U
    c                     @   s  d dl Z d dlZd dlZd dlZd dlmZ d dlmZ d dl	m
Z
mZ d dlmZmZmZmZmZmZmZ d dlmZmZmZ d dlmZmZmZmZ d dlmZmZ d d	l m!Z! ed
ddZ"G dd de#Z$ee ej%ee  ddddZ&e!ej%ej'e!e(ej)e* f  ddddZ+ejejdddZ,G dd dZ-G dd dZ.G dd dej/Z0G dd de#Z1G dd  d e j2d!Z3e34ej3 G d"d# d#e j2d!Z5e54ej5 G d$d% d%e5Z6G d&d' d'e j2d!Z7e74ej7 G d(d) d)e j2d!Z8e84ej8 dBe(ej9e3d*d+d,Z:dCe(ej9e3d*d-d.Z;dDe(ej9e8d*d/d0Z<dEe(ej9e8d*d1d2Z=dFe(ej9e7d*d3d4Z>dGe(ej9e7d*d5d6Z?G d7d8 d8Z@G d9d: d:ZAG d;d< d<ZBG d=d> d>ZCe*d?d@dAZDdS )H    N)utils)x509)hashesserialization)dsaeced25519ed448rsax25519x448)#CERTIFICATE_ISSUER_PUBLIC_KEY_TYPESCERTIFICATE_PRIVATE_KEY_TYPESCERTIFICATE_PUBLIC_KEY_TYPES)	ExtensionExtensionType
Extensions_make_sequence_methods)Name	_ASN1Type)ObjectIdentifieri     c                       s&   e Zd Zeedd fddZ  ZS )AttributeNotFoundN)msgoidreturnc                    s   t t| | || _d S N)superr   __init__r   )selfr   r   	__class__ 5lib/python3.8/site-packages/cryptography/x509/base.pyr   *   s    zAttributeNotFound.__init__)__name__
__module____qualname__strr   r   __classcell__r"   r"   r    r#   r   )   s   r   )	extension
extensionsr   c                 C   s"   |D ]}|j | j krtdqd S )Nz$This extension has already been set.)r   
ValueError)r)   r*   er"   r"   r#   _reject_duplicate_extension/   s    r-   )r   
attributesr   c                 C   s$   |D ]\}}}|| krt dqd S )Nz$This attribute has already been set.)r+   )r   r.   Zattr_oid_r"   r"   r#   _reject_duplicate_attribute9   s    r0   timer   c                 C   s:   | j dk	r2|  }|r|nt }| jdd| S | S dS )zNormalizes a datetime to a naive datetime in UTC.

    time -- datetime to normalize. Assumed to be in UTC if not timezone
            aware.
    N)tzinfo)r3   Z	utcoffsetdatetimeZ	timedeltareplace)r2   offsetr"   r"   r#   _convert_to_naive_utc_timeE   s
    
r7   c                   @   sx   e Zd ZejjfeeeddddZ	e
edddZe
eddd	Zedd
dZeedddZedddZdS )	AttributeN)r   value_typer   c                 C   s   || _ || _|| _d S r   )_oid_valuer:   )r   r   r9   r:   r"   r"   r#   r   T   s    zAttribute.__init__r   c                 C   s   | j S r   )r;   r   r"   r"   r#   r   ^   s    zAttribute.oidc                 C   s   | j S r   )r<   r>   r"   r"   r#   r9   b   s    zAttribute.valuec                 C   s   d | j| jS )Nz<Attribute(oid={}, value={!r})>)formatr   r9   r>   r"   r"   r#   __repr__f   s    zAttribute.__repr__otherr   c                 C   s2   t |tstS | j|jko0| j|jko0| j|jkS r   )
isinstancer8   NotImplementedr   r9   r:   r   rB   r"   r"   r#   __eq__i   s    


zAttribute.__eq__c                 C   s   t | j| j| jfS r   )hashr   r9   r:   r>   r"   r"   r#   __hash__s   s    zAttribute.__hash__)r$   r%   r&   r   Z
UTF8Stringr9   r   bytesintr   propertyr   r'   r@   objectboolrF   rH   r"   r"   r"   r#   r8   S   s   

r8   c                   @   sN   e Zd Zeje ddddZed\ZZ	Z
edddZeed	d
dZdS )
AttributesN)r.   r   c                 C   s   t || _d S r   )list_attributes)r   r.   r"   r"   r#   r   x   s    zAttributes.__init__rP   r=   c                 C   s   d | jS )Nz<Attributes({})>)r?   rP   r>   r"   r"   r#   r@      s    zAttributes.__repr__r   r   c                 C   s0   | D ]}|j |kr|  S qtd||d S )NzNo {} attribute was found)r   r   r?   )r   r   attrr"   r"   r#   get_attribute_for_oid   s    

z Attributes.get_attribute_for_oid)r$   r%   r&   typingIterabler8   r   r   __len____iter____getitem__r'   r@   r   rS   r"   r"   r"   r#   rN   w   s   rN   c                   @   s   e Zd ZdZdZdS )Versionr      N)r$   r%   r&   Zv1v3r"   r"   r"   r#   rY      s   rY   c                       s&   e Zd Zeedd fddZ  ZS )InvalidVersionN)r   parsed_versionr   c                    s   t t| | || _d S r   )r   r\   r   r]   )r   r   r]   r    r"   r#   r      s    zInvalidVersion.__init__)r$   r%   r&   r'   rJ   r   r(   r"   r"   r    r#   r\      s   r\   c                   @   sv  e Zd ZejejedddZej	e
dddZej	edddZejedd	d
Zej	ejdddZej	ejdddZej	edddZej	edddZej	ejej dddZej	edddZej	edddZej	edddZej	edddZej	edddZeje e!dd d!Z"eje
dd"d#Z#eje$j%ed$d%d&Z&d'S )(Certificate	algorithmr   c                 C   s   dS z4
        Returns bytes using digest passed.
        Nr"   r   r`   r"   r"   r#   fingerprint   s    zCertificate.fingerprintr=   c                 C   s   dS )z3
        Returns certificate serial number
        Nr"   r>   r"   r"   r#   serial_number   s    zCertificate.serial_numberc                 C   s   dS )z1
        Returns the certificate version
        Nr"   r>   r"   r"   r#   version   s    zCertificate.versionc                 C   s   dS z(
        Returns the public key
        Nr"   r>   r"   r"   r#   
public_key   s    zCertificate.public_keyc                 C   s   dS )z?
        Not before time (represented as UTC datetime)
        Nr"   r>   r"   r"   r#   not_valid_before   s    zCertificate.not_valid_beforec                 C   s   dS )z>
        Not after time (represented as UTC datetime)
        Nr"   r>   r"   r"   r#   not_valid_after   s    zCertificate.not_valid_afterc                 C   s   dS )z1
        Returns the issuer name object.
        Nr"   r>   r"   r"   r#   issuer   s    zCertificate.issuerc                 C   s   dS z2
        Returns the subject name object.
        Nr"   r>   r"   r"   r#   subject   s    zCertificate.subjectc                 C   s   dS zt
        Returns a HashAlgorithm corresponding to the type of the digest signed
        in the certificate.
        Nr"   r>   r"   r"   r#   signature_hash_algorithm   s    z$Certificate.signature_hash_algorithmc                 C   s   dS zJ
        Returns the ObjectIdentifier of the signature algorithm.
        Nr"   r>   r"   r"   r#   signature_algorithm_oid   s    z#Certificate.signature_algorithm_oidc                 C   s   dS )z/
        Returns an Extensions object.
        Nr"   r>   r"   r"   r#   r*      s    zCertificate.extensionsc                 C   s   dS z.
        Returns the signature bytes.
        Nr"   r>   r"   r"   r#   	signature   s    zCertificate.signaturec                 C   s   dS )zR
        Returns the tbsCertificate payload bytes as defined in RFC 5280.
        Nr"   r>   r"   r"   r#   tbs_certificate_bytes   s    z!Certificate.tbs_certificate_bytesc                 C   s   dS )zh
        Returns the tbsCertificate payload bytes with the SCT list extension
        stripped.
        Nr"   r>   r"   r"   r#   tbs_precertificate_bytes   s    z$Certificate.tbs_precertificate_bytesrA   c                 C   s   dS z"
        Checks equality.
        Nr"   rE   r"   r"   r#   rF      s    zCertificate.__eq__c                 C   s   dS z"
        Computes a hash.
        Nr"   r>   r"   r"   r#   rH      s    zCertificate.__hash__encodingr   c                 C   s   dS )zB
        Serializes the certificate to PEM or DER format.
        Nr"   r   rx   r"   r"   r#   public_bytes   s    zCertificate.public_bytesN)'r$   r%   r&   abcabstractmethodr   HashAlgorithmrI   rc   abstractpropertyrJ   rd   rY   re   r   rg   r4   rh   ri   r   rj   rl   rT   Optionalrn   r   rp   r   r*   rr   rs   rt   rL   rM   rF   rH   r   Encodingrz   r"   r"   r"   r#   r^      sF   
r^   )	metaclassc                   @   sJ   e Zd ZejedddZejejdddZeje	dddZ
dS )	RevokedCertificater=   c                 C   s   dS )zG
        Returns the serial number of the revoked certificate.
        Nr"   r>   r"   r"   r#   rd     s    z RevokedCertificate.serial_numberc                 C   s   dS )zH
        Returns the date of when this certificate was revoked.
        Nr"   r>   r"   r"   r#   revocation_date  s    z"RevokedCertificate.revocation_datec                 C   s   dS )zW
        Returns an Extensions object containing a list of Revoked extensions.
        Nr"   r>   r"   r"   r#   r*     s    zRevokedCertificate.extensionsN)r$   r%   r&   r{   r~   rJ   rd   r4   r   r   r*   r"   r"   r"   r#   r     s   r   c                   @   sX   e Zd ZeejedddZeedddZeejdddZ	eedd	d
Z
dS )_RawRevokedCertificaterd   r   r*   c                 C   s   || _ || _|| _d S r   _serial_number_revocation_date_extensionsr   rd   r   r*   r"   r"   r#   r     s    z_RawRevokedCertificate.__init__r=   c                 C   s   | j S r   )r   r>   r"   r"   r#   rd   )  s    z$_RawRevokedCertificate.serial_numberc                 C   s   | j S r   )r   r>   r"   r"   r#   r   -  s    z&_RawRevokedCertificate.revocation_datec                 C   s   | j S r   )r   r>   r"   r"   r#   r*   1  s    z!_RawRevokedCertificate.extensionsN)r$   r%   r&   rJ   r4   r   r   rK   rd   r   r*   r"   r"   r"   r#   r     s   
r   c                   @   s  e Zd ZejejedddZeje	j
edddZejeeje ddd	Zejeje	j
 d
ddZejed
ddZejed
ddZejejej d
ddZejejd
ddZejed
ddZejed
ddZejed
ddZejeedddZ ejed
ddZ!ej"eed d!d"Z#ej"e$ej%e d d#d"Z#ejej&ee$f ej&eej%e f d d$d"Z#ejej'e d
d%d&Z(eje)ed'd(d)Z*d*S )+CertificateRevocationListrw   c                 C   s   dS )z:
        Serializes the CRL to PEM or DER format.
        Nr"   ry   r"   r"   r#   rz   7  s    z&CertificateRevocationList.public_bytesr_   c                 C   s   dS ra   r"   rb   r"   r"   r#   rc   =  s    z%CertificateRevocationList.fingerprint)rd   r   c                 C   s   dS )zs
        Returns an instance of RevokedCertificate or None if the serial_number
        is not in the CRL.
        Nr"   )r   rd   r"   r"   r#   (get_revoked_certificate_by_serial_numberC  s    zBCertificateRevocationList.get_revoked_certificate_by_serial_numberr=   c                 C   s   dS rm   r"   r>   r"   r"   r#   rn   L  s    z2CertificateRevocationList.signature_hash_algorithmc                 C   s   dS ro   r"   r>   r"   r"   r#   rp   U  s    z1CertificateRevocationList.signature_algorithm_oidc                 C   s   dS )zC
        Returns the X509Name with the issuer of this CRL.
        Nr"   r>   r"   r"   r#   rj   [  s    z CertificateRevocationList.issuerc                 C   s   dS )z?
        Returns the date of next update for this CRL.
        Nr"   r>   r"   r"   r#   next_updatea  s    z%CertificateRevocationList.next_updatec                 C   s   dS )z?
        Returns the date of last update for this CRL.
        Nr"   r>   r"   r"   r#   last_updateg  s    z%CertificateRevocationList.last_updatec                 C   s   dS )zS
        Returns an Extensions object containing a list of CRL extensions.
        Nr"   r>   r"   r"   r#   r*   m  s    z$CertificateRevocationList.extensionsc                 C   s   dS rq   r"   r>   r"   r"   r#   rr   s  s    z#CertificateRevocationList.signaturec                 C   s   dS )zO
        Returns the tbsCertList payload bytes as defined in RFC 5280.
        Nr"   r>   r"   r"   r#   tbs_certlist_bytesy  s    z,CertificateRevocationList.tbs_certlist_bytesrA   c                 C   s   dS ru   r"   rE   r"   r"   r#   rF     s    z CertificateRevocationList.__eq__c                 C   s   dS )z<
        Number of revoked certificates in the CRL.
        Nr"   r>   r"   r"   r#   rV     s    z!CertificateRevocationList.__len__)idxr   c                 C   s   d S r   r"   r   r   r"   r"   r#   rX     s    z%CertificateRevocationList.__getitem__c                 C   s   d S r   r"   r   r"   r"   r#   rX     s    c                 C   s   dS )zS
        Returns a revoked certificate (or slice of revoked certificates).
        Nr"   r   r"   r"   r#   rX     s    c                 C   s   dS )z8
        Iterator over the revoked certificates
        Nr"   r>   r"   r"   r#   rW     s    z"CertificateRevocationList.__iter__)rg   r   c                 C   s   dS )zQ
        Verifies signature of revocation list against given public key.
        Nr"   )r   rg   r"   r"   r#   is_signature_valid  s    z,CertificateRevocationList.is_signature_validN)+r$   r%   r&   r{   r|   r   r   rI   rz   r   r}   rc   rJ   rT   r   r   r   r~   rn   r   rp   r   rj   r4   r   r   r   r*   rr   r   rL   rM   rF   rV   ZoverloadrX   sliceListZUnionIteratorrW   r   r   r"   r"   r"   r#   r   6  sV   
r   c                   @   s   e Zd ZejeedddZejedddZ	eje
dddZejedd	d
Zejejej dddZejedddZejedddZejedddZejejedddZejedddZejedddZejedddZ ejeedddZ!dS ) CertificateSigningRequestrA   c                 C   s   dS ru   r"   rE   r"   r"   r#   rF     s    z CertificateSigningRequest.__eq__r=   c                 C   s   dS rv   r"   r>   r"   r"   r#   rH     s    z"CertificateSigningRequest.__hash__c                 C   s   dS rf   r"   r>   r"   r"   r#   rg     s    z$CertificateSigningRequest.public_keyc                 C   s   dS rk   r"   r>   r"   r"   r#   rl     s    z!CertificateSigningRequest.subjectc                 C   s   dS rm   r"   r>   r"   r"   r#   rn     s    z2CertificateSigningRequest.signature_hash_algorithmc                 C   s   dS ro   r"   r>   r"   r"   r#   rp     s    z1CertificateSigningRequest.signature_algorithm_oidc                 C   s   dS )z@
        Returns the extensions in the signing request.
        Nr"   r>   r"   r"   r#   r*     s    z$CertificateSigningRequest.extensionsc                 C   s   dS )z/
        Returns an Attributes object.
        Nr"   r>   r"   r"   r#   r.     s    z$CertificateSigningRequest.attributesrw   c                 C   s   dS )z;
        Encodes the request to PEM or DER format.
        Nr"   ry   r"   r"   r#   rz     s    z&CertificateSigningRequest.public_bytesc                 C   s   dS rq   r"   r>   r"   r"   r#   rr     s    z#CertificateSigningRequest.signaturec                 C   s   dS )zd
        Returns the PKCS#10 CertificationRequestInfo bytes as defined in RFC
        2986.
        Nr"   r>   r"   r"   r#   tbs_certrequest_bytes  s    z/CertificateSigningRequest.tbs_certrequest_bytesc                 C   s   dS )z8
        Verifies signature of signing request.
        Nr"   r>   r"   r"   r#   r     s    z,CertificateSigningRequest.is_signature_validrQ   c                 C   s   dS )z:
        Get the attribute value for a given OID.
        Nr"   )r   r   r"   r"   r#   rS     s    z/CertificateSigningRequest.get_attribute_for_oidN)"r$   r%   r&   r{   r|   rL   rM   rF   rJ   rH   r   rg   r~   r   rl   rT   r   r   r}   rn   r   rp   r   r*   rN   r.   r   r   rI   rz   rr   r   r   rS   r"   r"   r"   r#   r     s6   
r   )databackendr   c                 C   s
   t | S r   )	rust_x509load_pem_x509_certificater   r   r"   r"   r#   r     s    r   c                 C   s
   t | S r   )r   load_der_x509_certificater   r"   r"   r#   r     s    r   c                 C   s
   t | S r   )r   load_pem_x509_csrr   r"   r"   r#   r     s    r   c                 C   s
   t | S r   )r   load_der_x509_csrr   r"   r"   r#   r     s    r   c                 C   s
   t | S r   )r   load_pem_x509_crlr   r"   r"   r#   r   "  s    r   c                 C   s
   t | S r   )r   load_der_x509_crlr   r"   r"   r#   r   )  s    r   c                	   @   s   e Zd Zdg g feje ejee  ejej	e
eeje f  dddZed dddZeed dd	d
Zdde
eeje d dddZdeejej ejedddZdS ) CertificateSigningRequestBuilderN)subject_namer*   r.   c                 C   s   || _ || _|| _dS )zB
        Creates an empty X.509 certificate request (v1).
        N)_subject_namer   rP   )r   r   r*   r.   r"   r"   r#   r   0  s    z)CertificateSigningRequestBuilder.__init__namer   c                 C   s4   t |tstd| jdk	r$tdt|| j| jS )zF
        Sets the certificate requestor's distinguished name.
        Expecting x509.Name object.N&The subject name may only be set once.)rC   r   	TypeErrorr   r+   r   r   rP   r   r   r"   r"   r#   r   ?  s    

  z-CertificateSigningRequestBuilder.subject_nameextvalcriticalr   c                 C   sD   t |tstdt|j||}t|| j t| j| j|g | j	S )zE
        Adds an X.509 extension to the certificate request.
        "extension must be an ExtensionType)
rC   r   r   r   r   r-   r   r   r   rP   r   r   r   r)   r"   r"   r#   add_extensionK  s    

z.CertificateSigningRequestBuilder.add_extension)_tag)r   r9   r   r   c                C   s|   t |tstdt |ts$td|dk	r>t |ts>tdt|| j |dk	rZ|j}nd}t| j	| j
| j|||fg S )zK
        Adds an X.509 attribute with an OID and associated value.
        zoid must be an ObjectIdentifierzvalue must be bytesNztag must be _ASN1Type)rC   r   r   rI   r   r0   rP   r9   r   r   r   )r   r   r9   r   tagr"   r"   r#   add_attribute]  s    


z.CertificateSigningRequestBuilder.add_attributeprivate_keyr`   r   r   c                 C   s    | j dkrtdt| ||S )zF
        Signs the request using the requestor's private key.
        Nz/A CertificateSigningRequest must have a subject)r   r+   r   Zcreate_x509_csrr   r   r`   r   r"   r"   r#   sign}  s    	
z%CertificateSigningRequestBuilder.sign)N)r$   r%   r&   rT   r   r   r   r   r   Tupler   rI   rJ   r   r   rM   r   r   r   r   r   r}   Anyr   r   r"   r"   r"   r#   r   /  s:    $ 
r   c                
   @   s  e Zd ZU ejee  ed< ddddddg feje	 eje	 eje
 eje ejej ejej ejee  ddddZe	d dddZe	d dd	d
Ze
d dddZed dddZejd dddZejd dddZeed dddZdeejej ejedddZdS )CertificateBuilderr   N)issuer_namer   rg   rd   rh   ri   r*   r   c                 C   s6   t j| _|| _|| _|| _|| _|| _|| _|| _	d S r   )
rY   r[   Z_version_issuer_namer   _public_keyr   _not_valid_before_not_valid_afterr   )r   r   r   rg   rd   rh   ri   r*   r"   r"   r#   r     s    
zCertificateBuilder.__init__r   c                 C   sD   t |tstd| jdk	r$tdt|| j| j| j| j	| j
| jS )z3
        Sets the CA's distinguished name.
        r   N%The issuer name may only be set once.)rC   r   r   r   r+   r   r   r   r   r   r   r   r   r"   r"   r#   r     s    

zCertificateBuilder.issuer_namec                 C   sD   t |tstd| jdk	r$tdt| j|| j| j| j	| j
| jS )z:
        Sets the requestor's distinguished name.
        r   Nr   )rC   r   r   r   r+   r   r   r   r   r   r   r   r   r"   r"   r#   r     s    

zCertificateBuilder.subject_name)keyr   c              	   C   s`   t |tjtjtjtjt	j
tjtjfs.td| jdk	r@tdt| j| j|| j| j| j| jS )zT
        Sets the requestor's public key (as found in the signing request).
        zExpecting one of DSAPublicKey, RSAPublicKey, EllipticCurvePublicKey, Ed25519PublicKey, Ed448PublicKey, X25519PublicKey, or X448PublicKey.Nz$The public key may only be set once.)rC   r   ZDSAPublicKeyr
   ZRSAPublicKeyr   ZEllipticCurvePublicKeyr   ZEd25519PublicKeyr	   ZEd448PublicKeyr   ZX25519PublicKeyr   ZX448PublicKeyr   r   r+   r   r   r   r   r   r   r   )r   r   r"   r"   r#   rg     s2    
zCertificateBuilder.public_keynumberr   c                 C   sh   t |tstd| jdk	r$td|dkr4td| dkrHtdt| j| j| j	|| j
| j| jS )z5
        Sets the certificate serial number.
        'Serial number must be of integral type.N'The serial number may only be set once.r   z%The serial number should be positive.   3The serial number should not be more than 159 bits.)rC   rJ   r   r   r+   
bit_lengthr   r   r   r   r   r   r   r   r   r"   r"   r#   rd     s&    

z CertificateBuilder.serial_numberr1   c                 C   sz   t |tjstd| jdk	r&tdt|}|tk r>td| jdk	rZ|| jkrZtdt| j	| j
| j| j|| j| jS )z7
        Sets the certificate activation time.
        Expecting datetime object.Nz*The not valid before may only be set once.z>The not valid before date must be on or after 1950 January 1).zBThe not valid before date must be before the not valid after date.)rC   r4   r   r   r+   r7   _EARLIEST_UTC_TIMEr   r   r   r   r   r   r   r   r2   r"   r"   r#   rh     s,    
z#CertificateBuilder.not_valid_beforec                 C   sz   t |tjstd| jdk	r&tdt|}|tk r>td| jdk	rZ|| jk rZtdt| j	| j
| j| j| j|| jS )z7
        Sets the certificate expiration time.
        r   Nz)The not valid after may only be set once.z<The not valid after date must be on or after 1950 January 1.zAThe not valid after date must be after the not valid before date.)rC   r4   r   r   r+   r7   r   r   r   r   r   r   r   r   r   r"   r"   r#   ri   $  s2    
z"CertificateBuilder.not_valid_afterr   c              	   C   sT   t |tstdt|j||}t|| j t| j| j	| j
| j| j| j| j|g S )z=
        Adds an X.509 extension to the certificate.
        r   )rC   r   r   r   r   r-   r   r   r   r   r   r   r   r   r   r"   r"   r#   r   D  s    

z CertificateBuilder.add_extensionr   c                 C   sz   | j dkrtd| jdkr$td| jdkr6td| jdkrHtd| jdkrZtd| jdkrltdt| ||S )zC
        Signs the certificate using the CA's private key.
        Nz&A certificate must have a subject namez&A certificate must have an issuer namez'A certificate must have a serial numberz/A certificate must have a not valid before timez.A certificate must have a not valid after timez$A certificate must have a public key)	r   r+   r   r   r   r   r   r   Zcreate_x509_certificater   r"   r"   r#   r   Z  s    	





zCertificateBuilder.sign)N)r$   r%   r&   rT   r   r   r   __annotations__r   r   r   rJ   r4   r   r   r   rg   rd   rh   ri   rM   r   r   r   r}   r   r^   r   r"   r"   r"   r#   r     sN   


%!  
r   c                   @   s   e Zd ZU ejee  ed< eje ed< dddg g fej	e
 ej	ej ej	ej ejee  eje dddZe
d ddd	Zejd d
ddZejd dddZeed dddZed dddZdeej	ej ejedddZdS ) CertificateRevocationListBuilderr   _revoked_certificatesN)r   r   r   r*   revoked_certificatesc                 C   s"   || _ || _|| _|| _|| _d S r   )r   _last_update_next_updater   r   )r   r   r   r   r*   r   r"   r"   r#   r   |  s
    z)CertificateRevocationListBuilder.__init__)r   r   c                 C   s<   t |tstd| jd k	r$tdt|| j| j| j| j	S )Nr   r   )
rC   r   r   r   r+   r   r   r   r   r   )r   r   r"   r"   r#   r     s    

z,CertificateRevocationListBuilder.issuer_name)r   r   c                 C   sr   t |tjstd| jd k	r&tdt|}|tk r>td| jd k	rZ|| jkrZtdt| j	|| j| j
| jS )Nr   !Last update may only be set once.8The last update date must be on or after 1950 January 1.z9The last update date must be before the next update date.)rC   r4   r   r   r+   r7   r   r   r   r   r   r   )r   r   r"   r"   r#   r     s(    
z,CertificateRevocationListBuilder.last_update)r   r   c                 C   sr   t |tjstd| jd k	r&tdt|}|tk r>td| jd k	rZ|| jk rZtdt| j	| j|| j
| jS )Nr   r   r   z8The next update date must be after the last update date.)rC   r4   r   r   r+   r7   r   r   r   r   r   r   )r   r   r"   r"   r#   r     s(    
z,CertificateRevocationListBuilder.next_updater   c                 C   sL   t |tstdt|j||}t|| j t| j| j	| j
| j|g | jS )zM
        Adds an X.509 extension to the certificate revocation list.
        r   )rC   r   r   r   r   r-   r   r   r   r   r   r   r   r"   r"   r#   r     s    

z.CertificateRevocationListBuilder.add_extension)revoked_certificater   c                 C   s2   t |tstdt| j| j| j| j| j|g S )z8
        Adds a revoked certificate to the CRL.
        z)Must be an instance of RevokedCertificate)	rC   r   r   r   r   r   r   r   r   )r   r   r"   r"   r#   add_revoked_certificate  s    

z8CertificateRevocationListBuilder.add_revoked_certificater   c                 C   sD   | j d krtd| jd kr$td| jd kr6tdt| ||S )NzA CRL must have an issuer namez"A CRL must have a last update timez"A CRL must have a next update time)r   r+   r   r   r   Zcreate_x509_crlr   r"   r"   r#   r     s    


z%CertificateRevocationListBuilder.sign)N)r$   r%   r&   rT   r   r   r   r   r   r   r   r4   r   r   r   r   rM   r   r   r   r   r}   r   r   r   r"   r"   r"   r#   r   x  sJ   


  
r   c                   @   s   e Zd Zddg feje ejej ejee	  dddZ
ed dddZejd dd	d
Ze	ed dddZdejedddZdS )RevokedCertificateBuilderNr   c                 C   s   || _ || _|| _d S r   r   r   r"   r"   r#   r      s    z"RevokedCertificateBuilder.__init__r   c                 C   sX   t |tstd| jd k	r$td|dkr4td| dkrHtdt|| j| jS )Nr   r   r   z$The serial number should be positiver   r   )	rC   rJ   r   r   r+   r   r   r   r   r   r"   r"   r#   rd   
  s    

  z'RevokedCertificateBuilder.serial_numberr1   c                 C   sN   t |tjstd| jd k	r&tdt|}|tk r>tdt| j|| j	S )Nr   z)The revocation date may only be set once.z7The revocation date must be on or after 1950 January 1.)
rC   r4   r   r   r+   r7   r   r   r   r   r   r"   r"   r#   r     s    
  z)RevokedCertificateBuilder.revocation_dater   c                 C   sD   t |tstdt|j||}t|| j t| j| j	| j|g S )Nr   )
rC   r   r   r   r   r-   r   r   r   r   r   r"   r"   r#   r   ,  s    

z'RevokedCertificateBuilder.add_extension)r   r   c                 C   s:   | j d krtd| jd kr$tdt| j | jt| jS )Nz/A revoked certificate must have a serial numberz1A revoked certificate must have a revocation date)r   r+   r   r   r   r   )r   r   r"   r"   r#   build:  s    

zRevokedCertificateBuilder.build)N)r$   r%   r&   rT   r   rJ   r4   r   r   r   r   rd   r   rM   r   r   r   r   r"   r"   r"   r#   r     s"   

 r   r=   c                   C   s   t tddd? S )N   Zbigr   )rJ   
from_bytesosurandomr"   r"   r"   r#   random_serial_numberH  s    r   )N)N)N)N)N)N)Er{   r4   r   rT   Zcryptographyr   Z"cryptography.hazmat.bindings._rustr   r   Zcryptography.hazmat.primitivesr   r   Z)cryptography.hazmat.primitives.asymmetricr   r   r   r	   r
   r   r   Z/cryptography.hazmat.primitives.asymmetric.typesr   r   r   Zcryptography.x509.extensionsr   r   r   r   Zcryptography.x509.namer   r   Zcryptography.x509.oidr   r   	Exceptionr   r   r-   r   rI   r   rJ   r0   r7   r8   rN   EnumrY   r\   ABCMetar^   registerr   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r"   r"   r"   r#   <module>   s   $	$mtU            \ n I