HEX
Server: LiteSpeed
System: Linux s787.bom1.mysecurecloudhost.com 4.18.0-477.13.1.lve.el8.x86_64 #1 SMP Thu Jun 1 16:40:47 EDT 2023 x86_64
User: mobilech (5348)
PHP: 8.1.34
Disabled: NONE
$ pwd: /opt/saltstack/salt/lib/python3.10/site-packages/OpenSSL/__pycache__/
Upload Files
File: //opt/saltstack/salt/lib/python3.10/site-packages/OpenSSL/__pycache__/crypto.cpython-310.pyc
o

;j�7�@s�UddlmZddlZddlZddlZddlZddlZddlZddlm	Z	ddl
mZmZddlm
Z
ddlmZmZmZejdkrIddlmZnejd	krYe�d
�Zdwdd�ZnddlmZddlmZmZddlmZmZmZmZmZddlm Z ddlm!Z"ddlm#Z$ddlm%Z&ddlm'Z(ddlm)Z*ddlm+Z,gd�Z-eej.ej/ej0ej1ej2fZ3eej4ej5ej6ej7ej8fZ9ee3e9fZ:ee;ede;ffZ<e(j=Z>de?d<e(j@ZAde?d <d!ZBe(jCZDde?d"<e(jEZFde?d#<e(jGZHde?d$<e(jIZJde?d%<Gd&d'�d'eK�ZLe
e$eL�ZMe*eL�ZNdxdyd+d,�ZOdzd/d0�ZPd{d4d5�ZQd|d6d7�ZRd}d9d:�ZSGd;d<�d<�ZTGd=d>�d>�ZUGd?d@�d@�ZVedA�d~dCdD��ZWedE�ddGdH��ZXejYGdIdJ�dJ��ZZedK�GdLdM�dM��Z[edN�GdOdP�dP��Z\GdQdR�dR�Z]GdSdT�dT�Z^GdUdV�dV�Z_GdWdX�dXeK�Z`GdYdZ�dZ�Zad�d\d]�Zbd�d_d`�Zcd�dbdc�Zd		d�d�dhdi�ZeGdjdk�dk�Zfd�dmdn�Zg	dxd�dodp�Zhd�drds�ZieiZjejeiekdNeldsdt�d�dudv�ZmemZnejemekdNeldvdt�dS)��)�annotationsN)�	b16encode)�Iterable�Sequence)�partial)�Any�Callable�Union)��
)�
deprecated)r
��T�msg�str�kwargs�object�return�Callable[[_T], _T]cKsdd�S)NcSs|S�N�)�frr�B/opt/saltstack/salt/lib/python3.10/site-packages/OpenSSL/crypto.py�<lambda>szdeprecated.<locals>.<lambda>r)rrrrrrsr)�utils�x509)�dsa�ec�ed448�ed25519�rsa)�StrOrBytesPath)�byte_string)�exception_from_error_queue)�ffi)�lib)�make_assert)�
path_bytes)�
FILETYPE_ASN1�FILETYPE_PEM�
FILETYPE_TEXT�TYPE_DSA�TYPE_RSA�X509�Error�PKey�
X509Extension�X509Name�X509Req�	X509Store�X509StoreContext�X509StoreContextError�X509StoreFlags�dump_certificate�dump_certificate_request�dump_privatekey�dump_publickey�get_elliptic_curve�get_elliptic_curves�load_certificate�load_certificate_request�load_privatekey�load_publickey.�intr)r(i��r,r+�TYPE_DH�TYPE_ECc@seZdZdZdS)r.z7
    An error occurred in an `OpenSSL.crypto` API.
    N)�__name__�
__module__�__qualname__�__doc__rrrrr.tsr.�buffer�bytes | NonercCsf|durt�t���}tj}nt�d|�}t�|t|��}|fd	dd�}t|tj	k�t�
||�}|S)
z�
    Allocate a new OpenSSL memory BIO.

    Arrange for the garbage collector to clean it up automatically.

    :param buffer: None or some bytes to use to put into the BIO so that they
        can be read out.
    N�char[]�bior�refrcSs
t�|�Sr)�_lib�BIO_free)rKrLrrr�free��
z_new_mem_buf.<locals>.free)rKrrLrrr)rMZBIO_newZ	BIO_s_memrN�_ffi�newZBIO_new_mem_buf�len�_openssl_assert�NULL�gc)rHrKrO�datarrr�_new_mem_buf~s	rXrK�bytescCs.t�d�}t�||�}t�|d|�dd�S)zO
    Copy the contents of an OpenSSL BIO object into a Python byte string.
    zchar**rN)rQrRrMZBIO_get_mem_datarH)rK�
result_bufferZ
buffer_lengthrrr�_bio_to_string�s
r[�boundary�when�NonecCs@t|t�s	td��t|tjk�t�||�}|dkrtd��dS)a�
    The the time value of an ASN1 time object.

    @param boundary: An ASN1_TIME pointer (or an object safely
        castable to that type) which will have its value set.
    @param when: A string representation of the desired time value.

    @raise TypeError: If C{when} is not a L{bytes} string.
    @raise ValueError: If C{when} does not represent a time in the required
        format.
    @raise RuntimeError: If the time value cannot be set for some other
        (unspecified) reason.
    zwhen must be a byte stringrzInvalid stringN)	�
isinstancerY�	TypeErrorrTrQrUrMZASN1_TIME_set_string�
ValueError)r\r]�
set_resultrrr�_set_asn1_time�s
�rccCs2t��}t|tjk�t�|tj�}t||�|S)a�
    Behaves like _set_asn1_time but returns a new ASN1_TIME object.

    @param when: A string representation of the desired time value.

    @raise TypeError: If C{when} is not a L{bytes} string.
    @raise ValueError: If C{when} does not represent a time in the required
        format.
    @raise RuntimeError: If the time value cannot be set for some other
        (unspecified) reason.
    )rMZ
ASN1_TIME_newrTrQrUrVZASN1_TIME_freerc)r]�retrrr�_new_asn1_time�s

re�	timestampcCs�t�d|�}t�|�dkrdSt�|�tjkrt�t�|��St�d�}t�	||�t
|dtjk�t�d|d�}t�|�}t�|�}t�|d�|S)a]
    Retrieve the time value of an ASN1 time object.

    @param timestamp: An ASN1_GENERALIZEDTIME* (or an object safely castable to
        that type) from which the time value will be retrieved.

    @return: The time value from C{timestamp} as a L{bytes} string in a certain
        format.  Or C{None} if the object contains no time value.
    �ASN1_STRING*rNzASN1_GENERALIZEDTIME**)
rQ�castrM�ASN1_STRING_lengthZASN1_STRING_typeZV_ASN1_GENERALIZEDTIME�string�ASN1_STRING_get0_datarRZASN1_TIME_to_generalizedtimerTrUZASN1_GENERALIZEDTIME_free)rfZstring_timestampZgeneralized_timestampZstring_data�
string_resultrrr�_get_asn1_time�s



rmc@s*eZdZddd�Zd
dd�Zdd	d
�ZdS)�_X509NameInvalidatorrr^cCs
g|_dSr)�_names��selfrrr�__init__�rPz_X509NameInvalidator.__init__�namer1cCs|j�|�dSr)ro�append�rqrsrrr�add�sz_X509NameInvalidator.addcCs|jD]}|`qdSr)ro�_namerurrr�clear�s
�z_X509NameInvalidator.clearN�rr^�rsr1rr^)rDrErFrrrvrxrrrrrn�s

rnc@sbeZdZdZdZdZddd�Zdd	d
�Zeddd
��Z	ddd�Z
ddd�Zd dd�Zd dd�Z
dS)!r/zD
    A class representing an DSA or RSA public key or key pair.
    FTrr^cCs"t��}t�|tj�|_d|_dS)NF)rMZEVP_PKEY_newrQrV�
EVP_PKEY_free�_pkey�_initialized�rq�pkeyrrrrr�s
z
PKey.__init__�_KeycCsNddlm}m}|jrtt|�}t�t||��St	t|�}t�t||dd��S)a
        Export as a ``cryptography`` key.

        :rtype: One of ``cryptography``'s `key interfaces`_.

        .. _key interfaces: https://cryptography.io/en/latest/hazmat/            primitives/asymmetric/rsa/#key-interfaces

        .. versionadded:: 16.1.0
        r)�load_der_private_key�load_der_public_keyN)�password)
�,cryptography.hazmat.primitives.serializationr�r��_only_publicr:r(�typingrhr�r9)rqr�r��derrrr�to_cryptography_keys

zPKey.to_cryptography_key�
crypto_keycCs�t|tjtjtjtjtjtj	t
jt
jt
jt
jf
�std��ddlm}m}m}m}t|tjtjtj	t
jt
jf�rCtt|�|j|j��S|�|j|j|��}tt|�S)z�
        Construct based on a ``cryptography`` *crypto_key*.

        :param crypto_key: A ``cryptography`` key.
        :type crypto_key: One of ``cryptography``'s `key interfaces`_.

        :rtype: PKey

        .. versionadded:: 16.1.0
        zUnsupported key typer)�Encoding�NoEncryption�
PrivateFormat�PublicFormat)r_r�
DSAPrivateKey�DSAPublicKeyr�EllipticCurvePrivateKey�EllipticCurvePublicKeyr�Ed25519PrivateKey�Ed25519PublicKeyr�Ed448PrivateKey�Ed448PublicKeyr �
RSAPrivateKey�RSAPublicKeyr`r�r�r�r�r�r@r(�public_bytes�DERZSubjectPublicKeyInfoZ
private_bytesZPKCS8r?)�clsr�r�r�r�r�r�rrr�from_cryptography_keysF����
���
zPKey.from_cryptography_key�typerA�bitsc	Cs4t|t�s	td��t|t�std��|tkrQ|dkrtd��t��}t�|tj	�}t�
|tj�t��}t�
|||tj�}t|dk�t�|j|�}t|dk�nD|tkr�t��}t|tjk�t�|tj�}t�||tjdtjtjtj�}t|dk�tt�|�dk�tt�|j|�dk�ntd��d|_dS)	a3
        Generate a key pair of the given type, with the given number of bits.

        This generates a key "into" the this object.

        :param type: The key type.
        :type type: :py:data:`TYPE_RSA` or :py:data:`TYPE_DSA`
        :param bits: The number of bits.
        :type bits: :py:data:`int` ``>= 0``
        :raises TypeError: If :py:data:`type` or :py:data:`bits` isn't
            of the appropriate type.
        :raises ValueError: If the number of bits isn't an integer of
            the appropriate size.
        :return: ``None``
        ztype must be an integerzbits must be an integerrzInvalid number of bits�zNo such key typeTN)r_rAr`r,rarMZBN_newrQrV�BN_freeZBN_set_wordZRSA_F4ZRSA_newZRSA_generate_key_exrUrTZEVP_PKEY_assign_RSAr|r+ZDSA_newZDSA_freeZDSA_generate_parameters_exZDSA_generate_keyZEVP_PKEY_set1_DSAr.r})rqr�r�Zexponentr �resultr�resrrr�generate_keyUs6

�
zPKey.generate_key�boolcCsd|jrtd��t�|���tjkrtd��t�|j�}t�	|tj
�}t�|�}|dkr-dSt�dS)ax
        Check the consistency of an RSA private key.

        This is the Python equivalent of OpenSSL's ``RSA_check_key``.

        :return: ``True`` if key is consistent.

        :raise OpenSSL.crypto.Error: if the key is inconsistent.

        :raise TypeError: if the key is of a type which cannot be checked.
            Only RSA keys can currently be checked.
        zpublic key onlyz'Only RSA keys can currently be checked.r�TN)
r�r`rMZ
EVP_PKEY_typer��EVP_PKEY_RSA�EVP_PKEY_get1_RSAr|rQrV�RSA_freeZ
RSA_check_key�_raise_current_error)rqr r�rrr�check�s


z
PKey.checkcC�t�|j�S)zT
        Returns the type of the key

        :return: The type of the key.
        )rM�EVP_PKEY_idr|rprrrr���z	PKey.typecCr�)zh
        Returns the number of bits of the key

        :return: The number of bits of the key.
        )rMZ
EVP_PKEY_bitsr|rprrrr��r�z	PKey.bitsNry)rr�)r�r�rr/)r�rAr�rArr^�rr��rrA)rDrErFrGr�r}rrr��classmethodr�r�r�r�r�rrrrr/�s


9
8
r/csneZdZdZdZd�fdd�Zeddd��Zedd
d��Zeddd��Z	ddd�Z
d dd�Zd!dd�Z�Z
S)"�_EllipticCurveaZ
    A representation of a supported elliptic curve.

    @cvar _curves: :py:obj:`None` until an attempt is made to load the curves.
        Thereafter, a :py:type:`set` containing :py:type:`_EllipticCurve`
        instances each of which represents one curve supported by the system.
    @type _curves: :py:type:`NoneType` or :py:type:`set`
    N�otherrrr�cst|t�rt��|�StS)z�
        Implement cooperation with the right-hand side argument of ``!=``.

        Python 3 seems to have dropped this cooperation in this very narrow
        circumstance.
        )r_r��super�__ne__�NotImplemented�rqr���	__class__rrr��s
z_EllipticCurve.__ne__r%�set[_EllipticCurve]cs>��tjd�}t�d|�}��||�t��fdd�|D��S)z�
        Get the curves supported by OpenSSL.

        :param lib: The OpenSSL library binding object.

        :return: A :py:type:`set` of ``cls`` instances giving the names of the
            elliptic curves the underlying library supports.
        rzEC_builtin_curve[]c3s�|]
}���|j�VqdSr)�from_nid�nid)�.0�c�r�r%rr�	<genexpr>�s�z7_EllipticCurve._load_elliptic_curves.<locals>.<genexpr>)ZEC_get_builtin_curvesrQrUrR�set)r�r%Z
num_curvesZbuiltin_curvesrr�r�_load_elliptic_curves�s
z$_EllipticCurve._load_elliptic_curvescCs|jdur|�|�|_|jS)a
        Get, cache, and return the curves supported by OpenSSL.

        :param lib: The OpenSSL library binding object.

        :return: A :py:type:`set` of ``cls`` instances giving the names of the
            elliptic curves the underlying library supports.
        N)�_curvesr�r�rrr�_get_elliptic_curves�s

z#_EllipticCurve._get_elliptic_curvesr�rAcCs|||t�|�|���d��S)a�
        Instantiate a new :py:class:`_EllipticCurve` associated with the given
        OpenSSL NID.

        :param lib: The OpenSSL library binding object.

        :param nid: The OpenSSL NID the resulting curve object will represent.
            This must be a curve NID (and not, for example, a hash NID) or
            subsequent operations will fail in unpredictable ways.
        :type nid: :py:class:`int`

        :return: The curve object.
        �ascii)rQrj�
OBJ_nid2sn�decode)r�r%r�rrrr��sz_EllipticCurve.from_nidrsrr^cCs||_||_||_dS)a�
        :param _lib: The :py:mod:`cryptography` binding instance used to
            interface with OpenSSL.

        :param _nid: The OpenSSL NID identifying the curve this object
            represents.
        :type _nid: :py:class:`int`

        :param name: The OpenSSL short name identifying the curve this object
            represents.
        :type name: :py:class:`unicode`
        N)rM�_nidrs)rqr%r�rsrrrrrs

z_EllipticCurve.__init__cCsd|j�d�S)Nz<Curve �>�rsrprrr�__repr__�z_EllipticCurve.__repr__cCs|j�|j�}t�|tj�S)z�
        Create a new OpenSSL EC_KEY structure initialized to use this curve.

        The structure is automatically garbage collected when the Python object
        is garbage collected.
        )rMZEC_KEY_new_by_curve_namer�rQrVZEC_KEY_free)rq�keyrrr�
_to_EC_KEYsz_EllipticCurve._to_EC_KEY�r�rrr�)r%rrr�)r%rr�rArr�)r%rr�rArsrrr^�rr�rr)rDrErFrGr�r�r�r�r�r�rrr�r��
__classcell__rrr�rr��s	


r�zSget_elliptic_curves is deprecated. You should use the APIs in cryptography instead.r�cCs
t�t�S)a�
    Return a set of objects representing the elliptic curves supported in the
    OpenSSL build in use.

    The curve objects have a :py:class:`unicode` ``name`` attribute by which
    they identify themselves.

    The curve objects are useful as values for the argument accepted by
    :py:meth:`Context.set_tmp_ecdh` to specify which elliptical curve should be
    used for ECDHE key exchange.
    )r�r�rMrrrrr<s
r<zRget_elliptic_curve is deprecated. You should use the APIs in cryptography instead.rscCs(t�D]}|j|kr|Sqtd|��)aT
    Return a single curve object selected by name.

    See :py:func:`get_elliptic_curves` for information about curve objects.

    :param name: The OpenSSL short name identifying the curve object to
        retrieve.
    :type name: :py:class:`unicode`

    If the named curve is not supported then :py:class:`ValueError` is raised.
    zunknown curve name)r<rsra)rsZcurverrrr;2s


�
r;csreZdZdZd dd�Zd!�fd
d�Zd"d
d�Zd#dd�Zd#dd�Zd$dd�Z	d%dd�Z
d&dd�Zd'dd�Z�Z
S)(r1a
    An X.509 Distinguished Name.

    :ivar countryName: The country of the entity.
    :ivar C: Alias for  :py:attr:`countryName`.

    :ivar stateOrProvinceName: The state or province of the entity.
    :ivar ST: Alias for :py:attr:`stateOrProvinceName`.

    :ivar localityName: The locality of the entity.
    :ivar L: Alias for :py:attr:`localityName`.

    :ivar organizationName: The organization name of the entity.
    :ivar O: Alias for :py:attr:`organizationName`.

    :ivar organizationalUnitName: The organizational unit of the entity.
    :ivar OU: Alias for :py:attr:`organizationalUnitName`

    :ivar commonName: The common name of the entity.
    :ivar CN: Alias for :py:attr:`commonName`.

    :ivar emailAddress: The e-mail address of the entity.
    rsrr^cCs t�|j�}t�|tj�|_dS)z�
        Create a new X509Name, copying the given X509Name instance.

        :param name: The name to copy.
        :type name: :py:class:`X509Name`
        N)rMZ
X509_NAME_duprwrQrVZX509_NAME_freerurrrrrbszX509Name.__init__r�valuerc		s|�d�rt��||�St|�turtdt|�jd�d���t�t	|��}|tj
kr?zt�Wt
d��ty>Yt
d��wtt�|j��D]%}t�|j|�}t�|�}t�|�}||krlt�|j|�}t�|�nqGt|t�rw|�d�}t�|j|tj|t|�dd�}|s�t�dSdS)	N�_z$attribute name must be string, not 'z.200�'�No such attribute�utf-8���r)�
startswithr��__setattr__r�rr`rDrM�OBJ_txt2nid�_byte_string�	NID_undefr�r.�AttributeError�range�X509_NAME_entry_countrw�X509_NAME_get_entry�X509_NAME_ENTRY_get_object�OBJ_obj2nidZX509_NAME_delete_entryZX509_NAME_ENTRY_freer_�encodeZX509_NAME_add_entry_by_NIDZ
MBSTRING_UTF8rS)	rqrsr�r��i�entZent_objZent_nid�
add_resultr�rrr�lsD

��
��


�

�
�zX509Name.__setattr__�
str | Nonec	
Cs�t�t|��}|tjkr!zt�Wtd��ty Ytd��wt�|j|d�}|dkr/dSt�	|j|�}t�
|�}t�d�}t�
||�}t|dk�zt�|d|�dd��d�}Wt�|d�|St�|d�w)a

        Find attribute. An X509Name object has the following attributes:
        countryName (alias C), stateOrProvince (alias ST), locality (alias L),
        organization (alias O), organizationalUnit (alias OU), commonName
        (alias CN) and more...
        r�r�N�unsigned char**rr�)rMr�r�r�r�r.r�ZX509_NAME_get_index_by_NIDrwr��X509_NAME_ENTRY_get_datarQrRZASN1_STRING_to_UTF8rTrHr��OPENSSL_free)	rqrsr�Zentry_index�entryrWrZZdata_lengthr�rrr�__getattr__�s0
��

��zX509Name.__getattr__r�r�cCs"t|t�stSt�|j|j�dkS�Nr�r_r1r�rMZ
X509_NAME_cmprwr�rrr�__eq__��
zX509Name.__eq__cCs"t|t�stSt�|j|j�dkSr�r�r�rrr�__lt__�r�zX509Name.__lt__cCsDt�dd�}t�|j|t|��}t|tjk�d�t�	|��
d��S)z6
        String representation of an X509Name
        rJiz<X509Name object '{}'>r�)rQrRrMZX509_NAME_onelinerwrSrTrU�formatrjr�)rqrZZ
format_resultrrrr��s��zX509Name.__repr__rAcCr�)a&
        Return an integer representation of the first four bytes of the
        MD5 digest of the DER representation of the name.

        This is the Python equivalent of OpenSSL's ``X509_NAME_hash``.

        :return: The (integer) hash of this name.
        :rtype: :py:class:`int`
        )rMZX509_NAME_hashrwrprrr�hash��
z
X509Name.hashrYcCsNt�d�}t�|j|�}t|dk�t�|d|�dd�}t�|d�|S)z�
        Return the DER encoding of this name.

        :return: The DER encoded form of this name.
        :rtype: :py:class:`bytes`
        r�rN)rQrRrMZ
i2d_X509_NAMErwrTrHr�)rqrZZ
encode_resultrlrrrr��s
zX509Name.der�list[tuple[bytes, bytes]]c	Cs�g}tt�|j��D]7}t�|j|�}t�|�}t�|�}t�|�}t�|�}t	�
t�|�t�|��dd�}|�
t	�|�|f�q
|S)z�
        Returns the components of this name, as a sequence of 2-tuples.

        :return: The components of this name.
        :rtype: :py:class:`list` of ``name, value`` tuples.
        N)r�rMr�rwr�r�r�r�r�rQrHrkrirtrj)	rqr�r�r��fnameZfvalr�rsr�rrr�get_components�s



��zX509Name.get_componentsrz)rsrr�rrr^)rsrrr�r�r�r��rrY)rr�)rDrErFrGrrr�r�r�r�r�r�r�r�r�rrr�rr1Hs


'
(



r1zZX509Extension support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c@s�eZdZUdZ		d"d#d
d�Zed$dd��Zejdej	dej
diZded<d%dd�Z
d%dd�Zd&dd�Zd'dd�Zd'd d!�ZdS)(r0zu
    An X.509 v3 certificate extension.

    .. deprecated:: 23.3.0
       Use cryptography's X509 APIs instead.
    N�	type_namerY�criticalr�r��subject�X509 | None�issuerrr^cCs�t�d�}t�|tjtjtjtjd�t�|�|dur)t|t�s%td��|j	|_
|dur:t|t�s6td��|j	|_|r@d|}t�tj|||�}|tjkrQt
�t�|tj�|_dS)a�
        Initializes an X509 extension.

        :param type_name: The name of the type of extension_ to create.
        :type type_name: :py:data:`bytes`

        :param bool critical: A flag indicating whether this is a critical
            extension.

        :param value: The OpenSSL textual representation of the extension's
            value.
        :type value: :py:data:`bytes`

        :param subject: Optional X509 certificate to use as subject.
        :type subject: :py:class:`X509`

        :param issuer: Optional X509 certificate to use as issuer.
        :type issuer: :py:class:`X509`

        .. _extension: https://www.openssl.org/docs/manmaster/man5/
            x509v3_config.html#STANDARD-EXTENSIONS
        zX509V3_CTX*rNzissuer must be an X509 instancez subject must be an X509 instances	critical,)rQrRrMZX509V3_set_ctxrUZX509V3_set_ctx_nodbr_r-r`�_x509Zissuer_certZsubject_certZX509V3_EXT_nconfr�rV�X509_EXTENSION_free�
_extension)rqr�r�r�r�r��ctx�	extensionrrrrrs"




zX509Extension.__init__rcCst�t�|j��Sr)rMr��X509_EXTENSION_get_objectr�rprrrr�\s
�zX509Extension._nid�email�DNSZURIztyping.ClassVar[dict[int, str]]�	_prefixesrc		Cs�t�dt�|j��}t�|tj�}g}tt�|��D]Q}t�	||�}z|j
|j}WntyFt
�}t�||�|�t|��d��Yqwt�d|jj�}t�t�|�t�|��dd��d�}|�|d|�qd�|�S)NzGENERAL_NAMES*r�rg�:z, )rQrhrMZX509V3_EXT_d2ir�rVZGENERAL_NAMES_freer�Zsk_GENERAL_NAME_numZsk_GENERAL_NAME_valuerr��KeyErrorrXZGENERAL_NAME_printrtr[r��dZia5rHrkri�join)	rq�names�partsr�rsZlabelrKZasn1_stringr�rrr�_subjectAltNameStringhs2�����
z#X509Extension._subjectAltNameStringcCsFtj|jkr
|��St�}t�||jdd�}t|dk�t|��	d�S)zF
        :return: a nice text representation of the extension
        rr�)
rMZNID_subject_alt_namer�rrXZX509V3_EXT_printr�rTr[r�)rqrKZprint_resultrrr�__str__�szX509Extension.__str__cCr�)zk
        Returns the critical field of this X.509 extension.

        :return: The critical field.
        )rMZX509_EXTENSION_get_criticalr�rprrr�get_critical�r�zX509Extension.get_criticalcCs8t�|j�}t�|�}t�|�}|tjkrt�|�SdS)z�
        Returns the short type name of this X.509 extension.

        The result is a byte string such as :py:const:`b"basicConstraints"`.

        :return: The short type name.
        :rtype: :py:data:`bytes`

        .. versionadded:: 0.12
        sUNDEF)rMrr�r�r�rQrUrj)rq�objr��bufrrr�get_short_name�s



zX509Extension.get_short_namecCs@t�|j�}t�d|�}t�|�}t�|�}t�||�dd�S)z�
        Returns the data of the X509 extension, encoded as ASN.1.

        :return: The ASN.1 encoded data of this X509 extension.
        :rtype: :py:data:`bytes`

        .. versionadded:: 0.12
        rgN)rMZX509_EXTENSION_get_datar�rQrhrkrirH)rqZoctet_resultrlZchar_result�
result_lengthrrr�get_data�s
	

zX509Extension.get_data�NN)r�rYr�r�r�rYr�r�r�r�rr^r�r�r�r�)rDrErFrGrr�propertyr�rMZ	GEN_EMAILZGEN_DNSZGEN_URIr�__annotations__rrr
rrrrrrr0s 
�E�



r0zPCSR support in pyOpenSSL is deprecated. You should use the APIs in cryptography.c@s�eZdZdZd*dd�Zd+dd�Zed,d
d��Zd-dd�Zd.dd�Z	d/dd�Z
d0dd�Zd1dd�Zd2dd�Z
d3d d!�Zd4d$d%�Zd5d'd(�Zd)S)6r2z�
    An X.509 certificate signing requests.

    .. deprecated:: 24.2.0
       Use `cryptography.x509.CertificateSigningRequest` instead.
    rr^cCs&t��}t�|tj�|_|�d�dSr�)rMZX509_REQ_newrQrV�
X509_REQ_free�_req�set_version)rq�reqrrrrr�szX509Req.__init__�x509.CertificateSigningRequestcC�ddlm}tt|�}||�S)z�
        Export as a ``cryptography`` certificate signing request.

        :rtype: ``cryptography.x509.CertificateSigningRequest``

        .. versionadded:: 17.1.0
        r)�load_der_x509_csr)�cryptography.x509r�"_dump_certificate_request_internalr()rqrr�rrr�to_cryptography�s
zX509Req.to_cryptography�
crypto_reqcC�6t|tj�s
td��ddlm}|�|j�}tt	|�S)a
        Construct based on a ``cryptography`` *crypto_req*.

        :param crypto_req: A ``cryptography`` X.509 certificate signing request
        :type crypto_req: ``cryptography.x509.CertificateSigningRequest``

        :rtype: X509Req

        .. versionadded:: 17.1.0
        z%Must be a certificate signing requestr�r�)
r_rZCertificateSigningRequestr`r�r�r�r��"_load_certificate_request_internalr()r�r r�r�rrr�from_cryptography�s

zX509Req.from_cryptographyrr/cCs t�|j|j�}t|dk�dS)z�
        Set the public key of the certificate signing request.

        :param pkey: The public key to use.
        :type pkey: :py:class:`PKey`

        :return: ``None``
        r�N)rMZX509_REQ_set_pubkeyrr|rT�rqrrbrrr�
set_pubkey�s	zX509Req.set_pubkeycCsDt�t�}t�|j�|_t|jtjk�t�	|jtj
�|_d|_|S)z�
        Get the public key of the certificate signing request.

        :return: The public key.
        :rtype: :py:class:`PKey`
        T)r/�__new__rMZX509_REQ_get_pubkeyrr|rTrQrUrVr{r�r~rrr�
get_pubkey�s
zX509Req.get_pubkey�versionrAcCs@t|t�s	td��|dkrtd��t�|j|�}t|dk�dS)z�
        Set the version subfield (RFC 2986, section 4.1) of the certificate
        request.

        :param int version: The version number.
        :return: ``None``
        zversion must be an intrz9Invalid version. The only valid version for X509Req is 0.r�N)r_rAr`rarMZX509_REQ_set_versionrrT)rqr)rbrrrrs
�zX509Req.set_versioncCr�)z�
        Get the version subfield (RFC 2459, section 4.1.2.1) of the certificate
        request.

        :return: The value of the version subfield.
        :rtype: :py:class:`int`
        )rMZX509_REQ_get_versionrrprrr�get_versionszX509Req.get_versionr1cCs2t�t�}t�|j�|_t|jtjk�||_	|S)a�
        Return the subject of this certificate signing request.

        This creates a new :class:`X509Name` that wraps the underlying subject
        name field on the certificate signing request. Modifying it will modify
        the underlying signing request, and will have the effect of modifying
        any other :class:`X509Name` that refers to this subject.

        :return: The subject of this certificate signing request.
        :rtype: :class:`X509Name`
        )
r1r'rMZX509_REQ_get_subject_namerrwrTrQrU�_ownerrurrr�get_subject&s

zX509Req.get_subject�
extensions�Iterable[X509Extension]cCs|tjdtdd�t��}t|tjk�t�|tj	�}|D]}t
|t�s'td��t�
||j�qt�|j|�}t|dk�dS)z�
        Add extensions to the certificate signing request.

        :param extensions: The X.509 extensions to add.
        :type extensions: iterable of :py:class:`X509Extension`
        :return: ``None``
        ��This API is deprecated and will be removed in a future version of pyOpenSSL. You should use pyca/cryptography's X.509 APIs instead.���
stacklevel�+One of the elements is not an X509Extensionr�N)�warnings�warn�DeprecationWarningrMZsk_X509_EXTENSION_new_nullrTrQrUrVZsk_X509_EXTENSION_freer_r0raZsk_X509_EXTENSION_pushr�ZX509_REQ_add_extensionsr)rqr-�stack�extr�rrr�add_extensions<s�

zX509Req.add_extensions�list[X509Extension]cCs~tjdtdd�g}t�|j�}t�|dd��}tt�	|��D]}t
�t
�}t�t�
||��}t�|tj�|_|�|�q|S)z�
        Get X.509 extensions in the certificate signing request.

        :return: The X.509 extensions in this request.
        :rtype: :py:class:`list` of :py:class:`X509Extension` objects.

        .. versionadded:: 0.15
        r/r0r1cSst�|t�tjd��S)Nr�)rMZsk_X509_EXTENSION_pop_freerQ�	addressofZ
_original_lib)�xrrrrts�z(X509Req.get_extensions.<locals>.<lambda>)r4r5r6rMZX509_REQ_get_extensionsrrQrVr�Zsk_X509_EXTENSION_numr0r'�X509_EXTENSION_dupZsk_X509_EXTENSION_valuer�r�rt)rqZextsZnative_exts_objr�r8rrrr�get_extensions]s&	�
�

�zX509Req.get_extensions�digestrcCs^|jrtd��|jstd��t�t|��}|tjkrtd��t�|j	|j
|�}t|dk�dS)aa
        Sign the certificate signing request with this key and digest type.

        :param pkey: The key pair to sign with.
        :type pkey: :py:class:`PKey`
        :param digest: The name of the message digest to use for the signature,
            e.g. :py:data:`"sha256"`.
        :type digest: :py:class:`str`
        :return: ``None``
        zKey has only public part�Key is uninitialized�No such digest methodrN)r�rar}rM�EVP_get_digestbynamer�rQrUZ
X509_REQ_signrr|rT)rqrr?Z
digest_obj�sign_resultrrr�sign�s
zX509Req.signr�cCs4t|t�s	td��t�|j|j�}|dkrt�|S)a@
        Verifies the signature on this certificate signing request.

        :param PKey key: A public key.

        :return: ``True`` if the signature is correct.
        :rtype: bool

        :raises OpenSSL.crypto.Error: If the signature is invalid or there is a
            problem verifying the signature.
        �pkey must be a PKey instancer)r_r/r`rMZX509_REQ_verifyrr|r�)rqrr�rrr�verify�s
zX509Req.verifyNry)rr)r rrr2�rr/rr^�rr/�r)rArr^r��rr1�r-r.rr^)rr:�rr/r?rrr^)rr/rr�)rDrErFrGrrrr�r$r&r(rr*r,r9r>rDrFrrrrr2�s









!
&r2c@sXeZdZdZd`dd�Zedadd	��Zdbdd�Zedcdd��Zdddd�Z	dedd�Z
dfdd�Zdgdd�Zdhdd�Z
did!d"�Zdjd$d%�Zded&d'�Zdkd)d*�Zded+d,�Zdld.d/�Zdld0d1�Zdmd3d4�Zdnd7d8�Zdod9d:�Zdpd=d>�Zdqd?d@�ZdodAdB�ZdqdCdD�ZdrdFdG�ZdsdIdJ�ZdtdKdL�ZdudNdO�ZdtdPdQ�Z dvdSdT�Z!dedUdV�Z"dwdYdZ�Z#dxd]d^�Z$d_S)yr-z
    An X.509 certificate.
    rr^cCs:t��}t|tjk�t�|tj�|_t�|_	t�|_
dSr)rMZX509_newrTrQrUrV�	X509_freer�rn�_issuer_invalidator�_subject_invalidator)rqrrrrrr�s
z
X509.__init__rrcCs.|�|�}t�|tj�|_t�|_t�|_|Sr)	r'rQrVrMrMr�rnrNrO)r�r�certrrr�_from_raw_x509_ptr�s

zX509._from_raw_x509_ptr�x509.CertificatecCr)z�
        Export as a ``cryptography`` certificate.

        :rtype: ``cryptography.x509.Certificate``

        .. versionadded:: 17.1.0
        r)�load_der_x509_certificate)rrSr7r()rqrSr�rrrr�s
zX509.to_cryptography�crypto_certcCr!)z�
        Construct based on a ``cryptography`` *crypto_cert*.

        :param crypto_key: A ``cryptography`` X.509 certificate.
        :type crypto_key: ``cryptography.x509.Certificate``

        :rtype: X509

        .. versionadded:: 17.1.0
        zMust be a certificaterr")
r_r�Certificater`r�r�r�r�r=r()r�rTr�r�rrrr$�s

zX509.from_cryptographyr)rAcCs,t|t�s	td��tt�|j|�dk�dS)a	
        Set the version number of the certificate. Note that the
        version value is zero-based, eg. a value of 0 is V1.

        :param version: The version number of the certificate.
        :type version: :py:class:`int`

        :return: ``None``
        zversion must be an integerr�N)r_rAr`rTrMZX509_set_versionr�)rqr)rrrr�s

zX509.set_versioncCr�)z�
        Return the version number of the certificate.

        :return: The version number of the certificate.
        :rtype: :py:class:`int`
        )rMZX509_get_versionr�rprrrr*��zX509.get_versionr/cCsFt�t�}t�|j�|_|jtjkrt�t�	|jtj
�|_d|_|S)z{
        Get the public key of the certificate.

        :return: The public key.
        :rtype: :py:class:`PKey`
        T)r/r'rMZX509_get_pubkeyr�r|rQrUr�rVr{r�r~rrrr(�s
zX509.get_pubkeyrcCs2t|t�s	td��t�|j|j�}t|dk�dS)z�
        Set the public key of the certificate.

        :param pkey: The public key.
        :type pkey: :py:class:`PKey`

        :return: :py:data:`None`
        rEr�N)r_r/r`rMZX509_set_pubkeyr�r|rTr%rrrr&s
	zX509.set_pubkeyr?rcCspt|t�s	td��|jrtd��|jstd��t�t|��}|t	j
kr'td��t�|j|j
|�}t|dk�dS)a
        Sign the certificate with this key and digest type.

        :param pkey: The key to sign with.
        :type pkey: :py:class:`PKey`

        :param digest: The name of the message digest to use.
        :type digest: :py:class:`str`

        :return: :py:data:`None`
        rEzKey only has public partr@rArN)r_r/r`r�rar}rMrBr�rQrUZ	X509_signr�r|rT)rqrr?Zevp_mdrCrrrrDs

z	X509.signrYcCsZt�|j�}t�d�}t�|tjtj|�t�|d�}|tjkr%t	d��t�
t�|��S)z�
        Return the signature algorithm used in the certificate.

        :return: The name of the algorithm.
        :rtype: :py:class:`bytes`

        :raises ValueError: If the signature algorithm is undefined.

        .. versionadded:: 0.13
        zASN1_OBJECT **rzUndefined signature algorithm)rMZX509_get0_tbs_sigalgr�rQrRZX509_ALGOR_get0rUr�r�rarjZ
OBJ_nid2ln)rqZsig_algZalgr�rrr�get_signature_algorithm9s

zX509.get_signature_algorithm�digest_namecCs�t�t|��}|tjkrtd��t�dtj�}t�dd�}t|�|d<t�	|j
|||�}t|dk�d�dd�t�
||d�D��S)	a5
        Return the digest of the X509 object.

        :param digest_name: The name of the digest algorithm to use.
        :type digest_name: :py:class:`str`

        :return: The digest of the object, formatted as
            :py:const:`b":"`-delimited hex pairs.
        :rtype: :py:class:`bytes`
        rAzunsigned char[]zunsigned int[]r�r�:cSsg|]}t|����qSr)r�upper)r��chrrr�
<listcomp>es
��zX509.digest.<locals>.<listcomp>)rMrBr�rQrUrarRZEVP_MAX_MD_SIZErSZX509_digestr�rTrrH)rqrXr?rZrZ
digest_resultrrrr?Ls

���zX509.digestcCr�)z�
        Return the hash of the X509 subject.

        :return: The hash of the subject.
        :rtype: :py:class:`int`
        )rMZX509_subject_name_hashr�rprrr�subject_name_hashkrVzX509.subject_name_hash�serialcCs�t|t�s	td��t|�dd�}|�d�}t�d�}t�||�}t	|tj
k�t�|dtj
�}t�|d�t	|tj
k�t�
|tj�}t�|j|�}t	|dk�dS)z�
        Set the serial number of the certificate.

        :param serial: The new serial number.
        :type serial: :py:class:`int`

        :return: :py:data`None`
        zserial must be an integerr0Nr�zBIGNUM**rr�)r_rAr`�hexr�rQrRrMZ	BN_hex2bnrTrUZBN_to_ASN1_INTEGERr�rVZASN1_INTEGER_freeZX509_set_serialNumberr�)rqr^�
hex_serialZhex_serial_bytes�
bignum_serialr��asn1_serialrbrrr�set_serial_numberts
	

zX509.set_serial_numberc	Cspt�|j�}t�|tj�}z$t�|�}zt�|�}t|d�}|Wt�	|�Wt�
|�St�	|�wt�
|�w)zx
        Return the serial number of this certificate.

        :return: The serial number.
        :rtype: int
        �)rMZX509_get_serialNumberr�ZASN1_INTEGER_to_BNrQrUZ	BN_bn2hexrjrAr�r�)rqrbrar`Zhexstring_serialr^rrr�get_serial_number�s


�zX509.get_serial_number�amountcC�.t|t�s	td��t�|j�}t�||�dS)z�
        Adjust the time stamp on which the certificate stops being valid.

        :param int amount: The number of seconds by which to adjust the
            timestamp.
        :return: ``None``
        �amount must be an integerN)r_rAr`rM�X509_getm_notAfterr��X509_gmtime_adj)rqrfZnotAfterrrr�gmtime_adj_notAfter�s
zX509.gmtime_adj_notAftercCrg)z�
        Adjust the timestamp on which the certificate starts being valid.

        :param amount: The number of seconds by which to adjust the timestamp.
        :return: ``None``
        rhN)r_rAr`rM�X509_getm_notBeforer�rj)rqrfZ	notBeforerrr�gmtime_adj_notBefore�s
zX509.gmtime_adj_notBeforer�cCsT|��}|durtd��|�d�}tj�|d�}tjj}tj�|�jdd�}||kS)z�
        Check whether the certificate has expired.

        :return: ``True`` if the certificate has expired, ``False`` otherwise.
        :rtype: bool
        NzUnable to determine notAfterr�z
%Y%m%d%H%M%SZ)�tzinfo)	�get_notAfterrar��datetime�strptime�timezone�utc�now�replace)rqZ
time_bytesZtime_stringZ	not_after�UTC�utcnowrrr�has_expired�s
zX509.has_expired�whichrIcCst||j��Sr)rmr�)rqryrrr�_get_boundary_time�r�zX509._get_boundary_timecC�|�tj�S)a

        Get the timestamp at which the certificate starts being valid.

        The timestamp is formatted as an ASN.1 TIME::

            YYYYMMDDhhmmssZ

        :return: A timestamp string, or ``None`` if there is none.
        :rtype: bytes or NoneType
        )rzrMrlrprrr�
get_notBefore��zX509.get_notBefore�Callable[..., Any]r]cCst||j�|�Sr)rcr�)rqryr]rrr�_set_boundary_time�szX509._set_boundary_timecC�|�tj|�S)z�
        Set the timestamp at which the certificate starts being valid.

        The timestamp is formatted as an ASN.1 TIME::

            YYYYMMDDhhmmssZ

        :param bytes when: A timestamp string.
        :return: ``None``
        )rrMrl�rqr]rrr�
set_notBefore��zX509.set_notBeforecCr{)a	
        Get the timestamp at which the certificate stops being valid.

        The timestamp is formatted as an ASN.1 TIME::

            YYYYMMDDhhmmssZ

        :return: A timestamp string, or ``None`` if there is none.
        :rtype: bytes or NoneType
        )rzrMrirprrrro�r}zX509.get_notAftercCr�)z�
        Set the timestamp at which the certificate stops being valid.

        The timestamp is formatted as an ASN.1 TIME::

            YYYYMMDDhhmmssZ

        :param bytes when: A timestamp string.
        :return: ``None``
        )rrMrir�rrr�set_notAfter�r�zX509.set_notAfterr1cCs0t�t�}||j�|_t|jtjk�||_|Sr)r1r'r�rwrTrQrUr+)rqryrsrrr�	_get_names

zX509._get_namerscCs0t|t�s	td��||j|j�}t|dk�dS)Nzname must be an X509Namer�)r_r1r`r�rwrT)rqryrsrbrrr�	_set_names
zX509._set_namecC�|�tj�}|j�|�|S)a�
        Return the issuer of this certificate.

        This creates a new :class:`X509Name` that wraps the underlying issuer
        name field on the certificate. Modifying it will modify the underlying
        certificate, and will have the effect of modifying any other
        :class:`X509Name` that refers to this issuer.

        :return: The issuer of this certificate.
        :rtype: :class:`X509Name`
        )r�rMZX509_get_issuer_namerNrvrurrr�
get_issuer�zX509.get_issuerr�cC�|�tj|�|j��dS)z�
        Set the issuer of this certificate.

        :param issuer: The issuer.
        :type issuer: :py:class:`X509Name`

        :return: ``None``
        N)r�rMZX509_set_issuer_namerNrx)rqr�rrr�
set_issuer-�	zX509.set_issuercCr�)a�
        Return the subject of this certificate.

        This creates a new :class:`X509Name` that wraps the underlying subject
        name field on the certificate. Modifying it will modify the underlying
        certificate, and will have the effect of modifying any other
        :class:`X509Name` that refers to this subject.

        :return: The subject of this certificate.
        :rtype: :class:`X509Name`
        )r�rMZX509_get_subject_namerOrvrurrrr,9r�zX509.get_subjectr�cCr�)z�
        Set the subject of this certificate.

        :param subject: The subject.
        :type subject: :py:class:`X509Name`

        :return: ``None``
        N)r�rMZX509_set_subject_namerOrx)rqr�rrr�set_subjectIr�zX509.set_subjectcCr�)z�
        Get the number of extensions on this certificate.

        :return: The number of extensions.
        :rtype: :py:class:`int`

        .. versionadded:: 0.12
        )rMZX509_get_ext_countr�rprrr�get_extension_countUs	zX509.get_extension_countr-r.cCsNtjdtdd�|D]}t|t�std��t�|j|j	d�}t
|dk�q
dS)z�
        Add extensions to the certificate.

        :param extensions: The extensions to add.
        :type extensions: An iterable of :py:class:`X509Extension` objects.
        :return: ``None``
        r/r0r1r3r�r�N)r4r5r6r_r0rarMZX509_add_extr�r�rT)rqr-r8r�rrrr9`s�

�zX509.add_extensions�indexr0cCs^tjdtdd�t�t�}t�|j|�|_|jt	j
krtd��t�|j�}t	�
|tj�|_|S)a�
        Get a specific extension of the certificate by index.

        Extensions on a certificate are kept in order. The index
        parameter selects which extension will be returned.

        :param int index: The index of the extension to retrieve.
        :return: The extension at the specified index.
        :rtype: :py:class:`X509Extension`
        :raises IndexError: If the extension index was out of bounds.

        .. versionadded:: 0.12
        r/r0r1zextension index out of bounds)r4r5r6r0r'rMZX509_get_extr�r�rQrU�
IndexErrorr=rVr�)rqr�r8rrrr�
get_extensionys�

zX509.get_extensionNry)rrrr-)rrR)rTrRrr-rIr�rHrGrLr�)rXrrrY)r^rArr^)rfrArr^r�)ryrrrI)rrI)ryr~r]rYrr^)r]rYrr^)ryrrr1)ryrrsr1rr^rJ)r�r1rr^)r�r1rr^rK)r�rArr0)%rDrErFrGrrr�rQrr$rr*r(r&rDrWr?r]rcrerkrmrxrzr|rr�ror�r�r�r�r�r,r�r�r9r�rrrrr-�sH





	





	

















r-c@s�eZdZUdZejZded<ejZ	ded<ej
Zded<ejZ
ded<ejZded<ejZded<ejZded	<ejZded
<ejZded<ejZded<d
S)r6a
    Flags for X509 verification, used to change the behavior of
    :class:`X509Store`.

    See `OpenSSL Verification Flags`_ for details.

    .. _OpenSSL Verification Flags:
        https://www.openssl.org/docs/manmaster/man3/X509_VERIFY_PARAM_set_flags.html
    rA�	CRL_CHECK�
CRL_CHECK_ALL�IGNORE_CRITICAL�X509_STRICT�ALLOW_PROXY_CERTS�POLICY_CHECK�EXPLICIT_POLICY�INHIBIT_MAP�CHECK_SS_SIGNATURE�
PARTIAL_CHAINN)rDrErFrGrMZX509_V_FLAG_CRL_CHECKr�rZX509_V_FLAG_CRL_CHECK_ALLr�ZX509_V_FLAG_IGNORE_CRITICALr�ZX509_V_FLAG_X509_STRICTr�ZX509_V_FLAG_ALLOW_PROXY_CERTSr�ZX509_V_FLAG_POLICY_CHECKr�ZX509_V_FLAG_EXPLICIT_POLICYr�ZX509_V_FLAG_INHIBIT_MAPr�ZX509_V_FLAG_CHECK_SS_SIGNATUREr�ZX509_V_FLAG_PARTIAL_CHAINr�rrrrr6�s

r6c@sPeZdZdZddd�Zddd	�Zddd
�Zddd�Zd dd�Z	d!d"dd�Z	dS)#r3a�
    An X.509 store.

    An X.509 store is used to describe a context in which to verify a
    certificate. A description of a context may include a set of certificates
    to trust, a set of certificate revocation lists, verification flags and
    more.

    An X.509 store, being only a description, cannot be used by itself to
    verify a certificate. To carry out the actual verification process, see
    :class:`X509StoreContext`.
    rr^cCst��}t�|tj�|_dSr)rMZX509_STORE_newrQrVZX509_STORE_free�_store�rq�storerrrrr�szX509Store.__init__rPr-cCs0t|t�st��t�|j|j�}t|dk�dS)a�
        Adds a trusted certificate to this store.

        Adding a certificate with this method adds this certificate as a
        *trusted* certificate.

        :param X509 cert: The certificate to add to this store.

        :raises TypeError: If the certificate is not an :class:`X509`.

        :raises OpenSSL.crypto.Error: If OpenSSL was unhappy with your
            certificate.

        :return: ``None`` if the certificate was added successfully.
        r�N)r_r-r`rMZX509_STORE_add_certr�r�rT)rqrPr�rrr�add_cert�s
zX509Store.add_cert�crl�x509.CertificateRevocationListcCsvt|tj�r*ddlm}t|�|j��}t�	|t
j�}t|t
jk�t
�
|tj�}ntd��tt�|j|�dk�dS)a�
        Add a certificate revocation list to this store.

        The certificate revocation lists added to a store will only be used if
        the associated flags are configured to check certificate revocation
        lists.

        .. versionadded:: 16.1.0

        :param crl: The certificate revocation list to add to this store.
        :type crl: ``cryptography.x509.CertificateRevocationList``
        :return: ``None`` if the certificate revocation list was added
            successfully.
        rr"z?CRL must be of type cryptography.x509.CertificateRevocationListN)r_rZCertificateRevocationListr�r�rXr�r�rMZd2i_X509_CRL_biorQrUrTrVZ
X509_CRL_freer`ZX509_STORE_add_crlr�)rqr�r�rKZopenssl_crlrrr�add_crl�s�zX509Store.add_crl�flagsrAcCstt�|j|�dk�dS)a�
        Set verification flags to this store.

        Verification flags can be combined by oring them together.

        .. note::

          Setting a verification flag sometimes requires clients to add
          additional information to the store, otherwise a suitable error will
          be raised.

          For example, in setting flags to enable CRL checking a
          suitable CRL must be added to the store otherwise an error will be
          raised.

        .. versionadded:: 16.1.0

        :param int flags: The verification flags to set on this store.
            See :class:`X509StoreFlags` for available constants.
        :return: ``None`` if the verification flags were successfully set.
        rN)rTrMZX509_STORE_set_flagsr�)rqr�rrr�	set_flags�szX509Store.set_flags�vfy_time�datetime.datetimecCsFt��}t�|tj�}t�|t�|����t	t�
|j|�dk�dS)a�
        Set the time against which the certificates are verified.

        Normally the current time is used.

        .. note::

          For example, you can determine if a certificate was valid at a given
          time.

        .. versionadded:: 17.0.0

        :param datetime vfy_time: The verification time to set on this store.
        :return: ``None`` if the verification time was successfully set.
        rN)rMZX509_VERIFY_PARAM_newrQrVZX509_VERIFY_PARAM_freeZX509_VERIFY_PARAM_set_time�calendar�timegm�	timetuplerTZX509_STORE_set1_paramr�)rqr��paramrrr�set_times�zX509Store.set_timeN�cafile�StrOrBytesPath | None�capathcCsR|durtj}nt|�}|durtj}nt|�}t�|j||�}|s't�dSdS)a�
        Let X509Store know where we can find trusted certificates for the
        certificate chain.  Note that the certificates have to be in PEM
        format.

        If *capath* is passed, it must be a directory prepared using the
        ``c_rehash`` tool included with OpenSSL.  Either, but not both, of
        *cafile* or *capath* may be ``None``.

        .. note::

          Both *cafile* and *capath* may be set simultaneously.

          Call this method multiple times to add more than one location.
          For example, CA certificates, and certificate revocation list bundles
          may be passed in *cafile* in subsequent calls to this method.

        .. versionadded:: 20.0

        :param cafile: In which file we can find the certificates (``bytes`` or
                       ``unicode``).
        :param capath: In which directory we can find the certificates
                       (``bytes`` or ``unicode``).

        :return: ``None`` if the locations were set successfully.

        :raises OpenSSL.crypto.Error: If both *cafile* and *capath* is ``None``
            or the locations could not be set for any reason.

        N)rQrU�_path_bytesrMZX509_STORE_load_locationsr�r�)rqr�r�Zload_resultrrr�load_locations(s#�
�zX509Store.load_locationsry)rPr-rr^)r�r�rr^)r�rArr^)r�r�rr^r)r�r�r�r�rr^)
rDrErFrGrrr�r�r�r�r�rrrrr3�s




�r3cs"eZdZdZd�fd
d�Z�ZS)
r5z�
    An exception raised when an error occurred while verifying a certificate
    using `OpenSSL.X509StoreContext.verify_certificate`.

    :ivar certificate: The certificate which caused verificate failure.
    :type certificate: :class:`X509`
    �messager�errors�	list[Any]�certificater-rr^cst��|�||_||_dSr)r�rrr�r�)rqr�r�r�r�rrrres
zX509StoreContextError.__init__)r�rr�r�r�r-rr^)rDrErFrGrrr�rrr�rr5\sr5c@sbeZdZdZ	dddd�Zed dd��Zed!dd��Zd"dd�Zd#dd�Z	d$dd�Z
d%dd�ZdS)&r4a9
    An X.509 store context.

    An X.509 store context is used to carry out the actual verification process
    of a certificate in a described context. For describing such a context, see
    :class:`X509Store`.

    :param X509Store store: The certificates which will be trusted for the
        purposes of any verifications.
    :param X509 certificate: The certificate to be verified.
    :param chain: List of untrusted certificates that may be used for building
        the certificate chain. May be ``None``.
    :type chain: :class:`list` of :class:`X509`
    Nr�r3r�r-�chain�Sequence[X509] | Nonerr^cCs||_||_|�|�|_dSr)r��_cert�_build_certificate_stack�_chain)rqr�r�r�rrrrr}szX509StoreContext.__init__�certificatescCs�d	dd�}|dust|�dkrtjSt��}t|tjk�t�||�}|D]'}t|t�s0t	d��tt�
|j�dk�t�||j�dkrLt�
|j�t�q%|S)
N�srrr^cSs8tt�|��D]
}t�||�}t�|�qt�|�dSr)r�rM�sk_X509_num�
sk_X509_valuerM�sk_X509_free)r�r�r<rrr�cleanup�sz:X509StoreContext._build_certificate_stack.<locals>.cleanuprz+One of the elements is not an X509 instance)r�rrr^)rSrQrUrMZsk_X509_new_nullrTrVr_r-r`ZX509_up_refr�Zsk_X509_pushrMr�)r�r�r7rPrrrr��s

�z)X509StoreContext._build_certificate_stack�	store_ctxrr5cCs\t�t�t�|����d�}t�|�t�|�|g}t�|�}t�|�}t	�
|�}t|||�S)z�
        Convert an OpenSSL native context error failure into a Python
        exception.

        When a call to native OpenSSL X509_verify_cert fails, additional
        information about the failure can be obtained from the store context.
        r�)rQrjrMZX509_verify_cert_error_stringZX509_STORE_CTX_get_errorr�ZX509_STORE_CTX_get_error_depthZX509_STORE_CTX_get_current_certZX509_dupr-rQr5)r�r�r�r�r��pycertrrr�_exception_from_context�s	����


z(X509StoreContext._exception_from_contextcCsjt��}t|tjk�t�|tj�}t�||jj|j	j
|j�}t|dk�t�|�}|dkr3|�
|��|S)a3
        Verifies the certificate and runs an X509_STORE_CTX containing the
        results.

        :raises X509StoreContextError: If an error occurred when validating a
          certificate in the context. Sets ``certificate`` attribute to
          indicate which certificate caused the error.
        r�r)rMZX509_STORE_CTX_newrTrQrUrVZX509_STORE_CTX_freeZX509_STORE_CTX_initr�r�r�r�ZX509_verify_certr�)rqr�rdrrr�_verify_certificate�s	�

z$X509StoreContext._verify_certificatecCs
||_dS)z�
        Set the context's X.509 store.

        .. versionadded:: 0.15

        :param X509Store store: The store description which will be used for
            the purposes of any *future* verifications.
        N)r�r�rrr�	set_store�s
	zX509StoreContext.set_storecCs|��dS)a"
        Verify a certificate in a context.

        .. versionadded:: 0.15

        :raises X509StoreContextError: If an error occurred when validating a
          certificate in the context. Sets ``certificate`` attribute to
          indicate which certificate caused the error.
        N)r�rprrr�verify_certificate�r�z#X509StoreContext.verify_certificate�
list[X509]cCst|��}t�|�}t|tjk�g}tt�|��D]}t�||�}t|tjk�t	�
|�}|�|�qt�|�|S)aR
        Verify a certificate in a context and return the complete validated
        chain.

        :raises X509StoreContextError: If an error occurred when validating a
          certificate in the context. Sets ``certificate`` attribute to
          indicate which certificate caused the error.

        .. versionadded:: 20.0
        )
r�rMZX509_STORE_CTX_get1_chainrTrQrUr�r�r�r-rQrtr�)rqr�Z
cert_stackr�r�rPr�rrr�get_verified_chain�s


z#X509StoreContext.get_verified_chainr)r�r3r�r-r�r�rr^)r�r�rr^)r�rrr5r�)r�r3rr^ry)rr�)rDrErFrGrr�staticmethodr�r�r�r�r�r�rrrrr4ms�



r4r�cCsvt|t�r
|�d�}t|�}|tkrt�|tjtjtj�}n|t	kr*t�
|tj�}ntd��|tjkr6t�t
�|�S)a
    Load a certificate (X509) from the string *buffer* encoded with the
    type *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)

    :param bytes buffer: The buffer the certificate is stored in

    :return: The X509 object
    r��3type argument must be FILETYPE_PEM or FILETYPE_ASN1)r_rr�rXr)rMZPEM_read_bio_X509rQrUr(Zd2i_X509_biorar�r-rQ)r�rHrKrrrrr=s



r=rPcCsnt�}|tkrt�||j�}n|tkrt�||j�}n|tkr)t�||jdd�}nt	d��t
|dk�t|�S)a
    Dump the certificate *cert* into a buffer string encoded with the type
    *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1, or
        FILETYPE_TEXT)
    :param cert: The certificate to dump
    :return: The buffer with the dumped certificate in
    r�Ctype argument must be FILETYPE_PEM, FILETYPE_ASN1, or FILETYPE_TEXTr�)rXr)rMZPEM_write_bio_X509r�r(Zi2d_X509_bior*Z
X509_print_exrarTr[)r�rPrK�result_coderrrr7(s
�r7rcCsPt�}|tkrtj}n|tkrtj}ntd��|||j�}|dkr$t�t	|�S)z�
    Dump a public key to a buffer.

    :param type: The file type (one of :data:`FILETYPE_PEM` or
        :data:`FILETYPE_ASN1`).
    :param PKey pkey: The public key to dump
    :return: The buffer with the dumped key in it.
    :rtype: bytes
    r�r�)
rXr)rMZPEM_write_bio_PUBKEYr(Zi2d_PUBKEY_biorar|r�r[)r�rrKZ	write_bior�rrrr:Ds
r:�cipherr��
passphrase�PassphraseCallableT | Nonec		Cst�}t|t�std��|dur)|durtd��t�t|��}|tjkr(t	d��ntj}t
||�}|tkrIt�||j
|tjd|j|j�}|��n4|tkrUt�||j
�}n(|tkryt�|j
�tjkrftd��t�t�|j
�tj�}t�||d�}nt	d��t|dk�t|�S)a�
    Dump the private key *pkey* into a buffer string encoded with the type
    *type*.  Optionally (if *type* is :const:`FILETYPE_PEM`) encrypting it
    using *cipher* and *passphrase*.

    :param type: The file type (one of :const:`FILETYPE_PEM`,
        :const:`FILETYPE_ASN1`, or :const:`FILETYPE_TEXT`)
    :param PKey pkey: The PKey to dump
    :param cipher: (optional) if encrypted PEM format, the cipher to use
    :param passphrase: (optional) if encrypted PEM format, this can be either
        the passphrase to use, or a callback for providing the passphrase.

    :return: The buffer with the dumped key in
    :rtype: bytes
    zpkey must be a PKeyNzDif a value is given for cipher one must also be given for passphrasezInvalid cipher namerz-Only RSA keys are supported for FILETYPE_TEXTr�)rXr_r/r`rMZEVP_get_cipherbynamer�rQrUra�_PassphraseHelperr)ZPEM_write_bio_PrivateKeyr|�callback�
callback_args�raise_if_problemr(Zi2d_PrivateKey_bior*r�r�rVr�r�Z	RSA_printrTr[)	r�rr�r�rKZ
cipher_obj�helperr�r rrrr9]sJ
�
�
�
	�r9c@sPeZdZ		dddd�Zeddd��Zeddd��Zefd dd�Zd!dd�Z	dS)"r�Fr�rAr�r��	more_argsr��truncaterr^cCs4|tkr|durtd��||_||_||_g|_dS)Nz0only FILETYPE_PEM key format supports encryption)r)ra�_passphrase�
_more_args�	_truncate�	_problems)rqr�r�r�r�rrrrr�s�
z_PassphraseHelper.__init__rcCs<|jdurtjSt|jt�st|j�rt�d|j�Std��)NZpem_password_cb�2Last argument must be a byte string or a callable.)	r�rQrUr_rY�callabler��_read_passphraser`rprrrr��s
�z_PassphraseHelper.callbackcCs4|jdurtjSt|jt�st|j�rtjStd��)Nr�)r�rQrUr_rYr�r`rprrrr��s
�z_PassphraseHelper.callback_args�
exceptionType�type[Exception]cCs6|jrzt|�Wn	|yYnw|j�d��dSr�)r��_exception_from_error_queue�pop)rqr�rrrr��s��z"_PassphraseHelper.raise_if_problemr�size�rwflag�userdatac
Cs�zUt|j�r|jr|�|||�}n|�|�}n
|jdusJ�|j}t|t�s*td��t|�|kr>|jr:|d|�}ntd��tt|��D]}|||d�||<qDt|�WSt	yn}z
|j
�|�WYd}~dSd}~ww)NzBytes expectedz+passphrase returned by callback is too longr�r)r�r�r�r_rYrarSr�r��	Exceptionr�rt)rqrr�r�r�r�r��errrr��s.

�
��z"_PassphraseHelper._read_passphraseN)FF)
r�rAr�r�r�r�r�r�rr^r�)r�r�rr^)
rrr�rAr�rr�rrrA)
rDrErFrrrr�r�r.r�r�rrrrr��s�


r��str | bytescCs�t|t�r
|�d�}t|�}|tkrt�|tjtjtj�}n|t	kr*t�
|tj�}ntd��|tjkr6t�t
�t
�}t�|tj�|_d|_|S)a<
    Load a public key from a buffer.

    :param type: The file type (one of :data:`FILETYPE_PEM`,
        :data:`FILETYPE_ASN1`).
    :param buffer: The buffer the key is stored in.
    :type buffer: A Python string object, either unicode or bytestring.
    :return: The PKey object.
    :rtype: :class:`PKey`
    r�r�T)r_rr�rXr)rMZPEM_read_bio_PUBKEYrQrUr(Zd2i_PUBKEY_biorar�r/r'rVr{r|r�)r�rHrK�evp_pkeyrrrrr@�s 

�

r@cCs�t|t�r
|�d�}t|�}t||�}|tkr't�|tj	|j
|j�}|��n|t
kr3t�|tj	�}ntd��|tj	kr?t�t�t�}t�|tj�|_|S)a�
    Load a private key (PKey) from the string *buffer* encoded with the type
    *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)
    :param buffer: The buffer the key is stored in
    :param passphrase: (optional) if encrypted PEM format, this can be
                       either the passphrase to use, or a callback for
                       providing the passphrase.

    :return: The PKey object
    r�r�)r_rr�rXr�r)rMZPEM_read_bio_PrivateKeyrQrUr�r�r�r(Zd2i_PrivateKey_biorar�r/r'rVr{r|)r�rHr�rKr�r�rrrrr?	s"


�


r?rcCsnt�}|tkrt�||j�}n|tkrt�||j�}n|tkr)t�||jdd�}nt	d��t
|dk�t|�S)av
    Dump the certificate request *req* into a buffer string encoded with the
    type *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)
    :param req: The certificate request to dump
    :return: The buffer with the dumped certificate request in


    .. deprecated:: 24.2.0
       Use `cryptography.x509.CertificateSigningRequest` instead.
    rr�)rXr)rMZPEM_write_bio_X509_REQrr(Zi2d_X509_REQ_bior*ZX509_REQ_print_exrarTr[)r�rrKr�rrrr8;	s
�r8r�cCs�t|t�r
|�d�}t|�}|tkrt�|tjtjtj�}n|t	kr*t�
|tj�}ntd��t|tjk�t
�t
�}t�|tj�|_|S)a�
    Load a certificate request (X509Req) from the string *buffer* encoded with
    the type *type*.

    :param type: The file type (one of FILETYPE_PEM, FILETYPE_ASN1)
    :param buffer: The buffer the certificate request is stored in
    :return: The X509Req object

    .. deprecated:: 24.2.0
       Use `cryptography.x509.load_der_x509_csr` or
       `cryptography.x509.load_pem_x509_csr` instead.
    r�r�)r_rr�rXr)rMZPEM_read_bio_X509_REQrQrUr(Zd2i_X509_REQ_biorarTr2r'rVrr)r�rHrKrZx509reqrrrr>i	s


r>)rrrrrrr)rHrIrr)rKrrrY)r\rr]rYrr^)r]rYrr)rfrrrI)rr�)rsrrr�)r�rArHrYrr-)r�rArPr-rrY)r�rArr/rrYr)
r�rArr/r�r�r�r�rrY)r�rArHr�rr/)r�rArHr�r�r�rr/)r�rArr2rrY)r�rArHrYrr2)o�
__future__rr�rp�	functools�sysr�r4�base64r�collections.abcrrrrrr	�version_infor�TypeVarZ_TZtyping_extensionsZcryptographyrrZ)cryptography.hazmat.primitives.asymmetricrrrrr Z
OpenSSL._utilr!r"r�r#r�r$rQr%rMr&Z_make_assertr'r��__all__r�r�r�r�r�Z_PrivateKeyr�r�r�r�r�Z
_PublicKeyr�rYZPassphraseCallableTZSSL_FILETYPE_PEMr)rZSSL_FILETYPE_ASN1r(r*r�r,ZEVP_PKEY_DSAr+ZEVP_PKEY_DHrBZEVP_PKEY_ECrCr�r.r�rTrXr[rcrermrnr/r�r<r;�total_orderingr1r0r2r-r6r3r5r4r=r7r:r9r�r@r?r8rrDr6r>r#rrrr�<module>s�


����


	


Bg��C�-�sm+


�E
N%�
) �
 
�
@ Telegram