File: //usr/local/CyberCP/lib/python3.10/site-packages/asyncssh/crypto/__pycache__/x509.cpython-310.pyc
o
�h< � @ sr d Z ddlmZmZ ddlZddlZddlmZmZmZm Z m
Z
m Z m Z ddl
mZ ddl
mZ ddlmZ ddlmZ d d
lmZmZmZ d d lmZ d d
lmZmZm Z m Z e de e f Z e e e e f Z!e de e e f Z"e de
ej# f Z$eej% Z&e e ej'eej( f Z)ej*j+ej*j,e�#d�e�#d�d�Z-dZ.e�#d�Z/e�0dej1�j2d d�Z3e�0dej1�Z4ej5dkr�ej6j2dej1d�Z7nej6j2ej1d�Z7de8defdd �Z9d e"de$fd d �Z:d e!de&fd!d"�Z;d e!de&fd#d$�Z<G d%d&� d&ej'�Z=G d'd(� d(�Z>G d)d*� d*�Z?d+ed,ed-e)d.ee) d/ee8 d0e8d1e8d2e@d3ee8 d e"d4e!d5e!d6e d7e de?f d8d9�ZAd:e de?fd;d<�ZBdS )=�7A shim around PyCA and PyOpenSSL for X.509 certificates� )�datetime�timezoneN)�Iterable�List�Optional�Sequence�Set�Union�cast)�Encoding)� PublicFormat)�x509)�crypto� )� IA5String�
der_decode�
der_encode)�
ip_address� )�PyCAKey�PyCAPrivateKey�
PyCAPublicKey�hashesz1.3.6.1.5.5.7.3.21z1.3.6.1.5.5.7.3.22)�
serverAuth�
clientAuth�secureShellClient�secureShellServerz 2.5.29.37.0z2.16.840.1.113730.1.13)� microsecondi����win32i� )�year�tzinfo)r! �t�returnc C sp | dkrt S zt�| tj�W S ttfy7 zt�t�� d tj� tW Y S ttfy6 t Y Y S w w )z'Convert a timestamp value to a datetimer r )
�
_datetime_minr �
fromtimestampr �utc�OSError�
OverflowError�
_datetime_max� timestamp�_datetime_32bit_max)r" � r, �G/usr/local/CyberCP/lib/python3.10/site-packages/asyncssh/crypto/x509.py�_to_generalized_timeE s �
��r. �purposesc C sL t | t�rdd� | �d�D �} | rd| v st| v r d}|S dd� | D �}|S )z*Convert a list of purposes to purpose OIDsc S � g | ]}|� � �qS r, ��strip��.0�pr, r, r- �
<listcomp>\ � z$_to_purpose_oids.<locals>.<listcomp>�,�anyNc S s h | ] }t �|�p
t�|��qS r, )�_purpose_to_oid�getr �ObjectIdentifierr3 r, r, r- � <setcomp>a s �z#_to_purpose_oids.<locals>.<setcomp>)�
isinstance�str�split� _purpose_any)r/ � purpose_oidsr, r, r- �_to_purpose_oidsX s
��rC �
principalsc C s, t | t�rdd� | �d�D �} dd� | D �S )z*Encode user principals as e-mail addressesc S r0 r, r1 r3 r, r, r- r6 k r7 z+_encode_user_principals.<locals>.<listcomp>r8 c S s g | ]}t �|��qS r, )r �
RFC822Name�r4 �namer, r, r- r6 m � )r> r? r@ �rD r, r, r- �_encode_user_principalsg s
rJ c sD dt dtjfdd�� t| t �rdd� | �d�D �} � fdd�| D �S ) z3Encode host principals as DNS names or IP addressesrG r# c S s. zt �t| ��W S ty t �| � Y S w )z3Encode a host principal as a DNS name or IP address)r � IPAddressr �
ValueError�DNSName)rG r, r, r- � _encode_hosts s
�z-_encode_host_principals.<locals>._encode_hostc S r0 r, r1 r3 r, r, r- r6 | r7 z+_encode_host_principals.<locals>.<listcomp>r8 c s g | ]}� |��qS r, r, rF �rN r, r- r6 ~ r7 )r? r � GeneralNamer> r@ rI r, rO r- �_encode_host_principalsp s
rQ c s$ e Zd ZdZe�d�Ze�d�Ze�d�Ze�d�Z de
j j fde
j j
fde
j jfd e
j jfd
e
j jfd e
j jfd e
j jffZee�Zd
d� eD �Zdef� fdd� Zdefdd�Zde
jdefdd�Z de
j defdd�Z dede e
j fdd �Z dede
jfd d �Z!d ede
j fd d!�Z"� Z#S )"�X509Namez0A shim around PyCA for X.509 distinguished namesz([,+\\])z
\\([,+\\])z(?:[^+\\]+|\\.)+z(?:[^,\\]+|\\.)+�C�ST�L�O�OU�CN�DCc C s i | ]\}}||�qS r, r, )r4 �k�vr, r, r- �
<dictcomp>� rH zX509Name.<dictcomp>rG c s> t |t�r | �|�}n t |tj�r|j}n|}t� �|� d S �N)r> r? � _parse_namer �Name�rdns�super�__init__)�selfrG r` �� __class__r, r- rb � s
zX509Name.__init__r# c s d� � fdd�� jD ��S )Nr8 c 3 � � | ]}� � |�V qd S r] )� _format_rdn�r4 �rdn�rc r, r- � <genexpr>� � � z#X509Name.__str__.<locals>.<genexpr>)�joinr` rj r, rj r- �__str__� s zX509Name.__str__ri c s d� t� fdd�|D ���S )z5Format an X.509 RelativeDistinguishedName as a string�+c 3 rf r] )� _format_attr)r4 �nameattrrj r, r- rk � rl z'X509Name._format_rdn.<locals>.<genexpr>)rm �sorted�rc ri r, rj r- rg � s zX509Name._format_rdnrq c C s4 | j �|j�p
|jj}|d | j�dtt|j�� S )z)Format an X.509 NameAttribute as a string�=z\\\1) � _from_oidr; �oid�
dotted_string�_escape�subr r? �value)rc rq �attrr, r, r- rp � s zX509Name._format_attrc s � fdd�� j �|�D �S )z!Parse an X.509 distinguished namec s g | ]}� � |��qS r, )�
_parse_rdnrh rj r, r- r6 � rH z(X509Name._parse_name.<locals>.<listcomp>)� _split_name�findall�rc rG r, rj r- r^ � s zX509Name._parse_namec s t �� fdd�� j�|�D ��S )z*Parse an X.509 relative distinguished namec 3 rf r] )�_parse_nameattr)r4 �avrj r, r- rk � s �
�z&X509Name._parse_rdn.<locals>.<genexpr>)r �RelativeDistinguishedName�
_split_rdnr~ rs r, rj r- r| � s
�zX509Name._parse_rdnr� c C s� z
|� dd�\}}W n ty td| �d�w z|�� }| j�|�p(t�|�}W n ty8 td| �d�w t�|| j� d|��S )z(Parse an X.509 name attribute/value pairrt r z Invalid X.509 name attribute: NzUnknown X.509 attribute: z\1)
r@ rL r2 �_to_oidr; r r< �
NameAttribute� _unescapery )rc r� r{ rz rv r, r, r- r� � s � �zX509Name._parse_nameattr)$�__name__�
__module__� __qualname__�__doc__�re�compilerx r� r� r} r �NameOID� COUNTRY_NAME�STATE_OR_PROVINCE_NAME�
LOCALITY_NAME�ORGANIZATION_NAME�ORGANIZATIONAL_UNIT_NAME� COMMON_NAME�DOMAIN_COMPONENT�_attrs�dictr� ru � _NameInitrb r? rn r� rg r� rp r r^ r| r� �
__classcell__r, r, rd r- rR � s2
�
� rR c @ sP e Zd ZdZdefdd�Zdedefdd�Zde fd d
�Z
d e defd d
�Z dS )�X509NamePatternz Match X.509 distinguished names�patternc C sB |� d�rt|d d� �| _t| jj�| _d S t|�| _d | _d S )Nz,*���)�endswithrR �_pattern�lenr` � _prefix_len)rc r� r, r, r- rb � s
zX509NamePattern.__init__�otherr# c C s& t |t�stS | j|jko| j|jkS r] )r> r� �NotImplementedr� r� �rc r� r, r, r- �__eq__� s
�zX509NamePattern.__eq__c C s t | j| jf�S r] )�hashr� r� rj r, r, r- �__hash__� s zX509NamePattern.__hash__rG c C s | j j|jd| j� kS )z1Return whether an X.509 name matches this patternN)r� r` r� r r, r, r- �matches� s zX509NamePattern.matchesN)
r� r� r� r� r? rb �object�boolr� �intr� rR r� r, r, r, r- r� � s
r� c
@ sf e Zd ZdZdejdefdd�Zdede fdd �Z
de fd
d �Z d e
d d
edededdf
dd�ZdS )�X509Certificater �cert�datac C s� || _ t|j�| _t|j�| _|�� �tjtj �| _
t j �
|�| _t| j�� �� �dd � | _t| j�� �� �dd � | _z
t|j�tj�j�| _W n
tj yW d | _Y nw z#|j�tj �j}|� tj �| _ |� tj!�dd� |� tj"�D � | _#W n tj y� |j�$tj%j&�}dd� |D �}|| _ || _#Y nw z|j�'t(�}t)tj*|j�j}t)t+t,|��j| _-W d S tj y� d | _-Y d S w )Nr c S s g | ]}t |��qS r, )r? )r4 �ipr, r, r- r6 r7 z,X509Certificate.__init__.<locals>.<listcomp>c S s g | ]}t t|j��qS r, )r r? rz )r4 r{ r, r, r- r6 s ).r� rR �subject�issuer�
public_key� public_bytesr �DERr
�SubjectPublicKeyInfo�key_datar �X509�from_cryptography� openssl_cert�hex� get_subjectr� � subject_hash�
get_issuer� issuer_hash�set�
extensions�get_extension_for_classr �ExtendedKeyUsagerz r/ �ExtensionNotFound�SubjectAlternativeName�get_values_for_typerE �user_principalsrM rK �host_principals�get_attributes_for_oidr� r� �get_extension_for_oid�_nscomment_oidr �UnrecognizedExtensionr r �comment)rc r� r� �sans�cnrD r� � comment_derr, r, r- rb � sV � ���
���
�
�
� �zX509Certificate.__init__r� r# c C s t |t�stS | j|jkS r] )r> r� r� r� r� r, r, r- r� s
zX509Certificate.__eq__c C s
t | j�S r] )r� r� rj r, r, r- r� s
zX509Certificate.__hash__� trust_storer/ �user_principal�host_principalNc
C s� t |�}|r| jr|| j@ std��|r || jvr td��|r(|| jvr(td��t�� }|D ]}|�|j� q.zt� || jd�}|�
� W dS tj y[ } ztd| � ��d�d} ~ ww )z Validate an X.509 certificatez Certificate purpose mismatchz#Certificate user principal mismatchz#Certificate host principal mismatchNz X.509 chain validation error: ) rC r/ rL r� r� r � X509Store�add_certr� �X509StoreContext�verify_certificate�X509StoreContextError)
rc r� r/ r� r� rB �
x509_store�c�x509_ctx�excr, r, r- �validate s&
���zX509Certificate.validate)r� r� r� r� r � Certificate�bytesrb r� r� r� r� r� r � _Purposesr? r� r, r, r, r- r� � s )
����r� � signing_key�keyr� r� �serial� valid_after� valid_before�ca� ca_path_lenr� r� � hash_namer� c C s. t �� }t|�}|rt|�n|}||k}|�|�}|�|�}|du r&t �� }|�|�}|�t|��}|� t|��}|�
t t |��}|rYt j
d|d�}t jdddddddddd� }nt j
ddd�}t jdddddddddd� }|j|dd�}|sy|s�|j|dd�}t| �}|r�|jt �|�dd�}t j�t t |��}|j|dd�}|s�t t| ��
� }t j�|�}|j|dd�}t|
�t| � }|r�|jt �|�dd�}|
r�t|
t�r�|
� d�}n|
}t t |��}|jt � t |�dd�}z | r�t!| � nd}W n
t"�y t#d�d�w |�$t t| �|�}|�%t&j'�}t(||�S ) z Generate a new X.509 certificateNT)r� � path_lengthF) �digital_signature�content_commitment�key_encipherment�data_encipherment�
key_agreement�
key_cert_sign�crl_sign�
encipher_only�
decipher_only)�criticalzutf-8zUnknown hash algorithm))r �CertificateBuilderrR � subject_name� issuer_name�random_serial_number�
serial_number�not_valid_beforer. �not_valid_afterr� r r �BasicConstraints�KeyUsage�
add_extensionrC r� �SubjectKeyIdentifier�from_public_keyr �AuthorityKeyIdentifier�from_issuer_public_keyrJ rQ r� r> r? �encoder r r� r� r �KeyErrorrL �signr� r r� r� )r� r� r� r� r� r� r� r� r� r/ r� r� r� r� �builder� self_signed�basic_constraints� key_usagerB �skid� issuer_pk�akidr� �
comment_bytes�hash_algr� r� r, r, r- �generate_x509_certificate: s�
��� � � �
�
� �
r r� c C s t �| �}t|| �S )z,Construct an X.509 certificate from DER data)r �load_der_x509_certificater� )r� r� r, r, r- �import_x509_certificate� s
r
)Cr� r r r� �sys�typingr r r r r r
r �,cryptography.hazmat.primitives.serializationr r
� cryptographyr �OpenSSLr �asn1r r r �miscr r r r r r� r? �_Comment� _Principalsr� r< � _PurposeOIDsrP �_GeneralNameListr_ r� r� �ExtendedKeyUsageOID� SERVER_AUTH� CLIENT_AUTHr: rA r� r% r& �replacer$ r+ �platform�maxr) r� r. rC rJ rQ rR r� r� r� r r
r, r, r, r- �<module> s� $
�
I
R������������
�d