U
    gRn                    @   st  d Z ddlmZmZmZmZ ddlmZ ddlm	Z	 ddl
Z
ddlZddlZddlZddlZddlZddlmZ ddlmZmZ dd	lmZ dd
lmZmZmZ ddlmZmZmZmZ ddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< ddl=m>Z> ddl?m@Z@mAZAmBZBmCZC G dd de*ZDG dd de*ZEG dd de*ZFG dd de0ZGG dd de3ZHG dd de4ZIG dd de"ZJG dd de3ZKG dd  d e7ZLed!d" ZMG d#d$ d$e%ZNG d%d& d&e.ZOG d'd( d(e3ZPG d)d* d*e6ZQG d+d, d,e4ZRG d-d. d.e%ZSG d/d0 d0e3ZTG d1d2 d2e%ZUG d3d4 d4e%ZVG d5d6 d6e%ZWG d7d8 d8e5ZXG d9d: d:e5ZYG d;d< d<e4ZZG d=d> d>e4Z[G d?d@ d@e3Z\G dAdB dBe3Z]G dCdD dDe4Z^G dEdF dFe3Z_G dGdH dHe4Z`G dIdJ dJe%ZaG dKdL dLe%ZbG dMdN dNe5ZcG dOdP dPe4ZdG dQdR dRe5ZeG dSdT dTe3ZfG dUdV dVe6ZgG dWdX dXe3ZhG dYdZ dZe%ZiG d[d\ d\e+ZjG d]d^ d^e+ZkG d_d` d`e3ZlG dadb dbe4ZmG dcdd dde3ZnG dedf dfe3ZoG dgdh dhe%ZpG didj dje4ZqG dkdl dle%ZrG dmdn dne3ZsG dodp dpe3ZtG dqdr dre3ZuG dsdt dte%ZvG dudv dve"ZwG dwdx dxe3ZxG dydz dze4ZyG d{d| d|e3ZzG d}d~ d~e3Z{G dd de4Z|G dd de%Z}G dd de4Z~G dd de3ZG dd de3ZG dd de.ZG dd de3ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de3ZG dd de4ZG dd de3ZG dd de.ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de4ZG dd de4ZG dd de3ZG dd de"ZG dd de+ZG dd de3ZG dd de6ZG dd de3ZG dd de3ZG dd de6ZG dd de'ZG dd de'ZG dd de'ZG dd de'ZG dd de'ZG ddĄ de'ZG ddƄ de3ZG ddȄ de3ZG ddʄ de'ZG dd̄ de3ZG dd΄ de3ZG ddЄ de6ZG dd҄ de.ZG ddԄ de6ZG ddք de6ZG dd؄ de6ZG ddڄ de3ZG dd܄ de6ZG ddބ de3ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de3ZG dd de3ZG dd de4ZG dd de4ZG dd de3ZG dd de&ZdS )z
ASN.1 type classes for X.509 certificates. Exports the following items:

 - Attributes()
 - Certificate()
 - Extensions()
 - GeneralName()
 - GeneralNames()
 - Name()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function)contextmanager)idnaN   )unwrap)
iri_to_uri
uri_to_iri)OrderedDict)	type_namestr_clsbytes_to_list)AlgorithmIdentifierAnyAlgorithmIdentifierDigestAlgorithmSignedDigestAlgorithm)Any	BitString	BMPStringBooleanChoiceConcat
EnumeratedGeneralizedTimeGeneralString	IA5StringIntegerNullNumericStringObjectIdentifierOctetBitStringOctetStringParsableOctetStringPrintableStringSequence
SequenceOfSetSetOfTeletexStringUniversalStringUTCTime
UTF8StringVisibleStringVOID)PublicKeyInfo)int_to_bytesint_from_bytes	inet_ntop	inet_ptonc                   @   s,   e Zd ZdZdZdd Zdd Zdd Zd	S )
DNSNamer         c                 C   s
   | |k S N selfotherr:   r:   3/tmp/pip-unpacked-wheel-etcy_95o/asn1crypto/x509.py__ne__L   s    zDNSName.__ne__c                 C   s&   t |tsdS |   |  kS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2

        :param other:
            Another DNSName object

        :return:
            A boolean
        F)
isinstancer5   __unicode__lowerr;   r:   r:   r>   __eq__O   s    
zDNSName.__eq__c                 C   sx   t |ts"ttdt| t||drFd|dd | j }n|| j}|| _|| _	d| _
| jdkrtd| _dS )zd
        Sets the value of the DNS name

        :param value:
            A unicode string
        K
                %s value must be a unicode string, not %s
                .   .r   N    )r@   r   	TypeErrorr	   r   
startswithencode	_encoding_unicodecontents_header_trailer)r<   valueencoded_valuer:   r:   r>   set_   s    


zDNSName.setN)__name__
__module____qualname__rK   _bad_tagr?   rC   rR   r:   r:   r:   r>   r5   G   s
   r5   c                   @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
URIc                 C   sL   t |ts"ttdt| t||| _t|| _d| _| j	dkrHd| _	dS )b
        Sets the value of the string

        :param value:
            A unicode string
        rD   NrG   )
r@   r   rH   r	   r   rL   r
   rM   rN   rO   r<   rP   r:   r:   r>   rR   ~   s    


zURI.setc                 C   s
   | |k S r9   r:   r;   r:   r:   r>   r?      s    z
URI.__ne__c                 C   s&   t |tsdS t| jdt|jdkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4

        :param other:
            Another URI object

        :return:
            A boolean
        FT)r@   rW   r
   nativer;   r:   r:   r>   rC      s    
z
URI.__eq__c                 C   s,   | j dkrdS | jdkr&t|  | _| jS 7
        :return:
            A unicode string
        N )rM   rL   r   _merge_chunksr<   r:   r:   r>   rA      s
    

zURI.__unicode__N)rS   rT   rU   rR   r?   rC   rA   r:   r:   r:   r>   rW   |   s   rW   c                   @   sR   e Zd ZdZdZdZedd Zejdd Zdd Z	d	d
 Z
dd Zdd ZdS )EmailAddressNFr6   c                 C   s   | j S )z`
        :return:
            A byte string of the DER-encoded contents of the sequence
        )	_contentsr_   r:   r:   r>   rM      s    zEmailAddress.contentsc                 C   s   d| _ || _dS )ze
        :param value:
            A byte string of the DER-encoded contents of the sequence
        FN)_normalizedra   rY   r:   r:   r>   rM      s    c                 C   s   t |ts"ttdt| t||ddkrZ|dd\}}|dd |d }n
|d}d| _|| _	|| _
d	| _| jd
krd
| _d	S )rX   rD   @r   ascii   @r   TNrG   )r@   r   rH   r	   r   findrsplitrJ   rb   rL   rM   rN   rO   )r<   rP   mailboxhostnamerQ   r:   r:   r>   rR      s     


zEmailAddress.setc                 C   s^   | j dkrX|  }|ddkr.|d| _ n*|dd\}}|dd |d | _ | j S )r\   Nrf   rd   cp1252r   rc   r   )rL   r^   rg   decoderh   )r<   rM   ri   rj   r:   r:   r>   rA      s    
zEmailAddress.__unicode__c                 C   s
   | |k S r9   r:   r;   r:   r:   r>   r?     s    zEmailAddress.__ne__c                 C   s   t |tsdS | js | | j |js2||j | jddksR|jddkr^| j|jkS |jdd\}}| jdd\}}||krdS | | krdS dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5

        :param other:
            Another EmailAddress object

        :return:
            A boolean
        Frf   rd   r   T)	r@   r`   rb   rR   rZ   ra   rg   rh   rB   )r<   r=   Zother_mailboxZother_hostnameri   rj   r:   r:   r>   rC     s    
 zEmailAddress.__eq__)rS   rT   rU   ra   rb   rV   propertyrM   setterrR   rA   r?   rC   r:   r:   r:   r>   r`      s   

	r`   c                   @   s:   e Zd ZdddZdd Zedd Zdd	 Zd
d ZdS )	IPAddressNc                 C   s   t tddS )z?
        This method is not applicable to IP addresses
        z=
            IP address values can not be parsed
            N)
ValueErrorr	   )r<   specZspec_paramsr:   r:   r>   parse'  s    zIPAddress.parsec           
      C   sT  t |ts"ttdt| t||}|ddk}d}|rv|dd}|d }t|d }|dk rvttdt| |ddkrt	j
}|dkrttd	t| d}n$t	j}|d
krttdt| d
}d}|rd| }	|	d|t|	  7 }	tt|	d}d|d t|  | }|| _t||| | _| j| _d| _| jdkrPd| _dS )z
        Sets the value of the object

        :param value:
            A unicode string containing an IPv4 address, IPv4 address with CIDR,
            an IPv6 address or IPv6 address with CIDR
        rD   /rd   r   r   zT
                    %s value contains a CIDR range less than 0
                    :   z
                    %s value contains a CIDR range bigger than 128, the maximum
                    value for an IPv6 address
                        z
                    %s value contains a CIDR range bigger than 32, the maximum
                    value for an IPv4 address
                    rG   10          N)r@   r   rH   r	   r   rg   splitintrp   socketAF_INET6AF_INETlenr1   _nativer4   rM   Z_bytesrN   rO   )
r<   rP   original_valueZhas_cidrcidrpartsfamilyZ	cidr_sizeZ
cidr_bytesZ	cidr_maskr:   r:   r>   rR   2  sZ    	
zIPAddress.setc                 C   s   | j dkrdS | jdkr|  }t|}d}d}|tddgkrnttj|dd }|dkrt|dd }n<|tddgkrttj	|dd }|dkrt|dd }|dk	rd
|}t|d}|d	 t| }|| _| jS )
z
        The native Python datatype representation of this value

        :return:
            A unicode string or None
        Nrv      r   r{      z{0:b}rx   rs   )rM   r   	__bytes__r   rR   r3   r~   r   r2   r   formatrstripr   )r<   Zbyte_stringZbyte_lenrP   Zcidr_intZ	cidr_bitsr   r:   r:   r>   rZ   y  s*    	


zIPAddress.nativec                 C   s
   | |k S r9   r:   r;   r:   r:   r>   r?     s    zIPAddress.__ne__c                 C   s   t |tsdS |  | kS )zl
        :param other:
            Another IPAddress object

        :return:
            A boolean
        F)r@   ro   r   r;   r:   r:   r>   rC     s    	
zIPAddress.__eq__)NN)	rS   rT   rU   rr   rR   rm   rZ   r?   rC   r:   r:   r:   r>   ro   &  s   
G
ro   c                   @   s"   e Zd ZdefdedeifgZdS )	Attributetypevaluesrq   N)rS   rT   rU   r!   r)   r   _fieldsr:   r:   r:   r>   r     s   r   c                   @   s   e Zd ZeZdS )
AttributesN)rS   rT   rU   r   _child_specr:   r:   r:   r>   r     s   r   c                
   @   s$   e Zd Zddddddddd	d
	ZdS )KeyUsageZdigital_signatureZnon_repudiationZkey_enciphermentZdata_enciphermentZkey_agreementZkey_cert_signZcrl_signZencipher_onlyZdecipher_only	r   r   ry      r            r{   NrS   rT   rU   _mapr:   r:   r:   r>   r     s   r   c                   @   s,   e Zd ZdedddfdedddfgZdS )PrivateKeyUsagePeriod
not_beforer   Timplicitoptional	not_afterr   N)rS   rT   rU   r   r   r:   r:   r:   r>   r     s   r   c                   @   s   e Zd ZdZdZdd ZdS )NotReallyTeletexStringa6  
    OpenSSL (and probably some other libraries) puts ISO-8859-1
    into TeletexString instead of ITU T.61. We use Windows-1252 when
    decoding since it is a superset of ISO-8859-1, and less likely to
    cause encoding issues, but we stay strict with encoding to prevent
    us from creating bad data.
    rk   c                 C   s0   | j dkrdS | jdkr*|  | j| _| jS r[   )rM   rL   r^   rl   _decoding_encodingr_   r:   r:   r>   rA     s
    

z"NotReallyTeletexString.__unicode__N)rS   rT   rU   __doc__r   rA   r:   r:   r:   r>   r     s   r   c                   c   s   zdt _d V  W 5 dt _X d S )Nrk   teletex)r   r   r:   r:   r:   r>   strict_teletex  s    
r   c                   @   s4   e Zd ZdefdefdefdefdefdefgZ	dS )DirectoryStringteletex_stringprintable_stringZuniversal_stringutf8_string
bmp_string
ia5_stringN)
rS   rT   rU   r   r%   r+   r-   r   r   _alternativesr:   r:   r:   r>   r     s   r   c                #   @   s   e Zd Zddddddddd	d
dddddddddddddddddddddd d!d"d#"Zdddddddddddd	d
dd dddddddddd!d"dddddddg!Zed$d% Zed&d' Zd(S ))NameTypecommon_namesurnameserial_numbercountry_namelocality_namestate_or_province_namestreet_addressorganization_nameorganizational_unit_nametitlebusiness_categorypostal_codetelephone_numbername
given_nameinitialsgeneration_qualifierunique_identifierdn_qualifier	pseudonymorganization_identifiertpm_manufacturer	tpm_modeltpm_versionplatform_manufacturerplatform_modelplatform_versionemail_addressincorporation_localityincorporation_state_or_provinceincorporation_countryuser_iddomain_componentname_distinguisher)"z2.5.4.3z2.5.4.4z2.5.4.5z2.5.4.6z2.5.4.7z2.5.4.8z2.5.4.9z2.5.4.10z2.5.4.11z2.5.4.12z2.5.4.15z2.5.4.17z2.5.4.20z2.5.4.41z2.5.4.42z2.5.4.43z2.5.4.44z2.5.4.45z2.5.4.46z2.5.4.65z2.5.4.97z2.23.133.2.1z2.23.133.2.2z2.23.133.2.3z2.23.133.2.4z2.23.133.2.5z2.23.133.2.6z1.2.840.113549.1.9.1z1.3.6.1.4.1.311.60.2.1.1z1.3.6.1.4.1.311.60.2.1.2z1.3.6.1.4.1.311.60.2.1.3z0.9.2342.19200300.100.1.1z0.9.2342.19200300.100.1.25z0.2.262.1.10.7.20c                 C   s4   |  |}|| jkr"| j|}n
t| j}||fS )z
        Returns an ordering value for a particular attribute key.

        Unrecognized attributes and OIDs will be sorted lexically at the end.

        :return:
            An orderable value.

        )mappreferred_orderindexr   )cls	attr_nameZordinalr:   r:   r>   preferred_ordinalK  s
    


zNameType.preferred_ordinalc              #   C   sV   ddddddddd	d
dddddddddddddddddddddd d!d"d#" | j| jS )$zZ
        :return:
            A human-friendly unicode string to display to users
        zCommon NameZSurnamezSerial NumberCountryZLocalityzState/ProvincezStreet AddressZOrganizationzOrganizational UnitZTitlezBusiness CategoryzPostal CodezTelephone NumberNamez
Given NameZInitialszGeneration QualifierzUnique IdentifierzDN QualifierZ	PseudonymzEmail AddresszIncorporation LocalityzIncorporation State/ProvincezIncorporation CountryzDomain ComponentzName DistinguisherzOrganization IdentifierzTPM Manufacturerz	TPM ModelzTPM VersionzPlatform ManufacturerzPlatform ModelzPlatform VersionzUser ID"r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )getrZ   r_   r:   r:   r>   human_friendly_  sL    # zNameType.human_friendlyN)	rS   rT   rU   r   r   classmethodr   rm   r   r:   r:   r:   r>   r     s   /$
r   c                #   @   s   e Zd ZdefdefgZdZeeeeeeeeeeeeeeeeee	eee
eeeeeeeeeeeeed"ZdZedd Zdd	 Zd
d Zdd ZdS )NameTypeAndValuer   rP   r   rP   r   Nc                 C   s"   | j dkr| | d j| _ | j S )z
        Returns the value after being processed by the internationalized string
        preparation as specified by RFC 5280

        :return:
            A unicode string
        NrP   )_prepped_ldap_string_preprZ   r_   r:   r:   r>   prepped_value  s    

zNameTypeAndValue.prepped_valuec                 C   s
   | |k S r9   r:   r;   r:   r:   r>   r?     s    zNameTypeAndValue.__ne__c                 C   s2   t |tsdS |d j| d jkr&dS |j| jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another NameTypeAndValue object

        :return:
            A boolean
        Fr   )r@   r   rZ   r   r;   r:   r:   r>   rC     s
    
zNameTypeAndValue.__eq__c                 C   s  t dd|}t dd|}tjdkr6t dd|}nt dd|}t dd|}|d	d}t d
d|}dttj|}t	
d|}|D ]}t|rttdt|rttdt|rttdt|rttdt|rttd|dkrttdqd}d}|D ](}t|r:d}nt|r$d}q$|rt|d }t|d }|s|r|sttddt dd|  d }|S )a"  
        Implements the internationalized string preparation algorithm from
        RFC 4518. https://tools.ietf.org/html/rfc4518#section-2

        :param string:
            A unicode string to prepare

        :return:
            A prepared unicode string, ready for comparison
        u   [­᠆͏᠋-᠍️-＀￼]+r]   u	   [	
] i  u   [-]|[-]|󠀁u   [𝅳-𝅺󠀠-󠁿󠀁]u?   [ ----۝܏᠎‌-‏‪-‮⁠-⁣⁪-⁯﻿￹-￻]+u   ​u   [   -  -   　]NFKCzc
                    X.509 Name objects may not contain unassigned code points
                    z
                    X.509 Name objects may not contain change display or
                    zzzzdeprecated characters
                    zc
                    X.509 Name objects may not contain private use characters
                    zf
                    X.509 Name objects may not contain non-character code points
                    zb
                    X.509 Name objects may not contain surrogate code points
                    u   �zf
                    X.509 Name objects may not contain the replacement character
                    FTr   rd   z{
                    X.509 Name object contains a malformed bidirectional
                    sequence
                    z +z  )resubsys
maxunicodereplacejoinr   
stringprepmap_table_b2unicodedata	normalizein_table_a1rp   r	   in_table_c8in_table_c3in_table_c4in_table_c5in_table_d1in_table_d2strip)r<   stringcharZhas_r_and_al_catZ	has_l_catZfirst_is_r_and_alZlast_is_r_and_alr:   r:   r>   r     sn    




z"NameTypeAndValue._ldap_string_prep)rS   rT   rU   r   r   r   	_oid_pairr   r%   r"   r`   r5   r-   
_oid_specsr   rm   r   r?   rC   r   r:   r:   r:   r>   r     sZ   '
r   c                   @   s<   e Zd ZeZedd Zdd Zdd Zdd Z	d	d
 Z
dS )RelativeDistinguishedNamec                 C   s@   g }|  | }t| D ]}|d||| f  qd|S )b
        :return:
            A unicode string that can be used as a dict key or in a set
        %s: %s)_get_valuessortedkeysappendr   )r<   outputr   keyr:   r:   r>   hashableP  s
    
z"RelativeDistinguishedName.hashablec                 C   s
   | |k S r9   r:   r;   r:   r:   r>   r?   `  s    z RelativeDistinguishedName.__ne__c                 C   sz   t |tsdS t| t|kr"dS | | }| |}||krBdS | | }| |}|D ]}|| || krZ dS qZdS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RelativeDistinguishedName object

        :return:
            A boolean
        FT)r@   r   r   
_get_typesr   )r<   r=   Z
self_typesZother_typesZself_valuesZother_valuesZ
type_name_r:   r:   r>   rC   c  s    




z RelativeDistinguishedName.__eq__c                 C   s   t dd |D S )z
        Returns a set of types contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A set object with unicode strings of NameTypeAndValue type field
            values
        c                 S   s   g | ]}|d  j qS r   rZ   .0Zntvr:   r:   r>   
<listcomp>  s     z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rR   r<   rdnr:   r:   r>   r    s    z$RelativeDistinguishedName._get_typesc                    s   i   fdd|D   S )a$  
        Returns a dict of prepped values contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A dict object with unicode strings of NameTypeAndValue value field
            values that have been prepped for comparison
        c                    s$   g | ]}  |d  j|jfgqS r  )updaterZ   r   r  r   r:   r>   r    s     z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r:   r	  r:   r  r>   r     s    z%RelativeDistinguishedName._get_valuesN)rS   rT   rU   r   r   rm   r  r?   rC   r  r   r:   r:   r:   r>   r   M  s   
 r   c                   @   s,   e Zd ZeZedd Zdd Zdd ZdS )RDNSequencec                 C   s   d dd | D S )r   c                 s   s   | ]}|j V  qd S r9   )r  )r  r
  r:   r:   r>   	<genexpr>  s     z'RDNSequence.hashable.<locals>.<genexpr>)r   r_   r:   r:   r>   r    s    
zRDNSequence.hashablec                 C   s
   | |k S r9   r:   r;   r:   r:   r>   r?     s    zRDNSequence.__ne__c                 C   sJ   t |tsdS t| t|kr"dS t| D ]\}}|| |kr* dS q*dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RDNSequence object

        :return:
            A boolean
        FT)r@   r  r   	enumerate)r<   r=   r   Zself_rdnr:   r:   r>   rC     s    
zRDNSequence.__eq__N)	rS   rT   rU   r   r   rm   r  r?   rC   r:   r:   r:   r>   r    s
   
r  c                   @   s   e Zd ZdefgZdZdZdZedddZ	e
dd Zdd	 Zd
d Zdd Ze
dd Ze
dd Zdd Ze
dd Ze
dd ZdS )r   r]   NFc           	      C   s   g }|sd}t }nd}t}tt| dd d}| D ]\}}t|}|dkr^t|}nF|dkrpt|}n4|t	dd	d
gkrt
dt|d}nt
|||d}|tt||dg q:| dt|dS )aY  
        Creates a Name object from a dict of unicode string keys and values.
        The keys should be from NameType._map, or a dotted-integer OID unicode
        string.

        :param name_dict:
            A dict of name information, e.g. {"common_name": "Will Bond",
            "country_name": "US", "organization_name": "Codex Non Sufficit LC"}

        :param use_printable:
            A bool - if PrintableString should be used for encoding instead of
            UTF8String. This is for backwards compatibility with old software.

        :return:
            An x509.Name object
        r   r   c                 S   s   t | d S )Nr   )r   r   )itemr:   r:   r>   <lambda>  rG   zName.build.<locals>.<lambda>)r  r   r   r   r   r   )r   rP   r   r]   )r-   r%   r   r   itemsr   r   r`   r5   rR   r   r   r   r   r  )	r   Z	name_dictZuse_printableZrdnsZencoding_nameZencoding_classattribute_nameZattribute_valuerP   r:   r:   r>   build  sD    



z
Name.buildc                 C   s   | j jS )r   )chosenr  r_   r:   r:   r>   r    s    zName.hashablec                 C   s
   t | jS r9   )r   r  r_   r:   r:   r>   __len__  s    zName.__len__c                 C   s
   | |k S r9   r:   r;   r:   r:   r>   r?     s    zName.__ne__c                 C   s   t |tsdS | j|jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another Name object

        :return:
            A boolean
        F)r@   r   r  r;   r:   r:   r>   rC   !  s    
zName.__eq__c                 C   s   | j d kr~t | _ | jjD ]b}|D ]X}|d }|| j krl| j | }t|ts\|g }| j |< ||d  q"|d | j |< q"q| j S )Nr   rP   )r   r   r  rZ   r@   listr   )r<   r
  type_val
field_nameexistingr:   r:   r>   rZ   0  s    



zName.nativec                 C   s
  | j dkrt }d}| jD ]R}|D ]H}|d j}|}||kr`|| g||< || |d  q$|d ||< q$qg }| }|dkrtt|}|D ](}|| }	| |	}
|d||
f  qd}|D ]}|	ddkrd	} qq|sd
nd}|
|ddd | _ | j S )zg
        :return:
            A human-friendly unicode string containing the parts of the name
        Nr   rP   r   r   F,rd   T, z; )_human_friendlyr   r  r   r   r   reversedr  _recursive_humanizerg   r   )r<   dataZ
last_fieldr
  r  r  Zto_joinr   r  rP   Znative_valueZ	has_commaelement	separatorr:   r:   r>   r   @  s6    


zName.human_friendlyc                    s,   t |tr&dt fdd|D S |jS )z
        Recursively serializes data compiled from the RDNSequence

        :param value:
            An Asn1Value object, or a list of Asn1Value objects

        :return:
            A unicode string
        r  c                    s   g | ]}  |qS r:   )r   )r  Z	sub_valuer_   r:   r>   r  t  s     z,Name._recursive_humanize.<locals>.<listcomp>)r@   r  r   r  rZ   rY   r:   r_   r>   r   g  s
    
zName._recursive_humanizec                 C   s$   | j dkrt|   | _ | j S )zZ
        :return:
            The SHA1 hash of the DER-encoded bytes of this name
        N_sha1hashlibsha1dumpdigestr_   r:   r:   r>   r'  x  s    
z	Name.sha1c                 C   s$   | j dkrt|   | _ | j S )z]
        :return:
            The SHA-256 hash of the DER-encoded bytes of this name
        N_sha256r&  sha256r(  r)  r_   r:   r:   r>   r,    s    
zName.sha256)F)rS   rT   rU   r  r   r  r%  r+  r   r  rm   r  r  r?   rC   rZ   r   r   r'  r,  r:   r:   r:   r>   r     s*   <


&

r   c                   @   s"   e Zd ZdefdeddifgZdS )AnotherNameZtype_idrP   explicitr   N)rS   rT   rU   r!   r   r   r:   r:   r:   r>   r-    s   r-  c                   @   s$   e Zd ZdZdZdefdefgZdS )CountryNamer   x121_dcc_codeiso_3166_alpha2_codeNrS   rT   rU   class_tagr    r%   r   r:   r:   r:   r>   r/    s
   r/  c                   @   s$   e Zd ZdZdZdefdefgZdS )AdministrationDomainNamer   ry   numeric	printableNr2  r:   r:   r:   r>   r5    s
   r5  c                   @   s   e Zd ZdefdefgZdS )PrivateDomainNamer6  r7  NrS   rT   rU   r    r%   r   r:   r:   r:   r>   r8    s   r8  c                   @   sF   e Zd Zdeddifdedddfded	ddfd
edddfgZdS )PersonalNamer   r   r   r   r   Tr   r   ry   r   r   NrS   rT   rU   r%   r   r:   r:   r:   r>   r:    s
   r:  c                   @   sF   e Zd Zdeddifdedddfded	ddfd
edddfgZdS )TeletexPersonalNamer   r   r   r   r   Tr   r   ry   r   r   NrS   rT   rU   r*   r   r:   r:   r:   r>   r<    s
   r<  c                   @   s   e Zd ZeZdS )OrganizationalUnitNamesNrS   rT   rU   r%   r   r:   r:   r:   r>   r>    s   r>  c                   @   s   e Zd ZeZdS )TeletexOrganizationalUnitNamesN)rS   rT   rU   r*   r   r:   r:   r:   r>   r@    s   r@  c                   @   s   e Zd Zdeddifdeddifdedddfded	ddfd
edddfdedddfdedddfdedddfde	dddfg	Z
dS )BuiltInStandardAttributesr   r   TZadministration_domain_namenetwork_addressr   r   Zterminal_identifierr   Zprivate_domain_namery   r.  r   r   r   Znumeric_user_identifierr   Zpersonal_namer   Zorganizational_unit_namesr   N)rS   rT   rU   r/  r5  r    r%   r8  r:  r>  r   r:   r:   r:   r>   rA    s   rA  c                   @   s   e Zd ZdefdefgZdS )BuiltInDomainDefinedAttributer   rP   Nr;  r:   r:   r:   r>   rD    s   rD  c                   @   s   e Zd ZeZdS )BuiltInDomainDefinedAttributesN)rS   rT   rU   rD  r   r:   r:   r:   r>   rE    s   rE  c                   @   s   e Zd ZdefdefgZdS )TeletexDomainDefinedAttributer   rP   Nr=  r:   r:   r:   r>   rF    s   rF  c                   @   s   e Zd ZeZdS )TeletexDomainDefinedAttributesN)rS   rT   rU   rF  r   r:   r:   r:   r>   rG    s   rG  c                   @   s   e Zd ZdefdefgZdS )PhysicalDeliveryCountryNamer0  r1  Nr9  r:   r:   r:   r>   rH    s   rH  c                   @   s   e Zd ZdefdefgZdS )
PostalCodeZnumeric_codeZprintable_codeNr9  r:   r:   r:   r>   rI    s   rI  c                   @   s(   e Zd ZdeddifdeddifgZdS )PDSParameterr   r   Tr   N)rS   rT   rU   r%   r*   r   r:   r:   r:   r>   rJ    s   rJ  c                   @   s   e Zd ZeZdS )PrintableAddressNr?  r:   r:   r:   r>   rK    s   rK  c                   @   s(   e Zd ZdeddifdeddifgZdS )UnformattedPostalAddressZprintable_addressr   Tr   N)rS   rT   rU   rK  r*   r   r:   r:   r:   r>   rL    s   rL  c                   @   s*   e Zd ZdeddifdedddfgZdS )	E1634Addressnumberr   r   Zsub_addressr   Tr   N)rS   rT   rU   r    r   r:   r:   r:   r>   rM    s   rM  c                   @   s   e Zd ZeZdS )
NAddressesN)rS   rT   rU   r#   r   r:   r:   r:   r>   rO    s   rO  c                   @   sF   e Zd Zdedddfdedddfdedddfd	ed
difgZdS )PresentationAddressZ
p_selectorr   TrC  Z
s_selectorr   Z
t_selectorry   Zn_addressesr.  r   N)rS   rT   rU   r#   rO  r   r:   r:   r:   r>   rP    s
   rP  c                   @   s"   e Zd ZdefdeddifgZdS )ExtendedNetworkAddressZe163_4_addressZpsap_addressr   r   N)rS   rT   rU   rM  rP  r   r:   r:   r:   r>   rQ  #  s   rQ  c                   @   s   e Zd ZdddddddZdS )	TerminalTypeZtelexr   Zg3_facsimileZg4_facsimileZia5_terminalZvideotex)r   r   r   r   r   r{   Nr   r:   r:   r:   r>   rR  *  s   rR  c                   @   s@   e Zd Zddddddddd	d
ddddddddddddddZdS )ExtensionAttributeTyper   teletex_common_nameteletex_organization_nameteletex_personal_nameteletex_organization_unit_names!teletex_domain_defined_attributespds_namephysical_delivery_country_namer   physical_delivery_office_namephysical_delivery_office_numberextension_of_address_componentsphysical_delivery_personal_name#physical_delivery_organization_name.extension_physical_delivery_address_componentsunformatted_postal_addressr   post_office_box_addressposte_restante_addressunique_postal_namelocal_postal_attributesextended_network_addressterminal_type)r   ry   r   r   r   r   r   r{   	   
      r7            r         r8               Nr   r:   r:   r:   r>   rS  5  s0   rS  c                   @   s`   e Zd ZdeddifdeddifgZdZeeee	e
eeeeeeeeeeeeeeeeeedZd	S )
ExtensionAttributeextension_attribute_typer   r   extension_attribute_valuer.  r   )ru  rv  )r   rT  rU  rV  rW  rX  rY  rZ  r   r[  r\  r]  r^  r_  r`  ra  r   rb  rc  rd  re  rf  rg  N)rS   rT   rU   rS  r   r   r   r%   r*   r<  r@  rG  rH  rI  rJ  rL  rQ  rR  r   r:   r:   r:   r>   rt  Q  s8   rt  c                   @   s   e Zd ZeZdS )ExtensionAttributesN)rS   rT   rU   rt  r   r:   r:   r:   r>   rw  s  s   rw  c                   @   s.   e Zd ZdefdeddifdeddifgZdS )	ORAddressZbuilt_in_standard_attributesZ"built_in_domain_defined_attributesr   TZextension_attributesN)rS   rT   rU   rA  rE  rw  r   r:   r:   r:   r>   rx  w  s   rx  c                   @   s*   e Zd ZdedddfdeddifgZdS )	EDIPartyNameZname_assignerr   Tr   Z
party_namer   r   N)rS   rT   rU   r   r   r:   r:   r:   r>   ry    s   ry  c                   @   s   e Zd Zdeddifdeddifdeddifdedd	ifd
eddifdeddifde	ddifde
ddifdeddifg	Zdd Zdd ZdS )GeneralName
other_namer   r   Zrfc822_namer   dns_namery   x400_addressr   Zdirectory_namer.  r   edi_party_namer   uniform_resource_identifierr   
ip_addressr   Zregistered_idr{   c                 C   s
   | |k S r9   r:   r;   r:   r:   r>   r?     s    zGeneralName.__ne__c                 C   sP   | j dkrttd| j |j dkr4ttd|j | j |j krDdS | j|jkS )z
        Does not support other_name, x400_address or edi_party_name

        :param other:
            The other GeneralName to compare to

        :return:
            A boolean
        )r{  r}  r~  zr
                Comparison is not supported for GeneralName objects of
                choice %s
                za
                Comparison is not supported for GeneralName objects of choice
                %sF)r   rp   r	   r  r;   r:   r:   r>   rC     s    

zGeneralName.__eq__N)rS   rT   rU   r-  r`   r5   rx  r   ry  rW   ro   r!   r   r?   rC   r:   r:   r:   r>   rz    s   rz  c                   @   s   e Zd ZeZdS )GeneralNamesN)rS   rT   rU   rz  r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZdefdefgZdS )TimeZutc_timeZgeneral_timeN)rS   rT   rU   r,   r   r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZdefdefgZdS )Validityr   r   N)rS   rT   rU   r  r   r:   r:   r:   r>   r    s   r  c                   @   s(   e Zd ZdeddifdeddifgZdS )BasicConstraintscadefaultFpath_len_constraintr   TN)rS   rT   rU   r   r   r   r:   r:   r:   r>   r    s   r  c                   @   s:   e Zd ZdedddfdedddfdedddfgZd	S )
AuthorityKeyIdentifierkey_identifierr   Tr   authority_cert_issuerr   authority_cert_serial_numberry   N)rS   rT   rU   r#   r  r   r   r:   r:   r:   r>   r    s   r  c                   @   s(   e Zd ZdeddifdeddifgZdS )DistributionPointName	full_namer   r   name_relative_to_crl_issuerr   N)rS   rT   rU   r  r   r   r:   r:   r:   r>   r    s   r  c                
   @   s$   e Zd Zddddddddd	d
	ZdS )ReasonFlagsZunusedZkey_compromiseZca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZaa_compromiser   Nr   r:   r:   r:   r>   r    s   r  c                   @   s2   e Zd ZdefdedddfdedddfgZd	S )
GeneralSubtreebaseZminimumr   r   r  maximumr   Tr   N)rS   rT   rU   rz  r   r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )GeneralSubtreesN)rS   rT   rU   r  r   r:   r:   r:   r>   r    s   r  c                   @   s,   e Zd ZdedddfdedddfgZdS )NameConstraintsZpermitted_subtreesr   Tr   Zexcluded_subtreesr   N)rS   rT   rU   r  r   r:   r:   r:   r>   r    s   r  c                   @   sJ   e Zd Zdedddfdedddfded	ddfgZd
Zedd Z	dS )DistributionPointdistribution_pointr   TrC  Zreasonsr   r   Z
crl_issuerry   Fc                 C   sh   | j dkrbd| _ | d }|jdkr.ttd|jD ],}|jdkr4|j}| dr4|| _  qbq4| j S )z_
        :return:
            None or a unicode string of the distribution point's URL
        FNr  r  z
                    CRL distribution points that are relative to the issuer are
                    not supported
                    r  zhttp://zhttps://zldap://zldaps://)_urlr   rp   r	   r  rZ   rB   rI   )r<   r   general_nameurlr:   r:   r>   r  
  s    



zDistributionPoint.urlN)
rS   rT   rU   r  r  r  r   r  rm   r  r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )CRLDistributionPointsN)rS   rT   rU   r  r   r:   r:   r:   r>   r  &  s   r  c                   @   s(   e Zd ZdefdefdefdefgZdS )DisplayTextr   Zvisible_stringr   r   N)rS   rT   rU   r   r.   r   r-   r   r:   r:   r:   r>   r  *  s
   r  c                   @   s   e Zd ZeZdS )NoticeNumbersNrS   rT   rU   r   r   r:   r:   r:   r>   r  3  s   r  c                   @   s   e Zd ZdefdefgZdS )NoticeReferenceZorganizationZnotice_numbersN)rS   rT   rU   r  r  r   r:   r:   r:   r>   r  7  s   r  c                   @   s(   e Zd ZdeddifdeddifgZdS )
UserNoticeZ
notice_refr   TZexplicit_textN)rS   rT   rU   r  r  r   r:   r:   r:   r>   r  >  s   r  c                   @   s   e Zd ZdddZdS )PolicyQualifierId certification_practice_statementuser_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2Nr   r:   r:   r:   r>   r  E  s   r  c                   @   s*   e Zd ZdefdefgZdZeedZ	dS )PolicyQualifierInfopolicy_qualifier_id	qualifier)r  r  )r  r  N)
rS   rT   rU   r  r   r   r   r   r  r   r:   r:   r:   r>   r  L  s   r  c                   @   s   e Zd ZeZdS )PolicyQualifierInfosN)rS   rT   rU   r  r   r:   r:   r:   r>   r  Y  s   r  c                   @   s   e Zd ZddiZdS )PolicyIdentifierz2.5.29.32.0Z
any_policyNr   r:   r:   r:   r>   r  ]  s    r  c                   @   s"   e Zd ZdefdeddifgZdS )PolicyInformationZpolicy_identifierZpolicy_qualifiersr   TN)rS   rT   rU   r  r  r   r:   r:   r:   r>   r  c  s   r  c                   @   s   e Zd ZeZdS )CertificatePoliciesN)rS   rT   rU   r  r   r:   r:   r:   r>   r  j  s   r  c                   @   s   e Zd ZdefdefgZdS )PolicyMappingZissuer_domain_policyZsubject_domain_policyN)rS   rT   rU   r  r   r:   r:   r:   r>   r  n  s   r  c                   @   s   e Zd ZeZdS )PolicyMappingsN)rS   rT   rU   r  r   r:   r:   r:   r>   r  u  s   r  c                   @   s,   e Zd ZdedddfdedddfgZdS )PolicyConstraintsZrequire_explicit_policyr   Tr   Zinhibit_policy_mappingr   NrS   rT   rU   r   r   r:   r:   r:   r>   r  y  s   r  c                V   @   s   e Zd Zddddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVUZdWS )XKeyPurposeIdZany_extended_key_usageZserver_authZclient_authZcode_signingZemail_protectionZipsec_end_systemZipsec_tunnelZ
ipsec_usertime_stampingZocsp_signingZdvcsZeap_over_pppZeap_over_lanZscvp_serverZscvp_clientZ	ipsec_ikeZ	capwap_acZ
capwap_wtpZ
sip_domainZsecure_shell_clientZsecure_shell_serverZsend_routerZsend_proxied_routerZ
send_ownerZsend_proxied_ownerZcmc_caZcmc_raZcmc_archiveZbgpspec_routerZike_intermediateZmicrosoft_trust_list_signingZmicrosoft_time_stamp_signingZmicrosoft_server_gatedZmicrosoft_serializedZmicrosoft_efsZmicrosoft_efs_recoveryZmicrosoft_whqlZmicrosoft_nt5Zmicrosoft_oem_whqlZmicrosoft_embedded_ntZmicrosoft_root_list_signerZ!microsoft_qualified_subordinationZmicrosoft_key_recoveryZmicrosoft_document_signingZmicrosoft_lifetime_signingZ microsoft_mobile_device_softwareZmicrosoft_smart_card_logonZapple_x509_basicZ	apple_sslZapple_local_cert_genZapple_csr_genZapple_revocation_crlZapple_revocation_ocspZapple_smimeZ	apple_eapZapple_software_update_signingZapple_ipsecZapple_ichatZapple_resource_signingZapple_pkinit_clientZapple_pkinit_serverZapple_code_signingZapple_package_signingZapple_id_validationZapple_time_stampingZapple_revocationZapple_passbook_signingZapple_mobile_storeZapple_escrow_serviceZapple_profile_signerZapple_qa_profile_signerZapple_test_mobile_storeZapple_otapki_signerZapple_test_otapki_signerZ)apple_id_validation_record_signing_policyZapple_smp_encryptionZapple_test_smp_encryptionZapple_server_authenticationZapple_pcs_escrow_serviceZpiv_card_authenticationZpiv_content_signingZpkinit_kpclientauthZpkinit_kpkdcZadobe_authentic_documents_trustZfpki_pivi_content_signing)Uz2.5.29.37.0z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2z1.3.6.1.5.5.7.3.3z1.3.6.1.5.5.7.3.4z1.3.6.1.5.5.7.3.5z1.3.6.1.5.5.7.3.6z1.3.6.1.5.5.7.3.7z1.3.6.1.5.5.7.3.8z1.3.6.1.5.5.7.3.9z1.3.6.1.5.5.7.3.10z1.3.6.1.5.5.7.3.13z1.3.6.1.5.5.7.3.14z1.3.6.1.5.5.7.3.15z1.3.6.1.5.5.7.3.16z1.3.6.1.5.5.7.3.17z1.3.6.1.5.5.7.3.18z1.3.6.1.5.5.7.3.19z1.3.6.1.5.5.7.3.20z1.3.6.1.5.5.7.3.21z1.3.6.1.5.5.7.3.22z1.3.6.1.5.5.7.3.23z1.3.6.1.5.5.7.3.24z1.3.6.1.5.5.7.3.25z1.3.6.1.5.5.7.3.26z1.3.6.1.5.5.7.3.27z1.3.6.1.5.5.7.3.28z1.3.6.1.5.5.7.3.29z1.3.6.1.5.5.7.3.30z1.3.6.1.5.5.8.2.2z1.3.6.1.4.1.311.10.3.1z1.3.6.1.4.1.311.10.3.2z1.3.6.1.4.1.311.10.3.3z1.3.6.1.4.1.311.10.3.3.1z1.3.6.1.4.1.311.10.3.4z1.3.6.1.4.1.311.10.3.4.1z1.3.6.1.4.1.311.10.3.5z1.3.6.1.4.1.311.10.3.6z1.3.6.1.4.1.311.10.3.7z1.3.6.1.4.1.311.10.3.8z1.3.6.1.4.1.311.10.3.9z1.3.6.1.4.1.311.10.3.10z1.3.6.1.4.1.311.10.3.11z1.3.6.1.4.1.311.10.3.12z1.3.6.1.4.1.311.10.3.13z1.3.6.1.4.1.311.10.3.14z1.3.6.1.4.1.311.20.2.2z1.2.840.113635.100.1.2z1.2.840.113635.100.1.3z1.2.840.113635.100.1.4z1.2.840.113635.100.1.5z1.2.840.113635.100.1.6z1.2.840.113635.100.1.7z1.2.840.113635.100.1.8z1.2.840.113635.100.1.9z1.2.840.113635.100.1.10z1.2.840.113635.100.1.11z1.2.840.113635.100.1.12z1.2.840.113635.100.1.13z1.2.840.113635.100.1.14z1.2.840.113635.100.1.15z1.2.840.113635.100.1.16z1.2.840.113635.100.1.17z1.2.840.113635.100.1.18z1.2.840.113635.100.1.20z1.2.840.113635.100.1.21z1.2.840.113635.100.1.22z1.2.840.113635.100.1.23z1.2.840.113635.100.1.24z1.2.840.113635.100.1.25z1.2.840.113635.100.1.26z1.2.840.113635.100.1.27z1.2.840.113635.100.1.28z1.2.840.113635.100.1.29z1.2.840.113625.100.1.30z1.2.840.113625.100.1.31z1.2.840.113625.100.1.32z1.2.840.113635.100.1.33z1.2.840.113635.100.1.34z2.16.840.1.101.3.6.8z2.16.840.1.101.3.6.7z1.3.6.1.5.2.3.4z1.3.6.1.5.2.3.5z1.2.840.113583.1.1.5z2.16.840.1.101.3.8.7Nr   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )ExtKeyUsageSyntaxNrS   rT   rU   r  r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZdddddZdS )AccessMethodocspZ
ca_issuersr  Zca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5Nr   r:   r:   r:   r>   r    s
   r  c                   @   s   e Zd ZdefdefgZdS )AccessDescriptionaccess_methodaccess_locationN)rS   rT   rU   r  rz  r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )AuthorityInfoAccessSyntaxNrS   rT   rU   r  r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )SubjectInfoAccessSyntaxNr  r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )FeaturesNr  r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZdefdefgZdS )EntrustVersionInfoZentrust_versZentrust_info_flagsN)rS   rT   rU   r   r   r   r:   r:   r:   r>   r    s   r  c                	   @   s"   e Zd Zddddddddd	Zd
S )NetscapeCertificateTypeZ
ssl_clientZ
ssl_serveremailZobject_signingreservedZssl_caZemail_caZobject_signing_ca)r   r   ry   r   r   r   r   r   Nr   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZddddZdS )Versionv1Zv2Zv3r   r   ry   Nr   r:   r:   r:   r>   r  %  s   r  c                   @   s"   e Zd ZdefdefdefgZdS )TPMSpecificationr   levelrevisionN)rS   rT   rU   r-   r   r   r:   r:   r:   r>   r  -  s   r  c                   @   s   e Zd ZeZdS )SetOfTPMSpecificationN)rS   rT   rU   r  r   r:   r:   r:   r>   r  5  s   r  c                   @   s"   e Zd ZdefdefdefgZdS )TCGSpecificationVersionmajor_versionminor_versionr  Nr  r:   r:   r:   r>   r  9  s   r  c                   @   s   e Zd ZdefdefgZdS )TCGPlatformSpecificationversionZplatform_classN)rS   rT   rU   r  r#   r   r:   r:   r:   r>   r  A  s   r  c                   @   s   e Zd ZeZdS )SetOfTCGPlatformSpecificationN)rS   rT   rU   r  r   r:   r:   r:   r>   r  H  s   r  c                   @   s   e Zd ZdddddZdS )EKGenerationTypeZinternalZinjectedZinternal_revocableZinjected_revocable)r   r   ry   r   Nr   r:   r:   r:   r>   r  L  s
   r  c                   @   s   e Zd ZddddZdS )EKGenerationLocationr   r   ek_cert_signerr  Nr   r:   r:   r:   r>   r  U  s   r  c                   @   s   e Zd ZddddZdS )EKCertificateGenerationLocationr   r   r  r  Nr   r:   r:   r:   r>   r  ]  s   r  c                   @   s    e Zd ZddddddddZd	S )
EvaluationAssuranceLevellevel1level2level3level4Zlevel5Zlevel6Zlevel7)r   ry   r   r   r   r   r   Nr   r:   r:   r:   r>   r  e  s   r  c                   @   s   e Zd ZddddZdS )EvaluationStatusZdesigned_to_meetZevaluation_in_progressZevaluation_completedr  Nr   r:   r:   r:   r>   r  q  s   r  c                   @   s   e Zd ZddddZdS )StrengthOfFunctionbasicZmediumhighr  Nr   r:   r:   r:   r>   r  y  s   r  c                   @   s.   e Zd ZdefdeddifdeddifgZdS )URIReferencer  Zhash_algorithmr   TZ
hash_valueN)rS   rT   rU   r   r   r   r   r:   r:   r:   r>   r    s   r  c                   @   st   e Zd Zdefdefdefdeddifdedd	d
fdedd	d
fde	dd	d
fdedd	d
fde	dd	d
fg	Z
dS )CommonCriteriaMeasuresr  Zassurance_levelZevaluation_statusplusr  FZstrengh_of_functionr   Tr   Zprofile_oidr   Zprofile_urlry   Z
target_oidr   Z
target_urir   N)rS   rT   rU   r   r  r  r   r  r!   r  r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZdddddZdS )SecurityLevelr  r  r  r  )r   ry   r   r   Nr   r:   r:   r:   r>   r    s
   r  c                   @   s(   e Zd ZdefdefdeddifgZdS )	FIPSLevelr  r  r  r  FN)rS   rT   rU   r   r  r   r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd Zdeddifdeddifdeddd	fd
eddd	fdeddd	fdeddd	fde	ddd	fdedddfde
ddifg	ZdS )TPMSecurityAssertionsr  r  r  Zfield_upgradableFZek_generation_typer   Tr   Zek_generation_locationr   Z"ek_certificate_generation_locationry   Zcc_infor   Z
fips_levelr   Ziso_9000_certifiedr   r  Ziso_9000_urir   N)rS   rT   rU   r  r   r  r  r  r  r  r   r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )SetOfTPMSecurityAssertionsN)rS   rT   rU   r  r   r:   r:   r:   r>   r    s   r  c                   @   s&   e Zd Zddddddddd	d
d
ZdS )SubjectDirectoryAttributeIdsupported_algorithmstpm_specificationtcg_platform_specificationtpm_security_assertionspda_date_of_birthpda_place_of_birth
pda_genderpda_country_of_citizenshippda_country_of_residenceZentrust_user_role)
z2.5.4.52z2.23.133.2.16z2.23.133.2.17z2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29Nr   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )SetOfGeneralizedTimeN)rS   rT   rU   r   r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )SetOfDirectoryStringN)rS   rT   rU   r   r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )SetOfPrintableStringNr?  r:   r:   r:   r>   r    s   r  c                   @   s2   e Zd ZdefdedddfdedddfgZdS )	SupportedAlgorithmZalgorithm_identifierZintended_usager   TrC  Zintended_certificate_policiesr   N)rS   rT   rU   r   r   r  r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeZdS )SetOfSupportedAlgorithmN)rS   rT   rU   r  r   r:   r:   r:   r>   r    s   r  c                
   @   sH   e Zd ZdefdefgZdZeee	e
eeeeed	Zdd ZdeiZdS )SubjectDirectoryAttributer   r   )r   r   )	r  r  r  r  r  r  r  r  r  c                 C   s"   | d j }|| jkr| j| S tS )Nr   )rZ   r   r)   )r<   type_r:   r:   r>   _values_spec  s    


z&SubjectDirectoryAttribute._values_specN)rS   rT   rU   r  r   r   r   r  r  r  r  r  r  r  r   r  Z_spec_callbacksr:   r:   r:   r>   r    s$    r  c                   @   s   e Zd ZeZdS )SubjectDirectoryAttributesN)rS   rT   rU   r  r   r:   r:   r:   r>   r    s   r  c                   @   sB   e Zd Zddddddddd	d
dddddddddddddddZdS )ExtensionIdsubject_directory_attributesr  	key_usageprivate_key_usage_periodsubject_alt_nameissuer_alt_namebasic_constraintsname_constraintscrl_distribution_pointscertificate_policiespolicy_mappingsauthority_key_identifierpolicy_constraintsextended_key_usagefreshest_crlinhibit_any_policyauthority_information_accesssubject_information_accesstls_featureocsp_no_checkentrust_version_extensionnetscape_certificate_type!signed_certificate_timestamp_listmicrosoft_enroll_certtype)z2.5.29.9z	2.5.29.14z	2.5.29.15z	2.5.29.16z	2.5.29.17z	2.5.29.18z	2.5.29.19z	2.5.29.30z	2.5.29.31z	2.5.29.32z	2.5.29.33z	2.5.29.35z	2.5.29.36z	2.5.29.37z	2.5.29.46z	2.5.29.54z1.3.6.1.5.5.7.1.1z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2z1.3.6.1.4.1.311.20.2Nr   r:   r:   r:   r>   r    s2   r  c                   @   sb   e Zd ZdefdeddifdefgZdZee	e
eeeeeeeeeeeeeeeeeeee	edZdS )		Extensionextn_idcriticalr  F
extn_value)r  r  )r  r  r  r  r  r  r  r  r  r  r  r   r  r  r  r  r  r  r  r  r	  r
  r  r  N)rS   rT   rU   r  r   r$   r   r   r  r#   r   r   r  r  r  r  r  r  r  r  r  r   r  r  r  r   r  r  r   r   r:   r:   r:   r>   r  '  s<   r  c                   @   s   e Zd ZeZdS )
ExtensionsN)rS   rT   rU   r  r   r:   r:   r:   r>   r  M  s   r  c                   @   sl   e Zd Zdedddfdefdefdefdefd	efd
efde	dddfde	dddfde
dddfg
ZdS )TbsCertificater  r   r  )r.  r  r   	signatureissuervaliditysubjectsubject_public_key_infoZissuer_unique_idr   Tr   Zsubject_unique_idry   
extensionsr   rC  N)rS   rT   rU   r  r   r   r   r  r0   r"   r  r   r:   r:   r:   r>   r  Q  s   r  c                   @   s  e Zd ZdefdefdefgZdZdZdZ	dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dd Z'e(dd	 Z)e(d
d Z*e(dd Z+e(dd Z,e(dd Z-e(dd Z.e(dd Z/e(dd Z0e(dd Z1e(dd Z2e(dd Z3e(dd Z4e(d d! Z5e(d"d# Z6e(d$d% Z7e(d&d' Z8e(d(d) Z9e(d*d+ Z:e(d,d- Z;e(d.d/ Z<e(d0d1 Z=e(d2d3 Z>e(d4d5 Z?e(d6d7 Z@e(d8d9 ZAe(d:d; ZBe(d<d= ZCe(d>d? ZDe(d@dA ZEe(dBdC ZFe(dDdE ZGe(dFdG ZHe(dHdI ZIe(dJdK ZJe(dLdM ZKe(dNdO ZLdPdQ ZMe(dRdS ZNe(dTdU ZOe(dVdW ZPe(dXdY ZQe(dZd[ ZRe(d\d] ZSe(d^d_ ZTe(d`da ZUe(dbdc ZVe(ddde ZWe(dfdg ZXdhdi ZYdjdk ZZdldm Z[dS )nCertificatetbs_certificatesignature_algorithmsignature_valueFNc                 C   sh   t  | _| d d D ]H}|d j}d| }t| |rFt| ||d j |d jr| j| qd| _dS )	zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r  r  r  z	_%s_valuer  r  TN)rR   _critical_extensionsrZ   hasattrsetattrparsedadd_processed_extensions)r<   	extensionr   r  r:   r:   r>   _set_extensions  s    


zCertificate._set_extensionsc                 C   s   | j s|   | jS )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r"  r$  r  r_   r:   r:   r>   critical_extensions  s    
zCertificate.critical_extensionsc                 C   s   | j s|   | jS )z
        This extension is used to constrain the period over which the subject
        private key may be used

        :return:
            None or a PrivateKeyUsagePeriod object
        )r"  r$  _private_key_usage_period_valuer_   r:   r:   r>   private_key_usage_period_value  s    
z*Certificate.private_key_usage_period_valuec                 C   s   | j s|   | jS )z
        This extension is used to contain additional identification attributes
        about the subject.

        :return:
            None or a SubjectDirectoryAttributes object
        )r"  r$  #_subject_directory_attributes_valuer_   r:   r:   r>   "subject_directory_attributes_value  s    
z.Certificate.subject_directory_attributes_valuec                 C   s   | j s|   | jS )z
        This extension is used to help in creating certificate validation paths.
        It contains an identifier that should generally, but is not guaranteed
        to, be unique.

        :return:
            None or an OctetString object
        )r"  r$  _key_identifier_valuer_   r:   r:   r>   key_identifier_value  s    z Certificate.key_identifier_valuec                 C   s   | j s|   | jS )z
        This extension is used to define the purpose of the public key
        contained within the certificate.

        :return:
            None or a KeyUsage
        )r"  r$  _key_usage_valuer_   r:   r:   r>   key_usage_value  s    
zCertificate.key_usage_valuec                 C   s   | j s|   | jS )aT  
        This extension allows for additional names to be associate with the
        subject of the certificate. While it may contain a whole host of
        possible names, it is usually used to allow certificates to be used
        with multiple different domain names.

        :return:
            None or a GeneralNames object
        )r"  r$  _subject_alt_name_valuer_   r:   r:   r>   subject_alt_name_value  s    z"Certificate.subject_alt_name_valuec                 C   s   | j s|   | jS )z
        This extension allows associating one or more alternative names with
        the issuer of the certificate.

        :return:
            None or an x509.GeneralNames object
        )r"  r$  _issuer_alt_name_valuer_   r:   r:   r>   issuer_alt_name_value  s    
z!Certificate.issuer_alt_name_valuec                 C   s   | j s|   | jS )a'  
        This extension is used to determine if the subject of the certificate
        is a CA, and if so, what the maximum number of intermediate CA certs
        after this are, before an end-entity certificate is found.

        :return:
            None or a BasicConstraints object
        )r"  r$  _basic_constraints_valuer_   r:   r:   r>   basic_constraints_value  s    z#Certificate.basic_constraints_valuec                 C   s   | j s|   | jS )z
        This extension is used in CA certificates, and is used to limit the
        possible names of certificates issued.

        :return:
            None or a NameConstraints object
        )r"  r$  _name_constraints_valuer_   r:   r:   r>   name_constraints_value	  s    
z"Certificate.name_constraints_valuec                 C   s   | j s|   | jS )z
        This extension is used to help in locating the CRL for this certificate.

        :return:
            None or a CRLDistributionPoints object
            extension
        )r"  r$  _crl_distribution_points_valuer_   r:   r:   r>   crl_distribution_points_value	  s    
z)Certificate.crl_distribution_points_valuec                 C   s   | j s|   | jS )a;  
        This extension defines policies in CA certificates under which
        certificates may be issued. In end-entity certificates, the inclusion
        of a policy indicates the issuance of the certificate follows the
        policy.

        :return:
            None or a CertificatePolicies object
        )r"  r$  _certificate_policies_valuer_   r:   r:   r>   certificate_policies_value*	  s    z&Certificate.certificate_policies_valuec                 C   s   | j s|   | jS )z
        This extension allows mapping policy OIDs to other OIDs. This is used
        to allow different policies to be treated as equivalent in the process
        of validation.

        :return:
            None or a PolicyMappings object
        )r"  r$  _policy_mappings_valuer_   r:   r:   r>   policy_mappings_value:	  s    z!Certificate.policy_mappings_valuec                 C   s   | j s|   | jS )z
        This extension helps in identifying the public key with which to
        validate the authenticity of the certificate.

        :return:
            None or an AuthorityKeyIdentifier object
        )r"  r$  _authority_key_identifier_valuer_   r:   r:   r>   authority_key_identifier_valueI	  s    
z*Certificate.authority_key_identifier_valuec                 C   s   | j s|   | jS )z
        This extension is used to control if policy mapping is allowed and
        when policies are required.

        :return:
            None or a PolicyConstraints object
        )r"  r$  _policy_constraints_valuer_   r:   r:   r>   policy_constraints_valueW	  s    
z$Certificate.policy_constraints_valuec                 C   s   | j s|   | jS )z
        This extension is used to help locate any available delta CRLs

        :return:
            None or an CRLDistributionPoints object
        )r"  r$  _freshest_crl_valuer_   r:   r:   r>   freshest_crl_valuee	  s    	zCertificate.freshest_crl_valuec                 C   s   | j s|   | jS )z
        This extension is used to prevent mapping of the any policy to
        specific requirements

        :return:
            None or a Integer object
        )r"  r$  _inhibit_any_policy_valuer_   r:   r:   r>   inhibit_any_policy_valuer	  s    
z$Certificate.inhibit_any_policy_valuec                 C   s   | j s|   | jS )z
        This extension is used to define additional purposes for the public key
        beyond what is contained in the basic constraints.

        :return:
            None or an ExtKeyUsageSyntax object
        )r"  r$  _extended_key_usage_valuer_   r:   r:   r>   extended_key_usage_value	  s    
z$Certificate.extended_key_usage_valuec                 C   s   | j s|   | jS )z
        This extension is used to locate the CA certificate used to sign this
        certificate, or the OCSP responder for this certificate.

        :return:
            None or an AuthorityInfoAccessSyntax object
        )r"  r$  #_authority_information_access_valuer_   r:   r:   r>   "authority_information_access_value	  s    
z.Certificate.authority_information_access_valuec                 C   s   | j s|   | jS )z
        This extension is used to access information about the subject of this
        certificate.

        :return:
            None or a SubjectInfoAccessSyntax object
        )r"  r$  !_subject_information_access_valuer_   r:   r:   r>    subject_information_access_value	  s    
z,Certificate.subject_information_access_valuec                 C   s   | j s|   | jS )z
        This extension is used to list the TLS features a server must respond
        with if a client initiates a request supporting them.

        :return:
            None or a Features object
        )r"  r$  _tls_feature_valuer_   r:   r:   r>   tls_feature_value	  s    
zCertificate.tls_feature_valuec                 C   s   | j s|   | jS )a-  
        This extension is used on certificates of OCSP responders, indicating
        that revocation information for the certificate should never need to
        be verified, thus preventing possible loops in path validation.

        :return:
            None or a Null object (if present)
        )r"  r$  _ocsp_no_check_valuer_   r:   r:   r>   ocsp_no_check_value	  s    zCertificate.ocsp_no_check_valuec                 C   s
   | d j S )zE
        :return:
            A byte string of the signature
        r  r  r_   r:   r:   r>   r  	  s    zCertificate.signaturec                 C   s
   | d j S )zj
        :return:
            A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
        r  )signature_algor_   r:   r:   r>   rN  	  s    zCertificate.signature_algoc                 C   s
   | d j S )z
        :return:
            A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
            "sha384", "sha512", "sha512_224", "sha512_256"
        r  )	hash_algor_   r:   r:   r>   rO  	  s    zCertificate.hash_algoc                 C   s   | d d S )zT
        :return:
            The PublicKeyInfo object for this certificate
        r  r  r:   r_   r:   r:   r>   
public_key	  s    zCertificate.public_keyc                 C   s   | d d S )zZ
        :return:
            The Name object for the subject of this certificate
        r  r  r:   r_   r:   r:   r>   r  	  s    zCertificate.subjectc                 C   s   | d d S )zY
        :return:
            The Name object for the issuer of this certificate
        r  r  r:   r_   r:   r:   r>   r  	  s    zCertificate.issuerc                 C   s   | d d j S )zT
        :return:
            An integer of the certificate's serial number
        r  r   r  r_   r:   r:   r>   r   	  s    zCertificate.serial_numberc                 C   s   | j s
dS | j jS )z
        :return:
            None or a byte string of the certificate's key identifier from the
            key identifier extension
        N)r+  rZ   r_   r:   r:   r>   r  
  s    zCertificate.key_identifierc                 C   s.   | j dkr(| jjd t| jd | _ | j S )z
        :return:
            A byte string of the SHA-256 hash of the issuer concatenated with
            the ascii character ":", concatenated with the serial number as
            an ascii string
        N   :re   )_issuer_serialr  r,  r   r   rJ   r_   r:   r:   r>   issuer_serial
  s    	
zCertificate.issuer_serialc                 C   s   | d d d j S )zd
        :return:
            A datetime of latest time when the certificate is still valid
        r  r  r   r  r_   r:   r:   r>   not_valid_after!
  s    zCertificate.not_valid_afterc                 C   s   | d d d j S )zd
        :return:
            A datetime of the earliest time when the certificate is valid
        r  r  r   r  r_   r:   r:   r>   not_valid_before)
  s    zCertificate.not_valid_beforec                 C   s   | j s
dS | j d jS )z
        :return:
            None or a byte string of the key_identifier from the authority key
            identifier extension
        Nr  )r=  rZ   r_   r:   r:   r>   r   1
  s    z$Certificate.authority_key_identifierc                 C   sj   | j dkrd| j}|r^|d jr^| jd d j}| }| jd j}|jd t|d | _ nd| _ | j S )a;  
        :return:
            None or a byte string of the SHA-256 hash of the isser from the
            authority key identifier extension concatenated with the ascii
            character ":", concatenated with the serial number from the
            authority key identifier extension as an ascii string
        Fr  r   r  rQ  re   N)_authority_issuer_serialr=  rZ   r  Zuntagr,  r   rJ   )r<   Zakivr  Zauthority_serialr:   r:   r>   authority_issuer_serial>
  s    

z#Certificate.authority_issuer_serialc                 C   s   | j dkr| | j| _ | j S )z
        Returns complete CRL URLs - does not include delta CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_crl_distribution_points!_get_http_crl_distribution_pointsr7  r_   r:   r:   r>   r  T
  s    	
z#Certificate.crl_distribution_pointsc                 C   s   | j dkr| | j| _ | j S )z
        Returns delta CRL URLs - does not include complete CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_delta_crl_distribution_pointsrY  rA  r_   r:   r:   r>   delta_crl_distribution_pointsa
  s    	
z)Certificate.delta_crl_distribution_pointsc                 C   s\   g }|dkrg S |D ]B}|d }|t kr*q|jdkr6q|jD ]}|jdkr<|| q<q|S )a?  
        Fetches the DistributionPoint object for non-relative, HTTP CRLs
        referenced by the certificate

        :param crl_distribution_points:
            A CRLDistributionPoints object to grab the DistributionPoints from

        :return:
            A list of zero or more DistributionPoint objects
        Nr  r  r  )r/   r   r  r   )r<   r  r   r  Zdistribution_point_namer  r:   r:   r>   rY  n
  s    


z-Certificate._get_http_crl_distribution_pointsc                 C   s^   | j s
g S g }| j D ]D}|d jdkr|d }|jdkr:q|j}| dr|| q|S )zx
        :return:
            A list of zero or more unicode strings of the OCSP URLs for this
            cert
        r  r  r  r  r  )rG  rZ   r   rB   rI   r   )r<   r   entrylocationr  r:   r:   r>   	ocsp_urls
  s    

zCertificate.ocsp_urlsc                 C   s   | j dkrg | _ | jrH| jD ](}|jdkr|j| j kr| j |j qnPtd}| jjD ]<}|D ]2}|d jdkrb|d j}|	|rb| j | qbqZ| j S )z
        :return:
            A list of unicode strings of valid domain names for the certificate.
            Wildcard certificates will have a domain in the form: *.example.com
        Nr|  zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r   r   rP   )
_valid_domainsr/  r   rZ   r   r   compiler  r  match)r<   r  patternr
  Zname_type_valuerP   r:   r:   r>   valid_domains
  s    




zCertificate.valid_domainsc                 C   s@   | j dkr:g | _ | jr:| jD ]}|jdkr| j |j q| j S )zj
        :return:
            A list of unicode strings of valid IP addresses for the certificate
        Nr  )
_valid_ipsr/  r   r   rZ   )r<   r  r:   r:   r>   	valid_ips
  s    


zCertificate.valid_ipsc                 C   s   | j o| j d jS )zW
        :return;
            A boolean - if the certificate is marked as a CA
        r  )r3  rZ   r_   r:   r:   r>   r  
  s    zCertificate.cac                 C   s   | j s
dS | jd jS )zT
        :return;
            None or an integer of the maximum path length
        Nr  )r  r3  rZ   r_   r:   r:   r>   max_path_length
  s    zCertificate.max_path_lengthc                 C   s   | j dkr| j| jk| _ | j S )zx
        :return:
            A boolean - if the certificate is self-issued, as defined by RFC
            5280
        N)_self_issuedr  r  r_   r:   r:   r>   self_issued
  s    
zCertificate.self_issuedc                 C   sJ   | j dkrDd| _ | jrD| jr>| js*d| _ qD| j| jkrDd| _ nd| _ | j S )a  
        :return:
            A unicode string of "no" or "maybe". The "maybe" result will
            be returned if the certificate issuer and subject are the same.
            If a key identifier and authority key identifier are present,
            they will need to match otherwise "no" will be returned.

            To verify is a certificate is truly self-signed, the signature
            will need to be verified. See the certvalidator package for
            one possible solution.
        Nnomaybe)_self_signedrh  r  r   r_   r:   r:   r>   self_signed
  s    
zCertificate.self_signedc                 C   s$   | j dkrt|   | _ | j S )zk
        :return:
            The SHA-1 hash of the DER-encoded bytes of this complete certificate
        Nr$  r_   r:   r:   r>   r'    s    
zCertificate.sha1c                 C   s   d dd t| jD S )z
        :return:
            A unicode string of the SHA-1 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r   c                 s   s   | ]}d | V  qdS z%02XNr:   r  cr:   r:   r>   r  $  s     z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r   r   r'  r_   r:   r:   r>   sha1_fingerprint  s    zCertificate.sha1_fingerprintc                 C   s$   | j dkrt|   | _ | j S )zy
        :return:
            The SHA-256 hash of the DER-encoded bytes of this complete
            certificate
        Nr*  r_   r:   r:   r>   r,  &  s    
zCertificate.sha256c                 C   s   d dd t| jD S )z
        :return:
            A unicode string of the SHA-256 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r   c                 s   s   | ]}d | V  qdS rm  r:   rn  r:   r:   r>   r  :  s     z1Certificate.sha256_fingerprint.<locals>.<genexpr>)r   r   r,  r_   r:   r:   r>   sha256_fingerprint2  s    zCertificate.sha256_fingerprintc                 C   sN  t |tsttdt||dd }|ddk}| oNt	
d|}| oZ| }|r| jsjdS |d}| jD ]b}|dd }|d}	t|	t|krqz|	|kr d	S | |}
|
rz| ||	rz d	S qzdS | jsdS |rtjntj}t||}| jD ]<}|ddkr&tjntj}t||}||kr d	S qdS )
a  
        Check if a domain name or IP address is valid according to the
        certificate

        :param domain_ip:
            A unicode string of a domain name or IP address

        :return:
            A boolean - if the domain or IP is valid for the certificate
        zL
                domain_ip must be a unicode string, not %s
                r   re   rt   rd   z^\d+\.\d+\.\d+\.\d+$FrE   T)r@   r   rH   r	   r   rJ   rl   rB   rg   r   ra  rc  r|   r   _is_wildcard_domain_is_wildcard_matchre  r~   r   r   r4   )r<   Z	domain_ipZencoded_domain_ipis_ipv6Zis_ipv4Z	is_domaindomain_labelsZvalid_domainZencoded_valid_domainvalid_domain_labelsZis_wildcardr   Znormalized_ipZvalid_ipZvalid_familyZnormalized_valid_ipr:   r:   r>   is_valid_domain_ip<  sD    









zCertificate.is_valid_domain_ipc                 C   sZ   | ddkrdS | d}|s(dS |d ddkr>dS |d dd dkrVdS d	S )
af  
        Checks if a domain is a valid wildcard according to
        https://tools.ietf.org/html/rfc6125#section-6.4.3

        :param domain:
            A unicode string of the domain name, where any U-labels from an IDN
            have been converted to A-labels

        :return:
            A boolean - if the domain is a valid wildcard domain
        *r   FrE   r   rd   r   zxn--T)countrB   r|   rg   )r<   domainlabelsr:   r:   r>   rr  ~  s    zCertificate._is_wildcard_domainc                 C   sl   |d }|dd }|d }|dd }||kr4dS |dkr@dS t d|dd d	 }||rhdS dS )
a  
        Determines if the labels in a domain are a match for labels from a
        wildcard valid domain name

        :param domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in the domain name to check

        :param valid_domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in a wildcard domain pattern

        :return:
            A boolean - if the domain matches the valid domain
        r   r   NFrx  T^z.*$)r   r`  r   ra  )r<   ru  rv  Zfirst_domain_labelZother_domain_labelsZwildcard_labelZother_valid_domain_labelsZwildcard_regexr:   r:   r>   rs    s    
zCertificate._is_wildcard_match)\rS   rT   rU   r  r   r"   r   r"  r  r(  r*  r,  r.  r0  r2  r4  r6  r8  r:  r<  r>  r@  rB  rD  rF  rH  r&  rJ  rL  rR  rV  rX  rZ  r_  rd  rg  rk  r%  r+  r$  rm   r%  r'  r)  r+  r-  r/  r1  r3  r5  r7  r9  r;  r=  r?  rA  rC  rE  rG  rI  rK  rM  r  rN  rO  rP  r  r  r   r  rS  rT  rU  r   rW  r  r[  rY  r^  rc  re  r  rf  rh  rl  r'  rp  r,  rq  rw  rr  rs  r:   r:   r:   r>   r  `  s  























	













"








	

	B!r  c                   @   s   e Zd ZeZdS )KeyPurposeIdentifiersNr  r:   r:   r:   r>   r~    s   r~  c                   @   s   e Zd ZeZdS )SequenceOfAlgorithmIdentifiersN)rS   rT   rU   r   r   r:   r:   r:   r>   r    s   r  c                	   @   sP   e Zd Zdeddifdedddfdeddifdeddifd	ed
ddfgZdS )CertificateAuxtrustr   Trejectr   r   aliasZkeyidr=   r   N)rS   rT   rU   r~  r-   r#   r  r   r:   r:   r:   r>   r    s   r  c                   @   s   e Zd ZeegZdS )TrustedCertificateN)rS   rT   rU   r  r  Z_child_specsr:   r:   r:   r>   r    s   r  )r   
__future__r   r   r   r   
contextlibr   	encodingsr   r&  r   r~   r   r   r   _errorsr	   Z_irir
   r   Z_ordereddictr   _typesr   r   r   Zalgosr   r   r   r   corer   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r   r0   utilr1   r2   r3   r4   r5   rW   r`   ro   r   r   r   r   r   r   r   r   r   r   r  r   r-  r/  r5  r8  r:  r<  r>  r@  rA  rD  rE  rF  rG  rH  rI  rJ  rK  rL  rM  rO  rP  rQ  rR  rS  rt  rw  rx  ry  rz  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r~  r  r  r  r:   r:   r:   r>   <module>   s  x59q 
  BU* D

			"2%	p			 &      o
