+VY?@sdZddlmZmZmZmZddlZddlmZddl m Z m Z m Z m Z mZmZmZmZmZddlmZmZmZmZmZmZmZmZGdd d e ZGd d d eZGd d d eZGdddeZGdddeZ Gddde Z!GdddeZ"GdddeZ#GdddeZ$GdddeZ%GdddeZ&GdddeZ'Gd d!d!eZ(dS)"z ASN.1 type classes for certificate revocation lists (CRL). Exports the following items: - CertificateList() Other type classes are defined that help compose the types listed above. )unicode_literalsdivisionabsolute_importprint_functionN)SignedDigestAlgorithm) Boolean EnumeratedGeneralizedTimeIntegerObjectIdentifierOctetBitStringParsableOctetStringSequence SequenceOf)AuthorityInfoAccessSyntaxAuthorityKeyIdentifierCRLDistributionPointsDistributionPointName GeneralNamesName ReasonFlagsTimec@s(eZdZddddddiZdS)VersionrZv1rZv2Zv3N)__name__ __module__ __qualname___maprr0/usr/lib/python3/dist-packages/asn1crypto/crl.pyr+s rc @seZdZdeddddddifdedd dd d d ifd edd ddd d ifdedd ddddifdedd ddd d ifdedd ddd d ifgZdS)IssuingDistributionPointdistribution_pointtag_typeexplicittagroptionalTZonly_contains_user_certsZimplicitrdefaultFZonly_contains_ca_certsrZonly_some_reasonsZ indirect_crlZonly_contains_attribute_certsN)rrrrrr_fieldsrrrr r!3s r!c@s@eZdZddddddddd d d d d diZdS)TBSCertListExtensionIdz 2.5.29.18issuer_alt_namez 2.5.29.20 crl_numberz 2.5.29.27delta_crl_indicatorz 2.5.29.28issuing_distribution_pointz 2.5.29.35authority_key_identifierz 2.5.29.46 freshest_crlz1.3.6.1.5.5.7.1.1authority_information_accessN)rrrrrrrr r,>s r,c@speZdZdefdeddifdefgZdZdede de d e d e d e d e iZd S)TBSCertListExtensionextn_idcriticalr'F extn_valuer-r.r/r0r1r2r3N)r5r7)rrrr,rrr+ _oid_pairrr r!rrr _oid_specsrrrr r4Js  r4c@seZdZeZdS)TBSCertListExtensionsN)rrrr4 _child_specrrrr r:]s r:c@sdeZdZddddddddd d d d d dddddddi ZeddZdS) CRLReasonr unspecifiedrkey_compromiser ca_compromiser(affiliation_changedr) supersededr*cessation_of_operationcertificate_holdremove_from_crl privilege_withdrawn aa_compromisecCsGddddddddd d d d d dddddddi |jS)a :return: A unicode string with revocation description that is suitable to show to end-users. Starts with a lower case letter and phrased in such a way that it makes sense after the phrase "because of" or "due to". r=zan unspecified reasonr>za compromised keyr?zthe CA being compromisedr@zan affiliation changerAzcertificate supersessionrBza cessation of operationrDza certificate holdrFzremoval from the CRLrHzprivilege withdrawlrJzthe AA being compromised)native)selfrrr human_friendlyos  zCRLReason.human_friendlyN)rrrrpropertyrMrrrr r<as  r<c@s.eZdZddddddddiZd S) CRLEntryExtensionIdz 2.5.29.21 crl_reasonz 2.5.29.23hold_instruction_codez 2.5.29.24invalidity_datez 2.5.29.29certificate_issuerN)rrrrrrrr rOs rOc@s^eZdZdefdeddifdefgZd Zdede de d e iZ d S) CRLEntryExtensionr5r6r'Fr7rPrQrRrSN)zextn_idz extn_value) rrrrOrrr+r8r<r r rr9rrrr rTs  rTc@seZdZeZdS)CRLEntryExtensionsN)rrrrTr;rrrr rUs rUc@seZdZdefdefdeddifgZdZdZdZ dZ dZ dZ dd Z ed d Zed d ZeddZeddZeddZdS)RevokedCertificateZuser_certificateZrevocation_datecrl_entry_extensionsr&TFNcCst|_xl|dD]`}|dj}d|}t||rZt|||dj|djr|jj|qWd|_dS)zv Sets common named extensions to private attributes and creates a list of critical extensions rWr5z _%s_valuer7r6TN)set_critical_extensionsrKhasattrsetattrparsedadd_processed_extensions)rL extensionnameattribute_namerrr _set_extensionss    z"RevokedCertificate._set_extensionscCs|js|j|jS)z Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings )r^rbrY)rLrrr critical_extensionss  z&RevokedCertificate.critical_extensionscCs |jdkr|j|jS)z This extension indicates the reason that a certificate was revoked. :return: None or a CRLReason object F)r^rb_crl_reason_value)rLrrr crl_reason_values  z#RevokedCertificate.crl_reason_valuecCs |jdkr|j|jS)a= This extension indicates the suspected date/time the private key was compromised or the certificate became invalid. This would usually be before the revocation date, which is when the CA processed the revocation. :return: None or a GeneralizedTime object F)r^rb_invalidity_date_value)rLrrr invalidity_date_values  z(RevokedCertificate.invalidity_date_valuecCs |jdkr|j|jS)a This extension indicates the issuer of the certificate in question, and is used in indirect CRLs. CRL entries without this extension are for certificates issued from the last seen issuer. :return: None or an x509.GeneralNames object F)r^rb_certificate_issuer_value)rLrrr certificate_issuer_values  z+RevokedCertificate.certificate_issuer_valuecCsX|jdkrQd|_|jrQx-|jD]"}|jdkr+|j|_Pq+W|jS)zi :return: None, or an asn1crypto.x509.Name object for the issuer of the cert FNZdirectory_name) _issuer_namerir`chosen)rL general_namerrr issuer_names   zRevokedCertificate.issuer_name)rrrr rrUr+r^rYrdrfrhrjrbrNrcrergrirmrrrr rVs     rVc@seZdZeZdS)RevokedCertificatesN)rrrrVr;rrrr rns rnc@s|eZdZdeddifdefdefdefdefdeddifd ed d d d ddifgZ dS) TbsCertListversionr&T signatureissuerZ this_updateZ next_updateZrevoked_certificatescrl_extensionsr#r$r%rN) rrrrrrrrnr:r+rrrr ros     roc@seZdZdefdefdefgZdZdZdZ dZ dZ dZ dZ dZdZdZdZdZdZddZedd Zed d Zed d ZeddZeddZeddZeddZeddZeddZeddZeddZ eddZ!ed d!Z"ed"d#Z#ed$d%Z$dS)&CertificateList tbs_cert_listZsignature_algorithmrqFNcCst|_xp|ddD]`}|dj}d|}t||r^t|||dj|djr|jj|qWd|_dS) zv Sets common named extensions to private attributes and creates a list of critical extensions rursr5z _%s_valuer7r6TN)rXrYrKrZr[r\r]r^)rLr_r`rarrr rb4s    zCertificateList._set_extensionscCs|js|j|jS)z Returns a set of the names (or OID if not a known extension) of the extensions marked as critical :return: A set of unicode strings )r^rbrY)rLrrr rcFs  z#CertificateList.critical_extensionscCs |jdkr|j|jS)z This extension allows associating one or more alternative names with the issuer of the CRL. :return: None or an x509.GeneralNames object F)r^rb_issuer_alt_name_value)rLrrr issuer_alt_name_valueTs  z%CertificateList.issuer_alt_name_valuecCs |jdkr|j|jS)z This extension adds a monotonically increasing number to the CRL and is used to distinguish different versions of the CRL. :return: None or an Integer object F)r^rb_crl_number_value)rLrrr crl_number_valuebs  z CertificateList.crl_number_valuecCs |jdkr|j|jS)z This extension indicates a CRL is a delta CRL, and contains the CRL number of the base CRL that it is a delta from. :return: None or an Integer object F)r^rb_delta_crl_indicator_value)rLrrr delta_crl_indicator_valueps  z)CertificateList.delta_crl_indicator_valuecCs |jdkr|j|jS)z This extension includes information about what types of revocations and certificates are part of the CRL. :return: None or an IssuingDistributionPoint object F)r^rb!_issuing_distribution_point_value)rLrrr issuing_distribution_point_value~s  z0CertificateList.issuing_distribution_point_valuecCs |jdkr|j|jS)z This extension helps in identifying the public key with which to validate the authenticity of the CRL. :return: None or an AuthorityKeyIdentifier object F)r^rb_authority_key_identifier_value)rLrrr authority_key_identifier_values  z.CertificateList.authority_key_identifier_valuecCs |jdkr|j|jS)z This extension is used in complete CRLs to indicate where a delta CRL may be located. :return: None or a CRLDistributionPoints object F)r^rb_freshest_crl_value)rLrrr freshest_crl_values  z"CertificateList.freshest_crl_valuecCs |jdkr|j|jS)z This extension is used to provide a URL with which to download the certificate used to sign this CRL. :return: None or an AuthorityInfoAccessSyntax object F)r^rb#_authority_information_access_value)rLrrr "authority_information_access_values  z2CertificateList.authority_information_access_valuecCs |ddS)z_ :return: An asn1crypto.x509.Name object for the issuer of the CRL rurrr)rLrrr rrszCertificateList.issuercCs|js dS|jdjS)z :return: None or a byte string of the key_identifier from the authority key identifier extension NZkey_identifier)rrK)rLrrr r1s z(CertificateList.authority_key_identifiercCs|jdkrg|_|jrxu|jD]j}|djdkr+|d}|jdkr`q+|j}|jdddkr+|jj|q+W|jS) z :return: A list of unicode strings that are URLs that should contain either an individual DER-encoded X.509 certificate, or a DER-encoded CMS message containing multiple certificates NZ access_methodZ ca_issuersZaccess_locationuniform_resource_identifierrzhttp://)_issuer_cert_urlsrrKr`lowerappend)rLentrylocationZurlrrr issuer_cert_urlss     z CertificateList.issuer_cert_urlscCs|jdkrg|_|jdk rx`|jD]U}|d}|jdkrSq1x0|jD]%}|jdkr]|jj|q]Wq1W|jS)z Returns delta CRL URLs - only applies to complete CRLs :return: A list of zero or more DistributionPoint objects Nr"Zname_relative_to_crl_issuerr)_delta_crl_distribution_pointsrr`rkr)rLr"Zdistribution_point_namerlrrr delta_crl_distribution_pointss   z-CertificateList.delta_crl_distribution_pointscCs |djS)zE :return: A byte string of the signature rq)rK)rLrrr rqszCertificateList.signaturecCs4|jdkr-tj|jj|_|jS)zf :return: The SHA1 hash of the DER-encoded bytes of this certificate list N)_sha1hashlibsha1dumpdigest)rLrrr rszCertificateList.sha1cCs4|jdkr-tj|jj|_|jS)zi :return: The SHA-256 hash of the DER-encoded bytes of this certificate list N)_sha256rsha256rr)rLrrr rszCertificateList.sha256)%rrrrorr r+r^rYrvrxrzr|r~rrrrrrrbrNrcrwryr{r}rrrrrr1rrrqrrrrrr rts@        rt))__doc__Z __future__rrrrrZalgosrZcorerr r r r r rrrZx509rrrrrrrrrr!r,r4r:r<rOrTrUrVrnrortrrrr  s$" @ :  & k