3
2Zh                @   st  d Z ddlmZmZmZmZ ddlmZ ddlm	Z	 ddl
Z
ddlZddlZddlZddlZddlZddlmZ ddlmZmZ dd	lmZ dd
lmZmZmZ ddlmZmZmZmZ ddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< ddl=m>Z> ddl?m@Z@mAZAmBZBmCZC G dd de*ZDG dd de*ZEG dd de*ZFG dd de0ZGG dd de3ZHG dd de4ZIG dd de"ZJG dd de3ZKG dd  d e7ZLed!d" ZMG d#d$ d$e%ZNG d%d& d&e.ZOG d'd( d(e3ZPG d)d* d*e6ZQG d+d, d,e4ZRG d-d. d.e%ZSG d/d0 d0e3ZTG d1d2 d2e%ZUG d3d4 d4e%ZVG d5d6 d6e%ZWG d7d8 d8e5ZXG d9d: d:e5ZYG d;d< d<e4ZZG d=d> d>e4Z[G d?d@ d@e3Z\G dAdB dBe3Z]G dCdD dDe4Z^G dEdF dFe3Z_G dGdH dHe4Z`G dIdJ dJe%ZaG dKdL dLe%ZbG dMdN dNe5ZcG dOdP dPe4ZdG dQdR dRe5ZeG dSdT dTe3ZfG dUdV dVe6ZgG dWdX dXe3ZhG dYdZ dZe%ZiG d[d\ d\e+ZjG d]d^ d^e+ZkG d_d` d`e3ZlG dadb dbe4ZmG dcdd dde3ZnG dedf dfe3ZoG dgdh dhe%ZpG didj dje4ZqG dkdl dle%ZrG dmdn dne3ZsG dodp dpe3ZtG dqdr dre3ZuG dsdt dte%ZvG dudv dve"ZwG dwdx dxe3ZxG dydz dze4ZyG d{d| d|e3ZzG d}d~ d~e3Z{G dd de4Z|G dd de%Z}G dd de4Z~G dd de3ZG dd de3ZG dd de.ZG dd de3ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de3ZG dd de4ZG dd de3ZG dd de.ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de4ZG dd de4ZG dd de3ZG dd de"ZG dd de+ZG dd de3ZG dd de6ZG dd de3ZG dd de3ZG dd de6ZG dd de'ZG dd de'ZG dd de'ZG dd de'ZG dd de'ZG ddĄ de'ZG ddƄ de3ZG ddȄ de3ZG ddʄ de'ZG dd̄ de3ZG dd΄ de3ZG ddЄ de6ZG dd҄ de.ZG ddԄ de6ZG ddք de6ZG dd؄ de6ZG ddڄ de3ZG dd܄ de6ZG ddބ de3ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de3ZG dd de3ZG dd de4ZG dd de4ZG dd de3ZG dd de&ZdS )z
ASN.1 type classes for X.509 certificates. Exports the following items:

 - Attributes()
 - Certificate()
 - Extensions()
 - GeneralName()
 - GeneralNames()
 - Name()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function)contextmanager)idnaN   )unwrap)
iri_to_uri
uri_to_iri)OrderedDict)	type_namestr_clsbytes_to_list)AlgorithmIdentifierAnyAlgorithmIdentifierDigestAlgorithmSignedDigestAlgorithm)Any	BitString	BMPStringBooleanChoiceConcat
EnumeratedGeneralizedTimeGeneralString	IA5StringIntegerNullNumericStringObjectIdentifierOctetBitStringOctetStringParsableOctetStringPrintableStringSequence
SequenceOfSetSetOfTeletexStringUniversalStringUTCTime
UTF8StringVisibleStringVOID)PublicKeyInfo)int_to_bytesint_from_bytes	inet_ntop	inet_ptonc               @   s,   e Zd ZdZdZdd Zdd Zdd Zd	S )
DNSNamer      c             C   s
   | |k S )N )selfotherr7   r7   1/usr/lib/python3/dist-packages/asn1crypto/x509.py__ne__L   s    zDNSName.__ne__c             C   s&   t |tsdS | j j |j j kS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2

        :param other:
            Another DNSName object

        :return:
            A boolean
        F)
isinstancer5   __unicode__lower)r8   r9   r7   r7   r:   __eq__O   s    
zDNSName.__eq__c             C   sx   t |ts"ttdt| t||jdrFd|dd j| j }n|j| j}|| _|| _	d| _
| jdkrtd| _dS )zd
        Sets the value of the DNS name

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                .   .r   N    )r<   r   	TypeErrorr	   r   
startswithencode	_encoding_unicodecontents_header_trailer)r8   valueencoded_valuer7   r7   r:   set_   s    


zDNSName.setN)__name__
__module____qualname__rF   Z_bad_tagr;   r?   rM   r7   r7   r7   r:   r5   G   s
   r5   c               @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
URIc             C   sL   t |ts"ttdt| t||| _t|| _d| _| j	dkrHd| _	dS )zb
        Sets the value of the string

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                NrB   )
r<   r   rC   r	   r   rG   r
   rH   rI   rJ   )r8   rK   r7   r7   r:   rM   ~   s    


zURI.setc             C   s
   | |k S )Nr7   )r8   r9   r7   r7   r:   r;      s    z
URI.__ne__c             C   s"   t |tsdS t| jt|jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4

        :param other:
            Another URI object

        :return:
            A boolean
        F)r<   rQ   r
   native)r8   r9   r7   r7   r:   r?      s    
z
URI.__eq__c             C   s,   | j dkrdS | jdkr&t| j | _| jS )z7
        :return:
            A unicode string
        N )rH   rG   r   _merge_chunks)r8   r7   r7   r:   r=      s
    

zURI.__unicode__N)rN   rO   rP   rM   r;   r?   r=   r7   r7   r7   r:   rQ   |   s   rQ   c               @   sN   e Zd ZdZdZedd Zejdd Zdd Zdd	 Z	d
d Z
dd ZdS )EmailAddressNFc             C   s   | j S )z`
        :return:
            A byte string of the DER-encoded contents of the sequence
        )	_contents)r8   r7   r7   r:   rH      s    zEmailAddress.contentsc             C   s   d| _ || _dS )ze
        :param value:
            A byte string of the DER-encoded contents of the sequence
        FN)_normalizedrV   )r8   rK   r7   r7   r:   rH      s    c             C   s   t |ts"ttdt| t||jdd
krZ|jdd\}}|jdd |jd }n
|jd}d| _|| _	|| _
d| _| jd	krd	| _dS )zb
        Sets the value of the string

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                @r   ascii   @r   TNrB   )r<   r   rC   r	   r   findrsplitrE   rW   rG   rH   rI   rJ   )r8   rK   mailboxhostnamerL   r7   r7   r:   rM      s    


zEmailAddress.setc             C   s^   | j dkrX| j }|jddkr.|jd| _ n*|jdd\}}|jdd |jd | _ | j S )z7
        :return:
            A unicode string
        NrZ   r   rY   rX   r   r[   )rG   rT   r\   decoder]   )r8   rH   r^   r_   r7   r7   r:   r=      s    
zEmailAddress.__unicode__c             C   s
   | |k S )Nr7   )r8   r9   r7   r7   r:   r;      s    zEmailAddress.__ne__c             C   s   t |tsdS | js | j| j |js2|j|j | jjddksR|jjddkr^| j|jkS |jjdd\}}| jjdd\}}||krdS |j |j krdS dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5

        :param other:
            Another EmailAddress object

        :return:
            A boolean
        FrZ   r   Tr[   r[   )	r<   rU   rW   rM   rR   rV   r\   r]   r>   )r8   r9   Zother_mailboxZother_hostnamer^   r_   r7   r7   r:   r?      s    
 zEmailAddress.__eq__)rN   rO   rP   rV   rW   propertyrH   setterrM   r=   r;   r?   r7   r7   r7   r:   rU      s   	
rU   c               @   s:   e Zd ZdddZdd Zedd Zdd	 Zd
d ZdS )	IPAddressNc             C   s   t tddS )z?
        This method is not applicable to IP addresses
        z=
            IP address values can not be parsed
            N)
ValueErrorr	   )r8   specZspec_paramsr7   r7   r:   parse"  s    zIPAddress.parsec       
      C   sT  t |ts"ttdt| t||}|jddk}d}|rv|jdd}|d }t|d }|dk rvttdt| |jddkrt	j
}|dkrttdt| d}n$t	j}|d	krttd
t| d	}d}|rd| }	|	d|t|	  7 }	tt|	d}d|d t|  | }|| _t||| | _| j| _d| _| jdkrPd| _dS )z
        Sets the value of the object

        :param value:
            A unicode string containing an IPv4 address, IPv4 address with CIDR,
            an IPv6 address or IPv6 address with CIDR
        zK
                %s value must be a unicode string, not %s
                /r   r   zT
                    %s value contains a CIDR range less than 0
                    :   z
                    %s value contains a CIDR range bigger than 128, the maximum
                    value for an IPv6 address
                        z
                    %s value contains a CIDR range bigger than 32, the maximum
                    value for an IPv4 address
                    rB   10          Nr[   r[   )r<   r   rC   r	   r   r\   splitintrd   socketAF_INET6AF_INETlenr1   _nativer4   rH   Z_bytesrI   rJ   )
r8   rK   original_valueZhas_cidrcidrpartsfamilyZ	cidr_sizeZ
cidr_bytesZ	cidr_maskr7   r7   r:   rM   -  sR    	
zIPAddress.setc             C   s   | j dkrdS | jdkr| j }t|}d}|tddgkrjttj|dd }|dkrt|dd }n<|tddgkrttj	|dd }|dkrt|dd }|dk	rdj
|}t|jd}|d	 t| }|| _| jS )
z
        The a native Python datatype representation of this value

        :return:
            A unicode string or None
        Nrj      r   ro      z{0:b}rl   rg   )rH   rv   	__bytes__ru   rM   r3   rr   rs   r2   rt   formatrstripr   )r8   Zbyte_stringZbyte_lenZcidr_intrK   Z	cidr_bitsrx   r7   r7   r:   rR   t  s(    	


zIPAddress.nativec             C   s
   | |k S )Nr7   )r8   r9   r7   r7   r:   r;     s    zIPAddress.__ne__c             C   s   t |tsdS | j |j kS )zl
        :param other:
            Another IPAddress object

        :return:
            A boolean
        F)r<   rc   r}   )r8   r9   r7   r7   r:   r?     s    	
zIPAddress.__eq__)NN)	rN   rO   rP   rf   rM   ra   rR   r;   r?   r7   r7   r7   r:   rc   !  s
   
Grc   c               @   s"   e Zd ZdefdedeifgZdS )	Attributetypevaluesre   N)rN   rO   rP   r!   r)   r   _fieldsr7   r7   r7   r:   r     s   r   c               @   s   e Zd ZeZdS )
AttributesN)rN   rO   rP   r   _child_specr7   r7   r7   r:   r     s   r   c            
   @   s$   e Zd Zddddddddd	d
	ZdS )KeyUsageZdigital_signatureZnon_repudiationZkey_enciphermentZdata_enciphermentZkey_agreementZkey_cert_signZcrl_signZencipher_onlyZdecipher_only)	r   r   rm      r|            ro   N)rN   rO   rP   _mapr7   r7   r7   r:   r     s   r   c               @   s,   e Zd ZdedddfdedddfgZdS )PrivateKeyUsagePeriod
not_beforer   T)implicitoptional	not_afterr   N)rN   rO   rP   r   r   r7   r7   r7   r:   r     s   r   c               @   s   e Zd ZdZdZdd ZdS )NotReallyTeletexStringa6  
    OpenSSL (and probably some other libraries) puts ISO-8859-1
    into TeletexString instead of ITU T.61. We use Windows-1252 when
    decoding since it is a superset of ISO-8859-1, and less likely to
    cause encoding issues, but we stay strict with encoding to prevent
    us from creating bad data.
    cp1252c             C   s0   | j dkrdS | jdkr*| j j| j| _| jS )z7
        :return:
            A unicode string
        NrS   )rH   rG   rT   r`   _decoding_encoding)r8   r7   r7   r:   r=     s
    

z"NotReallyTeletexString.__unicode__N)rN   rO   rP   __doc__r   r=   r7   r7   r7   r:   r     s   r   c               c   s   zdt _d V  W d dt _X d S )Nteletexr   )r   r   r7   r7   r7   r:   strict_teletex  s    
r   c               @   s4   e Zd ZdefdefdefdefdefdefgZ	dS )DirectoryStringteletex_stringprintable_stringZuniversal_stringutf8_string
bmp_string
ia5_stringN)
rN   rO   rP   r   r%   r+   r-   r   r   _alternativesr7   r7   r7   r:   r     s   r   c            "   @   s   e Zd Zddddddddd	d
dddddddddddddddddddddd d!d"!Zdddddddddddd	d
ddddddddddd d!dddddddg Zed#d$ Zed%d& Zd'S )(NameTypecommon_namesurnameserial_numbercountry_namelocality_namestate_or_province_namestreet_addressorganization_nameorganizational_unit_nametitlebusiness_categorypostal_codetelephone_numbername
given_nameinitialsgeneration_qualifierunique_identifierdn_qualifier	pseudonymorganization_identifiertpm_manufacturer	tpm_modeltpm_versionplatform_manufacturerplatform_modelplatform_versionemail_addressincorporation_localityincorporation_state_or_provinceincorporation_countrydomain_componentname_distinguisher)!z2.5.4.3z2.5.4.4z2.5.4.5z2.5.4.6z2.5.4.7z2.5.4.8z2.5.4.9z2.5.4.10z2.5.4.11z2.5.4.12z2.5.4.15z2.5.4.17z2.5.4.20z2.5.4.41z2.5.4.42z2.5.4.43z2.5.4.44z2.5.4.45z2.5.4.46z2.5.4.65z2.5.4.97z2.23.133.2.1z2.23.133.2.2z2.23.133.2.3z2.23.133.2.4z2.23.133.2.5z2.23.133.2.6z1.2.840.113549.1.9.1z1.3.6.1.4.1.311.60.2.1.1z1.3.6.1.4.1.311.60.2.1.2z1.3.6.1.4.1.311.60.2.1.3z0.9.2342.19200300.100.1.25z0.2.262.1.10.7.20c             C   s4   | j |}|| jkr"| jj|}n
t| j}||fS )z
        Returns an ordering value for a particular attribute key.

        Unrecognized attributes and OIDs will be sorted lexically at the end.

        :return:
            An orderable value.

        )mappreferred_orderindexru   )clsZ	attr_nameZordinalr7   r7   r:   preferred_ordinalB  s
    


zNameType.preferred_ordinalc          "   C   sT   ddddddddd	d
dddddddddddddddddddddd d!d"!j | j| jS )#zZ
        :return:
            A human-friendly unicode string to display to users
        zCommon NameZSurnamezSerial NumberCountryZLocalityzState/ProvincezStreet AddressZOrganizationzOrganizational UnitZTitlezBusiness CategoryzPostal CodezTelephone NumberNamez
Given NameZInitialszGeneration QualifierzUnique IdentifierzDN QualifierZ	PseudonymzEmail AddresszIncorporation LocalityzIncorporation State/ProvincezIncorporation CountryzDomain ComponentzName DistinguisherzOrganization IdentifierzTPM Manufacturerz	TPM ModelzTPM VersionzPlatform ManufacturerzPlatform ModelzPlatform Version)!r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )getrR   )r8   r7   r7   r:   human_friendlyV  sD    zNameType.human_friendlyN)	rN   rO   rP   r   r   classmethodr   ra   r   r7   r7   r7   r:   r     s   r   c            "   @   s   e Zd ZdefdefgZdZeeeeeeeeeeeeeeeeee	eee
eeeeeeeeeeeed!ZdZedd Zdd Zd	d
 Zdd ZdS )NameTypeAndValuer   rK   )!r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   Nc             C   s"   | j dkr| j| d j| _ | j S )z
        Returns the value after being processed by the internationalized string
        preparation as specified by RFC 5280

        :return:
            A unicode string
        NrK   )_prepped_ldap_string_preprR   )r8   r7   r7   r:   prepped_value  s    

zNameTypeAndValue.prepped_valuec             C   s
   | |k S )Nr7   )r8   r9   r7   r7   r:   r;     s    zNameTypeAndValue.__ne__c             C   s2   t |tsdS |d j| d jkr&dS |j| jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another NameTypeAndValue object

        :return:
            A boolean
        Fr   )r<   r   rR   r   )r8   r9   r7   r7   r:   r?     s
    
zNameTypeAndValue.__eq__c             C   s  t jdd|}t jdd|}tjdkr6t jdd|}nt jdd|}t jdd|}|jd	d}t jd
d|}djttj|}t	j
d|}x|D ]}tj|rttdtj|rttdtj|rttdtj|rttdtj|rttd|dkrttdqW d}d}x0|D ](}tj|r@d}ntj|r*d}q*W |rtj|d }tj|d }|s| s| rttddt jdd|j  d }|S )a"  
        Implements the internationalized string preparation algorithm from
        RFC 4518. https://tools.ietf.org/html/rfc4518#section-2

        :param string:
            A unicode string to prepare

        :return:
            A prepared unicode string, ready for comparison
        u   [­᠆͏᠋-᠍️-＀￼]+rS   u	   [	
] i  u   [-]|[-]|󠀁u   [𝅳-𝅺󠀠-󠁿󠀁]u?   [ ----۝܏᠎‌-‏‪-‮⁠-⁣⁪-⁯﻿￹-￻]+u   ​u   [   -  -   　]ZNFKCzc
                    X.509 Name objects may not contain unassigned code points
                    z
                    X.509 Name objects may not contain change display or
                    zzzzdeprecated characters
                    zc
                    X.509 Name objects may not contain private use characters
                    zf
                    X.509 Name objects may not contain non-character code points
                    zb
                    X.509 Name objects may not contain surrogate code points
                    u   �zf
                    X.509 Name objects may not contain the replacement character
                    FTr   r   z{
                    X.509 Name object contains a malformed bidirectional
                    sequence
                    z +z  r[   )resubsys
maxunicodereplacejoinr   
stringprepZmap_table_b2unicodedataZ	normalizeZin_table_a1rd   r	   Zin_table_c8Zin_table_c3Zin_table_c4Zin_table_c5Zin_table_d1Zin_table_d2strip)r8   stringcharZhas_r_and_al_catZ	has_l_catZfirst_is_r_and_alZlast_is_r_and_alr7   r7   r:   r     s^    







z"NameTypeAndValue._ldap_string_prep)r   rK   )rN   rO   rP   r   r   r   	_oid_pairr   r%   r"   rU   r5   r-   
_oid_specsr   ra   r   r;   r?   r   r7   r7   r7   r:   r     sR   
r   c               @   s<   e Zd ZeZedd Zdd Zdd Zdd Z	d	d
 Z
dS )RelativeDistinguishedNamec             C   sD   g }| j | }x*t|j D ]}|jd||| f  qW dj|S )zb
        :return:
            A unicode string that can be used as a dict key or in a set
        z%s: %s)_get_valuessortedkeysappendr   )r8   outputr   keyr7   r7   r:   hashableE  s
    
z"RelativeDistinguishedName.hashablec             C   s
   | |k S )Nr7   )r8   r9   r7   r7   r:   r;   U  s    z RelativeDistinguishedName.__ne__c             C   s|   t |tsdS t| t|kr"dS | j| }| j|}||krBdS | j| }| j|}x |D ]}|| || kr\dS q\W dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RelativeDistinguishedName object

        :return:
            A boolean
        FT)r<   r   ru   
_get_typesr   )r8   r9   Z
self_typesZother_typesZself_valuesZother_valuesZ
type_name_r7   r7   r:   r?   X  s    





z RelativeDistinguishedName.__eq__c             C   s   t dd |D S )z
        Returns a set of types contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A set object with unicode strings of NameTypeAndValue type field
            values
        c             S   s   g | ]}|d  j qS )r   )rR   ).0ntvr7   r7   r:   
<listcomp>  s    z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rM   )r8   rdnr7   r7   r:   r   x  s    z$RelativeDistinguishedName._get_typesc                s   i   fdd|D   S )a$  
        Returns a dict of prepped values contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A dict object with unicode strings of NameTypeAndValue value field
            values that have been prepped for comparison
        c                s$   g | ]} j |d  j|jfgqS )r   )updaterR   r   )r   r   )r   r7   r:   r     s    z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r7   )r8   r   r7   )r   r:   r     s    z%RelativeDistinguishedName._get_valuesN)rN   rO   rP   r   r   ra   r   r;   r?   r   r   r7   r7   r7   r:   r   B  s    r   c               @   s,   e Zd ZeZedd Zdd Zdd ZdS )RDNSequencec             C   s   dj dd | D S )zb
        :return:
            A unicode string that can be used as a dict key or in a set
        c             s   s   | ]}|j V  qd S )N)r   )r   r   r7   r7   r:   	<genexpr>  s    z'RDNSequence.hashable.<locals>.<genexpr>)r   )r8   r7   r7   r:   r     s    
zRDNSequence.hashablec             C   s
   | |k S )Nr7   )r8   r9   r7   r7   r:   r;     s    zRDNSequence.__ne__c             C   sL   t |tsdS t| t|kr"dS x$t| D ]\}}|| |kr,dS q,W dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RDNSequence object

        :return:
            A boolean
        FT)r<   r   ru   	enumerate)r8   r9   r   Zself_rdnr7   r7   r:   r?     s    
zRDNSequence.__eq__N)	rN   rO   rP   r   r   ra   r   r;   r?   r7   r7   r7   r:   r     s   r   c               @   s   e Zd ZdefgZdZdZdZedddZ	e
dd Zdd	 Zd
d Zdd Ze
dd Ze
dd Zdd Ze
dd Ze
dd ZdS )r   rS   NFc       	      C   s   g }|sd}t }nd}t}tt|j dd d}x|j D ]\}}tj|}|dkr`t|}nF|dkrrt|}n4|t	dd	d
gkrt
dt|d}nt
|||d}|jtt||dg q<W | dt|dS )aT  
        Creates a Name object from a dict of unicode string keys and values.
        The keys should be from NameType._map, or a dotted-integer OID unicode
        string.

        :param name_dict:
            A dict of name information, e.g. {"common_name": "Will Bond",
            "country_name": "US", "organization": "Codex Non Sufficit LC"}

        :param use_printable:
            A bool - if PrintableString should be used for encoding instead of
            UTF8String. This is for backwards compatibility with old software.

        :return:
            An x509.Name object
        r   r   c             S   s   t j| d S )Nr   )r   r   )itemr7   r7   r:   <lambda>  s    zName.build.<locals>.<lambda>)r   r   r   r   r   r   )r   rK   )r   rK   rS   )r-   r%   r   r   itemsr   r   rU   r5   rM   r   r   r   r   r   )	r   Z	name_dictZuse_printableZrdnsZencoding_nameZencoding_classattribute_nameZattribute_valuerK   r7   r7   r:   build  s8    


z
Name.buildc             C   s   | j jS )zb
        :return:
            A unicode string that can be used as a dict key or in a set
        )chosenr   )r8   r7   r7   r:   r     s    zName.hashablec             C   s
   t | jS )N)ru   r   )r8   r7   r7   r:   __len__  s    zName.__len__c             C   s
   | |k S )Nr7   )r8   r9   r7   r7   r:   r;     s    zName.__ne__c             C   s   t |tsdS | j|jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another Name object

        :return:
            A boolean
        F)r<   r   r   )r8   r9   r7   r7   r:   r?     s    
zName.__eq__c             C   s   | j d krt | _ xr| jjD ]f}x`|D ]X}|d }|| j krp| j | }t|ts`|g }| j |< |j|d  q&|d | j |< q&W qW | j S )Nr   rK   )rv   r   r   rR   r<   listr   )r8   r   type_val
field_nameexistingr7   r7   r:   rR   %  s    




zName.nativec             C   s  | j dkrt }d}x`| jD ]V}xP|D ]H}|d j}|}||krd|| g||< || j|d  q(|d ||< q(W qW g }|j }|dkrtt|}x0|D ](}|| }	| j|	}
|jd||
f  qW d}x |D ]}|j	ddkrd	}P qW |sd
nd}|j
|ddd | _ | j S )zg
        :return:
            A human-friendly unicode string containing the parts of the name
        Nr   rK   r   z%s: %sF,r   Tz, z; r[   r[   )_human_friendlyr   r   r   r   r   reversedr   _recursive_humanizer\   r   )r8   dataZ
last_fieldr   r   r   Zto_joinr   r   rK   Znative_valueZ	has_commaelementZ	separatorr7   r7   r:   r   5  s6    




zName.human_friendlyc                s,   t |tr&djt fdd|D S |jS )z
        Recursively serializes data compiled from the RDNSequence

        :param value:
            An Asn1Value object, or a list of Asn1Value objects

        :return:
            A unicode string
        z, c                s   g | ]} j |qS r7   )r   )r   Z	sub_value)r8   r7   r:   r   i  s    z,Name._recursive_humanize.<locals>.<listcomp>)r<   r   r   r   rR   )r8   rK   r7   )r8   r:   r   \  s    
zName._recursive_humanizec             C   s$   | j dkrtj| j j | _ | j S )zZ
        :return:
            The SHA1 hash of the DER-encoded bytes of this name
        N)_sha1hashlibsha1dumpdigest)r8   r7   r7   r:   r  m  s    
z	Name.sha1c             C   s$   | j dkrtj| j j | _ | j S )z]
        :return:
            The SHA-256 hash of the DER-encoded bytes of this name
        N)_sha256r  sha256r  r  )r8   r7   r7   r:   r  x  s    
zName.sha256)F)rN   rO   rP   r   r   r   r   r  r   r   ra   r   r   r;   r?   rR   r   r   r  r  r7   r7   r7   r:   r     s   
<	'r   c               @   s"   e Zd ZdefdeddifgZdS )AnotherNameZtype_idrK   explicitr   N)rN   rO   rP   r!   r   r   r7   r7   r7   r:   r    s   r  c               @   s$   e Zd ZdZdZdefdefgZdS )CountryNamer   x121_dcc_codeiso_3166_alpha2_codeN)rN   rO   rP   class_tagr    r%   r   r7   r7   r7   r:   r	    s   r	  c               @   s$   e Zd ZdZdZdefdefgZdS )AdministrationDomainNamer   rm   numeric	printableN)rN   rO   rP   r  r  r    r%   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZdefdefgZdS )PrivateDomainNamer  r  N)rN   rO   rP   r    r%   r   r7   r7   r7   r:   r    s   r  c               @   sF   e Zd Zdeddifdedddfded	ddfd
edddfgZdS )PersonalNamer   r   r   r   r   T)r   r   r   rm   r   r   N)rN   rO   rP   r%   r   r7   r7   r7   r:   r    s   r  c               @   sF   e Zd Zdeddifdedddfded	ddfd
edddfgZdS )TeletexPersonalNamer   r   r   r   r   T)r   r   r   rm   r   r   N)rN   rO   rP   r*   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )OrganizationalUnitNamesN)rN   rO   rP   r%   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )TeletexOrganizationalUnitNamesN)rN   rO   rP   r*   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd Zdeddifdeddifdedddfded	ddfd
edddfdedddfdedddfdedddfde	dddfg	Z
dS )BuiltInStandardAttributesr   r   TZadministration_domain_nameZnetwork_addressr   )r   r   Zterminal_identifierr   Zprivate_domain_namerm   )r  r   r   r   Znumeric_user_identifierr|   Zpersonal_namer   Zorganizational_unit_namesr   N)rN   rO   rP   r	  r  r    r%   r  r  r  r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZdefdefgZdS )BuiltInDomainDefinedAttributer   rK   N)rN   rO   rP   r%   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )BuiltInDomainDefinedAttributesN)rN   rO   rP   r  r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZdefdefgZdS )TeletexDomainDefinedAttributer   rK   N)rN   rO   rP   r*   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )TeletexDomainDefinedAttributesN)rN   rO   rP   r  r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZdefdefgZdS )PhysicalDeliveryCountryNamer
  r  N)rN   rO   rP   r    r%   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZdefdefgZdS )
PostalCodeZnumeric_codeZprintable_codeN)rN   rO   rP   r    r%   r   r7   r7   r7   r:   r    s   r  c               @   s(   e Zd ZdeddifdeddifgZdS )PDSParameterr   r   Tr   N)rN   rO   rP   r%   r*   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )PrintableAddressN)rN   rO   rP   r%   r   r7   r7   r7   r:   r    s   r  c               @   s(   e Zd ZdeddifdeddifgZdS )UnformattedPostalAddressZprintable_addressr   Tr   N)rN   rO   rP   r  r*   r   r7   r7   r7   r:   r    s   r  c               @   s*   e Zd ZdeddifdedddfgZdS )	E1634AddressZnumberr   r   Zsub_addressr   T)r   r   N)rN   rO   rP   r    r   r7   r7   r7   r:   r     s   r   c               @   s   e Zd ZeZdS )
NAddressesN)rN   rO   rP   r#   r   r7   r7   r7   r:   r!    s   r!  c               @   sF   e Zd Zdedddfdedddfdedddfd	ed
difgZdS )PresentationAddressZ
p_selectorr   T)r  r   Z
s_selectorr   Z
t_selectorrm   Zn_addressesr  r   N)rN   rO   rP   r#   r!  r   r7   r7   r7   r:   r"    s   r"  c               @   s"   e Zd ZdefdeddifgZdS )ExtendedNetworkAddressZe163_4_addressZpsap_addressr   r   N)rN   rO   rP   r   r"  r   r7   r7   r7   r:   r#    s   r#  c               @   s   e Zd ZdddddddZdS )	TerminalTypeZtelexr   Zg3_facsimileZg4_facsimileZia5_terminalZvideotex)r   r|   r   r   r   ro   N)rN   rO   rP   r   r7   r7   r7   r:   r$    s   r$  c               @   s@   e Zd Zddddddddd	d
ddddddddddddddZdS )ExtensionAttributeTyper   teletex_common_nameteletex_organization_nameteletex_personal_nameteletex_organization_unit_names!teletex_domain_defined_attributespds_namephysical_delivery_country_namer   physical_delivery_office_namephysical_delivery_office_numberextension_of_address_componentsphysical_delivery_personal_name#physical_delivery_organization_name.extension_physical_delivery_address_componentsunformatted_postal_addressr   post_office_box_addressposte_restante_addressunique_postal_namelocal_postal_attributesextended_network_addressterminal_type)r   rm   r   r|   r   r   r   ro   	   
                  r{         r6               N)rN   rO   rP   r   r7   r7   r7   r:   r%  *  s.   r%  c               @   s`   e Zd ZdeddifdeddifgZd	Zeeee	e
eeeeeeeeeeeeeeeeeedZdS )
ExtensionAttributeextension_attribute_typer   r   extension_attribute_valuer  r   )r   r&  r'  r(  r)  r*  r+  r,  r   r-  r.  r/  r0  r1  r2  r3  r   r4  r5  r6  r7  r8  r9  N)rH  rI  )rN   rO   rP   r%  r   r   r   r%   r*   r  r  r  r  r  r  r  r#  r$  r   r7   r7   r7   r:   rG  F  s4   rG  c               @   s   e Zd ZeZdS )ExtensionAttributesN)rN   rO   rP   rG  r   r7   r7   r7   r:   rJ  h  s   rJ  c               @   s.   e Zd ZdefdeddifdeddifgZdS )	ORAddressZbuilt_in_standard_attributesZ"built_in_domain_defined_attributesr   TZextension_attributesN)rN   rO   rP   r  r  rJ  r   r7   r7   r7   r:   rK  l  s   rK  c               @   s*   e Zd ZdedddfdeddifgZdS )	EDIPartyNameZname_assignerr   T)r   r   Z
party_namer   r   N)rN   rO   rP   r   r   r7   r7   r7   r:   rL  t  s   rL  c               @   s   e Zd Zdeddifdeddifdeddifdedd	ifd
eddifdeddifde	ddifde
ddifdeddifg	Zdd Zdd ZdS )GeneralName
other_namer   r   Zrfc822_namer   dns_namerm   x400_addressr   Zdirectory_namer  r|   edi_party_namer   uniform_resource_identifierr   
ip_addressr   Zregistered_idro   c             C   s
   | |k S )Nr7   )r8   r9   r7   r7   r:   r;     s    zGeneralName.__ne__c             C   sP   | j dkrttd| j |j dkr4ttd|j | j |j krDdS | j|jkS )	z
        Does not support other_name, x400_address or edi_party_name

        :param other:
            The other GeneralName to compare to

        :return:
            A boolean
        rN  rP  rQ  zr
                Comparison is not supported for GeneralName objects of
                choice %s
                za
                Comparison is not supported for GeneralName objects of choice
                %sF)rN  rP  rQ  )rN  rP  rQ  )r   rd   r	   r   )r8   r9   r7   r7   r:   r?     s    



zGeneralName.__eq__N)rN   rO   rP   r  rU   r5   rK  r   rL  rQ   rc   r!   r   r;   r?   r7   r7   r7   r:   rM  {  s   rM  c               @   s   e Zd ZeZdS )GeneralNamesN)rN   rO   rP   rM  r   r7   r7   r7   r:   rT    s   rT  c               @   s   e Zd ZdefdefgZdS )TimeZutc_timeZgeneral_timeN)rN   rO   rP   r,   r   r   r7   r7   r7   r:   rU    s   rU  c               @   s   e Zd ZdefdefgZdS )Validityr   r   N)rN   rO   rP   rU  r   r7   r7   r7   r:   rV    s   rV  c               @   s(   e Zd ZdeddifdeddifgZdS )BasicConstraintscadefaultFpath_len_constraintr   TN)rN   rO   rP   r   r   r   r7   r7   r7   r:   rW    s   rW  c               @   s:   e Zd ZdedddfdedddfdedddfgZd	S )
AuthorityKeyIdentifierkey_identifierr   T)r   r   authority_cert_issuerr   authority_cert_serial_numberrm   N)rN   rO   rP   r#   rT  r   r   r7   r7   r7   r:   r[    s   r[  c               @   s(   e Zd ZdeddifdeddifgZdS )DistributionPointName	full_namer   r   name_relative_to_crl_issuerr   N)rN   rO   rP   rT  r   r   r7   r7   r7   r:   r_    s   r_  c            
   @   s$   e Zd Zddddddddd	d
	ZdS )ReasonFlagsZunusedZkey_compromiseZca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZaa_compromise)	r   r   rm   r   r|   r   r   r   ro   N)rN   rO   rP   r   r7   r7   r7   r:   rb    s   rb  c               @   s2   e Zd ZdefdedddfdedddfgZd	S )
GeneralSubtreebaseZminimumr   )r   rY  Zmaximumr   T)r   r   N)rN   rO   rP   rM  r   r   r7   r7   r7   r:   rc    s   rc  c               @   s   e Zd ZeZdS )GeneralSubtreesN)rN   rO   rP   rc  r   r7   r7   r7   r:   re    s   re  c               @   s,   e Zd ZdedddfdedddfgZdS )NameConstraintsZpermitted_subtreesr   T)r   r   Zexcluded_subtreesr   N)rN   rO   rP   re  r   r7   r7   r7   r:   rf    s   rf  c               @   sJ   e Zd Zdedddfdedddfded	ddfgZd
Zedd Z	dS )DistributionPointdistribution_pointr   T)r  r   Zreasonsr   )r   r   Z
crl_issuerrm   Fc             C   sj   | j dkrdd| _ | d }|jdkr.ttdx4|jD ]*}|jdkr6|j}|j jdr6|| _ P q6W | j S )z_
        :return:
            None or a unicode string of the distribution point's URL
        FNrh  r`  z
                    CRL distribution points that are relative to the issuer are
                    not supported
                    rR  http://https://ldap://ldaps://)ri  rj  rk  rl  )_urlr   rd   r	   r   rR   r>   rD   )r8   r   general_nameurlr7   r7   r:   ro    s    


zDistributionPoint.urlN)
rN   rO   rP   r_  rb  rT  r   rm  ra   ro  r7   r7   r7   r:   rg    s
   rg  c               @   s   e Zd ZeZdS )CRLDistributionPointsN)rN   rO   rP   rg  r   r7   r7   r7   r:   rp    s   rp  c               @   s(   e Zd ZdefdefdefdefgZdS )DisplayTextr   Zvisible_stringr   r   N)rN   rO   rP   r   r.   r   r-   r   r7   r7   r7   r:   rq    s   rq  c               @   s   e Zd ZeZdS )NoticeNumbersN)rN   rO   rP   r   r   r7   r7   r7   r:   rr  (  s   rr  c               @   s   e Zd ZdefdefgZdS )NoticeReferenceZorganizationZnotice_numbersN)rN   rO   rP   rq  rr  r   r7   r7   r7   r:   rs  ,  s   rs  c               @   s(   e Zd ZdeddifdeddifgZdS )
UserNoticeZ
notice_refr   TZexplicit_textN)rN   rO   rP   rs  rq  r   r7   r7   r7   r:   rt  3  s   rt  c               @   s   e Zd ZdddZdS )PolicyQualifierId certification_practice_statementuser_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2N)rN   rO   rP   r   r7   r7   r7   r:   ru  :  s   ru  c               @   s*   e Zd ZdefdefgZdZeedZ	dS )PolicyQualifierInfopolicy_qualifier_id	qualifier)rv  rw  N)ry  rz  )
rN   rO   rP   ru  r   r   r   r   rt  r   r7   r7   r7   r:   rx  A  s
   
rx  c               @   s   e Zd ZeZdS )PolicyQualifierInfosN)rN   rO   rP   rx  r   r7   r7   r7   r:   r{  N  s   r{  c               @   s   e Zd ZddiZdS )PolicyIdentifierz2.5.29.32.0Z
any_policyN)rN   rO   rP   r   r7   r7   r7   r:   r|  R  s   r|  c               @   s"   e Zd ZdefdeddifgZdS )PolicyInformationZpolicy_identifierZpolicy_qualifiersr   TN)rN   rO   rP   r|  r{  r   r7   r7   r7   r:   r}  X  s   r}  c               @   s   e Zd ZeZdS )CertificatePoliciesN)rN   rO   rP   r}  r   r7   r7   r7   r:   r~  _  s   r~  c               @   s   e Zd ZdefdefgZdS )PolicyMappingZissuer_domain_policyZsubject_domain_policyN)rN   rO   rP   r|  r   r7   r7   r7   r:   r  c  s   r  c               @   s   e Zd ZeZdS )PolicyMappingsN)rN   rO   rP   r  r   r7   r7   r7   r:   r  j  s   r  c               @   s,   e Zd ZdedddfdedddfgZdS )PolicyConstraintsZrequire_explicit_policyr   T)r   r   Zinhibit_policy_mappingr   N)rN   rO   rP   r   r   r7   r7   r7   r:   r  n  s   r  c            U   @   s   e Zd Zddddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUTZdVS )WKeyPurposeIdZany_extended_key_usageZserver_authZclient_authZcode_signingZemail_protectionZipsec_end_systemZipsec_tunnelZ
ipsec_usertime_stampingZocsp_signingZdvcsZeap_over_pppZeap_over_lanZscvp_serverZscvp_clientZ	ipsec_ikeZ	capwap_acZ
capwap_wtpZ
sip_domainZsecure_shell_clientZsecure_shell_serverZsend_routerZsend_proxied_routerZ
send_ownerZsend_proxied_ownerZcmc_caZcmc_raZcmc_archiveZbgpspec_routerZmicrosoft_trust_list_signingZmicrosoft_time_stamp_signingZmicrosoft_server_gatedZmicrosoft_serializedZmicrosoft_efsZmicrosoft_efs_recoveryZmicrosoft_whqlZmicrosoft_nt5Zmicrosoft_oem_whqlZmicrosoft_embedded_ntZmicrosoft_root_list_signerZ!microsoft_qualified_subordinationZmicrosoft_key_recoveryZmicrosoft_document_signingZmicrosoft_lifetime_signingZ microsoft_mobile_device_softwareZmicrosoft_smart_card_logonZapple_x509_basicZ	apple_sslZapple_local_cert_genZapple_csr_genZapple_revocation_crlZapple_revocation_ocspZapple_smimeZ	apple_eapZapple_software_update_signingZapple_ipsecZapple_ichatZapple_resource_signingZapple_pkinit_clientZapple_pkinit_serverZapple_code_signingZapple_package_signingZapple_id_validationZapple_time_stampingZapple_revocationZapple_passbook_signingZapple_mobile_storeZapple_escrow_serviceZapple_profile_signerZapple_qa_profile_signerZapple_test_mobile_storeZapple_otapki_signerZapple_test_otapki_signerZ)apple_id_validation_record_signing_policyZapple_smp_encryptionZapple_test_smp_encryptionZapple_server_authenticationZapple_pcs_escrow_serviceZpiv_card_authenticationZpiv_content_signingZpkinit_kpclientauthZpkinit_kpkdcZadobe_authentic_documents_trustZfpki_pivi_content_signing)Tz2.5.29.37.0z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2z1.3.6.1.5.5.7.3.3z1.3.6.1.5.5.7.3.4z1.3.6.1.5.5.7.3.5z1.3.6.1.5.5.7.3.6z1.3.6.1.5.5.7.3.7z1.3.6.1.5.5.7.3.8z1.3.6.1.5.5.7.3.9z1.3.6.1.5.5.7.3.10z1.3.6.1.5.5.7.3.13z1.3.6.1.5.5.7.3.14z1.3.6.1.5.5.7.3.15z1.3.6.1.5.5.7.3.16z1.3.6.1.5.5.7.3.17z1.3.6.1.5.5.7.3.18z1.3.6.1.5.5.7.3.19z1.3.6.1.5.5.7.3.20z1.3.6.1.5.5.7.3.21z1.3.6.1.5.5.7.3.22z1.3.6.1.5.5.7.3.23z1.3.6.1.5.5.7.3.24z1.3.6.1.5.5.7.3.25z1.3.6.1.5.5.7.3.26z1.3.6.1.5.5.7.3.27z1.3.6.1.5.5.7.3.28z1.3.6.1.5.5.7.3.29z1.3.6.1.5.5.7.3.30z1.3.6.1.4.1.311.10.3.1z1.3.6.1.4.1.311.10.3.2z1.3.6.1.4.1.311.10.3.3z1.3.6.1.4.1.311.10.3.3.1z1.3.6.1.4.1.311.10.3.4z1.3.6.1.4.1.311.10.3.4.1z1.3.6.1.4.1.311.10.3.5z1.3.6.1.4.1.311.10.3.6z1.3.6.1.4.1.311.10.3.7z1.3.6.1.4.1.311.10.3.8z1.3.6.1.4.1.311.10.3.9z1.3.6.1.4.1.311.10.3.10z1.3.6.1.4.1.311.10.3.11z1.3.6.1.4.1.311.10.3.12z1.3.6.1.4.1.311.10.3.13z1.3.6.1.4.1.311.10.3.14z1.3.6.1.4.1.311.20.2.2z1.2.840.113635.100.1.2z1.2.840.113635.100.1.3z1.2.840.113635.100.1.4z1.2.840.113635.100.1.5z1.2.840.113635.100.1.6z1.2.840.113635.100.1.7z1.2.840.113635.100.1.8z1.2.840.113635.100.1.9z1.2.840.113635.100.1.10z1.2.840.113635.100.1.11z1.2.840.113635.100.1.12z1.2.840.113635.100.1.13z1.2.840.113635.100.1.14z1.2.840.113635.100.1.15z1.2.840.113635.100.1.16z1.2.840.113635.100.1.17z1.2.840.113635.100.1.18z1.2.840.113635.100.1.20z1.2.840.113635.100.1.21z1.2.840.113635.100.1.22z1.2.840.113635.100.1.23z1.2.840.113635.100.1.24z1.2.840.113635.100.1.25z1.2.840.113635.100.1.26z1.2.840.113635.100.1.27z1.2.840.113635.100.1.28z1.2.840.113635.100.1.29z1.2.840.113625.100.1.30z1.2.840.113625.100.1.31z1.2.840.113625.100.1.32z1.2.840.113635.100.1.33z1.2.840.113635.100.1.34z2.16.840.1.101.3.6.8z2.16.840.1.101.3.6.7z1.3.6.1.5.2.3.4z1.3.6.1.5.2.3.5z1.2.840.113583.1.1.5z2.16.840.1.101.3.8.7N)rN   rO   rP   r   r7   r7   r7   r:   r  u  s   r  c               @   s   e Zd ZeZdS )ExtKeyUsageSyntaxN)rN   rO   rP   r  r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZdddddZdS )AccessMethodocspZ
ca_issuersr  Zca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5N)rN   rO   rP   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZdefdefgZdS )AccessDescriptionaccess_methodaccess_locationN)rN   rO   rP   r  rM  r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )AuthorityInfoAccessSyntaxN)rN   rO   rP   r  r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )SubjectInfoAccessSyntaxN)rN   rO   rP   r  r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )FeaturesN)rN   rO   rP   r   r   r7   r7   r7   r:   r     s   r  c               @   s   e Zd ZdefdefgZdS )EntrustVersionInfoZentrust_versZentrust_info_flagsN)rN   rO   rP   r   r   r   r7   r7   r7   r:   r    s   r  c            	   @   s"   e Zd Zddddddddd	Zd
S )NetscapeCertificateTypeZ
ssl_clientZ
ssl_serverZemailZobject_signingZreservedZssl_caZemail_caZobject_signing_ca)r   r   rm   r   r|   r   r   r   N)rN   rO   rP   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZddddZdS )Versionv1Zv2Zv3)r   r   rm   N)rN   rO   rP   r   r7   r7   r7   r:   r    s   r  c               @   s"   e Zd ZdefdefdefgZdS )TPMSpecificationrz   levelrevisionN)rN   rO   rP   r-   r   r   r7   r7   r7   r:   r     s   r  c               @   s   e Zd ZeZdS )SetOfTPMSpecificationN)rN   rO   rP   r  r   r7   r7   r7   r:   r  (  s   r  c               @   s"   e Zd ZdefdefdefgZdS )TCGSpecificationVersionZmajor_versionZminor_versionr  N)rN   rO   rP   r   r   r7   r7   r7   r:   r  ,  s   r  c               @   s   e Zd ZdefdefgZdS )TCGPlatformSpecificationversionZplatform_classN)rN   rO   rP   r  r#   r   r7   r7   r7   r:   r  4  s   r  c               @   s   e Zd ZeZdS )SetOfTCGPlatformSpecificationN)rN   rO   rP   r  r   r7   r7   r7   r:   r  ;  s   r  c               @   s   e Zd ZdddddZdS )EKGenerationTypeZinternalZinjectedZinternal_revocableZinjected_revocable)r   r   rm   r   N)rN   rO   rP   r   r7   r7   r7   r:   r  ?  s   r  c               @   s   e Zd ZddddZdS )EKGenerationLocationr   r   ek_cert_signer)r   r   rm   N)rN   rO   rP   r   r7   r7   r7   r:   r  H  s   r  c               @   s   e Zd ZddddZdS )EKCertificateGenerationLocationr   r   r  )r   r   rm   N)rN   rO   rP   r   r7   r7   r7   r:   r  P  s   r  c               @   s    e Zd ZddddddddZd	S )
EvaluationAssuranceLevellevel1level2level3level4Zlevel5Zlevel6Zlevel7)r   rm   r   r|   r   r   r   N)rN   rO   rP   r   r7   r7   r7   r:   r  X  s   r  c               @   s   e Zd ZddddZdS )EvaluationStatusZdesigned_to_meetZevaluation_in_progressZevaluation_completed)r   r   rm   N)rN   rO   rP   r   r7   r7   r7   r:   r  d  s   r  c               @   s   e Zd ZddddZdS )StrengthOfFunctionZbasicZmediumZhigh)r   r   rm   N)rN   rO   rP   r   r7   r7   r7   r:   r  l  s   r  c               @   s.   e Zd ZdefdeddifdeddifgZdS )URIReferencerR  Zhash_algorithmr   TZ
hash_valueN)rN   rO   rP   r   r   r   r   r7   r7   r7   r:   r  t  s   r  c               @   st   e Zd Zdefdefdefdeddifdedd	d
fdedd	d
fde	dd	d
fdedd	d
fde	dd	d
fg	Z
dS )CommonCriteriaMeasuresr  Zassurance_levelZevaluation_statusplusrY  FZstrengh_of_functionr   T)r   r   Zprofile_oidr   Zprofile_urlrm   Z
target_oidr   Z
target_urir|   N)rN   rO   rP   r   r  r  r   r  r!   r  r   r7   r7   r7   r:   r  |  s   r  c               @   s   e Zd ZdddddZdS )SecurityLevelr  r  r  r  )r   rm   r   r|   N)rN   rO   rP   r   r7   r7   r7   r:   r    s   r  c               @   s(   e Zd ZdefdefdeddifgZdS )	FIPSLevelr  r  r  rY  FN)rN   rO   rP   r   r  r   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd Zdeddifdeddifdeddd	fd
eddd	fdeddd	fdeddd	fde	ddd	fdedddfde
ddifg	ZdS )TPMSecurityAssertionsr  rY  r  Zfield_upgradableFZek_generation_typer   T)r   r   Zek_generation_locationr   Z"ek_certificate_generation_locationrm   Zcc_infor   Z
fips_levelr|   Ziso_9000_certifiedr   )r   rY  Ziso_9000_urir   N)rN   rO   rP   r  r   r  r  r  r  r  r   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )SetOfTPMSecurityAssertionsN)rN   rO   rP   r  r   r7   r7   r7   r:   r    s   r  c               @   s&   e Zd Zddddddddd	d
d
ZdS )SubjectDirectoryAttributeIdsupported_algorithmstpm_specificationtcg_platform_specificationtpm_security_assertionspda_date_of_birthpda_place_of_birth
pda_genderpda_country_of_citizenshippda_country_of_residenceZentrust_user_role)
z2.5.4.52z2.23.133.2.16z2.23.133.2.17z2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29N)rN   rO   rP   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )SetOfGeneralizedTimeN)rN   rO   rP   r   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )SetOfDirectoryStringN)rN   rO   rP   r   r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )SetOfPrintableStringN)rN   rO   rP   r%   r   r7   r7   r7   r:   r    s   r  c               @   s2   e Zd ZdefdedddfdedddfgZdS )	SupportedAlgorithmZalgorithm_identifierZintended_usager   T)r  r   Zintended_certificate_policiesr   N)rN   rO   rP   r   r   r~  r   r7   r7   r7   r:   r    s   r  c               @   s   e Zd ZeZdS )SetOfSupportedAlgorithmN)rN   rO   rP   r  r   r7   r7   r7   r:   r    s   r  c            
   @   sH   e Zd ZdefdefgZdZeee	e
eeeeed	Zdd ZdeiZdS )SubjectDirectoryAttributer   r   )	r  r  r  r  r  r  r  r  r  c             C   s"   | d j }|| jkr| j| S tS )Nr   )rR   r   r)   )r8   Ztype_r7   r7   r:   _values_spec  s    


z&SubjectDirectoryAttribute._values_specN)r   r   )rN   rO   rP   r  r   r   r   r  r  r  r  r  r  r  r   r  Z_spec_callbacksr7   r7   r7   r:   r    s   
r  c               @   s   e Zd ZeZdS )SubjectDirectoryAttributesN)rN   rO   rP   r  r   r7   r7   r7   r:   r    s   r  c               @   s@   e Zd Zddddddddd	d
ddddddddddddddZdS )ExtensionIdsubject_directory_attributesr\  	key_usageprivate_key_usage_periodsubject_alt_nameissuer_alt_namebasic_constraintsname_constraintscrl_distribution_pointscertificate_policiespolicy_mappingsauthority_key_identifierpolicy_constraintsextended_key_usagefreshest_crlinhibit_any_policyauthority_information_accesssubject_information_accesstls_featureocsp_no_checkentrust_version_extensionnetscape_certificate_type!signed_certificate_timestamp_list)z2.5.29.9z	2.5.29.14z	2.5.29.15z	2.5.29.16z	2.5.29.17z	2.5.29.18z	2.5.29.19z	2.5.29.30z	2.5.29.31z	2.5.29.32z	2.5.29.33z	2.5.29.35z	2.5.29.36z	2.5.29.37z	2.5.29.46z	2.5.29.54z1.3.6.1.5.5.7.1.1z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2N)rN   rO   rP   r   r7   r7   r7   r:   r    s.   r  c               @   s`   e Zd ZdefdeddifdefgZdZee	e
eeeeeeeeeeeeeeeeeeee	dZdS )		Extensionextn_idcriticalrY  F
extn_value)r  r\  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  N)r  r  )rN   rO   rP   r  r   r$   r   r   r  r#   r   r   rT  rW  rf  rp  r~  r  r[  r  r  r   r  r  r  r   r  r  r   r7   r7   r7   r:   r    s6   
r  c               @   s   e Zd ZeZdS )
ExtensionsN)rN   rO   rP   r  r   r7   r7   r7   r:   r  ;  s   r  c               @   sl   e Zd Zdedddfdefdefdefdefd	efd
efde	dddfde	dddfde
dddfg
ZdS )TbsCertificater  r   r  )r  rY  r   	signatureissuerZvaliditysubjectsubject_public_key_infoZissuer_unique_idr   T)r   r   Zsubject_unique_idrm   
extensionsr   )r  r   N)rN   rO   rP   r  r   r   r   rV  r0   r"   r  r   r7   r7   r7   r:   r  ?  s   r  c               @   s  e Zd ZdefdefdefgZdZdZdZ	dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dd Z'e(dd	 Z)e(d
d Z*e(dd Z+e(dd Z,e(dd Z-e(dd Z.e(dd Z/e(dd Z0e(dd Z1e(dd Z2e(dd Z3e(dd Z4e(d d! Z5e(d"d# Z6e(d$d% Z7e(d&d' Z8e(d(d) Z9e(d*d+ Z:e(d,d- Z;e(d.d/ Z<e(d0d1 Z=e(d2d3 Z>e(d4d5 Z?e(d6d7 Z@e(d8d9 ZAe(d:d; ZBe(d<d= ZCe(d>d? ZDe(d@dA ZEe(dBdC ZFe(dDdE ZGe(dFdG ZHe(dHdI ZIe(dJdK ZJdLdM ZKe(dNdO ZLe(dPdQ ZMe(dRdS ZNe(dTdU ZOe(dVdW ZPe(dXdY ZQe(dZd[ ZRe(d\d] ZSe(d^d_ ZTe(d`da ZUe(dbdc ZVddde ZWdfdg ZXdhdi ZYdS )jCertificatetbs_certificatesignature_algorithmsignature_valueFNc             C   sl   t  | _xX| d d D ]H}|d j}d| }t| |rHt| ||d j |d jr| jj| qW d| _dS )	zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r  r  r  z	_%s_valuer  r  TN)rM   _critical_extensionsrR   hasattrsetattrZparsedadd_processed_extensions)r8   	extensionr   r   r7   r7   r:   _set_extensionsv  s    


zCertificate._set_extensionsc             C   s   | j s| j  | jS )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r  r  r  )r8   r7   r7   r:   critical_extensions  s    
zCertificate.critical_extensionsc             C   s   | j s| j  | jS )z
        This extension is used to constrain the period over which the subject
        private key may be used

        :return:
            None or a PrivateKeyUsagePeriod object
        )r  r  _private_key_usage_period_value)r8   r7   r7   r:   private_key_usage_period_value  s    
z*Certificate.private_key_usage_period_valuec             C   s   | j s| j  | jS )z
        This extension is used to contain additional identification attributes
        about the subject.

        :return:
            None or a SubjectDirectoryAttributes object
        )r  r  _subject_directory_attributes)r8   r7   r7   r:   "subject_directory_attributes_value  s    
z.Certificate.subject_directory_attributes_valuec             C   s   | j s| j  | jS )z
        This extension is used to help in creating certificate validation paths.
        It contains an identifier that should generally, but is not guaranteed
        to, be unique.

        :return:
            None or an OctetString object
        )r  r  _key_identifier_value)r8   r7   r7   r:   key_identifier_value  s    z Certificate.key_identifier_valuec             C   s   | j s| j  | jS )z
        This extension is used to define the purpose of the public key
        contained within the certificate.

        :return:
            None or a KeyUsage
        )r  r  _key_usage_value)r8   r7   r7   r:   key_usage_value  s    
zCertificate.key_usage_valuec             C   s   | j s| j  | jS )aT  
        This extension allows for additional names to be associate with the
        subject of the certificate. While it may contain a whole host of
        possible names, it is usually used to allow certificates to be used
        with multiple different domain names.

        :return:
            None or a GeneralNames object
        )r  r  _subject_alt_name_value)r8   r7   r7   r:   subject_alt_name_value  s    z"Certificate.subject_alt_name_valuec             C   s   | j s| j  | jS )z
        This extension allows associating one or more alternative names with
        the issuer of the certificate.

        :return:
            None or an x509.GeneralNames object
        )r  r  _issuer_alt_name_value)r8   r7   r7   r:   issuer_alt_name_value  s    
z!Certificate.issuer_alt_name_valuec             C   s   | j s| j  | jS )a'  
        This extension is used to determine if the subject of the certificate
        is a CA, and if so, what the maximum number of intermediate CA certs
        after this are, before an end-entity certificate is found.

        :return:
            None or a BasicConstraints object
        )r  r  _basic_constraints_value)r8   r7   r7   r:   basic_constraints_value  s    z#Certificate.basic_constraints_valuec             C   s   | j s| j  | jS )z
        This extension is used in CA certificates, and is used to limit the
        possible names of certificates issued.

        :return:
            None or a NameConstraints object
        )r  r  _name_constraints_value)r8   r7   r7   r:   name_constraints_value  s    
z"Certificate.name_constraints_valuec             C   s   | j s| j  | jS )z
        This extension is used to help in locating the CRL for this certificate.

        :return:
            None or a CRLDistributionPoints object
            extension
        )r  r  _crl_distribution_points_value)r8   r7   r7   r:   crl_distribution_points_value
	  s    
z)Certificate.crl_distribution_points_valuec             C   s   | j s| j  | jS )a;  
        This extension defines policies in CA certificates under which
        certificates may be issued. In end-entity certificates, the inclusion
        of a policy indicates the issuance of the certificate follows the
        policy.

        :return:
            None or a CertificatePolicies object
        )r  r  _certificate_policies_value)r8   r7   r7   r:   certificate_policies_value	  s    z&Certificate.certificate_policies_valuec             C   s   | j s| j  | jS )z
        This extension allows mapping policy OIDs to other OIDs. This is used
        to allow different policies to be treated as equivalent in the process
        of validation.

        :return:
            None or a PolicyMappings object
        )r  r  _policy_mappings_value)r8   r7   r7   r:   policy_mappings_value(	  s    z!Certificate.policy_mappings_valuec             C   s   | j s| j  | jS )z
        This extension helps in identifying the public key with which to
        validate the authenticity of the certificate.

        :return:
            None or an AuthorityKeyIdentifier object
        )r  r  _authority_key_identifier_value)r8   r7   r7   r:   authority_key_identifier_value7	  s    
z*Certificate.authority_key_identifier_valuec             C   s   | j s| j  | jS )z
        This extension is used to control if policy mapping is allowed and
        when policies are required.

        :return:
            None or a PolicyConstraints object
        )r  r  _policy_constraints_value)r8   r7   r7   r:   policy_constraints_valueE	  s    
z$Certificate.policy_constraints_valuec             C   s   | j s| j  | jS )z
        This extension is used to help locate any available delta CRLs

        :return:
            None or an CRLDistributionPoints object
        )r  r  _freshest_crl_value)r8   r7   r7   r:   freshest_crl_valueS	  s    	zCertificate.freshest_crl_valuec             C   s   | j s| j  | jS )z
        This extension is used to prevent mapping of the any policy to
        specific requirements

        :return:
            None or a Integer object
        )r  r  _inhibit_any_policy_value)r8   r7   r7   r:   inhibit_any_policy_value`	  s    
z$Certificate.inhibit_any_policy_valuec             C   s   | j s| j  | jS )z
        This extension is used to define additional purposes for the public key
        beyond what is contained in the basic constraints.

        :return:
            None or an ExtKeyUsageSyntax object
        )r  r  _extended_key_usage_value)r8   r7   r7   r:   extended_key_usage_valuen	  s    
z$Certificate.extended_key_usage_valuec             C   s   | j s| j  | jS )z
        This extension is used to locate the CA certificate used to sign this
        certificate, or the OCSP responder for this certificate.

        :return:
            None or an AuthorityInfoAccessSyntax object
        )r  r  #_authority_information_access_value)r8   r7   r7   r:   "authority_information_access_value|	  s    
z.Certificate.authority_information_access_valuec             C   s   | j s| j  | jS )z
        This extension is used to access information about the subject of this
        certificate.

        :return:
            None or a SubjectInfoAccessSyntax object
        )r  r  !_subject_information_access_value)r8   r7   r7   r:    subject_information_access_value	  s    
z,Certificate.subject_information_access_valuec             C   s   | j s| j  | jS )z
        This extension is used to list the TLS features a server must respond
        with if a client initiates a request supporting them.

        :return:
            None or a Features object
        )r  r  _tls_feature_value)r8   r7   r7   r:   tls_feature_value	  s    
zCertificate.tls_feature_valuec             C   s   | j s| j  | jS )a-  
        This extension is used on certificates of OCSP responders, indicating
        that revocation information for the certificate should never need to
        be verified, thus preventing possible loops in path validation.

        :return:
            None or a Null object (if present)
        )r  r  _ocsp_no_check_value)r8   r7   r7   r:   ocsp_no_check_value	  s    zCertificate.ocsp_no_check_valuec             C   s
   | d j S )zE
        :return:
            A byte string of the signature
        r  )rR   )r8   r7   r7   r:   r  	  s    zCertificate.signaturec             C   s
   | d j S )zj
        :return:
            A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
        r  )signature_algo)r8   r7   r7   r:   r  	  s    zCertificate.signature_algoc             C   s
   | d j S )z
        :return:
            A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
            "sha384", "sha512", "sha512_224", "sha512_256"
        r  )	hash_algo)r8   r7   r7   r:   r  	  s    zCertificate.hash_algoc             C   s   | d d S )zT
        :return:
            The PublicKeyInfo object for this certificate
        r  r  r7   )r8   r7   r7   r:   
public_key	  s    zCertificate.public_keyc             C   s   | d d S )zZ
        :return:
            The Name object for the subject of this certificate
        r  r  r7   )r8   r7   r7   r:   r  	  s    zCertificate.subjectc             C   s   | d d S )zY
        :return:
            The Name object for the issuer of this certificate
        r  r  r7   )r8   r7   r7   r:   r  	  s    zCertificate.issuerc             C   s   | d d j S )zT
        :return:
            An integer of the certificate's serial number
        r  r   )rR   )r8   r7   r7   r:   r   	  s    zCertificate.serial_numberc             C   s   | j s
dS | j jS )z
        :return:
            None or a byte string of the certificate's key identifier from the
            key identifier extension
        N)r  rR   )r8   r7   r7   r:   r\  	  s    zCertificate.key_identifierc             C   s.   | j dkr(| jjd t| jjd | _ | j S )z
        :return:
            A byte string of the SHA-256 hash of the issuer concatenated with
            the ascii character ":", concatenated with the serial number as
            an ascii string
        N   :rY   )_issuer_serialr  r  r   r   rE   )r8   r7   r7   r:   issuer_serial
  s    	
zCertificate.issuer_serialc             C   s   | j s
dS | j d jS )z
        :return:
            None or a byte string of the key_identifier from the authority key
            identifier extension
        Nr\  )r  rR   )r8   r7   r7   r:   r  
  s    z$Certificate.authority_key_identifierc             C   sj   | j dkrd| j}|r^|d jr^| jd d j}|j }| jd j}|jd t|jd | _ nd| _ | j S )a;  
        :return:
            None or a byte string of the SHA-256 hash of the isser from the
            authority key identifier extension concatenated with the ascii
            character ":", concatenated with the serial number from the
            authority key identifier extension as an ascii string
        Fr]  r   r^  r  rY   N)_authority_issuer_serialr  rR   r   Zuntagr  r   rE   )r8   Zakivr  Zauthority_serialr7   r7   r:   authority_issuer_serial
  s    

z#Certificate.authority_issuer_serialc             C   s   | j dkr| j| j| _ | j S )z
        Returns complete CRL URLs - does not include delta CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_crl_distribution_points!_get_http_crl_distribution_pointsr  )r8   r7   r7   r:   r  2
  s    	
z#Certificate.crl_distribution_pointsc             C   s   | j dkr| j| j| _ | j S )z
        Returns delta CRL URLs - does not include complete CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_delta_crl_distribution_pointsr  r  )r8   r7   r7   r:   delta_crl_distribution_points?
  s    	
z)Certificate.delta_crl_distribution_pointsc             C   sd   g }|dkrg S xN|D ]F}|d }|t kr,q|jdkr8qx"|jD ]}|jdkr@|j| q@W qW |S )a?  
        Fetches the DistributionPoint object for non-relative, HTTP CRLs
        referenced by the certificate

        :param crl_distribution_points:
            A CRLDistributionPoints object to grab the DistributionPoints from

        :return:
            A list of zero or more DistributionPoint objects
        Nrh  ra  rR  )r/   r   r   r   )r8   r  r   rh  Zdistribution_point_namern  r7   r7   r:   r  L
  s    


z-Certificate._get_http_crl_distribution_pointsc             C   sb   | j s
g S g }xN| j D ]D}|d jdkr|d }|jdkr<q|j}|j jd	r|j| qW |S )
zx
        :return:
            A list of zero or more unicode strings of the OCSP URLs for this
            cert
        r  r  r  rR  http://https://ldap://ldaps://)r  r   r!  r"  )r  rR   r   r>   rD   r   )r8   r   entrylocationro  r7   r7   r:   	ocsp_urlsk
  s    
zCertificate.ocsp_urlsc             C   s   | j dkrg | _ | jrLx| jD ](}|jdkr|j| j kr| j j|j qW nXtjd}xL| jjD ]@}x:|D ]2}|d jdkrj|d j}|j	|rj| j j| qjW q`W | j S )z
        :return:
            A list of unicode strings of valid domain names for the certificate.
            Wildcard certificates will have a domain in the form: *.example.com
        NrO  zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r   r   rK   )
_valid_domainsr  r   rR   r   r   compiler  r   match)r8   rn  patternr   Zname_type_valuerK   r7   r7   r:   valid_domains
  s    




zCertificate.valid_domainsc             C   sD   | j dkr>g | _ | jr>x&| jD ]}|jdkr| j j|j qW | j S )zj
        :return:
            A list of unicode strings of valid IP addresses for the certificate
        NrS  )
_valid_ipsr  r   r   rR   )r8   rn  r7   r7   r:   	valid_ips
  s    

zCertificate.valid_ipsc             C   s   | j o| j d jS )zW
        :return;
            A boolean - if the certificate is marked as a CA
        rX  )r  rR   )r8   r7   r7   r:   rX  
  s    zCertificate.cac             C   s   | j s
dS | jd jS )zT
        :return;
            None or an integer of the maximum path length
        NrZ  )rX  r  rR   )r8   r7   r7   r:   max_path_length
  s    zCertificate.max_path_lengthc             C   s   | j dkr| j| jk| _ | j S )zx
        :return:
            A boolean - if the certificate is self-issued, as defined by RFC
            5280
        N)_self_issuedr  r  )r8   r7   r7   r:   self_issued
  s    
zCertificate.self_issuedc             C   sJ   | j dkrDd| _ | jrD| jr>| js*d| _ qD| j| jkrDd| _ nd| _ | j S )a  
        :return:
            A unicode string of "no" or "maybe". The "maybe" result will
            be returned if the certificate issuer and subject are the same.
            If a key identifier and authority key identifier are present,
            they will need to match otherwise "no" will be returned.

            To verify is a certificate is truly self-signed, the signature
            will need to be verified. See the certvalidator package for
            one possible solution.
        Nnomaybe)_self_signedr/  r\  r  )r8   r7   r7   r:   self_signed
  s    
zCertificate.self_signedc             C   s$   | j dkrtj| j j | _ | j S )zk
        :return:
            The SHA-1 hash of the DER-encoded bytes of this complete certificate
        N)r   r  r  r  r  )r8   r7   r7   r:   r  
  s    
zCertificate.sha1c             C   s   dj dd t| jD S )z
        :return:
            A unicode string of the SHA-1 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r   c             s   s   | ]}d | V  qdS )z%02XNr7   )r   cr7   r7   r:   r     s    z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r   r   r  )r8   r7   r7   r:   sha1_fingerprint
  s    zCertificate.sha1_fingerprintc             C   s$   | j dkrtj| j j | _ | j S )zy
        :return:
            The SHA-256 hash of the DER-encoded bytes of this complete
            certificate
        N)r  r  r  r  r  )r8   r7   r7   r:   r    s    
zCertificate.sha256c             C   s   dj dd t| jD S )z
        :return:
            A unicode string of the SHA-256 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r   c             s   s   | ]}d | V  qdS )z%02XNr7   )r   r4  r7   r7   r:   r     s    z1Certificate.sha256_fingerprint.<locals>.<genexpr>)r   r   r  )r8   r7   r7   r:   sha256_fingerprint  s    zCertificate.sha256_fingerprintc             C   sP  t |tsttdt||jdjdj }|jdd
k}| oNt	j
d|}| oZ| }|r| jsjdS |jd}xh| jD ]^}|jdjdj }|jd}	t|	t|krq||	|krd	S | j|}
|
r|| j||	r|d	S q|W dS | jsdS |rtjntj}t||}xD| jD ]:}|jddkr(tjntj}t||}||krd	S qW dS )a  
        Check if a domain name or IP address is valid according to the
        certificate

        :param domain_ip:
            A unicode string of a domain name or IP address

        :return:
            A boolean - if the domain or IP is valid for the certificate
        zL
                domain_ip must be a unicode string, not %s
                r   rY   rh   r   z^\d+\.\d+\.\d+\.\d+$Fr@   Tr[   r[   )r<   r   rC   r	   r   rE   r`   r>   r\   r   r(  r*  rp   ru   _is_wildcard_domain_is_wildcard_matchr,  rr   rt   rs   r4   )r8   Z	domain_ipZencoded_domain_ipZis_ipv6Zis_ipv4Z	is_domaindomain_labelsZvalid_domainZencoded_valid_domainvalid_domain_labelsZis_wildcardrz   Znormalized_ipZvalid_ipZvalid_familyZnormalized_valid_ipr7   r7   r:   is_valid_domain_ip  sB    







zCertificate.is_valid_domain_ipc             C   sZ   |j ddkrdS |j jd}|s(dS |d jdd	kr>dS |d dd dkrVdS dS )
af  
        Checks if a domain is a valid wildcard according to
        https://tools.ietf.org/html/rfc6125#section-6.4.3

        :param domain:
            A unicode string of the domain name, where any U-labels from an IDN
            have been converted to A-labels

        :return:
            A boolean - if the domain is a valid wildcard domain
        *r   Fr@   r   r|   zxn--Tr[   )countr>   rp   r\   )r8   ZdomainZlabelsr7   r7   r:   r7  \  s    zCertificate._is_wildcard_domainc             C   sl   |d }|dd }|d }|dd }||kr4dS |dkr@dS t jd|jdd d	 }|j|rhdS dS )
a  
        Determines if the labels in a domain are a match for labels from a
        wildcard valid domain name

        :param domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in the domain name to check

        :param valid_domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in a wildcard domain pattern

        :return:
            A boolean - if the domain matches the valid domain
        r   r   NFr<  T^z.*$)r   r'  r   r(  )r8   r9  r:  Zfirst_domain_labelZother_domain_labelsZwildcard_labelZother_valid_domain_labelsZwildcard_regexr7   r7   r:   r8  }  s    
zCertificate._is_wildcard_match)ZrN   rO   rP   r  r   r"   r   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r	  r  r  r  r  r  r  r  r  r  r&  r+  r.  r2  r   r  r  ra   r  r  r  r  r  r  r  r  r  r  r  r   r  r  r  r  r
  r  r  r  r  r  r  r  r  r  r  r   r\  r  r  r  r  r  r  r%  r*  r,  rX  r-  r/  r3  r  r5  r  r6  r;  r7  r8  r7   r7   r7   r:   r  N  s   
		
				#	

B!r  c               @   s   e Zd ZeZdS )KeyPurposeIdentifiersN)rN   rO   rP   r  r   r7   r7   r7   r:   r@    s   r@  c               @   s   e Zd ZeZdS )SequenceOfAlgorithmIdentifiersN)rN   rO   rP   r   r   r7   r7   r7   r:   rA    s   rA  c            	   @   sP   e Zd Zdeddifdedddfdeddifdeddifd	ed
ddfgZdS )CertificateAuxZtrustr   TZrejectr   )r   r   aliasZkeyidr9   r   N)rN   rO   rP   r@  r-   r#   rA  r   r7   r7   r7   r:   rB    s
   rB  c               @   s   e Zd ZeegZdS )TrustedCertificateN)rN   rO   rP   r  rB  Z_child_specsr7   r7   r7   r:   rD    s   rD  )r   Z
__future__r   r   r   r   
contextlibr   Z	encodingsr   r  r   rr   r   r   r   Z_errorsr	   Z_irir
   r   Z_ordereddictr   Z_typesr   r   r   Zalgosr   r   r   r   Zcorer   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r   r0   utilr1   r2   r3   r4   r5   rQ   rU   rc   r   r   r   r   r   r   r   r   r   r   r   r   r  r	  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r!  r"  r#  r$  r%  rG  rJ  rK  rL  rM  rT  rU  rV  rW  r[  r_  rb  rc  re  rf  rg  rp  rq  rr  rs  rt  ru  rx  r{  r|  r}  r~  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r@  rA  rB  rD  r7   r7   r7   r:   <module>   s  x59l 	  AU* D

			"2%	n			#      _
