusted_key_usage': SetOfKeyPurposeId, } def _values_spec(self): return self._oid_specs.get(self['type'].native, SetOfAny) _spec_callbacks = { 'values': _values_spec } class Attributes(SetOf): _child_spec = Attribute class Pfx(Sequence): _fields = [ ('version', Version), ('auth_safe', ContentInfo), ('mac_data', MacData, {'optional': True}) ] _authenticated_safe = None @property def authenticated_safe(self): if self._authenticated_safe is None: content = self['auth_safe']['content'] if isinstance(content, SignedData): content = content['content_info']['content'] self._authenticated_safe = AuthenticatedSafe.load(content.native) return self._authenticated_safe class AuthenticatedSafe(SequenceOf): _child_spec = ContentInfo class BagId(ObjectIdentifier): _map = { '1.2.840.113549.1.12.10.1.1': 'key_bag', '1.2.840.113549.1.12.10.1.2': 'pkcs8_shrouded_key_bag', '1.2.840.113549.1.12.10.1.3': 'cert_bag', '1.2.840.113549.1.12.10.1.4': 'crl_bag', '1.2.840.113549.1.12.10.1.5': 'secret_bag', '1.2.840.113549.1.12.10.1.6': 'safe_contents', } class CertId(ObjectIdentifier): _map = { '1.2.840.113549.1.9.22.1': 'x509', '1.2.840.113549.1.9.22.2': 'sdsi', } class CertBag(Sequence): _fields = [ ('cert_id', CertId), ('cert_value', ParsableOctetString, {'explicit': 0}), ] _oid_pair = ('cert_id', 'cert_value') _oid_specs = { 'x509': Certificate, } class CrlBag(Sequence): _fields = [ ('crl_id', ObjectIdentifier), ('crl_value', OctetString, {'explicit': 0}), ] class SecretBag(Sequence): _fields = [ ('secret_type_id', ObjectIdentifier), ('secret_value', OctetString, {'explicit': 0}), ] class SafeContents(SequenceOf): pass class SafeBag(Sequence): _fields = [ ('bag_id', BagId), ('bag_value', Any, {'explicit': 0}), ('bag_attributes', Attributes, {'optional': True}), ] _oid_pair = ('bag_id', 'bag_value') _oid_specs = { 'key_bag': PrivateKeyInfo, 'pkcs8_shrouded_key_bag': EncryptedPrivateKeyInfo, 'cert_bag': CertBag, 'crl_bag': CrlBag, 'secret_bag': SecretBag, 'safe_contents': SafeContents } SafeContents._child_spec = SafeBag tsp.py000064400000017221152572326550005743 0ustar00# coding: utf-8 """ ASN.1 type classes for the time stamp protocol (TSP). Exports the following items: - TimeStampReq() - TimeStampResp() Also adds TimeStampedData() support to asn1crypto.cms.ContentInfo(), TimeStampedData() and TSTInfo() support to asn1crypto.cms.EncapsulatedContentInfo() and some oids and value parsers to asn1crypto.cms.CMSAttribute(). Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function from .algos import DigestAlgorithm from .cms import ( CMSAttribute, CMSAttributeType, ContentInfo, ContentType, EncapsulatedContentInfo, ) from .core import ( Any, BitString, Boolean, Choice, GeneralizedTime, IA5String, Integer, ObjectIdentifier, OctetString, Sequence, SequenceOf, SetOf, UTF8String, ) from .crl import CertificateList from .x509 import ( Attributes, CertificatePolicies, GeneralName, GeneralNames, ) # The structures in this file are based on https://tools.ietf.org/html/rfc3161, # https://tools.ietf.org/html/rfc4998, https://tools.ietf.org/html/rfc5544, # https://tools.ietf.org/html/rfc5035, https://tools.ietf.org/html/rfc2634 class Version(Integer): _map = { 0: 'v0', 1: 'v1', 2: 'v2', 3: 'v3', 4: 'v4', 5: 'v5', } class MessageImprint(Sequence): _fields = [ ('hash_algorithm', DigestAlgorithm), ('hashed_message', OctetString), ] class Accuracy(Sequence): _fields = [ ('seconds', Integer, {'optional': True}), ('millis', Integer, {'implicit': 0, 'optional': True}), ('micros', Integer, {'implicit': 1, 'optional': True}), ] class Extension(Sequence): _fields = [ ('extn_id', ObjectIdentifier), ('critical', Boolean, {'default': False}), ('extn_value', OctetString), ] class Extensions(SequenceOf): _child_spec = Extension class TSTInfo(Sequence): _fields = [ ('version', Version), ('policy', ObjectIdentifier), ('message_imprint', MessageImprint), ('serial_number', Integer), ('gen_time', GeneralizedTime), ('accuracy', Accuracy, {'optional': True}), ('ordering', Boolean, {'default': False}), ('nonce', Integer, {'optional': True}), ('tsa', GeneralName, {'explicit': 0, 'optional': True}), ('extensions', Extensions, {'implicit': 1, 'optional': True}), ] class TimeStampReq(Sequence): _fields = [ ('version', Version), ('message_imprint', MessageImprint), ('req_policy', ObjectIdentifier, {'optional': True}), ('nonce', Integer, {'optional': True}), ('cert_req', Boolean, {'default': False}), ('extensions', Extensions, {'implicit': 0, 'optional': True}), ] class PKIStatus(Integer): _map = { 0: 'granted', 1: 'granted_with_mods', 2: 'rejection', 3: 'waiting', 4: 'revocation_warning', 5: 'revocation_notification', } class PKIFreeText(SequenceOf): _child_spec = UTF8String class PKIFailureInfo(BitString): _map = { 0: 'bad_alg', 2: 'bad_request', 5: 'bad_data_format', 14: 'time_not_available', 15: 'unaccepted_policy', 16: 'unaccepted_extensions', 17: 'add_info_not_available', 25: 'system_failure', } class PKIStatusInfo(Sequence): _fields = [ ('status', PKIStatus), ('status_string', PKIFreeText, {'optional': True}), ('fail_info', PKIFailureInfo, {'optional': True}), ] class TimeStampResp(Sequence): _fields = [ ('status', PKIStatusInfo), ('time_stamp_token', ContentInfo), ] class MetaData(Sequence): _fields = [ ('hash_protected', Boolean), ('file_name', UTF8String, {'optional': True}), ('media_type', IA5String, {'optional': True}), ('other_meta_data', Attributes, {'optional': True}), ] class TimeStampAndCRL(Sequence): _fields = [ ('time_stamp', EncapsulatedContentInfo), ('crl', CertificateList, {'optional': True}), ] class TimeStampTokenEvidence(SequenceOf): _child_spec = TimeStampAndCRL class DigestAlgorithms(SequenceOf): _child_spec = DigestAlgorithm class EncryptionInfo(Sequence): _fields = [ ('encryption_info_type', ObjectIdentifier), ('encryption_info_value', Any), ] class PartialHashtree(SequenceOf): _child_spec = OctetString class PartialHashtrees(SequenceOf): _child_spec = PartialHashtree class ArchiveTimeStamp(Sequence): _fields = [ ('digest_algorithm', DigestAlgorithm, {'implicit': 0, 'optional': True}), ('attributes', Attributes, {'implicit': 1, 'optional': True}), ('reduced_hashtree', PartialHashtrees, {'implicit': 2, 'optional': True}), ('time_stamp', ContentInfo), ] class ArchiveTimeStampSequence(SequenceOf): _child_spec = ArchiveTimeStamp class EvidenceRecord(Sequence): _fields = [ ('version', Version), ('digest_algorithms', DigestAlgorithms), ('crypto_infos', Attributes, {'implicit': 0, 'optional': True}), ('encryption_info', EncryptionInfo, {'implicit': 1, 'optional': True}), ('archive_time_stamp_sequence', ArchiveTimeStampSequence), ] class OtherEvidence(Sequence): _fields = [ ('oe_type', ObjectIdentifier), ('oe_value', Any), ] class Evidence(Choice): _alternatives = [ ('tst_evidence', TimeStampTokenEvidence, {'implicit': 0}), ('ers_evidence', EvidenceRecord, {'implicit': 1}), ('other_evidence', OtherEvidence, {'implicit': 2}), ] class TimeStampedData(Sequence): _fields = [ ('version', Version), ('data_uri', IA5String, {'optional': True}), ('meta_data', MetaData, {'optional': True}), ('content', OctetString, {'optional': True}), ('temporal_evidence', Evidence), ] class IssuerSerial(Sequence): _fields = [ ('issuer', GeneralNames), ('serial_number', Integer), ] class ESSCertID(Sequence): _fields = [ ('cert_hash', OctetString), ('issuer_serial', IssuerSerial, {'optional': True}), ] class ESSCertIDs(SequenceOf): _child_spec = ESSCertID class SigningCertificate(Sequence): _fields = [ ('certs', ESSCertIDs), ('policies', CertificatePolicies, {'optional': True}), ] class SetOfSigningCertificates(SetOf): _child_spec = SigningCertificate class ESSCertIDv2(Sequence): _fields = [ ('hash_algorithm', DigestAlgorithm, {'default': {'algorithm': 'sha256'}}), ('cert_hash', OctetString), ('issuer_serial', IssuerSerial, {'optional': True}), ] class ESSCertIDv2s(SequenceOf): _child_spec = ESSCertIDv2 class SigningCertificateV2(Sequence): _fields = [ ('certs', ESSCertIDv2s), ('policies', CertificatePolicies, {'optional': True}), ] class SetOfSigningCertificatesV2(SetOf): _child_spec = SigningCertificateV2 EncapsulatedContentInfo._oid_specs['tst_info'] = TSTInfo EncapsulatedContentInfo._oid_specs['timestamped_data'] = TimeStampedData ContentInfo._oid_specs['timestamped_data'] = TimeStampedData ContentType._map['1.2.840.113549.1.9.16.1.4'] = 'tst_info' ContentType._map['1.2.840.113549.1.9.16.1.31'] = 'timestamped_data' CMSAttributeType._map['1.2.840.113549.1.9.16.2.12'] = 'signing_certificate' CMSAttribute._oid_specs['signing_certificate'] = SetOfSigningCertificates CMSAttributeType._map['1.2.840.113549.1.9.16.2.47'] = 'signing_certificate_v2' CMSAttribute._oid_specs['signing_certificate_v2'] = SetOfSigningCertificatesV2 util.py000064400000052561152572326550006120 0ustar00# coding: utf-8 """ Miscellaneous data helpers, including functions for converting integers to and from bytes and UTC timezone. Exports the following items: - OrderedDict() - int_from_bytes() - int_to_bytes() - timezone.utc - utc_with_dst - create_timezone() - inet_ntop() - inet_pton() - uri_to_iri() - iri_to_uri() """ from __future__ import unicode_literals, division, absolute_import, print_function import math import sys from datetime import datetime, date, timedelta, tzinfo from ._errors import unwrap from ._iri import iri_to_uri, uri_to_iri # noqa from ._ordereddict import OrderedDict # noqa from ._types import type_name if sys.platform == 'win32': from ._inet import inet_ntop, inet_pton else: from socket import inet_ntop, inet_pton # noqa # Python 2 if sys.version_info <= (3,): def int_to_bytes(value, signed=False, width=None): """ Converts an integer to a byte string :param value: The integer to convert :param signed: If the byte string should be encoded using two's complement :param width: If None, the minimal possible size (but at least 1), otherwise an integer of the byte width for the return value :return: A byte string """ if value == 0 and width == 0: return b'' # Handle negatives in two's complement is_neg = False if signed and value < 0: is_neg = True bits = int(math.ceil(len('%x' % abs(value)) / 2.0) * 8) value = (value + (1 << bits)) % (1 << bits) hex_str = '%x' % value if len(hex_str) & 1: hex_str = '0' + hex_str output = hex_str.decode('hex') if signed and not is_neg and ord(output[0:1]) & 0x80: output = b'\x00' + output if width is not None: if len(output) > width: raise OverflowError('int too big to convert') if is_neg: pad_char = b'\xFF' else: pad_char = b'\x00' output = (pad_char * (width - len(output))) + output elif is_neg and ord(output[0:1]) & 0x80 == 0: output = b'\xFF' + output return output def int_from_bytes(value, signed=False): """ Converts a byte string to an integer :param value: The byte string to convert :param signed: If the byte string should be interpreted using two's complement :return: An integer """ if value == b'': return 0 num = long(value.encode("hex"), 16) # noqa if not signed: return num # Check for sign bit and handle two's complement if ord(value[0:1]) & 0x80: bit_len = len(value) * 8 return num - (1 << bit_len) return num class timezone(tzinfo): # noqa """ Implements datetime.timezone for py2. Only full minute offsets are supported. DST is not supported. """ def __init__(self, offset, name=None): """ :param offset: A timedelta with this timezone's offset from UTC :param name: Name of the timezone; if None, generate one. """ if not timedelta(hours=-24) < offset < timedelta(hours=24): raise ValueError('Offset must be in [-23:59, 23:59]') if offset.seconds % 60 or offset.microseconds: raise ValueError('Offset must be full minutes') self._offset = offset if name is not None: self._name = name elif not offset: self._name = 'UTC' else: self._name = 'UTC' + _format_offset(offset) def __eq__(self, other): """ Compare two timezones :param other: The other timezone to compare to :return: A boolean """ if type(other) != timezone: return False return self._offset == other._offset def __getinitargs__(self): """ Called by tzinfo.__reduce__ to support pickle and copy. :return: offset and name, to be used for __init__ """ return self._offset, self._name def tzname(self, dt): """ :param dt: A datetime object; ignored. :return: Name of this timezone """ return self._name def utcoffset(self, dt): """ :param dt: A datetime object; ignored. :return: A timedelta object with the offset from UTC """ return self._offset def dst(self, dt): """ :param dt: A datetime object; ignored. :return: Zero timedelta """ return timedelta(0) timezone.utc = timezone(timedelta(0)) # Python 3 else: from datetime import timezone # noqa def int_to_bytes(value, signed=False, width=None): """ Converts an integer to a byte string :param value: The integer to convert :param signed: If the byte string should be encoded using two's complement :param width: If None, the minimal possible size (but at least 1), otherwise an integer of the byte width for the return value :return: A byte string """ if width is None: if signed: if value < 0: bits_required = abs(value + 1).bit_length() else: bits_required = value.bit_length() if bits_required % 8 == 0: bits_required += 1 else: bits_required = value.bit_length() width = math.ceil(bits_required / 8) or 1 return value.to_bytes(width, byteorder='big', signed=signed) def int_from_bytes(value, signed=False): """ Converts a byte string to an integer :param value: The byte string to convert :param signed: If the byte string should be interpreted using two's complement :return: An integer """ return int.from_bytes(value, 'big', signed=signed) def _format_offset(off): """ Format a timedelta into "[+-]HH:MM" format or "" for None """ if off is None: return '' mins = off.days * 24 * 60 + off.seconds // 60 sign = '-' if mins < 0 else '+' return sign + '%02d:%02d' % divmod(abs(mins), 60) class _UtcWithDst(tzinfo): """ Utc class where dst does not return None; required for astimezone """ def tzname(self, dt): return 'UTC' def utcoffset(self, dt): return timedelta(0) def dst(self, dt): return timedelta(0) utc_with_dst = _UtcWithDst() _timezone_cache = {} def create_timezone(offset): """ Returns a new datetime.timezone object with the given offset. Uses cached objects if possible. :param offset: A datetime.timedelta object; It needs to be in full minutes and between -23:59 and +23:59. :return: A datetime.timezone object """ try: tz = _timezone_cache[offset] except KeyError: tz = _timezone_cache[offset] = timezone(offset) return tz class extended_date(object): """ A datetime.datetime-like object that represents the year 0. This is just to handle 0000-01-01 found in some certificates. Python's datetime does not support year 0. The proleptic gregorian calendar repeats itself every 400 years. Therefore, the simplest way to format is to substitute year 2000. """ def __init__(self, year, month, day): """ :param year: The integer 0 :param month: An integer from 1 to 12 :param day: An integer from 1 to 31 """ if year != 0: raise ValueError('year must be 0') self._y2k = date(2000, month, day) @property def year(self): """ :return: The integer 0 """ return 0 @property def month(self): """ :return: An integer from 1 to 12 """ return self._y2k.month @property def day(self): """ :return: An integer from 1 to 31 """ return self._y2k.day def strftime(self, format): """ Formats the date using strftime() :param format: A strftime() format string :return: A str, the formatted date as a unicode string in Python 3 and a byte string in Python 2 """ # Format the date twice, once with year 2000, once with year 4000. # The only differences in the result will be in the millennium. Find them and replace by zeros. y2k = self._y2k.strftime(format) y4k = self._y2k.replace(year=4000).strftime(format) return ''.join('0' if (c2, c4) == ('2', '4') else c2 for c2, c4 in zip(y2k, y4k)) def isoformat(self): """ Formats the date as %Y-%m-%d :return: The date formatted to %Y-%m-%d as a unicode string in Python 3 and a byte string in Python 2 """ return self.strftime('0000-%m-%d') def replace(self, year=None, month=None, day=None): """ Returns a new datetime.date or asn1crypto.util.extended_date object with the specified components replaced :return: A datetime.date or asn1crypto.util.extended_date object """ if year is None: year = self.year if month is None: month = self.month if day is None: day = self.day if year > 0: cls = date else: cls = extended_date return cls( year, month, day ) def __str__(self): """ :return: A str representing this extended_date, e.g. "0000-01-01" """ return self.strftime('%Y-%m-%d') def __eq__(self, other): """ Compare two extended_date objects :param other: The other extended_date to compare to :return: A boolean """ # datetime.date object wouldn't compare equal because it can't be year 0 if not isinstance(other, self.__class__): return False return self.__cmp__(other) == 0 def __ne__(self, other): """ Compare two extended_date objects :param other: The other extended_date to compare to :return: A boolean """ return not self.__eq__(other) def _comparison_error(self, other): raise TypeError(unwrap( ''' An asn1crypto.util.extended_date object can only be compared to an asn1crypto.util.extended_date or datetime.date object, not %s ''', type_name(other) )) def __cmp__(self, other): """ Compare two extended_date or datetime.date objects :param other: The other extended_date object to compare to :return: An integer smaller than, equal to, or larger than 0 """ # self is year 0, other is >= year 1 if isinstance(other, date): return -1 if not isinstance(other, self.__class__): self._comparison_error(other) if self._y2k < other._y2k: return -1 if self._y2k > other._y2k: return 1 return 0 def __lt__(self, other): return self.__cmp__(other) < 0 def __le__(self, other): return self.__cmp__(other) <= 0 def __gt__(self, other): return self.__cmp__(other) > 0 def __ge__(self, other): return self.__cmp__(other) >= 0 class extended_datetime(object): """ A datetime.datetime-like object that represents the year 0. This is just to handle 0000-01-01 found in some certificates. Python's datetime does not support year 0. The proleptic gregorian calendar repeats itself every 400 years. Therefore, the simplest way to format is to substitute year 2000. """ # There are 97 leap days during 400 years. DAYS_IN_400_YEARS = 400 * 365 + 97 DAYS_IN_2000_YEARS = 5 * DAYS_IN_400_YEARS def __init__(self, year, *args, **kwargs): """ :param year: The integer 0 :param args: Other positional arguments; see datetime.datetime. :param kwargs: Other keyword arguments; see datetime.datetime. """ if year != 0: raise ValueError('year must be 0') self._y2k = datetime(2000, *args, **kwargs) @property def year(self): """ :return: The integer 0 """ return 0 @property def month(self): """ :return: An integer from 1 to 12 """ return self._y2k.month @property def day(self): """ :return: An integer from 1 to 31 """ return self._y2k.day @property def hour(self): """ :return: An integer from 1 to 24 """ return self._y2k.hour @property def minute(self): """ :return: An integer from 1 to 60 """ return self._y2k.minute @property def second(self): """ :return: An integer from 1 to 60 """ return self._y2k.second @property def microsecond(self): """ :return: An integer from 0 to 999999 """ return self._y2k.microsecond @property def tzinfo(self): """ :return: If object is timezone aware, a datetime.tzinfo object, else None. """ return self._y2k.tzinfo def utcoffset(self): """ :return: If object is timezone aware, a datetime.timedelta object, else None. """ return self._y2k.utcoffset() def time(self): """ :return: A datetime.time object """ return self._y2k.time() def date(self): """ :return: An asn1crypto.util.extended_date of the date """ return extended_date(0, self.month, self.day) def strftime(self, format): """ Performs strftime(), always returning a str :param format: A strftime() format string :return: A str of the formatted datetime """ # Format the datetime twice, once with year 2000, once with year 4000. # The only differences in the result will be in the millennium. Find them and replace by zeros. y2k = self._y2k.strftime(format) y4k = self._y2k.replace(year=4000).strftime(format) return ''.join('0' if (c2, c4) == ('2', '4') else c2 for c2, c4 in zip(y2k, y4k)) def isoformat(self, sep='T'): """ Formats the date as "%Y-%m-%d %H:%M:%S" with the sep param between the date and time portions :param set: A single character of the separator to place between the date and time :return: The formatted datetime as a unicode string in Python 3 and a byte string in Python 2 """ s = '0000-%02d-%02d%c%02d:%02d:%02d' % (self.month, self.day, sep, self.hour, self.minute, self.second) if self.microsecond: s += '.%06d' % self.microsecond return s + _format_offset(self.utcoffset()) def replace(self, year=None, *args, **kwargs): """ Returns a new datetime.datetime or asn1crypto.util.extended_datetime object with the specified components replaced :param year: The new year to substitute. None to keep it. :param args: Other positional arguments; see datetime.datetime.replace. :param kwargs: Other keyword arguments; see datetime.datetime.replace. :return: A datetime.datetime or asn1crypto.util.extended_datetime object """ if year: return self._y2k.replace(year, *args, **kwargs) return extended_datetime.from_y2k(self._y2k.replace(2000, *args, **kwargs)) def astimezone(self, tz): """ Convert this extended_datetime to another timezone. :param tz: A datetime.tzinfo object. :return: A new extended_datetime or datetime.datetime object """ return extended_datetime.from_y2k(self._y2k.astimezone(tz)) def timestamp(self): """ Return POSIX timestamp. Only supported in python >= 3.3 :return: A float representing the seconds since 1970-01-01 UTC. This will be a negative value. """ return self._y2k.timestamp() - self.DAYS_IN_2000_YEARS * 86400 def __str__(self): """ :return: A str representing this extended_datetime, e.g. "0000-01-01 00:00:00.000001-10:00" """ return self.isoformat(sep=' ') def __eq__(self, other): """ Compare two extended_datetime objects :param other: The other extended_datetime to compare to :return: A boolean """ # Only compare against other datetime or extended_datetime objects if not isinstance(other, (self.__class__, datetime)): return False # Offset-naive and offset-aware datetimes are never the same if (self.tzinfo is None) != (other.tzinfo is None): return False return self.__cmp__(other) == 0 def __ne__(self, other): """ Compare two extended_datetime objects :param other: The other extended_datetime to compare to :return: A boolean """ return not self.__eq__(other) def _comparison_error(self, other): """ Raises a TypeError about the other object not being suitable for comparison :param other: The object being compared to """ raise TypeError(unwrap( ''' An asn1crypto.util.extended_datetime object can only be compared to an asn1crypto.util.extended_datetime or datetime.datetime object, not %s ''', type_name(other) )) def __cmp__(self, other): """ Compare two extended_datetime or datetime.datetime objects :param other: The other extended_datetime or datetime.datetime object to compare to :return: An integer smaller than, equal to, or larger than 0 """ if not isinstance(other, (self.__class__, datetime)): self._comparison_error(other) if (self.tzinfo is None) != (other.tzinfo is None): raise TypeError("can't compare offset-naive and offset-aware datetimes") diff = self - other zero = timedelta(0) if diff < zero: return -1 if diff > zero: return 1 return 0 def __lt__(self, other): return self.__cmp__(other) < 0 def __le__(self, other): return self.__cmp__(other) <= 0 def __gt__(self, other): return self.__cmp__(other) > 0 def __ge__(self, other): return self.__cmp__(other) >= 0 def __add__(self, other): """ Adds a timedelta :param other: A datetime.timedelta object to add. :return: A new extended_datetime or datetime.datetime object. """ return extended_datetime.from_y2k(self._y2k + other) def __sub__(self, other): """ Subtracts a timedelta or another datetime. :param other: A datetime.timedelta or datetime.datetime or extended_datetime object to subtract. :return: If a timedelta is passed, a new extended_datetime or datetime.datetime object. Else a datetime.timedelta object. """ if isinstance(other, timedelta): return extended_datetime.from_y2k(self._y2k - other) if isinstance(other, extended_datetime): return self._y2k - other._y2k if isinstance(other, datetime): return self._y2k - other - timedelta(days=self.DAYS_IN_2000_YEARS) return NotImplemented def __rsub__(self, other): return -(self - other) @classmethod def from_y2k(cls, value): """ Revert substitution of year 2000. :param value: A datetime.datetime object which is 2000 years in the future. :return: A new extended_datetime or datetime.datetime object. """ year = value.year - 2000 if year > 0: new_cls = datetime else: new_cls = cls return new_cls( year, value.month, value.day, value.hour, value.minute, value.second, value.microsecond, value.tzinfo ) version.py000064400000000230152572326550006612 0ustar00# coding: utf-8 from __future__ import unicode_literals, division, absolute_import, print_function __version__ = '1.5.1' __version_info__ = (1, 5, 1) x509.py000064400000267122152572326550005651 0ustar00# coding: utf-8 """ ASN.1 type classes for X.509 certificates. Exports the following items: - Attributes() - Certificate() - Extensions() - GeneralName() - GeneralNames() - Name() Other type classes are defined that help compose the types listed above. """ from __future__ import unicode_literals, division, absolute_import, print_function from contextlib import contextmanager from encodings import idna # noqa import hashlib import re import socket import stringprep import sys import unicodedata from ._errors import unwrap from ._iri import iri_to_uri, uri_to_iri from ._ordereddict import OrderedDict from ._types import type_name, str_cls, bytes_to_list from .algos import AlgorithmIdentifier, AnyAlgorithmIdentifier, DigestAlgorithm, SignedDigestAlgorithm from .core import ( Any, BitString, BMPString, Boolean, Choice, Concat, Enumerated, GeneralizedTime, GeneralString, IA5String, Integer, Null, NumericString, ObjectIdentifier, OctetBitString, OctetString, ParsableOctetString, PrintableString, Sequence, SequenceOf, Set, SetOf, TeletexString, UniversalString, UTCTime, UTF8String, VisibleString, VOID, ) from .keys import PublicKeyInfo from .util import int_to_bytes, int_from_bytes, inet_ntop, inet_pton # The structures in this file are taken from https://tools.ietf.org/html/rfc5280 # and a few other supplementary sources, mostly due to extra supported # extension and name OIDs class DNSName(IA5String): _encoding = 'idna' _bad_tag = (12, 19) def __ne__(self, other): return not self == other def __eq__(self, other): """ Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2 :param other: Another DNSName object :return: A boolean """ if not isinstance(other, DNSName): return False return self.__unicode__().lower() == other.__unicode__().lower() def set(self, value): """ Sets the value of the DNS name :param value: A unicode string """ if not isinstance(value, str_cls): raise TypeError(unwrap( ''' %s value must be a unicode string, not %s ''', type_name(self), type_name(value) )) if value.startswith('.'): encoded_value = b'.' + value[1:].encode(self._encoding) else: encoded_value = value.encode(self._encoding) self._unicode = value self.contents = encoded_value self._header = None if self._trailer != b'': self._trailer = b'' class URI(IA5String): def set(self, value): """ Sets the value of the string :param value: A unicode string """ if not isinstance(value, str_cls): raise TypeError(unwrap( ''' %s value must be a unicode string, not %s ''', type_name(self), type_name(value) )) self._unicode = value self.contents = iri_to_uri(value) self._header = None if self._trailer != b'': self._trailer = b'' def __ne__(self, other): return not self == other def __eq__(self, other): """ Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4 :param other: Another URI object :return: A boolean """ if not isinstance(other, URI): return False return iri_to_uri(self.native, True) == iri_to_uri(other.native, True) def __unicode__(self): """ :return: A unicode string """ if self.contents is None: return '' if self._unicode is None: self._unicode = uri_to_iri(self._merge_chunks()) return self._unicode class EmailAddress(IA5String): _contents = None # If the value has gone through the .set() method, thus normalizing it _normalized = False # In the wild we've seen this encoded as a UTF8String and PrintableString _bad_tag = (12, 19) @property def contents(self): """ :return: A byte string of the DER-encoded contents of the sequence """ return self._contents @contents.setter def contents(self, value): """ :param value: A byte string of the DER-encoded contents of the sequence """ self._normalized = False self._contents = value def set(self, value): """ Sets the value of the string :param value: A unicode string """ if not isinstance(value, str_cls): raise TypeError(unwrap( ''' %s value must be a unicode string, not %s ''', type_name(self), type_name(value) )) if value.find('@') != -1: mailbox, hostname = value.rsplit('@', 1) encoded_value = mailbox.encode('ascii') + b'@' + hostname.encode('idna') else: encoded_value = value.encode('ascii') self._normalized = True self._unicode = value self.contents = encoded_value self._header = None if self._trailer != b'': self._trailer = b'' def __unicode__(self): """ :return: A unicode string """ # We've seen this in the wild as a PrintableString, and since ascii is a # subset of cp1252, we use the later for decoding to be more user friendly if self._unicode is None: contents = self._merge_chunks() if contents.find(b'@') == -1: self._unicode = contents.decode('cp1252') else: mailbox, hostname = contents.rsplit(b'@', 1) self._unicode = mailbox.decode('cp1252') + '@' + hostname.decode('idna') return self._unicode def __ne__(self, other): return not self == other def __eq__(self, other): """ Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5 :param other: Another EmailAddress object :return: A boolean """ if not isinstance(other, EmailAddress): return False if not self._normalized: self.set(self.native) if not other._normalized: other.set(other.native) if self._contents.find(b'@') == -1 or other._contents.find(b'@') == -1: return self._contents == other._contents other_mailbox, other_hostname = other._contents.rsplit(b'@', 1) mailbox, hostname = self._contents.rsplit(b'@', 1) if mailbox != other_mailbox: return False if hostname.lower() != other_hostname.lower(): return False return True class IPAddress(OctetString): def parse(self, spec=None, spec_params=None): """ This method is not applicable to IP addresses """ raise ValueError(unwrap( ''' IP address values can not be parsed ''' )) def set(self, value): """ Sets the value of the object :param value: A unicode string containing an IPv4 address, IPv4 address with CIDR, an IPv6 address or IPv6 address with CIDR """ if not isinstance(value, str_cls): raise TypeError(unwrap( ''' %s value must be a unicode string, not %s ''', type_name(self), type_name(value) )) original_value = value has_cidr = value.find('/') != -1 cidr = 0 if has_cidr: parts = value.split('/', 1) value = parts[0] cidr = int(parts[1]) if cidr < 0: raise ValueError(unwrap( ''' %s value contains a CIDR range less than 0 ''', type_name(self) )) if value.find(':') != -1: family = socket.AF_INET6 if cidr > 128: raise ValueError(unwrap( ''' %s value contains a CIDR range bigger than 128, the maximum value for an IPv6 address ''', type_name(self) )) cidr_size = 128 else: family = socket.AF_INET if cidr > 32: raise ValueError(unwrap( ''' %s value contains a CIDR range bigger than 32, the maximum value for an IPv4 address ''', type_name(self) )) cidr_size = 32 cidr_bytes = b'' if has_cidr: cidr_mask = '1' * cidr cidr_mask += '0' * (cidr_size - len(cidr_mask)) cidr_bytes = int_to_bytes(int(cidr_mask, 2)) cidr_bytes = (b'\x00' * ((cidr_size // 8) - len(cidr_bytes))) + cidr_bytes self._native = original_value self.contents = inet_pton(family, value) + cidr_bytes self._bytes = self.contents self._header = None if self._trailer != b'': self._trailer = b'' @property def native(self): """ The native Python datatype representation of this value :return: A unicode string or None """ if self.contents is None: return None if self._native is None: byte_string = self.__bytes__() byte_len = len(byte_string) value = None cidr_int = None if byte_len in set([32, 16]): value = inet_ntop(socket.AF_INET6, byte_string[0:16]) if byte_len > 16: cidr_int = int_from_bytes(byte_string[16:]) elif byte_len in set([8, 4]): value = inet_ntop(socket.AF_INET, byte_string[0:4]) if byte_len > 4: cidr_int = int_from_bytes(byte_string[4:]) if cidr_int is not None: cidr_bits = '{0:b}'.format(cidr_int) cidr = len(cidr_bits.rstrip('0')) value = value + '/' + str_cls(cidr) self._native = value return self._native def __ne__(self, other): return not self == other def __eq__(self, other): """ :param other: Another IPAddress object :return: A boolean """ if not isinstance(other, IPAddress): return False return self.__bytes__() == other.__bytes__() class Attribute(Sequence): _fields = [ ('type', ObjectIdentifier), ('values', SetOf, {'spec': Any}), ] class Attributes(SequenceOf): _child_spec = Attribute class KeyUsage(BitString): _map = { 0: 'digital_signature', 1: 'non_repudiation', 2: 'key_encipherment', 3: 'data_encipherment', 4: 'key_agreement', 5: 'key_cert_sign', 6: 'crl_sign', 7: 'encipher_only', 8: 'decipher_only', } class PrivateKeyUsagePeriod(Sequence): _fields = [ ('not_before', GeneralizedTime, {'implicit': 0, 'optional': True}), ('not_after', GeneralizedTime, {'implicit': 1, 'optional': True}), ] class NotReallyTeletexString(TeletexString): """ OpenSSL (and probably some other libraries) puts ISO-8859-1 into TeletexString instead of ITU T.61. We use Windows-1252 when decoding since it is a superset of ISO-8859-1, and less likely to cause encoding issues, but we stay strict with encoding to prevent us from creating bad data. """ _decoding_encoding = 'cp1252' def __unicode__(self): """ :return: A unicode string """ if self.contents is None: return '' if self._unicode is None: self._unicode = self._merge_chunks().decode(self._decoding_encoding) return self._unicode @contextmanager def strict_teletex(): try: NotReallyTeletexString._decoding_encoding = 'teletex' yield finally: NotReallyTeletexString._decoding_encoding = 'cp1252' class DirectoryString(Choice): _alternatives = [ ('teletex_string', NotReallyTeletexString), ('printable_string', PrintableString), ('universal_string', UniversalString), ('utf8_string', UTF8String), ('bmp_string', BMPString), # This is an invalid/bad alternative, but some broken certs use it ('ia5_string', IA5String), ] class NameType(ObjectIdentifier): _map = { '2.5.4.3': 'common_name', '2.5.4.4': 'surname', '2.5.4.5': 'serial_number', '2.5.4.6': 'country_name', '2.5.4.7': 'locality_name', '2.5.4.8': 'state_or_province_name', '2.5.4.9': 'street_address', '2.5.4.10': 'organization_name', '2.5.4.11': 'organizational_unit_name', '2.5.4.12': 'title', '2.5.4.15': 'business_category', '2.5.4.17': 'postal_code', '2.5.4.20': 'telephone_number', '2.5.4.41': 'name', '2.5.4.42': 'given_name', '2.5.4.43': 'initials', '2.5.4.44': 'generation_qualifier', '2.5.4.45': 'unique_identifier', '2.5.4.46': 'dn_qualifier', '2.5.4.65': 'pseudonym', '2.5.4.97': 'organization_identifier', # https://www.trustedcomputinggroup.org/wp-content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf '2.23.133.2.1': 'tpm_manufacturer', '2.23.133.2.2': 'tpm_model', '2.23.133.2.3': 'tpm_version', '2.23.133.2.4': 'platform_manufacturer', '2.23.133.2.5': 'platform_model', '2.23.133.2.6': 'platform_version', # https://tools.ietf.org/html/rfc2985#page-26 '1.2.840.113549.1.9.1': 'email_address', # Page 10 of https://cabforum.org/wp-content/uploads/EV-V1_5_5.pdf '1.3.6.1.4.1.311.60.2.1.1': 'incorporation_locality', '1.3.6.1.4.1.311.60.2.1.2': 'incorporation_state_or_province', '1.3.6.1.4.1.311.60.2.1.3': 'incorporation_country', # https://tools.ietf.org/html/rfc4519#section-2.39 '0.9.2342.19200300.100.1.1': 'user_id', # https://tools.ietf.org/html/rfc2247#section-4 '0.9.2342.19200300.100.1.25': 'domain_component', # http://www.alvestrand.no/objectid/0.2.262.1.10.7.20.html '0.2.262.1.10.7.20': 'name_distinguisher', } # This order is largely based on observed order seen in EV certs from # Symantec and DigiCert. Some of the uncommon name-related fields are # just placed in what seems like a reasonable order. preferred_order = [ 'incorporation_country', 'incorporation_state_or_province', 'incorporation_locality', 'business_category', 'serial_number', 'country_name', 'postal_code', 'state_or_province_name', 'locality_name', 'street_address', 'organization_name', 'organizational_unit_name', 'title', 'common_name', 'user_id', 'initials', 'generation_qualifier', 'surname', 'given_name', 'name', 'pseudonym', 'dn_qualifier', 'telephone_number', 'email_address', 'domain_component', 'name_distinguisher', 'organization_identifier', 'tpm_manufacturer', 'tpm_model', 'tpm_version', 'platform_manufacturer', 'platform_model', 'platform_version', ] @classmethod def preferred_ordinal(cls, attr_name): """ Returns an ordering value for a particular attribute key. Unrecognized attributes and OIDs will be sorted lexically at the end. :return: An orderable value. """ attr_name = cls.map(attr_name) if attr_name in cls.preferred_order: ordinal = cls.preferred_order.index(attr_name) else: ordinal = len(cls.preferred_order) return (ordinal, attr_name) @property def human_friendly(self): """ :return: A human-friendly unicode string to display to users """ return { 'common_name': 'Common Name', 'surname': 'Surname', 'serial_number': 'Serial Number', 'country_name': 'Country', 'locality_name': 'Locality', 'state_or_province_name': 'State/Province', 'street_address': 'Street Address', 'organization_name': 'Organization', 'organizational_unit_name': 'Organizational Unit', 'title': 'Title', 'business_category': 'Business Category', 'postal_code': 'Postal Code', 'telephone_number': 'Telephone Number', 'name': 'Name', 'given_name': 'Given Name', 'initials': 'Initials', 'generation_qualifier': 'Generation Qualifier', 'unique_identifier': 'Unique Identifier', 'dn_qualifier': 'DN Qualifier', 'pseudonym': 'Pseudonym', 'email_address': 'Email Address', 'incorporation_locality': 'Incorporation Locality', 'incorporation_state_or_province': 'Incorporation State/Province', 'incorporation_country': 'Incorporation Country', 'domain_component': 'Domain Component', 'name_distinguisher': 'Name Distinguisher', 'organization_identifier': 'Organization Identifier', 'tpm_manufacturer': 'TPM Manufacturer', 'tpm_model': 'TPM Model', 'tpm_version': 'TPM Version', 'platform_manufacturer': 'Platform Manufacturer', 'platform_model': 'Platform Model', 'platform_version': 'Platform Version', 'user_id': 'User ID', }.get(self.native, self.native) class NameTypeAndValue(Sequence): _fields = [ ('type', NameType), ('value', Any), ] _oid_pair = ('type', 'value') _oid_specs = { 'common_name': DirectoryString, 'surname': DirectoryString, 'serial_number': DirectoryString, 'country_name': DirectoryString, 'locality_name': DirectoryString, 'state_or_province_name': DirectoryString, 'street_address': DirectoryString, 'organization_name': DirectoryString, 'organizational_unit_name': DirectoryString, 'title': DirectoryString, 'business_category': DirectoryString, 'postal_code': DirectoryString, 'telephone_number': PrintableString, 'name': DirectoryString, 'given_name': DirectoryString, 'initials': DirectoryString, 'generation_qualifier': DirectoryString, 'unique_identifier': OctetBitString, 'dn_qualifier': DirectoryString, 'pseudonym': DirectoryString, # https://tools.ietf.org/html/rfc2985#page-26 'email_address': EmailAddress, # Page 10 of https://cabforum.org/wp-content/uploads/EV-V1_5_5.pdf 'incorporation_locality': DirectoryString, 'incorporation_state_or_province': DirectoryString, 'incorporation_country': DirectoryString, 'domain_component': DNSName, 'name_distinguisher': DirectoryString, 'organization_identifier': DirectoryString, 'tpm_manufacturer': UTF8String, 'tpm_model': UTF8String, 'tpm_version': UTF8String, 'platform_manufacturer': UTF8String, 'platform_model': UTF8String, 'platform_version': UTF8String, 'user_id': DirectoryString, } _prepped = None @property def prepped_value(self): """ Returns the value after being processed by the internationalized string preparation as specified by RFC 5280 :return: A unicode string """ if self._prepped is None: self._prepped = self._ldap_string_prep(self['value'].native) return self._prepped def __ne__(self, other): return not self == other def __eq__(self, other): """ Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1 :param other: Another NameTypeAndValue object :return: A boolean """ if not isinstance(other, NameTypeAndValue): return False if other['type'].native != self['type'].native: return False return other.prepped_value == self.prepped_value def _ldap_string_prep(self, string): """ Implements the internationalized string preparation algorithm from RFC 4518. https://tools.ietf.org/html/rfc4518#section-2 :param string: A unicode string to prepare :return: A prepared unicode string, ready for comparison """ # Map step string = re.sub('[\u00ad\u1806\u034f\u180b-\u180d\ufe0f-\uff00\ufffc]+', '', string) string = re.sub('[\u0009\u000a\u000b\u000c\u000d\u0085]', ' ', string) if sys.maxunicode == 0xffff: # Some installs of Python 2.7 don't support 8-digit unicode escape # ranges, so we have to break them into pieces # Original was: \U0001D173-\U0001D17A and \U000E0020-\U000E007F string = re.sub('\ud834[\udd73-\udd7a]|\udb40[\udc20-\udc7f]|\U000e0001', '', string) else: string = re.sub('[\U0001D173-\U0001D17A\U000E0020-\U000E007F\U000e0001]', '', string) string = re.sub( '[\u0000-\u0008\u000e-\u001f\u007f-\u0084\u0086-\u009f\u06dd\u070f\u180e\u200c-\u200f' '\u202a-\u202e\u2060-\u2063\u206a-\u206f\ufeff\ufff9-\ufffb]+', '', string ) string = string.replace('\u200b', '') string = re.sub('[\u00a0\u1680\u2000-\u200a\u2028-\u2029\u202f\u205f\u3000]', ' ', string) string = ''.join(map(stringprep.map_table_b2, string)) # Normalize step string = unicodedata.normalize('NFKC', string) # Prohibit step for char in string: if stringprep.in_table_a1(char): raise ValueError(unwrap( ''' X.509 Name objects may not contain unassigned code points ''' )) if stringprep.in_table_c8(char): raise ValueError(unwrap( ''' X.509 Name objects may not contain change display or zzzzdeprecated characters ''' )) if stringprep.in_table_c3(char): raise ValueError(unwrap( ''' X.509 Name objects may not contain private use characters ''' )) if stringprep.in_table_c4(char): raise ValueError(unwrap( ''' X.509 Name objects may not contain non-character code points ''' )) if stringprep.in_table_c5(char): raise ValueError(unwrap( ''' X.509 Name objects may not contain surrogate code points ''' )) if char == '\ufffd': raise ValueError(unwrap( ''' X.509 Name objects may not contain the replacement character ''' )) # Check bidirectional step - here we ensure that we are not mixing # left-to-right and right-to-left text in the string has_r_and_al_cat = False has_l_cat = False for char in string: if stringprep.in_table_d1(char): has_r_and_al_cat = True elif stringprep.in_table_d2(char): has_l_cat = True if has_r_and_al_cat: first_is_r_and_al = stringprep.in_table_d1(string[0]) last_is_r_and_al = stringprep.in_table_d1(string[-1]) if has_l_cat or not first_is_r_and_al or not last_is_r_and_al: raise ValueError(unwrap( ''' X.509 Name object contains a malformed bidirectional sequence ''' )) # Insignificant space handling step string = ' ' + re.sub(' +', ' ', string).strip() + ' ' return string class RelativeDistinguishedName(SetOf): _child_spec = NameTypeAndValue @property def hashable(self): """ :return: A unicode string that can be used as a dict key or in a set """ output = [] values = self._get_values(self) for key in sorted(values.keys()): output.append('%s: %s' % (key, values[key])) # Unit separator is used here since the normalization process for # values moves any such character, and the keys are all dotted integers # or under_score_words return '\x1F'.join(output) def __ne__(self, other): return not self == other def __eq__(self, other): """ Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1 :param other: Another RelativeDistinguishedName object :return: A boolean """ if not isinstance(other, RelativeDistinguishedName): return False if len(self) != len(other): return False self_types = self._get_types(self) other_types = self._get_types(other) if self_types != other_types: return False self_values = self._get_values(self) other_values = self._get_values(other) for type_name_ in self_types: if self_values[type_name_] != other_values[type_name_]: return False return True def _get_types(self, rdn): """ Returns a set of types contained in an RDN :param rdn: A RelativeDistinguishedName object :return: A set object with unicode strings of NameTypeAndValue type field values """ return set([ntv['type'].native for ntv in rdn]) def _get_values(self, rdn): """ Returns a dict of prepped values contained in an RDN :param rdn: A RelativeDistinguishedName object :return: A dict object with unicode strings of NameTypeAndValue value field values that have been prepped for comparison """ output = {} [output.update([(ntv['type'].native, ntv.prepped_value)]) for ntv in rdn] return output class RDNSequence(SequenceOf): _child_spec = RelativeDistinguishedName @property def hashable(self): """ :return: A unicode string that can be used as a dict key or in a set """ # Record separator is used here since the normalization process for # values moves any such character, and the keys are all dotted integers # or under_score_words return '\x1E'.join(rdn.hashable for rdn in self) def __ne__(self, other): return not self == other def __eq__(self, other): """ Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1 :param other: Another RDNSequence object :return: A boolean """ if not isinstance(other, RDNSequence): return False if len(self) != len(other): return False for index, self_rdn in enumerate(self): if other[index] != self_rdn: return False return True class Name(Choice): _alternatives = [ ('', RDNSequence), ] _human_friendly = None _sha1 = None _sha256 = None @classmethod def build(cls, name_dict, use_printable=False): """ Creates a Name object from a dict of unicode string keys and values. The keys should be from NameType._map, or a dotted-integer OID unicode string. :param name_dict: A dict of name information, e.g. {"common_name": "Will Bond", "country_name": "US", "organization_name": "Codex Non Sufficit LC"} :param use_printable: A bool - if PrintableString should be used for encoding instead of UTF8String. This is for backwards compatibility with old software. :return: An x509.Name object """ rdns = [] if not use_printable: encoding_name = 'utf8_string' encoding_class = UTF8String else: encoding_name = 'printable_string' encoding_class = PrintableString # Sort the attributes according to NameType.preferred_order name_dict = OrderedDict( sorted( name_dict.items(), key=lambda item: NameType.preferred_ordinal(item[0]) ) ) for attribute_name, attribute_value in name_dict.items(): attribute_name = NameType.map(attribute_name) if attribute_name == 'email_address': value = EmailAddress(attribute_value) elif attribute_name == 'domain_component': value = DNSName(attribute_value) elif attribute_name in set(['dn_qualifier', 'country_name', 'serial_number']): value = DirectoryString( name='printable_string', value=PrintableString(attribute_value) ) else: value = DirectoryString( name=encoding_name, value=encoding_class(attribute_value) ) rdns.append(RelativeDistinguishedName([ NameTypeAndValue({ 'type': attribute_name, 'value': value }) ])) return cls(name='', value=RDNSequence(rdns)) @property def hashable(self): """ :return: A unicode string that can be used as a dict key or in a set """ return self.chosen.hashable def __len__(self): return len(self.chosen) def __ne__(self, other): return not self == other def __eq__(self, other): """ Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1 :param other: Another Name object :return: A boolean """ if not isinstance(other, Name): return False return self.chosen == other.chosen @property def native(self): if self._native is None: self._native = OrderedDict() for rdn in self.chosen.native: for type_val in rdn: field_name = type_val['type'] if field_name in self._native: existing = self._native[field_name] if not isinstance(existing, list): existing = self._native[field_name] = [existing] existing.append(type_val['value']) else: self._native[field_name] = type_val['value'] return self._native @property def human_friendly(self): """ :return: A human-friendly unicode string containing the parts of the name """ if self._human_friendly is None: data = OrderedDict() last_field = None for rdn in self.chosen: for type_val in rdn: field_name = type_val['type'].human_friendly last_field = field_name if field_name in data: data[field_name] = [data[field_name]] data[field_name].append(type_val['value']) else: data[field_name] = type_val['value'] to_join = [] keys = data.keys() if last_field == 'Country': keys = reversed(list(keys)) for key in keys: value = data[key] native_value = self._recursive_humanize(value) to_join.append('%s: %s' % (key, native_value)) has_comma = False for element in to_join: if element.find(',') != -1: has_comma = True break separator = ', ' if not has_comma else '; ' self._human_friendly = separator.join(to_join[::-1]) return self._human_friendly def _recursive_humanize(self, value): """ Recursively serializes data compiled from the RDNSequence :param value: An Asn1Value object, or a list of Asn1Value objects :return: A unicode string """ if isinstance(value, list): return ', '.join( reversed([self._recursive_humanize(sub_value) for sub_value in value]) ) return value.native @property def sha1(self): """ :return: The SHA1 hash of the DER-encoded bytes of this name """ if self._sha1 is None: self._sha1 = hashlib.sha1(self.dump()).digest() return self._sha1 @property def sha256(self): """ :return: The SHA-256 hash of the DER-encoded bytes of this name """ if self._sha256 is None: self._sha256 = hashlib.sha256(self.dump()).digest() return self._sha256 class AnotherName(Sequence): _fields = [ ('type_id', ObjectIdentifier), ('value', Any, {'explicit': 0}), ] class CountryName(Choice): class_ = 1 tag = 1 _alternatives = [ ('x121_dcc_code', NumericString), ('iso_3166_alpha2_code', PrintableString), ] class AdministrationDomainName(Choice): class_ = 1 tag = 2 _alternatives = [ ('numeric', NumericString), ('printable', PrintableString), ] class PrivateDomainName(Choice): _alternatives = [ ('numeric', NumericString), ('printable', PrintableString), ] class PersonalName(Set): _fields = [ ('surname', PrintableString, {'implicit': 0}), ('given_name', PrintableString, {'implicit': 1, 'optional': True}), ('initials', PrintableString, {'implicit': 2, 'optional': True}), ('generation_qualifier', PrintableString, {'implicit': 3, 'optional': True}), ] class TeletexPersonalName(Set): _fields = [ ('surname', TeletexString, {'implicit': 0}), ('given_name', TeletexString, {'implicit': 1, 'optional': True}), ('initials', TeletexString, {'implicit': 2, 'optional': True}), ('generation_qualifier', TeletexString, {'implicit': 3, 'optional': True}), ] class OrganizationalUnitNames(SequenceOf): _child_spec = PrintableString class TeletexOrganizationalUnitNames(SequenceOf): _child_spec = TeletexString class BuiltInStandardAttributes(Sequence): _fields = [ ('country_name', CountryName, {'optional': True}), ('administration_domain_name', AdministrationDomainName, {'optional': True}), ('network_address', NumericString, {'implicit': 0, 'optional': True}), ('terminal_identifier', PrintableString, {'implicit': 1, 'optional': True}), ('private_domain_name', PrivateDomainName, {'explicit': 2, 'optional': True}), ('organization_name', PrintableString, {'implicit': 3, 'optional': True}), ('numeric_user_identifier', NumericString, {'implicit': 4, 'optional': True}), ('personal_name', PersonalName, {'implicit': 5, 'optional': True}), ('organizational_unit_names', OrganizationalUnitNames, {'implicit': 6, 'optional': True}), ] class BuiltInDomainDefinedAttribute(Sequence): _fields = [ ('type', PrintableString), ('value', PrintableString), ] class BuiltInDomainDefinedAttributes(SequenceOf): _child_spec = BuiltInDomainDefinedAttribute class TeletexDomainDefinedAttribute(Sequence): _fields = [ ('type', TeletexString), ('value', TeletexString), ] class TeletexDomainDefinedAttributes(SequenceOf): _child_spec = TeletexDomainDefinedAttribute class PhysicalDeliveryCountryName(Choice): _alternatives = [ ('x121_dcc_code', NumericString), ('iso_3166_alpha2_code', PrintableString), ] class PostalCode(Choice): _alternatives = [ ('numeric_code', NumericString), ('printable_code', PrintableString), ] class PDSParameter(Set): _fields = [ ('printable_string', PrintableString, {'optional': True}), ('teletex_string', TeletexString, {'optional': True}), ] class PrintableAddress(SequenceOf): _child_spec = PrintableString class UnformattedPostalAddress(Set): _fields = [ ('printable_address', PrintableAddress, {'optional': True}), ('teletex_string', TeletexString, {'optional': True}), ] class E1634Address(Sequence): _fields = [ ('number', NumericString, {'implicit': 0}), ('sub_address', NumericString, {'implicit': 1, 'optional': True}), ] class NAddresses(SetOf): _child_spec = OctetString class PresentationAddress(Sequence): _fields = [ ('p_selector', OctetString, {'explicit': 0, 'optional': True}), ('s_selector', OctetString, {'explicit': 1, 'optional': True}), ('t_selector', OctetString, {'explicit': 2, 'optional': True}), ('n_addresses', NAddresses, {'explicit': 3}), ] class ExtendedNetworkAddress(Choice): _alternatives = [ ('e163_4_address', E1634Address), ('psap_address', PresentationAddress, {'implicit': 0}) ] class TerminalType(Integer): _map = { 3: 'telex', 4: 'teletex', 5: 'g3_facsimile', 6: 'g4_facsimile', 7: 'ia5_terminal', 8: 'videotex', } class ExtensionAttributeType(Integer): _map = { 1: 'common_name', 2: 'teletex_common_name', 3: 'teletex_organization_name', 4: 'teletex_personal_name', 5: 'teletex_organization_unit_names', 6: 'teletex_domain_defined_attributes', 7: 'pds_name', 8: 'physical_delivery_country_name', 9: 'postal_code', 10: 'physical_delivery_office_name', 11: 'physical_delivery_office_number', 12: 'extension_of_address_components', 13: 'physical_delivery_personal_name', 14: 'physical_delivery_organization_name', 15: 'extension_physical_delivery_address_components', 16: 'unformatted_postal_address', 17: 'street_address', 18: 'post_office_box_address', 19: 'poste_restante_address', 20: 'unique_postal_name', 21: 'local_postal_attributes', 22: 'extended_network_address', 23: 'terminal_type', } class ExtensionAttribute(Sequence): _fields = [ ('extension_attribute_type', ExtensionAttributeType, {'implicit': 0}), ('extension_attribute_value', Any, {'explicit': 1}), ] _oid_pair = ('extension_attribute_type', 'extension_attribute_value') _oid_specs = { 'common_name': PrintableString, 'teletex_common_name': TeletexString, 'teletex_organization_name': TeletexString, 'teletex_personal_name': TeletexPersonalName, 'teletex_organization_unit_names': TeletexOrganizationalUnitNames, 'teletex_domain_defined_attributes': TeletexDomainDefinedAttributes, 'pds_name': PrintableString, 'physical_delivery_country_name': PhysicalDeliveryCountryName, 'postal_code': PostalCode, 'physical_delivery_office_name': PDSParameter, 'physical_delivery_office_number': PDSParameter, 'extension_of_address_components': PDSParameter, 'physical_delivery_personal_name': PDSParameter, 'physical_delivery_organization_name': PDSParameter, 'extension_physical_delivery_address_components': PDSParameter, 'unformatted_postal_address': UnformattedPostalAddress, 'street_address': PDSParameter, 'post_office_box_address': PDSParameter, 'poste_restante_address': PDSParameter, 'unique_postal_name': PDSParameter, 'local_postal_attributes': PDSParameter, 'extended_network_address': ExtendedNetworkAddress, 'terminal_type': TerminalType, } class ExtensionAttributes(SequenceOf): _child_spec = ExtensionAttribute class ORAddress(Sequence): _fields = [ ('built_in_standard_attributes', BuiltInStandardAttributes), ('built_in_domain_defined_attributes', BuiltInDomainDefinedAttributes, {'optional': True}), ('extension_attributes', ExtensionAttributes, {'optional': True}), ] class EDIPartyName(Sequence): _fields = [ ('name_assigner', DirectoryString, {'implicit': 0, 'optional': True}), ('party_name', DirectoryString, {'implicit': 1}), ] class GeneralName(Choice): _alternatives = [ ('other_name', AnotherName, {'implicit': 0}), ('rfc822_name', EmailAddress, {'implicit': 1}), ('dns_name', DNSName, {'implicit': 2}), ('x400_address', ORAddress, {'implicit': 3}), ('directory_name', Name, {'explicit': 4}), ('edi_party_name', EDIPartyName, {'implicit': 5}), ('uniform_resource_identifier', URI, {'implicit': 6}), ('ip_address', IPAddress, {'implicit': 7}), ('registered_id', ObjectIdentifier, {'implicit': 8}), ] def __ne__(self, other): return not self == other def __eq__(self, other): """ Does not support other_name, x400_address or edi_party_name :param other: The other GeneralName to compare to :return: A boolean """ if self.name in ('other_name', 'x400_address', 'edi_party_name'): raise ValueError(unwrap( ''' Comparison is not supported for GeneralName objects of choice %s ''', self.name )) if other.name in ('other_name', 'x400_address', 'edi_party_name'): raise ValueError(unwrap( ''' Comparison is not supported for GeneralName objects of choice %s''', other.name )) if self.name != other.name: return False return self.chosen == other.chosen class GeneralNames(SequenceOf): _child_spec = GeneralName class Time(Choice): _alternatives = [ ('utc_time', UTCTime), ('general_time', GeneralizedTime), ] class Validity(Sequence): _fields = [ ('not_before', Time), ('not_after', Time), ] class BasicConstraints(Sequence): _fields = [ ('ca', Boolean, {'default': False}), ('path_len_constraint', Integer, {'optional': True}), ] class AuthorityKeyIdentifier(Sequence): _fields = [ ('key_identifier', OctetString, {'implicit': 0, 'optional': True}), ('authority_cert_issuer', GeneralNames, {'implicit': 1, 'optional': True}), ('authority_cert_serial_number', Integer, {'implicit': 2, 'optional': True}), ] class DistributionPointName(Choice): _alternatives = [ ('full_name', GeneralNames, {'implicit': 0}), ('name_relative_to_crl_issuer', RelativeDistinguishedName, {'implicit': 1}), ] class ReasonFlags(BitString): _map = { 0: 'unused', 1: 'key_compromise', 2: 'ca_compromise', 3: 'affiliation_changed', 4: 'superseded', 5: 'cessation_of_operation', 6: 'certificate_hold', 7: 'privilege_withdrawn', 8: 'aa_compromise', } class GeneralSubtree(Sequence): _fields = [ ('base', GeneralName), ('minimum', Integer, {'implicit': 0, 'default': 0}), ('maximum', Integer, {'implicit': 1, 'optional': True}), ] class GeneralSubtrees(SequenceOf): _child_spec = GeneralSubtree class NameConstraints(Sequence): _fields = [ ('permitted_subtrees', GeneralSubtrees, {'implicit': 0, 'optional': True}), ('excluded_subtrees', GeneralSubtrees, {'implicit': 1, 'optional': True}), ] class DistributionPoint(Sequence): _fields = [ ('distribution_point', DistributionPointName, {'explicit': 0, 'optional': True}), ('reasons', ReasonFlags, {'implicit': 1, 'optional': True}), ('crl_issuer', GeneralNames, {'implicit': 2, 'optional': True}), ] _url = False @property def url(self): """ :return: None or a unicode string of the distribution point's URL """ if self._url is False: self._url = None name = self['distribution_point'] if name.name != 'full_name': raise ValueError(unwrap( ''' CRL distribution points that are relative to the issuer are not supported ''' )) for general_name in name.chosen: if general_name.name == 'uniform_resource_identifier': url = general_name.native if url.lower().startswith(('http://', 'https://', 'ldap://', 'ldaps://')): self._url = url break return self._url class CRLDistributionPoints(SequenceOf): _child_spec = DistributionPoint class DisplayText(Choice): _alternatives = [ ('ia5_string', IA5String), ('visible_string', VisibleString), ('bmp_string', BMPString), ('utf8_string', UTF8String), ] class NoticeNumbers(SequenceOf): _child_spec = Integer class NoticeReference(Sequence): _fields = [ ('organization', DisplayText), ('notice_numbers', NoticeNumbers), ] class UserNotice(Sequence): _fields = [ ('notice_ref', NoticeReference, {'optional': True}), ('explicit_text', DisplayText, {'optional': True}), ] class PolicyQualifierId(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.2.1': 'certification_practice_statement', '1.3.6.1.5.5.7.2.2': 'user_notice', } class PolicyQualifierInfo(Sequence): _fields = [ ('policy_qualifier_id', PolicyQualifierId), ('qualifier', Any), ] _oid_pair = ('policy_qualifier_id', 'qualifier') _oid_specs = { 'certification_practice_statement': IA5String, 'user_notice': UserNotice, } class PolicyQualifierInfos(SequenceOf): _child_spec = PolicyQualifierInfo class PolicyIdentifier(ObjectIdentifier): _map = { '2.5.29.32.0': 'any_policy', } class PolicyInformation(Sequence): _fields = [ ('policy_identifier', PolicyIdentifier), ('policy_qualifiers', PolicyQualifierInfos, {'optional': True}) ] class CertificatePolicies(SequenceOf): _child_spec = PolicyInformation class PolicyMapping(Sequence): _fields = [ ('issuer_domain_policy', PolicyIdentifier), ('subject_domain_policy', PolicyIdentifier), ] class PolicyMappings(SequenceOf): _child_spec = PolicyMapping class PolicyConstraints(Sequence): _fields = [ ('require_explicit_policy', Integer, {'implicit': 0, 'optional': True}), ('inhibit_policy_mapping', Integer, {'implicit': 1, 'optional': True}), ] class KeyPurposeId(ObjectIdentifier): _map = { # https://tools.ietf.org/html/rfc5280#page-45 '2.5.29.37.0': 'any_extended_key_usage', '1.3.6.1.5.5.7.3.1': 'server_auth', '1.3.6.1.5.5.7.3.2': 'client_auth', '1.3.6.1.5.5.7.3.3': 'code_signing', '1.3.6.1.5.5.7.3.4': 'email_protection', '1.3.6.1.5.5.7.3.5': 'ipsec_end_system', '1.3.6.1.5.5.7.3.6': 'ipsec_tunnel', '1.3.6.1.5.5.7.3.7': 'ipsec_user', '1.3.6.1.5.5.7.3.8': 'time_stamping', '1.3.6.1.5.5.7.3.9': 'ocsp_signing', # http://tools.ietf.org/html/rfc3029.html#page-9 '1.3.6.1.5.5.7.3.10': 'dvcs', # http://tools.ietf.org/html/rfc6268.html#page-16 '1.3.6.1.5.5.7.3.13': 'eap_over_ppp', '1.3.6.1.5.5.7.3.14': 'eap_over_lan', # https://tools.ietf.org/html/rfc5055#page-76 '1.3.6.1.5.5.7.3.15': 'scvp_server', '1.3.6.1.5.5.7.3.16': 'scvp_client', # https://tools.ietf.org/html/rfc4945#page-31 '1.3.6.1.5.5.7.3.17': 'ipsec_ike', # https://tools.ietf.org/html/rfc5415#page-38 '1.3.6.1.5.5.7.3.18': 'capwap_ac', '1.3.6.1.5.5.7.3.19': 'capwap_wtp', # https://tools.ietf.org/html/rfc5924#page-8 '1.3.6.1.5.5.7.3.20': 'sip_domain', # https://tools.ietf.org/html/rfc6187#page-7 '1.3.6.1.5.5.7.3.21': 'secure_shell_client', '1.3.6.1.5.5.7.3.22': 'secure_shell_server', # https://tools.ietf.org/html/rfc6494#page-7 '1.3.6.1.5.5.7.3.23': 'send_router', '1.3.6.1.5.5.7.3.24': 'send_proxied_router', '1.3.6.1.5.5.7.3.25': 'send_owner', '1.3.6.1.5.5.7.3.26': 'send_proxied_owner', # https://tools.ietf.org/html/rfc6402#page-10 '1.3.6.1.5.5.7.3.27': 'cmc_ca', '1.3.6.1.5.5.7.3.28': 'cmc_ra', '1.3.6.1.5.5.7.3.29': 'cmc_archive', # https://tools.ietf.org/html/draft-ietf-sidr-bgpsec-pki-profiles-15#page-6 '1.3.6.1.5.5.7.3.30': 'bgpspec_router', # https://www.ietf.org/proceedings/44/I-D/draft-ietf-ipsec-pki-req-01.txt '1.3.6.1.5.5.8.2.2': 'ike_intermediate', # https://msdn.microsoft.com/en-us/library/windows/desktop/aa378132(v=vs.85).aspx # and https://support.microsoft.com/en-us/kb/287547 '1.3.6.1.4.1.311.10.3.1': 'microsoft_trust_list_signing', '1.3.6.1.4.1.311.10.3.2': 'microsoft_time_stamp_signing', '1.3.6.1.4.1.311.10.3.3': 'microsoft_server_gated', '1.3.6.1.4.1.311.10.3.3.1': 'microsoft_serialized', '1.3.6.1.4.1.311.10.3.4': 'microsoft_efs', '1.3.6.1.4.1.311.10.3.4.1': 'microsoft_efs_recovery', '1.3.6.1.4.1.311.10.3.5': 'microsoft_whql', '1.3.6.1.4.1.311.10.3.6': 'microsoft_nt5', '1.3.6.1.4.1.311.10.3.7': 'microsoft_oem_whql', '1.3.6.1.4.1.311.10.3.8': 'microsoft_embedded_nt', '1.3.6.1.4.1.311.10.3.9': 'microsoft_root_list_signer', '1.3.6.1.4.1.311.10.3.10': 'microsoft_qualified_subordination', '1.3.6.1.4.1.311.10.3.11': 'microsoft_key_recovery', '1.3.6.1.4.1.311.10.3.12': 'microsoft_document_signing', '1.3.6.1.4.1.311.10.3.13': 'microsoft_lifetime_signing', '1.3.6.1.4.1.311.10.3.14': 'microsoft_mobile_device_software', # https://support.microsoft.com/en-us/help/287547/object-ids-associated-with-microsoft-cryptography '1.3.6.1.4.1.311.20.2.2': 'microsoft_smart_card_logon', # https://opensource.apple.com/source # - /Security/Security-57031.40.6/Security/libsecurity_keychain/lib/SecPolicy.cpp # - /libsecurity_cssm/libsecurity_cssm-36064/lib/oidsalg.c '1.2.840.113635.100.1.2': 'apple_x509_basic', '1.2.840.113635.100.1.3': 'apple_ssl', '1.2.840.113635.100.1.4': 'apple_local_cert_gen', '1.2.840.113635.100.1.5': 'apple_csr_gen', '1.2.840.113635.100.1.6': 'apple_revocation_crl', '1.2.840.113635.100.1.7': 'apple_revocation_ocsp', '1.2.840.113635.100.1.8': 'apple_smime', '1.2.840.113635.100.1.9': 'apple_eap', '1.2.840.113635.100.1.10': 'apple_software_update_signing', '1.2.840.113635.100.1.11': 'apple_ipsec', '1.2.840.113635.100.1.12': 'apple_ichat', '1.2.840.113635.100.1.13': 'apple_resource_signing', '1.2.840.113635.100.1.14': 'apple_pkinit_client', '1.2.840.113635.100.1.15': 'apple_pkinit_server', '1.2.840.113635.100.1.16': 'apple_code_signing', '1.2.840.113635.100.1.17': 'apple_package_signing', '1.2.840.113635.100.1.18': 'apple_id_validation', '1.2.840.113635.100.1.20': 'apple_time_stamping', '1.2.840.113635.100.1.21': 'apple_revocation', '1.2.840.113635.100.1.22': 'apple_passbook_signing', '1.2.840.113635.100.1.23': 'apple_mobile_store', '1.2.840.113635.100.1.24': 'apple_escrow_service', '1.2.840.113635.100.1.25': 'apple_profile_signer', '1.2.840.113635.100.1.26': 'apple_qa_profile_signer', '1.2.840.113635.100.1.27': 'apple_test_mobile_store', '1.2.840.113635.100.1.28': 'apple_otapki_signer', '1.2.840.113635.100.1.29': 'apple_test_otapki_signer', '1.2.840.113625.100.1.30': 'apple_id_validation_record_signing_policy', '1.2.840.113625.100.1.31': 'apple_smp_encryption', '1.2.840.113625.100.1.32': 'apple_test_smp_encryption', '1.2.840.113635.100.1.33': 'apple_server_authentication', '1.2.840.113635.100.1.34': 'apple_pcs_escrow_service', # http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.201-2.pdf '2.16.840.1.101.3.6.8': 'piv_card_authentication', '2.16.840.1.101.3.6.7': 'piv_content_signing', # https://tools.ietf.org/html/rfc4556.html '1.3.6.1.5.2.3.4': 'pkinit_kpclientauth', '1.3.6.1.5.2.3.5': 'pkinit_kpkdc', # https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSig/changes.html '1.2.840.113583.1.1.5': 'adobe_authentic_documents_trust', # https://www.idmanagement.gov/wp-content/uploads/sites/1171/uploads/fpki-pivi-cert-profiles.pdf '2.16.840.1.101.3.8.7': 'fpki_pivi_content_signing' } class ExtKeyUsageSyntax(SequenceOf): _child_spec = KeyPurposeId class AccessMethod(ObjectIdentifier): _map = { '1.3.6.1.5.5.7.48.1': 'ocsp', '1.3.6.1.5.5.7.48.2': 'ca_issuers', '1.3.6.1.5.5.7.48.3': 'time_stamping', '1.3.6.1.5.5.7.48.5': 'ca_repository', } class AccessDescription(Sequence): _fields = [ ('access_method', AccessMethod), ('access_location', GeneralName), ] class AuthorityInfoAccessSyntax(SequenceOf): _child_spec = AccessDescription class SubjectInfoAccessSyntax(SequenceOf): _child_spec = AccessDescription # https://tools.ietf.org/html/rfc7633 class Features(SequenceOf): _child_spec = Integer class EntrustVersionInfo(Sequence): _fields = [ ('entrust_vers', GeneralString), ('entrust_info_flags', BitString) ] class NetscapeCertificateType(BitString): _map = { 0: 'ssl_client', 1: 'ssl_server', 2: 'email', 3: 'object_signing', 4: 'reserved', 5: 'ssl_ca', 6: 'email_ca', 7: 'object_signing_ca', } class Version(Integer): _map = { 0: 'v1', 1: 'v2', 2: 'v3', } class TPMSpecification(Sequence): _fields = [ ('family', UTF8String), ('level', Integer), ('revision', Integer), ] class SetOfTPMSpecification(SetOf): _child_spec = TPMSpecification class TCGSpecificationVersion(Sequence): _fields = [ ('major_version', Integer), ('minor_version', Integer), ('revision', Integer), ] class TCGPlatformSpecification(Sequence): _fields = [ ('version', TCGSpecificationVersion), ('platform_class', OctetString), ] class SetOfTCGPlatformSpecification(SetOf): _child_spec = TCGPlatformSpecification class EKGenerationType(Enumerated): _map = { 0: 'internal', 1: 'injected', 2: 'internal_revocable', 3: 'injected_revocable', } class EKGenerationLocation(Enumerated): _map = { 0: 'tpm_manufacturer', 1: 'platform_manufacturer', 2: 'ek_cert_signer', } class EKCertificateGenerationLocation(Enumerated): _map = { 0: 'tpm_manufacturer', 1: 'platform_manufacturer', 2: 'ek_cert_signer', } class EvaluationAssuranceLevel(Enumerated): _map = { 1: 'level1', 2: 'level2', 3: 'level3', 4: 'level4', 5: 'level5', 6: 'level6', 7: 'level7', } class EvaluationStatus(Enumerated): _map = { 0: 'designed_to_meet', 1: 'evaluation_in_progress', 2: 'evaluation_completed', } class StrengthOfFunction(Enumerated): _map = { 0: 'basic', 1: 'medium', 2: 'high', } class URIReference(Sequence): _fields = [ ('uniform_resource_identifier', IA5String), ('hash_algorithm', DigestAlgorithm, {'optional': True}), ('hash_value', BitString, {'optional': True}), ] class CommonCriteriaMeasures(Sequence): _fields = [ ('version', IA5String), ('assurance_level', EvaluationAssuranceLevel), ('evaluation_status', EvaluationStatus), ('plus', Boolean, {'default': False}), ('strengh_of_function', StrengthOfFunction, {'implicit': 0, 'optional': True}), ('profile_oid', ObjectIdentifier, {'implicit': 1, 'optional': True}), ('profile_url', URIReference, {'implicit': 2, 'optional': True}), ('target_oid', ObjectIdentifier, {'implicit': 3, 'optional': True}), ('target_uri', URIReference, {'implicit': 4, 'optional': True}), ] class SecurityLevel(Enumerated): _map = { 1: 'level1', 2: 'level2', 3: 'level3', 4: 'level4', } class FIPSLevel(Sequence): _fields = [ ('version', IA5String), ('level', SecurityLevel), ('plus', Boolean, {'default': False}), ] class TPMSecurityAssertions(Sequence): _fields = [ ('version', Version, {'default': 'v1'}), ('field_upgradable', Boolean, {'default': False}), ('ek_generation_type', EKGenerationType, {'implicit': 0, 'optional': True}), ('ek_generation_location', EKGenerationLocation, {'implicit': 1, 'optional': True}), ('ek_certificate_generation_location', EKCertificateGenerationLocation, {'implicit': 2, 'optional': True}), ('cc_info', CommonCriteriaMeasures, {'implicit': 3, 'optional': True}), ('fips_level', FIPSLevel, {'implicit': 4, 'optional': True}), ('iso_9000_certified', Boolean, {'implicit': 5, 'default': False}), ('iso_9000_uri', IA5String, {'optional': True}), ] class SetOfTPMSecurityAssertions(SetOf): _child_spec = TPMSecurityAssertions class SubjectDirectoryAttributeId(ObjectIdentifier): _map = { # https://tools.ietf.org/html/rfc2256#page-11 '2.5.4.52': 'supported_algorithms', # https://www.trustedcomputinggroup.org/wp-content/uploads/Credential_Profile_EK_V2.0_R14_published.pdf '2.23.133.2.16': 'tpm_specification', '2.23.133.2.17': 'tcg_platform_specification', '2.23.133.2.18': 'tpm_security_assertions', # https://tools.ietf.org/html/rfc3739#page-18 '1.3.6.1.5.5.7.9.1': 'pda_date_of_birth', '1.3.6.1.5.5.7.9.2': 'pda_place_of_birth', '1.3.6.1.5.5.7.9.3': 'pda_gender', '1.3.6.1.5.5.7.9.4': 'pda_country_of_citizenship', '1.3.6.1.5.5.7.9.5': 'pda_country_of_residence', # https://holtstrom.com/michael/tools/asn1decoder.php '1.2.840.113533.7.68.29': 'entrust_user_role', } class SetOfGeneralizedTime(SetOf): _child_spec = GeneralizedTime class SetOfDirectoryString(SetOf): _child_spec = DirectoryString class SetOfPrintableString(SetOf): _child_spec = PrintableString class SupportedAlgorithm(Sequence): _fields = [ ('algorithm_identifier', AnyAlgorithmIdentifier), ('intended_usage', KeyUsage, {'explicit': 0, 'optional': True}), ('intended_certificate_policies', CertificatePolicies, {'explicit': 1, 'optional': True}), ] class SetOfSupportedAlgorithm(SetOf): _child_spec = SupportedAlgorithm class SubjectDirectoryAttribute(Sequence): _fields = [ ('type', SubjectDirectoryAttributeId), ('values', Any), ] _oid_pair = ('type', 'values') _oid_specs = { 'supported_algorithms': SetOfSupportedAlgorithm, 'tpm_specification': SetOfTPMSpecification, 'tcg_platform_specification': SetOfTCGPlatformSpecification, 'tpm_security_assertions': SetOfTPMSecurityAssertions, 'pda_date_of_birth': SetOfGeneralizedTime, 'pda_place_of_birth': SetOfDirectoryString, 'pda_gender': SetOfPrintableString, 'pda_country_of_citizenship': SetOfPrintableString, 'pda_country_of_residence': SetOfPrintableString, } def _values_spec(self): type_ = self['type'].native if type_ in self._oid_specs: return self._oid_specs[type_] return SetOf _spec_callbacks = { 'values': _values_spec } class SubjectDirectoryAttributes(SequenceOf): _child_spec = SubjectDirectoryAttribute class ExtensionId(ObjectIdentifier): _map = { '2.5.29.9': 'subject_directory_attributes', '2.5.29.14': 'key_identifier', '2.5.29.15': 'key_usage', '2.5.29.16': 'private_key_usage_period', '2.5.29.17': 'subject_alt_name', '2.5.29.18': 'issuer_alt_name', '2.5.29.19': 'basic_constraints', '2.5.29.30': 'name_constraints', '2.5.29.31': 'crl_distribution_points', '2.5.29.32': 'certificate_policies', '2.5.29.33': 'policy_mappings', '2.5.29.35': 'authority_key_identifier', '2.5.29.36': 'policy_constraints', '2.5.29.37': 'extended_key_usage', '2.5.29.46': 'freshest_crl', '2.5.29.54': 'inhibit_any_policy', '1.3.6.1.5.5.7.1.1': 'authority_information_access', '1.3.6.1.5.5.7.1.11': 'subject_information_access', # https://tools.ietf.org/html/rfc7633 '1.3.6.1.5.5.7.1.24': 'tls_feature', '1.3.6.1.5.5.7.48.1.5': 'ocsp_no_check', '1.2.840.113533.7.65.0': 'entrust_version_extension', '2.16.840.1.113730.1.1': 'netscape_certificate_type', # https://tools.ietf.org/html/rfc6962.html#page-14 '1.3.6.1.4.1.11129.2.4.2': 'signed_certificate_timestamp_list', # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wcce/3aec3e50-511a-42f9-a5d5-240af503e470 '1.3.6.1.4.1.311.20.2': 'microsoft_enroll_certtype', } class Extension(Sequence): _fields = [ ('extn_id', ExtensionId), ('critical', Boolean, {'default': False}), ('extn_value', ParsableOctetString), ] _oid_pair = ('extn_id', 'extn_value') _oid_specs = { 'subject_directory_attributes': SubjectDirectoryAttributes, 'key_identifier': OctetString, 'key_usage': KeyUsage, 'private_key_usage_period': PrivateKeyUsagePeriod, 'subject_alt_name': GeneralNames, 'issuer_alt_name': GeneralNames, 'basic_constraints': BasicConstraints, 'name_constraints': NameConstraints, 'crl_distribution_points': CRLDistributionPoints, 'certificate_policies': CertificatePolicies, 'policy_mappings': PolicyMappings, 'authority_key_identifier': AuthorityKeyIdentifier, 'policy_constraints': PolicyConstraints, 'extended_key_usage': ExtKeyUsageSyntax, 'freshest_crl': CRLDistributionPoints, 'inhibit_any_policy': Integer, 'authority_information_access': AuthorityInfoAccessSyntax, 'subject_information_access': SubjectInfoAccessSyntax, 'tls_feature': Features, 'ocsp_no_check': Null, 'entrust_version_extension': EntrustVersionInfo, 'netscape_certificate_type': NetscapeCertificateType, 'signed_certificate_timestamp_list': OctetString, # Not UTF8String as Microsofts docs claim, see: # https://www.alvestrand.no/objectid/1.3.6.1.4.1.311.20.2.html 'microsoft_enroll_certtype': BMPString, } class Extensions(SequenceOf): _child_spec = Extension class TbsCertificate(Sequence): _fields = [ ('version', Version, {'explicit': 0, 'default': 'v1'}), ('serial_number', Integer), ('signature', SignedDigestAlgorithm), ('issuer', Name), ('validity', Validity), ('subject', Name), ('subject_public_key_info', PublicKeyInfo), ('issuer_unique_id', OctetBitString, {'implicit': 1, 'optional': True}), ('subject_unique_id', OctetBitString, {'implicit': 2, 'optional': True}), ('extensions', Extensions, {'explicit': 3, 'optional': True}), ] class Certificate(Sequence): _fields = [ ('tbs_certificate', TbsCertificate), ('signature_algorithm', SignedDigestAlgorithm), ('signature_value', OctetBitString), ] _processed_extensions = False _critical_extensions = None _subject_directory_attributes_value = None _key_identifier_value = None _key_usage_value = None _subject_alt_name_value = None _issuer_alt_name_value = None _basic_constraints_value = None _name_constraints_value = None _crl_distribution_points_value = None _certificate_policies_value = None _policy_mappings_value = None _authority_key_identifier_value = None _policy_constraints_value = None _freshest_crl_value = None _inhibit_any_policy_value = None _extended_key_usage_value = None _authority_information_access_value = None _subject_information_access_value = None _private_key_usage_period_value = None _tls_feature_value = None _ocsp_no_check_value = None _issuer_serial = None _authority_issuer_serial = False _crl_distribution_points = None _delta_crl_distribution_points = None _valid_domains = None _valid_ips = None _self_issued = None _self_signed = None _sha1 = None _sha256 = None def _set_extensions(self): """ Sets common named extensions to private attributes and creates a list of critical extensions """ self._critical_extensions = set() for extension in self['tbs_certificate']['extensions']: name = extension['extn_id'].native attribute_name = '_%s_value' % name if hasattr(self, attribute_name): setattr(self, attribute_name, extension['extn_value'].parsed) if extension['critical'].native: self._critical_extensions.add(name) self._processed_extensions = True @property def critical_extensions(self): """ Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings """ if not self._processed_extensions: self._set_extensions() return self._critical_extensions @property def private_key_usage_period_value(self): """ This extension is used to constrain the period over which the subject private key may be used :return: None or a PrivateKeyUsagePeriod object """ if not self._processed_extensions: self._set_extensions() return self._private_key_usage_period_value @property def subject_directory_attributes_value(self): """ This extension is used to contain additional identification attributes about the subject. :return: None or a SubjectDirectoryAttributes object """ if not self._processed_extensions: self._set_extensions() return self._subject_directory_attributes_value @property def key_identifier_value(self): """ This extension is used to help in creating certificate validation paths. It contains an identifier that should generally, but is not guaranteed to, be unique. :return: None or an OctetString object """ if not self._processed_extensions: self._set_extensions() return self._key_identifier_value @property def key_usage_value(self): """ This extension is used to define the purpose of the public key contained within the certificate. :return: None or a KeyUsage """ if not self._processed_extensions: self._set_extensions() return self._key_usage_value @property def subject_alt_name_value(self): """ This extension allows for additional names to be associate with the subject of the certificate. While it may contain a whole host of possible names, it is usually used to allow certificates to be used with multiple different domain names. :return: None or a GeneralNames object """ if not self._processed_extensions: self._set_extensions() return self._subject_alt_name_value @property def issuer_alt_name_value(self): """ This extension allows associating one or more alternative names with the issuer of the certificate. :return: None or an x509.GeneralNames object """ if not self._processed_extensions: self._set_extensions() return self._issuer_alt_name_value @property def basic_constraints_value(self): """ This extension is used to determine if the subject of the certificate is a CA, and if so, what the maximum number of intermediate CA certs after this are, before an end-entity certificate is found. :return: None or a BasicConstraints object """ if not self._processed_extensions: self._set_extensions() return self._basic_constraints_value @property def name_constraints_value(self): """ This extension is used in CA certificates, and is used to limit the possible names of certificates issued. :return: None or a NameConstraints object """ if not self._processed_extensions: self._set_extensions() return self._name_constraints_value @property def crl_distribution_points_value(self): """ This extension is used to help in locating the CRL for this certificate. :return: None or a CRLDistributionPoints object extension """ if not self._processed_extensions: self._set_extensions() return self._crl_distribution_points_value @property def certificate_policies_value(self): """ This extension defines policies in CA certificates under which certificates may be issued. In end-entity certificates, the inclusion of a policy indicates the issuance of the certificate follows the policy. :return: None or a CertificatePolicies object """ if not self._processed_extensions: self._set_extensions() return self._certificate_policies_value @property def policy_mappings_value(self): """ This extension allows mapping policy OIDs to other OIDs. This is used to allow different policies to be treated as equivalent in the process of validation. :return: None or a PolicyMappings object """ if not self._processed_extensions: self._set_extensions() return self._policy_mappings_value @property def authority_key_identifier_value(self): """ This extension helps in identifying the public key with which to validate the authenticity of the certificate. :return: None or an AuthorityKeyIdentifier object """ if not self._processed_extensions: self._set_extensions() return self._authority_key_identifier_value @property def policy_constraints_value(self): """ This extension is used to control if policy mapping is allowed and when policies are required. :return: None or a PolicyConstraints object """ if not self._processed_extensions: self._set_extensions() return self._policy_constraints_value @property def freshest_crl_value(self): """ This extension is used to help locate any available delta CRLs :return: None or an CRLDistributionPoints object """ if not self._processed_extensions: self._set_extensions() return self._freshest_crl_value @property def inhibit_any_policy_value(self): """ This extension is used to prevent mapping of the any policy to specific requirements :return: None or a Integer object """ if not self._processed_extensions: self._set_extensions() return self._inhibit_any_policy_value @property def extended_key_usage_value(self): """ This extension is used to define additional purposes for the public key beyond what is contained in the basic constraints. :return: None or an ExtKeyUsageSyntax object """ if not self._processed_extensions: self._set_extensions() return self._extended_key_usage_value @property def authority_information_access_value(self): """ This extension is used to locate the CA certificate used to sign this certificate, or the OCSP responder for this certificate. :return: None or an AuthorityInfoAccessSyntax object """ if not self._processed_extensions: self._set_extensions() return self._authority_information_access_value @property def subject_information_access_value(self): """ This extension is used to access information about the subject of this certificate. :return: None or a SubjectInfoAccessSyntax object """ if not self._processed_extensions: self._set_extensions() return self._subject_information_access_value @property def tls_feature_value(self): """ This extension is used to list the TLS features a server must respond with if a client initiates a request supporting them. :return: None or a Features object """ if not self._processed_extensions: self._set_extensions() return self._tls_feature_value @property def ocsp_no_check_value(self): """ This extension is used on certificates of OCSP responders, indicating that revocation information for the certificate should never need to be verified, thus preventing possible loops in path validation. :return: None or a Null object (if present) """ if not self._processed_extensions: self._set_extensions() return self._ocsp_no_check_value @property def signature(self): """ :return: A byte string of the signature """ return self['signature_value'].native @property def signature_algo(self): """ :return: A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa" """ return self['signature_algorithm'].signature_algo @property def hash_algo(self): """ :return: A unicode string of "md2", "md5", "sha1", "sha224", "sha256", "sha384", "sha512", "sha512_224", "sha512_256" """ return self['signature_algorithm'].hash_algo @property def public_key(self): """ :return: The PublicKeyInfo object for this certificate """ return self['tbs_certificate']['subject_public_key_info'] @property def subject(self): """ :return: The Name object for the subject of this certificate """ return self['tbs_certificate']['subject'] @property def issuer(self): """ :return: The Name object for the issuer of this certificate """ return self['tbs_certificate']['issuer'] @property def serial_number(self): """ :return: An integer of the certificate's serial number """ return self['tbs_certificate']['serial_number'].native @property def key_identifier(self): """ :return: None or a byte string of the certificate's key identifier from the key identifier extension """ if not self.key_identifier_value: return None return self.key_identifier_value.native @property def issuer_serial(self): """ :return: A byte string of the SHA-256 hash of the issuer concatenated with the ascii character ":", concatenated with the serial number as an ascii string """ if self._issuer_serial is None: self._issuer_serial = self.issuer.sha256 + b':' + str_cls(self.serial_number).encode('ascii') return self._issuer_serial @property def not_valid_after(self): """ :return: A datetime of latest time when the certificate is still valid """ return self['tbs_certificate']['validity']['not_after'].native @property def not_valid_before(self): """ :return: A datetime of the earliest time when the certificate is valid """ return self['tbs_certificate']['validity']['not_before'].native @property def authority_key_identifier(self): """ :return: None or a byte string of the key_identifier from the authority key identifier extension """ if not self.authority_key_identifier_value: return None return self.authority_key_identifier_value['key_identifier'].native @property def authority_issuer_serial(self): """ :return: None or a byte string of the SHA-256 hash of the isser from the authority key identifier extension concatenated with the ascii character ":", concatenated with the serial number from the authority key identifier extension as an ascii string """ if self._authority_issuer_serial is False: akiv = self.authority_key_identifier_value if akiv and akiv['authority_cert_issuer'].native: issuer = self.authority_key_identifier_value['authority_cert_issuer'][0].chosen # We untag the element since it is tagged via being a choice from GeneralName issuer = issuer.untag() authority_serial = self.authority_key_identifier_value['authority_cert_serial_number'].native self._authority_issuer_serial = issuer.sha256 + b':' + str_cls(authority_serial).encode('ascii') else: self._authority_issuer_serial = None return self._authority_issuer_serial @property def crl_distribution_points(self): """ Returns complete CRL URLs - does not include delta CRLs :return: A list of zero or more DistributionPoint objects """ if self._crl_distribution_points is None: self._crl_distribution_points = self._get_http_crl_distribution_points(self.crl_distribution_points_value) return self._crl_distribution_points @property def delta_crl_distribution_points(self): """ Returns delta CRL URLs - does not include complete CRLs :return: A list of zero or more DistributionPoint objects """ if self._delta_crl_distribution_points is None: self._delta_crl_distribution_points = self._get_http_crl_distribution_points(self.freshest_crl_value) return self._delta_crl_distribution_points def _get_http_crl_distribution_points(self, crl_distribution_points): """ Fetches the DistributionPoint object for non-relative, HTTP CRLs referenced by the certificate :param crl_distribution_points: A CRLDistributionPoints object to grab the DistributionPoints from :return: A list of zero or more DistributionPoint objects """ output = [] if crl_distribution_points is None: return [] for distribution_point in crl_distribution_points: distribution_point_name = distribution_point['distribution_point'] if distribution_point_name is VOID: continue # RFC 5280 indicates conforming CA should not use the relative form if distribution_point_name.name == 'name_relative_to_crl_issuer': continue # This library is currently only concerned with HTTP-based CRLs for general_name in distribution_point_name.chosen: if general_name.name == 'uniform_resource_identifier': output.append(distribution_point) return output @property def ocsp_urls(self): """ :return: A list of zero or more unicode strings of the OCSP URLs for this cert """ if not self.authority_information_access_value: return [] output = [] for entry in self.authority_information_access_value: if entry['access_method'].native == 'ocsp': location = entry['access_location'] if location.name != 'uniform_resource_identifier': continue url = location.native if url.lower().startswith(('http://', 'https://', 'ldap://', 'ldaps://')): output.append(url) return output @property def valid_domains(self): """ :return: A list of unicode strings of valid domain names for the certificate. Wildcard certificates will have a domain in the form: *.example.com """ if self._valid_domains is None: self._valid_domains = [] # For the subject alt name extension, we can look at the name of # the choice selected since it distinguishes between domain names, # email addresses, IPs, etc if self.subject_alt_name_value: for general_name in self.subject_alt_name_value: if general_name.name == 'dns_name' and general_name.native not in self._valid_domains: self._valid_domains.append(general_name.native) # If there was no subject alt name extension, and the common name # in the subject looks like a domain, that is considered the valid # list. This is done because according to # https://tools.ietf.org/html/rfc6125#section-6.4.4, the common # name should not be used if the subject alt name is present. else: pattern = re.compile('^(\\*\\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\\-]*[a-zA-Z0-9])?\\.)+[a-zA-Z]{2,}$') for rdn in self.subject.chosen: for name_type_value in rdn: if name_type_value['type'].native == 'common_name': value = name_type_value['value'].native if pattern.match(value): self._valid_domains.append(value) return self._valid_domains @property def valid_ips(self): """ :return: A list of unicode strings of valid IP addresses for the certificate """ if self._valid_ips is None: self._valid_ips = [] if self.subject_alt_name_value: for general_name in self.subject_alt_name_value: if general_name.name == 'ip_address': self._valid_ips.append(general_name.native) return self._valid_ips @property def ca(self): """ :return; A boolean - if the certificate is marked as a CA """ return self.basic_constraints_value and self.basic_constraints_value['ca'].native @property def max_path_length(self): """ :return; None or an integer of the maximum path length """ if not self.ca: return None return self.basic_constraints_value['path_len_constraint'].native @property def self_issued(self): """ :return: A boolean - if the certificate is self-issued, as defined by RFC 5280 """ if self._self_issued is None: self._self_issued = self.subject == self.issuer return self._self_issued @property def self_signed(self): """ :return: A unicode string of "no" or "maybe". The "maybe" result will be returned if the certificate issuer and subject are the same. If a key identifier and authority key identifier are present, they will need to match otherwise "no" will be returned. To verify is a certificate is truly self-signed, the signature will need to be verified. See the certvalidator package for one possible solution. """ if self._self_signed is None: self._self_signed = 'no' if self.self_issued: if self.key_identifier: if not self.authority_key_identifier: self._self_signed = 'maybe' elif self.authority_key_identifier == self.key_identifier: self._self_signed = 'maybe' else: self._self_signed = 'maybe' return self._self_signed @property def sha1(self): """ :return: The SHA-1 hash of the DER-encoded bytes of this complete certificate """ if self._sha1 is None: self._sha1 = hashlib.sha1(self.dump()).digest() return self._sha1 @property def sha1_fingerprint(self): """ :return: A unicode string of the SHA-1 hash, formatted using hex encoding with a space between each pair of characters, all uppercase """ return ' '.join('%02X' % c for c in bytes_to_list(self.sha1)) @property def sha256(self): """ :return: The SHA-256 hash of the DER-encoded bytes of this complete certificate """ if self._sha256 is None: self._sha256 = hashlib.sha256(self.dump()).digest() return self._sha256 @property def sha256_fingerprint(self): """ :return: A unicode string of the SHA-256 hash, formatted using hex encoding with a space between each pair of characters, all uppercase """ return ' '.join('%02X' % c for c in bytes_to_list(self.sha256)) def is_valid_domain_ip(self, domain_ip): """ Check if a domain name or IP address is valid according to the certificate :param domain_ip: A unicode string of a domain name or IP address :return: A boolean - if the domain or IP is valid for the certificate """ if not isinstance(domain_ip, str_cls): raise TypeError(unwrap( ''' domain_ip must be a unicode string, not %s ''', type_name(domain_ip) )) encoded_domain_ip = domain_ip.encode('idna').decode('ascii').lower() is_ipv6 = encoded_domain_ip.find(':') != -1 is_ipv4 = not is_ipv6 and re.match('^\\d+\\.\\d+\\.\\d+\\.\\d+$', encoded_domain_ip) is_domain = not is_ipv6 and not is_ipv4 # Handle domain name checks if is_domain: if not self.valid_domains: return False domain_labels = encoded_domain_ip.split('.') for valid_domain in self.valid_domains: encoded_valid_domain = valid_domain.encode('idna').decode('ascii').lower() valid_domain_labels = encoded_valid_domain.split('.') # The domain must be equal in label length to match if len(valid_domain_labels) != len(domain_labels): continue if valid_domain_labels == domain_labels: return True is_wildcard = self._is_wildcard_domain(encoded_valid_domain) if is_wildcard and self._is_wildcard_match(domain_labels, valid_domain_labels): return True return False # Handle IP address checks if not self.valid_ips: return False family = socket.AF_INET if is_ipv4 else socket.AF_INET6 normalized_ip = inet_pton(family, encoded_domain_ip) for valid_ip in self.valid_ips: valid_family = socket.AF_INET if valid_ip.find('.') != -1 else socket.AF_INET6 normalized_valid_ip = inet_pton(valid_family, valid_ip) if normalized_valid_ip == normalized_ip: return True return False def _is_wildcard_domain(self, domain): """ Checks if a domain is a valid wildcard according to https://tools.ietf.org/html/rfc6125#section-6.4.3 :param domain: A unicode string of the domain name, where any U-labels from an IDN have been converted to A-labels :return: A boolean - if the domain is a valid wildcard domain """ # The * character must be present for a wildcard match, and if there is # most than one, it is an invalid wildcard specification if domain.count('*') != 1: return False labels = domain.lower().split('.') if not labels: return False # Wildcards may only appear in the left-most label if labels[0].find('*') == -1: return False # Wildcards may not be embedded in an A-label from an IDN if labels[0][0:4] == 'xn--': return False return True def _is_wildcard_match(self, domain_labels, valid_domain_labels): """ Determines if the labels in a domain are a match for labels from a wildcard valid domain name :param domain_labels: A list of unicode strings, with A-label form for IDNs, of the labels in the domain name to check :param valid_domain_labels: A list of unicode strings, with A-label form for IDNs, of the labels in a wildcard domain pattern :return: A boolean - if the domain matches the valid domain """ first_domain_label = domain_labels[0] other_domain_labels = domain_labels[1:] wildcard_label = valid_domain_labels[0] other_valid_domain_labels = valid_domain_labels[1:] # The wildcard is only allowed in the first label, so if # The subsequent labels are not equal, there is no match if other_domain_labels != other_valid_domain_labels: return False if wildcard_label == '*': return True wildcard_regex = re.compile('^' + wildcard_label.replace('*', '.*') + '$') if wildcard_regex.match(first_domain_label): return True return False # The structures are taken from the OpenSSL source file x_x509a.c, and specify # extra information that is added to X.509 certificates to store trust # information about the certificate. class KeyPurposeIdentifiers(SequenceOf): _child_spec = KeyPurposeId class SequenceOfAlgorithmIdentifiers(SequenceOf): _child_spec = AlgorithmIdentifier class CertificateAux(Sequence): _fields = [ ('trust', KeyPurposeIdentifiers, {'optional': True}), ('reject', KeyPurposeIdentifiers, {'implicit': 0, 'optional': True}), ('alias', UTF8String, {'optional': True}), ('keyid', OctetString, {'optional': True}), ('other', SequenceOfAlgorithmIdentifiers, {'implicit': 1, 'optional': True}), ] class TrustedCertificate(Concat): _child_specs = [Certificate, CertificateAux] __pycache__/__init__.cpython-312.pyc000064400000002334152572326550013234 0ustar00 ui:ddlmZmZmZmZddlmZmZgdZdZ y))unicode_literalsdivisionabsolute_importprint_function) __version____version_info__)rr load_orderc gdS)a+ Returns a list of the module and sub-module names for asn1crypto in dependency load order, for the sake of live reloading code :return: A list of unicode strings of module names, as they would appear in sys.modules, ordered by which module should be reloaded first )zasn1crypto._errorszasn1crypto._intzasn1crypto._ordereddictzasn1crypto._teletex_codeczasn1crypto._typeszasn1crypto._inetzasn1crypto._irizasn1crypto.versionzasn1crypto.pemzasn1crypto.utilzasn1crypto.parserzasn1crypto.corezasn1crypto.algoszasn1crypto.keyszasn1crypto.x509zasn1crypto.crlzasn1crypto.csrzasn1crypto.ocspzasn1crypto.cmszasn1crypto.pdfzasn1crypto.pkcs12zasn1crypto.tsp asn1cryptor D/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/__init__.pyr r s  rN) __future__rrrrversionrr __all__r r rrrsRR2 "r__pycache__/_errors.cpython-312.pyc000064400000002734152572326550013154 0ustar00 ui.LdZddlmZmZmZmZddlZddlZGddeZ dZ y)z= Exports the following items: - unwrap() - APIException() )unicode_literalsdivisionabsolute_importprint_functionNceZdZdZy) APIExceptionzI An exception indicating an API has been removed from asn1crypto N)__name__ __module__ __qualname____doc__C/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/_errors.pyrrs  rrctj|}|jddk7rtjdd|}|r||z}|j }|S)a_ Takes a multi-line string and does the following: - dedents - converts newlines with text before and after into a single line - strips leading and trailing whitespace :param string: The string to format :param *params: Params to interpolate into the string :return: The formatted string  z(?<=\S) (?=[^ \d\*\-=]) )textwrapdedentfindresubstrip)stringparamsoutputs runwraprsT$__V $F{{4B:CH & \\^F Mr) r __future__rrrrrr Exceptionrrr rrr s*SR  9 r__pycache__/_inet.cpython-312.pyc000064400000012725152572326550012600 0ustar00 ui5\ddlmZmZmZmZddlZddlZddlmZddl m Z m Z m Z m Z dZdZy))unicode_literalsdivisionabsolute_importprint_functionN)unwrap)byte_cls bytes_to_liststr_cls type_namec |ttjtjgvrNt t dt tjt tjt |t|tstt dt||tjk(rdnd}t||k7rt t d|t||tjk(rdtt|zStjd|}i}d}d }t!|d zD]/\}}|dk7r |||z } | |vr||| <t#|| }d }+|.|}1|D cgc]} t%| d d } } |d krd j'| S||} | |z} d j'| d | d zd j'| | d zScc} w)a Windows compatibility shim for socket.inet_ntop(). :param address_family: socket.AF_INET for IPv4 or socket.AF_INET6 for IPv6 :param packed_ip: A byte string of the network form of an IP address :return: A unicode string of the IP address p address_family must be socket.AF_INET (%s) or socket.AF_INET6 (%s), not %s zA packed_ip must be a byte string, not %s zA packed_ip must be %d bytes long - is %d z %d.%d.%d.%d !HHHHHHHHrN):::)setsocketAF_INETAF_INET6 ValueErrorrrepr isinstancer TypeErrorr lentupler structunpack enumeratemaxhexjoin)address_family packed_ip required_lenoctets runs_of_zero longest_run zero_indexioctetlengthohexed zero_startzero_ends A/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/_inet.py inet_ntopr5 sS&..&//!BCC    !      i *  i    '&..81bL 9~%    N    'u]9%=>>> ]]< 3FLKJfun-5 A:%Z-+5L(!+v6 !  J."( (ASVABZE (Qxxk*JK'H 88E+:& '$ .% :J1K KK )s6Gc |ttjtjgvrNt t dt tjt tjt |t|tstt dt||tjk(r|jd}t|dk7}|s3g}|D],}t|}|dkDs|dkrd}n|j|.|rt t dt |tj d gSd }|j#d }|d kDrd}n|dk(r |jd }t|dk7}n\|jd \}}|jd } |jd } dt| z t| z } | dg| zz| z}|sJg}D]-}t|d}|dkDs|dkrd}n|j|/tj dg|St t dt |)a Windows compatibility shim for socket.inet_ntop(). :param address_family: socket.AF_INET for IPv4 or socket.AF_INET6 for IPv6 :param ip_string: A unicode string of an IP address :return: A byte string of the network form of the IP address rzD ip_string must be a unicode string, not %s .rrTz ip_string must be a dotted string with four integers in the range of 0 to 255, got %s s!BBBBFrrr0rirz? ip_string must be a valid ipv6 string, got %s )rrrrrrrrr rr splitrintappendr packcount) r& ip_stringr)errorintsr0omittedbeginend begin_octets end_octetsmissings r4 inet_ptonrITs;S&..&//!BCC    !      i )  i    '%F q DFs7a!e E A  VY  {{8+d++ Eood#G{ A%F q __T* s{{3' YYs^ c,''#j/9#1J> AAr A5yAE KKN {{</$// V  Y  ) __future__rrrrrr _errorsr_typesr r r r r5rIrJr4rOs(RR ??FLRVrJ__pycache__/_int.cpython-312.pyc000064400000001434152572326550012426 0ustar00 ui"ddlmZmZmZmZdZy))unicode_literalsdivisionabsolute_importprint_functioncJt||krd|z}t||kr|S)a  Ensure a byte string representing a positive integer is a specific width (in bytes) :param bytes_: The integer byte string :param width: The desired width as an integer :return: A byte string of the width specified )len)bytes_widths @/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/_int.py fill_widthr s- f+ 6! f+  MN) __future__rrrrr rr rsRRr__pycache__/_iri.cpython-312.pyc000064400000023057152572326550012424 0ustar00 ui"dZddlmZmZmZmZddlmZddlZddl Z ddl Z ddl m Z ddl mZmZmZmZmZe j&dkrdd lmZmZdd lmZmZn dd lmZmZmZmZdd Zd ZdZej@deddZ!ddZ"y)z Functions to convert unicode IRIs into ASCII byte string URIs and back. Exports the following items: - iri_to_uri() - uri_to_iri() )unicode_literalsdivisionabsolute_importprint_function)idnaN)unwrap)byte_clsstr_cls type_name bytes_to_list int_types))urlsplit urlunsplit)quoteunquote)runquote_to_bytesrrcZt|tsttdt |d}t j dkr|jdsq|jds`d}tjd|}|r"|jd}d|t|dz}t|}|r"||ddz}t|dd }n t|}|t|j}|j}||j!d }t|j"d }t|j$d }|j&} | t| j!d } d} || |z } |r| d|zz } | dz } || |z } | &|dk(xr| dk(} |dk(xr| dk(} |r| s | s| d| zz } t|j(d } t|j*d }t|j,d }|r | || dk(rd} | d} t/|| | ||f}t|tr|j!d}|S)z Encodes a unicode IRI into an ASCII byte string URI :param value: A unicode string of an IRI :param normalize: A bool that controls URI normalization :return: A byte string of the ASCII-encoded URI z@ value must be a unicode string, not %s N)zhttp://zhttps://z ^[^:]*://rrrz !$&'()*+,;=safeascii:@shttps80shttpss443z/!$&'()*+,;=@:z/?!$&'()*+,;=@:/latin1) isinstancer TypeErrorr r sys version_info startswithrematchgrouplenr _urlquoteschemehostnameencodeusernamepasswordportpathqueryfragmentr)value normalizer, real_prefix prefix_matchparsedr-r/r0r1netloc default_http default_httpsr2r3r4outputs @/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/_iri.py iri_to_urir?%sS eW %  e     F & )9)9))DUM]M]^hMi xx U3 &,,Q/Kc+&6&7 88E% %)+E{3B/0F% ~6==)H??6*~>H~>H ;;D t}##G, F(  dXo %F$( (:TU] (*=tv~ m dTk !F V[['8 9D fll); uri_to_irirJxsd eX &  e     e_F ]]F w'6??3*=H6??3*=HH??6* ;;D JtY/{{7# F(  cHn $F# ( # %% v{{3%$ ?D  S#J FE6??+H vvtUH= >>rct|j|j|j}|Dcgc]}d|z }}dj ||jfScc}w)a> Error handler for decoding UTF-8 parts of a URI into an IRI. Leaves byte sequences encoded in %XX format, but as part of a unicode string. :param exc: The UnicodeDecodeError exception :return: A 2-element tuple of (replacement unicode string, integer index to resume at) %%%02xr )r objectstartendjoin)exc bytes_as_intsnum replacementss r>_iri_utf8_errors_handlerrUsV"#**SYYsww"?@M.; _try_unescapez _urlquote.._try_unescapesW*5;;q>:K(//CN!$Z !/!7!7 8cR[nC\!](! !rz(?:%[0-9a-fA-F]{2})+cdj|jdjdy)Nrr)appendr)r.)r(escapess r>_extract_escapez"_urlquote.._extract_escapes% NN5;;q>009 :rrYrrrc&jdS)Nr)pop)_rds r>_return_escapez!_urlquote.._return_escapes;;q> !rs%00)r'searchsuburlquoter.r"r r*)stringrr`rer=rirds ` @r>r+r+s~2G yy"F+ " . vF )?FC fmmG,4;;w3G HF fh 'w' 7|a "7 Mrc||S|dk(ry|rSgd}i}|D]H}|jd}|||<|j|jd|jd}Jt|}|rC|D]>}|j|jddt |zjd}@|j dd}|r*j D]\}}|j||}|S) a Unquotes a URI portion from a byte string into unicode using UTF-8 :param byte_string: A byte string of the data to unquote :param remap: A list of characters (as unicode) that should be re-mapped to a %XX encoding. This is used when characters are not valid in part of a URL. :param preserve: A bool - indicates that the chars to be remapped if they occur in non-hex form, should be preserved. E.g. / for URL path. :return: A unicode string rr )rrrLrYrV)rgr[r.rr\rHitems) r]rCrErTpreserve_unmapchar replacementr=originals r>rIrIs(c? D&**1-K*.N; '%--dkk'.BKDVDVW^D_`K #;/K D%--dkk'.BXPSTXPYEYDaDabiDjkK   3F%3%9%9%; !K^^K:F&< Mr)F)r )NN)#__doc__ __future__rrrr encodingsrcodecsr'r$_errorsr _typesr r r r rr%urlparserrurllibrrlrr urllib.parser?rJrUregister_errorr+rIrr>rsSR JJd- Pf1?h,$i!9:1h.r__pycache__/_ordereddict.cpython-312.pyc000064400000012663152572326550014132 0ustar00 ui\ddlZejdksddlmZyddlmZGddeeZy)N)) OrderedDict) DictMixinc.eZdZdZdZdZdZdZdZddZ dZ d Z e jZ e jZe jZe j Ze j"Ze j$Ze j&Ze j(Zd Zd Zedd ZdZdZy )rct|dkDrtdt|z |j|j |i|y#t$r|j Y.wxYw)Nz$expected at most 1 arguments, got %d)len TypeError_OrderedDict__endAttributeErrorclearupdate)selfargskwdss H/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/_ordereddict.py__init__zOrderedDict.__init__#s]4y1} FT RSS   DKK & &"   s AA"!A"c^gx|_}|d||gz }i|_tj|yN)r _OrderedDict__mapdictr)rends rrzOrderedDict.clear,s2! !DJ D#s# #CDJ JJt c||vr-|j}|d}|||gx|d<x|d<|j|<tj|||y)Nr r)r rr __setitem__)rkeyvaluercurrs rrzOrderedDict.__setitem__2sS$jj1v6945EEQE#a&4::c?   T3 .rctj|||jj|\}}}||d<||d<y)Nrr )r __delitem__rpop)rrprevnext_s rr!zOrderedDict.__delitem__9s=   T3 '#zz~~c2 CuDGE!Hrc#ZK|j}|d}||ur|d|d}||uryyw)Nrrr rrrs r__iter__zOrderedDict.__iter__?:**Cq6Dc/1g Awc/&++c#ZK|j}|d}||ur|d|d}||uryyw)Nr rr&r's r __reversed__zOrderedDict.__reversed__Fr)r*c|s td|rt|j}nt|j}|j |}||fS)Nzdictionary is empty)KeyErrorreversednextiterr")rlastrrs rpopitemzOrderedDict.popitemMsM455tn))+4joo'HHSME: rc|Dcgc] }|||g }}|j|jf}|`|`t|j}|\|_|_|r|j|f|fS|j|ffScc}wr)rr varscopy __class__)rkitemstmp inst_dicts r __reduce__zOrderedDict.__reduce__Ws+/04aaa\4E0**djj(C DJT )I%( "DJ )<<>>E8+ +1sA:ct|Sr)listrs rkeyszOrderedDict.keysas : rc|s|jjdS|jjd|jdS)Nz()())r7__name__r9r?s r__repr__zOrderedDict.__repr__ms3!%!8!8::#~~66 E Erc$|j|Sr)r7r?s rr6zOrderedDict.copyrs>>$' 'rNc,|}|D]}|||< |Sr)clsiterablerdrs rfromkeyszOrderedDict.fromkeysus!A# Hrct|trPt|t|k7ryt|j |j D] \}}||k7s yyt j ||S)NFT) isinstancerr zipr9r__eq__)rotherpqs rrPzOrderedDict.__eq__|s`%-t9E *  ekkmrbs0.  & '#f%dIf%r__pycache__/_teletex_codec.cpython-312.pyc000064400000007266152572326550014454 0ustar00 ui2dZddlmZmZmZmZddlZGddejZGddejZ Gdd ejZ Gd d eejZGd d eejZdZdZdZej(eZy)zW Implementation of the teletex T.61 codec. Exports the following items: - register() )unicode_literalsdivisionabsolute_importprint_functionNceZdZddZddZy) TeletexCodecc8tj||tSN)codecscharmap_encodeENCODING_TABLEselfinput_errorss J/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/_teletex_codec.pyencodezTeletexCodec.encode$$VV^DDc8tj||tSr )r charmap_decodeDECODING_TABLErs rdecodezTeletexCodec.decoderrN)strict)__name__ __module__ __qualname__rrrrrrsEErrceZdZddZy)TeletexIncrementalEncodercRtj||jtdSNr)r r rr rrfinals rrz TeletexIncrementalEncoder.encode $$VT[[.I!LLrNF)rrrrrrrr r Mrr ceZdZddZy)TeletexIncrementalDecodercRtj||jtdSr")r rrrr#s rrz TeletexIncrementalDecoder.decoder%rNr&)rrrrrrrr)r)r'rr)c eZdZy)TeletexStreamWriterNrrrrrrr,r,#rr,c eZdZy)TeletexStreamReaderNr-rrrr0r0(r.rr0c |dk7rytjdtjtjt t ttS)zO Search function for teletex codec that is passed to codecs.register() teletexN)namerrincrementalencoderincrementaldecoder streamreader streamwriter) r CodecInforrrr r)r0r,)r3s rteletex_search_functionr9-sG  y    ~$$~$$44(( rc6tjty)z% Registers the teletex codec N)r registerr9rrrr;r;@s  OO+,ru  !"￾￾%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[￾]￾_￾abcdefghijklmnopqrstuvwxyz￾|￾￾€‚ƒ„…†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ ¡¢£$¥#§¤￾￾«￾￾￾￾°±²³×µ¶·÷￾￾»¼½¾¿￾̀́̂̃̄̆̇̈￾̧̨̲̊̋̌￾￾￾￾￾￾￾￾￾￾￾￾￾￾￾￾ΩÆЪĦ￾IJĿŁØŒºÞŦŊʼnĸæđðħıijŀłøœßþŧŋ￾)__doc__ __future__rrrrr CodecrIncrementalEncoderr IncrementalDecoderr) StreamWriterr, StreamReaderr0r9r;r charmap_buildr rrrrDs SR E6<<EM 9 9M M 9 9M  ,(;(;  ,(;(; &- D&%%n5r__pycache__/_types.cpython-312.pyc000064400000003040152572326550012773 0ustar00 uiddlmZmZmZmZddlZddlZejdkreZ e Z e e fZdZeZdZye Z eZ e ZeZdZdZy))unicode_literalsdivisionabsolute_importprint_functionN)c>|Dcgc] }t|c}Scc}wN)ord) byte_stringbs B/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/_types.py bytes_to_listr s +, 1A ,,,sct|gSr )bytes)nums r chr_clsrscU|ctj|r|}n |j}|jt ddgvr |j S|jd|j S)z Returns a user-readable name for the type of an object :param value: A value to get the type name of :return: A unicode string of the object's type name builtins __builtin__.)inspectisclass __class__ __module__set__name__)valueclss r type_namer sQuoo ~~j-899||nncll 33r) __future__rrrrrsys version_infounicodestr_clsstrbyte_clsintlong int_typesrchrrrlistr rr r.seRR dGHd I-G4GHIM4r__pycache__/algos.cpython-312.pyc000064400000100677152572326550012613 0ustar00 uidZddlmZmZmZmZddlmZddlm Z ddl m Z m Z ddl mZmZmZmZmZmZmZmZGdd eZGd d eZGd d eZGddeZGddeZGddeeZGddeZGddeZGddeZGddeZ GddeZ!GddeZ"Gd d!eeZ#Gd"d#eZ$Gd$d%eZ%Gd&d'eZ&Gd(d)eZ'Gd*d+eZ(Gd,d-eZ)Gd.d/eZ*Gd0d1eZ+Gd2d3eZ,Gd4d5eZ-Gd6d7eZ.Gd8d9eZ/Gd:d;eZ0Gd<d=eZ1Gd>d?eZ2Gd@dAeZ3GdBdCeZ4GdDdEeeZ5GdFdGeZ6GdHdIeZ7GdJdKeZ8GdLdMeZ9e6e5jtdN<GdOdPeZ;GdQdReeZ>8 8 $++Dt&t,,   # #t'7'7 7Krrctt| ||}|dk7r|S|dj|jvr|S|dj t k7r|St|d<|S)Nrr)superr! __setitem__r1r2 __class__rr)r3keyvalueresr9s rr8z _ForceNullParameters.__setitem___sk($;CG + J   # #4+;+; ;J   ' '4 /J!V\ r) rrr__doc__setr2r5_spec_callbacksr8 __classcell__)r9s@rr!r!2s7  K  &O  rr!c *eZdZddddddddd d d d d Zy)HmacAlgorithmIddes_macsha1sha224sha256sha384sha512 sha512_224 sha512_256sha3_224sha3_256sha3_384sha3_512) z 1.3.14.3.2.10z1.2.840.113549.2.7z1.2.840.113549.2.8z1.2.840.113549.2.9z1.2.840.113549.2.10z1.2.840.113549.2.11z1.2.840.113549.2.12z1.2.840.113549.2.13z2.16.840.1.101.3.4.2.13z2.16.840.1.101.3.4.2.14z2.16.840.1.101.3.4.2.15z2.16.840.1.101.3.4.2.16Nrrr_maprrrrBrBks-"$&&''++#-#-#-#- DrrBc"eZdZdefdeddifgZy) HmacAlgorithmrrrTN)rrrrBr rrrrrRrR|s o& sZ./GrrRcveZdZiddddddddd d d d d ddddddddddddddddddd d!d"Zy#)$DigestAlgorithmIdz1.2.840.113549.2.2md2z1.2.840.113549.2.5md5r'rDr(rEr)rFr*rGr+rHz2.16.840.1.101.3.4.2.5rIz2.16.840.1.101.3.4.2.6rJz2.16.840.1.101.3.4.2.7rKz2.16.840.1.101.3.4.2.8rLz2.16.840.1.101.3.4.2.9rMz2.16.840.1.101.3.4.2.10rNz2.16.840.1.101.3.4.2.11shake128z2.16.840.1.101.3.4.2.12shake256z2.16.840.1.101.3.4.2.17 shake128_lenz2.16.840.1.101.3.4.2.18 shake256_lenNrOrrrrTrTs e e    !(   !(   !(   !(  !,  !,  !*  !*  !*  ":  ":  ":  ">! " "># DrrTc"eZdZdefdeddifgZy)DigestAlgorithmrrrTN)rrrrTr rrrrr\r\s! '( sZ./Grr\ceZdZdefdefgZy) DigestInfodigest_algorithmdigestN)rrrr\rrrrrr^r^s _- ;Grr^ceZdZddiZy)MaskGenAlgorithmIdz1.2.840.113549.1.1.8mgf1NrOrrrrbrbs Drrbc.eZdZdefdeddifgZdZdeiZy)MaskGenAlgorithmrrrTr-rcN) rrrrbr rr.r\r0rrrreres4 () sZ./G ,IJrreceZdZddiZy) TrailerFieldrtrailer_field_bcNrOrrrrgrgs  DrrgcVeZdZdedddidfdeddddid dfd ed d dfd edddfgZy)RSASSAPSSParamshash_algorithmrrrDexplicitdefaultmask_gen_algorithmrrcr- salt_length trailer_fieldrhN)rrrr\rerrgrrrrrjrjs{  '0   ! !'#."7        -  9$GrrjceZdZiddddddddddd dd d d d ddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+ Zid'd,d(d-ddddd&d.dddddddd dddd/d d dddd0d d d d1ddd2dd3d4d5d6d7d8d9Zy:);SignedDigestAlgorithmIdz 1.3.14.3.2.3md5_rsaz 1.3.14.3.2.29sha1_rsaz1.3.14.7.2.3.1md2_rsaz1.2.840.113549.1.1.2z1.2.840.113549.1.1.4z1.2.840.113549.1.1.5r& sha224_rsar# sha256_rsar$ sha384_rsar% sha512_rsaz1.2.840.113549.1.1.10 rsassa_pssz1.2.840.10040.4.3sha1_dsaz 1.3.14.3.2.13z 1.3.14.3.2.27z2.16.840.1.101.3.4.3.1 sha224_dsaz2.16.840.1.101.3.4.3.2 sha256_dsaz1.2.840.10045.4.1 sha1_ecdsa sha224_ecdsa sha256_ecdsa sha384_ecdsa sha512_ecdsasha3_224_ecdsasha3_256_ecdsasha3_384_ecdsasha3_512_ecdsarsassa_pkcs1v15dsaecdsaed25519ed448) 1.2.840.10045.4.3.11.2.840.10045.4.3.21.2.840.10045.4.3.31.2.840.10045.4.3.42.16.840.1.101.3.4.3.92.16.840.1.101.3.4.3.102.16.840.1.101.3.4.3.112.16.840.1.101.3.4.3.12r"1.2.840.10040.4.11.2.840.10045.4 1.3.101.112 1.3.101.113rrr"rrrrrrrrrr)rr}rrrrrrN)rrrrP _reverse_maprrrrvrvs!  ! !  )!   !   !   !  !  !  !  !  !  Z!  !  !  !,!  !,!! " \#! $ .---"2#3#3#3 1"" A! DF "" ) )  1  -  ' ) * . - - . - - -!" -#$.-2333 3LrrvcNeZdZdefdeddifgZdZdeiZe dZ e dZ y ) SignedDigestAlgorithmrrrTr-r~c |dj}iddddddddddddd dddd d d d d d dd d d ddddddddddddddddd}||vr||Sttd|)z :return: A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa", "ed25519" or "ed448" rryrrwrxrzr{r|r}r~rrrrrrrrrrr)rrrrrrrrz> Signature algorithm not known for %s r/ ValueErrorrr3ralgo_maps rsignature_algoz$SignedDigestAlgorithm.signature_algo4s=%,,  ( (  )  +  +  +   +  0  ,    %  %  5  '  G G! " G# $$%%%% 3 6  I& &      rc|dj}idddddddd d d d d dddddd dd dddd dd dd dddddd}||vr||S|dk(r|dddjSttd|)z :return: A unicode string of "md2", "md5", "sha1", "sha224", "sha256", "sha384", "sha512", "sha512_224", "sha512_256" or "shake256" rryrUrwrVrxrDrzrEr{rFr|rGr}rHrrrrrrrrrrrXr~rrkz9 Hash algorithm not known for %s rrs r hash_algozSignedDigestAlgorithm.hash_algocs:%,,  u u    (  (  (   (    (  (  &  H  H  H  H x! " Z# &  I& &  $ %&67 DKK K      rN) rrrrvr rr.rjr0propertyrrrrrrr)s] -. sZ./G ,IoJ, , \' ' rrceZdZdefdefgZy) Pbkdf2Salt specified other_sourceN)rrrrr _alternativesrrrrrs k" ,-Mrrc8eZdZdefdefdeddifdeddd iifgZy ) Pbkdf2Paramssaltiteration_count key_lengthrTprfrnrrDN)rrrrrrRrrrrrrs<  G$ wT 23  K+@AB GrrceZdZddiZy)KdfAlgorithmIdz1.2.840.113549.1.5.12pbkdf2NrOrrrrr Drrc.eZdZdefdeddifgZdZdeiZy) KdfAlgorithmrrrTr-rN) rrrrr rr.rr0rrrrrs3 n% sZ./G,I,Jrrc,eZdZdZdefdefdeddifgZy) DHParameterszn Original Name: DHParameter Source: ftp://ftp.rsasecurity.com/pub/pkcs/ascii/pkcs-3.asc section 9 pgprivate_value_lengthrTN)rrrr=rrrrrrrs- g g :t*<=GrrceZdZddiZy)KeyExchangeAlgorithmIdz1.2.840.113549.1.3.1dhNrOrrrrrs Drrc.eZdZdefdeddifgZdZdeiZy)KeyExchangeAlgorithmrrrTr-rN) rrrrr rr.rr0rrrrrs4 ,- sZ./G,I lJrrc"eZdZdeddifdefgZy) Rc2Paramsrc2_parameter_versionrTivN)rrrrrrrrrrrs 'J+=> {GrrceZdZddiZy)Rc5ParamVersionzv1-0NrOrrrrrs F Drrc.eZdZdefdefdefdeddifgZy) Rc5Paramsversionroundsblock_size_in_bitsrrTN)rrrrrrrrrrrrs0 O$ 7 w' {Z./ GrrceZdZdefdefgZy) Pbes1Paramsr iterationsNrrrrrrrrrrrs  wGrrceZdZdefdefgZy) CcmParams aes_nonce aes_icvlenNrrrrrrs k" wGrrceZdZddiZy)PSourceAlgorithmIdz1.2.840.113549.1.1.9 p_specifiedNrOrrrrrs  Drrc.eZdZdefdeddifgZdZdeiZy)PSourceAlgorithmrrrTr-rN) rrrrr rr.rr0rrrrrs4 () sZ./G ,I{JrrcNeZdZdedddidfdeddddid dfd ed d d d dfgZy)RSAESOAEPParamsrkrrrDrlrorrcr-p_source_algorithmrqrrN)rrrr\rerrrrrrrsk  '0   ! !'#."7   ! !."%  )Grrc6eZdZdZdefdefgZedZdZy) DSASignaturea  An ASN.1 class for translating between the OS crypto library's representation of an (EC)DSA signature and the ASN.1 structure that is part of various RFCs. Original Name: DSS-Sig-Value Source: https://tools.ietf.org/html/rfc3279#section-2.2.2 rsct|dt|dz}t|t|dzd}|||dS)a Reads a signature from a byte string encoding accordint to IEEE P1363, which is used by Microsoft's BCryptSignHash() function. :param data: A byte string from BCryptSignHash() :return: A DSASignature object rrqN)rr)r len)clsdatarrs r from_p1363zDSASignature.from_p13637sF 4#d)q.1 2 4D Q0 1#$$rct|dj}t|dj}tt|t|}t ||}t ||}||zS)z Dumps a signature to a byte string compatible with Microsoft's BCryptVerifySignature() function. :return: A byte string compatible with BCryptVerifySignature() rr)r r/maxrr )r3r_bytess_bytesint_byte_lengths rto_p1363zDSASignature.to_p1363HsctCy//0tCy//0c'lCL9Wo6Wo6  rN) rrrr=rr classmethodrrrrrrr(s7 g gG %% !rrc eZdZiddddddddd d d d d ddddddddddddddddddd d!d"id#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdO ZyP)QEncryptionAlgorithmIdz 1.3.14.3.2.7desz1.2.840.113549.3.7tripledes_3keyz1.2.840.113549.3.2rc2z1.2.840.113549.3.4rc4z1.2.840.113549.3.9rc5z2.16.840.1.101.3.4.1.1 aes128_ecbz2.16.840.1.101.3.4.1.2 aes128_cbcz2.16.840.1.101.3.4.1.3 aes128_ofbz2.16.840.1.101.3.4.1.4 aes128_cfbz2.16.840.1.101.3.4.1.5 aes128_wrapz2.16.840.1.101.3.4.1.6 aes128_gcmz2.16.840.1.101.3.4.1.7 aes128_ccmz2.16.840.1.101.3.4.1.8aes128_wrap_padz2.16.840.1.101.3.4.1.21 aes192_ecbz2.16.840.1.101.3.4.1.22 aes192_cbcz2.16.840.1.101.3.4.1.23 aes192_ofbz2.16.840.1.101.3.4.1.24 aes192_cfbz2.16.840.1.101.3.4.1.25 aes192_wrapz2.16.840.1.101.3.4.1.26 aes192_gcmz2.16.840.1.101.3.4.1.27 aes192_ccmz2.16.840.1.101.3.4.1.28aes192_wrap_padz2.16.840.1.101.3.4.1.41 aes256_ecbz2.16.840.1.101.3.4.1.42 aes256_cbcz2.16.840.1.101.3.4.1.43 aes256_ofbz2.16.840.1.101.3.4.1.44 aes256_cfbz2.16.840.1.101.3.4.1.45 aes256_wrapz2.16.840.1.101.3.4.1.46 aes256_gcmz2.16.840.1.101.3.4.1.47 aes256_ccmz2.16.840.1.101.3.4.1.48aes256_wrap_padz1.2.840.113549.1.5.13pbes2z1.2.840.113549.1.5.1 pbes1_md2_desz1.2.840.113549.1.5.3 pbes1_md5_desz1.2.840.113549.1.5.4 pbes1_md2_rc2z1.2.840.113549.1.5.6 pbes1_md5_rc2pbes1_sha1_despbes1_sha1_rc2pkcs12_sha1_rc4_128pkcs12_sha1_rc4_40pkcs12_sha1_tripledes_3keypkcs12_sha1_tripledes_2keypkcs12_sha1_rc2_128pkcs12_sha1_rc2_40rsaes_pkcs1v15 rsaes_oaep) z1.2.840.113549.1.5.10z1.2.840.113549.1.5.11z1.2.840.113549.1.12.1.1z1.2.840.113549.1.12.1.2z1.2.840.113549.1.12.1.3z1.2.840.113549.1.12.1.4z1.2.840.113549.1.12.1.5z1.2.840.113549.1.12.1.6r"z1.2.840.113549.1.1.7NrOrrrrr[s1 1 .1  e1  e 1  e 1  !,1  !,1  !,1  !,1  !-1  !,1  !,1  !"31  "<1  ">>V        rc |dj}|dddk(r dddd|dd Sd dd }||vr||S|d k(r?|d dj}dd dd}||vr||S|dk\r|S|yttd|dk(r.|d dd dj}||S|d djS|j ddk(rd d d d d d ddddddd |Sttd|)a Returns the key length to pass to the cipher/kdf. The PKCS#5 spec does not specify a way to store the RC5 key length, however this tends not to be a problem since OpenSSL does not support RC5 in PKCS#8 and OS X does not provide an RC5 cipher for use in the Security Transforms library. :raises: ValueError - when the key length can not be determined :return: An integer representing the length in bytes rrrtaesr aes128_aes192_aes256_)rrrrr)x:zw Invalid RC2 parameter version found in EncryptionAlgorithm parameters rr rencryption_schemer!r" rrrrrrrrrrrr@ Unrecognized encryption algorithm "%s" )r/rrrr*)r3r,cipher_lengthsrencoded_key_bits_maprs rrzEncryptionAlgorithm.key_lengthTs {+22 1Q 5 (a" $ $   n ,!/2 2 e #$($67N$O$V$V ! $ %(<<+,ABB$+,,$,V  g %l+,AB<PQ]^eeJ%!! %&9:EE E    $ *!"!"!"!""#"#')&'.0.0')&'         rc|dj}|ddtgdvr|ddS|dddk(ry|ddd k(ry|tgd vry|d k(r|d d jStt d|)z Returns the name of the encryption mode to use. :return: A unicode string from one of the following: "cbc", "ecb", "ofb", "cfb", "wrap", "gcm", "ccm", "wrap_pad" rrr?r;Npbes1_cbcpkcs12_)rrrrrrrGrI)r/r>encryption_moderrr5s rrQz#EncryptionAlgorithm.encryption_modes{+22 1Q 3'H#I I"12& & 1Q 8 + 1Q 9 , c"IJ J g % %&9:JJ J      rc |dj}|ddtgdvry|tgdvr|S|dk(ry|d k(r|d d jS|jd d k(rddddddddddddd |St t d|)al Returns the name of the symmetric encryption cipher to use. The key length can be retrieved via the .key_length property to disabiguate between different variations of TripleDES, AES, and the RC* ciphers. :return: A unicode string from one of the following: "rc2", "rc5", "des", "tripledes", "aes" rrr?r;r8)rrrr tripledesrrrGr!r"rrrrHrI)r/r>encryption_cipherr*rrr5s rrTz%EncryptionAlgorithm.encryption_ciphers{+22 1Q 3'H#I I c"78 8" " . . g % %&9:LL L    $ *!&!&!&!&"'"'',&+.9.9',&+         rc <|dj}|ddtgdvrydddd}||vr||S|dk(r|d d jdzS|d k(r|d d jS|jd dk(rddddddddddddd |St t d|)z Returns the block size of the encryption cipher, in bytes. :return: An integer that is the block size in bytes rrr?r;rr@)rrrrrrrrGr!r"rHrI)r/r>encryption_block_sizer*rr)r3r, cipher_maps rrVz)EncryptionAlgorithm.encryption_block_sizes{+22 1Q 3'H#I I j (o. . e # %&:;BBaG G g % %&9:PP P    $ *!"!"!"!""#"#'(&'././'(&'         rc$|dj}|tddgvr|ddjStgd}||vr|djS|dk(r|ddjS|jd d k(ry t t d |) a Returns the byte string of the initialization vector for the encryption scheme. Only the PBES2 stores the IV in the params. For PBES1, the IV is derived from the KDF and this property will return None. :return: A byte string or None rrrrr)rrrrrrrrrrGr!r"NrI)r/r> encryption_ivr*rr)r3r,octet_string_iv_oidss rrYz!EncryptionAlgorithm.encryption_iv9s{+22 c5%.1 1 %d+22 2 # $  2 2 %,, , g % %&9:HH H    $ *      rN)rrrrr rr.rrrrrrr0rr-r0r3r6rrQrTrVrYrrrrrs +, sZ./G ,I {+ y y  k  k  k k k k i i i !" #$ %& '(&%*)&1&1*)%=JB& & P! ! F* * X  B\ \ |  B. . `0 0 d- - rrceZdZdefdefgZy) Pbes2Paramsr rGN)rrrrrrrrrr\r\js  - 12Grr\ceZdZdefdefgZy) Pbmac1Paramsr message_auth_schemeN)rrrrrRrrrrr^r^qs  -  .Grr^ceZdZddiZy) Pkcs5MacIdz1.2.840.113549.1.5.14pbmac1NrOrrrraraxrrrac(eZdZdefdefgZdZdeiZy)Pkcs5MacAlgorithmrrr-rbN) rrrrar rr.r^r0rrrrdrd~s, j! sG ,I,JrrdrceZdZiZdZy)AnyAlgorithmIdc|jj}tttfD])}|jj D] \}}|||< +yN)r9rPrrvrTitems)r3rP other_clsoidr2s r_setupzAnyAlgorithmId._setupsI~~""/1HJ[\I&^^113 T S 4]rN)rrrrPrlrrrrfrfs D!rrfc0eZdZdefdeddifgZdZiZdZy)AnyAlgorithmIdentifierrrrTr-ctj||jj}tt fD])}|jj D] \}}|||< +yrh)rrlr9r0rrri)r3specsrjrkspecs rrlzAnyAlgorithmIdentifier._setupsT))-/DEI&11779 T!c :FrN) rrrrfr rr.r0rlrrrrnrns1 n% sZ./G ,IJ"rrnN)=r= __future__rrrr_errorsr_intr utilr r corer r rrrrrrrobjectr!rBrRrTr\r^rbrergrjrvrrrrrrrrrrrrrrrrrrrr\r^rardr0rfrnrrrrxs$SR.   "(666r&"H(,*H) x 7 %h%P>.>Bb 0(b J8% 8 8 - 8g () x  h F0!80!f2,2jW .W t(8!  +6w'!%!"18"r__pycache__/cms.cpython-312.pyc000064400000101064152572326550012257 0ustar00 uil " dZddlmZmZmZmZ ddlZddlm Z m Z m Z m Z m Z mZmZmZddlmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z ddl!m"Z"ddl#m$Z$dd l%m&Z&dd l'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-Gd d eZ.Gd deZ/GddeZ0GddeZ1GddeZ2GddeZ3GddeZ4GddeZ5GddeZ6GddeZ7Gdd eZ8Gd!d"eZ9Gd#d$eZ:Gd%d&eZ;Gd'd(eZ<Gd)d*eZ=Gd+d,eZ>Gd-d.eZ?Gd/d0eZ@Gd1d2eZAGd3d4eZBGd5d6eZCGd7d8eZDGd9d:eZEGd;deZGGd?d@eZHGdAdBeZIGdCdDeZJGdEdFeZKGdGdHeZLGdIdJeZMGdKdLeZNGdMdNeZOGdOdPeZPGdQdReZQGdSdTeZRGdUdVeZSGdWdXeZTGdYdZeZUGd[d\eZVGd]d^eZWGd_d`eZXGdadbeZYGdcddeZZGdedfeZ[GdgdheZ\GdidjeZ]GdkdleZ^GdmdneZ_GdodpeZ`GdqdreZaGdsdteZbGdudveZcGdwdxeZdGdydzeZeGd{d|eZfGd}d~eZgGddeZhGddeZiGddeZjGddeZkGddeZlGddeZmGddeZnGddeZoGddeZpGddeZqGddeZrGddeZsGddeZtGdde eZuGddeZvGddeZwGddeZxGddeZyGddeZzGddeZ{GddeZ|GddeZ}GddeZ~GddeZGddeZGddeZGddeZGddeZGddeZGddeZGddeZGddeZGddeZGddeZGdÄdeZGdńdeZGdDŽdeZGdɄdeZGd˄deZyGd̄deZGd΄deZGdЄdeZGd҄deZGdԄdeZeeqeeeeeeed֜ ec_eqeeeeeeedלee_e5e6e7epede9ededeed؜ e:_y#e$rdZYwxYw)a ASN.1 type classes for cryptographic message syntax (CMS). Structures are also compatible with PKCS#7. Exports the following items: - AuthenticatedData() - AuthEnvelopedData() - CompressedData() - ContentInfo() - DigestedData() - EncryptedData() - EnvelopedData() - SignedAndEnvelopedData() - SignedData() Other type classes are defined that help compose the types listed above. Most CMS structures in the wild are formatted as ContentInfo encapsulating one of the other types. )unicode_literalsdivisionabsolute_importprint_functionN)_ForceNullParametersDigestAlgorithmEncryptionAlgorithmEncryptionAlgorithmId HmacAlgorithm KdfAlgorithmRSAESOAEPParamsSignedDigestAlgorithm)Any BitStringChoice EnumeratedGeneralizedTimeIntegerObjectIdentifierOctetBitString OctetStringParsableOctetStringSequence SequenceOfSetOfUTCTime UTF8String)CertificateList) PublicKeyInfo) OCSPResponse) Attributes Certificate Extensions GeneralName GeneralNamesNamec"eZdZdefdefdefgZy)ExtendedCertificateInfoversion certificate attributesN)__name__ __module__ __qualname__rr#r"_fields?/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/cms.pyr)r)As! G  $ z"Gr2r)c"eZdZdefdefdefgZy)ExtendedCertificateextended_certificate_infosignature_algorithm signatureN)r-r.r/r)rrr0r1r2r3r5r5Is# $&=>  56 n%Gr2r5ceZdZdddddddZy) CMSVersionv0v1v2v3v4v5rrNr-r.r/_mapr1r2r3r:r:Ws        Dr2r:c &eZdZddddddddd d d Zy ) CMSAttributeType content_typemessage_digest signing_timecounter_signaturesmime_capabilitiesencrypt_key_prefsignature_time_stamp_tokencms_algorithm_protectionmicrosoft_nested_signaturemicrosoft_time_stamp_token) z1.2.840.113549.1.9.3z1.2.840.113549.1.9.4z1.2.840.113549.1.9.5z1.2.840.113549.1.9.6z1.2.840.113549.1.9.15z1.2.840.113549.1.9.16.2.11z1.2.840.113549.1.9.16.2.14z1.2.840.113549.1.9.52z1.3.6.1.4.1.311.2.4.1z1.3.6.1.4.1.311.3.3.1NrFr1r2r3rIrIbs) . 0 . 3!5&8&B!;!= ">) Dr2rIceZdZdefdefgZy)Timeutc_timegeneralized_timeN)r-r.r/rr _alternativesr1r2r3rUrU{s W _-Mr2rUc $eZdZddddddddd d Zy ) ContentTypedata signed_dataenveloped_datasigned_and_enveloped_data digested_dataencrypted_dataauthenticated_datacompressed_dataauthenticated_enveloped_data) z1.2.840.113549.1.7.1z1.2.840.113549.1.7.2z1.2.840.113549.1.7.3z1.2.840.113549.1.7.4z1.2.840.113549.1.7.5z1.2.840.113549.1.7.6z1.2.840.113549.1.9.16.1.2z1.2.840.113549.1.9.16.1.9z1.2.840.113549.1.9.16.1.23NrFr1r2r3rZrZs$ & - 0 ; / 0%9%6&D Dr2rZc2eZdZdefdedddfdedddfgZy) CMSAlgorithmProtectiondigest_algorithmr7rTimplicitoptional mac_algorithmrBN)r-r.r/r rr r0r1r2r3reres1 _-  5ASW7XY -aT)JKGr2receZdZeZy)SetOfContentTypeN)r-r.r/rZ _child_specr1r2r3rlrlKr2rlceZdZeZy)SetOfOctetStringN)r-r.r/rrmr1r2r3rprprnr2rpceZdZeZy) SetOfTimeN)r-r.r/rUrmr1r2r3rrrrsKr2rrceZdZeZy)SetOfAnyN)r-r.r/rrmr1r2r3rtrtsKr2rtceZdZeZy)SetOfCMSAlgorithmProtectionN)r-r.r/rermr1r2r3rvrvs(Kr2rvc*eZdZdefdgZiZdZdeiZy) CMSAttributetypevaluesNc\|jj|djtSNry _oid_specsgetnativertselfs r3 _values_speczCMSAttribute._values_spec#""4<#6#6AAr2r{N)r-r.r/rIr0rr_spec_callbacksr1r2r3rxrxs0 !"G JB ,Or2rxceZdZeZy) CMSAttributesN)r-r.r/rxrmr1r2r3rrKr2rc(eZdZdefdefdeddifgZy) IssuerSerialissuerserial issuer_uidriTN)r-r.r/r&rrr0r1r2r3rrs( < 7 ~ D'9:Gr2rceZdZdddZy)AttCertVersionr<r=)rrNrFr1r2r3rrs   Dr2rc(eZdZdeddifdeddifgZy)AttCertSubjectbase_certificate_idexplicitr subject_namerN)r-r.r/rr&rXr1r2r3rrs%  z1o>  A7Mr2rceZdZdefdefgZy)AttCertValidityPeriodnot_before_timenot_after_timeN)r-r.r/rr0r1r2r3rrs O, ?+Gr2rc XeZdZdeddifdefdefdefdefdefd e fd e d d ifd e d d ifg Z y)AttributeCertificateInfoV1r*defaultr<subjectrr8 serial_numberatt_cert_validity_periodr,issuer_unique_idriT extensionsN) r-r.r/rrr&rrrr"rr$r0r1r2r3rrsh NY$56 N# < +, '" #%:; z" ^j$-?@ zJ#56 Gr2rc"eZdZdefdefdefgZy)AttributeCertificateV1ac_infor7r8N)r-r.r/rrrr0r1r2r3rrs# ./  56 n%Gr2rceZdZddddZy)DigestedObjectType public_keypublic_key_certother_objy_types)rrrBNrFr1r2r3rrs    Dr2rc.eZdZdefdeddifdefdefgZy)ObjectDigestInfodigested_object_typeother_object_type_idriTrf object_digestN)r-r.r/rrr rr0r1r2r3rrs2 !34 !1J3EF _- .) Gr2rc:eZdZdedddfdedddfdedddfgZy ) HolderrrTrg entity_namerobject_digest_inforBN)r-r.r/rr&rr0r1r2r3rrs7  1$.OP  1$&GH /aT1RSGr2rc8eZdZdeddifdedddfdedddfgZy ) V2Form issuer_nameriTrrrrirrN)r-r.r/r&rrr0r1r2r3rr s7  z4&89  1$.OP /aT1RSGr2rc"eZdZdefdeddifgZy) AttCertIssuerv1_formv2_formrhrN)r-r.r/r&rrXr1r2r3rrs L! FZO,Mr2rc"eZdZdefdefdefgZy) IetfAttrValueoctetsoidstringN)r-r.r/rrrrXr1r2r3rrs" ;  ! :Mr2rceZdZeZy)IetfAttrValuesN)r-r.r/rrmr1r2r3rr#Kr2rc$eZdZdedddfdefgZy)IetfAttrSyntaxpolicy_authorityrTrgr{N)r-r.r/r&rr0r1r2r3rr's \t+LM >"Gr2rceZdZeZy)SetOfIetfAttrSyntaxN)r-r.r/rrmr1r2r3rr.s Kr2rc(eZdZdefdefdeddifgZy) SvceAuthInfoserviceident auth_inforiTN)r-r.r/r%rr0r1r2r3rr2s( K + kJ#56Gr2rceZdZeZy)SetOfSvceAuthInfoN)r-r.r/rrmr1r2r3rr:rr2rc*eZdZdedddfdeddifgZy) RoleSyntaxrole_authorityrTrg role_namerrN)r-r.r/r&r%r0r1r2r3rr>s& 2B.C"DE  5 D7IJGr2rceZdZeZy)SetOfClearanceN)r-r.r/rrmr1r2r3rrgsKr2rc(eZdZdefdefdeddifgZy)BigTimemajorfractional_secondssignriTN)r-r.r/rr0r1r2r3rrks( ' w' :t,-Gr2rceZdZdefdefgZy)LeapData leap_timeactionN)r-r.r/rrr0r1r2r3rrss g 7Gr2rceZdZeZy) SetOfLeapDataN)r-r.r/rrmr1r2r3rrzsKr2rc4eZdZdefdefdefdefdeddifgZy) TimingMetricsntp_timeoffsetdelay expiration leap_eventriTN)r-r.r/rrr0r1r2r3rr~s8 W 7 ' w }z4&89 Gr2rceZdZeZy)SetOfTimingMetricsN)r-r.r/rrmr1r2r3rrrr2rc8eZdZdedeifdedddfdedddfgZy ) TimingPolicyrspec max_offsetrTr max_delayrN)r-r.r/rrrr0r1r2r3rrs7 j6+;"<= wQD AB gA4@AGr2rceZdZeZy)SetOfTimingPolicyN)r-r.r/rrmr1r2r3rrrr2rc "eZdZddddddddd Zy ) AttCertAttributeTypeauthentication_infoaccess_identitycharging_identitygrouprole clearancetiming_metrics timing_policy)z1.3.6.1.5.5.7.10.1z1.3.6.1.5.5.7.10.2z1.3.6.1.5.5.7.10.3z1.3.6.1.5.5.7.10.4z2.5.4.72z2.5.4.55z1.3.6.1.4.1.601.10.4.1z1.3.6.1.4.1.601.10.4.2NrFr1r2r3r r s!3/1%"2"1 Dr2r c <eZdZdefdgZeeeeeee e dZ dZ de iZ y)AttCertAttributeryrz)r r r r rrrrc\|jj|djtSr}r~rs r3rzAttCertAttribute._values_specrr2r{N)r-r.r/r r0rrrrrrrrrr1r2r3rrsJ %&G 1,0$#,* JB ,Or2rceZdZeZy)AttCertAttributesN)r-r.r/rrmr1r2r3rrrr2rc ReZdZdefdefdefdefdefdefde fde d d ifd e d d ifg Z y ) AttributeCertificateInfoV2r*holderrr8rrr,rriTrN) r-r.r/rrrrrrrrr$r0r1r2r3rrsb N# 6 =! +, '" #%:; () ^j$-?@ zJ#56 Gr2rc&eZdZdZdefdefdefgZy)AttributeCertificateV2rrr7r8N)r-r.r/_bad_tagrrrr0r1r2r3rrs*H ./  56 n%Gr2rceZdZdefdefgZy)OtherCertificateFormatother_cert_format other_certNrr1r2r3rrs ./ sGr2rcXeZdZdefdeddifdeddifdeddifd edd ifgZfd Z xZ S) CertificateChoicesr+extended_certificaterhr v1_attr_certr v2_attr_certrBotherrCctt| ||||jdk(rOtj t j |djjdk(rd|_yyy)aJ Ensures that the class and tag specified exist as an alternative. This custom version fixes parsing broken encodings there a V2 attribute # certificate is encoded as a V1 :param class_: The integer class_ from the encoded value header :param tag: The integer tag from the encoded value header :param contents: A byte string of the contents of the value - used when the object is explicitly tagged :raises: ValueError - when value is not a valid alternative rBrr=rCN) superr"validate_choicerloadrdumpr)rclass_tagcontents __class__s r3r)zCertificateChoices.validatesh(  $0hG <<1 ""8==#:1#=#B#B#DELLPTT  U r2) r-r.r/r#r5rrrrXr) __classcell__)r0s@r3r"r"sX  $ !4z1oF /*aA /*aA (:q/: M!!r2r"ceZdZeZy)CertificateSetN)r-r.r/r"rmr1r2r3r3r3s$Kr2r3c,eZdZdefdedddfgZdZiZy) ContentInforJcontentrTrrJr6N)r-r.r/rZrr0 _oid_pairrr1r2r3r5r5 s, % CaT:;G ,IJr2r5ceZdZeZy)SetOfContentInfoN)r-r.r/r5rmr1r2r3r:r:rnr2r:c,eZdZdefdedddfgZdZiZy)EncapsulatedContentInforJr6rTrr7N)r-r.r/rZrr0r8rr1r2r3r<r<s- % 'aT)JKG ,IJr2r<ceZdZdefdefgZy)IssuerAndSerialNumberrrN)r-r.r/r'rr0r1r2r3r>r>!s 4 '"Gr2r>c"eZdZdefdeddifgZy)SignerIdentifierissuer_and_serial_numbersubject_key_identifierrhrNr-r.r/r>rrXr1r2r3r@r@( #%:; !;Q@Mr2r@ceZdZeZy)DigestAlgorithmsN)r-r.r/r rmr1r2r3rFrF/!Kr2rFceZdZeZy)CertificateRevocationListsN)r-r.r/rrmr1r2r3rIrI3rGr2rIc$eZdZdedddfdefgZy) SCVPReqResrequestrTrresponseN)r-r.r/r5r0r1r2r3rKrK7s KaT!BC [!Gr2rKceZdZdddZy)OtherRevInfoFormatId ocsp_responsescvp)z1.3.6.1.5.5.7.16.2z1.3.6.1.5.5.7.16.4NrFr1r2r3rOrO>s-$ Dr2rOc*eZdZdefdefgZdZeedZ y)OtherRevocationInfoFormatother_rev_info_formatother_rev_info)rTrU)rPrQN) r-r.r/rOrr0r8r!rKrr1r2r3rSrSEs. "67 3G |djdk7rtStSNr*r<rr<r5rs r3_encap_content_info_specz#SignedData._encap_content_info_specw$  ? ! !T )* * r2rfN) r-r.r/r:rFr3rZrar0rmrr1r2r3rcrcmsX J ./$ aT)JK &QD(IJ % G  6Or2rcc,eZdZdedddfdedddfgZy)OriginatorInfocertsrTrgrhrN)r-r.r/r3rZr0r1r2r3rprps( .qd"CD &QD(IJGr2rpc"eZdZdefdeddifgZy)RecipientIdentifierrArBrhrNrCr1r2r3rsrsrDr2rsc :eZdZddddddddd Zd d d d d ddddd Zy)KeyEncryptionAlgorithmIdrsaes_pkcs1v15 rsaes_oaep aes128_wrapaes128_wrap_pad aes192_wrapaes192_wrap_pad aes256_wrapaes256_wrap_pad)1.2.840.113549.1.1.11.2.840.113549.1.1.72.16.840.1.101.3.4.1.52.16.840.1.101.3.4.1.82.16.840.1.101.3.4.1.252.16.840.1.101.3.4.1.282.16.840.1.101.3.4.1.452.16.840.1.101.3.4.1.48r~rrrrrrr) rsarvrwrxryrzr{r|r}N)r-r.r/rG _reverse_mapr1r2r3rurusE 0 ,"/"3#0#4#0#4 D&0,/30404 Lr2ruc.eZdZdefdeddifgZdZdeiZy)KeyEncryptionAlgorithm algorithm parametersriT)rrrwN) r-r.r/rurr0r8rrr1r2r3rrs4 ./ sZ./G ,IoJr2rc(eZdZdefdefdefdefgZy)KeyTransRecipientInfor*ridkey_encryption_algorithm encrypted_keyN)r-r.r/r:rsrrr0r1r2r3rrs+ J #$ #%;< +& Gr2rc.eZdZdefdeddifdeddifgZy)OriginatorIdentifierOrKeyrArBrhroriginator_keyrN)r-r.r/r>rr rXr1r2r3rrs. #%:; !;Q@ =:q/:Mr2rceZdZdefdefgZy)OtherKeyAttribute key_attr_idkey_attrNrr1r2r3rrs () SGr2rc.eZdZdefdeddifdeddifgZy)RecipientKeyIdentifierrBdateriTr&Nr-r.r/rrrr0r1r2r3rrs0 !;/ :t"45 #j$%78Gr2rc"eZdZdefdeddifgZy)KeyAgreementRecipientIdentifierrAr_key_idrhrN)r-r.r/r>rrXr1r2r3rrs! #%:; +j!_=Mr2rceZdZdefdefgZy)RecipientEncryptedKeyrrN)r-r.r/rrr0r1r2r3rrs /0 +&Gr2rceZdZeZy)RecipientEncryptedKeysN)r-r.r/rrmr1r2r3rrs'Kr2rc<eZdZdefdeddifdedddfd efd efgZy ) KeyAgreeRecipientInfor* originatorrrukmrTrrrecipient_encrypted_keysN) r-r.r/r:rrrrr0r1r2r3rrsA J 0:q/B  !>? #%;< #%;< Gr2rc.eZdZdefdeddifdeddifgZy) KEKIdentifierkey_identifierrriTr&Nrr1r2r3rrs0 ;' :t"45 #j$%78Gr2rc(eZdZdefdefdefdefgZy)KEKRecipientInfor*kekidrrN)r-r.r/r:rrrr0r1r2r3rrs* J - #%;< +& Gr2rc0eZdZdefdedddfdefdefgZy) PasswordRecipientInfor*key_derivation_algorithmrTrgrrN)r-r.r/r:r rrr0r1r2r3rr s1 J #\t3TU #%;< +& Gr2rceZdZdefdefgZy)OtherRecipientInfoori_type ori_valueNrr1r2r3rrs %& cGr2rcFeZdZdefdeddifdeddifdeddifd edd ifgZy ) RecipientInfoktrikarirhrkekrirBpwrirCorirDN) r-r.r/rrrrrrXr1r2r3rrsN &' &Q8 "ZO4 &Q8 "ZO4 Mr2rceZdZeZy)RecipientInfosN)r-r.r/rrmr1r2r3rr$rr2rc*eZdZdefdefdedddfgZy)EncryptedContentInforJcontent_encryption_algorithmencrypted_contentrTrgN)r-r.r/rZr rr0r1r2r3rr(s) % ')<= kt+LMGr2rc >eZdZdefdedddfdefdefded ddfgZy ) EnvelopedDatar*originator_inforTrgrecipient_infosencrypted_content_infounprotected_attrsrN) r-r.r/r:rprrrr0r1r2r3rr0s@ J N,MN N+ !#78 m!-NO Gr2rc JeZdZdefdefdefdefdedddfd ed ddfd e fgZ y ) SignedAndEnvelopedDatar*rrdrrgrTrgrhrriN) r-r.r/r:rrFrr3rIrar0r1r2r3rr:sR J N+ ./ !#78 aT)JK +!-NO %Gr2rc2eZdZdefdefddefgZdZdeiZy) DigestedDatar*rfredigestc>|djdk7rtStSrkrlrs r3rmz%DigestedData._encap_content_info_specNrnr2rfN) r-r.r/r:r rr0rmrr1r2r3rrFs8 J _-$ ; G  6Or2rc*eZdZdefdefdedddfgZy) EncryptedDatar*rrrTrgN)r-r.r/r:rrr0r1r2r3rras) J !#78 m!-NOGr2rc feZdZdefdedddfdefdefded ddfd efd e d ddfd e fde dddfg Z y)AuthenticatedDatar*rrTrgrrjrfrrf auth_attrsrBmac unauth_attrsrCN) r-r.r/r:rprr r r<rrr0r1r2r3rrisp J N,MN N+ -( _1$.OP 67 }1$&GH   QD(IJ Gr2rc ReZdZdefdedddfdefdefded ddfd efd ed ddfgZ y )AuthEnvelopedDatar*rrTrgrauth_encrypted_content_inforrrrrBN) r-r.r/r:rprrrrr0r1r2r3rrysW J N,MN N+ &(<= }1$&GH   QD(IJGr2rceZdZddiZy)CompressionAlgorithmIdz1.2.840.113549.1.9.16.3.8zlibNrFr1r2r3rrs#V Dr2rc"eZdZdefdeddifgZy)CompressionAlgorithmrrriTN)r-r.r/rrr0r1r2r3rrs! ,- sZ./Gr2rc6eZdZdefdefdefgZdZedZ y)CompressedDatar*compression_algorithmrfNc|j;t tdtj|ddj|_|jS)Nz The zlib module is not availablerfr6) _decompressedr SystemError decompressrrs r3 decompressedzCompressedData.decompressedsM    %|!"DEE!%6J1KI1V1]1]!^D !!!r2) r-r.r/r:rr<r0rpropertyrr1r2r3rrs< J "67 67G M ""r2rc.eZdZdefdeddifdeddifgZy)rsubjectKeyIdentifierrriTr&Nrr1r2r3rrs0 - :t"45 #j$%78Gr2c4eZdZdeddifdeddifdeddifgZy) SMIMEEncryptionKeyPreferencerArhrrecipientKeyIdrsubjectAltKeyIdentifierrBN)r-r.r/r>rr rXr1r2r3rrs5 #%:ZOL 1J?C "MJ?CMr2rceZdZeZy)SMIMEEncryptionKeyPreferencesN)r-r.r/rrmr1r2r3rrs.Kr2rc"eZdZdefdeddifgZy)SMIMECapabilityIdentifier capability_idrriTN)r-r.r/r rr0r1r2r3rrs! /0 sZ./Gr2rceZdZeZy)SMIMECapabilitesN)r-r.r/rrmr1r2r3rrs+Kr2rceZdZeZy)SetOfSMIMECapabilitesN)r-r.r/rrmr1r2r3rrrr2r) r[r\r]r^r_r`rarbrc)r\r]r^r_r`rarbrc) rJrKrLrMrPrQrRrSrOrN)__doc__ __future__rrrrr ImportErroralgosrr r r r r rrcorerrrrrrrrrrrrrrrrXrkeysr ocspr!x509r"r#r$r%r&r'r)r5r:rIrUrZrerlrprrrtrvrxrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr rrrrrr"r3r5r:r<r>r@rFrIrKrOrSrWrZr\rarcrprsrurrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr1r2r3rs&SR   "!VV h('26 " Xuuu)%) 8  E8WVH  XxXXFF Z X!%!8e x#E#UhxEH  8 + x2# #  XX ! !F%U%(uhHv"u"""+  6'E'  %:X&/2 18 HXfH(Z(HHxHF U 8H X 86H    - 8"X"$X6/E/,z,#E# #!7!#+%$5  #!7!#+%$5 &"%&$"2 ;"2"25/  M  DsTT T__pycache__/core.cpython-312.pyc000064400000526230152572326550012433 0ustar00 uiܚ dZddlmZmZmZmZddlmZmZddlm Z ddl Z ddl Z ddl Z ddl Z ddlZddlmZddlmZdd lmZdd lmZmZmZmZmZdd lmZmZdd lmZm Z m!Z!m"Z"m#Z#m$Z$ejJd kr ddl&m'Z(e)Z*dZ+nddl,m(Z(dZ+ejZdddddZ.dddddddddZ/dddZ0e jbdZ2iZ3ddZ4Gdd e5Z6Gd!d"Z7Gd#d$e5Z8Gd%d&e5Z9Gd'd(e6Z:e:Z;Gd)d*e6Z<Gd+d,e6Z=Gd-d.e5Z>Gd/d0e6Z?Gd1d2e9e?Z@Gd3d4e?ZAGd5d6e?e7ZBGd7d8e5ZCGd9d:eCe9e8e?e7ZDGd;deCe9e8e?ZFGd?d@e9e8e?ZGGdAdBe9e8e?ZHGdCdDe9e8e?ZIGdEdFeIZJGdGdHe?ZKGdIdJe?e7ZLGdKdLe?ZMGdMdNe?ZNGdOdPe?ZOGdQdReBZPGdSdTe@ZQGdUdVeLZRGdWdXe6ZSGdYdZe6ZTGd[d\eSZUGd]d^eTZVGd_d`eSZWGdadbe@ZXGdcdde@ZYGdedfe@ZZGdgdheGZ[Gdidje@Z\Gdkdle@Z]Gdmdne]Z^Gdodpe]Z_Gdqdre@Z`Gdsdte@ZaGdudve@ZbGdwdxe@ZcGdydze@ZdGd{d|e@Zed}Zfd~ZgdZhdZidZjideAdeBdeDdeGdeKdeLdeMdeNdeOdePdeWdeQdeRdeSdeUdeXdeYeZe[e\e^e_e`eaebecedeed ZkddZlddZmy)a ASN.1 type classes for universal types. Exports the following items: - load() - Any() - Asn1Value() - BitString() - BMPString() - Boolean() - CharacterString() - Choice() - EmbeddedPdv() - Enumerated() - GeneralizedTime() - GeneralString() - GraphicString() - IA5String() - InstanceOf() - Integer() - IntegerBitString() - IntegerOctetString() - Null() - NumericString() - ObjectDescriptor() - ObjectIdentifier() - OctetBitString() - OctetString() - PrintableString() - Real() - RelativeOid() - Sequence() - SequenceOf() - Set() - SetOf() - TeletexString() - UniversalString() - UTCTime() - UTF8String() - VideotexString() - VisibleString() - VOID - Void() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_function)datetime timedelta)FractionN)_teletex_codec)unwrap) OrderedDict) type_namestr_clsbyte_cls int_typeschr_cls)_parse _dump_header) int_to_bytesint_from_bytestimezoneextended_datetimecreate_timezone utc_with_dst))StringIOT)BytesIOF universal applicationcontextprivate)rr rr"r)rrr r!rr r"r primitive constructed)rr z ^\d+(\.\d+)*$c0tj||S)a5 Loads a BER/DER-encoded byte string and construct a universal object based on the tag value: - 1: Boolean - 2: Integer - 3: BitString - 4: OctetString - 5: Null - 6: ObjectIdentifier - 7: ObjectDescriptor - 8: InstanceOf - 9: Real - 10: Enumerated - 11: EmbeddedPdv - 12: UTF8String - 13: RelativeOid - 16: Sequence, - 17: Set - 18: NumericString - 19: PrintableString - 20: TeletexString - 21: VideotexString - 22: IA5String - 23: UTCTime - 24: GeneralizedTime - 25: GraphicString - 26: VisibleString - 27: GeneralString - 28: UniversalString - 29: CharacterString - 30: BMPString :param encoded_data: A byte string of BER or DER-encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :raises: ValueError - when strict is True and trailing data is present ValueError - when the encoded value tag a tag other than listed above ValueError - when the ASN.1 header length is longer than the data TypeError - when encoded_data is not a byte string :return: An instance of the one of the universal classes )strict) Asn1Valueload) encoded_datar&s @/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/core.pyr(r(ssf >>,v> 66ceZdZdZdZdZdZdZdZdZ dZ dZ dZ dZ eddZ ddZdZdZd Zd Zd Zd Zd ZdZddZdZdZddZddZy)r'z' The basis of all ASN.1 values NFr+c t|tstdt|zd}|j|}t ||||\}}|S)a Loads a BER/DER-encoded byte string using the current class as the spec :param encoded_data: A byte string of BER or DER-encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :return: An instance of the current class *encoded_data must be a byte string, not %sNspec spec_paramsr&) isinstancer TypeErrorrtag _parse_build)clsr)r&kwargsr0value_s r*r(zAsn1Value.loadsS ,1H9UaKbbc c 77 D 4VTZ[q r+c  |jtvrl|j} | j/t| jdtr| jf| _t | dr|j dt| <|!t|tr|d}||f}|dk(rd}d}|!t|tr|d}||f}|dk(rd}d}|6|d}|dk(r||f}n(|dk(r||f}nttdt||t|d k(rt|d tr|f}|D]\}}d} t|tr |tvr|} n|tvr|} t|}| ttd t| |.t|tsttd t||j ||ff|_|j||ffz|_n|x|\}}|tvrttd t||.t|tsttdt|t||_||_d|_nR|4|tvrttdt|t||_|jd|_|||_| C| t%gdvrttdt| | dk(rd} n| dk(rd } | |_|rd|_| | |_y||j%|yy#ttf$r=} | j*d d}| j*ddt|zzf|z| _| d} ~ wwxYw)a The optional parameter is not used, but rather included so we don't have to delete it from the parameter dictionary when passing as keyword args :param explicit: An int tag number for explicit tagging, or a 2-element tuple of class and tag. :param implicit: An int tag number for implicit tagging, or a 2-element tuple of class and tag. :param no_explicit: If explicit tagging info should be removed from this instance. Used internally to allow contructing the underlying value that has been wrapped in an explicit tag. :param tag_type: None for normal values, or one of "implicit", "explicit" for tagged values. Deprecated in favor of explicit and implicit params. :param class_: The class for the value - defaults to "universal" if tag_type is None, otherwise defaults to "context". Valid values include: - "universal" - "application" - "context" - "private" Deprecated in favor of explicit and implicit params. :param tag: The integer tag to override - usually this is used with tag_type or class_. Deprecated in favor of explicit and implicit params. :param optional: Dummy parameter that allows "optional" key in spec param dicts :param default: The default value to use if the value is currently None :param contents: A byte string of the encoded contents of the value :param method: The method for the value - no default value since this is normally set on a class. Valid values include: - "primitive" or 0 - "constructed" or 1 :raises: ValueError - when implicit, explicit, tag_type, class_ or tag are invalid values Nr_setupTr explicitimplicitzh tag_type must be one of "implicit", "explicit", not %s r"r z explicit class must be one of "universal", "application", "context", "private", not %s zi explicit tag must be an integer, not %s z implicit class must be one of "universal", "application", "context", "private", not %s za implicit tag must be an integer, not %s z class_ must be one of "universal", "application", "context", "private", not %s )r#rr$r z method must be one of "primitive" or "constructed", not %s r#r$ while constructing %s) __class___SETUP_CLASSESr<r2rhasattrr; ValueErrorr reprlenCLASS_NUM_TO_NAME_MAPCLASS_NAME_TO_NUM_MAPr3rclass_r4r=setmethodcontentsargs)selfr<r= no_explicittag_typerGr4optionaldefaultrJrIr6 invalid_classerKs r*__init__zAsn1Value.__init__spT ~~^3nn<<+ 3<<?I0V$'LL#3CL3)KKM&*s##h 2~!* &1Hz)#HC#h 2~!* &1Hz)#HC#>&Fz) &}H+ &}H$VX &#x=A%*Xa[)*L (|H#+KFC$(M!&)4!)>>,2M!)>>,2M!6v!>$0( !/ *)#y9"+F!$!*# -# }},*0#(9 (, &#8I(I 9$,<%& !66$VV &?%c95' &cN ) 4F;  $ %%::( !L *#8"?DK;;&"#DK?"DH!%G!HH$VV &[(F},F$  $ # ( $!%I& 66!":DffQi"?)D/"QQSVZZAFG sK>LLM"%8MM"cNtr|jS|jSz Since str is different in Python 2 and 3, this calls the appropriate method, __unicode__() or __bytes__() :return: A unicode string _PY2 __bytes__ __unicode__rLs r*__str__zAsn1Value.__str__# >># ###% %r+c tr5dt|dt|dt|j dSdt|dt|dt|j dS)7 :return: A unicode string < z b>)rWridrCdumprZs r*__repr__zAsn1Value.__repr__sN $-dORXtDIIK?PQ Q $-T?BtHd499;>OP Pr+c@|jjdS)z A fall-back method for print() in Python 2 :return: A byte string of the output of repr() utf-8)rdencoderZs r*rXzAsn1Value.__bytes__s}}%%g..r+c"|jS)z A fall-back method for print() in Python 3 :return: A unicode string of the output of repr() )rdrZs r*rYzAsn1Value.__unicode__s}}r+c|j}|j|_|j|_|j|_|j|_|S)z Constructs a new copy of the current object, preserving any tagging :return: An Asn1Value object )r?rGr4r=r<rLnew_objs r* _new_instancezAsn1Value._new_instancesC.."hh ====r+cf|j}|j|tj|S)z Implements the copy.copy() interface :return: A new shallow copy of the current Asn1Value object )rl_copycopyrjs r*__copy__zAsn1Value.__copy__s)$$& dDII&r+c|j}||t|<|j|tj|S)z Implements the copy.deepcopy() interface :param memo: A dict for memoization :return: A new deep copy of the current Asn1Value object )rlrbrnrodeepcopyrLmemorks r* __deepcopy__zAsn1Value.__deepcopy__s6$$& RX dDMM*r+c,tj|S)z} Copies the object, preserving any special tagging from it :return: An Asn1Value object rorrrZs r*rozAsn1Value.copy}}T""r+ct|ts||i}|j|jd|jd}|j |t j |S)a} Copies the object, applying a new tagging to it :param tagging: A dict containing the keys "explicit" and "implicit". Legacy API allows a unicode string of "implicit" or "explicit". :param tag: A integer tag number. Only used when tagging is a unicode string. :return: An Asn1Value object r<r=)r<r=)r2dictr?getrnrorr)rLtaggingr4rks r*retagzAsn1Value.retagsS '4(nG..'++j*AGKKXbLc.d dDMM*r+cf|j}|j|tj|S)z{ Copies the object, removing any special tagging from it :return: An Asn1Value object )r?rnrorrrjs r*untagzAsn1Value.untag/s'.." dDMM*r+c |j|jk7r(ttdt|t||j|_||j |_y)a! Copies the contents of another Asn1Value object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects Q Can not copy values from %s object to %s object N)r?r3r rrJ_nativerLother copy_funcs r*rnzAsn1Value._copy;s[ >>U__ ,F% $    / r+cd|z}t|d}t|||r|jj|dzyt|dr|jj|dzyt r>t |jtr$t|dt|jyt|d|jy)J Show the binary data and parsed data in a tree structure  parsedr"chosenz Native: bz Native: N) rA _basic_debugrdebugrrWr2nativerprintrC)rL nest_levelprefix has_parseds r*rzAsn1Value.debugSs  "T8, VT"  KK  j1n - T8 $ KK  j1n - 4;;9VT$++5FGHFDKK@Ar+c|j}|j|jdddk(rd}|j|rt|tr|jrd|_t |j|j |j|j}|j2|jD]#\}}t |d|||jz|z}%||_d|_ |j|z|jzS) Encodes the value using DER :param force: If the encoded contents already exist, clear them and regenerate to ensure they are in DER format instead of BER format :return: A byte string of the DER-encoded value NTrr r+) rJ_headerr2 Constructable _indefiniterIrrGr4r<_trailer)rLforcerJheaderrGr4s r*rczAsn1Value.dumpis== << # RS(9W(DE << 5$ .43C3C !$++t{{DHHdmmTF}}(#'==KFC)&!S&4==:PQTZZF$1"DLDM||h&66r+F) NNFNNNNNNNNr )__name__ __module__ __qualname____doc__rIrGr4_bad_tagr=r<rrJrr classmethodr(rSr[rdrXrYrlrpruror}rrnrrcr+r*r'r's FF CHHHGHHG2imDHL\ & Q/   #, 00B,7r+r'ceZdZdZdZdZdZy)ValueMapzl Basic functionality that allows for mapping values from ints or OIDs to python unicode strings Nc|j}|j |jyi|_|jjD]\}}||j|<y)2 Generates _reverse_map from _map N)r?_map _reverse_mapitems)rLr6keyr8s r*r;zValueMap._setupsV nn 88 s//; ((..*JC&)C  U #+r+)rrrrrrr;rr+r*rrs DL *r+rceZdZdZdZy)Castablez A mixin to handle converting an object between different classes that represent the same encoded value, but with different rules for converting to and from native Python values c |j|jjk7rHttdt |t ||j|jj|}|j |_|j |_|j|_|j|_|j|_ |j|_ t|tr"|j|_ |j|_|S)a+ Converts the current object into an object of a different class. The new class must use the ASN.1 encoding for the value. :param other_class: The class to instantiate the new object from :return: An instance of the type other_class z Can not covert a value from %s object to %s object since they use different tags: %d versus %d )r4r?r3r rrGr=r<rrJrr2rrIr)rL other_classrks r*castz Castable.casts ??dnn00 0F+&$""   -====,,==== dM *![[GN"&"2"2G r+N)rrrrrrr+r*rrs  "r+rc8eZdZdZdZdZdZdZfdZxZ S)rz A mixin to handle string types that may be constructed from chunks contained within an indefinite length BER-encoded container Fc@|js|jSd}t|j}d}||krQt |j||j \}}||j }n||j z }||krQ||jS|S)zc :return: A concatenation of the native values of the contained chunks rN)r0)r _as_chunkrDrJr5r? _merge_chunks)rLpointer contents_lenoutput sub_values r*rzConstructable._merge_chunkss >># #4==)  $!-dmmW4>>!Z Iw~"002)1133  $ >>># # r+c|jS)a A method to return a chunk of data that can be combined for constructed method values :return: A native Python value that can be added together. Examples include byte strings, unicode strings or tuples. rJrZs r*rzConstructable._as_chunks}}r+c|jS)a Returns a native value that can be round-tripped into .set(), to result in a DER encoding. This differs from .native in that .native is designed for the end use, and may account for the fact that the merged value is further parsed as ASN.1, such as in the case of ParsableOctetString() and ParsableOctetBitString(). :return: A python value that is valid to pass to .set() )rrZs r*_setable_nativezConstructable._setable_natives{{r+ctt| |||jr |j |j yy)a% Copies the contents of another Constructable object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)superrrnrrHrrLrrr?s r*rnzConstructable._copys; mT( :    HHU**, - r+) rrrrrrrrrn __classcell__r?s@r*rrs(K4  ..r+rcDeZdZdZdZdZdZdZdZe dZ d dZ y ) Voidz A representation of an optional value that is not present. Has .native property and .dump() method to be compatible with other value classes. r+c4|j|jk(S)u :param other: The other Primitive to compare to :return: A boolean rrLrs r*__eq__z Void.__eq__+s$..00r+cy)NFrrZs r* __nonzero__zVoid.__nonzero__6sr+cyNrrrZs r*__len__z Void.__len__9sr+ctdS)Nr)iterrZs r*__iter__z Void.__iter__<s Bxr+cyzl The native Python datatype representation of this value :return: None NrrZs r*rz Void.native?r+cy)rr+rrLrs r*rcz Void.dumpJsr+Nr) rrrrrJrrrrpropertyrrcrr+r*rr#s; H 1 r+rc^eZdZdZdZd dZedZedZd dZ fdZ d dZ xZ S) Anyz A value class that can contain any value, and allows for easy parsing of the underlying encoded value using a spec. This is normally contained in a Structure that has an ObjectIdentifier field and _oid_pair and _oid_specs defined. Nc tj|fi| |Xt|tstt dt |||j df|_|j|_ yy#ttf$r=}|jdd}|jddt |zzf|z|_ |d}~wwxYw)z Sets the value of the object before passing to Asn1Value.__init__() :param value: An Asn1Value object that will be set as the parsed value Nz` value must be an instance of Asn1Value, not %s r rr>) r'rSr2r3r rr?_parsedrcrJrBrK)rLr8r7rRrKs r*rSz Any.__init__gs 4*6*  !%3#F"%( %!&u= %  !I& 66!":DffQi"?)D/"QQSVZZAFG sAA33B?8B::B?cl|j|j|jdjS)z The native Python datatype representation of this value :return: The .native value from the parsed value object r)rparserrZs r*rz Any.natives+ <<  JJL||A%%%r+cX|j|j|jdSzw Returns the parsed object from .parse() :return: The object returned by .parse() rrrrZs r*rz Any.parsed% <<  JJL||Ar+cb|j|jdd||fk7r |xsi}t||j)d|vr|j|dz|d<n|j|d<|j|jz|j z}t |||\}}|||f|_d|_d|_d|_d|_||_d|_|jdS#ttf$r=}|jdd}|jdd t|zzf|z|_ |d}~wwxYw) v Parses the contents generically, or using a spec with optional params :param spec: A class derived from Asn1Value that defines what class_ and tag the value should have, and the semantics of the encoded value. The return value will be of this type. If omitted, the encoded value will be decoded using the standard universal tag based on the encoded tag number. :param spec_params: A dict of params to pass to the spec object :return: An object of the type spec, or if not present, a child of Asn1Value Nr rr<r0r1Fr+r while parsing %s) r_tag_type_to_explicit_implicitr<rrJrr5r4r=rBr3rKr) rLr0r1 passed_paramsrJ parsed_valuer9rRrKs r*rz Any.parsesE$ << 4<<!#4{8K#K  + 1r .}===,!]248MMMR\D]4] j148MM j1<<$--7$--G". -# a !-dK@   $ % " ( # ||A  * vvabz&&)&>4&PPRUYY sB1C""D.18D))D.c\tt| ||||j|_y)a Copies the contents of another Any object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)rrrnrrs r*rnz Any._copys& c4ui0 / r+cx|j|j|jdj|S)rrr)rrrcrs r*rczAny.dumps3 <<  JJL||A##%#00r+rNNr) rrrrrrSrrrrrnrcrrs@r*rr\sLG8 & &  0d 01r+rceZdZdZdZdZdZdZdZdZ dZ e ddZ dZ ddZedZej"dZedZd Zed Zed Zd Zd ZfdZddZxZS)ChoicezF A class to handle when a value may be one of several options Nc xt|tstdt|zt ||||\}}|S)a Loads a BER/DER-encoded byte string using the current class as the spec :param encoded_data: A byte string of BER or DER encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :return: A instance of the current class r.r/)r2rr3rr5)r6r)r&r7r8r9s r*r(z Choice.loads? ,1H9UaKbbc c 3FSYZq r+c|j}i|_i|_t|jD][\}}t |dkr|ifz}||j|<t |d|d}||j|<||j|d<]y)zS Generates _id_map from _alternatives to allow validating contents rr"r rN)r?_id_map _name_map enumerate _alternativesrD_build_id_tuple)rLr6indexinfoid_s r*r;z Choice._setup+s nn  $S%6%67KE44y1}re|+/!!%(!$q'473C$CKK %*CMM$q' " 8r+c t|tj|fi| |jdt t d|=t |trUt|dk7r(t t dt|t|t|jd\}}t |tr@t|dk7r(t t dt|t||d}|d}||jvrt t d |t||j||_|j|j\}}}t ||s ||fi|}n t!||}||_yy#tt$f$r=}|j&dd}|j&dd t|zzf|z|_|d}~wwxYw) aq Checks to ensure implicit tagging is not being used since it is incompatible with Choice, then forwards on to Asn1Value.__init__() :param name: The name of the alternative to be set - used with value. Alternatively this may be a dict with a single key being the name and the value being the value, or a two-element tuple of the name and the value. :param value: The alternative value to set - used with name :raises: ValueError - when implicit param is passed (or legacy tag_type param is "implicit") r=Nz The Choice type can not be implicitly tagged even if in an implicit module - due to its nature any tagging must be explicit r z When passing a dict as the "name" argument to %s, it must have a single key/value - however %d were present rr"z When passing a tuple as the "name" argument to %s, it must have two elements, the name and value - however %d were present z The name specified, "%s", is not a valid alternative for %s r>)rr'rSr{rBr r2rzrDrlistrtupler_choicer _fix_taggingrr3rK) rLnamer8r7r9r0paramsrRrKs r*rSzChoice.__init__;s$ 'v.4*6*< zz*%1 "dD)4yA~( &dOI*#'tzz|"4Q"7KD%dE*4yA~( &dOI*!GE7Dt~~-$V!$ & $~~d3 "&"4"4T\\"B4!%. 1&1E(7E$ [ ^I& 66!":DffQi"?)D/"QQSVZZAFG sE$F G8GGc^|j|jjS|jS)zj :return: A byte string of the DER-encoded contents of the chosen alternative )rrJ _contentsrZs r*rJzChoice.contentss( << #<<(( (~~r+c||_y)zo :param value: A byte string of the DER-encoded contents of the chosen alternative NrrLr8s r*rJzChoice.contents r+ct|js!|j|jd|_|jS)zc :return: A unicode string of the field name of the chosen alternative r)_namerrrZs r*rz Choice.names0 zz++DLL9!4&PPRUYY s=A##B/28B**B/c"|jS)zT :return: An Asn1Value object of the chosen alternative )rrZs r*rz Choice.chosenszz|r+c.|jjS)z The native Python datatype representation of this value :return: The .native value from the contained value object )rrrZs r*rz Choice.natives{{!!!r+c ||f}|jS|jd|k7rttdt|t |t |\\}}}}}}}||f}||j vr|j ||_y|je|jYt |jdkDrttdt|||j|jfk(rd|_y|j||}|j Dcgc]}|j|d|d}}ttd|t|dj|cc}w) a Ensures that the class and tag specified exist as an alternative :param class_: The integer class_ from the encoded value header :param tag: The integer tag from the encoded value header :param contents: A byte string of the contents of the value - used when the object is explicitly tagged :raises: ValueError - when value is not a valid alternative Nrz %s was explicitly tagged, but the value provided does not match the class and tag r z| %s was implicitly tagged, but more than one alternative exists rzs Value %s did not match the class and tag of any of the alternatives in %s: %s , ) r<rBr rrrDrrrGr4r_format_class_tagjoin) rLrGr4rJrr9asn1pairasn1ss r*validatezChoice.validatesw$sm == $}}R C' dO ".4Hc(m-L * &faaA3-C $,, <<,DL  ;; "txx';4%%&* dO "t{{DHH--  %%fc2FJllSld''Qa9lS   dO IIe    TsE(c>dt|jd|dS)zo :return: A unicode string of a human-friendly representation of the class and tag [r`])rEupper)rLrGr4s r*r zChoice._format_class_tags 2&9??A3GGr+ctt| |||j|_|j|_||j |_y)a Copies the contents of another Choice object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)rrrnrrrrs r*rnz Choice._copys< fd!%3}} [[  / r+c|j|jdddk(rd}|jj||_|j|r^d|_|jK|jD]<\}}t |d||j|jz|jz|_>|j|jzS)rNrrTrr+r )rrrcrr<r)rLrrGr4s r*rcz Choice.dump-s << # RS(9W(DE)))6 << 5DL}}(#'==KFC#/3 t~~@]#^aeamam#mDL$1||dnn,,r+rr)rrrrrrrrrrrrr(r;rSrrJsetterrrrrrr rnrcrrs@r*rrs G EGIMGI*+ Rh  __$""> @H0"-r+rceZdZdZdZdZeddZddZdZ dZ dZ dZ d Z d Zd Zd Zdd ZddZedZdZdZdZdZy)Concata A class that contains two or more encoded child values concatentated together. THIS IS NOT PART OF THE ASN.1 SPECIFICATION! This exists to handle the x509.TrustedCertificate() class for OpenSSL certificates containing extra information. Nc|||S)a Loads a BER/DER-encoded byte string using the current class as the spec :param encoded_data: A byte string of BER or DER encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :return: A Concat object )rJr&r)r6r)r&s r*r(z Concat.loadSs L88r+c<|y t|}g|_d}|jD];}||krt|||\}}n|}|jj |=|r||k7r||z }t d|z|P|jdgt|jz|_t|D]\} } |j| | yy#t t f$r=} | jdd} | jddt|zzf| z| _| d} ~ wwxYw)a :param value: A native Python datatype to initialize the object value with :param contents: A byte string of the encoded contents of the value :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists in contents :raises: ValueError - when an error occurs with one of the children TypeError - when an error occurs with one of the children Nr)rr04Extra data - %d bytes of trailing data were providedr r>) rD _children _child_specsr5appendrBr3rKrr __setitem__) rLr8rJr&roffsetr0 child_value extra_bytesrRrKrdatas r*rSzConcat.__init__es7"   "8} !# --D ,.:8VZ^._+ V&*f NN))+6 .f 4"."7K$%[^i%ijj  ~~%"&#d.?.?*@!@(/ t  - 0   * vvabz&&)&CiPTo&UUWZ^^ sA8CD8DDcNtr|jS|jSrUrVrZs r*r[zConcat.__str__r\r+c"|jS)z; A byte string of the DER-encoded contents rcrZs r*rXzConcat.__bytes__s yy{r+ct|Sr^)rCrZs r*rYzConcat.__unicode__s Dzr+c ldt|dt|dt|jdS)r^r_r`ra)rrbrCrcrZs r*rdzConcat.__repr__s$ )4$tyy{:KLLr+cf|j}|j|tj|S)z| Implements the copy.copy() interface :return: A new shallow copy of the Concat object )r?rnrorjs r*rpzConcat.__copy__s'.." dDII&r+c|j}||t|<|j|tj|S)z Implements the copy.deepcopy() interface :param memo: A dict for memoization :return: A new deep copy of the Concat object and all child objects )r?rbrnrorrrss r*ruzConcat.__deepcopy__s4.." RX dDMM*r+c,tj|S)zQ Copies the object :return: A Concat object rwrZs r*roz Concat.copyrxr+c |j|jk7r(ttdt|t|||j|_y)a Copies the contents of another Concat object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects rN)r?r3r rrrs r*rnz Concat._copysP >>U__ ,F% $  #5??3r+cd|z}t|t|dt|t|d|jD]}|j |dzy)rr Object #z Children:r"N)rrrbrrrLrrchilds r*rz Concat.debugsN  " 69T?BtHEF )*^^E KK Q '$r+cVd}|jD]}||j|z }|S)rr+r)rrcrLrrJr4s r*rcz Concat.dumps1^^E   / /H$r+c"|jS)z` :return: A byte string of the DER-encoded contents of the children r)rZs r*rJzConcat.contentssyy{r+c,t|jSz. :return: Integer )rDrrZs r*rzConcat.__len__s 4>>""r+c |t|jdz kDs|dkrttd|t ||j |S)z Allows accessing children by index :param key: An integer of the child index :raises: KeyError - when an index is invalid :return: The Asn1Value object of the child specified r rzN No child is definition for position %d of %s )rDr KeyErrorr rrrLrs r* __getitem__zConcat.__getitem__!sX T&&'!+ +sQw6$  ~~c""r+c |t|jdz kDs|dkrttd|t |t |t sttd|t |||j|<y)aG Allows settings children by index :param key: An integer of the child index :param value: An Asn1Value object to set the child to :raises: KeyError - when an index is invalid ValueError - when the value is not an instance of Asn1Value r rzK No child is defined for position %d of %s zz Value for child %s of %s is not an instance of asn1crypto.core.Asn1Value N) rDr r;r rr2r'rBr)rLrr8s r*r"zConcat.__setitem__:s T&&'!+ +sQw6$  %+V$  $sr+c,t|jS)zB :return: An iterator of child values )rrrZs r*rzConcat.__iter__^s DNN##r+r)NNFr)rrrrr rrr(rSr[rXrYrdrprurornrrcrrJrr=r"rrr+r*rrFsLI99"+.Z &M  #4. ("##2"$H$r+rc:eZdZdZdZdZd dZdZd dZdZ dZ y) PrimitivezO Sets the class_ and method attributes for primitive, universal values rNc 4tj|fi| |||_y||j|y||j|yy#tt f$r=}|j dd}|j ddt|zzf|z|_|d}~wwxYw)a^ Sets the value of the object before passing to Asn1Value.__init__() :param value: A native Python datatype to initialize the object value with :param default: The default value if no value is specified :param contents: A byte string of the encoded contents of the value Nr rr>)r'rSrJrHrBr3rKr)rLr8rPrJr7rRrKs r*rSzPrimitive.__init__ps 4*6* # ( "$!%I& 66!":DffQi"?)D/"QQSVZZAFG s! A A A B8BBc t|ts(ttdt |t |||_||_d|_|jdk7rd|_yy)_ Sets the value of the object :param value: A byte string H %s value must be a byte string, not %s Nr+) r2rr3r rrrJrrrs r*rHz Primitive.setsg%*F$%     ==C DM r+c|j|jdddk(rd}|r$|j}d|_|j|tj |S)rNrrT)rrrJrHr'rcrLrrs r*rczPrimitive.dumpsS << # RS(9W(DE [[F DM HHV ~~d##r+c||k( Srrrs r*__ne__zPrimitive.__ne__s5=  r+ct|tsy|j|jk7ry|jj|jjk7ry|j|jk(r|j|jk(ryt |jj t |jgzt tttgz }t |jj t |jgzt tttgz }||zr|j|jk(S|js$|js|js |jr=|jj|jjk(S|j|jk(S)rFT) r2rArJr?r4rH __bases__r'rr=r<rrc)rLr self_bases other_basess r*rzPrimitive.__eq__sR%+ ==ENN * >>  !4!4 4 >>U__ ,%..1P$..223c4>>:J6KKsT]_hjrSsOtt 5??445U__> >yy{ejjl**r+NNNr) rrrrrGrIrSrHrcrIrrr+r*rArAgs,F F> .$.!#+r+rAcFeZdZdZdZdZdZdZfdZe dZ xZ S)AbstractStringz A base class for all strings that have a known encoding. In general, we do not worry ourselves with confirming that the decoded values match a specific set of characters, only that they are decoded into a Python unicode string latin1Nc 2t|ts(ttdt |t |||_|j |j|_d|_ |jrd|_ d|_ |jdk7rd|_ yy)zb Sets the value of the string :param value: A unicode string K %s value must be a unicode string, not %s NFrr+) r2rr3r r_unicoderg _encodingrJrrrIrrs r*rHzAbstractString.sets%)F$%    T^^4    $D DK ==C DM r+c|jy|j.|jj|j|_|jS)r^)rJrTrdecoderUrZs r*rYzAbstractString.__unicode__ sD ==  ==  ..077GDM}}r+cPtt| |||j|_y)a& Copies the contents of another AbstractString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)rrPrnrTrs r*rnzAbstractString._copys! nd)%; r+c<|jy|jSz The native Python datatype representation of this value :return: A unicode string or None N)rJrYrZs r*rzAbstractString.native(s  == !!r+) rrrrrUrTrHrYrnrrrrs@r*rPrPs9IH 4  ' " "r+rPc6eZdZdZdZdZdZdZedZ y)Booleanz7 Represents a boolean in both ASN.1 and Python r cvt||_|sdnd|_d|_|jdk7rd|_yy)z Sets the value of the object :param value: True, False or another value that works with bool() Nr+)boolrrJrrrs r*rHz Boolean.set>s9E{ ','  ==C DM r+c"|jS)4 :return: True or False )__bool__rZs r*rzBoolean.__nonzero__Ms }}r+c |jdk7S)rcr_rrZs r*rdzBoolean.__bool__Ts }}''r+cv|jy|j|j|_|jS)z{ The native Python datatype representation of this value :return: True, False or None N)rJrrdrZs r*rzBoolean.native[s2 ==  << ==?DL||r+N) rrrrr4rHrrdrrrr+r*r]r]7s1 C  (  r+r]c0eZdZdZdZdZdZedZy)Integerz8 Represents an integer in both ASN.1 and Python r"c "t|trg|jtt dt |||j vrtt dt |||j |}n8t|ts(tt dt |t ||jr||jvr|j|n||_ t|d|_ d|_ |jdk7rd|_ yy)z Sets the value of the object :param value: An integer, or a unicode string if _map is set :raises: ValueError - when an invalid value is passed Nz\ %s value is a unicode string, but no _map provided zR %s value, %s, is not present in the _map z %s value must be an integer or unicode string when a name_map is provided, not %s Tsignedr+)r2rrrBr rrrr3rrrJrrrs r*rHz Integer.setss eW %yy  dO "D--- dO "%%e,EE9-F$%  ,099$))9Ktyy'QV $U48  ==C DM r+c0t|jdS)1 :return: An integer Trj)rrJrZs r*__int__zInteger.__int__s dmmD99r+c|jy|jW|j|_|j6|j|jvr|j|j|_|jSzz The native Python datatype representation of this value :return: An integer or None N)rJrrnrrZs r*rzInteger.natives_ ==  << <<>DLyy$)B#yy6 ||r+N) rrrrr4rHrnrrrr+r*rhrhls- C. `:r+rhcBeZdZdZdZdZdZfdZedZ xZ S)_IntegerBitStringzY A mixin for IntegerBitString and BitString to parse the contents as an integer. rc|jrgStrt|jdn|jd}t |jdd}t |jdz dz}|s||dfgSt |jdk(rt dj||dkDrt dj|t|d|zdz z|}||z}||z}|||fgS) a Parse the contents of a primitive BitString encoding as an integer value. Allows reconstructing indefinite length values. :raises: ValueError - when an invalid value is passed :return: A list with one tuple (value, bits, unused_bits) where value is an integer with the value of the BitString, bits is the bit count of value and unused_bits is a tuple of 1s and 0s. rr Nr$Empty bit string has {0} unused bitsBit string has {0} unused bits) rrWordrJrrDrBformat_int_to_bit_tuple)rLunused_bits_lenr8bits unused_bitss r*rz_IntegerBitString._as_chunks   I37#dmmA./T]]1=Mt}}QR01DMM"Q&!+D"%& & t}}  "CJJ?[\ \ Q =DD_UV V'!2F!1K(Lo^  /! k*++r+c|js|jdSd}d}d}|jD]#\}}}|dzr td||z }||z|z}%|||fS)aa Combines the chunks into a single value. :raises: ValueError - when an invalid value is passed :return: A tuple (value, bits, unused_bits) where value is an integer with the value of the BitString, bits is the bit count of value and unused_bits is a tuple of 1s and 0s. rrrv4Only last chunk in a bit string may have unused bits)rrrrB)rLr8 total_bitsr}chunkr|s r*_chunks_to_intz _IntegerBitString._chunks_to_ints>>#A& &  )-(:(:(< $E4A~ !WXX $ Jd]e+E )=j+--r+cPtt| |||j|_y)a) Copies the contents of another _IntegerBitString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)rrrrn _unused_bitsrs r*rnz_IntegerBitString._copy s% ,UI>!..r+c2|j|jSzp The unused bits of the bit string encoding. :return: A tuple of 1s and 0s rrrZs r*r}z_IntegerBitString.unused_bits    r+) rrrrrrrrnrr}rrs@r*rrrrs3 L%,N.> / ! !r+rrc@eZdZdZdZdZdZdZdZdZ e dZ y) BitStringzK Represents a bit string from ASN.1 as a Python tuple of 1s and 0s rNctj||j}|j,t |jj dz|_yy)rNr )rr;r?rmaxkeys_size)rLr6s r*r;zBitString._setup2sD nn 88 DIINN,-1CI r+c t|tr|jtt dt |dg|j z}||_td|j D]*}|jj|}|!||vs&d||<,djtt|}n|jtk(r|j||_n\t|_t|D]?\}}|s |jj||}|jj!|Adjtt|}n(t#t dt |t ||j\t%||j kDr3tt dt ||j t%||j'd}t%|}|d z}d} |dk7r d |z } |d| zz }t)t+j,|d z } | r t/| } nd } |dk(rd } nt/t)|d } t%| | k7rd | t%| z z| z} | | z|_d | z|_d|_|j6rd|_d|_|j:d k7rd |_yy)z Sets the value of the object :param value: An integer or a tuple of integers 0 and 1 :raises: ValueError - when an invalid value is passed NF %s._map has not been defined rr rWz %s value must be a tuple of ones and zeros or a set of unicode strings, not %s zf %s value must be at most %s bits long, specified was %s long 0rtr_r+r")rF)r2rHrrBr rrrranger{rmaprr?rraddr3rDrstripintmathceilrrJrrrrIr) rLr8r|rrbitrsizesize_mod extra_bits size_in_bytesextra_bits_byte value_bytess r*rHz BitString.set=s eS !yy  dO "3#D DLq$**-iimmE*;%<"#DK .GGC./E __ %yy $ "u "+E"2JE3#yy}}UE: ((.#3GGC/0EF$%   99 5zDJJ& dOJJJ "LL%E5z!8 q=XJ S:% %EDIIdQh/0 *:6O%O B;K&s5!}5K { } ,"mc+6F&FG;VK'+5  :-   $D DK ==C DM r+ct|t}|set|jtst t dt |||jvrt t dt |||j |j|j4t|j|dzk\rt|j|Sy|r|jj||}||jvS)aG Retrieves a boolean version of one of the bits based on a name from the _map :param key: The unicode string of one of the bit names :raises: ValueError - when _map is not set or the key name is invalid :return: A boolean if the bit is set rT %s._map does not contain an entry for "%s" r F) r2rrrzrBr rrrrrDrar{)rLris_ints r*r=zBitString.__getitem__sC+dii. dO "$+++ dO " <<  KK 99 4<< C!G+DLL-.. ))--S)Cdll""r+ct|t}|sW|jtt dt |||j vrtt dt |||j |j|jZt|j}t|dz }||kDr|jdg||z z|rdnd||<t||_ns|r|jj||}|r*||jvrE|jj|n)||jvr|jj||j!|jy)a Sets one of the bits based on a name from the _map :param key: The unicode string of one of the bit names :param value: A boolean value :raises: ValueError - when _map is not set or the key name is invalid Nrrr r)r2rrrBr rrrrrrDextendrr{rremoverH)rLrr8r new_nativemax_keys r*r"zBitString.__setitem__sNC+yy  dO "$+++ dO " <<  KK 99 dll+J*o)GW}!!1#w"78#(aaJsO ,DLiimmC-dll*LL$$S)$,,&LL'', r+c|j7|j|jdn|jt|j|j \}}|_t ||}|jrht|_t|D]?\}}|s |jj||}|jj|A|jS||_|jS)z The native Python datatype representation of this value :return: If a _map is set, a set of names, or if no _map is set, a tuple of integers 1 and 0. None if no value. r) rJrrHrrrrzrr{r)rL int_value bit_countr|rrrs r*rzBitString.native s == yy   << 6:6I6I6K 3Iy$"3$Y :Dyy"u "+D/JE3#yy}}UE: ((.#2 || $ ||r+) rrrrr4rr;rHr=r"rrrr+r*rr)s? C E 2a F-#^7rr+rc`eZdZdZdZdZdZdZdZfdZ dZ e d Z e d Z xZS) OctetBitStringzB Represents a bit string in ASN.1 as a Python byte string rNrc t|ts(ttdt |t |||_d|z|_d|_d|_|jrd|_ d|_ |jdk7rd|_ yy) Sets the value of the object :param value: A byte string :raises: ValueError - when an invalid value is passed rEr_rNFrr+) r2rr3r r_bytesrJrrrrIrrs r*rHzOctetBitString.set5 s%*F$%   %    $D DK ==C DM r+ct|jy|j|js,|jd\|_|_|jS|j }d|_|D]#}|jr t d|d|_%djd|D|_|jS)4 :return: A byte string r+rrrr c3&K|] }|d yw)rNr).0rs r* z+OctetBitString.__bytes__..g s&DVEuQxVs)rJrrrrrrBr)rLchunksrs r*rXzOctetBitString.__bytes__T s ==  ;; ##151A!1D. T.{{++-$&!#E((()_``(-aD% $ "hh&DV&DD {{r+crtt| |||j|_|j|_y)a& Copies the contents of another OctetBitString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)rrrnrrrs r*rnzOctetBitString._copyk s/ nd)%;ll !..r+ctrt|jdn|jd}|s|jdddfgSt|jdk(rt dj ||dkDrt dj |d|zdz }trt|jdn|jd}||z}|jddtr t |n t|fz}t||z|}||fgS) z Allows reconstructing indefinite length values :raises: ValueError - when an invalid value is passed :return: List with one tuple, consisting of a byte string and an integer (unused bits) rr Nrrurvrwr) rWrxrJrDrBrychrbytesrz)rLr{mask last_byte zeroed_byter8r}s r*rzOctetBitString._as_chunk{ s48#dmmA./T]]1=M]]12&+, , t}}  "CJJ?[\ \ Q =DD_UV V_$).2C b)* b8I  4%'  a#4s;'7UK>EZ[' D(8/J  $%%r+c<|jy|jS} The native Python datatype representation of this value :return: A byte string or None NrJrXrZs r*rzOctetBitString.native  == ~~r+c2|j|jSrrrZs r*r}zOctetBitString.unused_bits rr+)rrrrr4rrrHrXrnrrrr}rrs@r*rr( sZ CFL >./ &D     ! !r+rc*eZdZdZdZdZedZy)IntegerBitStringz> Represents a bit string in ASN.1 as a Python integer rc rt|ts(ttdt |t ||dkrt tdt ||||_dt|dz|_d|_ d|_ |jrd |_ d|_ |jd k7rd |_ yy) Sets the value of the object :param value: An integer :raises: ValueError - when an invalid value is passed M %s value must be a positive integer, not %s rM %s value must be a positive integer, not %d r_TrjrNFr+)r2rr3r rrBrrrJrrrrIrrs r*rHzIntegerBitString.set s%+F$%   19V$   ,uT"BB    $D DK ==C DM r+c|jy|j|j\|_}|_|jSrp)rJrrr)rL__s r*rzIntegerBitString.native s? ==  << 262E2E2G /DL"d/||r+Nrrrrr4rHrrrr+r*rr s( C& Pr+rcFeZdZdZdZdZdZdZfdZe dZ xZ S) OctetStringz; Represents a byte string in both ASN.1 and Python Nc t|ts(ttdt |t |||_||_d|_|jrd|_d|_ |jdk7rd|_ yyrDrENFrr+ r2rr3r rrrJrrrIrrs r*rHzOctetString.set %*F$%       $D DK ==C DM r+cv|jy|j|j|_|jSrr+rJrrrZs r*rXzOctetString.__bytes__ 5 ==  ;; ,,.DK{{r+cPtt| |||j|_y)a# Copies the contents of another OctetString object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)rrrnrrs r*rnzOctetString._copy+ s! k4&ui8ll r+c<|jy|jSrrrZs r*rzOctetString.native: rr+) rrrrr4rrHrXrnrrrrs@r*rr s9 CF 4  #    r+rc4eZdZdZdZdZdZedZdZ y)IntegerOctetStringz? Represents a byte string in ASN.1 as a Python integer rNc tt|ts(ttdt |t ||dkrt tdt ||||_t|d|j|_ d|_ |jrd|_ d|_ |jdk7rd|_ yy)rrrrF)rkwidthNr+)r2rr3r rrBrr_encoded_widthrJrrrIrrs r*rHzIntegerOctetString.setV s%+F$%   19V$   $U5@S@ST    $D DK ==C DM r+c|jy|jt|j|_|jSrp)rJrrrrZs r*rzIntegerOctetString.native| s: ==  << )$*<*<*>?DL||r+c||_|j5t|j|k7r|j|jyyy)z Set the explicit enoding width for the integer :param width: An integer byte width to encode the integer to N)rrJrDrHr)rLrs r*set_encoded_widthz$IntegerOctetString.set_encoded_width s?$ == $T]]);u)D HHT[[ !*E $r+) rrrrr4rrHrrrrr+r*rrI s4 C N$ L   "r+rcteZdZdZdZdZd dZdZd dZdZ dZ fdZ e d Z e d Zd d ZxZS)ParsableOctetStringrNc d}|$|"t|tr|j}d}tj|fd|i||r||j df|_yy)a Allows providing a parsed object that will be serialized to get the byte string value :param value: A native Python datatype to initialize the object value with :param parsed: If value is None and this is an Asn1Value object, this will be set as the parsed value, and the value will be obtained by calling .dump() on this object. FNTr8)r2r'rcrArSr?r)rLr8rr7 set_parseds r*rSzParsableOctetString.__init__ s` =V/Jvy4QKKMEJ47u77 "F$4$4d;DL r+c t|ts(ttdt |t |||_||_d|_|jrd|_d|_ |jdk7rd|_ yyrrrs r*rHzParsableOctetString.set rr+c|j|jdd||fk7r)t|j||\}}|||f|_|jdS)rr rrr)rr5rX)rLr0r1rr9s r*rzParsableOctetString.parse s[$ << 4<<!#4{8K#K*4>>+;$T_`OL!($ ># #r+cX|j|j|jdSrrrZs r*rzParsableOctetString.parsed# rr+c|jrd}|rM|j|jj|}n |j}d|_|j |tj|S)rTNr)rrrrcrrJrHr'rGs r*rczParsableOctetString.dump1 sa   E ||')))6 DM HHV ~~d##r+rr)rrrr4rrrSrHrrXrrnrrrrcrrs@r*rr s_ CGF<0 4.  0 $$   $r+rceZdZdZdZdZy)ParsableOctetBitStringrc t|ts(ttdt |t |||_d|z|_d|_|jrd|_d|_ |jdk7rd|_ yy)rrEr_NFrr+rrs r*rHzParsableOctetBitString.setP s%*F$%   %    $D DK ==C DM r+ctrt|jdn|jd}|r td|jddS)z Allows reconstructing indefinite length values :raises: ValueError - when an invalid value is passed :return: A byte string rz1ParsableOctetBitString should have no unused bitsr N)rWrxrJrB)rLr{s r*rz ParsableOctetBitString._as_chunkn sD48#dmmA./T]]1=M PQ Q}}QR  r+N)rrrr4rHrrr+r*rrL s C <!r+rc.eZdZdZdZdZdZedZy)Nullz< Represents a null value in ASN.1 as None in Python r+cd|_y)zV Sets the value of the object :param value: None r+Nrrs r*rHzNull.set s  r+cyrrrZs r*rz Null.native rr+N) rrrrr4rJrHrrrr+r*rr s, CHr+rcdeZdZdZdZdZedZedZdZ dZ e dZ e d Z y) ObjectIdentifier` Represents an object identifier in ASN.1 as a Python unicode dotted integer string Nc|jttdt|t |t st tdt||jj||S)a^ Converts a dotted unicode string OID into a mapped unicode string :param value: A dotted unicode string OID :raises: ValueError - when no _map dict has been defined on the class TypeError - when value is not a unicode string :return: A mapped unicode string > %s._map has not been defined H value must be a unicode string, not %s )rrBr rr2rr3r{r6r8s r*rzObjectIdentifier.map sv 88 V#  %)F%  xx||E5))r+c|tvr|jdt|<|jtt dt |t |tstt dt |||jvr|j|Stj|stt dt |||S)a Converts a mapped unicode string value into a dotted unicode string OID :param value: A mapped unicode string OR dotted unicode string OID :raises: ValueError - when no _map dict has been defined on the class or the value can't be unmapped TypeError - when value is not a unicode string :return: A dotted unicode string OID TrrzL %s._map does not contain an entry for "%s" ) r@r;rrBr rr2rr3r_OID_REmatchrs r*unmapzObjectIdentifier.unmap s n $ ELLN"&N3  88 V#  %)F%   C$$ $##E* *}}U#V#   r+c t|ts(ttdt |t |||_|j ||jvr|j|}d|_d}t|jdD]\}}t|}|dk(r|}|dk(rS|dkDrttdt||dkr#|d k\rttd t||d z|z}td |z}|d z }|dkDrtd d |zz|z}|d z }|dkDr|xj|z c_d|_|j dk7rd|_yy)a  Sets the value of the object :param value: A unicode string. May be a dotted integer string, or if _map is provided, one of the mapped values. :raises: ValueError - when an invalid value is passed rSNr+.rr r"z\ First arc must be one of 0, 1 or 2, not %s (z Second arc must be less than 40 if first arc is 0 or 1, not %s rv)r2rr3r rrrrrJrsplitrrBrCrrr)rLr8firstrpart encoded_parts r*rHzObjectIdentifier.set s%)F$%   99 )))))%0 $U[[%56KE4t9Dz!19$VU & QY42:$VT & d*"4$;/L19D(&ttd{';<|K qy( MM\ )M=7@ ==C DM r+c|jSr+)dottedrZs r*rYzObjectIdentifier.__unicode__? s {{r+c|j-g}d}|jD]}tr t|}|dz}||dzz }|dzdk(s+t |dk(r|dk\r8|j t d|j t |dz n|dk\r8|j t d|j t |dz nO|j t d|j t |n|j t |d}dj||_|jS) z :return: A unicode string of the object identifier in dotted notation, thus ignoring any mapped value rrrPr"rr r)_dottedrJrWrxrDr!rr)rLrr bytes r*r zObjectIdentifier.dottedG s  << FD t9Dczs "$;!#6{a'2:"MM'!*5"MM'$)*<=!RZ"MM'!*5"MM'$)*<="MM'!*5"MM'$-8 gdm4D'&*88F+DL||r+c|jy|j|j|_|j6|j|jvr|j|j|_|jS)aC The native Python datatype representation of this value :return: A unicode string or None. If _map is not defined, the unicode string is a string of dotted integers. If _map is defined and the dotted string is present in the _map, the mapped value is returned. N)rJrr rrZs r*rzObjectIdentifier.nativek s] ==  << ;;DL 99 T\\TYY%>99T\\2DL||r+)rrrrr4rrrrrHrYrr rrr+r*rr sq CG**B//b? B!!Fr+rceZdZdZdZy)ObjectDescriptorzO Represents an object descriptor from ASN.1 - no Python implementation rvNrrrrr4rr+r*rr  Cr+rceZdZdZdZy) InstanceOfzF Represents an instance from ASN.1 - no Python implementation rtNrrr+r*rr rr+rceZdZdZdZy)RealzH Represents a real number from ASN.1 - no Python implementation Nrrr+r*rr rr+rc*eZdZdZdZdZedZy) Enumeratedz\ Represents a enumerated list of integers from ASN.1 as a Python unicode string c t|ts8t|ts(tt dt |t |t|tr=||j vrtt dt |||j |}n-||jvrtt dt ||tj||y)z Sets the value of the object :param value: An integer or a unicode string from _map :raises: ValueError - when an invalid value is passed zY %s value must be an integer or a unicode string, not %s zL %s value "%s" is not a valid value zB %s value %s is not a valid value N) r2rrr3r rrrBrrhrHrs r*rHzEnumerated.set s%+Jug4NF$%   eW %D--- dO "%%e,E $)) #V$    D% r+c|jy|j"|j|j|_|jSr[)rJrrrnrZs r*rzEnumerated.native s; ==  << 99T\\^4DL||r+Nrrr+r*rr s( C)!V  r+rceZdZdZdZdZy) UTF8StringzI Represents a UTF-8 string from ASN.1 as a Python unicode string rfNrrrrr4rUrr+r*r!r!  CIr+r!ceZdZdZdZy) RelativeOidr Nrrr+r*r&r& s Cr+r&ceZdZdZdZdZdZdZdZdZ gZ dZ dZ dZ dZdZdZdZddZedZej*d Zd Zd Zd Zd ZdZdZdZddZdZdZdZ ddZ!dZ"edZ#fdZ$ddZ%ddZ&xZ'S)Sequencezf Represents a sequence of fields from ASN.1 as a Python object with a dict-like interface rr NFc tj|fi|d}|1|/d}|j|jd}n|j |}|0 |j r6|j Dcgc]}|d }}t |j}n|j}t |}|D]}|rR|j|} | t|jkr+|j| tur||vr|j|W||vs\|j||||j|t|r@ttdt|dj!t#t%|yycc}w#tt&f$r=} | j(dd} | j(ddt|zzf| z| _| d} ~ wwxYw) a" Allows setting field values before passing everything else along to Asn1Value.__init__() :param value: A native Python datatype to initialize the object value with :param default: The default value if no value is specified FNTrz One or more unknown fields was passed to the constructor of %s: %s r r r>)r'rSchildrenrJ_parse_children_fieldsrHr _field_maprDVOIDrr"rBr rrsortedrr3rK) rLr8rPr7check_existingrr unused_keysrrrRrKs r*rSzSequence.__init__' s 4*6* =W0!N}}$==(%*N((*E  & <<04 = DG D="%ejjl"3K ::< * vvabz&&)&CiPTo&UUWZ^^ s2F* F6BF A3FFG8G  Gc|j |jS|jr|j|jSz` :return: A byte string of the DER-encoded contents of the sequence r,r _is_mutated _set_contentsrZs r*rJzSequence.contentsh : == >> !        ~~r+c||_yze :param value: A byte string of the DER-encoded contents of the sequence Nrrs r*rJzSequence.contentsw rr+c|j}|jF|jD]7}t|tst|ts$|xs|j }9|Sz~ :return: A boolean - if the sequence or any children (recursively) have been mutated _mutatedr,r2r) SequenceOfr7rLmutatedr4s r*r7zSequence._is_mutated R-- == $eX.*UJ2O%<):):) 9EDMM%( r+cd|j|jt|jSr9r,r-rDrZs r*rzSequence.__len__ ) ==  "4==!!r+c |j|jt|ts<||jvrt t d|t||j|}|t|jk\rt t d|t| |j|S#ttf$r=}|jdd}|jddt|zzf|z|_ |d}~wwxYw)a9 Allows accessing fields by name or index :param key: A unicode string of the field name, or an integer of the field index :raises: KeyError - when a field name or index is invalid :return: The Asn1Value object of the field specified NL No field named "%s" defined for %s zL No field numbered %s is present in this %s r rr) r,r-r2rr/r;r rrDrIrBr3rK)rLrrRrKs r*r=zSequence.__getitem__ s ==  "#y)$//)vdO  //#&C #dmm$ $6$   ##C( (I& 66!":DffQi":Yt_"LLNQUUAFG s!B22C>8C99C>c ||j|jt|ts<||jvrt t d|t||j|}|j|\}}}}}|j|||||}d} t|tr|jdu} n|jdu} | rtt d|t|||j|<|j6|j|j|j|j |d<d|_y)a Allows settings fields by name or index :param key: A unicode string of the field name, or an integer of the field index :param value: A native Python datatype to set the field value to. This method will construct the appropriate Asn1Value object from _fields. :raises: ValueError - when a field name or index is invalid NrNFzG Value for field "%s" of %s is not set rT)r,r-r2rr/r;r r_determine_spec _make_valuerrrJrBrrr.r?) rLrr8 field_name field_spec value_spec field_paramsr9 new_value invalid_values r*r"zSequence.__setitem__ s= ==  "#y)$//)vdO  //#&C>B>R>RSV>W; J L!$$ZZW\]  i %%,,4M%..$6M V$  ' c << #15s1C1J1JDLLc*1- . r+c |j|jt|ts<||jvrt t d|t||j|}|j|\}}}|rd|vr#d|vrtt d|t|d|vr6t|j|<|j)d|j|<d|_ y|j|dd|_ y)a/ Allows deleting optional or default fields by name or index :param key: A unicode string of the field name, or an integer of the field index :raises: ValueError - when a field name or index is invalid, or the field is not optional or defaulted NrNrPrOz Can not delete the value for the field "%s" of %s since it is not optional or defaulted T)r,r-r2rr/r;r rr.rBr0rr"r?)rLrrr9rs r* __delitem__zSequence.__delitem__ s ==  "#y)$//)vdO  //#&C,,s+a)61j6NV$    !%DMM# ||'%) T"    S$ ' r+c#<K|jD] }|d yw)zE :return: An iterator of field key names rN)r.)rLrs r*rzSequence.__iter__6s LLDq'M!scL|j|jt}t|jD]\}}|j|}|d}n[|j t k(r6|r"|j|j|}n$|d|dz|dz}n|j|}|dr)d|dvr"|d d i|d}|j|k(r|j||j|_ d|_ |jdk7rd|_ yy) a Updates the .contents attribute of the value with the encoded value of all of the child objects :param force: Ensure all contents are in DER format instead of possibly using cached BER-encoded data Nr+rrrrr"rPr r)r,r-rrr.r?rrIrcwritegetvaluerrr)rLrrJrrr4 child_dump default_values r*r8zSequence._set_contents?s" ==  "9$T\\2KE4MM%(E} E)!%!1!1%!8!=!=E!=!JJ!&qE!H!4uQx!?J"ZZeZ4 Aw9Q/ 'Q 2$q' 2  %%':5 NN: &!3""**, ==C DM r+c*|j}i|_g|_g|_t |j D]e\}}t |dkr|ifz}||j |<||j|d<|jjt|d|dg|j=|j|jd|j|jdf|_ t |j D]\}}|jduxr|d|jv}|jduxr|jd|k(}|s|r|jjdi|jj|d|d|d|ddfyzS Generates _field_map, _field_ids and _oid_nums for use in parsing rrr"r N) r?r/ _field_ids_precomputed_specsrr.rDr!r _oid_pair _oid_nums_spec_callbacksrLr6rfield has_callback is_mapped_oids r*r;zSequence._setupdst nn!#%ckk2LE55zA~ %* E"',CNN58 $ NN ! !/%(E!H"E F 3 == $ ^^CMM!,<=s~~cmm\]N^?_`CM%ckk2LE5..d:^uQx3K^K^?^LMM5S#--:Je:SM}&&--d3&&--uQxq58USTXW[.\] 3r+c|j|\}}}|}d}|j`||jvrR|j|}||}|r|jtk(rt |dk(r |\}}|v|}d}nq||}|}d}nh|}ne|j Y|j d|k(rG|j |j dj}||jvr|j|}|}|||||fS)a Determine how a value for a field should be constructed :param index: The field number :return: A tuple containing the following elements: - unicode string of the field name - Asn1Value class of the field spec - Asn1Value class of the value spec - None or dict of params to pass to the field spec - None or Asn1Value class indicating the value spec was derived from an OID or a spec callback Nr"r r) r.rfr?rrDrerIr _oid_specs) rLrrrSrUrT spec_overridecallbackoids r*rPzSequence._determine_specs *.e)<&j,     +8L8L0L++D1H$TNM!**e3M8Ja8O-:*J !)%/ (, '!.J!+J$(M!.J ^^ 'DNN1,=,F""4>>!#45<>+;L|L#,i.A.A4"H#  L9 r+c |j}|j|jrtgt |jz|_t |jD]l\}\}}}d|vs|j|r|j|\}}}} }n|j|\}}}} }|j|||| d|j |<ny g|_t |j} d} d} t |j} d}| | k}|r^|t|j| | \}} | | k}| | kr |j| xs|j| \}}}} }| rd| vsd| vr|j| |d|dfk7r|tk7rd}t|tr' |di| }|j|d|d|dd }|sNd| vr |j j#tn!|j j#|di| | d z } d } ||rt|tr|}d}|r ||| |fz}n||| fz}n| dkDr| d z| krg}| d z }|dk\rK|j|}t |d krn-d|dvsd|dvr|j#|d|d z}|dk\rKt |d kDrd nd }dj%|}t!t'd| d zt(j+|dt,j+|d |d|||}|r0t/|}t1|t2t4fr|j7d |j j#|| d z } d}|r^t |j }|| kr~|j|\}}} d| vr"|j j#|di| n9d| vr |j j#tnt!t'd||d z }|| kr}yy#t $rYMwxYw#t t8f$rD}d|_|j:d d}|j:ddt=|zzf|z|_|d}~wwxYw)Q Parses the contents and generates Asn1Value objects based on the definitions from _fields. :param recurse: If child objects that are Sequence or SequenceOf objects should be recursively parsed :raises: ValueError - when an error occurs parsing child objects NrPrrrOr"FrTr rsrWr z Data for field %s (%s class, %s method, tag %s) does not match the field definition%s of %s recursezV Field "%s" is missing from structure rr)r?rr.r0rDr,rrcrPrQrrbrrqrrrBr!rr rEr{METHOD_NUM_TO_NAME_MAPrGr2r)r@r-r3rKr)rLr}r6rr9rrRrSrTrUcontents_length child_pointerrh field_lenpartsagainrm choice_matchtesterr4 missed_fields prev_fieldprev_field_infopluralmissed_field_namesrrRrKs r*r-zSequence._parse_childrensnn >> !||!%T\\): : -6t||-D)E>Aq& F*11%8RURhRhinRoOJ J aRVRfRfglRmOJ J a/3/?/? JXbdprv/w e, .E l DM!$..1OMEDLL)IE!O3E=+1$../[h+i(E=%79$..u5T9M9Me9TKAz:|]$|)CyT`G`??51eAha5IIj\_N_,1L)*f=!)-7-G,-GF$*OOE!HeAha$Q37L$0#-#=$(MM$8$8$>$(MM$8$89Sl9S$T % (, (!)m :WZ@[%/ (, $ %\:(N N %\(B B]uqyI'=$&M!&J$/*.,,z*B/!3!%);;yO\]L^?^)001CD"a %/%( $6$:SF)-=)A&$V -11%(;.2258<a* &  "E"ENE!%(J)?@--d-; $$U+ ]` &E)#15e1D.j, ,MM(()Cl)CD</MM((.$V &  )#y)3!)$(!)VI&  DM66!":DffQi":Yt_"LLNQUUAFG  sL CP&PCP!CP*BP P PPPQ&"?Q!!Q&c t|tsttdt ||j (t tdt|t ||j|}|j|}|dS)a Determines the spec to use for the field specified. Depending on how the spec is determined (_oid_pair or _spec_callbacks), it may be necessary to set preceding field values before calling this. Usually specs, if dynamic, are controlled by a preceding ObjectIdentifier field. :param field_name: A unicode string of the field name to get the spec for :return: A child class of asn1crypto.core.Asn1Value that the field must be encoded using zM field_name must be a unicode string, not %s z Unable to retrieve spec for field %s in the class %s because _fields has not been set r") r2rr3r rr.rBrCr/rP)rLrRrrs r*r0z Sequence.specs *g.F*%   << VZ $   +##E*Awr+c|jy|j|j|jd t |_t |jD][\}}|j tk(rt|}||j|< |j|d}|j|j|<] |jS|jS#t$rt|}YJwxYw#ttf$rD}d|_|jdd}|jddt!|zzf|z|_|d}~wwxYw)z The native Python datatype representation of this value :return: An OrderedDict or None. If an OrderedDict, all child values are recursively converted to native representation also. NTr|rr r)rJrr,r-r rr?rrGr. IndexErrorrrrBr3rKr)rLrr4rrRrKs r*rzSequence.natives1 ==  << }}$$$T$2 *} $-dmm$4&PPRUYY  s<AC.C C.C+(C.*C++C..E=?D<<Ec(tt| |||jqg|_|jD]Z}|jt k(r|jj |2|jj |j\yy)a  Copies the contents of another Sequence object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)rr)rnr,r?rr!rorLrrr4r?s r*rnzSequence._copysp h#E95 == $DM??e+MM((/MM((6 ( %r+c|j|jd|z}t|||D]N}|j|j|}|t us*t |d|d|j|dzPy)rNrz Field ""r)r,r-rrIr/r0rr)rLrrrRr4s r*rzSequence.debugsv ==  " "VT"J$$T__Z%@AED FJ?@ JN+ r+c|j|jdddk(rd}|r#|jgk(r|jturd}|r|j ||jr`|j Tt |jD]<\}\}}}|j |tur d|vsd|vr)ttd |tj|S) rNrrTFrrPrOzN Field "%s" is missing from structure ) rr.r?r)r8r,rr0rBr r'rc)rLrrrRr9rs r*rcz Sequence.dumps << # RS(9W(DE T\\R'DNNh,FE    U  + <  " 3J~~d##r+rrr)(rrrrr4rGrIr,rr?r.rfr/rbrdrlrercrSrrJrr7rIrr=r"rYrr8r;rPrQr-r0rrnrrcrrs@r*r)r) s  C F FHIHGOJJ IJI?B  __  ",\5n+Z# J^6-K^^@FP%NB7*, $$r+r)ceZdZdZdZdZdZdZdZdZ dZ ddZ e dZ e jd Z d Zd Zd Zd ZdZdZdZdZdZdZddZddZdZe dZfdZddZddZxZ S)r@z Represents a sequence (ordered) of a single type of values from ASN.1 as a Python object with a list-like interface r*rr NFc |r||_tj|fi| |||_y|||}|Ct |D]\}}|j |||j|j yyy#ttf$r=}|jdd} |jddt|zzf| z|_ |d}~wwxYw)a Allows setting child objects and the _child_spec via the spec parameter before passing everything else along to Asn1Value.__init__() :param value: A native Python datatype to initialize the object value with :param default: The default value if no value is specified :param contents: A byte string of the encoded contents of the value :param spec: A class derived from Asn1Value to use to parse children Nr rr>) _child_specr'rSrJrr"r8rBr3rKr) rLr8rPrJr0r7rr4rRrKs r*rSzSequenceOf.__init__Cs$ #D 4*6* # ( =W%8#E$(1%(8 u((6)9}},**,- %I& 66!":DffQi"?)D/"QQSVZZAFG s A7A A77C8B>>Cc|j |jS|jr|j|jSr5r6rZs r*rJzSequenceOf.contentsnr9r+c||_yr;rrs r*rJzSequenceOf.contents}rr+c|j}|jF|jD]7}t|tst|ts$|xs|j }9|Sr=r>rAs r*r7zSequenceOf._is_mutatedrCr+cx|j|}|jtk(rt|}||j|<|SrErFrHs r*rIzSequenceOf._lazy_childs:  e$ ??e #ENE#(DMM%  r+ctt||jr|}nt|jtr1t|tr|}nt t dt|t|jtrt|ts3t t dt||jjt||jsJ|j}|j|j|j|j||_|}|}n|j|Si}|jjr|jj|d<|jj r/|jj|jjf|d<t#||S)a  Constructs a _child_spec value from a native Python data type, or an appropriate Asn1Value object :param value: A native Python value, or some child of Asn1Value :return: An object of type _child_spec z Can not set a native python value to %s where the _child_spec is Any - value must be an instance of Asn1Value z Can not set a native python value to %s where the _child_spec is the choice type %s - value must be an instance of Asn1Value )r8r<r=)r2rrqrr'rBr rrrrrGr4rJrr<r=r)rLr8rVrwrs r*rQzSequenceOf._make_valuesy eT-- .I ((# .%+!  dO "((& 1eY/  dO$$--"eT%5%56**,  uyy%..I"'I##%#0 0    $ $!%!1!1!:!:F:     $ $"&"2"2"9"94;K;K;O;O!PF: Iv..r+cd|j|jt|jS)rmrKrZs r*rzSequenceOf.__len__rLr+c\|j|j|j|S)zm Allows accessing children via index :param key: Integer index of child )r,r-rIr<s r*r=zSequenceOf.__getitem__s+ ==  "$$r+c|j|j|j|}|t|jk(rB|jj d|j |j j d||j|<|j &|j|j |j |<d|_y)z Allows overriding a child via index :param key: Integer index of child :param value: Native python datatype that will be passed to _child_spec to create new child object NT)r,r-rQrDr!rrr?)rLrr8rVs r*r"zSequenceOf.__setitem__s ==  "$$U+  #dmm$ $ MM  &||' ##D)& c << # $ c 2 9 9DLL  r+c|j|j|jj||j|jj|d|_y)zk Allows removing a child via index :param key: Integer index of child NT)r,r-poprr?r<s r*rYzSequenceOf.__delitem__sO ==  " # << # LL  S ! r+c#K|j|jtdt|jD]}|j |yw)zA :return: An iter() of child objects Nr)r,r-rrDrI)rLrs r*rzSequenceOf.__iter__!sI ==  "1c$--01E""5) )2sAAc ||turyt||js?$ $? ||t|| @ * vvabz&&)&>4&PPRUYY s(A5A0A50A55C8B<<Cc(tt| |||jqg|_|jD]Z}|jt k(r|jj |2|jj |j\yy)a" Copies the contents of another SequenceOf object to itself :param object: Another instance of the same class :param copy_func: An reference of copy.copy() or copy.deepcopy() to use when copying lists, dicts and objects N)rr@rnr,r?rr!rors r*rnzSequenceOf._copysp j$%eY7 == $DM??e+MM((/MM((6 ( %r+c|j|jd|z}t|||D]}|j|dzy)rNrr )r,r-rrr3s r*rzSequenceOf.debugsH ==  " "VT"E KK Q 'r+c|j|jdddk(rd}|r|j|tj|S)rNrrTr)rr8r'rcrs r*rczSequenceOf.dumpsH << # RS(9W(DE    U  +~~d##r+)NNNNrr)!rrrrr4rGrIr,rr?rrSrrJrr7rIrQrr=r"rYrrr!r8r-r0rrnrrcrrs@r*r@r@+s C F FHIHK)V  __  5/n " %>$ *:( ("H  .7* ($r+r@c6eZdZdZdZdZdZdZdZd dZ d dZ y) Setzm Represents a set of fields (unordered) from ASN.1 as a Python object with a dict-like interface r rNc|j}i|_i|_g|_t |j D]Y\}}t |dkr|ifz}||j |<||j|d<||jt|d|d<[|j=|j|jd|j|jdf|_ t |j D]\}}|jduxr|d|jv}|jduxr|jd|k(}|s|r|jjdi|jj|d|d|d|ddfyra) r?r/rbrcrr.rDrrdrerfr!rgs r*r;z Set._setupsp nn!#%ckk2LE55zA~ %* E"',CNN58 $BGCNN?58U1X> ? 3 == $ ^^CMM!,<=s~~cmm\]N^?_`CM%ckk2LE5..d:^uQx3K^K^?^LMM5S#--:Je:SM}&&--d3&&--uQxq58USTXW[.\] 3r+c |j}|j|jrtgt |jz|_t |jD]l\}\}}}d|vs|j|r|j|\}}}} }n|j|\}}}} }|j|||| d|j |<ny i} t |j} d} d} | | krt|j| | \}} |d|df}|jj|}|Gttd| t j|dt"j|d|d|j|xs|j|\}}}} }||rt%|t&r|}d}|r ||| |fz}n||| fz}|r0t)|}t+|t,t.fr|j1d || |<| dz } | | krt |j}t3d|D]}|| vr|j|xs|j|\}}}} }||rt%|t&r|}d}d }| sd}n(d | vrd| vrd}nd | vr t| |<nd| vr |di| | |<|szttd |t5|g|_t3d|D] }|j j7| |"y#tt8f$r=}|j:dd}|j:dd t5|zzf|z|_|d}~wwxYw)ryNrPrrzr"z Data for field %s (%s class, %s method, tag %s) does not match any of the field definitions r Tr|FrOzU Missing required field "%s" from %s rr)r?rr.r0rDr,rrcrPrQrJrrbr{rBr rEr~rqrrGr2r)r@r-rrr!r3rK)rLr}r6rr9rrRrSrTrU child_maprr seen_fieldrrrhrmr4 total_fieldsrmissingrRrKs r*r-zSet._parse_childrensnn >> !||!%T\\): : -6t||-D)E>Aq& F*11%8RURhRhinRoOJ J aRVRfRfglRmOJ J a/3/?/? JXbdprv/w e, .E S I!$--0OMJ/1'-dmm_Vc'd$}Qxq*++C0=$V#-11%(;.2258<a &  **51PT5I5I%5PG:z<%-JzSV>E"ENE!%(J)?@--d-;#( % a I /1Lt||,Lq,/I%**51PT5I5I%5PJj*lM%-JzSVDMq,/ $$Yu%560I& 66!":DffQi":Yt_"LLNQUUAFG s' D=K> BK>'AK>>M  8MM c|j|jg}t|jD]e\}}|j|}|j|\}}}d|vr|di|j|k(rI|j |j |fg|jddj|D cgc]} | d c} |_ d|_ |jdk7rd|_ yycc} w) ac Encodes all child objects into the contents for this object. This method is overridden because a Set needs to be encoded by removing defaulted fields and then sorting the fields by tag. :param force: Ensure all contents are in DER format instead of possibly using cached BER-encoded data NrrPc |dSrr)cts r*z#Set._set_contents..s1r+)rr+r r) r,r-rrcr.r!r4sortrrrr) rLrchild_tag_encodingsrr4child_encodingrr0rUrs r*r8zSet._set_contentss ==  " %dmm4LE5"ZZeZ4N(,||E': $D$ L(',',,..@  & & >'B C5   %5 63F"G3FR2a53F"GH ==C DM #Hs> C5r) rrrrrIrGr4rbr;r-r8rr+r*rrs1 F F CJ^6m^ r+rceZdZdZdZddZy)SetOfz~ Represents a set (unordered) of a single type of values from ASN.1 as a Python object with a list-like interface rc |j|jg}|D]#}|j|j|%dj t ||_d|_|jdk7rd|_yy)aD Encodes all child objects into the contents for this object. This method is overridden because a SetOf needs to be encoded by sorting the child encodings. :param force: Ensure all contents are in DER format instead of possibly using cached BER-encoded data Nrr+) r,r-r!rcrr1rrr)rLrchild_encodingsr4s r*r8zSetOf._set_contentssx ==  "E  " "5::E:#: ;&"9: ==C DM r+Nr)rrrrr4r8rr+r*rrs C r+rceZdZdZdZy) EmbeddedPdvz A sequence structure Nrrr+r*rr Cr+rceZdZdZdZdZy) NumericStringzK Represents a numeric string from ASN.1 as a Python unicode string rQNr#rr+r*rr CIr+rceZdZdZdZdZy)PrintableStringzM Represents a printable string from ASN.1 as a Python unicode string rQNr#rr+r*rrrr+rceZdZdZdZdZy) TeletexStringzK Represents a teletex string from ASN.1 as a Python unicode string teletexNr#rr+r*rrs CIr+rceZdZdZdZy)VideotexStringzI Represents a videotex string from ASN.1 as a Python byte string Nrrr+r*rrrr+rceZdZdZdZdZy) IA5StringzH Represents an IA5 string from ASN.1 as a Python unicode string asciiNr#rr+r*rrr$r+rc0eZdZdZedZedZy) AbstractTimezK Represents a time from ASN.1 as a Python datetime.datetime object c t|}|jj|}|stt d|t ||j }d}|drtj}nF|drA|ddk(rdnd}t|tt|dt|d xsd  z}|d rZtt|d d t|d zdz}|d|dz}n |d|dz}t|jd}nd }t|dt|dt|dt|dt|dxsd t|dxsd ||dS)z The parsed datetime string. :raises: ValueError - when an invalid value is passed :return: A dict with the parsed values z: Error parsing %s to a %s Nzuludsign+r rdhourdminuter)hoursminutesfractionri@Bminuteisecond<yearmonthdayhour)rrrrrrtzinfor)r_TIMESTRING_RErrBr r groupdictrutcrrrr rDlimit_denominator)rLstringmgroupstzsignfract fract_usecs r* _parsed_timezAbstractTime._parsed_times    % %f -V$    &>B G_w3.1BD  &/*F9-23)"B * F:&'c&,--E h' !) U44Q78JJv')ve}%v'&*/a0&*/a0"  r+c|jy|jG|j}|jdd}|j |}|r|t |z }||_|jS)aF The native Python datatype representation of this value :return: A datetime.datetime object, asn1crypto.util.extended_datetime object or None. The datetime object is usually timezone aware. If it's naive, then it's in the sender's local time; see X.680 sect. 42.3 Nrr) microseconds)rJrrr _get_datetimer)rLrrr8s r*rzAbstractTime.nativeFsi ==  << &&Fzz*a0H&&v.E99 DL||r+N)rrrrrrrrr+r*rrs0= = ~r+rcZeZdZdZdZej dejZdZ dZ y)UTCTimez^ Represents a UTC time from ASN.1 as a timezone aware Python datetime.datetime object a  ^ # YYMMDD (?P\d{2}) (?P\d{2}) (?P\d{2}) # hhmm or hhmmss (?P\d{2}) (?P\d{2}) (?P\d{2})? # Matches nothing, needed because GeneralizedTime uses this. (?P) # Z or [-+]hhmm (?: (?PZ) | (?: (?P[-+]) (?P\d{2}) (?P\d{2}) ) ) $ c^t|tr|js td|j t }d|j cxkrdkstdtd|jd}tr|jd}tj||d|_ y)z Sets the value of the object :param value: A unicode string or a datetime.datetime object :raises: ValueError - when an invalid value is passed Must be timezone awareiizMYear of the UTCTime is not in range [1950, 2049], use GeneralizedTime insteadz %y%m%d%H%M%SZrN) r2rrrB astimezonerrstrftimerWrXrPrHrrs r*rHz UTCTime.sets eX &<< !9::$$\2E5::-- !pqq. !pqqNN?3E W-4' r+c^|ddkr|dxxdz cc<n |dxxdz cc<tdi|S)z Create a datetime object from the parsed time. :return: An aware datetime.datetime object r2iilr)rrLrs r*rzUTCTime._get_datetimes: &>B  6Nd "N 6Nd "N!&!!r+N rrrrr4recompileXrrHrrr+r*rrcs8 C RZZ!4 5N8<"r+rcZeZdZdZdZej dejZdZ dZ y)GeneralizedTimez Represents a generalized time from ASN.1 as a Python datetime.datetime object or asn1crypto.util.extended_datetime object in UTC aO ^ # YYYYMMDD (?P\d{4}) (?P\d{2}) (?P\d{2}) # hh or hhmm or hhmmss (?P\d{2}) (?: (?P\d{2}) (?P\d{2})? )? # Optional fraction; [.,]dddd (one or more decimals) # If Seconds are given, it's fractions of Seconds. # Else if Minutes are given, it's fractions of Minutes. # Else it's fractions of Hours. (?: [,.] (?P\d+) )? # Optional timezone. If left out, the time is in local time. # Z or [-+]hh or [-+]hhmm (?: (?PZ) | (?: (?P[-+]) (?P\d{2}) (?P\d{2})? ) )? $ ct|ttfr|js t d|j t }|jr7dt|jjdjdz}nd}|jd|zdz}tr|jd}tj||d |_y ) a Sets the value of the object :param value: A unicode string, a datetime.datetime object or an asn1crypto.util.extended_datetime object :raises: ValueError - when an invalid value is passed rrrrrWz %Y%m%d%H%M%SZrN)r2rrrrBrr microsecondstrzfillrrrWrXrPrHr)rLr8rs r*rHzGeneralizedTime.sets eh(9: ;<< !9::$$\2E  U%6%6!7!=!=a!@!G!G!LLNN>2X=CE W-4' r+c>|ddk(r tdi|Stdi|S)z Create a datetime object from the parsed time. :return: A datetime.datetime object or asn1crypto.util.extended_datetime object. It may or may not be aware. rrr)rrrs r*rzGeneralizedTime._get_datetimes, &>Q $.v. .%f% %r+Nrrr+r*rrs< C RZZ#!F G#NJB &r+rceZdZdZdZdZy) GraphicStringzK Represents a graphic string from ASN.1 as a Python unicode string rQNr#rr+r*rr CIr+rceZdZdZdZdZy) VisibleStringzK Represents a visible string from ASN.1 as a Python unicode string rQNr#rr+r*rr"rr+rceZdZdZdZdZy) GeneralStringzK Represents a general string from ASN.1 as a Python unicode string rQNr#rr+r*rr+rr+rceZdZdZdZdZy)UniversalStringzM Represents a universal string from ASN.1 as a Python unicode string z utf-32-beNr#rr+r*rr5 CIr+rceZdZdZdZdZy)CharacterStringzM Represents a character string from ASN.1 as a Python unicode string rQNr#rr+r*rr>rr+rceZdZdZdZdZy) BMPStringzG Represents a BMP string from ASN.1 as a Python unicode string z utf-16-beNr#rr+r*r!r!Hrr+r!c Pt|t|dt||jr@t|dt j |jxsdj d|jduxr|jduxr|jdu}|r>tj|j}tj|j}|j^|jD],\}}t|dtj|d|d.|rst|d d d |jnR|jr$|rDt|dd d|jd n"|r t|dd d|j|jr@t|d t j |jxsdj dt|d t j |j xsdj dy)a7 Prints out basic information about an Asn1Value object. Extracted for reuse among different classes that customize the debug information. :param prefix: A unicode string of spaces to prefix output line with :param self: The object to print the debugging information about r2z Header: 0xr+rfNz z tag z (explicitly tagged)z r`z (implicitly tagged)z Trailer: 0xz Data: 0x)rrrbrbinasciihexlifyrXrIrGr4r~r{rEr<r=rrJ)rrL has_header method_name class_namerGr4s r*rrQs vy4 AB || FH,<,Rs-S-Z-Z[b-cde fh&6&6t}}7K&L&S&ST[&\ ]^r+cd|vrT|ddk(r|jdd|df|d<n"|ddk(r|jdd|df|d<|d=|d=d|vr|d=yyy)z Converts old-style "tag_type" and "tag" params to "explicit" and "implicit" :param params: A dict of parameters to convert from tag_type/tag to explicit/implicit rNr<classr"r4r=N)r{)rs r*rrsV *  +"(**Wa"8&-!HF:  J : -"(**Wa"8&-!HF:  :  5M f w r+cft|d}d|vr|jdur^d}n[t|dtr |d\}}n|d}d}|jdurd}n'|jt |k7s|j |k7rd}|jd|jk7rd}|r|j|S|S)z Checks if a value is properly tagged based on the spec, and re/untags as necessary :param value: An Asn1Value object :param params: A dict of spec params :return: An Asn1Value that is properly tagged Fr=Tr r<) rr=r2rrGrFr4r{r<r})r8rr}rGr4s r*rrs#6* E >> &E fZ(% 0 ,KFC$CF >>U "E \\26: :eii3>NE zz*/ {{6"" Lr+cr|y|j}|j}t|d|vr$t|dtr |d\}}n/d}|d}n'd|vr#t|dtr |d\}}nd}|d}|t|t s t |}|jd|}|jd|}||fS)aP Builds a 2-element tuple used to identify fields by grabbing the class_ and tag from an Asn1Value class and the params dict being passed to it :param params: A dict of params to pass to spec :param spec: An Asn1Value class :return: A 2-element integer tuple in the form (class_, tag) rr<r"r=rGr4)rGr4rr2rrrFr{)rr0required_class required_tags r*rrs  |[[N88L"6*V fZ(% 0+1*+= (NLN!*-L v  fZ(% 0+1*+= (NLN!*-L!*^Y*O.~>ZZ.9N::e\2L L ))r+c |s|sytttt|dj|}t ||k7r$t djt |||S)z Format value as a tuple of 1s and 0s. :param value: A non-negative integer to format :param bits: Number of bits in the output :return: A tuple of 1s and 0s with bits members. rz0{0}bzResult too large: {0} > {1})rrrryrDrB)r8r|results r*rzrzs[  3sF5'..*>?@ AF 6{d6==c&k4PQQ Mr+rrrrvrtrrrr"r'r*rrr) rrrrrrrrrrr"c  | t||tSd} |a|xrd|v} | sx|js|rid|vrd|r |di|} n|} | j} t| } |}|}|}|}|}|xsd}| D]\}}||k7rGt t dt | tj|tj|||dk7rGt t dt | tjdtj||||k7r t t d t | ||t|t|\}}|\}}}}}}t| tr||z }||z}t|dd id } || _|| _| | _d } n|r |dd |i|} n || } |t"urnt| tr<| j%||| || j&z| _d}| j)n|| j.k7rQt t dt | tj| j.tj|||| j0k7r|dk(xr| j0dk(xr|dk(}|rt| t2sQt t dt | tj| j0tj|||| _d | _|| j6k7rt| j8t:r|| j8v}n|| j8k(}|skt t dt | | j6||rd|vrt=dd |i|}|j} |}|}|xsd}t| D]0\}}t|t|\}}|\}}}}}}||z }||z}2t|dd id } || jz| _| xj |xsdz c_| | _d } n|t>vr=t t dtj|tj||t>|}|||} |dk(xr| j0dk(xr|dk(}|rt| t2rd | _|| _| s|| _|xsd| _d| _ |r | j)|| S| S#tt*f$r=}|j,dd}|j,ddt | zzf|z|_|d}~wwxYw#tt*f$r=}|j,dd}|j,ddt | zzf|z|_|d}~wwxYw)a Builds an Asn1Value object generically, or using a spec with optional params :param class_: An integer representing the ASN.1 class :param method: An integer representing the ASN.1 method :param tag: An integer representing the ASN.1 tag :param header: A byte string of the ASN.1 header (class, method, tag, length) :param contents: A byte string of the ASN.1 value :param trailer: A byte string of any ASN.1 trailer (only used by indefinite length encodings) :param spec: A class derived from Asn1Value that defines what class_ and tag the value should have, and the semantics of the encoded value. The return value will be of this type. If omitted, the encoded value will be decoded using the standard universal tag based on the encoded tag number. :param spec_params: A dict of params to pass to the spec object :param nested_spec: For certain Asn1Value classes (such as OctetString and BitString), the contents can be further parsed and interpreted as another Asn1Value. This parameter controls the spec for that sub-parsing. :return: An object of the type spec, or if not specified, a child of Asn1Value NFrMr<r+z Error parsing %s - explicitly-tagged class should have been %s, but %s was found r z Error parsing %s - explicitly-tagged method should have been %s, but %s was found z Error parsing %s - explicitly-tagged tag should have been %s, but %s was found TrrJrrrz Error parsing %s - class should have been %s, but %s was found szy Error parsing %s - method should have been %s, but %s was found zv Error parsing %s - tag should have been %s, but %s was found zO Unknown element - %s class, %s method, tag %s )rJrGr)!rr0r<reversedrBr rrEr{r~rrDr2rrGrrrrrJrr3rKrGrIrrr4rrr'_UNIVERSAL_SPECSr)rGrIr4rrJtrailerr0r1 nested_spec header_setrMr8original_explicit explicit_info parsed_class parsed_method parsed_tagto_parseexplicit_headerexplicit_trailerexpected_class expected_tagrr9 parsed_headerparsed_trailerrRrK ber_indef is_bad_tagoriginal_values r*rGrG sR&{3 ~ J "Bm{&B  +*P[B[+{+ % $%67M!L"MJH$O&~# 0=, >1$V"%(-11.A-11, M&!A%$V"%(.2215.22=-P&-$V"%($"&!3x=9acg` mZR`!%0#}4O'58H'H$I1>LDt-9NOE+EM-EN.ENJ>h>+>h/s{E6*vsH5%+enn%c,45F,G (NLXs8}5GD!?C rWs,\SR( %DD(jjt- E D D   "**% &37l_7_7D**6)v)XN.FN.b393l vS1)S1lQ-YQ-h ^$V^$B |+ |+~N"]IN"b2i2jNiNbi!i!X|!=(Ix|~O!]HiO!d>(-9>BK -9K \N")N"bo$-9o$d1!01!h9>^y(^B y    9 AAH " z $yz $zD$D$Nw (w t J B ( NnN [ _>_DS"lS"l\&l\&~NNNnn,_^ &%P**Z0wwy{  t   zt      !"#$ 9@fR#Lr+__pycache__/crl.cpython-312.pyc000064400000044507152572326550012265 0ustar00 ui>dZddlmZmZmZmZddlZddlmZddl m Z m Z m Z m Z mZmZmZmZmZddlmZmZmZmZmZmZmZmZGdd e ZGd d eZGd d eZGddeZGddeZ Gdde Z!GddeZ"GddeZ#GddeZ$GddeZ%GddeZ&GddeZ'Gd d!eZ(y)"z ASN.1 type classes for certificate revocation lists (CRL). Exports the following items: - CertificateList() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_functionN)SignedDigestAlgorithm) Boolean EnumeratedGeneralizedTimeIntegerObjectIdentifierOctetBitStringParsableOctetStringSequence SequenceOf)AuthorityInfoAccessSyntaxAuthorityKeyIdentifierCRLDistributionPointsDistributionPointName GeneralNamesName ReasonFlagsTimeceZdZddddZy)Versionv1v2v3)rrN__name__ __module__ __qualname___map?/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/crl.pyrr+s    Dr&rc deZdZdedddfdedddfd ed ddfd ed dd fdedddfdedddfgZy)IssuingDistributionPointdistribution_pointrTexplicitoptionalonly_contains_user_certsrF)implicitdefaultonly_contains_ca_certsronly_some_reasons)r/r- indirect_crlonly_contains_attribute_certsN)r!r"r#rr r_fieldsr%r&r'r)r)3se 41RV6WX #W1.OP !7u,MN kt+LM qU"CD ('e3TU Gr&r)c eZdZddddddddZy ) TBSCertListExtensionIdissuer_alt_name crl_numberdelta_crl_indicatorissuing_distribution_pointauthority_key_identifier freshest_crlauthority_information_access)z 2.5.29.18z 2.5.29.20z 2.5.29.27z 2.5.29.28z 2.5.29.35z 2.5.29.46z1.3.6.1.5.5.7.1.1Nr r%r&r'r:r:>s&!*1/#; Dr&r:c@eZdZdefdeddifdefgZdZee e e e e e dZy) TBSCertListExtensionextn_idcriticalr0F extn_valuerDrF)r;r<r=r>r?r@rAN)r!r"r#r:r rr8 _oid_pairrr r)rrr _oid_specsr%r&r'rCrCJsM *+ Wy%01 *+G *I'&&>$:-(AJr&rCceZdZeZy)TBSCertListExtensionsN)r!r"r#rC _child_specr%r&r'rKrK]s&Kr&rKc 6eZdZddddddddd d d Zed Zy ) CRLReason unspecifiedkey_compromise ca_compromiseaffiliation_changed supersededcessation_of_operationcertificate_holdremove_from_crlprivilege_withdrawn aa_compromise) rrrr3r5r7 c 6ddddddddd d d |jS) a :return: A unicode string with revocation description that is suitable to show to end-users. Starts with a lower case letter and phrased in such a way that it makes sense after the phrase "because of" or "due to". zan unspecified reasonza compromised keyzthe CA being compromisedzan affiliation changezcertificate supersessionza cessation of operationza certificate holdzremoval from the CRLzprivilege withdrawlzthe AA being compromised) rOrPrQrRrSrTrUrVrWrXnativeselfs r'human_friendlyzCRLReason.human_friendlyos:317#:4&@ 45#87   ++  r&N)r!r"r#r$propertyrbr%r&r'rNrNas;     #    Dr&rNceZdZdddddZy)CRLEntryExtensionId crl_reasonhold_instruction_codeinvalidity_datecertificate_issuer)z 2.5.29.21z 2.5.29.23z 2.5.29.24z 2.5.29.29Nr r%r&r'reres!,&)  Dr&rec:eZdZdefdeddifdefgZdZee e e dZ y) CRLEntryExtensionrDrEr0FrFrG)rfrgrhriN) r!r"r#rer rr8rHrNr r rrIr%r&r'rkrksD '( Wy%01 *+G *I!1** Jr&rkceZdZeZy)CRLEntryExtensionsN)r!r"r#rkrLr%r&r'rmrms#Kr&rmceZdZdefdefdeddifgZdZdZdZ dZ dZ dZ dZ ed Zed Zed Zed Zed Zy)RevokedCertificateuser_certificaterevocation_datecrl_entry_extensionsr-TFNct|_|dD]g}|dj}d|z}t||rt |||dj |djsM|jj |id|_y)v Sets common named extensions to private attributes and creates a list of critical extensions rrrD _%s_valuerFrETNset_critical_extensionsr_hasattrsetattrparsedadd_processed_extensionsra extensionnameattribute_names r'_set_extensionsz"RevokedCertificate._set_extensionss %(E!45IY'..D(4/Nt^,ni .E.L.LM$++))--d3 6&*"r&cR|js|j|jSz Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings r}rrxr`s r'critical_extensionsz&RevokedCertificate.critical_extensions%))  "(((r&cV|jdur|j|jS)z This extension indicates the reason that a certificate was revoked. :return: None or a CRLReason object F)r}r_crl_reason_valuer`s r'crl_reason_valuez#RevokedCertificate.crl_reason_values*  % % .  "%%%r&cV|jdur|j|jS)a= This extension indicates the suspected date/time the private key was compromised or the certificate became invalid. This would usually be before the revocation date, which is when the CA processed the revocation. :return: None or a GeneralizedTime object F)r}r_invalidity_date_valuer`s r'invalidity_date_valuez(RevokedCertificate.invalidity_date_values*  % % .  "***r&cV|jdur|j|jS)a This extension indicates the issuer of the certificate in question, and is used in indirect CRLs. CRL entries without this extension are for certificates issued from the last seen issuer. :return: None or an x509.GeneralNames object F)r}r_certificate_issuer_valuer`s r'certificate_issuer_valuez+RevokedCertificate.certificate_issuer_values*  % % .  "---r&c|jdurQd|_|jr>|jD]/}|jdk(s|j|_|jS|jS)zi :return: None, or an asn1crypto.x509.Name object for the issuer of the cert FNdirectory_name) _issuer_namerrchosen)ra general_names r' issuer_namezRevokedCertificate.issuer_namesn    % $D ,,$($A$AL#((,<<,8,?,?)   %B   r&)r!r"r#r rrmr8r}rxrrrrrrcrrrrrr%r&r'roros W% D! !3j$5GHG "! $L*$ ) ) & & + + . . ! !r&roceZdZeZy)RevokedCertificatesN)r!r"r#rorLr%r&r'rrs$Kr&rc TeZdZdeddifdefdefdefdeddifdeddifd ed dd fgZ y ) TbsCertListversionr-T signatureissuer this_update next_updaterevoked_certificatescrl_extensionsrr+N) r!r"r#rrrrrrKr8r%r&r'rrs` Gj$/0 +, 4  z401 !4z46HI 0qd2STGr&rcLeZdZdefdefdefgZdZdZdZ dZ dZ dZ dZ dZdZdZdZdZdZdZedZedZed Zed Zed Zed Zed ZedZedZedZedZ edZ!edZ"edZ#edZ$y)CertificateList tbs_cert_listsignature_algorithmrFNct|_|ddD]g}|dj}d|z}t||rt |||dj |djsM|jj |id|_y) rtrrrDrurFrETNrvr~s r'rzCertificateList._set_extensions4s %(E!o./?@IY'..D(4/Nt^,ni .E.L.LM$++))--d3 A&*"r&cR|js|j|jSrrr`s r'rz#CertificateList.critical_extensionsFrr&cV|jdur|j|jS)z This extension allows associating one or more alternative names with the issuer of the CRL. :return: None or an x509.GeneralNames object F)r}r_issuer_alt_name_valuer`s r'issuer_alt_name_valuez%CertificateList.issuer_alt_name_valueTs*  % % .  "***r&cV|jdur|j|jS)z This extension adds a monotonically increasing number to the CRL and is used to distinguish different versions of the CRL. :return: None or an Integer object F)r}r_crl_number_valuer`s r'crl_number_valuez CertificateList.crl_number_valuebs*  % % .  "%%%r&cV|jdur|j|jS)z This extension indicates a CRL is a delta CRL, and contains the CRL number of the base CRL that it is a delta from. :return: None or an Integer object F)r}r_delta_crl_indicator_valuer`s r'delta_crl_indicator_valuez)CertificateList.delta_crl_indicator_valueps*  % % .  "...r&cV|jdur|j|jS)z This extension includes information about what types of revocations and certificates are part of the CRL. :return: None or an IssuingDistributionPoint object F)r}r!_issuing_distribution_point_valuer`s r' issuing_distribution_point_valuez0CertificateList.issuing_distribution_point_value~s*  % % .  "555r&cV|jdur|j|jS)z This extension helps in identifying the public key with which to validate the authenticity of the CRL. :return: None or an AuthorityKeyIdentifier object F)r}r_authority_key_identifier_valuer`s r'authority_key_identifier_valuez.CertificateList.authority_key_identifier_values*  % % .  "333r&cV|jdur|j|jS)z This extension is used in complete CRLs to indicate where a delta CRL may be located. :return: None or a CRLDistributionPoints object F)r}r_freshest_crl_valuer`s r'freshest_crl_valuez"CertificateList.freshest_crl_values*  % % .  "'''r&cV|jdur|j|jS)z This extension is used to provide a URL with which to download the certificate used to sign this CRL. :return: None or an AuthorityInfoAccessSyntax object F)r}r#_authority_information_access_valuer`s r'"authority_information_access_valuez2CertificateList.authority_information_access_values*  % % .  "777r&c|ddS)z_ :return: An asn1crypto.x509.Name object for the issuer of the CRL rrr%r`s r'rzCertificateList.issuersO$X..r&cN|jsy|jdjS)z :return: None or a byte string of the key_identifier from the authority key identifier extension Nkey_identifier)rr_r`s r'r?z(CertificateList.authority_key_identifiers(22223CDKKKr&cF|jg|_|jrw|jD]h}|djdk(s|d}|jdk7r+|j}|j dddk(sN|jj |j|jS)z :return: A list of unicode strings that are URLs that should contain either an individual DER-encoded X.509 certificate, or a DER-encoded CMS message containing multiple certificates access_method ca_issuersaccess_locationuniform_resource_identifierrzhttp://)_issuer_cert_urlsrr_rlowerappend)raentrylocationurls r'issuer_cert_urlsz CertificateList.issuer_cert_urlss  ! ! )%'D "66!DDE_-44 D#():#;#==,II$&oo99;q+y8 2299#>E%%%r&c|jug|_|jb|jD]S}|d}|jdk(r|jD]-}|jdk(s|jj |/U|jS)z Returns delta CRL URLs - only applies to complete CRLs :return: A list of zero or more DistributionPoint objects r*name_relative_to_crl_issuerr)_delta_crl_distribution_pointsrrrr)rar*distribution_point_namers r'delta_crl_distribution_pointsz-CertificateList.delta_crl_distribution_pointss  . . 624D /&&2*.*A*A&.@AU.V+.337TT (?(F(F ',,0MM ??FFGYZ)G +B222r&c |djS)zE :return: A byte string of the signature rr^r`s r'rzCertificateList.signaturesK '''r&c|j6tj|jj |_|jS)zf :return: The SHA1 hash of the DER-encoded bytes of this certificate list )_sha1hashlibsha1dumpdigestr`s r'rzCertificateList.sha1s7 ::  diik299;DJzzr&c|j6tj|jj |_|jS)zi :return: The SHA-256 hash of the DER-encoded bytes of this certificate list )_sha256rsha256rrr`s r'rzCertificateList.sha256s7 << ">>$))+6==?DL||r&)%r!r"r#rrrr8r}rxrrrrrrrrrrrrrcrrrrrrrrrr?rrrrrr%r&r'rrs +&  56 n%G "!!%(,%&*#*.'%)" EG*$ ) ) + + & & / / 6 6 4 4 ( ( 8 8// L L&&*330((r&r))__doc__ __future__rrrrralgosrcorer r r r r rrrrx509rrrrrrrrrr)r:rCrKrNrerkrmrorrrr%r&r'rsSR(      gx - 8&'J'# #L*   $$h!h!V%*% ( yhyr&__pycache__/csr.cpython-312.pyc000064400000010713152572326550012264 0ustar00 ui dZddlmZmZmZmZddlmZddlm Z m Z m Z m Z m Z mZmZmZmZddlmZddlmZmZmZGdd e ZGd d e ZGd d eZGddeZGddeZGddeZGddeZGddeZGddeZ GddeZ!GddeZ"GddeZ#Gd d!eZ$Gd"d#eZ%y$)%z ASN.1 type classes for certificate signing requests (CSR). Exports the following items: - CertificationRequest() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_function)SignedDigestAlgorithm) Any BitString BMPStringIntegerObjectIdentifierOctetBitStringSequenceSetOf UTF8String) PublicKeyInfo)DirectoryString ExtensionsNameceZdZddiZy)Versionrv1N__name__ __module__ __qualname___map?/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/csr.pyrr"s 4 DrrceZdZdddddddZy) CSRAttributeTypechallenge_passwordextended_certificate_attributesextension_request!microsoft_enrollment_csp_providermicrosoft_os_versionmicrosoft_request_client_info)z1.2.840.113549.1.9.7z1.2.840.113549.1.9.9z1.2.840.113549.1.9.14z1.3.6.1.4.1.311.13.2.2z1.3.6.1.4.1.311.13.2.3z1.3.6.1.4.1.311.21.20Nrrrr r"r"(s 4 A!4"E"8!@ Drr"ceZdZeZy)SetOfDirectoryStringN)rrrr _child_specrrr r*r*6s!Krr*c"eZdZdefdedeifgZy) AttributetypevaluesspecN)rrrr rr _fieldsrrr r-r-:s !" 563-(Grr-ceZdZeZy)SetOfAttributesN)rrrr-r+rrr r3r3AsKrr3ceZdZeZy)SetOfExtensionsN)rrrrr+rrr r5r5EsKrr5c"eZdZdefdefdefgZy)MicrosoftEnrollmentCSProviderkeyspeccspname signatureN)rrrr r r r1rrr r7r7Is! G I i Grr7ceZdZeZy)"SetOfMicrosoftEnrollmentCSProviderN)rrrr7r+rrr r<r<Qs/Krr<c(eZdZdefdefdefdefgZy)MicrosoftRequestClientInfoclientid machinenameusername processnameN)rrrr rr1rrr r>r>Us) W  # Z  # Grr>ceZdZeZy)SetOfMicrosoftRequestClientInfoN)rrrr>r+rrr rDrD^s,KrrDc2eZdZdefdefgZdZeee e ee dZ y) CRIAttributer.r/)r.r/)r#r$r%r&r'r(N) rrrr"r r1 _oid_pairr*r3r5r<rD _oid_specsrrr rFrFbs9 !" 3G #I2+:,-O 4)H JrrFceZdZeZy) CRIAttributesN)rrrrFr+rrr rJrJssKrrJc0eZdZdefdefdefdedddfgZy) CertificationRequestInfoversionsubjectsubject_pk_info attributesrT)implicitoptionalN)rrrrrrrJr1rrr rLrLws0 G D M* }1$&GH GrrLc"eZdZdefdefdefgZy)CertificationRequestcertification_request_infosignature_algorithmr:N)rrrrLrrr1rrr rTrTs# %'?@  56 n%GrrTN)&__doc__ __future__rrrralgosrcorer r r r r rrrrkeysrx509rrrrr"r*r-r3r5r7r<r>rDrFrJrLrTrrr r]sSR(    33g ' "5"eeH00-e-8"Ex8r__pycache__/keys.cpython-312.pyc000064400000120271152572326550012451 0ustar00 uidZddlmZmZmZmZddlZddlZddlm Z m Z ddl m Z m Z ddlmZmZmZmZmZddlmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#dd l$m%Z%m&Z&Gd d e!Z'Gd d e"Z(GddeZ)Gdde!Z*Gdde!Z+Gdde!Z,GddZ-Gddee-Z.Gddee-Z/GddeZ0GddeZ1Gd d!eZ2Gd"d#e!Z3Gd$d%e!Z4Gd&d'e!Z5Gd(d)e!Z6Gd*d+e!Z7Gd,d-eZ8Gd.d/eZ9Gd0d1eZ:Gd2d3e!Z;Gd4d5e!Z<Gd6d7e!Z=Gd8d9e#Z>Gd:d;eZ?Gd<d=ee!Z@Gd>d?e!ZAGd@dAe!ZBGdBdCe!ZCGdDdEe!ZDGdFdGeZEGdHdIee!ZFGdJdKe!ZGy)La' ASN.1 type classes for public and private keys. Exports the following items: - DSAPrivateKey() - ECPrivateKey() - EncryptedPrivateKeyInfo() - PrivateKeyInfo() - PublicKeyInfo() - RSAPrivateKey() - RSAPublicKey() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_functionN)unwrap APIException) type_namebyte_cls)_ForceNullParametersDigestAlgorithmEncryptionAlgorithmRSAESOAEPParamsRSASSAPSSParams)Any Asn1Value BitStringChoiceIntegerIntegerOctetStringNullObjectIdentifierOctetBitString OctetStringParsableOctetStringParsableOctetBitStringSequence SequenceOfSetOf)int_from_bytes int_to_bytesc&eZdZdZdefdefdefgZy)OtherPrimeInfo= Source: https://tools.ietf.org/html/rfc3447#page-46 primeexponent coefficientN__name__ __module__ __qualname____doc__r_fields@/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/keys.pyr#r#-s( ' W  Gr/r#ceZdZdZeZy)OtherPrimeInfosr$N)r)r*r+r,r# _child_specr.r/r0r2r29s!Kr/r2ceZdZdZdddZy)RSAPrivateKeyVersionzX Original Name: Version Source: https://tools.ietf.org/html/rfc3447#page-45 z two-primemulti)rrNr)r*r+r,_mapr.r/r0r5r5As   Dr/r5c VeZdZdZdefdefdefdefdefdefdefd efd efd ed d ifg Zy) RSAPrivateKeyz= Source: https://tools.ietf.org/html/rfc3447#page-45 versionmoduluspublic_exponentprivate_exponentprime1prime2 exponent1 exponent2r'other_prime_infosoptionalTN)r)r*r+r,r5rr2r-r.r/r0r:r:Msh () G G$ W% 7 7 g g  o D/AB Gr/r:c eZdZdZdefdefgZy) RSAPublicKeyz= Source: https://tools.ietf.org/html/rfc3447#page-44 r<r=Nr(r.r/r0rFrF`s  G G$Gr/rFc8eZdZdZdefdefdefdefdefdefgZy) DSAPrivateKeya& The ASN.1 structure that OpenSSL uses to store a DSA private key that is not part of a PKCS#8 structure. Reversed engineered from english-language description on linked OpenSSL documentation page. Original Name: None Source: https://www.openssl.org/docs/apps/dsa.html r;pqg public_key private_keyNr(r.r/r0rHrHks= G g g g w  Gr/rHc&eZdZdZedZdZy)_ECPointa  In both PublicKeyInfo and PrivateKeyInfo, the EC public key is a byte string that is encoded as a bit string. This class adds convenience methods for converting to and from the byte string to a pair of integers that are the X and Y coordinates. cBttjtj|ddz }ttjtj|ddz }t ||}d}|t ||z }|t ||z }||S)a Creates an ECPoint object from the X and Y integer coordinates of the point :param x: The X coordinate, as an integer :param y: The Y coordinate, as an integer :return: An ECPoint object  @)width)intmathceillogmaxr!)clsxyx_bytesy_bytes num_bytes byte_strings r0 from_coordsz_ECPoint.from_coordss diiA 456diiA 456)  |AY77 |AY77 ;r/c|j}|dd}|dk(r3|dd}t|dz}t|d|}t||d}||fS|tddgvrt t dt t d ) z Returns the X and Y coordinates for this EC point, as native Python integers :return: A 2-element tuple containing integers (X, Y) rrrSNrQzQ Invalid EC public key - first byte is incorrect z| Compressed representations of EC public keys are not supported due to patent US6252960 )nativelenr set ValueErrorr)selfdata first_byte remaining field_lenr[r\s r0 to_coordsz_ECPoint.to_coordss{{!AY   QRII!+Iy956Ay45Aq6M S'7!34 4V      r/N)r)r*r+r, classmethodrarnr.r/r0rOrOs   4  r/rOc eZdZy)ECPointNr)r*r+r.r/r0rqrqr/rqc eZdZy)ECPointBitStringNrrr.r/r0rurursr/ruceZdZdZddddZy)SpecifiedECDomainVersion: Source: http://www.secg.org/sec1-v2.pdf page 104 ecdpVer1ecdpVer2ecdpVer3)rrQNr7r.r/r0rwrws    Dr/rwceZdZdZdddZy) FieldTypezR Original Name: None Source: http://www.secg.org/sec1-v2.pdf page 101 prime_fieldcharacteristic_two_field)z1.2.840.10045.1.1z1.2.840.10045.1.2Nr7r.r/r0r~r~s +7 Dr/r~ceZdZdZddddZy)CharacteristicTwoBasiszR Original Name: None Source: http://www.secg.org/sec1-v2.pdf page 102 gn_basistp_basispp_basis)z1.2.840.10045.1.2.1.1z1.2.840.10045.1.2.1.2z1.2.840.10045.1.2.1.3Nr7r.r/r0rrs ",!+!+ Dr/rc&eZdZdZdefdefdefgZy) Pentanomial: Source: http://www.secg.org/sec1-v2.pdf page 102 k1k2k3Nr(r.r/r0rrs% w w wGr/rc6eZdZdZdefdefdefgZdZe ee dZ y)CharacteristicTwoz` Original Name: Characteristic-two Source: http://www.secg.org/sec1-v2.pdf page 101 mbasis parameters)rr)rrrN) r)r*r+r,rrrr- _oid_pairrr _oid_specsr.r/r0rrs? g () sG (IJr/rc.eZdZdZdefdefgZdZee dZ y)FieldIDz: Source: http://www.secg.org/sec1-v2.pdf page 100 field_typer)rr)rrN) r)r*r+r,r~rr-rrrrr.r/r0rrs4 y! sG -I$5Jr/rc,eZdZdZdefdefdeddifgZy)CurverxabseedrDTN)r)r*r+r,rrr-r.r/r0rr$s/ k k *d!34Gr/rc JeZdZdZdefdefdefdefdefdedd ifd e dd ifgZ y ) SpecifiedECDomainz: Source: http://www.secg.org/sec1-v2.pdf page 103 r;field_idcurvebaseordercofactorrDThashN) r)r*r+r,rwrrrqrr r-r.r/r0rr0sW ,- W %  ' Wz401 :t"45Gr/rceZdZdZidddddddd d d d d ddddddddddddddddddd d!d"d#id$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;dd?d@dAdBdCdDdEidFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgidhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddddddddddddZiddddddddd dd dddddddddddddddddddd dd"did$dd&dd(dd*dd,dd.dd0dd2dd4dd6dd8dd:dddd@ddBddDdidFddHddJddLddNddPddRddTddVddXddZdd\dd^dd`ddbdddddfdidhddjddlddnddpddrddtddvddxddzdd|dd~ddddddddddddddddZedZy) NamedCurvez Various named curves Original Name: None Source: https://tools.ietf.org/html/rfc3279#page-23, https://tools.ietf.org/html/rfc5480#page-5 z1.2.840.10045.3.0.1 c2pnb163v1z1.2.840.10045.3.0.2 c2pnb163v2z1.2.840.10045.3.0.3 c2pnb163v3z1.2.840.10045.3.0.4 c2pnb176w1z1.2.840.10045.3.0.5 c2tnb191v1z1.2.840.10045.3.0.6 c2tnb191v2z1.2.840.10045.3.0.7 c2tnb191v3z1.2.840.10045.3.0.8 c2onb191v4z1.2.840.10045.3.0.9 c2onb191v5z1.2.840.10045.3.0.10 c2pnb208w1z1.2.840.10045.3.0.11 c2tnb239v1z1.2.840.10045.3.0.12 c2tnb239v2z1.2.840.10045.3.0.13 c2tnb239v3z1.2.840.10045.3.0.14 c2onb239v4z1.2.840.10045.3.0.15 c2onb239v5z1.2.840.10045.3.0.16 c2pnb272w1z1.2.840.10045.3.0.17 c2pnb304w1z1.2.840.10045.3.0.18 c2tnb359v1z1.2.840.10045.3.0.19 c2pnb368w1z1.2.840.10045.3.0.20 c2tnb431r1z1.2.840.10045.3.1.2 prime192v2z1.2.840.10045.3.1.3 prime192v3z1.2.840.10045.3.1.4 prime239v1z1.2.840.10045.3.1.5 prime239v2z1.2.840.10045.3.1.6 prime239v3z1.2.840.10045.3.1.1 secp192r1z1.2.840.10045.3.1.7 secp256r1z 1.3.132.0.1 sect163k1z 1.3.132.0.2 sect163r1z 1.3.132.0.3 sect239k1z 1.3.132.0.4 sect113r1z 1.3.132.0.5 sect113r2z 1.3.132.0.6 secp112r1z 1.3.132.0.7 secp112r2z 1.3.132.0.8 secp160r1z 1.3.132.0.9 secp160k1z 1.3.132.0.10 secp256k1z 1.3.132.0.15 sect163r2z 1.3.132.0.16 sect283k1z 1.3.132.0.17 sect283r1z 1.3.132.0.22 sect131r1z 1.3.132.0.23 sect131r2z 1.3.132.0.24 sect193r1z 1.3.132.0.25 sect193r2z 1.3.132.0.26 sect233k1z 1.3.132.0.27 sect233r1z 1.3.132.0.28 secp128r1z 1.3.132.0.29 secp128r2z 1.3.132.0.30 secp160r2z 1.3.132.0.31 secp192k1z 1.3.132.0.32 secp224k1z 1.3.132.0.33 secp224r1z 1.3.132.0.34 secp384r1z 1.3.132.0.35 secp521r1z 1.3.132.0.36 sect409k1z 1.3.132.0.37 sect409r1z 1.3.132.0.38 sect571k1z 1.3.132.0.39 sect571r1z1.3.36.3.3.2.8.1.1.1brainpoolp160r1z1.3.36.3.3.2.8.1.1.2brainpoolp160t1z1.3.36.3.3.2.8.1.1.3brainpoolp192r1z1.3.36.3.3.2.8.1.1.4brainpoolp192t1z1.3.36.3.3.2.8.1.1.5brainpoolp224r1z1.3.36.3.3.2.8.1.1.6brainpoolp224t1z1.3.36.3.3.2.8.1.1.7brainpoolp256r1z1.3.36.3.3.2.8.1.1.8brainpoolp256t1z1.3.36.3.3.2.8.1.1.9brainpoolp320r1z1.3.36.3.3.2.8.1.1.10brainpoolp320t1brainpoolp384r1brainpoolp384t1brainpoolp512r1brainpoolp512t1)z1.3.36.3.3.2.8.1.1.11z1.3.36.3.3.2.8.1.1.12z1.3.36.3.3.2.8.1.1.13z1.3.36.3.3.2.8.1.1.14!%-5 $0B34H(@cv||j|<|j||j|<||j|<y)a Registers a new named elliptic curve that is not included in the default list of named curves :param name: A unicode string of the curve name :param oid: A unicode string of the dotted format OID :param key_size: An integer of the number of bytes the private key should be encoded to N)r8 _reverse_map _key_sizes)rZnameoidkey_sizes r0registerzNamedCurve.registers;"    '%(C  T "&sr/N)r)r*r+r,r8rror r.r/r0rr@sM |M  |M  | M  | M  | M  |M  |M  |M  |M   M   M   M   M   M   !M "  #M $  %M &  'M (  )M *  +M , |-M . |/M 0 |1M 2 |3M 4 |5M : {;M < {=M > {?M @ {AM B {CM D {EM F {GM H {IM J {KM L {MM N {OM P  QM R  SM T  UM V  WM X  YM Z  [M \  ]M ^  _M `  aM b  cM d  eM f  gM h  iM j  kM l  mM n  oM p  qM r  sM t  uM v  wM x  yM z  {M ~  1M @  1AM B  1CM D  1EM F  1GM H  1IM J  1KM L  1MM N  1OM P !2QM R"3!2!2!2YM D^Q rQ r Q r Q r Q rQ rQ rQ rQ rQ Q Q Q Q !Q" #Q$ %Q& 'Q( )Q* +Q, -Q. r/Q0 r1Q2 r3Q4 r5Q6 r7Q> r?Q@ rAQB rCQD rEQF rGQH rIQJ rKQL rMQN rOQP rQQR rSQT UQV WQX YQZ [Q\ ]Q^ _Q` aQb cQd eQf gQh iQj kQl mQn oQp qQr sQt uQv wQx yQz {Q| }Q~ QF GQH IQJ KQL MQN OQP QQR SQT UQV WQX YQZ"$!#!#!#aQJf''r/rc6eZdZdZdefdefdefgZedZ y)ECDomainParametersr specifiednamed implicit_cac|jdk(rttd|jdk(rE|jdj}t j t j|ddz S|jj}|tjvrttdt|tj|S)Nrz Unable to calculate key_size from ECDomainParameters that are implicitly defined by the CA key rrg@rRz The asn1crypto.keys.NamedCurve %s does not have a registered key length, please call asn1crypto.keys.NamedCurve.register() ) rrhrchosenrerVrWrXdottedrrrepr)rirr s r0r zECDomainParameters.key_size s 99 %V  99 #KK(//E99TXXeS1C78 8kk   j++ +VS  $$S))r/N) r)r*r+r,rrr _alternativespropertyr r.r/r0r r s= '( * M **r/r ceZdZdZddiZy)ECPrivateKeyVersionzR Original Name: None Source: http://www.secg.org/sec1-v2.pdf page 108 r ecPrivkeyVer1Nr7r.r/r0rr's ? Dr/rc^eZdZdZdefdefdedddfded ddfgZd Z fd Z d Z d Z xZ S) ECPrivateKeyz: Source: http://www.secg.org/sec1-v2.pdf page 108 r;rMrrT)explicitrDrLrNctt| ||}|dk(r|jV|dj}t |t rSt|dkDrE|jt|dj|S|j|j|S|dk(rCt |dtr0|djdk7r|j|dj|S)NrMrrr) superr __setitem__ _key_sizecontents isinstancer rf set_key_size_update_key_sizer rr )rikeyvalueres pkey_contents __class__s r0rzECPrivateKey.__setitem__BsL$3C? - ~~% $] 3 < < mX63};MPQ;Q%%c$}*=*F*F&GH +%%'  L Z\0BDV%W\"''=8   d<099 : r/c2||_|jy)z Sets the key_size to ensure the private key is encoded to the proper length :param key_size: An integer byte length to encode the private_key to N)r r$)rir s r0r#zECPrivateKey.set_key_sizeUs" r/c|j3t|dtr|dj|jyyy)zG Ensure the private_key explicit encoding width is set NrM)r r"rset_encoded_widthris r0r$zECPrivateKey._update_key_size`s= >> %*T-5HJ\*]   1 1$.. A+^ %r/)r)r*r+r,rrr rur-r rr#r$ __classcell__r)s@r0rr2sZ '( *+ )t+LM 'aT)JK GI&  Br/rc&eZdZdZdefdefdefgZy) DSAParamsz Parameters for a DSA public or private key Original Name: Dss-Parms Source: https://tools.ietf.org/html/rfc3279#page-9 rIrJrKNr(r.r/r0r1r1is% g g gGr/r1c&eZdZdZdefdedeifgZy) Attributezq Source: https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.501-198811-S!!PDF-E&type=items page 8 typevaluesspecN)r)r*r+r,rrrr-r.r/r0r3r3xs' !" 563-(Gr/r3ceZdZdZeZy) Attributes< Source: https://tools.ietf.org/html/rfc5208#page-3 N)r)r*r+r,r3r3r.r/r0r8r8sKr/r8c &eZdZdZdddddddd d Zy ) PrivateKeyAlgorithmIdz These OIDs for various public keys are reused when storing private keys inside of a PKCS#8 structure Original Name: None Source: https://tools.ietf.org/html/rfc3279 rsa rsassa_pssdsaecx25519x448ed25519ed448)1.2.840.113549.1.1.11.2.840.113549.1.1.101.2.840.10040.4.11.2.840.10045.2.1 1.3.101.110 1.3.101.111 1.3.101.112 1.3.101.113Nr7r.r/r0r;r;s(!&!-"!  Dr/r;c6eZdZdZdefdeddifgZdZee e dZ y) PrivateKeyAlgorithmzm Original Name: PrivateKeyAlgorithmIdentifier Source: https://tools.ietf.org/html/rfc5208#page-3 algorithmrrDTrNr)r>r?r=N) r)r*r+r,r;rr-rr1r rrr.r/r0rMrMs? +, sZ./G ,I %Jr/rMceZdZdZdefdefdefdedddfgZd Z de iZ d Z d Z d Z d Zed Zfd Zd ZedZedZedZedZedZedZedZedZxZS)PrivateKeyInfor9r;private_key_algorithmrM attributesrT)implicitrDc |ddj}ttttttttd|S)NrRrN)r<r=r>r?r@rArBrC)rer:rrrrirNs r0_private_key_specz PrivateKeyInfo._private_key_specsF01+>EE  '""      r/Nct|ts.t|tstt dt ||dk(s|dk(r0t|t st j|}t}n|dk(rRt|tstj|}t}|d|d<|d|d<|d|d<|d}|d }nb|d k(r?t|tstj|}n|j}|d }|d =ntt d t|t}t!||d <||d <|}||_t%d|d<||d<||d <|dk(r|_|S)a' Wraps a private key in a PrivateKeyInfo structure :param private_key: A byte string or Asn1Value object of the private key :param algorithm: A unicode string of "rsa", "dsa" or "ec" :return: A PrivateKeyInfo object zX private_key must be a byte string or Asn1Value, not %s r<r=r>rIrJrKrLrMr?rzU algorithm must be one of "rsa", "dsa", "ec", not %s rNrr;rR)r"r r TypeErrorrr r:loadrrHr1rcopyrhrrMr; _algorithmr _public_key)rZrMrNparamsrLprivate_key_algo containers r0wrapzPrivateKeyInfo.wraps+x0KQZ9[F+&    l!:k=9+00= VF % k=9+00= [F%c*F3K%c*F3K%c*F3K$\2J%m4K $ k<8*// < )..0  .FL)VY  /0(=i(H%)/&E ( &qz )-= )*#. -   $.I !r/crtt| ||}|d}|dk(s|dk(r|djdk(rt |dt rm|dj dk7r[t |dtrHt |djtr+|djj|dj|S)NrRrMrNr?rr) rrQrrer"r rrparsedrr#r )rir%r&r'rNr)s r0rzPrivateKeyInfo.__setitem__"sND5c5A01  * *c].B+&--59\24FG,',, =4 .0CD4 .55|D   & & 3 3Il4K4T4T U r/ctd)z Unwraps the private key into an RSAPrivateKey, DSAPrivateKey or ECPrivateKey object :return: An RSAPrivateKey, DSAPrivateKey or ECPrivateKey object zxasn1crypto.keys.PrivateKeyInfo().unwrap() has been removed, please use oscrypto.asymmetric.PrivateKey().unwrap() insteadr r-s r0rzPrivateKeyInfo.unwrap3s KL Lr/c|jdk7r-ttd|jj|dd}|j}|j dk(rd}n |j }|j |fS)# Returns information about the curve used for an EC key :raises: ValueError - when the key is not an EC key :return: A two-element tuple, with the first element being a unicode string of "implicit_ca", "specified" or "named". If the first element is "implicit_ca", the second is None. If "specified", the second is an OrderedDict that is the native version of SpecifiedECDomain. If "named", the second is a unicode string of the curve name. r?K Only EC keys have a curve, this key is %s rRrrNrNrhrupperrrrerir^rr&s r0rzPrivateKeyInfo.curve@s >>T !V$$&  -.|< ;;- 'EMME U##r/c|jdk7r-ttd|jjt j |dddj ddz }|dkrd Sd S) z Returns the name of the family of hash algorithms used to generate a DSA key :raises: ValueError - when the key is not a DSA key :return: A unicode string of "sha1" or "sha2" r>t Only DSA keys are generated using a hash algorithm, this key is %s rRrrJrQrsha1sha2)rNrhrrjrVrXre)ribyte_lens r0 hash_algozPrivateKeyInfo.hash_algobs{ >>U "V$$&  88D!89,GLSSUVWZ[[!Rv3V3r/c`|j|ddj|_|jS)] :return: A unicode string of "rsa", "rsassa_pss", "dsa" or "ec" rRrNr\rer-s r0rNzPrivateKeyInfo.algorithm|s0 ?? ""#:;KHOODOr/c|j|jdk(s|jdk(r|djdj}nP|jdk(r|dddj}n+|jd k(r|djdj}t t j t jd |_|jd z}|d k7r|xjd |z z c_|jS) zU :return: The bit size of the private key, as an integer r<r=rMr<r>rRrrIr?rQrnr) _bit_sizerNrcrerUrVrWrXrir%r<s r0bit_sizezPrivateKeyInfo.bit_sizes >> !~~&$..L*H]+229=DD5(45lCCHOO4']+22=AHH 488E1+=!>?DNnnq(G!|!g+-~~r/cXttj|jdz S)zV :return: The byte size of the private key, as an integer rnrUrVrWryr-s r0 byte_sizezPrivateKeyInfo.byte_size!499T]]Q./00r/ctd)z :return: If an RSA key, an RSAPublicKey object. If a DSA key, an Integer object. If an EC key, an ECPointBitString object. zasn1crypto.keys.PrivateKeyInfo().public_key has been removed, please use oscrypto.asymmetric.PrivateKey().public_key.unwrap() insteadrer-s r0rLzPrivateKeyInfo.public_keys VW Wr/ctd)z\ :return: A PublicKeyInfo object derived from this private key. zasn1crypto.keys.PrivateKeyInfo().public_key_info has been removed, please use oscrypto.asymmetric.PrivateKey().public_key.asn1 insteadrer-s r0public_key_infozPrivateKeyInfo.public_key_infos RS Sr/ctd)aY Creates a fingerprint that can be compared with a public key to see if the two form a pair. This fingerprint is not compatible with fingerprints generated by any other software. :return: A byte string that is a sha256 hash of selected components (based on the key type) z~asn1crypto.keys.PrivateKeyInfo().fingerprint has been removed, please use oscrypto.asymmetric.PrivateKey().fingerprint insteadrer-s r0 fingerprintzPrivateKeyInfo.fingerprints NO Or/)r)r*r+r,rrMrr8r-rW_spec_callbacksr\rwr] _fingerprintrorarrrrrrrNryr|rLrrr.r/s@r0rQrQs+ G "56 +, zt#DE G  (OJIKLAAJ" L$$B442&11 W WSSOOr/rQc eZdZdZdefdefgZy)EncryptedPrivateKeyInfoz< Source: https://tools.ietf.org/html/rfc5208#page-4 encryption_algorithmencrypted_dataN)r)r*r+r,rrr-r.r/r0rrs! !45 ;'Gr/rc eZdZdZdefdefgZy)ValidationParms= Source: https://tools.ietf.org/html/rfc3279#page-10 r pgen_counterN)r)r*r+r,rrr-r.r/r0rrs   !Gr/rc>eZdZdZdefdefdefdeddifdeddifgZy ) DomainParametersrrIrKrJjrDTvalidation_paramsN)r)r*r+r,rrr-r.r/r0rrsC g g g g D)* o D/AB Gr/rc *eZdZdZdddddddd d d d Zy )PublicKeyAlgorithmIdzM Original Name: None Source: https://tools.ietf.org/html/rfc3279 r< rsaes_oaepr=r>r?dhr@rArBrC) rDz1.2.840.113549.1.1.7rErFrGz1.2.840.10046.2.1rHrIrJrKNr7r.r/r0rrs.!& ,!-"!! # Dr/rc:eZdZdZdefdeddifgZdZee e e e dZ y) PublicKeyAlgorithmzd Original Name: AlgorithmIdentifier Source: https://tools.ietf.org/html/rfc5280#page-18 rNrrDTrO)r>r?rrr=N)r)r*r+r,rrr-rr1r rrrrr.r/r0rrsE *+ sZ./G ,I %% Jr/rceZdZdZdefdefgZdZdeiZdZ dZ dZ dZ dZ edZdZedZed Zed Zed Zed Zed ZedZedZy) PublicKeyInfoze Original Name: SubjectPublicKeyInfo Source: https://tools.ietf.org/html/rfc5280#page-17 rNrLc |ddj}tttttdfttdftdftdftdfd |S)NrN) r<rr=r>r?rr@rArBrC)rerFrrurrVs r0_public_key_speczPublicKeyInfo._public_key_spec/sf%k299 &&$T*&t,#T*&-$d+   r/Nct|ts.t|tstt dt ||dk7r#|dk7rt t dt|t}t||d<t|d<|}||d<t|tr|jj}t||d<|S)a Wraps a public key in a PublicKeyInfo structure :param public_key: A byte string or Asn1Value object of the public key :param algorithm: A unicode string of "rsa" :return: A PublicKeyInfo object zW public_key must be a byte string or Asn1Value, not %s r<r=z> algorithm must "rsa", not %s rNrrL)r"r rrYrr rhrrrruntagdumpr)rZrLrNalgor`s r0razPublicKeyInfo.wrapLs*h/ :y8YF*%    )|";VY  "#0;[!V\E !% + j) ,#))+002J"8"D ,r/ctd)z Unwraps an RSA public key into an RSAPublicKey object. Does not support DSA or EC public keys since they do not have an unwrapped form. :return: An RSAPublicKey object zvasn1crypto.keys.PublicKeyInfo().unwrap() has been removed, please use oscrypto.asymmetric.PublicKey().unwrap() insteadrer-s r0rzPublicKeyInfo.unwrapws JK Kr/c|jdk7r-ttd|jj|dd}|j}|j dk(rd}n |j }|j |fS)rgr?rhrNrrNrirks r0rzPublicKeyInfo.curves~ >>T !V$$&  k"<0 ;;- 'EMME U##r/c|jdk7r-ttd|jj|dd}|jyt j |djddz }|d krd Sd S) a# Returns the name of the family of hash algorithms used to generate a DSA key :raises: ValueError - when the key is not a DSA key :return: A unicode string of "sha1" or "sha2" or None if no parameters are present r>rmrNrNrJrQrnrrorp)rNrhrrjrerVrX)rirrqs r0rrzPublicKeyInfo.hash_algos >>U "V$$&  +&|4    $88JsO22A6:!Rv3V3r/c`|j|ddj|_|jS)rtrNrur-s r0rNzPublicKeyInfo.algorithms/ ?? "";/ <CCDOr/cL|j |jdk(r;tt|djdz dz dz|_|jS|jdk(s|jdk(r|dj dj}n$|jd k(r|d d d j}tt jt jd|_|jdz}|d k7r|xjd|z z c_|jS)zT :return: The bit size of the public key, as an integer r?rLrrQrnr<r=r<r>rNrrIr) rwrNrUrfrercrVrWrXrxs r0ryzPublicKeyInfo.bit_sizes >> !~~%!$s4 +=+D+D'E'IQ&NRS%S!T~~>>U*dnn .L .55i@GGE^^u, -l;C@GGE!$TYYtxxq/A%B!C..1,a<NNa'k1N~~r/cXttj|jdz S)zU :return: The byte size of the public key, as an integer rnr{r-s r0r|zPublicKeyInfo.byte_sizer}r/c|j4tjt|dj |_|jS)ze :return: The SHA1 hash of the DER-encoded bytes of this public key info rL)_sha1hashlibror digestr-s r0rozPublicKeyInfo.sha1s; ::  htL/A&BCJJLDJzzr/c|j4tjt|dj |_|jS)zh :return: The SHA-256 hash of the DER-encoded bytes of this public key info rL)_sha256rsha256r rr-s r0rzPublicKeyInfo.sha256s; << ">>(4 3E*FGNNPDL||r/ctd)aZ Creates a fingerprint that can be compared with a private key to see if the two form a pair. This fingerprint is not compatible with fingerprints generated by any other software. :return: A byte string that is a sha256 hash of selected components (based on the key type) z|asn1crypto.keys.PublicKeyInfo().fingerprint has been removed, please use oscrypto.asymmetric.PublicKey().fingerprint insteadrer-s r0rzPublicKeyInfo.fingerprints MN Nr/)r)r*r+r,rrr-rrr\rwrrrrorarrrrrrNryr|rorrr.r/r0rr$s  () -.G ( &OJIL EG((T K$$B44<*11NNr/r)Hr, __future__rrrrrrV_errorsrr _typesr r algosr r rrrcorerrrrrrrrrrrrrrrutilr r!r#r2r5r:rFrHrOrqrurwr~rrrrrrrr rrr1r3r8r;rMrQrrrrrrr.r/r0rs SR )'oo"/ X !j! 7 H&8H(C C L k8  ~x w   -  ( (h" H    '!'D"*"*J'4B84Bn  ,4.&SOXSOlhh x +6-x*qNHqNr/__pycache__/ocsp.cpython-312.pyc000064400000055526152572326550012454 0ustar00 uiPJdZddlmZmZmZmZddlmZddlm Z m Z ddl m Z m Z mZmZmZmZmZmZmZmZmZmZmZddlmZmZddlmZdd lmZm Z m!Z!m"Z"Gd d eZ#Gd d eZ$GddeZ%GddeZ&GddeZ'GddeZ(GddeZ)GddeZ*GddeZ+GddeZ,GddeZ-Gd d!eZ.Gd"d#eZ/Gd$d%eZ0Gd&d'eZ1Gd(d)eZ2Gd*d+eZ3Gd,d-eZ4Gd.d/eZ5Gd0d1eZ6Gd2d3e Z7Gd4d5eZ8Gd6d7eZ9Gd8d9eZ:Gd:d;e Z;Gd<d=eZ<Gd>d?eZ=Gd@dAeZ>GdBdCeZ?GdDdEeZ@GdFdGeZAGdHdIeZBGdJdKeZCGdLdMeZDGdNdOeZEGdPdQeZFGdRdSeZGGdTdUeZHyV)Wz ASN.1 type classes for the online certificate status protocol (OCSP). Exports the following items: - OCSPRequest() - OCSPResponse() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_function)unwrap)DigestAlgorithmSignedDigestAlgorithm) BooleanChoice EnumeratedGeneralizedTime IA5StringIntegerNullObjectIdentifierOctetBitString OctetStringParsableOctetStringSequence SequenceOf)AuthorityInfoAccessSyntax CRLReason)PublicKeyAlgorithm) Certificate GeneralName GeneralNamesNameceZdZddiZy)Versionrv1N__name__ __module__ __qualname___map@/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/ocsp.pyr r (s 4 Dr(r c(eZdZdefdefdefdefgZy)CertIdhash_algorithmissuer_name_hashissuer_key_hash serial_numberN)r#r$r%r rr_fieldsr'r(r)r+r+.s) ?+ [) K( '" Gr(r+ceZdZdefdefgZy)ServiceLocatorissuerlocatorN)r#r$r%rrr0r'r(r)r2r27s 4 -.Gr(r2ceZdZddiZy)RequestExtensionIdz1.3.6.1.5.5.7.48.1.7service_locatorNr"r'r(r)r6r6>s 1 Dr(r6c4eZdZdefdeddifdefgZdZdeiZ y) RequestExtensionextn_idcriticaldefaultF extn_valuer:r=r7N) r#r$r%r6r rr0 _oid_pairr2 _oid_specsr'r(r)r9r9Ds= &' Wy%01 *+G *I>Jr(r9ceZdZeZy)RequestExtensionsN)r#r$r%r9 _child_specr'r(r)rBrBQs"Kr(rBcVeZdZdefdedddfgZdZdZdZdZ e d Z e d Z y) Requestreq_certsingle_request_extensionsrTexplicitoptionalFNct|_|dD]g}|dj}d|z}t||rt |||dj |djsM|jj |id|_y)v Sets common named extensions to private attributes and creates a list of critical extensions rGr: _%s_valuer=r;TNset_critical_extensionsnativehasattrsetattrparsedadd_processed_extensionsself extensionnameattribute_names r)_set_extensionszRequest._set_extensions_s %(E!9:IY'..D(4/Nt^,ni .E.L.LM$++))--d3 ;&*"r(cR|js|j|jSz Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings rVr\rPrXs r)critical_extensionszRequest.critical_extensionsq%))  "(((r(cV|jdur|j|jS)z This extension is used when communicating with an OCSP responder that acts as a proxy for OCSP requests :return: None or a ServiceLocator object F)rVr\_service_locator_valuer`s r)service_locator_valuezRequest.service_locator_value*  % % .  "***r() r#r$r%r+rBr0rVrPrdr\propertyrarer'r(r)rErEUsc V $&7aUY9Z[G "!*$ ) ) + +r(rEceZdZeZy)RequestsN)r#r$r%rErCr'r(r)ririsKr(riceZdZddiZy) ResponseTypez1.3.6.1.5.5.7.48.1.1basic_ocsp_responseNr"r'r(r)rkrks 5 Dr(rkceZdZeZy)AcceptableResponsesN)r#r$r%rkrCr'r(r)rnrnsKr(rnc"eZdZdefdeddifgZy)PreferredSignatureAlgorithmsig_identifiercert_identifierrJTN)r#r$r%r rr0r'r(r)rprps" 01 .T0BCGr(rpceZdZeZy)PreferredSignatureAlgorithmsN)r#r$r%rprCr'r(r)rtrts-Kr(rtceZdZddddZy)TBSRequestExtensionIdnonceacceptable_responsespreferred_signature_algorithms)1.3.6.1.5.5.7.48.1.2z1.3.6.1.5.5.7.48.1.4z1.3.6.1.5.5.7.48.1.8Nr"r'r(r)rvrvs ' 6 @ Dr(rvc8eZdZdefdeddifdefgZdZee e dZ y) TBSRequestExtensionr:r;r<Fr=r>)rwrxryN) r#r$r%rvr rr0r?rrnrtr@r'r(r)r|r|sA )* Wy%01 *+G *I 3*FJr(r|ceZdZeZy)TBSRequestExtensionsN)r#r$r%r|rCr'r(r)r~r~s%Kr(r~c@eZdZdedddfdedddfd efd ed ddfgZy ) TBSRequestversionrr!rIr<requestor_namerTrH request_listrequest_extensionsN)r#r$r%r rrir~r0r'r(r)rrs@ G!=> ;QD(IJ " 3!QU5VW Gr(rceZdZeZy) CertificatesN)r#r$r%rrCr'r(r)rrsKr(rc*eZdZdefdefdedddfgZy) Signaturesignature_algorithm signaturecertsrTrHN)r#r$r%r rrr0r'r(r)rrs)  56 n% ,QD ABGr(rc~eZdZdefdedddfgZdZdZdZdZ dZ dZ e d Z e d Ze d Ze d Zy) OCSPRequest tbs_requestoptional_signaturerTrHFNct|_|ddD]g}|dj}d|z}t||rt |||dj |djsM|jj |id|_y) rLrrr:rMr=r;TNrNrWs r)r\zOCSPRequest._set_extensionss %(E!m,-ABIY'..D(4/Nt^,ni .E.L.LM$++))--d3 C&*"r(cR|js|j|jSr^r_r`s r)razOCSPRequest.critical_extensionsrbr(cV|jdur|j|jS)z This extension is used to prevent replay attacks by including a unique, random value with each request/response pair :return: None or an OctetString object FrVr\ _nonce_valuer`s r) nonce_valuezOCSPRequest.nonce_value*  % % .  "   r(cV|jdur|j|jS)a( This extension is used to allow the client and server to communicate with alternative response formats other than just basic_ocsp_response, although no other formats are defined in the standard. :return: None or an AcceptableResponses object F)rVr\_acceptable_responses_valuer`s r)acceptable_responses_valuez&OCSPRequest.acceptable_responses_values*  % % .  "///r(cV|jdur|j|jS)aj This extension is used by the client to define what signature algorithms are preferred, including both the hash algorithm and the public key algorithm, with a level of detail down to even the public key algorithm parameters, such as curve name. :return: None or a PreferredSignatureAlgorithms object F)rVr\%_preferred_signature_algorithms_valuer`s r)$preferred_signature_algorithms_valuez0OCSPRequest.preferred_signature_algorithms_value s*  % % .  "999r()r#r$r%rrr0rVrPrrrr\rgrarrrr'r(r)rrs  # yqd*KLG "L"&,0)*$ ) ) ! ! 0 0 : :r(rceZdZdddddddZy) OCSPResponseStatus successfulmalformed_requestinternal_error try_later sign_required unauthorized)rrrNr"r'r(r)rr1s        Dr(rc(eZdZdeddifdeddifgZy) ResponderIdby_namerIrby_keyrN)r#r$r%rr _alternativesr'r(r)rr<s% D:q/* ;Q0Mr(rc"eZdZdZedZy) StatusGoodc||3|dk7r.t|tsttdt |d|_y)z` Sets the value of the object :param value: None or 'good' NgoodzK value must be one of None, "good", not %s r( isinstancer ValueErrorrreprcontentsrXvalues r)rOzStatusGood.setEsD  &E49PVU   r(cy)Nrr'r`s r)rQzStatusGood.nativeWsr(Nr#r$r%rOrgrQr'r(r)rrDs$r(rc"eZdZdZedZy) StatusUnknownc||3|dk7r.t|tsttdt |d|_y)zc Sets the value of the object :param value: None or 'unknown' NunknownzN value must be one of None, "unknown", not %s r(rrs r)rOzStatusUnknown.set^sE  )!3Jud? _1$&GHGr(rceZdZdddddddZy) SingleResponseExtensionIdcrlarchive_cutoff crl_reasoninvalidity_datecertificate_issuer!signed_certificate_timestamp_list)z1.3.6.1.5.5.7.48.1.3z1.3.6.1.5.5.7.48.1.6z 2.5.29.21z 2.5.29.24z 2.5.29.29z1.3.6.1.4.1.11129.2.4.5Nr"r'r(r)rrs % 0"&)#F Dr(rc>eZdZdefdeddifdefgZdZee e e e e dZ y) SingleResponseExtensionr:r;r<Fr=r>)rrrrrrN)r#r$r%rr rr0r?rrrrrr@r'r(r)rrsJ -. Wy%01 *+G *I)**-8 Jr(rceZdZeZy)SingleResponseExtensionsN)r#r$r%rrCr'r(r)rrs)Kr(rc eZdZdefdefdefdedddfded ddfgZd Zd Z d Z d Z d Z d Z d Zd Zed ZedZedZedZedZedZy )SingleResponsecert_id cert_status this_update next_updaterTrHsingle_extensionsrFNct|_|dD]g}|dj}d|z}t||rt |||dj |djsM|jj |id|_y)rLrr:rMr=r;TNrNrWs r)r\zSingleResponse._set_extensionss %(E!12IY'..D(4/Nt^,ni .E.L.LM$++))--d3 3&*"r(cR|js|j|jSr^r_r`s r)raz"SingleResponse.critical_extensionsrbr(cV|jdur|j|jS)z This extension is used to locate the CRL that a certificate's revocation is contained within. :return: None or a CrlId object F)rVr\ _crl_valuer`s r) crl_valuezSingleResponse.crl_values(  % % .  "r(cV|jdur|j|jS)z This extension is used to indicate the date at which an archived (historical) certificate status entry will no longer be available. :return: None or a GeneralizedTime object F)rVr\_archive_cutoff_valuer`s r)archive_cutoff_valuez#SingleResponse.archive_cutoff_values*  % % .  ")))r(cV|jdur|j|jS)z This extension indicates the reason that a certificate was revoked. :return: None or a CRLReason object F)rVr\_crl_reason_valuer`s r)crl_reason_valuezSingleResponse.crl_reason_values*  % % .  "%%%r(cV|jdur|j|jS)a= This extension indicates the suspected date/time the private key was compromised or the certificate became invalid. This would usually be before the revocation date, which is when the CA processed the revocation. :return: None or a GeneralizedTime object F)rVr\_invalidity_date_valuer`s r)invalidity_date_valuez$SingleResponse.invalidity_date_value s*  % % .  "***r(cV|jdur|j|jS)z This extension indicates the issuer of the certificate in question. :return: None or an x509.GeneralNames object F)rVr\_certificate_issuer_valuer`s r)certificate_issuer_valuez'SingleResponse.certificate_issuer_values*  % % .  "---r()r#r$r%r+rrrr0rVrPrrrrrr\rgrarrrrrr'r(r)rrs F  # ( aT)JK 6QTX8YZ G"J ! $*$ ) )   * * & & + + . .r(rceZdZeZy) ResponsesN)r#r$r%rrCr'r(r)rr(s Kr(rceZdZdddZy)ResponseDataExtensionIdrwextended_revoke)rzz1.3.6.1.5.5.7.48.1.9Nr"r'r(r)rr,s ' 1 Dr(rc6eZdZdefdeddifdefgZdZee dZ y) ResponseDataExtensionr:r;r<Fr=r>)rwrN) r#r$r%rr rr0r?rrr@r'r(r)rr3s> +, Wy%01 *+G *IJr(rceZdZeZy)ResponseDataExtensionsN)r#r$r%rrCr'r(r)rrAs'Kr(rc >eZdZdedddfdefdefdefded d d fgZy ) ResponseDatarrr!r responder_id produced_at responsesresponse_extensionsrTrHN) r#r$r%r rrrrr0r'r(r)rrEsA G!=> % ( i  6QTX8YZ Gr(rc0eZdZdefdefdefdedddfgZy) BasicOCSPResponsetbs_response_datarrrrTrHN)r#r$r%rr rrr0r'r(r)rrOs1 l+  56 n% ,QD AB Gr(rc(eZdZdefdefgZdZdeiZy) ResponseBytes response_typeresponse)rrrlN) r#r$r%rkrr0r?rr@r'r(r)rrXs. ,' ()G .I0Jr(rceZdZdefdedddfgZdZdZdZdZ dZ e d Z e d Z e d Ze d Ze d Zy) OCSPResponseresponse_statusresponse_bytesrTrHFNc4t|_|ddjddD]g}|dj}d|z}t ||rt |||dj|djsM|jj |id |_y ) rLr rrrr:rMr=r;TN)rOrPrTrQrRrSrUrVrWs r)r\zOCSPResponse._set_extensionsos %(E!./ ;BBCVWXmnIY'..D(4/Nt^,ni .E.L.LM$++))--d3 o&*"r(cR|js|j|jSr^r_r`s r)raz OCSPResponse.critical_extensionsrbr(cV|jdur|j|jS)z This extension is used to prevent replay attacks on the request/response exchange :return: None or an OctetString object Frr`s r)rzOCSPResponse.nonce_valuerr(cV|jdur|j|jS)z This extension is used to signal that the responder will return a "revoked" status for non-issued certificates. :return: None or a Null object (if present) F)rVr\_extended_revoke_valuer`s r)extended_revoke_valuez"OCSPResponse.extended_revoke_valuerfr(c&|ddjS)z A shortcut into the BasicOCSPResponse sequence :return: None or an asn1crypto.ocsp.BasicOCSPResponse object r rrTr`s r)rlz OCSPResponse.basic_ocsp_responses$%j1888r(c,|ddjdS)z A shortcut into the parsed, ResponseData sequence :return: None or an asn1crypto.ocsp.ResponseData object r rrrr`s r) response_datazOCSPResponse.response_datas!$%j1889LMMr()r#r$r%rrr0rVrPrrr\rgrarrrlrr'r(r)r r ds ./ =qd*KLG "L!*$ ) ) ! ! + +99NNr(r N)I__doc__ __future__rrrr_errorsralgosr r corer r r rrrrrrrrrrrrrkeysrx509rrrrr r+r2r6r9rBrErirkrnrprtrvr|r~rrrrrrrrrrrrrrrrrrrrrrr r'r(r)rsSR96$>> g XX) x # #6+h6+rz# *(.:., ( &:&:W:(W:t&2D0(H  0 h$*z*u.Xu.p! !. H (Z(8 H [N8[Nr(__pycache__/parser.cpython-312.pyc000064400000022300152572326550012764 0ustar00 ui#dZddlmZmZmZmZddlZddlmZm Z m Z ddl m Z m Z ejdkZdZd Zd Zdd Zd Zdd ZdZy)z Functions for parsing and dumping using the ASN.1 DER encoding. Exports the following items: - emit() - parse() - peek() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_functionN)byte_clschr_cls type_name)int_from_bytes int_to_bytes)zOOPP zVaZENOO fc ";i>OOPP zVaZ86ABB c3 89S>IJJ Qw@3FGG h )@9XCVVWW X 6 AAct|tstdt|zt |}t ||\}}|r||k7rt d||z z|S)al Parses a byte string of ASN.1 BER/DER-encoded data. This is typically not useful. Instead, use one of the standard classes from asn1crypto.core, or construct a new class with specific fields, and call the .load() class method. :param contents: A byte string of BER/DER-encoded data :param strict: A boolean indicating if trailing data should be forbidden - if so, a ValueError will be raised when trailing data exists :raises: ValueError - when the contents do not contain an ASN.1 header or are truncated in some way TypeError - when contents is not a byte string :return: A 6-element tuple: - 0: integer class (0 to 3) - 1: integer method - 2: integer tag - 3: byte string header - 4: byte string content - 5: byte string trailer rz4Extra data - %d bytes of trailing data were provided)rrrr len_parser)rstrict contents_leninfoconsumeds rparser$Ksd: h )@9XCVVWWx=LHl3ND( (l*OS_bjSjkll Krct|tstdt|zt |t |\}}|S)aW Parses a byte string of ASN.1 BER/DER-encoded data to find the length This is typically used to look into an encoded value to see how long the next chunk of ASN.1-encoded data is. Primarily it is useful when a value is a concatenation of multiple values. :param contents: A byte string of BER/DER-encoded data :raises: ValueError - when the contents do not contain an ASN.1 header or are truncated in some way TypeError - when contents is not a byte string :return: An integer with the number of bytes occupied by the ASN.1 value r)rrrr rr)rr"r#s rpeekr&rs=& h )@9XCVVWWHc(m4ND( Orc |tkDr td|}||dzkrttd||z fztrt ||n||}|dz }|dz}|dz dz}|dk(r|d} ||dzkrttd||z fztrt ||n||} |dz }| dk(r|dk(r td|dz}|| d zz }| d z dk(rni|dkr td||dzkrttd||z fztrt ||n||} |dz }d } | d z dk(r || d zz} n| d z} | r;||| zkrtt| ||z fz|| z }|t ||| z |d z} nT|s td|} || dzks || | dzdk7r+t ||| d|dz\}} || dzkr|| | dzdk7r+| dz } d} | |kDrtt| |z ||z fz|r|| fS|dz |||||||| t| z | f| fS)a Parses a byte string into component parts :param encoded_data: A byte string that contains BER-encoded data :param data_len: The integer length of the encoded data :param pointer: The index in the byte string to parse from :param lengths_only: A boolean to cause the call to return a 2-element tuple of the integer number of bytes in the header and the integer number of bytes in the contents. Internal use only. :param depth: The recursion depth when evaluating indefinite-length encoding. :return: A 2-element tuple: - 0: A tuple of (class_, method, tag, header, content, trailer) - 1: An integer indicating how many bytes were consumed z*Indefinite-length recursion limit exceededrrTzNon-minimal tag encodingrF)signedz-Indefinite-length element must be constructeds) lengths_onlydepth) _MAX_DEPTHr_INSUFFICIENT_DATA_MESSAGE_PY2ordr rr) encoded_datadata_lenpointerr/r0start first_octetr constructednum length_octettrailer contents_end length_octets_s rrrs6 zEFF E'A+3q(W:L6MMNN04#l7+,,w:OK qLG  C!#q(K by'A+% !;q(WBT>U!UVV04#l7+,,w:OC qLGd{sax !;<< 3JC 39 Cax1} 878 8'A+3q(W:L6MMNN153|G,-<;PL qLGGqA,"45 %s* 'M11 !;}hY`N`>a!abb } $G"^L=AXY`4ajo%ppL !PQQ"L\A--l1Z^i1i"(x\`hmnoho"p<\A--l1Z^i1i A L!Gh3|g7MxZaOa6bbcc&& 1    w ' c'l!: ;      rcfd}d}||dzz}||dzz}|dk\rF(C Ag "%.'&3,'' ]F }'&/! M $F+ '$\!2233, Mr)F)rFr)__doc__ __future__rrrrsys_typesrr r utilr r version_infor4r3r2rr$r&rrrrrOsX SR 00. 4[  .Bb$N4gT.r__pycache__/pdf.cpython-312.pyc000064400000006602152572326550012250 0ustar00 uiFdZddlmZmZmZmZddlmZmZddl m Z m Z m Z m Z mZmZmZmZddlmZddlmZddlmZmZmZmZGd d eZGd d eZGd deZGddeZGddeZGddeZ GddeZ!GddeZ"dejFd<dejFd<dejFd<eejHd<eejHd<e ejHd<dejFd <d!ejFd"<e"ejHd!<y#)$z ASN.1 type classes for PDF signature structures. Adds extra oid mapping and value parsing to asn1crypto.x509.Extension() and asn1crypto.xms.CMSAttribute(). )unicode_literalsdivisionabsolute_importprint_function)CMSAttributeType CMSAttribute)BooleanIntegerNullObjectIdentifier OctetStringSequence SequenceOfSetOf)CertificateList) OCSPResponse) Extension ExtensionId GeneralName KeyPurposeIdceZdZdefgZy)AdobeArchiveRevInfoversionN)__name__ __module__ __qualname__r _fields?/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/pdf.pyrrs GGr rc*eZdZdefdefdedddfgZy)AdobeTimestamprlocation requires_authTF)optionaldefaultN)rrrr rr rrr r!r#r#%s( G [! '#GHGr r#ceZdZdefdefgZy) OtherRevInfotypevalueN)rrrr rrrr r!r)r)-s !" +Gr r)ceZdZeZy)SequenceOfCertificateListN)rrrr _child_specrr r!r-r-4s!Kr r-ceZdZeZy)SequenceOfOCSPResponseN)rrrrr.rr r!r0r08Kr r0ceZdZeZy)SequenceOfOtherRevInfoN)rrrr)r.rr r!r3r3<r1r r3c:eZdZdedddfdedddfdedddfgZy ) RevocationInfoArchivalcrlrT)explicitr&ocsprother_rev_infoN)rrrr-r0r3rrr r!r5r5@s9 )t+LM 'aT)JK 1t3TUGr r5ceZdZeZy)SetOfRevocationInfoArchivalN)rrrr5r.rr r!r<r<Hs(Kr r<adobe_archive_rev_infoz1.2.840.113583.1.1.9.2adobe_timestampz1.2.840.113583.1.1.9.1adobe_ppklite_credentialz1.2.840.113583.1.1.10 pdf_signingz1.2.840.113583.1.1.5adobe_revocation_info_archivalz1.2.840.113583.1.1.8N)%__doc__ __future__rrrrcmsrr corer r r r rrrrr6rr8rx509rrrrrr#r)r-r0r3r5r<_map _oid_specsrr r!rIs4 SR/   !( X8" "ZZX)%).F )*-> )*,F ()1D -.*8 &'37 /0,9 ()0P,-t jd|}|s'|jdjd}d }d }L|d k(rQ|jd d k(rd }n:|jd} | jdd\} } | j|| <|d k(s|dddvr'tj|} ||| fd}i}d}d}d }||z }|r|sttdyw)ax Convert a PEM-encoded byte string into one or more DER-encoded byte strings :param pem_bytes: A byte string of the PEM-encoded data :raises: ValueError - when the pem_bytes do not appear to be PEM-encoded bytes :return: A generator of 3-element tuples in the format: (object_type, headers, der_bytes). The object_type is a unicode string of what is between "-----BEGIN " and "-----". Examples include: "CERTIFICATE", "PUBLIC KEY", "PRIVATE KEY". The headers is a dict containing any lines in the form "Name: Value" that are right after the begin line. zA pem_bytes must be a byte string, not %s trashrNFs1^(?:---- |-----)BEGIN ([A-Z0-9 ]+)(?: ----|-----)rrTr%:rbody:r)s-----s---- z| pem_bytes does not appear to contain PEM-encoded data - no BEGIN/END combination found )rr rrr splitlinesrematchgroupdecodersplitstripr b64decode ValueError) pem_bytesstater% base64_data object_type found_start found_endlinetype_name_match decoded_linenamevaluer$s r_unarmorrFps$ i *  y !     EGKKKI$$U+ 3;  G !hh'[]abO")//299'BKKE  I yy"$#{{73 *00a8 e %   F?Aay00",,[9 "GY77! "   4 KM,P i    (s C3E6AEc6t|}|s t|S|S)a Convert a PEM-encoded byte string into a DER-encoded byte string :param pem_bytes: A byte string of the PEM-encoded data :param multiple: If True, function will return a generator :raises: ValueError - when the pem_bytes do not appear to be PEM-encoded bytes :return: A 3-element tuple (object_name, headers, der_bytes). The object_name is a unicode string of what is between "-----BEGIN " and "-----". Examples include: "CERTIFICATE", "PUBLIC KEY", "PRIVATE KEY". The headers is a dict containing any lines in the form "Name: Value" that are right after the begin line. )rFnext)r;multiple generators runarmorrKs!*#I I r)N)F)__doc__ __future__rrrrr r3sys_errorsr_typesr rr r version_info cStringIOr riorr+rFrKrrrUsQSR >>d-Z.;|Q hr__pycache__/pkcs12.cpython-312.pyc000064400000014436152572326550012606 0ustar00 ui"dZddlmZmZmZmZddlmZddlm Z m Z ddl m Z m Z mZmZmZmZmZmZmZddlmZmZddlmZmZGd d eZGd d eZGd deZGddeZGddeZGddeZ GddeZ!GddeZ"GddeZ#GddeZ$GddeZ%Gdd eZ&Gd!d"eZ'Gd#d$eZ(Gd%d&eZ)Gd'd(eZ*Gd)d*eZ+Gd+d,eZ,e,e+_-y-).z ASN.1 type classes for PKCS#12 files. Exports the following items: - CertBag() - CrlBag() - Pfx() - SafeBag() - SecretBag() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_function) DigestInfo) ContentInfo SignedData) Any BMPStringIntegerObjectIdentifier OctetStringParsableOctetStringSequence SequenceOfSetOf)PrivateKeyInfoEncryptedPrivateKeyInfo) Certificate KeyPurposeIdc(eZdZdefdefdeddifgZy)MacDatamacmac_salt iterationsdefaultrN)__name__ __module__ __qualname__rrr _fieldsB/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/pkcs12.pyrr$s'   [! wA/Gr#rceZdZddiZy)Versionv3Nrrr _mapr"r#r$r&r&,s 4 Dr#r&ceZdZdddddZy) AttributeType friendly_name local_key_idmicrosoft_local_machine_keysettrusted_key_usage)z1.2.840.113549.1.9.20z1.2.840.113549.1.9.21z1.3.6.1.4.1.311.17.1z2.16.840.1.113894.746875.1.1Nr)r"r#r$r,r,2s"1!/ @)< Dr#r,ceZdZeZy)SetOfAnyN)rrr r _child_specr"r#r$r2r2?sKr#r2ceZdZeZy)SetOfBMPStringN)rrr r r3r"r#r$r5r5CKr#r5ceZdZeZy)SetOfOctetStringN)rrr rr3r"r#r$r8r8GKr#r8ceZdZeZy)SetOfKeyPurposeIdN)rrr rr3r"r#r$r;r;KsKr#r;c4eZdZdefdgZeeeedZdZ de iZ y) Attributetype)valuesN)r-r.microsoft_csp_namer0c\|jj|djtS)Nr>) _oid_specsgetnativer2)selfs r$ _values_speczAttribute._values_spec\s#""4<#6#6AAr#r?N) rrr r,r!r5r8r;rBrF_spec_callbacksr"r#r$r=r=Os= G ((,. JB ,Or#r=ceZdZeZy) AttributesN)rrr r=r3r"r#r$rIrIdr6r#rIc<eZdZdefdefdeddifgZdZedZ y)Pfxversion auth_safemac_dataoptionalTNc|jD|dd}t|tr|dd}tj |j |_|jS)NrMcontent content_info)_authenticated_safe isinstancer AuthenticatedSafeloadrD)rErQs r$authenticated_safezPfx.authenticated_safeqsY  # # +;' 2G':.!.1)<'8'='=gnn'MD $'''r#) rrr r&r rr!rSpropertyrWr"r#r$rKrKhsB G k" Wz401G  ((r#rKceZdZeZy)rUN)rrr r r3r"r#r$rUrU{r9r#rUceZdZdddddddZy) BagIdkey_bagpkcs8_shrouded_key_bagcert_bagcrl_bag secret_bag safe_contents)z1.2.840.113549.1.12.10.1.1z1.2.840.113549.1.12.10.1.2z1.2.840.113549.1.12.10.1.3z1.2.840.113549.1.12.10.1.4z1.2.840.113549.1.12.10.1.5z1.2.840.113549.1.12.10.1.6Nr)r"r#r$r[r[s&/&>&0&/&2&5  Dr#r[ceZdZdddZy)CertIdx509sdsi)z1.2.840.113549.1.9.22.1z1.2.840.113549.1.9.22.2Nr)r"r#r$rcrcs#)#) Dr#rcc.eZdZdefdeddifgZdZdeiZy)CertBagcert_id cert_valueexplicitr)rhrirdN) rrr rcrr! _oid_pairrrBr"r#r$rgrgs3 F *ZO<G *I Jr#rgc"eZdZdefdeddifgZy)CrlBagcrl_id crl_valuerjrNrrr rrr!r"r#r$rmrms #$ kJ?3Gr#rmc"eZdZdefdeddifgZy) SecretBagsecret_type_id secret_valuerjrNrpr"r#r$rrrrs +, z1o6Gr#rrc eZdZy) SafeContentsN)rrr r"r#r$rvrvsr#rvcDeZdZdefdeddifdeddifgZdZee e e e e d Zy ) SafeBagbag_id bag_valuerjrbag_attributesrOT)ryrz)r\r]r^r_r`raN)rrr r[r rIr!rkrrrgrmrrrvrBr"r#r$rxrxsN 5 cJ?+ : D'9:G (I!"9% Jr#rxN).__doc__ __future__rrrralgosrcmsr r corer r r rrrrrrkeysrrrdrrrr&r,r2r5r8r;r=rIrKrUr[rcrgrmrrrvrxr3r"r#r$rs SR(   :+ hg $ uUu*(((&    h X : h$# r#__pycache__/tsp.cpython-312.pyc000064400000025574152572326550012316 0ustar00 uidZddlmZmZmZmZddlmZddlm Z m Z m Z m Z m Z ddlmZmZmZmZmZmZmZmZmZmZmZmZmZddlmZddlmZm Z m!Z!m"Z"Gd d eZ#Gd d eZ$Gd deZ%GddeZ&GddeZ'GddeZ(GddeZ)GddeZ*GddeZ+GddeZ,GddeZ-Gdd eZ.Gd!d"eZ/Gd#d$eZ0Gd%d&eZ1Gd'd(eZ2Gd)d*eZ3Gd+d,eZ4Gd-d.eZ5Gd/d0eZ6Gd1d2eZ7Gd3d4eZ8Gd5d6eZ9Gd7d8eZ:Gd9d:eZ;Gd;deZ=Gd?d@eZ>GdAdBeZ?GdCdDeZ@GdEdFeZAGdGdHeZBGdIdJeZCGdKdLeZDe(e jdM<e;e jdN<e;e jdN<dMe jdO<dNe jdP<dQe jdR<e@e jdQ<dSe jdT<eDe jdS<yU)Va ASN.1 type classes for the time stamp protocol (TSP). Exports the following items: - TimeStampReq() - TimeStampResp() Also adds TimeStampedData() support to asn1crypto.cms.ContentInfo(), TimeStampedData() and TSTInfo() support to asn1crypto.cms.EncapsulatedContentInfo() and some oids and value parsers to asn1crypto.cms.CMSAttribute(). Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_function)DigestAlgorithm) CMSAttributeCMSAttributeType ContentInfo ContentTypeEncapsulatedContentInfo) Any BitStringBooleanChoiceGeneralizedTime IA5StringIntegerObjectIdentifier OctetStringSequence SequenceOfSetOf UTF8String)CertificateList) AttributesCertificatePolicies GeneralName GeneralNamesceZdZdddddddZy) Versionv0v1v2v3v4v5rrN__name__ __module__ __qualname___map?/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/tsp.pyr!r!8s        Dr3r!ceZdZdefdefgZy)MessageImprinthash_algorithmhashed_messageN)r.r/r0rr_fieldsr2r3r4r6r6Cs ?+ ;'Gr3r6c8eZdZdeddifdedddfdedddfgZy ) AccuracysecondsoptionalTmillisrimplicitr=microsrN)r.r/r0rr9r2r3r4r;r;Js6 Gj$/0 7=> 7=>Gr3r;c(eZdZdefdeddifdefgZy) Extensionextn_idcriticaldefaultF extn_valueN)r.r/r0rrrr9r2r3r4rCrCRs) $% Wy%01 {#Gr3rCceZdZeZy) ExtensionsN)r.r/r0rC _child_specr2r3r4rIrIZKr3rIcneZdZdefdefdefdefdefdeddifd e d d ifd eddifd e dddfde dddfg Z y)TSTInfoversionpolicymessage_imprint serial_numbergen_timeaccuracyr=TorderingrFFnoncetsar)explicitr= extensionsrr?N) r.r/r0r!rr6rrr;rrrIr9r2r3r4rMrM^s} G #$ N+ '" _% X D12 Wy%01 'J-.  !>? zt#DE Gr3rMc NeZdZdefdefdeddifdeddifdedd ifd ed dd fgZ y ) TimeStampReqrNrP req_policyr=TrUcert_reqrFFrXrr?N) r.r/r0r!r6rrrrIr9r2r3r4rZrZmsV G N+ '*d);< 'J-. Wy%01 zt#DE Gr3rZceZdZdddddddZy) PKIStatusgrantedgranted_with_mods rejectionwaitingrevocation_warningrevocation_notificationr(Nr-r2r3r4r^r^xs      $  Dr3r^ceZdZeZy) PKIFreeTextN)r.r/r0rrJr2r3r4rfrfsKr3rfc "eZdZddddddddd Zy ) PKIFailureInfobad_alg bad_requestbad_data_formattime_not_availableunaccepted_policyunaccepted_extensionsadd_info_not_availablesystem_failure)rr)r,Nr-r2r3r4rhrhs!     # $  Dr3rhc.eZdZdefdeddifdeddifgZy) PKIStatusInfostatus status_stringr=T fail_infoN)r.r/r0r^rfrhr9r2r3r4rwrws/ 9 + D'9: nz4&89Gr3rwceZdZdefdefgZy) TimeStampResprxtime_stamp_tokenN)r.r/r0rwr r9r2r3r4r|r|s =! [)Gr3r|c:eZdZdefdeddifdeddifdeddifgZy)MetaDatahash_protected file_namer=T media_typeother_meta_dataN)r.r/r0rrrrr9r2r3r4rrs> 7# j:t"45 y:t"45 JT(:; Gr3rc"eZdZdefdeddifgZy)TimeStampAndCRL time_stampcrlr=TN)r.r/r0r rr9r2r3r4rrs! ./ *d!34Gr3rceZdZeZy)TimeStampTokenEvidenceN)r.r/r0rrJr2r3r4rr!Kr3rceZdZeZy)DigestAlgorithmsN)r.r/r0rrJr2r3r4rrrr3rceZdZdefdefgZy)EncryptionInfoencryption_info_typeencryption_info_valueNr.r/r0rrr9r2r3r4rrs !12 #&Gr3rceZdZeZy)PartialHashtreeN)r.r/r0rrJr2r3r4rrKr3rceZdZeZy)PartialHashtreesN)r.r/r0rrJr2r3r4rrrr3rc@eZdZdedddfdedddfdedddfd efgZy ) ArchiveTimeStampdigest_algorithmrTr? attributesrreduced_hashtreer)rN)r.r/r0rrrr r9r2r3r4rrs? _1$.OP zt#DE -A4/PQ {# Gr3rceZdZeZy)ArchiveTimeStampSequenceN)r.r/r0rrJr2r3r4rrs"Kr3rc>eZdZdefdefdedddfdedddfd efgZy ) EvidenceRecordrNdigest_algorithms crypto_infosrTr?encryption_inforarchive_time_stamp_sequenceN) r.r/r0r!rrrrr9r2r3r4rrsA G ./ !%FG N,MN &(@A Gr3rceZdZdefdefgZy) OtherEvidenceoe_typeoe_valueNrr2r3r4rrs $% SGr3rc4eZdZdeddifdeddifdeddifgZy) Evidence tst_evidencer@r ers_evidencerother_evidencer)N)r.r/r0rrr _alternativesr2r3r4rrs4 /*aA *a9 =:q/:Mr3rc@eZdZdefdeddifdeddifdeddifdefgZy) TimeStampedDatarNdata_urir=T meta_datacontenttemporal_evidenceN) r.r/r0r!rrrrr9r2r3r4rrsF G YT 23 hT 23 K*d!34 h' Gr3rceZdZdefdefgZy) IssuerSerialissuerrQN)r.r/r0rrr9r2r3r4rrs < '"Gr3rc"eZdZdefdeddifgZy) ESSCertID cert_hash issuer_serialr=TN)r.r/r0rrr9r2r3r4rrs k" ,T(:;Gr3rceZdZeZy) ESSCertIDsN)r.r/r0rrJr2r3r4rrrKr3rc"eZdZdefdeddifgZy)SigningCertificatecertspoliciesr=TN)r.r/r0rrr9r2r3r4rr s! * (:t*<=Gr3rceZdZeZy)SetOfSigningCertificatesN)r.r/r0rrJr2r3r4rrs$Kr3rc2eZdZdedddiifdefdeddifgZy ) ESSCertIDv2r7rF algorithmsha256rrr=TN)r.r/r0rrrr9r2r3r4rrs4 ?Yh8O,PQ k" ,T(:;Gr3rceZdZeZy) ESSCertIDv2sN)r.r/r0rrJr2r3r4rrrr3rc"eZdZdefdeddifgZy)SigningCertificateV2rrr=TN)r.r/r0rrr9r2r3r4rr#s! , (:t*<=Gr3rceZdZeZy)SetOfSigningCertificatesV2N)r.r/r0rrJr2r3r4rr*s&Kr3rtst_infotimestamped_dataz1.2.840.113549.1.9.16.1.4z1.2.840.113549.1.9.16.1.31signing_certificatez1.2.840.113549.1.9.16.2.12signing_certificate_v2z1.2.840.113549.1.9.16.2.47N)G__doc__ __future__rrrralgosrcmsr r r r r corerrrrrrrrrrrrrrrx509rrrrr!r6r;rCrIrMrZr^rfrhrwr|rrrrrrrrrrrrrrrrrrrrrr _oid_specsr1r2r3r4rsy SR"!gXx h 8* Y HHxh"Z""z"Xj"z"x#z#XHvh8%u%(:8''29"":.9H""#56-< )*0: ,-1C -.6K231I -.6N234N 01r3__pycache__/util.cpython-312.pyc000064400000065737152572326550012472 0ustar00 uiqUdZddlmZmZmZmZddlZddlZddlmZm Z m Z m Z ddl m Z ddlmZmZddlmZdd lmZej*d k(r dd lmZmZndd lmZmZej4d kr'dd ZddZGdde Zee de_nddlmZddZddZdZGdde Z e Z!iZ"dZ#Gdde$Z%Gdde$Z&y)a5 Miscellaneous data helpers, including functions for converting integers to and from bytes and UTC timezone. Exports the following items: - OrderedDict() - int_from_bytes() - int_to_bytes() - timezone.utc - utc_with_dst - create_timezone() - inet_ntop() - inet_pton() - uri_to_iri() - iri_to_uri() )unicode_literalsdivisionabsolute_importprint_functionN)datetimedate timedeltatzinfo)unwrap) iri_to_uri uri_to_iri) OrderedDict) type_namewin32) inet_ntop inet_pton)c |dk(r|dk(ryd}|rN|dkrId}ttjtdt |zdz dz}|d|zzd|zz}d|z}t|dzrd |z}|j d }|r|st |ddd zrd |z}|6t||kDr td |rd}nd }||t|z z|z}|S|rt |ddd zdk(rd|z}|S) Converts an integer to a byte string :param value: The integer to convert :param signed: If the byte string should be encoded using two's complement :param width: If None, the minimal possible size (but at least 1), otherwise an integer of the byte width for the return value :return: A byte string rFTz%xg@r 0hexzint too big to convert)intmathceillenabsdecodeord OverflowError)valuesignedwidthis_negbitshex_stroutputpad_chars @/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/util.py int_to_bytesr/'s-$ A:%1* eaiFtyyTCJ%6!7#!=>BCDa4i(Q$Y7E, w??!DL! " "^F%;; rcZt|tk7ry|j|jk(S)z Compare two timezones :param other: The other timezone to compare to :return: A boolean F)typer9rBrEothers r.__eq__ztimezone.__eq__s&E{h&<<5==0 0rc2|j|jfS)z Called by tzinfo.__reduce__ to support pickle and copy. :return: offset and name, to be used for __init__ )rBrCrEs r.__getinitargs__ztimezone.__getinitargs__s<<+ +rc|jS)z :param dt: A datetime object; ignored. :return: Name of this timezone )rCrEdts r.tznameztimezone.tznames:: rc|jS)z :param dt: A datetime object; ignored. :return: A timedelta object with the offset from UTC )rBrRs r. utcoffsetztimezone.utcoffsets<< rctdS)z :param dt: A datetime object; ignored. :return: Zero timedelta rr rRs r.dstz timezone.dstsQ< rN) __name__ __module__ __qualname____doc__rHrMrPrTrVrYrr.r9r9vs%  <0 1 ,   rr9)r9c |n|r@|dkrt|dzj}n|j}|dzdk(r|dz }n|j}tj|dz xsd}|j |d|S)rrr rbig) byteorderr')r" bit_lengthrr to_bytes)r&r'r( bits_requireds r.r/r/s$ =19$' N$=$=$?M$)$4$4$6M 1$)!Q&M % 0 0 2 IIma/05AE~~euV~DDrc2tj|d|S)r1ra)r')r from_bytes)r&r's r.r7r7s~~eU6~::rc|y|jdzdz|jdzz}|dkrdnd}|dtt|dzzS)zC Format a timedelta into "[+-]HH:MM" format or "" for None r<r=r-+z %02d:%02d)daysr@divmodr")offminssigns r.rDrDsT  { 88b=2  r 1 1D(3D +s4y" 55 55rc"eZdZdZdZdZdZy) _UtcWithDstzK Utc class where dst does not return None; required for astimezone cy)Nr>r_rRs r.rTz_UtcWithDst.tznamesrctdSNrrXrRs r.rVz_UtcWithDst.utcoffset |rctdSrurXrRs r.rYz_UtcWithDst.dstrvrN)r[r\r]r^rTrVrYr_rr.rrrrsrrrcb t|}|S#t$rt|x}t|<Y|SwxYw)a Returns a new datetime.timezone object with the given offset. Uses cached objects if possible. :param offset: A datetime.timedelta object; It needs to be in full minutes and between -23:59 and +23:59. :return: A datetime.timezone object )_timezone_cacheKeyErrorr9)rFtzs r.create_timezoner|&sB8 V $ I 8'/'77_V $ I8s ..ceZdZdZdZedZedZedZdZ dZ dd Z d Z d Z d Zd ZdZdZdZdZdZy) extended_dateB A datetime.datetime-like object that represents the year 0. This is just to handle 0000-01-01 found in some certificates. Python's datetime does not support year 0. The proleptic gregorian calendar repeats itself every 400 years. Therefore, the simplest way to format is to substitute year 2000. cH|dk7r tdtd|||_y)z :param year: The integer 0 :param month: An integer from 1 to 12 :param day: An integer from 1 to 31 ryear must be 0N)r?r_y2k)rEyearmonthdays r.rHzextended_date.__init__Cs' 19-. .uc* rcyz4 :return: The integer 0 rr_rOs r.rzextended_date.yearTrc.|jjSz> :return: An integer from 1 to 12 rrrOs r.rzextended_date.month]yyrc.|jjSz> :return: An integer from 1 to 31 rrrOs r.rzextended_date.dayfyy}}rc|jj|}|jjdj|}djdt ||DS)z Formats the date using strftime() :param format: A strftime() format string :return: A str, the formatted date as a unicode string in Python 3 and a byte string in Python 2 rric38K|]\}}||fdk(rdn|yw)24rNr_.0c2c4s r. z)extended_date.strftime..%Y=Rr2h*4s"<=rstrftimereplacejoinziprEformaty2ky4ks r.rzextended_date.strftimeosVii  (iiT*33F;wwY3sTW=YYYrc$|jdS)z Formats the date as %Y-%m-%d :return: The date formatted to %Y-%m-%d as a unicode string in Python 3 and a byte string in Python 2 z 0000-%m-%drrOs r. isoformatzextended_date.isoformats}}\**rNc| |j}| |j}| |j}|dkDrt}nt}||||S)z Returns a new datetime.date or asn1crypto.util.extended_date object with the specified components replaced :return: A datetime.date or asn1crypto.util.extended_date object r)rrrrr~)rErrrclss r.rzextended_date.replacesU <99D =JJE ;((C !8CC     rc$|jdS)z_ :return: A str representing this extended_date, e.g. "0000-01-01" z%Y-%m-%drrOs r.__str__zextended_date.__str__s }}Z((rcXt||jsy|j|dk(S) Compare two extended_date objects :param other: The other extended_date to compare to :return: A boolean Fr) isinstance __class____cmp__rKs r.rMzextended_date.__eq__s)%0||E"a''rc&|j| S)rrMrKs r.__ne__zextended_date.__ne__;;u%%%rc>ttdt|)Nz An asn1crypto.util.extended_date object can only be compared to an asn1crypto.util.extended_date or datetime.date object, not %s  TypeErrorr rrKs r._comparison_errorzextended_date._comparison_errors%  e     rct|tryt||js|j||j|jkry|j|jkDryy)z Compare two extended_date or datetime.date objects :param other: The other extended_date object to compare to :return: An integer smaller than, equal to, or larger than 0 r r)rrrrrrKs r.rzextended_date.__cmp__sV eT "%0  " "5 ) 99uzz ! 99uzz !rc*|j|dkSrurrKs r.__lt__zextended_date.__lt__||E"Q&&rc*|j|dkSrurrKs r.__le__zextended_date.__le__||E"a''rc*|j|dkDSrurrKs r.__gt__zextended_date.__gt__rrc*|j|dk\SrurrKs r.__ge__zextended_date.__ge__rr)NNN)r[r\r]r^rHpropertyrrrrrrrrMrrrrrrrr_rr.r~r~9s+"Z$ + 6)( & 0'('(rr~c0eZdZdZdZdezZdZedZedZ edZ edZ ed Z ed Z ed Zed Zd ZdZdZdZd#dZd$dZdZdZdZdZdZdZdZdZdZdZdZ dZ!d Z"d!Z#e$d"Z%y)%extended_datetimeri:cL|dk7r tdtdg|i||_y)z :param year: The integer 0 :param args: Other positional arguments; see datetime.datetime. :param kwargs: Other keyword arguments; see datetime.datetime. rrrN)r?rrrErargskwargss r.rHzextended_datetime.__init__s- 19-. .T3D3F3 rcyrr_rOs r.rzextended_datetime.yearrrc.|jjSrrrOs r.rzextended_datetime.month"rrc.|jjSrrrOs r.rzextended_datetime.day+rrc.|jjS)z> :return: An integer from 1 to 24 )rhourrOs r.rzextended_datetime.hour4syy~~rc.|jjSz> :return: An integer from 1 to 60 )rminuterOs r.rzextended_datetime.minute=yyrc.|jjSr)rsecondrOs r.rzextended_datetime.secondFrrc.|jjS)zB :return: An integer from 0 to 999999 )r microsecondrOs r.rzextended_datetime.microsecondOsyy$$$rc.|jjS)zh :return: If object is timezone aware, a datetime.tzinfo object, else None. )rr rOs r.r zextended_datetime.tzinfoXrrc6|jjS)zk :return: If object is timezone aware, a datetime.timedelta object, else None. )rrVrOs r.rVzextended_datetime.utcoffsetas yy""$$rc6|jjS)z= :return: A datetime.time object )rtimerOs r.rzextended_datetime.timeis yy~~rcDtd|j|jS)zS :return: An asn1crypto.util.extended_date of the date r)r~rrrOs r.rzextended_datetime.dateqs Q DHH55rc|jj|}|jjdj|}djdt ||DS)z Performs strftime(), always returning a str :param format: A strftime() format string :return: A str of the formatted datetime rrric38K|]\}}||fdk(rdn|ywrr_rs r.rz-extended_datetime.strftime..rrrrs r.rzextended_datetime.strftimeysVii  (iiT*33F;wwY3sTW=YYYrcd|j|j||j|j|jfz}|j r|d|j zz }|t |jzS)aj Formats the date as "%Y-%m-%d %H:%M:%S" with the sep param between the date and time portions :param set: A single character of the separator to place between the date and time :return: The formatted datetime as a unicode string in Python 3 and a byte string in Python 2 z0000-%02d-%02d%c%02d:%02d:%02dz.%06d)rrrrrrrDrV)rEsepss r.rzextended_datetime.isoformatsj - DHHc499VZVaVacgcncn/o o    4+++ +A>$.."2333rNc|r |jj|g|i|Stj|jjdg|i|S)a Returns a new datetime.datetime or asn1crypto.util.extended_datetime object with the specified components replaced :param year: The new year to substitute. None to keep it. :param args: Other positional arguments; see datetime.datetime.replace. :param kwargs: Other keyword arguments; see datetime.datetime.replace. :return: A datetime.datetime or asn1crypto.util.extended_datetime object r)rrrfrom_y2krs r.rzextended_datetime.replacesU$ $499$$T;D;F; ; ))*;$))*;*;D*R4*R6*RSSrc^tj|jj|S)z Convert this extended_datetime to another timezone. :param tz: A datetime.tzinfo object. :return: A new extended_datetime or datetime.datetime object )rrr astimezone)rEr{s r.rzextended_datetime.astimezones$!))$))*>*>r*BCCrcV|jj|jdzz S)z Return POSIX timestamp. Only supported in python >= 3.3 :return: A float representing the seconds since 1970-01-01 UTC. This will be a negative value. iQ)r timestampDAYS_IN_2000_YEARSrOs r.rzextended_datetime.timestamps'yy""$t'>'>'FFFrc&|jdS)zy :return: A str representing this extended_datetime, e.g. "0000-01-01 00:00:00.000001-10:00"  )r)rrOs r.rzextended_datetime.__str__s ~~#~&&rct||jtfsy|jdu|jduk7ry|j |dk(S) Compare two extended_datetime objects :param other: The other extended_datetime to compare to :return: A boolean FNr)rrrr rrKs r.rMzextended_datetime.__eq__sM%$..(!;< KK4 U\\T%9 :||E"a''rc&|j| S)rrrKs r.rzextended_datetime.__ne__rrc>ttdt|)z Raises a TypeError about the other object not being suitable for comparison :param other: The object being compared to z An asn1crypto.util.extended_datetime object can only be compared to an asn1crypto.util.extended_datetime or datetime.datetime object, not %s rrKs r.rz#extended_datetime._comparison_errors'  e     rct||jtfs|j||jdu|jduk7r t d||z }t d}||kry||kDryy)a Compare two extended_datetime or datetime.datetime objects :param other: The other extended_datetime or datetime.datetime object to compare to :return: An integer smaller than, equal to, or larger than 0 Nz5can't compare offset-naive and offset-aware datetimesrrr )rrrrr rr )rErLdiffzeros r.rzextended_datetime.__cmp__st%$..(!;<  " "5 ) KK4 U\\T%9 :ST Te|| $; $;rc*|j|dkSrurrKs r.rzextended_datetime.__lt__ rrc*|j|dkSrurrKs r.rzextended_datetime.__le__#rrc*|j|dkDSrurrKs r.rzextended_datetime.__gt__&rrc*|j|dk\SrurrKs r.rzextended_datetime.__ge__)rrcFtj|j|zS)z Adds a timedelta :param other: A datetime.timedelta object to add. :return: A new extended_datetime or datetime.datetime object. )rrrrKs r.__add__zextended_datetime.__add__,s!))$))e*;<rs SR 66(%<<7+++t0d:W 6W rIaL)HL "E>;" 6 & } &~(F~(Bt t r__pycache__/version.cpython-312.pyc000064400000000557152572326550013167 0ustar00 ui$ddlmZmZmZmZdZdZy))unicode_literalsdivisionabsolute_importprint_functionz1.5.1)rN) __future__rrrr __version____version_info__C/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/version.pyrsRR r __pycache__/x509.cpython-312.pyc000064400000320115152572326550012202 0ustar00 uiRn dZddlmZmZmZmZddlmZddlm Z ddl Z ddl Z ddl Z ddl Z ddlZddlZddlmZddlmZmZdd lmZdd lmZmZmZdd lmZmZmZmZdd l m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>ddl?m@Z@mAZAmBZBmCZCGdde*ZDGdde*ZEGdde*ZFGdde0ZGGdde3ZHGdde4ZIGdde"ZJGdde3ZKGdd e7ZLed!ZMGd"d#e%ZNGd$d%e.ZOGd&d'e3ZPGd(d)e6ZQGd*d+e4ZRGd,d-e%ZSGd.d/e3ZTGd0d1e%ZUGd2d3e%ZVGd4d5e%ZWGd6d7e5ZXGd8d9e5ZYGd:d;e4ZZGd<d=e4Z[Gd>d?e3Z\Gd@dAe3Z]GdBdCe4Z^GdDdEe3Z_GdFdGe4Z`GdHdIe%ZaGdJdKe%ZbGdLdMe5ZcGdNdOe4ZdGdPdQe5ZeGdRdSe3ZfGdTdUe6ZgGdVdWe3ZhGdXdYe%ZiGdZd[e+ZjGd\d]e+ZkGd^d_e3ZlGd`dae4ZmGdbdce3ZnGdddee3ZoGdfdge%ZpGdhdie4ZqGdjdke%ZrGdldme3ZsGdndoe3ZtGdpdqe3ZuGdrdse%ZvGdtdue"ZwGdvdwe3ZxGdxdye4ZyGdzd{e3ZzGd|d}e3Z{Gd~de4Z|Gdde%Z}Gdde4Z~Gdde3ZGdde3ZGdde.ZGdde3ZGdde4ZGdde.ZGdde3ZGdde4ZGdde3ZGdde4ZGdde3ZGdde.ZGdde4ZGdde.ZGdde3ZGdde4ZGdde4ZGdde4ZGdde3ZGdde"ZGdde+ZGdde3ZGdde6ZGdde3ZGdde3ZGdde6ZGdde'ZGdde'ZGdde'ZGdde'ZGdde'ZGd„de'ZGdĄde3ZGdƄde3ZGdȄde'ZGdʄde3ZGd̄de3ZGd΄de6ZGdЄde.ZGd҄de6ZGdԄde6ZGdքde6ZGd؄de3ZGdڄde6ZGd܄de3ZGdބde4ZGdde.ZGdde3ZGdde4ZGdde3ZGdde3ZGdde4ZGdde4ZGdde3ZGdde&Zy)z ASN.1 type classes for X.509 certificates. Exports the following items: - Attributes() - Certificate() - Extensions() - GeneralName() - GeneralNames() - Name() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_function)contextmanager)idnaN)unwrap) iri_to_uri uri_to_iri) OrderedDict) type_namestr_cls bytes_to_list)AlgorithmIdentifierAnyAlgorithmIdentifierDigestAlgorithmSignedDigestAlgorithm)Any BitString BMPStringBooleanChoiceConcat EnumeratedGeneralizedTime GeneralString IA5StringIntegerNull NumericStringObjectIdentifierOctetBitString OctetStringParsableOctetStringPrintableStringSequence SequenceOfSetSetOf TeletexStringUniversalStringUTCTime UTF8String VisibleStringVOID) PublicKeyInfo) int_to_bytesint_from_bytes inet_ntop inet_ptonc&eZdZdZdZdZdZdZy)DNSNamer c||k( SNselfothers @/opt/nydus/tmp/pip-target-dhtdbchl/lib/python/asn1crypto/x509.py__ne__zDNSName.__ne__L5=  ct|tsy|jj|jjk(S)z Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2 :param other: Another DNSName object :return: A boolean F) isinstancer7 __unicode__lowerr>s rA__eq__zDNSName.__eq__Os@%)!'')U->->-@-F-F-HHHrDc ht|ts(ttdt |t ||j dr"d|ddj |jz}n|j |j}||_||_ d|_ |jdk7rd|_ yy)zd Sets the value of the DNS name :param value: A unicode string K %s value must be a unicode string, not %s ..r NrD) rFr TypeErrorr r startswithencode _encoding_unicodecontents_header_trailer)r?value encoded_values rAsetz DNSName.set_s%)F$%     C  59#3#3DNN#CCM!LL8M %  ==C DM rDN)__name__ __module__ __qualname__rQ_bad_tagrBrIrXr=rDrAr7r7GsIH!I  rDr7c$eZdZdZdZdZdZy)URIc t|ts(ttdt |t |||_t ||_d|_|jdk7rd|_ yy)b Sets the value of the string :param value: A unicode string rKNrD) rFrrNr rrRr rSrTrUr?rVs rArXzURI.set~sl%)F$%   "5)  ==C DM rDc||k( Sr<r=r>s rArBz URI.__ne__rCrDc~t|tsyt|jdt|jdk(S)z Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4 :param other: Another URI object :return: A boolean FT)rFr^r nativer>s rArIz URI.__eq__s2%%$++t, 5<<0NNNrDc|jy|jt|j|_|jS7 :return: A unicode string )rSrRr _merge_chunksr?s rArGzURI.__unicode__s: ==  == &t'9'9';|j|j}|jddk(r"|jd|_|jS|j dd\}}|jddz|jdz|_|jS)rgrurscp1252r rrr)rRrirvdecoderw)r?rSrxrys rArGzEmailAddress.__unicode__s == ))+H}}T"b( ( 9 }}%-OOD!$<! 'x 83 >QWAX X }}rDc||k( Sr<r=r>s rArBzEmailAddress.__ne__rCrDc8t|tsy|js|j|j|js|j|j|j j ddk(s|j j ddk(r|j |j k(S|j jdd\}}|j jdd\}}||k7ry|j|jk7ryy)z Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5 :param other: Another EmailAddress object :return: A boolean Frursr T) rFrlrprXrdrnrvrwrH)r?r@ other_mailboxother_hostnamerxrys rArIzEmailAddress.__eq__s%. HHT[[ !  IIell # >>  t $ *eoo.B.B4.HB.N>>U__4 4(-(>(>tQ(G% ~ NN11$: m # >> ~335 5rD) rYrZr[rnrpr\propertyrSsetterrXrGrBrIr=rDrArlrlsSIKH __ <"!rDrlc6eZdZddZdZedZdZdZy) IPAddressNc*ttd)z? This method is not applicable to IP addresses z= IP address values can not be parsed ) ValueErrorr )r?spec spec_paramss rAparsezIPAddress.parse's     rDc \t|ts(ttdt |t ||}|j ddk7}d}|rH|j dd}|d}t|d}|dkrttdt ||j ddk7r6tj}|dkDrttd t |d}n5tj}|d kDrttd t |d }d }|rEd |z} | d|t| z zz } tt| d}d|dzt|z z|z}||_t|||z|_|j |_d|_|j&d k7rd |_yy)z Sets the value of the object :param value: A unicode string containing an IPv4 address, IPv4 address with CIDR, an IPv6 address or IPv6 address with CIDR rK/rsrr zT %s value contains a CIDR range less than 0 :z %s value contains a CIDR range bigger than 128, the maximum value for an IPv6 address z %s value contains a CIDR range bigger than 32, the maximum value for an IPv4 address rD10N)rFrrNr rrvsplitintrsocketAF_INET6AF_INETlenr2_nativer5rS_bytesrTrU) r?rVoriginal_valuehas_cidrcidrpartsfamily cidr_size cidr_bytes cidr_masks rArXz IPAddress.set2s%)F$%  ::c?b( KKQ'E!HEuQx=Dax dO " ::c?b __Fcz dO "I^^Fby dO "I d I  C N :; ;I%c)Q&78J!i1nJ%GHJVJ% !&%0:= mm  ==C DM rDc|jy|j|j}t|}d}d}|t ddgvr1t t j|dd}|dkDrNt|dd}n?|t ddgvr0t t j|dd}|dkDrt|dd}|?HS!Q[(!&..+a2BCa<-k!"o>H##NN84 9++C01 gdm3 DL||rDc||k( Sr<r=r>s rArBzIPAddress.__ne__rCrDcft|tsy|j|jk(S)zl :param other: Another IPAddress object :return: A boolean F)rFrrr>s rArIzIPAddress.__eq__s*%+~~5??#444rD)NN) rYrZr[rrXrrdrBrIr=rDrArr&s,  E N>! 5rDrc"eZdZdefdedeifgZy) AttributetypevaluesrN)rYrZr[r"r*r_fieldsr=rDrArrs !" 563-(GrDrceZdZeZy) AttributesN)rYrZr[r _child_specr=rDrArrKrDrc $eZdZddddddddd d Zy ) KeyUsagedigital_signaturenon_repudiationkey_enciphermentdata_encipherment key_agreement key_cert_signcrl_sign encipher_only decipher_only rr rrrNrYrZr[_mapr=rDrArrs$          DrDrc,eZdZdedddfdedddfgZy)PrivateKeyUsagePeriod not_beforerTimplicitoptional not_afterr N)rYrZr[rrr=rDrArrs' QD(IJ oA4'HIGrDrceZdZdZdZdZy)NotReallyTeletexStringa6 OpenSSL (and probably some other libraries) puts ISO-8859-1 into TeletexString instead of ITU T.61. We use Windows-1252 when decoding since it is a superset of ISO-8859-1, and less likely to cause encoding issues, but we stay strict with encoding to prevent us from creating bad data. r{c|jy|j.|jj|j|_|jSrf)rSrRrir|_decoding_encodingrjs rArGz"NotReallyTeletexString.__unicode__sF ==  ==  ..0778O8OPDM}}rDN)rYrZr[__doc__rrGr=rDrArrs" rDrc#bK dt_ddt_y#dt_wxYww)Nteletexr{)rrr=rDrAstrict_teletexrs)=4=1 4<1H1s/ / ,/c4eZdZdefdefdefdefdefdefgZ y)DirectoryStringteletex_stringprintable_stringuniversal_string utf8_string bmp_string ia5_stringN) rYrZr[rr&r,r.rr _alternativesr=rDrArrs: 12 _- _-  # y! y!MrDrceZdZiddddddddd d d d d ddddddddddddddddddd d!d"id#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDZgdEZedFZedGZyH)INameTypez2.5.4.3 common_namez2.5.4.4surnamez2.5.4.5 serial_numberz2.5.4.6 country_namez2.5.4.7 locality_namez2.5.4.8state_or_province_namez2.5.4.9street_addressz2.5.4.10organization_namez2.5.4.11organizational_unit_namez2.5.4.12titlez2.5.4.15business_categoryz2.5.4.17 postal_codez2.5.4.20telephone_numberz2.5.4.41namez2.5.4.42 given_namez2.5.4.43initialsz2.5.4.44generation_qualifierz2.5.4.45unique_identifierz2.5.4.46 dn_qualifierz2.5.4.65 pseudonymz2.5.4.97organization_identifierz 2.23.133.2.1tpm_manufacturerz 2.23.133.2.2 tpm_modelz 2.23.133.2.3 tpm_versionz 2.23.133.2.4platform_manufacturerz 2.23.133.2.5platform_modelz 2.23.133.2.6platform_versionz1.2.840.113549.1.9.1 email_addressz1.3.6.1.4.1.311.60.2.1.1incorporation_localityz1.3.6.1.4.1.311.60.2.1.2incorporation_state_or_provincez1.3.6.1.4.1.311.60.2.1.3incorporation_countryz0.9.2342.19200300.100.1.1user_idz0.9.2342.19200300.100.1.25domain_componentz0.2.262.1.10.7.20name_distinguisher)!rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrc|j|}||jvr|jj|}||fSt|j}||fS)z Returns an ordering value for a particular attribute key. Unrecognized attributes and OIDs will be sorted lexically at the end. :return: An orderable value. )mappreferred_orderindexr)cls attr_nameordinals rApreferred_ordinalzNameType.preferred_ordinalKs`GGI& ++ +))// :G###--.G##rDciddddddddd d d d d ddddddddddddddddddd d!d"id#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDj|j|jS)EzZ :return: A human-friendly unicode string to display to users rz Common NamerSurnamerz Serial NumberrCountryrLocalityrzState/ProvincerzStreet Addressr OrganizationrzOrganizational UnitrTitlerzBusiness Categoryrz Postal CoderzTelephone NumberrNamerz Given NamerInitialsrzGeneration QualifierrzUnique Identifierrz DN Qualifierr Pseudonymrz Email AddressrzIncorporation LocalityrzIncorporation State/ProvincerzIncorporation CountryrzDomain ComponentrzName DistinguisherrzOrganization IdentifierrzTPM Manufacturerrz TPM Modelrz TPM VersionrzPlatform ManufacturerrzPlatform ModelrzPlatform VersionrzUser ID)getrdrjs rAhuman_friendlyzNameType.human_friendly_s# =# y#  _#  I # Z # %&6 #  .#  #  '(=#  W#  !4#  =#   2#  F#  ,#  !# " #$:## $ !4%# & N'# ( )# * _+# , %&>-# . ./M/# 0 $%<1# 2  23# 4 !"65# 6 &'@7# 8  29# : ;# < ==# > $% )  ? )  + )  #)  ')  .)  G)  ')  M)  &)  F)  L)  J!) " *#) $ '%) & N') ( K)) * -+) . */) 0  1) 2  3) 4 /5) 6 (7) 8 *9) < =) @ #$s rArBzNameTypeAndValue.__ne__rCrDct|tsy|dj|djk7ry|j|jk(S)z Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1 :param other: Another NameTypeAndValue object :return: A boolean Fr)rFrrdr!r>s rArIzNameTypeAndValue.__eq__sH%!12 =  4<#6#6 6""d&8&888rDc"tjdd|}tjdd|}tjdk(rtjdd|}ntjdd|}tjdd|}|j d d}tjd d|}dj t tj|}tjd |}|D]}tj|rttd tj|rttd tj|rttdtj |rttdtj"|rttd|dk(sttdd}d}|D]2}tj$|rd}tj&|s1d}4|rJtj$|d}tj$|d}|s|r|sttddtjdd|j)zdz}|S)a" Implements the internationalized string preparation algorithm from RFC 4518. https://tools.ietf.org/html/rfc4518#section-2 :param string: A unicode string to prepare :return: A prepared unicode string, ready for comparison u[­᠆͏᠋-᠍️-＀]+rhu [ …] iu[-]|[-]|󠀁u[𝅳-𝅺󠀠-󠁿󠀁]u?[---„†-Ÿ۝܏᠎‌-‏‪-‮⁠-⁣--]+u​u[   - 
-
  　]NFKCzc X.509 Name objects may not contain unassigned code points z X.509 Name objects may not contain change display or zzzzdeprecated characters zc X.509 Name objects may not contain private use characters zf X.509 Name objects may not contain non-character code points zb X.509 Name objects may not contain surrogate code points u�zf X.509 Name objects may not contain the replacement character FTrrsz{ X.509 Name object contains a malformed bidirectional sequence z +z )resubsys maxunicodereplacejoinr stringprep map_table_b2 unicodedata normalize in_table_a1rr in_table_c8 in_table_c3 in_table_c4 in_table_c5 in_table_d1 in_table_d2strip)r?stringcharhas_r_and_al_cat has_l_catfirst_is_r_and_allast_is_r_and_als rAr z"NameTypeAndValue._ldap_string_prepsOQSU[\@#vN >>V #VVTVXZ`aFVVTVXZ`aF K     "-TVY[abZ44f=>&&vv6D%%d+ " %%d+ "%%d+ " %%d+ " %%d+ " x "M\! D%%d+#' ''-   * 6 6vay A )55fRjA  19I "rvvdD&17799C? rD)rYrZr[rrr _oid_pairrr&r#rlr7r. _oid_specsrrr!rBrIr r=rDrArrs  #G "I%%?% %  %  % !/ % /% _% #O% % _% % O% % o% O!%" #%$ ^%%& '%( _)%, -%0 !/1%2 *?3%4 5%6 G7%8 o9%: "?;%< J=%> Z?%@ zA%B C%D *E%F JG%H ?I%JNH   !9&jrDrc8eZdZeZedZdZdZdZ dZ y)RelativeDistinguishedNamecg}|j|}t|jD]}|j|d||dj |S)b :return: A unicode string that can be used as a dict key or in a set : ) _get_valuessortedkeysappendr,)r?outputrkeys rAhashablez"RelativeDistinguishedName.hashablePsT!!$'&++-(C MMc6#;7 8) {{6""rDc||k( Sr<r=r>s rArBz RelativeDistinguishedName.__ne__`rCrDct|tsyt|t|k7ry|j|}|j|}||k7ry|j |}|j |}|D]}||||k7syy)z Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1 :param other: Another RelativeDistinguishedName object :return: A boolean FT)rFrBr _get_typesrG)r?r@ self_types other_types self_values other_values type_name_s rArIz RelativeDistinguishedName.__eq__cs%!:; t9E "__T* ooe,  $&&t, ''. $J:&,z*BB%rDcXt|Dcgc]}|djc}Scc}w)z Returns a set of types contained in an RDN :param rdn: A RelativeDistinguishedName object :return: A set object with unicode strings of NameTypeAndValue type field values r)rXrd)r?rdnntvs rArPz$RelativeDistinguishedName._get_typess+#6#3CK&&#6776s'ci}|Dcgc]-}|j|dj|jfg/c}|Scc}w)a$ Returns a dict of prepped values contained in an RDN :param rdn: A RelativeDistinguishedName object :return: A dict object with unicode strings of NameTypeAndValue value field values that have been prepped for comparison r)updaterdr!)r?rWrKrXs rArGz%RelativeDistinguishedName._get_valuessGMPQScV++S->->?@ ASQ  Rs2>N) rYrZr[rrrrMrBrIrPrGr=rDrArBrBMs."K  # #!@ 8rDrBc,eZdZeZedZdZdZy) RDNSequencec2djd|DS)rDc34K|]}|jywr<)rM).0rWs rA z'RDNSequence.hashable..s84C3<<4s)r,rjs rArMzRDNSequence.hashables{{84888rDc||k( Sr<r=r>s rArBzRDNSequence.__ne__rCrDct|tsyt|t|k7ryt|D]\}}|||k7syy)z Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1 :param other: Another RDNSequence object :return: A boolean FT)rFr\r enumerate)r?r@r self_rdns rArIzRDNSequence.__eq__sJ%- t9E "(OE8U|x' /rDN) rYrZr[rBrrrMrBrIr=rDrAr\r\s#+K  9 9!rDr\ceZdZdefgZdZdZdZed dZ e dZ dZ dZ dZe dZe d Zd Ze d Ze d Zy)rrhNc g}|s d}t}nd}t}tt|j d}|j D]\}}t j |}|dk(r t|}nJ|dk(r t|}n9|tgdvrtdt|}nt|||}|jtt||d g|d t|S) aY Creates a Name object from a dict of unicode string keys and values. The keys should be from NameType._map, or a dotted-integer OID unicode string. :param name_dict: A dict of name information, e.g. {"common_name": "Will Bond", "country_name": "US", "organization_name": "Codex Non Sufficit LC"} :param use_printable: A bool - if PrintableString should be used for encoding instead of UTF8String. This is for backwards compatibility with old software. :return: An x509.Name object rrc2tj|dS)Nr)rr)items rAzName.build..s!;!;DG!DrD)rLrr)rrr)rrVrrh)r.r&r rHitemsrrrlr7rXrrJrBrr\) r  name_dict use_printablerdns encoding_nameencoding_classattribute_nameattribute_valuerVs rAbuildz Name.builds &)M'N.M,N !D  09/@ +NO%\\.9N0$_5#5503'X#YY'+)/: (&(9 KK1 *""3 #0A0+d"344rDc.|jjS)rD)chosenrMrjs rArMz Name.hashables{{###rDc,t|jSr<)rrurjs rA__len__z Name.__len__s4;;rDc||k( Sr<r=r>s rArBz Name.__ne__rCrDcVt|tsy|j|jk(S)z Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1 :param other: Another Name object :return: A boolean F)rFrrur>s rArIz Name.__eq__!s$%&{{ell**rDcj|jt|_|jjD]t}|D]m}|d}||jvrF|j|}t |t s|gx}|j|<|j |d\|d|j|<ov|jS)NrrV)rr rurdrFlistrJ)r?rWtype_val field_nameexistings rArdz Name.native0s << &=DL{{)) #H!)&!1J!T\\1#'<< #;)(D9CK*LHt||J'? (9:3;G3D Z0!$*||rDc:|jt}d}|jD]G}|D]@}|dj}|}||vr!||g||<||j |d9|d||<BIg}|j }|dk(rt t|}|D].}||} |j| } |j |d| 0d} |D]} | jddk7sd } n| sd nd } | j|ddd|_|jS) zg :return: A human-friendly unicode string containing the parts of the name NrrVrrEF,rsT, z; ) _human_friendlyr rurrJrIreversedr{_recursive_humanizervr,)r?data last_fieldrWr|r}to_joinrIrLrV native_value has_commaelement separators rArzName.human_friendly@s@    '=DJ{{ #H!)&!1!@!@J!+J!T),0,<+=Z(Z(//0AB+3G+<Z(!$#G99;DY&T +S #77> 3 => I"<<$* $I# %.4I#,>>'$B$-#@D ###rDc t|tr7djt|Dcgc]}|j |c}S|j Scc}w)z Recursively serializes data compiled from the RDNSequence :param value: An Asn1Value object, or a list of Asn1Value objects :return: A unicode string r)rFr{r,rrrd)r?rV sub_values rArzName._recursive_humanizegsS eT "99uUu)$229=uUV ||VsA c|j6tj|jj |_|jS)zZ :return: The SHA1 hash of the DER-encoded bytes of this name _sha1hashlibsha1dumpdigestrjs rArz Name.sha1x7 ::  diik299;DJzzrDc|j6tj|jj |_|jS)z] :return: The SHA-256 hash of the DER-encoded bytes of this name _sha256rsha256rrrjs rArz Name.sha256s7 << ">>$))+6==?DL||rD)F)rYrZr[r\rrrrrrsrrMrwrBrIrdrrrrr=rDrArrs [MO EG:5:5x$$ ! +  $$$$L"rDrc"eZdZdefdeddifgZy) AnotherNametype_idrVexplicitrN)rYrZr[r"rrr=rDrArrs $% # A'GrDrc$eZdZdZdZdefdefgZy) CountryNamer x121_dcc_codeiso_3166_alpha2_codeNrYrZr[class_tagr!r&rr=rDrArrs% F C -( 1MrDrc$eZdZdZdZdefdefgZy)AdministrationDomainNamer rnumeric printableNrr=rDrArrs% F C M" o&MrDrceZdZdefdefgZy)PrivateDomainNamerrNrYrZr[r!r&rr=rDrArrs M" o&MrDrcFeZdZdeddifdedddfded ddfd ed ddfgZy ) PersonalNamerrrrr TrrrrrNrYrZr[r&rr=rDrArrsD Oj!_5 QD(IJ _1$&GH qd2ST GrDrcFeZdZdeddifdedddfded ddfd ed ddfgZy ) TeletexPersonalNamerrrrr TrrrrrNrYrZr[r+rr=rDrArrsD MJ?3 }1$&GH ]$EF QD0QR GrDrceZdZeZy)OrganizationalUnitNamesNrYrZr[r&rr=rDrArr!KrDrceZdZeZy)TeletexOrganizationalUnitNamesN)rYrZr[r+rr=rDrArrKrDrc eZdZdeddifdeddifdedddfded ddfd ed dd fd edddfdedddfdedddfde dddfg Z y)BuiltInStandardAttributesrrTadministration_domain_namenetwork_addressrrterminal_identifierr private_domain_namerrrrrnumeric_user_identifierr personal_namerorganizational_unit_namesrN) rYrZr[rrr!r&rrrrr=rDrArrs z4&89 %'?*dAST Mt+LM aT1RS  1t3TU oA4/PQ "Mt3TU ,QD(IJ $&=A[_?`a GrDrceZdZdefdefgZy)BuiltInDomainDefinedAttributerrVNrr=rDrArrs ! /"GrDrceZdZeZy)BuiltInDomainDefinedAttributesN)rYrZr[rrr=rDrArr/KrDrceZdZdefdefgZy)TeletexDomainDefinedAttributerrVNrr=rDrArrs  - GrDrceZdZeZy)TeletexDomainDefinedAttributesN)rYrZr[rrr=rDrArrrrDrceZdZdefdefgZy)PhysicalDeliveryCountryNamerrNrr=rDrArrs -( 1MrDrceZdZdefdefgZy) PostalCode numeric_codeprintable_codeNrr=rDrArrs ' ?+MrDrc(eZdZdeddifdeddifgZy) PDSParameterrrTrN)rYrZr[r&r+rr=rDrArrs' _z4.@A =:t*<=GrDrceZdZeZy)PrintableAddressNrr=rDrArrrrDrc(eZdZdeddifdeddifgZy)UnformattedPostalAddressprintable_addressrTrN)rYrZr[rr+rr=rDrArrs( .T0BC =:t*<=GrDrc*eZdZdeddifdedddfgZy) E1634Addressnumberrr sub_addressr TrN)rYrZr[r!rr=rDrArrs& =:q/2  A4'HIGrDrceZdZeZy) NAddressesN)rYrZr[r$rr=rDrArrKrDrcFeZdZdedddfdedddfdedddfd ed d ifgZy ) PresentationAddress p_selectorrTr s_selectorr t_selectorr n_addressesrrN)rYrZr[r$rrr=rDrArrsD {$EF {$EF {$EF  ZO4 GrDrc"eZdZdefdeddifgZy)ExtendedNetworkAddresse163_4_address psap_addressrrN)rYrZr[rrrr=rDrArr#s <( ,z1o>MrDrceZdZdddddddZy) TerminalTypetelexr g3_facsimile g4_facsimile ia5_terminalvideotex)rrrrrrNrr=rDrArr*s        DrDrceZdZiddddddddd d d d d ddddddddddddddddddd d!d"d#d$d%d&d'd(d)Zy*)+ExtensionAttributeTyper rrteletex_common_namerteletex_organization_namerteletex_personal_namerteletex_organization_unit_namesr!teletex_domain_defined_attributesrpds_namerphysical_delivery_country_name r physical_delivery_office_name physical_delivery_office_numberr9extension_of_address_components physical_delivery_personal_name#physical_delivery_organization_name.extension_physical_delivery_address_componentsrunformatted_postal_addressrpost_office_box_addressposte_restante_addressunique_postal_namelocal_postal_attributesextended_network_address terminal_type)r:Nrr=rDrArr5s  =    &  "   ,   .   :  +  =  +  -  -  -  1  <  (! " # $ & $ % & / DrDrceZdZdeddifdeddifgZdZided ed ed e d e d e dede de dedededededededeeeeeeedZy)ExtensionAttributeextension_attribute_typerrextension_attribute_valuerr )rrrrrrrrrrrrrrrrrrr)rr r r r r N)rYrZr[rrrr?r&r+rrrrrrrrrr@r=rDrArrQs #%;j!_M $cJ?;G JI} $] !4  *+I  ,-K  O )*E z ( *< *< *< .| 9, %&>!" ,#$$0".*#/$:%/JrDrceZdZeZy)ExtensionAttributesN)rYrZr[rrr=rDrArrs$KrDrc.eZdZdefdeddifdeddifgZy) ORAddressbuilt_in_standard_attributes"built_in_domain_defined_attributesrTextension_attributesN)rYrZr[rrrrr=rDrArrws4 ')BC -/MPZ\`Oab !4z46HIGrDrc*eZdZdedddfdeddifgZy) EDIPartyName name_assignerrTr party_namerr N)rYrZr[rrr=rDrAr r s& /t+LM Q8GrDr c eZdZdeddifdeddifdeddifdedd ifd ed d ifd eddifde ddifde ddifde ddifg Z dZ dZy) GeneralName other_namerr rfc822_namer dns_namer x400_addressrdirectory_namerredi_party_nameruniform_resource_identifierr ip_addressr registered_idrc||k( Sr<r=r>s rArBzGeneralName.__ne__rCrDc|jdvrttd|j|jdvrttd|j|j|jk7ry|j|jk(S)z Does not support other_name, x400_address or edi_party_name :param other: The other GeneralName to compare to :return: A boolean )r%r(r*zr Comparison is not supported for GeneralName objects of choice %s za Comparison is not supported for GeneralName objects of choice %sF)rrr rur>s rArIzGeneralName.__eq__s 99H HV   ::I IV   99 "{{ell**rDN)rYrZr[rrlr7rrr r^rr"rrBrIr=rDrAr$r$s {ZO4  z1o6 Wz1o. ZO4 4*a1 <*a9 &j!_= y:q/2 *ZO< M!+rDr$ceZdZeZy) GeneralNamesN)rYrZr[r$rr=rDrAr1r1rrDr1ceZdZdefdefgZy)Timeutc_time general_timeN)rYrZr[r-rrr=rDrAr3r3s W )MrDr3ceZdZdefdefgZy)ValidityrrN)rYrZr[r3rr=rDrAr7r7s t dGrDr7c(eZdZdeddifdeddifgZy)BasicConstraintscadefaultFpath_len_constraintrTN)rYrZr[rrrr=rDrAr9r9s' wE*+ *d);<GrDr9c:eZdZdedddfdedddfdedddfgZy ) AuthorityKeyIdentifierkey_identifierrTrauthority_cert_issuerr authority_cert_serial_numberrN)rYrZr[r$r1rrr=rDrAr>r>s6 ;QD(IJ ,QD0QR 'qd2STGrDr>c(eZdZdeddifdeddifgZy)DistributionPointName full_namerrname_relative_to_crl_issuerr N)rYrZr[r1rBrr=rDrArCrCs' lZO4 &(AJPQ?SMrDrCc $eZdZddddddddd d Zy ) ReasonFlagsunusedkey_compromise ca_compromiseaffiliation_changed supersededcessation_of_operationcertificate_holdprivilege_withdrawn aa_compromiserNrr=rDrArGrGs$     #   DrDrGc2eZdZdefdedddfdedddfgZy ) GeneralSubtreebaseminimumrrr;maximumr TrN)rYrZr[r$rrr=rDrArRrRs/  G!:; G!>?GrDrRceZdZeZy)GeneralSubtreesN)rYrZr[rRrr=rDrArXrXs KrDrXc,eZdZdedddfdedddfgZy)NameConstraintspermitted_subtreesrTrexcluded_subtreesr N)rYrZr[rXrr=rDrArZrZs' QD0QR oA4/PQGrDrZcNeZdZdedddfdedddfded ddfgZd Zed Z y ) DistributionPointdistribution_pointrTrreasonsr r crl_issuerrFcT|jdurd|_|d}|jdk7rttd|jD]Q}|jdk(s|j }|j jds?||_|jS|jS)z_ :return: None or a unicode string of the distribution point's URL FNr_rDz CRL distribution points that are relative to the issuer are not supported r+zhttp://zhttps://zldap://zldaps://)_urlrrr rurdrHrO)r?r general_nameurls rArfzDistributionPoint.url s 99 DI,-DyyK' "!% $$(EE&--Cyy{--.\]$' yy!,yyrDN) rYrZr[rCrGr1rrdrrfr=rDrAr^r^sQ 41RV6WX KaT!BC |!%FGG D rDr^ceZdZeZy)CRLDistributionPointsN)rYrZr[r^rr=rDrArhrh&#KrDrhc(eZdZdefdefdefdefgZy) DisplayTextrvisible_stringrrN)rYrZr[rr/rr.rr=rDrArkrk*s) y! =) y!  # MrDrkceZdZeZy) NoticeNumbersNrYrZr[rrr=rDrArnrn3KrDrnceZdZdefdefgZy)NoticeReference organizationnotice_numbersN)rYrZr[rkrnrr=rDrArrrr7s % =)GrDrrc(eZdZdeddifdeddifgZy) UserNotice notice_refrT explicit_textN)rYrZr[rrrkrr=rDrArvrv>s' T(:; + D'9:GrDrvceZdZdddZy)PolicyQualifierId certification_practice_statement user_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2Nrr=rDrArzrzEs?* DrDrzc*eZdZdefdefgZdZeedZ y)PolicyQualifierInfopolicy_qualifier_id qualifier)rr)r{r|N) rYrZr[rzrrr?rrvr@r=rDrAr~r~Ls.  12 cG 5I,5!JrDr~ceZdZeZy)PolicyQualifierInfosN)rYrZr[r~rr=rDrArrY%KrDrceZdZddiZy)PolicyIdentifierz 2.5.29.32.0 any_policyNrr=rDrArr]s| DrDrc"eZdZdefdeddifgZy)PolicyInformationpolicy_identifierpolicy_qualifiersrTN)rYrZr[rrrr=rDrArrcs" ./ 2Z4FGGrDrceZdZeZy)CertificatePoliciesN)rYrZr[rrr=rDrArrjrirDrceZdZdefdefgZy) PolicyMappingissuer_domain_policysubject_domain_policyN)rYrZr[rrr=rDrArrns !12 "23GrDrceZdZeZy)PolicyMappingsN)rYrZr[rrr=rDrArrurrDrc,eZdZdedddfdedddfgZy)PolicyConstraintsrequire_explicit_policyrTrinhibit_policy_mappingr NrYrZr[rrr=rDrArrys' "G!-NO !7,MNGrDrceZdZiddddddddd d d d d ddddddddddddddddddd d!d"id#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDidEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfidgdhdidjdkdldmdndodpdqdrdsdtdudvdwdxdydzd{d|d}d~ddddddddddiddddddddddddddddddddddddddddddddddZy) KeyPurposeIdz 2.5.29.37.0any_extended_key_usagez1.3.6.1.5.5.7.3.1 server_authz1.3.6.1.5.5.7.3.2 client_authz1.3.6.1.5.5.7.3.3 code_signingz1.3.6.1.5.5.7.3.4email_protectionz1.3.6.1.5.5.7.3.5ipsec_end_systemz1.3.6.1.5.5.7.3.6 ipsec_tunnelz1.3.6.1.5.5.7.3.7 ipsec_userz1.3.6.1.5.5.7.3.8 time_stampingz1.3.6.1.5.5.7.3.9 ocsp_signingz1.3.6.1.5.5.7.3.10dvcsz1.3.6.1.5.5.7.3.13 eap_over_pppz1.3.6.1.5.5.7.3.14 eap_over_lanz1.3.6.1.5.5.7.3.15 scvp_serverz1.3.6.1.5.5.7.3.16 scvp_clientz1.3.6.1.5.5.7.3.17 ipsec_ikez1.3.6.1.5.5.7.3.18 capwap_acz1.3.6.1.5.5.7.3.19 capwap_wtpz1.3.6.1.5.5.7.3.20 sip_domainz1.3.6.1.5.5.7.3.21secure_shell_clientz1.3.6.1.5.5.7.3.22secure_shell_serverz1.3.6.1.5.5.7.3.23 send_routerz1.3.6.1.5.5.7.3.24send_proxied_routerz1.3.6.1.5.5.7.3.25 send_ownerz1.3.6.1.5.5.7.3.26send_proxied_ownerz1.3.6.1.5.5.7.3.27cmc_caz1.3.6.1.5.5.7.3.28cmc_raz1.3.6.1.5.5.7.3.29 cmc_archivez1.3.6.1.5.5.7.3.30bgpspec_routerz1.3.6.1.5.5.8.2.2ike_intermediatez1.3.6.1.4.1.311.10.3.1microsoft_trust_list_signingz1.3.6.1.4.1.311.10.3.2microsoft_time_stamp_signingz1.3.6.1.4.1.311.10.3.3microsoft_server_gatedz1.3.6.1.4.1.311.10.3.3.1microsoft_serializedz1.3.6.1.4.1.311.10.3.4 microsoft_efsz1.3.6.1.4.1.311.10.3.4.1microsoft_efs_recoveryz1.3.6.1.4.1.311.10.3.5microsoft_whqlz1.3.6.1.4.1.311.10.3.6 microsoft_nt5z1.3.6.1.4.1.311.10.3.7microsoft_oem_whqlz1.3.6.1.4.1.311.10.3.8microsoft_embedded_ntz1.3.6.1.4.1.311.10.3.9microsoft_root_list_signerz1.3.6.1.4.1.311.10.3.10!microsoft_qualified_subordinationz1.3.6.1.4.1.311.10.3.11microsoft_key_recoveryz1.3.6.1.4.1.311.10.3.12microsoft_document_signingz1.3.6.1.4.1.311.10.3.13microsoft_lifetime_signingz1.3.6.1.4.1.311.10.3.14 microsoft_mobile_device_softwarez1.3.6.1.4.1.311.20.2.2microsoft_smart_card_logonz1.2.840.113635.100.1.2apple_x509_basicz1.2.840.113635.100.1.3 apple_sslz1.2.840.113635.100.1.4apple_local_cert_genz1.2.840.113635.100.1.5 apple_csr_genz1.2.840.113635.100.1.6apple_revocation_crlz1.2.840.113635.100.1.7apple_revocation_ocspz1.2.840.113635.100.1.8 apple_smimez1.2.840.113635.100.1.9 apple_eapz1.2.840.113635.100.1.10apple_software_update_signingz1.2.840.113635.100.1.11 apple_ipsecz1.2.840.113635.100.1.12 apple_ichatz1.2.840.113635.100.1.13apple_resource_signingz1.2.840.113635.100.1.14apple_pkinit_clientz1.2.840.113635.100.1.15apple_pkinit_serverz1.2.840.113635.100.1.16apple_code_signingz1.2.840.113635.100.1.17apple_package_signingz1.2.840.113635.100.1.18apple_id_validationz1.2.840.113635.100.1.20apple_time_stampingz1.2.840.113635.100.1.21apple_revocationz1.2.840.113635.100.1.22apple_passbook_signingz1.2.840.113635.100.1.23apple_mobile_storez1.2.840.113635.100.1.24apple_escrow_servicez1.2.840.113635.100.1.25apple_profile_signerz1.2.840.113635.100.1.26apple_qa_profile_signerz1.2.840.113635.100.1.27apple_test_mobile_storez1.2.840.113635.100.1.28apple_otapki_signerz1.2.840.113635.100.1.29apple_test_otapki_signerz1.2.840.113625.100.1.30)apple_id_validation_record_signing_policyz1.2.840.113625.100.1.31apple_smp_encryptionz1.2.840.113625.100.1.32apple_test_smp_encryptionz1.2.840.113635.100.1.33apple_server_authenticationz1.2.840.113635.100.1.34apple_pcs_escrow_servicez2.16.840.1.101.3.6.8piv_card_authenticationz2.16.840.1.101.3.6.7piv_content_signingz1.3.6.1.5.2.3.4pkinit_kpclientauthz1.3.6.1.5.2.3.5 pkinit_kpkdcz1.2.840.113583.1.1.5adobe_authentic_documents_trustz2.16.840.1.101.3.8.7fpki_pivi_content_signingNrr=rDrArrsl /l  ]l  ] l  ^ l  / l  /l  ^l  \l  _l  ^l  fl  nl  n!l $ m%l & m'l * k+l . k/l 0 l1l 4 l5l 8 39l : 3;l > m?l @ 3Al B lCl D 2El H hIl J hKl L mMl P .Ql T /Ul Z !"@[l \ !"@]l ^ !":_l ` #$:al b !/cl d #$ol p "#Fql r "#;sl t "#?ul v "#?wl x "#Eyl | !">}l D !"4El F !+Gl H !"8Il J !/Kl L !"8Ml N !"9Ol P !-Ql R !+Sl T "#BUl V "=Wl X "=Yl Z "#;[l \ "#8]l ^ "#8_l ` "#7al b "#:cl d "#8el f "#8gl h "#5il j "#;kl l "#7ml n "#9ol p "#9ql r "#l @ "#@Al B "#=Cl F  9Gl H  5Il L 0Ml N >Ol R  ASl V  ;Wl DrDrceZdZeZy)ExtKeyUsageSyntaxNrYrZr[rrr=rDrArrKrDrceZdZdddddZy) AccessMethodocsp ca_issuersr ca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5Nrr=rDrArrs$*--  DrDrceZdZdefdefgZy)AccessDescription access_methodaccess_locationN)rYrZr[rr$rr=rDrArrs ,' K(GrDrceZdZeZy)AuthorityInfoAccessSyntaxNrYrZr[rrr=rDrArrrirDrceZdZeZy)SubjectInfoAccessSyntaxNrr=rDrArrrirDrceZdZeZy)FeaturesNror=rDrArr rprDrceZdZdefdefgZy)EntrustVersionInfo entrust_versentrust_info_flagsN)rYrZr[rrrr=rDrArrs ' y)GrDrc "eZdZddddddddd Zy ) NetscapeCertificateType ssl_client ssl_serveremailobject_signingreservedssl_caemail_caobject_signing_ca)rr rrrrrrNrr=rDrArrs!         DrDrceZdZddddZy)Versionv1v2v3rr rNrr=rDrArr%s    DrDrc"eZdZdefdefdefgZy)TPMSpecificationrlevelrevisionN)rYrZr[r.rrr=rDrArr-s! : ' WGrDrceZdZeZy)SetOfTPMSpecificationN)rYrZr[rrr=rDrArr5s"KrDrc"eZdZdefdefdefgZy)TCGSpecificationVersion major_version minor_versionrNrr=rDrArr9s! '" '" WGrDrceZdZdefdefgZy)TCGPlatformSpecificationversionplatform_classN)rYrZr[rr$rr=rDrAr"r"As +, ;'GrDr"ceZdZeZy)SetOfTCGPlatformSpecificationN)rYrZr[r"rr=rDrAr&r&Hs*KrDr&ceZdZdddddZy)EKGenerationTypeinternalinjectedinternal_revocableinjected_revocable)rr rrNrr=rDrAr(r(Ls      DrDr(ceZdZddddZy)EKGenerationLocationrrek_cert_signerrNrr=rDrAr.r.U  "  DrDr.ceZdZddddZy)EKCertificateGenerationLocationrrr/rNrr=rDrAr2r2]r0rDr2c eZdZddddddddZy ) EvaluationAssuranceLevellevel1level2level3level4level5level6level7)r rrrrrrNrr=rDrAr4r4es        DrDr4ceZdZddddZy)EvaluationStatusdesigned_to_meetevaluation_in_progressevaluation_completedrNrr=rDrAr=r=qs  # ! DrDr=ceZdZddddZy)StrengthOfFunctionbasicmediumhighrNrr=rDrArBrBys    DrDrBc.eZdZdefdeddifdeddifgZy) URIReferencer+hash_algorithmrT hash_valueN)rYrZr[rrrrr=rDrArGrGs/ & 2 ?Z,>? y:t"45GrDrGc teZdZdefdefdefdeddifdedd d fd ed d d fd e dd d fdedd d fde dd d fg Z y)CommonCriteriaMeasuresr#assurance_levelevaluation_statusplusr;Fstrengh_of_functionrTr profile_oidr profile_urlr target_oidr target_urirN) rYrZr[rr4r=rrBr"rGrr=rDrArKrKs I 45 ./ 9e,-  2PT4UV (qd*KL  1$&GH 'aT)JK |!%FG GrDrKceZdZdddddZy) SecurityLevelr5r6r7r8)r rrrNrr=rDrArUrUs      DrDrUc(eZdZdefdefdeddifgZy) FIPSLevelr#rrNr;FN)rYrZr[rrUrrr=rDrArWrWs( I - 9e,-GrDrWc eZdZdeddifdeddifdeddd fd ed dd fd ed dd fdeddd fde ddd fdedddfde ddifg Z y)TPMSecurityAssertionsr#r;rfield_upgradableFek_generation_typerTrek_generation_locationr "ek_certificate_generation_locationrcc_infor fips_levelriso_9000_certifiedrrU iso_9000_urirN) rYrZr[rrr(r.r2rKrWrrr=rDrArYrYs Gi./ Wy%&89 /aT1RS !#7aUY9Z[ -/N]^lpPqr *,MN yqd"CD wQ5(IJ Z$67 GrDrYceZdZeZy)SetOfTPMSecurityAssertionsN)rYrZr[rYrr=rDrArcrcs'KrDrcc &eZdZddddddddd d d Zy ) SubjectDirectoryAttributeIdsupported_algorithmstpm_specificationtcg_platform_specificationtpm_security_assertionspda_date_of_birthpda_place_of_birth pda_genderpda_country_of_citizenshippda_country_of_residenceentrust_user_role) z2.5.4.52z 2.23.133.2.16z 2.23.133.2.17z 2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29Nrr=rDrAreres)+,5201)97"5 DrDreceZdZeZy)SetOfGeneralizedTimeN)rYrZr[rrr=rDrArqrqrrDrqceZdZeZy)SetOfDirectoryStringN)rYrZr[rrr=rDrArsrsrrDrsceZdZeZy)SetOfPrintableStringNrr=rDrArururrDruc2eZdZdefdedddfdedddfgZy) SupportedAlgorithmalgorithm_identifierintended_usagerTrintended_certificate_policiesr N)rYrZr[rrrrr=rDrArwrws2 !78 8!%FG (*=A[_?`aGrDrwceZdZeZy)SetOfSupportedAlgorithmN)rYrZr[rwrr=rDrAr|r|rrDr|c FeZdZdefdefgZdZeee e e e e e e d ZdZdeiZy)SubjectDirectoryAttributerr)rr) rfrgrhrirjrkrlrmrncf|dj}||jvr|j|StS)Nr)rdr@r*)r?type_s rA _values_specz&SubjectDirectoryAttribute._values_specs1V ## DOO #??5) ) rDN)rYrZr[rerrr?r|rr&rcrqrsrur@r_spec_callbacksr=rDrAr~r~sU ,- 3G #I 72&C#=12*&:$8 J ,OrDr~ceZdZeZy)SubjectDirectoryAttributesN)rYrZr[r~rr=rDrArrs+KrDrc eZdZiddddddddd d d d d ddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*Zy+), ExtensionIdz2.5.29.9subject_directory_attributesz 2.5.29.14r?z 2.5.29.15 key_usagez 2.5.29.16private_key_usage_periodz 2.5.29.17subject_alt_namez 2.5.29.18issuer_alt_namez 2.5.29.19basic_constraintsz 2.5.29.30name_constraintsz 2.5.29.31crl_distribution_pointsz 2.5.29.32certificate_policiesz 2.5.29.33policy_mappingsz 2.5.29.35authority_key_identifierz 2.5.29.36policy_constraintsz 2.5.29.37extended_key_usagez 2.5.29.46 freshest_crlz 2.5.29.54inhibit_any_policyz1.3.6.1.5.5.7.1.1authority_information_accesssubject_information_access tls_feature ocsp_no_checkentrust_version_extensionnetscape_certificate_type!signed_certificate_timestamp_listmicrosoft_enroll_certtype)z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2z1.3.6.1.4.1.311.20.2Nrr=rDrArrs 2 %  [  /   '   &   (  '  .  +  &  /  )  )  ^  )! " ;# $;+ /!rrrrrrr rrrr@r=rDrArr's' K Wy%01 *+G *I&(B+ X #$9  L  <  - O "#8  3 > #$: / / - g!" '(A#$'>%7%<-8&/5JrDrceZdZeZy) ExtensionsN)rYrZr[rrr=rDrArrMrrDrcleZdZdedddfdefdefdefdefd efd efd e d d dfde dd dfde dd dfg Z y)TbsCertificater#rr)rr;r signatureissuervaliditysubjectsubject_public_key_infoissuer_unique_idr Trsubject_unique_idr extensionsrrN) rYrZr[rrrrr7r1r#rrr=rDrArrQsv G!=> '" +, 4 X D "M2 ^!-NO n1$.OP zt#DE GrDrceZdZdefdefdefgZdZdZdZ dZ dZ dZ dZ dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'e(dZ)e(dZ*e(d Z+e(d Z,e(d Z-e(d Z.e(d Z/e(dZ0e(dZ1e(dZ2e(dZ3e(dZ4e(dZ5e(dZ6e(dZ7e(dZ8e(dZ9e(dZ:e(dZ;e(dZe(dZ?e(dZ@e(dZAe(d ZBe(d!ZCe(d"ZDe(d#ZEe(d$ZFe(d%ZGe(d&ZHe(d'ZIe(d(ZJe(d)ZKe(d*ZLd+ZMe(d,ZNe(d-ZOe(d.ZPe(d/ZQe(d0ZRe(d1ZSe(d2ZTe(d3ZUe(d4ZVe(d5ZWe(d6ZXd7ZYd8ZZd9Z[y): Certificatetbs_certificatesignature_algorithmsignature_valueFNct|_|ddD]g}|dj}d|z}t||rt |||dj |djsM|jj |id|_y) zv Sets common named extensions to private attributes and creates a list of critical extensions rrrz _%s_valuerrTN)rX_critical_extensionsrdhasattrsetattrparsedadd_processed_extensions)r? extensionrrqs rA_set_extensionszCertificate._set_extensionss %(E!/0>IY'..D(4/Nt^,ni .E.L.LM$++))--d3 ?&*"rDcR|js|j|jS)z Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings )rrrrjs rAcritical_extensionszCertificate.critical_extensionss%))  "(((rDcR|js|j|jS)z This extension is used to constrain the period over which the subject private key may be used :return: None or a PrivateKeyUsagePeriod object )rr_private_key_usage_period_valuerjs rAprivate_key_usage_period_valuez*Certificate.private_key_usage_period_value%))  "333rDcR|js|j|jS)z This extension is used to contain additional identification attributes about the subject. :return: None or a SubjectDirectoryAttributes object )rr#_subject_directory_attributes_valuerjs rA"subject_directory_attributes_valuez.Certificate.subject_directory_attributes_value%))  "777rDcR|js|j|jS)z This extension is used to help in creating certificate validation paths. It contains an identifier that should generally, but is not guaranteed to, be unique. :return: None or an OctetString object )rr_key_identifier_valuerjs rAkey_identifier_valuez Certificate.key_identifier_values%))  ")))rDcR|js|j|jS)z This extension is used to define the purpose of the public key contained within the certificate. :return: None or a KeyUsage )rr_key_usage_valuerjs rAkey_usage_valuezCertificate.key_usage_values%))  "$$$rDcR|js|j|jS)aT This extension allows for additional names to be associate with the subject of the certificate. While it may contain a whole host of possible names, it is usually used to allow certificates to be used with multiple different domain names. :return: None or a GeneralNames object )rr_subject_alt_name_valuerjs rAsubject_alt_name_valuez"Certificate.subject_alt_name_values%))  "+++rDcR|js|j|jS)z This extension allows associating one or more alternative names with the issuer of the certificate. :return: None or an x509.GeneralNames object )rr_issuer_alt_name_valuerjs rAissuer_alt_name_valuez!Certificate.issuer_alt_name_values%))  "***rDcR|js|j|jS)a' This extension is used to determine if the subject of the certificate is a CA, and if so, what the maximum number of intermediate CA certs after this are, before an end-entity certificate is found. :return: None or a BasicConstraints object )rr_basic_constraints_valuerjs rAbasic_constraints_valuez#Certificate.basic_constraints_values%))  ",,,rDcR|js|j|jS)z This extension is used in CA certificates, and is used to limit the possible names of certificates issued. :return: None or a NameConstraints object )rr_name_constraints_valuerjs rAname_constraints_valuez"Certificate.name_constraints_value s%))  "+++rDcR|js|j|jS)z This extension is used to help in locating the CRL for this certificate. :return: None or a CRLDistributionPoints object extension )rr_crl_distribution_points_valuerjs rAcrl_distribution_points_valuez)Certificate.crl_distribution_points_value s%))  "222rDcR|js|j|jS)a; This extension defines policies in CA certificates under which certificates may be issued. In end-entity certificates, the inclusion of a policy indicates the issuance of the certificate follows the policy. :return: None or a CertificatePolicies object )rr_certificate_policies_valuerjs rAcertificate_policies_valuez&Certificate.certificate_policies_value* s%))  "///rDcR|js|j|jS)z This extension allows mapping policy OIDs to other OIDs. This is used to allow different policies to be treated as equivalent in the process of validation. :return: None or a PolicyMappings object )rr_policy_mappings_valuerjs rApolicy_mappings_valuez!Certificate.policy_mappings_value: s%))  "***rDcR|js|j|jS)z This extension helps in identifying the public key with which to validate the authenticity of the certificate. :return: None or an AuthorityKeyIdentifier object )rr_authority_key_identifier_valuerjs rAauthority_key_identifier_valuez*Certificate.authority_key_identifier_valueI rrDcR|js|j|jS)z This extension is used to control if policy mapping is allowed and when policies are required. :return: None or a PolicyConstraints object )rr_policy_constraints_valuerjs rApolicy_constraints_valuez$Certificate.policy_constraints_valueW %))  "---rDcR|js|j|jS)z This extension is used to help locate any available delta CRLs :return: None or an CRLDistributionPoints object )rr_freshest_crl_valuerjs rAfreshest_crl_valuezCertificate.freshest_crl_valuee s%))  "'''rDcR|js|j|jS)z This extension is used to prevent mapping of the any policy to specific requirements :return: None or a Integer object )rr_inhibit_any_policy_valuerjs rAinhibit_any_policy_valuez$Certificate.inhibit_any_policy_valuer rrDcR|js|j|jS)z This extension is used to define additional purposes for the public key beyond what is contained in the basic constraints. :return: None or an ExtKeyUsageSyntax object )rr_extended_key_usage_valuerjs rAextended_key_usage_valuez$Certificate.extended_key_usage_value rrDcR|js|j|jS)z This extension is used to locate the CA certificate used to sign this certificate, or the OCSP responder for this certificate. :return: None or an AuthorityInfoAccessSyntax object )rr#_authority_information_access_valuerjs rA"authority_information_access_valuez.Certificate.authority_information_access_value rrDcR|js|j|jS)z This extension is used to access information about the subject of this certificate. :return: None or a SubjectInfoAccessSyntax object )rr!_subject_information_access_valuerjs rA subject_information_access_valuez,Certificate.subject_information_access_value s%))  "555rDcR|js|j|jS)z This extension is used to list the TLS features a server must respond with if a client initiates a request supporting them. :return: None or a Features object )rr_tls_feature_valuerjs rAtls_feature_valuezCertificate.tls_feature_value s%))  "&&&rDcR|js|j|jS)a- This extension is used on certificates of OCSP responders, indicating that revocation information for the certificate should never need to be verified, thus preventing possible loops in path validation. :return: None or a Null object (if present) )rr_ocsp_no_check_valuerjs rAocsp_no_check_valuezCertificate.ocsp_no_check_value s%))  "(((rDc |djS)zE :return: A byte string of the signature rrdrjs rArzCertificate.signature s%&---rDc |djS)zj :return: A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa" r)signature_algorjs rArzCertificate.signature_algo s)*999rDc |djS)z :return: A unicode string of "md2", "md5", "sha1", "sha224", "sha256", "sha384", "sha512", "sha512_224", "sha512_256" r) hash_algorjs rArzCertificate.hash_algo s)*444rDc|ddS)zT :return: The PublicKeyInfo object for this certificate rrr=rjs rA public_keyzCertificate.public_key s%&'@AArDc|ddS)zZ :return: The Name object for the subject of this certificate rrr=rjs rArzCertificate.subject s%&y11rDc|ddS)zY :return: The Name object for the issuer of this certificate rrr=rjs rArzCertificate.issuer s%&x00rDc&|ddjS)zT :return: An integer of the certificate's serial number rrrrjs rArzCertificate.serial_number s%&7>>>rDcH|jsy|jjS)z :return: None or a byte string of the certificate's key identifier from the key identifier extension N)rrdrjs rAr?zCertificate.key_identifier s"((((///rDc|jC|jjdzt|jj dz|_|jS)z :return: A byte string of the SHA-256 hash of the issuer concatenated with the ascii character ":", concatenated with the serial number as an ascii string :rt)_issuer_serialrrrrrPrjs rA issuer_serialzCertificate.issuer_serial sO    &"&++"4"4t";gdFXFX>Y>`>`ah>i"iD """rDc,|dddjS)zd :return: A datetime of latest time when the certificate is still valid rrrrrjs rAnot_valid_afterzCertificate.not_valid_after! s %&z2;?FFFrDc,|dddjS)zd :return: A datetime of the earliest time when the certificate is valid rrrrrjs rAnot_valid_beforezCertificate.not_valid_before) s %&z2<@GGGrDcN|jsy|jdjS)z :return: None or a byte string of the key_identifier from the authority key identifier extension Nr?)rrdrjs rArz$Certificate.authority_key_identifier1 s(22223CDKKKrDc~|jdur|j}|r|djr|jddj}|j }|jdj}|j dzt |jdz|_|jSd|_|jS)a; :return: None or a byte string of the SHA-256 hash of the isser from the authority key identifier extension concatenated with the ascii character ":", concatenated with the serial number from the authority key identifier extension as an ascii string Fr@rrAr rtN)_authority_issuer_serialrrdruuntagrrrP)r?akivrauthority_serials rAauthority_issuer_serialz#Certificate.authority_issuer_serial> s  ( (E 166D45<<<<=TUVWX__#'#F#FGe#f#m#m 06 0DwO_G`GgGghoGp0p-,,,15-,,,rDcr|j |j|j|_|jS)z Returns complete CRL URLs - does not include delta CRLs :return: A list of zero or more DistributionPoint objects )_crl_distribution_points!_get_http_crl_distribution_pointsrrjs rArz#Certificate.crl_distribution_pointsT s6  ( ( 0,0,R,RSWSuSu,vD ),,,rDcr|j |j|j|_|jS)z Returns delta CRL URLs - does not include complete CRLs :return: A list of zero or more DistributionPoint objects )_delta_crl_distribution_pointsrrrjs rAdelta_crl_distribution_pointsz)Certificate.delta_crl_distribution_pointsa s6  . . 6262X2XY]YpYp2qD /222rDcg}|gS|D]R}|d}|tur|jdk(r!|jD]#}|jdk(s|j|%T|S)a? Fetches the DistributionPoint object for non-relative, HTTP CRLs referenced by the certificate :param crl_distribution_points: A CRLDistributionPoints object to grab the DistributionPoints from :return: A list of zero or more DistributionPoint objects r_rEr+)r0rrurJ)r?rrKr_distribution_point_nameres rArz-Certificate._get_http_crl_distribution_pointsn s{ " *I"9 &89M&N #&$.&++/LL 7 > > $$(EEMM"45!?#: rDc|jsgSg}|jD]g}|djdk(s|d}|jdk7r+|j}|jj dsW|j |i|S)zx :return: A list of zero or more unicode strings of the OCSP URLs for this cert rrrr+rc)rrdrrHrOrJ)r?rKentrylocationrfs rA ocsp_urlszCertificate.ocsp_urls s66I<.$ sE,Dq ,D)r,rrrjs rAsha1_fingerprintzCertificate.sha1_fingerprint s"xxEM$)),DEEErDc|j6tj|jj |_|jS)zy :return: The SHA-256 hash of the DER-encoded bytes of this complete certificate rrjs rArzCertificate.sha256& s7 << ">>$))+6==?DL||rDcXdjdt|jDS)z :return: A unicode string of the SHA-256 hash, formatted using hex encoding with a space between each pair of characters, all uppercase r%c3&K|] }d|z ywr=r=r>s rAraz1Certificate.sha256_fingerprint..: sG,Fq ,Fr@)r,rrrjs rAsha256_fingerprintzCertificate.sha256_fingerprint2 s"xxGM$++,FGGGrDct|tsttdt ||j dj dj}|jddk7}| xrtjd|}| xr| }|r|jsy|jd}|jD]}|j dj dj}|jd} t| t|k7rZ| |k(ry |j|} | su|j|| sy y|j sy|rt"j$nt"j&} t)| |} |j D]I} | jddk7rt"j$nt"j&}t)|| }|| k(sIy y) a Check if a domain name or IP address is valid according to the certificate :param domain_ip: A unicode string of a domain name or IP address :return: A boolean - if the domain or IP is valid for the certificate zL domain_ip must be a unicode string, not %s rrtrrsz^\d+\.\d+\.\d+\.\d+$FrLT)rFrrNr rrPr|rHrvr'r(r+rr_is_wildcard_domain_is_wildcard_matchr.rrrr5)r? domain_ipencoded_domain_ipis_ipv6is_ipv4 is_domain domain_labels valid_domainencoded_valid_domainvalid_domain_labels is_wildcardr normalized_ipvalid_ip valid_familynormalized_valid_ips rAis_valid_domain_ipzCertificate.is_valid_domain_ip< s)W-F)$  &,,V4;;GDJJL#((-3+\"((+HJ["\K/K  %%-33C8M $ 2 2 '3':':6'B'I'I''R'X'X'Z$&:&@&@&E#*+s=/AA&-7"667KL 4#:#:=J]#^!3~~#*!&*;< H-5]]3-?2-E6>>6??L"+L("C "m3 'rDc|jddk7ry|jjd}|sy|djddk(ry|ddddk(ryy ) af Checks if a domain is a valid wildcard according to https://tools.ietf.org/html/rfc6125#section-6.4.3 :param domain: A unicode string of the domain name, where any U-labels from an IDN have been converted to A-labels :return: A boolean - if the domain is a valid wildcard domain *r FrLrrsrzxn--T)countrHrrv)r?domainlabelss rArGzCertificate._is_wildcard_domain~ sh <<  !%%c* !9>># " $ !9Qq>V #rDc|d}|dd}|d}|dd}||k7ry|dk(rytjd|jddzd z}|j|ryy) a Determines if the labels in a domain are a match for labels from a wildcard valid domain name :param domain_labels: A list of unicode strings, with A-label form for IDNs, of the labels in the domain name to check :param valid_domain_labels: A list of unicode strings, with A-label form for IDNs, of the labels in a wildcard domain pattern :return: A boolean - if the domain matches the valid domain rr NFrYT^z.*$)r'r'r+r()r?rNrQfirst_domain_labelother_domain_labelswildcard_labelother_valid_domain_labelswildcard_regexs rArHzCertificate._is_wildcard_match s"+1-+AB/,Q/$7$;! "; ; S C.*@*@d*K$Kc$QR    2 3rD)\rYrZr[rrr#rrrrrrrrrrrrrrrrrrrrrrrr rrrr&r-r3r8rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr?r rrrrrrrr$r+r.r:r1r4r9rrArrErWrGrHr=rDrArr`s N+  56 N+G "*.' "!#"%)""&!&*# $ $ $*.'(,%&*#N$#%)"NJLL EG*$ ) ) 4 4 8 8 * * % % , , + + - - , , 3 3 0 0 + + 4 4 . . ( ( . . . . 8 8 6 6 ' ' ) )..::55BB2211?? 0 0 # #GGHH L L--* - - 3 3>* # #D ZZJJ ! !!!2FF  HH@DB#rDrceZdZeZy)KeyPurposeIdentifiersNrr=rDrArfrf rrDrfceZdZeZy)SequenceOfAlgorithmIdentifiersN)rYrZr[rrr=rDrArhrh rrDrhc PeZdZdeddifdedddfdeddifdeddifd ed ddfgZy ) CertificateAuxtrustrTrejectrraliaskeyidr@r N)rYrZr[rfr.r$rhrr=rDrArjrj sW '*d);< (qd*KL *z401 + D12 0qd2ST GrDrjceZdZeegZy)TrustedCertificateN)rYrZr[rrj _child_specsr=rDrArprp s 0LrDrp)r __future__rrrr contextlibr encodingsrrr'rr-r)r/_errorsr _irir r _ordereddictr _typesrrralgosrrrrcorerrrrrrrrrrrr r!r"r#r$r%r&r'r(r)r*r+r,r-r.r/r0rIr1utilr2r3r4r5r7r^rlrrrrrrrrrrrBr\rrrrrrrrrrrrrrrrrrrrrrrrrrrrr r$r1r3r7r9r>rCrGrRrXrZr^rhrkrnrrrvrzr~rrrrrrrrrrrrrrrrrrrrr"r&r(r.r2r4r=rBrGrKrUrWrYrcrerqrsrurwr|r~rrrrrrrfrhrjrpr=rDrAr|s SR%  (%55ff< DD2 i2 j6)6rn9nbB5 B5J y H]0== f Q(Q(h~x~BRRj'*'T@6@F(&v3#"j" Z   H0Z0H0Z0&3"z"s8(V7W8D%*%8/+&/+d:6xxXF ) X!j!h""J$J$&Jh( ( &:&' $*$H Z m#m` #$ $$j$ z i gx#E#hx+E+z:j z z8 X J H (("2&"5""5""5"%e%<,,"@##L X b (b RJ&Z&X11rD