File: //lib/python3.6/site-packages/ipalib/__pycache__/x509.cpython-36.pyc
3
�d[e�r � @ s� d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl Z d dl
m Z d dl
mZ d dlmZ d dlmZmZmZmZ d dlZd dlZd dlmZmZmZm Z d dl m Z m Z d d l m!Z!m"Z" d dl#Z#d d
l$m%Z% d d l&m'Z' e#j(r�e)Z*d Z+d Z,e j-d
e j.�Z/e j-de j.�Z0dZ1dZ2dZ3dZ4dZ5dZ6dZ7dZ8dZ9dZ:G dd� de j;�Z<dd � Z=d d � Z>d d � Z?d!d"� Z@d#d$� ZAd%d&� ZBdad'd(�ZCe+fd)d*�ZDd+d,� ZEd-d.� ZFd/d0� ZGdbd1d2�ZHdcd3d4�ZIG d5d6� d6ejJ�ZKG d7d8� d8ejJ�ZLd9d:� ZMG d;d<� d<e jNjO�ZPG d=d>� d>e jNjO�ZQe:ePe9eQiZRd?d@� ZSdAdB� ZTdCdD� ZUdEdF� ZVdGdH� ZWdIdJ� ZXdKdL� ZYdMdN� ZZdOdP� Z[G dQdR� dRej\�Z]dSdT� Z^G dUdV� dVej_�Z`G dWdX� dX�ZaG dYdZ� dZea�ZbG d[d\� d\eb�ZcG d]d^� d^eb�ZdG d_d`� d`ejJ�ZedS )d� )�print_functionN)�x509)�default_backend)�
serialization)�Encoding� PublicFormat�
PrivateFormat�load_pem_private_key)�univ�char� namedtype�tag)�decoder�encoder)�rfc2315�rfc2459)�errors)�DNSName� s; (-----BEGIN CERTIFICATE-----(.*?)-----END CERTIFICATE-----)s� -----BEGIN(?: ENCRYPTED)?(?: (?:RSA|DSA|DH|EC))? PRIVATE KEY-----.*?-----END(?: ENCRYPTED)?(?: (?:RSA|DSA|DH|EC))? PRIVATE KEY-----z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2z1.3.6.1.5.5.7.3.3z1.3.6.1.5.5.7.3.4z1.3.6.1.5.2.3.4z1.3.6.1.5.2.3.5z 2.5.29.37.0z1.3.6.1.4.1.3319.6.10.16z1.3.6.1.4.1.311.20.2.3z
1.3.6.1.5.2.2c @ s� e Zd ZdZdOdd�Zdd� Zdd� Zd d
� Zd d � Zd
d� Z dd� Z
dd� Z dd� Z dd� Z
dd� Zdd� Zedd � �Zed d � �Zed d � �Zed!d"� �Zed#d$� �Zed%d&� �Zed'd(� �Zeejd)�r�ed*d+� �Zed,d-� �Z ed.d/� �Z ed0d1� �Z ed2d3� �Z ed4d5� �Z ed6d7� �Z!ed8d9� �Z"d:d;� Z#ed<d=� �Z$ed>d?� �Z%ed@dA� �Z&edBdC� �Z'dDdE� Z(edFdG� �Z)dHdI� Z*edJdK� �Z+eejdL��r�dMdN� Z,dS )P�IPACertificatezf
A proxy class wrapping a python-cryptography certificate representation for
IPA purposes
Nc C s` || _ |dkrt� n|� | _| jd�| _| jd�| _| jd�| _| jjdkr\t d| jj ��dS )z�
:param cert: A python-cryptography Certificate object
:param backend: A python-cryptography Backend object
N�subject�issuerZ serialNumberZv3zX.509 %s is not supported)
�_certr �backend� _IPACertificate__get_der_field�_subject�_issuer�_serial_number�version�name�
ValueError)�self�certr � r# �/usr/lib/python3.6/x509.py�__init___ s zIPACertificate.__init__c C s | j tj�| j| j| jd�}|S )N)r r r r )� public_bytesr �DER�
subject_bytes� issuer_bytesr )r! �stater# r# r$ � __getstate__r s
zIPACertificate.__getstate__c C s8 |d | _ |d | _|d | _tj|d t� d�| _d S )Nr r r r )r )r r � crypto_x509�load_der_x509_certificater r )r! r* r# r# r$ � __setstate__{ s
zIPACertificate.__setstate__c C sJ t |tjtf�r(| jtj�|jtj�kS t |t�rB| jtj�|kS dS dS )z�
Checks equality.
:param other: either cryptography.Certificate or IPACertificate or
bytes representing a DER-formatted certificate
FN)�
isinstancer, � Certificater r& r r' �bytes)r! �otherr# r# r$ �__eq__� s
zIPACertificate.__eq__c C s | j |� S )z#
Checks not equal.
)r3 )r! r2 r# r# r$ �__ne__� s zIPACertificate.__ne__c C s
t | j�S )zJ
Computes a hash of the wrapped cryptography.Certificate.
)�hashr )r! r# r# r$ �__hash__� s zIPACertificate.__hash__c C s\ t j� }tj|�|d< tj|�|d< tjjd�r@tj tj
|��}tj |�|d< tj |�}|S )N�extnID�criticalz0.3� extnValue) r Z Extensionr
�ObjectIdentifierZBoolean�pyasn1� __version__�
startswithr �encode� OctetStringZAny)r! �oidr8 �value�extr# r# r$ Z__encode_extension� s
z!IPACertificate.__encode_extensionc C s& | j }tj|tj� �d }|| }|S )zO
:returns: a field of the certificate in pyasn1 representation
r )�tbs_certificate_bytesr �decoder ZTBSCertificate)r! �fieldZ
cert_bytesr" r# r# r$ Z__get_pyasn1_field� s z!IPACertificate.__get_pyasn1_fieldc C s t j| j|��S )z�
:field: the name of the field of the certificate
:returns: bytes representing the value of a certificate field
)r r> �!_IPACertificate__get_pyasn1_field)r! rE r# r# r$ Z__get_der_field� s z IPACertificate.__get_der_fieldc C s | j j|�S )zB
Serializes the certificate to PEM or DER format.
)r r& )r! �encodingr# r# r$ r& � s zIPACertificate.public_bytesc C s | j j| j jkS )zT
:returns: True if this certificate is self-signed, False otherwise
)r r r )r! r# r# r$ �is_self_signed� s z IPACertificate.is_self_signedc C s | j j|�S )zL
Counts fingerprint of the wrapped cryptography.Certificate
)r � fingerprint)r! � algorithmr# r# r$ rI � s zIPACertificate.fingerprintc C s | j jS )N)r �
serial_number)r! r# r# r$ rK � s z IPACertificate.serial_numberc C s | j S )N)r )r! r# r# r$ �serial_number_bytes� s z"IPACertificate.serial_number_bytesc C s | j jS )N)r r )r! r# r# r$ r � s zIPACertificate.versionc C s | j jS )N)r r )r! r# r# r$ r � s zIPACertificate.subjectc C s | j S )N)r )r! r# r# r$ r( � s z IPACertificate.subject_bytesc C s | j jS )zt
Returns a HashAlgorithm corresponding to the type of the digest signed
in the certificate.
)r �signature_hash_algorithm)r! r# r# r$ rM � s z'IPACertificate.signature_hash_algorithmc C s | j jS )zJ
Returns the ObjectIdentifier of the signature algorithm.
)r �signature_algorithm_oid)r! r# r# r$ rN � s z&IPACertificate.signature_algorithm_oid� signature_algorithm_parametersc C s | j jS )N)r rO )r! r# r# r$ rO � s z-IPACertificate.signature_algorithm_parametersc C s | j jS )z.
Returns the signature bytes.
)r � signature)r! r# r# r$ rP � s zIPACertificate.signaturec C s | j jS )N)r r )r! r# r# r$ r � s zIPACertificate.issuerc C s | j S )N)r )r! r# r# r$ r) s zIPACertificate.issuer_bytesc C s | j jS )N)r �not_valid_before)r! r# r# r$ rQ s z IPACertificate.not_valid_beforec C s | j jS )N)r �not_valid_after)r! r# r# r$ rR s z IPACertificate.not_valid_afterc C s | j jS )N)r rC )r! r# r# r$ rC s z$IPACertificate.tbs_certificate_bytesc C s | j jS )N)r �
extensions)r! r# r# r$ rS s zIPACertificate.extensionsc C s
| j j� S )N)r �
public_key)r! r# r# r$ rT s zIPACertificate.public_keyc C s | j j� jtjtjd�S )N)rG �format)r rT r& r r' r ZSubjectPublicKeyInfo)r! r# r# r$ �public_key_info_bytes s
z$IPACertificate.public_key_info_bytesc C sD y| j jjtjjj�j}W n tjk
r0 d S X t dd� |D ��S )Nc s s | ] }|j V qd S )N)�
dotted_string)�.0r@ r# r# r$ � <genexpr>) s z4IPACertificate.extended_key_usage.<locals>.<genexpr>)
r rS Zget_extension_for_oidr, r@ Z ExtensionOIDZEXTENDED_KEY_USAGErA ZExtensionNotFound�set)r! Z
ext_key_usager# r# r$ �extended_key_usage! s z!IPACertificate.extended_key_usagec C s^ | j }|d krd S tj� }x&tt|��D ]\}}tj|�||< q(W tj|�}| j dt
|k|�S )Nz 2.5.29.37) r[ r ZExtKeyUsageSyntax� enumerate�sortedr
r: r r> �!_IPACertificate__encode_extension�EKU_ANY)r! ZekuZekurfc�ir@ r# r# r$ �extended_key_usage_bytes+ s
z'IPACertificate.extended_key_usage_bytesc C sd | j � }dd� dd� tttdd� td�}g }x2|D ]*}|j� }||kr2|j|| |j� �� q2W |S )a�
Return SAN general names from a python-cryptography
certificate object. If the SAN extension is not present,
return an empty sequence.
Because python-cryptography does not yet provide a way to
handle unrecognised critical extensions (which may occur),
we must parse the certificate and extract the General Names.
For uniformity with other code, we manually construct values
of python-crytography GeneralName subtypes.
python-cryptography does not yet provide types for
ediPartyName or x400Address, so we drop these name types.
otherNames are NOT instantiated to more specific types where
the type is known. Use ``process_othernames`` to do that.
When python-cryptography can handle certs with unrecognised
critical extensions and implements ediPartyName and
x400Address, this function (and helpers) will be redundant
and should go away.
c S s t jt| ��S )N)r, Z
RFC822Name�unicode)�xr# r# r$ �<lambda>S s z2IPACertificate.san_general_names.<locals>.<lambda>c S s t jt| ��S )N)r, r rb )rc r# r# r$ rd T s c S s t jt| ��S )N)r, ZUniformResourceIdentifierrb )rc r# r# r$ rd Y s )Z
rfc822Name�dNSNameZ
directoryNameZ registeredIDZ iPAddressZuniformResourceIdentifierZ otherName)�-_IPACertificate__pyasn1_get_san_general_names�%_pyasn1_to_cryptography_directoryname�$_pyasn1_to_cryptography_registeredid�!_pyasn1_to_cryptography_ipaddress�!_pyasn1_to_cryptography_othername�getName�append� getComponent)r! �gnsZGENERAL_NAME_CONSTRUCTORS�result�gnZgn_typer# r# r$ �san_general_names7 s
z IPACertificate.san_general_namesc C s| | j d�p g }tjd�}g }xZ|D ]R}|d |kr"|d }tjjd�r\tj|tj� d�d }tj|t j
� d�d }P q"W |S )NrS z 2.5.29.17r7 r9 z0.3)�asn1Specr ) rF r
r: r; r< r= r rD r? r ZSubjectAltName)r! rS ZOID_SANrn rB Zderr# r# r$ Z __pyasn1_get_san_general_namesg s
z-IPACertificate.__pyasn1_get_san_general_namesc C s< | j � }g }x*|D ]"}|j� dkr|jt|j� �� qW |S )Nre )rf rk rl rb rm )r! rn ro rp r# r# r$ �san_a_label_dns_namesx s
z$IPACertificate.san_a_label_dns_namesc
C s� i }g |d< }xN| j jjD ]@}g }x,|D ]$}|jtjjjkr*|jd|jf� q*W |j|� q W | j }|r�g |d< }x|D ]} |jd| f� q|W t
j |t |�j
� � d S )Nr Z
commonNameZsubjectAltNameZDNS)r r Zrdnsr@ r, ZNameOIDZ COMMON_NAMErl rA rs �ssl�match_hostnamer ZToASCII)
r! ZhostnameZ
match_certZ
match_subject�rdnZ match_rdn�ava�valuesZ match_sanrA r# r# r$ ru � s
z IPACertificate.match_hostnamec C s | j jS )N)r �tbs_precertificate_bytes)r! r# r# r$ ry � s z'IPACertificate.tbs_precertificate_bytes�verify_directly_issued_byc C s | j j|�S )N)r rz )r! r r# r# r$ rz � s z(IPACertificate.verify_directly_issued_by)N)-�__name__�
__module__� __qualname__�__doc__r% r+ r. r3 r4 r6 r^ rF r r& rH rI �propertyrK rL r r r( rM rN �hasattrr, r0 rO rP r r) rQ rR rC rS rT rV r[ ra rq rf rs ru ry rz r# r# r# r$ r Z sP
0 r c C s t tj| t� d��S )z�
Load an X.509 certificate in PEM format.
:returns: a ``IPACertificate`` object.
:raises: ``ValueError`` if unable to load the certificate.
)r )r r, �load_pem_x509_certificater )�datar# r# r$ r� � s r� c C s t tj| t� d��S )z�
Load an X.509 certificate in DER format.
:returns: a ``IPACertificate`` object.
:raises: ``ValueError`` if unable to load the certificate.
)r )r r, r- r )r� r# r# r$ r- � s r- c C s& yt | �S tk
r t| �S X dS )a
Only use this function when you can't be sure what kind of format does
your certificate have, e.g. input certificate files in installers
:returns: a ``IPACertificate`` object.
:raises: ``ValueError`` if unable to load the certificate.
N)r� r r- )r� r# r# r$ � load_unknown_x509_certificate� s r� c C s$ t | dd��}t|j� �S Q R X dS )zh
Load a certificate from a PEM file.
Returns a python-cryptography ``Certificate`` object.
�rb)�modeN)�openr� �read)�filename�fr# r# r$ �load_certificate_from_file� s r� c C s t j| �}dd� |D �S )z�
Load a certificate list from a sequence of concatenated PEMs.
Return a list of python-cryptography ``Certificate`` objects.
c S s g | ]}t |d ��qS )r )r� )rX r" r# r# r$ �
<listcomp>� s z)load_certificate_list.<locals>.<listcomp>)�PEM_CERT_REGEX�findall)r� �certsr# r# r$ �load_certificate_list� s
r� c C s" t | d��}t|j� �S Q R X dS )zv
Load a certificate list from a PEM file.
Return a list of python-cryptography ``Certificate`` objects.
r� N)r� r� r� )r� r� r# r# r$ � load_certificate_list_from_file� s r� c C sz t � }g }xjtjt| �D ]Z}tjd|j� �dk rZ|dkr@td��|jt|j� ||d�� q|jt|j� d|d�� qW |S )a
Load a private key list from a sequence of concatenated PEMs.
:param data: bytes containing the private keys
:param password: bytes, the password to encrypted keys in the bundle
:returns: List of python-cryptography ``PrivateKey`` objects
s ENCRYPTEDNz:Password is required for the encrypted keys in the bundle.)r ) r �re�finditer�PEM_PRIV_REGEX�search�group� RuntimeErrorrl r )r� ZpasswordZcrypto_backendZ priv_keys�matchr# r# r$ �load_private_key_list� s
r� c C s� |t kr4tjd| tj�}|s$td��tj|jd��} tj | t
j � �\}}|rTtd��|d t
j krjtd��tj t
|d �t
j� �\}}|r�td��g }x,|d D ] }tj|�}t|�}|j|� q�W |S )
zn
Extract certificates from a PKCS #7 object.
:returns: a ``list`` of ``IPACertificate`` objects.
s- -----BEGIN PKCS7-----(.*?)-----END PKCS7-----znot a valid PKCS#7 PEMr znot a valid PKCS#7 messageZ contentTypez not a PKCS#7 signed data messageZcontentz¬ a valid PKCS#7 signed data messageZ certificates)�PEMr� r� �DOTALLr �base64Z b64decoder� r rD r Z ContentInfoZ
signedDatar1 Z
SignedDatar r> r- rl )r� Zdatatyper� Z content_info�tailZ signed_dataro Z certificater# r# r$ �pkcs7_to_certs s.
r� c C sD y t | � W n2 tk
r> } ztjt|�d��W Y dd}~X nX dS )zO
Perform cert validation by trying to load it via python-cryptography.
)�errorN)r� r r �CertificateFormatError�str)r" �er# r# r$ � validate_pem_x509_certificate, s r� c C sD y t | � W n2 tk
r> } ztjt|�d��W Y dd}~X nX dS )zO
Perform cert validation by trying to load it via python-cryptography.
)r� N)r- r r r� r� )r" r� r# r# r$ � validate_der_x509_certificate6 s r� c C sh y,t |d��}|j| jtj�� W dQ R X W n6 ttfk
rb } ztjt |�d��W Y dd}~X nX dS )zm
Write the certificate to a file in PEM format.
:param cert: cryptograpy ``Certificate`` object
�wbN)�reason)
r� �writer& r r� �IOError�OSErrorr � FileErrorr� )r" r� �fpr� r# r# r$ �write_certificate@ s
r� c C s� yRt |d��>}|dk r&tj|j� |� x | D ]}|j|jtj�� q,W W dQ R X W n6 tt fk
r� } zt
j t |�d��W Y dd}~X nX dS )z�
Write a list of certificates to a file in PEM format.
:param certs: a list of IPACertificate objects to be written to a file
:param filename: a path to the file the certificates should be written into
r� N)r� )
r� �os�fchmod�filenor� r& r r� r� r� r r� r� )r� r� r� r� r" r� r# r# r$ �write_certificate_listN s
$r� c C s� |dk rt j|�}nt j� }yDt|d��0}tj|j� d� |j| jt j
t j |d�� W dQ R X W n6 t
tfk
r� } ztjt|�d��W Y dd}~X nX dS )a
Write a private key to a file in PEM format. Will force 0x600 permissions
on file.
:param priv_key: cryptography ``PrivateKey`` object
:param passwd: ``bytes`` representing the password to store the
private key with
Nr� i� )Zencryption_algorithm)r� )r ZBestAvailableEncryptionZ NoEncryptionr� r� r� r� r� Z
private_bytesr r� r ZPKCS8r� r� r r� r� )Zpriv_keyr� ZpasswdZenc_algr� r� r# r# r$ �write_pem_private_key` s r� c @ sb e Zd Zejejdej� je j
e j e j d�d��ejdej
ej� �je j
e j e j d�d���ZdS )�_PrincipalNamez name-typer )� explicitTagz name-stringr N)r{ r| r} r �
NamedTypes� NamedTyper
�Integer�subtyper
�Tag�tagClassContext�tagFormatSimpleZ
SequenceOfr �
GeneralString�
componentTyper# r# r# r$ r� x s
r� c @ sZ e Zd Zejejdej� je j
e j e j d�d��ejde
� je j
e j e j d�d���ZdS )�_KRB5PrincipalName�realmr )r� �
principalNamer N)r{ r| r} r r� r� r r� r� r
r� r� r� r� r� r# r# r# r$ r� � s
r� c C s` t j| t� d�d }t|d �jdd�jdd�}|d d }d
jd d � |D ��}d
||f }|S )N)rr r r� �\z\\�@z\@r� z name-string�/c s s. | ]&}t |�jd d�jdd�jdd�V qdS )r� z\\r� z\/r� z\@N)rb �replace)rX �nr# r# r$ rY � s z,_decode_krb5principalname.<locals>.<genexpr>z%s@%s)r rD r� rb r� �join)r� Z principalr� r r# r# r$ �_decode_krb5principalname� s
r� c s e Zd Z� fdd�Z� ZS )�KRB5PrincipalNamec s t t| �j||� t|�| _d S )N)�superr� r% r� r )r! �type_idrA )� __class__r# r$ r% � s zKRB5PrincipalName.__init__)r{ r| r} r% �
__classcell__r# r# )r� r$ r� � s r� c s e Zd Z� fdd�Z� ZS )�UPNc s2 t t| �j||� ttj|tj� d�d �| _d S )N)rr r ) r� r� r% rb r rD r Z
UTF8Stringr )r! r� rA )r� r# r$ r% � s z UPN.__init__)r{ r| r} r% r� r# r# )r� r$ r� � s r� c c sL xF| D ]>}t |tjj�r>tj|jjtjj�}||j|j�V q|V qW dS )z�
Process python-cryptography GeneralName values, yielding
OtherName values of more specific type if type is known.
N) r/ r, � general_name� OtherName�OTHERNAME_CLASS_MAP�getr� rW rA )rn rp �clsr# r# r$ �process_othernames� s
r� c C sd g }xN| j � D ]B}x<|D ]4}tjt|d �ttj|d �d ��}|j|� qW qW tjtj |��S )N�typerA r )
rm r, Z
NameAttribute�_pyasn1_to_cryptography_oidrb r rD rl Z
DirectoryName�Name)ZdnZattrsrv rw �attrr# r# r$ rg � s
rg c C s t jt| ��S )N)r, Z RegisteredIDr� )r@ r# r# r$ rh � s rh c C s t jtjt| ���S )N)r, Z IPAddress� ipaddressZ
ip_addressr1 )Z octet_stringr# r# r$ ri � s ri c C s t jt| d �t| d ��S )Nztype-idrA )r, r� r� r1 )Zonr# r# r$ rj � s
rj c C s t jt| ��S )N)r, r: r� )r@ r# r# r$ r� � s r� c C s dd� t jjt|�g| � D �S )z�Yield chunks of the specified size from the given string.
The input must be a multiple of the chunk size (otherwise
trailing characters are dropped).
Works on character strings only.
c s s | ]}d j |�V qdS )� N)r� )rX �spanr# r# r$ rY � s zchunk.<locals>.<genexpr>)�sixZmoves�zip�iter)�size�sr# r# r$ �chunk� s r� c C s dj td| ��S )z4Add colons between each nibble pair in a hex string.�:� )r� r� )r� r# r# r$ �
add_colons� s r� c C s t tj| �jd��S )z*Convert bytes to a hex string with colons.zutf-8)r� �binasciiZhexlifyrD )Zbsr# r# r$ �to_hex_with_colons� s r� c @ s. e Zd Zejd�Zdd� Zdd� Zdd� ZdS ) �UTCr c C s dS )Nr� r# )r! �dtr# r# r$ �tzname� s z
UTC.tznamec C s | j S )N)�ZERO)r! r� r# r# r$ � utcoffset� s z
UTC.utcoffsetc C s | j S )N)r� )r! r� r# r# r$ �dst� s zUTC.dstN) r{ r| r} �datetimeZ timedeltar� r� r� r� r# r# r# r$ r� � s
r� c C s& | j d kr| jt� d�} t| jd��S )N)�tzinfoz%a %b %d %H:%M:%S %Y %Z)r� r� r� rb Zstrftime)�tr# r# r$ �format_datetime s
r� c @ s e Zd ZdZdZdS )�ExternalCATypeZgenericzms-csN)r{ r| r} ZGENERIC�MS_CSr# r# r# r$ r� s r� c sB e Zd ZdZd dd�Ze� Zd � fdd� Zdd� Zd d
� Z � Z
S )
�ExternalCAProfilea#
An external CA profile configuration. Currently the only
subclasses are for Microsoft CAs, for providing data in the
"Certificate Template" extension.
Constructing this class will actually return an instance of a
subclass.
Subclasses MUST set ``valid_for``.
Nc C s
|| _ d S )N)�unparsed_input)r! r� r# r# r$ r% s zExternalCAProfile.__init__c sr | t k rtt | �j| �S |dkr(td��|jd�}ytj|d �}tjt|�S tj j
k
rl t jt |�S X dS )z�Construct the ExternalCAProfile value.
Return an instance of a subclass determined by
the format of the argument.
Nzstring argument is requiredr� r ) r� r� �__new__r �splitr
r: �MSCSTemplateV2r; r� � PyAsn1Error�MSCSTemplateV1)r� r� �partsZ_oid)r� r# r$ r� ! s
zExternalCAProfile.__new__c C s | j S )N)r� )r! r# r# r$ r+ @ s z ExternalCAProfile.__getstate__c C s | j |� d S )N)r% )r! r* r# r# r$ r. C s z ExternalCAProfile.__setstate__)N)N) r{ r| r} r~ r% rZ � valid_forr� r+ r. r� r# r# )r� r$ r� s
r� c @ s. e Zd ZdZeejjg�ZdZ dZ
dd� Z dS )� MSCSTemplatez�
An Microsoft AD-CS Template specifier.
Subclasses MUST set ext_oid.
Subclass constructors MUST set asn1obj.
Nc C s t j| j�S )z"Return DER-encoded extension data.)r r> �asn1obj)r! r# r# r$ � get_ext_dataV s zMSCSTemplate.get_ext_data) r{ r| r} r~ rZ r� r� rA r� �ext_oidr� r� r# r# r# r$ r� H s
r� c s$ e Zd ZdZdZ� fdd�Z� ZS )r� a
A v1 template specifier, per
https://msdn.microsoft.com/en-us/library/cc250011.aspx.
::
CertificateTemplateName ::= SEQUENCE {
Name UTF8String
}
But note that a bare BMPString is used in practice.
z1.3.6.1.4.1.311.20.2c sF t t| �j|� |jd�}t|�dkr.td��tjt|d ��| _ d S )Nr� r z<Cannot specify certificate template version when using name.r )
r� r� r% r� �lenr r Z BMPStringr� r� )r! r� r� )r� r# r$ r% k s
zMSCSTemplateV1.__init__)r{ r| r} r~ r� r% r� r# r# )r� r$ r� [ s
r� c s0 e Zd ZdZdZedd� �Z� fdd�Z� ZS )r� a�
A v2 template specifier, per
https://msdn.microsoft.com/en-us/library/windows/desktop/aa378274(v=vs.85).aspx
::
CertificateTemplate ::= SEQUENCE {
templateID EncodedObjectID,
templateMajorVersion TemplateVersion,
templateMinorVersion TemplateVersion OPTIONAL
}
TemplateVersion ::= INTEGER (0..4294967295)
z1.3.6.1.4.1.311.21.7c C s" |dk s|dkr t dj| ���d S )Nr r� � z2Template {} version must be in range 0..4294967295l )r rU )Zdescr� r# r# r$ �check_version_in_range� s z%MSCSTemplateV2.check_version_in_rangec s� t t| �j|� |jd�}t� }t|�dk s8t|�dkr@td��yjtj|d �|d< t |d �}| j
d|� ||d < t|�dkr�t |d �}| j
d
|� t |d �|d < W n t j j
k
r� td ��Y nX || _d S )
Nr� r� � z[Incorrect template specification; required format is: <oid>:<majorVersion>[:<minorVersion>]r �
templateIDr �major�templateMajorVersion�minor�templateMinorVersionz/Could not parse certificate template specifier.)r� r� r% r� �CertificateTemplateV2r� r r
r: �intr� r; r� r� r� )r! r� r� �objr r )r� r# r$ r% � s$
zMSCSTemplateV2.__init__) r{ r| r} r~ r� � staticmethodr� r% r� r# r# )r� r$ r� t s r� c @ s> e Zd Zejejdej� �ejdej� �ej dej� ��Z
dS )r r r r N) r{ r| r} r r� r� r
r: r� ZOptionalNamedTyper� r# r# r# r$ r � s r )N)N)N)fZ
__future__r r� r� r� �enumr� rt r� r� Z cryptographyr r, Z cryptography.hazmat.backendsr Z cryptography.hazmat.primitivesr Z,cryptography.hazmat.primitives.serializationr r r r r; Z pyasn1.errorZ pyasn1.typer
r r r
Zpyasn1.codec.derr r Zpyasn1_modulesr r r� Zipalibr Zipapython.dnsutilr ZPY3r� rb r� r' �compiler� r� r� ZEKU_SERVER_AUTHZEKU_CLIENT_AUTHZEKU_CODE_SIGNINGZEKU_EMAIL_PROTECTIONZEKU_PKINIT_CLIENT_AUTHZEKU_PKINIT_KDCr_ ZEKU_PLACEHOLDERZSAN_UPNZSAN_KRB5PRINCIPALNAMEr0 r r� r- r� r� r� r� r� r� r� r� r� r� r� �Sequencer� r� r� r� r� r� r� r� r� rg rh ri rj r� r� r� r� r� r� r� �Enumr� r� r� r� r� r r# r# r# r$ �<module> s� L
&
:4