B
    M]l                @   st  d Z ddlmZmZmZmZ ddlmZ ddlm	Z	 ddl
Z
ddlZddlZddlZddlZddlZddlmZ ddlmZmZ dd	lmZ dd
lmZmZmZ ddlmZmZmZmZ ddl m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z< ddl=m>Z> ddl?m@Z@mAZAmBZBmCZC G dd de*ZDG dd de*ZEG dd de*ZFG dd de0ZGG dd de3ZHG dd de4ZIG dd de"ZJG dd de3ZKG dd  d e7ZLed!d" ZMG d#d$ d$e%ZNG d%d& d&e.ZOG d'd( d(e3ZPG d)d* d*e6ZQG d+d, d,e4ZRG d-d. d.e%ZSG d/d0 d0e3ZTG d1d2 d2e%ZUG d3d4 d4e%ZVG d5d6 d6e%ZWG d7d8 d8e5ZXG d9d: d:e5ZYG d;d< d<e4ZZG d=d> d>e4Z[G d?d@ d@e3Z\G dAdB dBe3Z]G dCdD dDe4Z^G dEdF dFe3Z_G dGdH dHe4Z`G dIdJ dJe%ZaG dKdL dLe%ZbG dMdN dNe5ZcG dOdP dPe4ZdG dQdR dRe5ZeG dSdT dTe3ZfG dUdV dVe6ZgG dWdX dXe3ZhG dYdZ dZe%ZiG d[d\ d\e+ZjG d]d^ d^e+ZkG d_d` d`e3ZlG dadb dbe4ZmG dcdd dde3ZnG dedf dfe3ZoG dgdh dhe%ZpG didj dje4ZqG dkdl dle%ZrG dmdn dne3ZsG dodp dpe3ZtG dqdr dre3ZuG dsdt dte%ZvG dudv dve"ZwG dwdx dxe3ZxG dydz dze4ZyG d{d| d|e3ZzG d}d~ d~e3Z{G dd de4Z|G dd de%Z}G dd de4Z~G dd de3ZG dd de3ZG dd de.ZG dd de3ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de3ZG dd de4ZG dd de3ZG dd de.ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de4ZG dd de4ZG dd de3ZG dd de"ZG dd de+ZG dd de3ZG dd de6ZG dd de3ZG dd de3ZG dd de6ZG dd de'ZG dd de'ZG dd de'ZG dd de'ZG dd de'ZG ddĄ de'ZG ddƄ de3ZG ddȄ de3ZG ddʄ de'ZG dd̄ de3ZG dd΄ de3ZG ddЄ de6ZG dd҄ de.ZG ddԄ de6ZG ddք de6ZG dd؄ de6ZG ddڄ de3ZG dd܄ de6ZG ddބ de3ZG dd de4ZG dd de.ZG dd de3ZG dd de4ZG dd de3ZG dd de3ZG dd de4ZG dd de4ZG dd de3ZG dd de&ZdS )z
ASN.1 type classes for X.509 certificates. Exports the following items:

 - Attributes()
 - Certificate()
 - Extensions()
 - GeneralName()
 - GeneralNames()
 - Name()

Other type classes are defined that help compose the types listed above.
    )unicode_literalsdivisionabsolute_importprint_function)contextmanager)idnaN   )unwrap)
iri_to_uri
uri_to_iri)OrderedDict)	type_namestr_clsbytes_to_list)AlgorithmIdentifierAnyAlgorithmIdentifierDigestAlgorithmSignedDigestAlgorithm)Any	BitString	BMPStringBooleanChoiceConcat
EnumeratedGeneralizedTimeGeneralString	IA5StringIntegerNullNumericStringObjectIdentifierOctetBitStringOctetStringParsableOctetStringPrintableStringSequence
SequenceOfSetSetOfTeletexStringUniversalStringUTCTime
UTF8StringVisibleStringVOID)PublicKeyInfo)int_to_bytesint_from_bytes	inet_ntop	inet_ptonc               @   s,   e Zd ZdZdZdd Zdd Zdd Zd	S )
DNSNamer   )      c             C   s
   | |k S )N )selfotherr8   r8   .lib/python3.7/site-packages/asn1crypto/x509.py__ne__L   s    zDNSName.__ne__c             C   s&   t |tsdS |   |  kS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.2

        :param other:
            Another DNSName object

        :return:
            A boolean
        F)
isinstancer5   __unicode__lower)r9   r:   r8   r8   r;   __eq__O   s    
zDNSName.__eq__c             C   sx   t |ts"ttdt| t||drFd|dd | j }n|| j}|| _|| _	d| _
| jdkrtd| _dS )zd
        Sets the value of the DNS name

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                .   .r   N    )r=   r   	TypeErrorr	   r   
startswithencode	_encoding_unicodecontents_header_trailer)r9   valueencoded_valuer8   r8   r;   set_   s    


zDNSName.setN)__name__
__module____qualname__rG   _bad_tagr<   r@   rN   r8   r8   r8   r;   r5   G   s
   r5   c               @   s,   e Zd Zdd Zdd Zdd Zdd Zd	S )
URIc             C   sL   t |ts"ttdt| t||| _t|| _d| _| j	dkrHd| _	dS )zb
        Sets the value of the string

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                NrC   )
r=   r   rD   r	   r   rH   r
   rI   rJ   rK   )r9   rL   r8   r8   r;   rN   ~   s    


zURI.setc             C   s
   | |k S )Nr8   )r9   r:   r8   r8   r;   r<      s    z
URI.__ne__c             C   s&   t |tsdS t| jdt|jdkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.4

        :param other:
            Another URI object

        :return:
            A boolean
        FT)r=   rS   r
   native)r9   r:   r8   r8   r;   r@      s    
z
URI.__eq__c             C   s,   | j dkrdS | jdkr&t|  | _| jS )z7
        :return:
            A unicode string
        N )rI   rH   r   _merge_chunks)r9   r8   r8   r;   r>      s
    

zURI.__unicode__N)rO   rP   rQ   rN   r<   r@   r>   r8   r8   r8   r;   rS   |   s   rS   c               @   sR   e Zd ZdZdZdZedd Zejdd Zdd Z	d	d
 Z
dd Zdd ZdS )EmailAddressNF)r6   r7   c             C   s   | j S )z`
        :return:
            A byte string of the DER-encoded contents of the sequence
        )	_contents)r9   r8   r8   r;   rI      s    zEmailAddress.contentsc             C   s   d| _ || _dS )ze
        :param value:
            A byte string of the DER-encoded contents of the sequence
        FN)_normalizedrX   )r9   rL   r8   r8   r;   rI      s    c             C   s   t |ts"ttdt| t||ddkrZ|dd\}}|dd |d }n
|d}d| _|| _	|| _
d	| _| jd
krd
| _d	S )zb
        Sets the value of the string

        :param value:
            A unicode string
        zK
                %s value must be a unicode string, not %s
                @r   ascii   @r   TNrC   )r=   r   rD   r	   r   findrsplitrF   rY   rH   rI   rJ   rK   )r9   rL   mailboxhostnamerM   r8   r8   r;   rN      s    


zEmailAddress.setc             C   s^   | j dkrX|  }|ddkr.|d| _ n*|dd\}}|dd |d | _ | j S )z7
        :return:
            A unicode string
        Nr]   r[   cp1252r   rZ   r   )rH   rV   r^   decoder_   )r9   rI   r`   ra   r8   r8   r;   r>      s    
zEmailAddress.__unicode__c             C   s
   | |k S )Nr8   )r9   r:   r8   r8   r;   r<     s    zEmailAddress.__ne__c             C   s   t |tsdS | js | | j |js2||j | jddksR|jddkr^| j|jkS |jdd\}}| jdd\}}||krdS | | krdS dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.5

        :param other:
            Another EmailAddress object

        :return:
            A boolean
        Fr]   r[   r   T)	r=   rW   rY   rN   rT   rX   r^   r_   r?   )r9   r:   Zother_mailboxZother_hostnamer`   ra   r8   r8   r;   r@     s    
 zEmailAddress.__eq__)rO   rP   rQ   rX   rY   rR   propertyrI   setterrN   r>   r<   r@   r8   r8   r8   r;   rW      s   	
rW   c               @   s:   e Zd ZdddZdd Zedd Zdd	 Zd
d ZdS )	IPAddressNc             C   s   t tddS )z?
        This method is not applicable to IP addresses
        z=
            IP address values can not be parsed
            N)
ValueErrorr	   )r9   specZspec_paramsr8   r8   r;   parse'  s    zIPAddress.parsec       
      C   sT  t |ts"ttdt| t||}|ddk}d}|rv|dd}|d }t|d }|dk rvttdt| |ddkrt	j
}|dkrttd	t| d}n$t	j}|d
krttdt| d
}d}|rd| }	|	d|t|	  7 }	tt|	d}d|d t|  | }|| _t||| | _| j| _d| _| jdkrPd| _dS )z
        Sets the value of the object

        :param value:
            A unicode string containing an IPv4 address, IPv4 address with CIDR,
            an IPv6 address or IPv6 address with CIDR
        zK
                %s value must be a unicode string, not %s
                /r[   r   r   zT
                    %s value contains a CIDR range less than 0
                    :   z
                    %s value contains a CIDR range bigger than 128, the maximum
                    value for an IPv6 address
                        z
                    %s value contains a CIDR range bigger than 32, the maximum
                    value for an IPv4 address
                    rC   10          N)r=   r   rD   r	   r   r^   splitintrg   socketAF_INET6AF_INETlenr1   _nativer4   rI   Z_bytesrJ   rK   )
r9   rL   original_valueZhas_cidrcidrpartsfamilyZ	cidr_sizeZ
cidr_bytesZ	cidr_maskr8   r8   r;   rN   2  sR    	
zIPAddress.setc             C   s   | j dkrdS | jdkr|  }t|}d}d}|tddgkrnttj|dd }|dkrt|dd }n<|tddgkrttj	|dd }|dkrt|dd }|dk	rd
|}t|d}|d	 t| }|| _| jS )
z
        The native Python datatype representation of this value

        :return:
            A unicode string or None
        Nrm      r   rr      z{0:b}ro   rj   )rI   ry   	__bytes__rx   rN   r3   ru   rv   r2   rw   formatrstripr   )r9   Zbyte_stringZbyte_lenrL   Zcidr_intZ	cidr_bitsr{   r8   r8   r;   rT   y  s*    	


zIPAddress.nativec             C   s
   | |k S )Nr8   )r9   r:   r8   r8   r;   r<     s    zIPAddress.__ne__c             C   s   t |tsdS |  | kS )zl
        :param other:
            Another IPAddress object

        :return:
            A boolean
        F)r=   rf   r   )r9   r:   r8   r8   r;   r@     s    	
zIPAddress.__eq__)NN)	rO   rP   rQ   ri   rN   rd   rT   r<   r@   r8   r8   r8   r;   rf   &  s
   
G rf   c               @   s"   e Zd ZdefdedeifgZdS )	Attributetypevaluesrh   N)rO   rP   rQ   r!   r)   r   _fieldsr8   r8   r8   r;   r     s   r   c               @   s   e Zd ZeZdS )
AttributesN)rO   rP   rQ   r   _child_specr8   r8   r8   r;   r     s   r   c            
   @   s$   e Zd Zddddddddd	d
	ZdS )KeyUsageZdigital_signatureZnon_repudiationZkey_enciphermentZdata_enciphermentZkey_agreementZkey_cert_signZcrl_signZencipher_onlyZdecipher_only)	r   r   rp      r            rr   N)rO   rP   rQ   _mapr8   r8   r8   r;   r     s   r   c               @   s,   e Zd ZdedddfdedddfgZdS )PrivateKeyUsagePeriod
not_beforer   T)implicitoptional	not_afterr   N)rO   rP   rQ   r   r   r8   r8   r8   r;   r     s   r   c               @   s   e Zd ZdZdZdd ZdS )NotReallyTeletexStringa6  
    OpenSSL (and probably some other libraries) puts ISO-8859-1
    into TeletexString instead of ITU T.61. We use Windows-1252 when
    decoding since it is a superset of ISO-8859-1, and less likely to
    cause encoding issues, but we stay strict with encoding to prevent
    us from creating bad data.
    rb   c             C   s0   | j dkrdS | jdkr*|  | j| _| jS )z7
        :return:
            A unicode string
        NrU   )rI   rH   rV   rc   _decoding_encoding)r9   r8   r8   r;   r>     s
    

z"NotReallyTeletexString.__unicode__N)rO   rP   rQ   __doc__r   r>   r8   r8   r8   r;   r     s   r   c               c   s   zdt _d V  W d dt _X d S )Nteletexrb   )r   r   r8   r8   r8   r;   strict_teletex  s    
r   c               @   s4   e Zd ZdefdefdefdefdefdefgZ	dS )DirectoryStringteletex_stringprintable_stringZuniversal_stringutf8_string
bmp_string
ia5_stringN)
rO   rP   rQ   r   r%   r+   r-   r   r   _alternativesr8   r8   r8   r;   r     s   r   c            #   @   s   e Zd Zddddddddd	d
dddddddddddddddddddddd d!d"d#"Zdddddddddddd	d
dd dddddddddd!d"dddddddg!Zed$d% Zed&d' Zd(S ))NameTypecommon_namesurnameserial_numbercountry_namelocality_namestate_or_province_namestreet_addressorganization_nameorganizational_unit_nametitlebusiness_categorypostal_codetelephone_numbername
given_nameinitialsgeneration_qualifierunique_identifierdn_qualifier	pseudonymorganization_identifiertpm_manufacturer	tpm_modeltpm_versionplatform_manufacturerplatform_modelplatform_versionemail_addressincorporation_localityincorporation_state_or_provinceincorporation_countryuser_iddomain_componentname_distinguisher)"z2.5.4.3z2.5.4.4z2.5.4.5z2.5.4.6z2.5.4.7z2.5.4.8z2.5.4.9z2.5.4.10z2.5.4.11z2.5.4.12z2.5.4.15z2.5.4.17z2.5.4.20z2.5.4.41z2.5.4.42z2.5.4.43z2.5.4.44z2.5.4.45z2.5.4.46z2.5.4.65z2.5.4.97z2.23.133.2.1z2.23.133.2.2z2.23.133.2.3z2.23.133.2.4z2.23.133.2.5z2.23.133.2.6z1.2.840.113549.1.9.1z1.3.6.1.4.1.311.60.2.1.1z1.3.6.1.4.1.311.60.2.1.2z1.3.6.1.4.1.311.60.2.1.3z0.9.2342.19200300.100.1.1z0.9.2342.19200300.100.1.25z0.2.262.1.10.7.20c             C   s4   |  |}|| jkr"| j|}n
t| j}||fS )z
        Returns an ordering value for a particular attribute key.

        Unrecognized attributes and OIDs will be sorted lexically at the end.

        :return:
            An orderable value.

        )mappreferred_orderindexrx   )clsZ	attr_nameZordinalr8   r8   r;   preferred_ordinalK  s
    


zNameType.preferred_ordinalc          #   C   sV   ddddddddd	d
dddddddddddddddddddddd d!d"d#" | j| jS )$zZ
        :return:
            A human-friendly unicode string to display to users
        zCommon NameZSurnamezSerial NumberCountryZLocalityzState/ProvincezStreet AddressZOrganizationzOrganizational UnitZTitlezBusiness CategoryzPostal CodezTelephone NumberNamez
Given NameZInitialszGeneration QualifierzUnique IdentifierzDN QualifierZ	PseudonymzEmail AddresszIncorporation LocalityzIncorporation State/ProvincezIncorporation CountryzDomain ComponentzName DistinguisherzOrganization IdentifierzTPM Manufacturerz	TPM ModelzTPM VersionzPlatform ManufacturerzPlatform ModelzPlatform VersionzUser ID)"r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   )getrT   )r9   r8   r8   r;   human_friendly_  sF    zNameType.human_friendlyN)	rO   rP   rQ   r   r   classmethodr   rd   r   r8   r8   r8   r;   r     s   r   c            #   @   s   e Zd ZdefdefgZdZeeeeeeeeeeeeeeeeee	eee
eeeeeeeeeeeeed"ZdZedd Zdd	 Zd
d Zdd ZdS )NameTypeAndValuer   rL   )r   rL   )"r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   Nc             C   s"   | j dkr| | d j| _ | j S )z
        Returns the value after being processed by the internationalized string
        preparation as specified by RFC 5280

        :return:
            A unicode string
        NrL   )_prepped_ldap_string_preprT   )r9   r8   r8   r;   prepped_value  s    

zNameTypeAndValue.prepped_valuec             C   s
   | |k S )Nr8   )r9   r:   r8   r8   r;   r<     s    zNameTypeAndValue.__ne__c             C   s2   t |tsdS |d j| d jkr&dS |j| jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another NameTypeAndValue object

        :return:
            A boolean
        Fr   )r=   r   rT   r   )r9   r:   r8   r8   r;   r@     s
    
zNameTypeAndValue.__eq__c             C   s  t dd|}t dd|}tjdkr6t dd|}nt dd|}t dd|}|d	d}t d
d|}dttj|}t	
d|}x|D ]}t|rttdt|rttdt|rttdt|rttdt|rttd|dkrttdqW d}d}x0|D ](}t|r@d}nt|r*d}q*W |rt|d }t|d }|s|r|sttddt dd|  d }|S )a"  
        Implements the internationalized string preparation algorithm from
        RFC 4518. https://tools.ietf.org/html/rfc4518#section-2

        :param string:
            A unicode string to prepare

        :return:
            A prepared unicode string, ready for comparison
        u   [­᠆͏᠋-᠍️-＀￼]+rU   u	   [	
] i  u   [-]|[-]|󠀁u   [𝅳-𝅺󠀠-󠁿󠀁]u?   [ ----۝܏᠎‌-‏‪-‮⁠-⁣⁪-⁯﻿￹-￻]+u   ​u   [   -  -   　]ZNFKCzc
                    X.509 Name objects may not contain unassigned code points
                    z
                    X.509 Name objects may not contain change display or
                    zzzzdeprecated characters
                    zc
                    X.509 Name objects may not contain private use characters
                    zf
                    X.509 Name objects may not contain non-character code points
                    zb
                    X.509 Name objects may not contain surrogate code points
                    u   �zf
                    X.509 Name objects may not contain the replacement character
                    FTr   r[   z{
                    X.509 Name object contains a malformed bidirectional
                    sequence
                    z +z  )resubsys
maxunicodereplacejoinr   
stringprepZmap_table_b2unicodedataZ	normalizeZin_table_a1rg   r	   Zin_table_c8Zin_table_c3Zin_table_c4Zin_table_c5Zin_table_d1Zin_table_d2strip)r9   stringcharZhas_r_and_al_catZ	has_l_catZfirst_is_r_and_alZlast_is_r_and_alr8   r8   r;   r     s^    







z"NameTypeAndValue._ldap_string_prep)rO   rP   rQ   r   r   r   	_oid_pairr   r%   r"   rW   r5   r-   
_oid_specsr   rd   r   r<   r@   r   r8   r8   r8   r;   r     sT   
r   c               @   s<   e Zd ZeZedd Zdd Zdd Zdd Z	d	d
 Z
dS )RelativeDistinguishedNamec             C   sD   g }|  | }x*t| D ]}|d||| f  qW d|S )zb
        :return:
            A unicode string that can be used as a dict key or in a set
        z%s: %s)_get_valuessortedkeysappendr   )r9   outputr   keyr8   r8   r;   hashableP  s
    
z"RelativeDistinguishedName.hashablec             C   s
   | |k S )Nr8   )r9   r:   r8   r8   r;   r<   `  s    z RelativeDistinguishedName.__ne__c             C   s|   t |tsdS t| t|kr"dS | | }| |}||krBdS | | }| |}x |D ]}|| || kr\dS q\W dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RelativeDistinguishedName object

        :return:
            A boolean
        FT)r=   r   rx   
_get_typesr   )r9   r:   Z
self_typesZother_typesZself_valuesZother_valuesZ
type_name_r8   r8   r;   r@   c  s    





z RelativeDistinguishedName.__eq__c             C   s   t dd |D S )z
        Returns a set of types contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A set object with unicode strings of NameTypeAndValue type field
            values
        c             S   s   g | ]}|d  j qS )r   )rT   ).0ntvr8   r8   r;   
<listcomp>  s    z8RelativeDistinguishedName._get_types.<locals>.<listcomp>)rN   )r9   rdnr8   r8   r;   r     s    z$RelativeDistinguishedName._get_typesc                s   i   fdd|D   S )a$  
        Returns a dict of prepped values contained in an RDN

        :param rdn:
            A RelativeDistinguishedName object

        :return:
            A dict object with unicode strings of NameTypeAndValue value field
            values that have been prepped for comparison
        c                s$   g | ]}  |d  j|jfgqS )r   )updaterT   r   )r   r   )r   r8   r;   r     s    z9RelativeDistinguishedName._get_values.<locals>.<listcomp>r8   )r9   r   r8   )r   r;   r     s    z%RelativeDistinguishedName._get_valuesN)rO   rP   rQ   r   r   rd   r   r<   r@   r   r   r8   r8   r8   r;   r   M  s    r   c               @   s,   e Zd ZeZedd Zdd Zdd ZdS )RDNSequencec             C   s   d dd | D S )zb
        :return:
            A unicode string that can be used as a dict key or in a set
        c             s   s   | ]}|j V  qd S )N)r   )r   r   r8   r8   r;   	<genexpr>  s    z'RDNSequence.hashable.<locals>.<genexpr>)r   )r9   r8   r8   r;   r     s    
zRDNSequence.hashablec             C   s
   | |k S )Nr8   )r9   r:   r8   r8   r;   r<     s    zRDNSequence.__ne__c             C   sL   t |tsdS t| t|kr"dS x$t| D ]\}}|| |kr,dS q,W dS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another RDNSequence object

        :return:
            A boolean
        FT)r=   r   rx   	enumerate)r9   r:   r   Zself_rdnr8   r8   r;   r@     s    
zRDNSequence.__eq__N)	rO   rP   rQ   r   r   rd   r   r<   r@   r8   r8   r8   r;   r     s   r   c               @   s   e Zd ZdefgZdZdZdZedddZ	e
dd Zdd	 Zd
d Zdd Ze
dd Ze
dd Zdd Ze
dd Ze
dd ZdS )r   rU   NFc       	      C   s   g }|sd}t }nd}t}tt| dd d}x| D ]\}}t|}|dkr`t|}nF|dkrrt|}n4|t	dd	d
gkrt
dt|d}nt
|||d}|tt||dg q<W | dt|dS )aT  
        Creates a Name object from a dict of unicode string keys and values.
        The keys should be from NameType._map, or a dotted-integer OID unicode
        string.

        :param name_dict:
            A dict of name information, e.g. {"common_name": "Will Bond",
            "country_name": "US", "organization": "Codex Non Sufficit LC"}

        :param use_printable:
            A bool - if PrintableString should be used for encoding instead of
            UTF8String. This is for backwards compatibility with old software.

        :return:
            An x509.Name object
        r   r   c             S   s   t | d S )Nr   )r   r   )itemr8   r8   r;   <lambda>  rC   zName.build.<locals>.<lambda>)r   r   r   r   r   r   )r   rL   )r   rL   rU   )r-   r%   r   r   itemsr   r   rW   r5   rN   r   r   r   r   r   )	r   Z	name_dictZuse_printableZrdnsZencoding_nameZencoding_classattribute_nameZattribute_valuerL   r8   r8   r;   build  s8    


z
Name.buildc             C   s   | j jS )zb
        :return:
            A unicode string that can be used as a dict key or in a set
        )chosenr   )r9   r8   r8   r;   r     s    zName.hashablec             C   s
   t | jS )N)rx   r   )r9   r8   r8   r;   __len__  s    zName.__len__c             C   s
   | |k S )Nr8   )r9   r:   r8   r8   r;   r<     s    zName.__ne__c             C   s   t |tsdS | j|jkS )z
        Equality as defined by https://tools.ietf.org/html/rfc5280#section-7.1

        :param other:
            Another Name object

        :return:
            A boolean
        F)r=   r   r   )r9   r:   r8   r8   r;   r@   !  s    
zName.__eq__c             C   s   | j d krt | _ xr| jjD ]f}x`|D ]X}|d }|| j krp| j | }t|ts`|g }| j |< ||d  q&|d | j |< q&W qW | j S )Nr   rL   )ry   r   r   rT   r=   listr   )r9   r   type_val
field_nameexistingr8   r8   r;   rT   0  s    




zName.nativec             C   s  | j dkrt }d}x`| jD ]V}xP|D ]H}|d j}|}||krd|| g||< || |d  q(|d ||< q(W qW g }| }|dkrtt|}x0|D ](}|| }	| |	}
|d||
f  qW d}x |D ]}|	ddkrd	}P qW |sd
nd}|
|ddd | _ | j S )zg
        :return:
            A human-friendly unicode string containing the parts of the name
        Nr   rL   r   z%s: %sF,r[   Tz, z; )_human_friendlyr   r   r   r   r   reversedr   _recursive_humanizer^   r   )r9   dataZ
last_fieldr   r   r   Zto_joinr   r   rL   Znative_valueZ	has_commaelementZ	separatorr8   r8   r;   r   @  s6    




zName.human_friendlyc                s,   t |tr&dt fdd|D S |jS )z
        Recursively serializes data compiled from the RDNSequence

        :param value:
            An Asn1Value object, or a list of Asn1Value objects

        :return:
            A unicode string
        z, c                s   g | ]}  |qS r8   )r   )r   Z	sub_value)r9   r8   r;   r   t  s    z,Name._recursive_humanize.<locals>.<listcomp>)r=   r   r   r   rT   )r9   rL   r8   )r9   r;   r   g  s    
zName._recursive_humanizec             C   s$   | j dkrt|   | _ | j S )zZ
        :return:
            The SHA1 hash of the DER-encoded bytes of this name
        N)_sha1hashlibsha1dumpdigest)r9   r8   r8   r;   r  x  s    
z	Name.sha1c             C   s$   | j dkrt|   | _ | j S )z]
        :return:
            The SHA-256 hash of the DER-encoded bytes of this name
        N)_sha256r  sha256r  r  )r9   r8   r8   r;   r	    s    
zName.sha256)F)rO   rP   rQ   r   r   r   r  r  r   r   rd   r   r   r<   r@   rT   r   r   r  r	  r8   r8   r8   r;   r     s   
<	'r   c               @   s"   e Zd ZdefdeddifgZdS )AnotherNameZtype_idrL   explicitr   N)rO   rP   rQ   r!   r   r   r8   r8   r8   r;   r
    s   r
  c               @   s$   e Zd ZdZdZdefdefgZdS )CountryNamer   x121_dcc_codeiso_3166_alpha2_codeN)rO   rP   rQ   class_tagr    r%   r   r8   r8   r8   r;   r    s   r  c               @   s$   e Zd ZdZdZdefdefgZdS )AdministrationDomainNamer   rp   numeric	printableN)rO   rP   rQ   r  r  r    r%   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdefdefgZdS )PrivateDomainNamer  r  N)rO   rP   rQ   r    r%   r   r8   r8   r8   r;   r    s   r  c               @   sF   e Zd Zdeddifdedddfded	ddfd
edddfgZdS )PersonalNamer   r   r   r   r   T)r   r   r   rp   r   r   N)rO   rP   rQ   r%   r   r8   r8   r8   r;   r    s   r  c               @   sF   e Zd Zdeddifdedddfded	ddfd
edddfgZdS )TeletexPersonalNamer   r   r   r   r   T)r   r   r   rp   r   r   N)rO   rP   rQ   r*   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )OrganizationalUnitNamesN)rO   rP   rQ   r%   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )TeletexOrganizationalUnitNamesN)rO   rP   rQ   r*   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd Zdeddifdeddifdedddfded	ddfd
edddfdedddfdedddfdedddfde	dddfg	Z
dS )BuiltInStandardAttributesr   r   TZadministration_domain_nameZnetwork_addressr   )r   r   Zterminal_identifierr   Zprivate_domain_namerp   )r  r   r   r   Znumeric_user_identifierr   Zpersonal_namer   Zorganizational_unit_namesr   N)rO   rP   rQ   r  r  r    r%   r  r  r  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdefdefgZdS )BuiltInDomainDefinedAttributer   rL   N)rO   rP   rQ   r%   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )BuiltInDomainDefinedAttributesN)rO   rP   rQ   r  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdefdefgZdS )TeletexDomainDefinedAttributer   rL   N)rO   rP   rQ   r*   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )TeletexDomainDefinedAttributesN)rO   rP   rQ   r  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdefdefgZdS )PhysicalDeliveryCountryNamer  r  N)rO   rP   rQ   r    r%   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdefdefgZdS )
PostalCodeZnumeric_codeZprintable_codeN)rO   rP   rQ   r    r%   r   r8   r8   r8   r;   r    s   r  c               @   s(   e Zd ZdeddifdeddifgZdS )PDSParameterr   r   Tr   N)rO   rP   rQ   r%   r*   r   r8   r8   r8   r;   r     s   r   c               @   s   e Zd ZeZdS )PrintableAddressN)rO   rP   rQ   r%   r   r8   r8   r8   r;   r!    s   r!  c               @   s(   e Zd ZdeddifdeddifgZdS )UnformattedPostalAddressZprintable_addressr   Tr   N)rO   rP   rQ   r!  r*   r   r8   r8   r8   r;   r"    s   r"  c               @   s*   e Zd ZdeddifdedddfgZdS )	E1634AddressZnumberr   r   Zsub_addressr   T)r   r   N)rO   rP   rQ   r    r   r8   r8   r8   r;   r#    s   r#  c               @   s   e Zd ZeZdS )
NAddressesN)rO   rP   rQ   r#   r   r8   r8   r8   r;   r$    s   r$  c               @   sF   e Zd Zdedddfdedddfdedddfd	ed
difgZdS )PresentationAddressZ
p_selectorr   T)r  r   Z
s_selectorr   Z
t_selectorrp   Zn_addressesr  r   N)rO   rP   rQ   r#   r$  r   r8   r8   r8   r;   r%    s   r%  c               @   s"   e Zd ZdefdeddifgZdS )ExtendedNetworkAddressZe163_4_addressZpsap_addressr   r   N)rO   rP   rQ   r#  r%  r   r8   r8   r8   r;   r&  #  s   r&  c               @   s   e Zd ZdddddddZdS )	TerminalTypeZtelexr   Zg3_facsimileZg4_facsimileZia5_terminalZvideotex)r   r   r   r   r   rr   N)rO   rP   rQ   r   r8   r8   r8   r;   r'  *  s   r'  c               @   s@   e Zd Zddddddddd	d
ddddddddddddddZdS )ExtensionAttributeTyper   teletex_common_nameteletex_organization_nameteletex_personal_nameteletex_organization_unit_names!teletex_domain_defined_attributespds_namephysical_delivery_country_namer   physical_delivery_office_namephysical_delivery_office_numberextension_of_address_componentsphysical_delivery_personal_name#physical_delivery_organization_name.extension_physical_delivery_address_componentsunformatted_postal_addressr   post_office_box_addressposte_restante_addressunique_postal_namelocal_postal_attributesextended_network_addressterminal_type)r   rp   r   r   r   r   r   rr   	   
      r6            r~         r7               N)rO   rP   rQ   r   r8   r8   r8   r;   r(  5  s.   r(  c               @   s`   e Zd ZdeddifdeddifgZdZeeee	e
eeeeeeeeeeeeeeeeeedZd	S )
ExtensionAttributeextension_attribute_typer   r   extension_attribute_valuer  r   )rJ  rK  )r   r)  r*  r+  r,  r-  r.  r/  r   r0  r1  r2  r3  r4  r5  r6  r   r7  r8  r9  r:  r;  r<  N)rO   rP   rQ   r(  r   r   r   r%   r*   r  r  r  r  r  r   r"  r&  r'  r   r8   r8   r8   r;   rI  Q  s4   rI  c               @   s   e Zd ZeZdS )ExtensionAttributesN)rO   rP   rQ   rI  r   r8   r8   r8   r;   rL  s  s   rL  c               @   s.   e Zd ZdefdeddifdeddifgZdS )	ORAddressZbuilt_in_standard_attributesZ"built_in_domain_defined_attributesr   TZextension_attributesN)rO   rP   rQ   r  r  rL  r   r8   r8   r8   r;   rM  w  s   rM  c               @   s*   e Zd ZdedddfdeddifgZdS )	EDIPartyNameZname_assignerr   T)r   r   Z
party_namer   r   N)rO   rP   rQ   r   r   r8   r8   r8   r;   rN    s   rN  c               @   s   e Zd Zdeddifdeddifdeddifdedd	ifd
eddifdeddifde	ddifde
ddifdeddifg	Zdd Zdd ZdS )GeneralName
other_namer   r   Zrfc822_namer   dns_namerp   x400_addressr   Zdirectory_namer  r   edi_party_namer   uniform_resource_identifierr   
ip_addressr   Zregistered_idrr   c             C   s
   | |k S )Nr8   )r9   r:   r8   r8   r;   r<     s    zGeneralName.__ne__c             C   sP   | j dkrttd| j |j dkr4ttd|j | j |j krDdS | j|jkS )z
        Does not support other_name, x400_address or edi_party_name

        :param other:
            The other GeneralName to compare to

        :return:
            A boolean
        )rP  rR  rS  zr
                Comparison is not supported for GeneralName objects of
                choice %s
                za
                Comparison is not supported for GeneralName objects of choice
                %sF)r   rg   r	   r   )r9   r:   r8   r8   r;   r@     s    



zGeneralName.__eq__N)rO   rP   rQ   r
  rW   r5   rM  r   rN  rS   rf   r!   r   r<   r@   r8   r8   r8   r;   rO    s   rO  c               @   s   e Zd ZeZdS )GeneralNamesN)rO   rP   rQ   rO  r   r8   r8   r8   r;   rV    s   rV  c               @   s   e Zd ZdefdefgZdS )TimeZutc_timeZgeneral_timeN)rO   rP   rQ   r,   r   r   r8   r8   r8   r;   rW    s   rW  c               @   s   e Zd ZdefdefgZdS )Validityr   r   N)rO   rP   rQ   rW  r   r8   r8   r8   r;   rX    s   rX  c               @   s(   e Zd ZdeddifdeddifgZdS )BasicConstraintscadefaultFpath_len_constraintr   TN)rO   rP   rQ   r   r   r   r8   r8   r8   r;   rY    s   rY  c               @   s:   e Zd ZdedddfdedddfdedddfgZd	S )
AuthorityKeyIdentifierkey_identifierr   T)r   r   authority_cert_issuerr   authority_cert_serial_numberrp   N)rO   rP   rQ   r#   rV  r   r   r8   r8   r8   r;   r]    s   r]  c               @   s(   e Zd ZdeddifdeddifgZdS )DistributionPointName	full_namer   r   name_relative_to_crl_issuerr   N)rO   rP   rQ   rV  r   r   r8   r8   r8   r;   ra    s   ra  c            
   @   s$   e Zd Zddddddddd	d
	ZdS )ReasonFlagsZunusedZkey_compromiseZca_compromiseZaffiliation_changedZ
supersededZcessation_of_operationZcertificate_holdZprivilege_withdrawnZaa_compromise)	r   r   rp   r   r   r   r   r   rr   N)rO   rP   rQ   r   r8   r8   r8   r;   rd    s   rd  c               @   s2   e Zd ZdefdedddfdedddfgZd	S )
GeneralSubtreebaseZminimumr   )r   r[  Zmaximumr   T)r   r   N)rO   rP   rQ   rO  r   r   r8   r8   r8   r;   re    s   re  c               @   s   e Zd ZeZdS )GeneralSubtreesN)rO   rP   rQ   re  r   r8   r8   r8   r;   rg    s   rg  c               @   s,   e Zd ZdedddfdedddfgZdS )NameConstraintsZpermitted_subtreesr   T)r   r   Zexcluded_subtreesr   N)rO   rP   rQ   rg  r   r8   r8   r8   r;   rh    s   rh  c               @   sJ   e Zd Zdedddfdedddfded	ddfgZd
Zedd Z	dS )DistributionPointdistribution_pointr   T)r  r   Zreasonsr   )r   r   Z
crl_issuerrp   Fc             C   sj   | j dkrdd| _ | d }|jdkr.ttdx4|jD ]*}|jdkr6|j}| dr6|| _ P q6W | j S )z_
        :return:
            None or a unicode string of the distribution point's URL
        FNrj  rb  z
                    CRL distribution points that are relative to the issuer are
                    not supported
                    rT  )zhttp://zhttps://zldap://zldaps://)_urlr   rg   r	   r   rT   r?   rE   )r9   r   general_nameurlr8   r8   r;   rm  
  s    


zDistributionPoint.urlN)
rO   rP   rQ   ra  rd  rV  r   rk  rd   rm  r8   r8   r8   r;   ri    s
   ri  c               @   s   e Zd ZeZdS )CRLDistributionPointsN)rO   rP   rQ   ri  r   r8   r8   r8   r;   rn  &  s   rn  c               @   s(   e Zd ZdefdefdefdefgZdS )DisplayTextr   Zvisible_stringr   r   N)rO   rP   rQ   r   r.   r   r-   r   r8   r8   r8   r;   ro  *  s   ro  c               @   s   e Zd ZeZdS )NoticeNumbersN)rO   rP   rQ   r   r   r8   r8   r8   r;   rp  3  s   rp  c               @   s   e Zd ZdefdefgZdS )NoticeReferenceZorganizationZnotice_numbersN)rO   rP   rQ   ro  rp  r   r8   r8   r8   r;   rq  7  s   rq  c               @   s(   e Zd ZdeddifdeddifgZdS )
UserNoticeZ
notice_refr   TZexplicit_textN)rO   rP   rQ   rq  ro  r   r8   r8   r8   r;   rr  >  s   rr  c               @   s   e Zd ZdddZdS )PolicyQualifierId certification_practice_statementuser_notice)z1.3.6.1.5.5.7.2.1z1.3.6.1.5.5.7.2.2N)rO   rP   rQ   r   r8   r8   r8   r;   rs  E  s   rs  c               @   s*   e Zd ZdefdefgZdZeedZ	dS )PolicyQualifierInfopolicy_qualifier_id	qualifier)rw  rx  )rt  ru  N)
rO   rP   rQ   rs  r   r   r   r   rr  r   r8   r8   r8   r;   rv  L  s
   
rv  c               @   s   e Zd ZeZdS )PolicyQualifierInfosN)rO   rP   rQ   rv  r   r8   r8   r8   r;   ry  Y  s   ry  c               @   s   e Zd ZddiZdS )PolicyIdentifierz2.5.29.32.0Z
any_policyN)rO   rP   rQ   r   r8   r8   r8   r;   rz  ]  s   rz  c               @   s"   e Zd ZdefdeddifgZdS )PolicyInformationZpolicy_identifierZpolicy_qualifiersr   TN)rO   rP   rQ   rz  ry  r   r8   r8   r8   r;   r{  c  s   r{  c               @   s   e Zd ZeZdS )CertificatePoliciesN)rO   rP   rQ   r{  r   r8   r8   r8   r;   r|  j  s   r|  c               @   s   e Zd ZdefdefgZdS )PolicyMappingZissuer_domain_policyZsubject_domain_policyN)rO   rP   rQ   rz  r   r8   r8   r8   r;   r}  n  s   r}  c               @   s   e Zd ZeZdS )PolicyMappingsN)rO   rP   rQ   r}  r   r8   r8   r8   r;   r~  u  s   r~  c               @   s,   e Zd ZdedddfdedddfgZdS )PolicyConstraintsZrequire_explicit_policyr   T)r   r   Zinhibit_policy_mappingr   N)rO   rP   rQ   r   r   r8   r8   r8   r;   r  y  s   r  c            V   @   s   e Zd Zddddddddd	d
dddddddddddddddddddddd d!d"d#d$d%d&d'd(d)d*d+d,d-d.d/d0d1d2d3d4d5d6d7d8d9d:d;d<d=d>d?d@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVUZdWS )XKeyPurposeIdZany_extended_key_usageZserver_authZclient_authZcode_signingZemail_protectionZipsec_end_systemZipsec_tunnelZ
ipsec_usertime_stampingZocsp_signingZdvcsZeap_over_pppZeap_over_lanZscvp_serverZscvp_clientZ	ipsec_ikeZ	capwap_acZ
capwap_wtpZ
sip_domainZsecure_shell_clientZsecure_shell_serverZsend_routerZsend_proxied_routerZ
send_ownerZsend_proxied_ownerZcmc_caZcmc_raZcmc_archiveZbgpspec_routerZike_intermediateZmicrosoft_trust_list_signingZmicrosoft_time_stamp_signingZmicrosoft_server_gatedZmicrosoft_serializedZmicrosoft_efsZmicrosoft_efs_recoveryZmicrosoft_whqlZmicrosoft_nt5Zmicrosoft_oem_whqlZmicrosoft_embedded_ntZmicrosoft_root_list_signerZ!microsoft_qualified_subordinationZmicrosoft_key_recoveryZmicrosoft_document_signingZmicrosoft_lifetime_signingZ microsoft_mobile_device_softwareZmicrosoft_smart_card_logonZapple_x509_basicZ	apple_sslZapple_local_cert_genZapple_csr_genZapple_revocation_crlZapple_revocation_ocspZapple_smimeZ	apple_eapZapple_software_update_signingZapple_ipsecZapple_ichatZapple_resource_signingZapple_pkinit_clientZapple_pkinit_serverZapple_code_signingZapple_package_signingZapple_id_validationZapple_time_stampingZapple_revocationZapple_passbook_signingZapple_mobile_storeZapple_escrow_serviceZapple_profile_signerZapple_qa_profile_signerZapple_test_mobile_storeZapple_otapki_signerZapple_test_otapki_signerZ)apple_id_validation_record_signing_policyZapple_smp_encryptionZapple_test_smp_encryptionZapple_server_authenticationZapple_pcs_escrow_serviceZpiv_card_authenticationZpiv_content_signingZpkinit_kpclientauthZpkinit_kpkdcZadobe_authentic_documents_trustZfpki_pivi_content_signing)Uz2.5.29.37.0z1.3.6.1.5.5.7.3.1z1.3.6.1.5.5.7.3.2z1.3.6.1.5.5.7.3.3z1.3.6.1.5.5.7.3.4z1.3.6.1.5.5.7.3.5z1.3.6.1.5.5.7.3.6z1.3.6.1.5.5.7.3.7z1.3.6.1.5.5.7.3.8z1.3.6.1.5.5.7.3.9z1.3.6.1.5.5.7.3.10z1.3.6.1.5.5.7.3.13z1.3.6.1.5.5.7.3.14z1.3.6.1.5.5.7.3.15z1.3.6.1.5.5.7.3.16z1.3.6.1.5.5.7.3.17z1.3.6.1.5.5.7.3.18z1.3.6.1.5.5.7.3.19z1.3.6.1.5.5.7.3.20z1.3.6.1.5.5.7.3.21z1.3.6.1.5.5.7.3.22z1.3.6.1.5.5.7.3.23z1.3.6.1.5.5.7.3.24z1.3.6.1.5.5.7.3.25z1.3.6.1.5.5.7.3.26z1.3.6.1.5.5.7.3.27z1.3.6.1.5.5.7.3.28z1.3.6.1.5.5.7.3.29z1.3.6.1.5.5.7.3.30z1.3.6.1.5.5.8.2.2z1.3.6.1.4.1.311.10.3.1z1.3.6.1.4.1.311.10.3.2z1.3.6.1.4.1.311.10.3.3z1.3.6.1.4.1.311.10.3.3.1z1.3.6.1.4.1.311.10.3.4z1.3.6.1.4.1.311.10.3.4.1z1.3.6.1.4.1.311.10.3.5z1.3.6.1.4.1.311.10.3.6z1.3.6.1.4.1.311.10.3.7z1.3.6.1.4.1.311.10.3.8z1.3.6.1.4.1.311.10.3.9z1.3.6.1.4.1.311.10.3.10z1.3.6.1.4.1.311.10.3.11z1.3.6.1.4.1.311.10.3.12z1.3.6.1.4.1.311.10.3.13z1.3.6.1.4.1.311.10.3.14z1.3.6.1.4.1.311.20.2.2z1.2.840.113635.100.1.2z1.2.840.113635.100.1.3z1.2.840.113635.100.1.4z1.2.840.113635.100.1.5z1.2.840.113635.100.1.6z1.2.840.113635.100.1.7z1.2.840.113635.100.1.8z1.2.840.113635.100.1.9z1.2.840.113635.100.1.10z1.2.840.113635.100.1.11z1.2.840.113635.100.1.12z1.2.840.113635.100.1.13z1.2.840.113635.100.1.14z1.2.840.113635.100.1.15z1.2.840.113635.100.1.16z1.2.840.113635.100.1.17z1.2.840.113635.100.1.18z1.2.840.113635.100.1.20z1.2.840.113635.100.1.21z1.2.840.113635.100.1.22z1.2.840.113635.100.1.23z1.2.840.113635.100.1.24z1.2.840.113635.100.1.25z1.2.840.113635.100.1.26z1.2.840.113635.100.1.27z1.2.840.113635.100.1.28z1.2.840.113635.100.1.29z1.2.840.113625.100.1.30z1.2.840.113625.100.1.31z1.2.840.113625.100.1.32z1.2.840.113635.100.1.33z1.2.840.113635.100.1.34z2.16.840.1.101.3.6.8z2.16.840.1.101.3.6.7z1.3.6.1.5.2.3.4z1.3.6.1.5.2.3.5z1.2.840.113583.1.1.5z2.16.840.1.101.3.8.7N)rO   rP   rQ   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )ExtKeyUsageSyntaxN)rO   rP   rQ   r  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdddddZdS )AccessMethodocspZ
ca_issuersr  Zca_repository)z1.3.6.1.5.5.7.48.1z1.3.6.1.5.5.7.48.2z1.3.6.1.5.5.7.48.3z1.3.6.1.5.5.7.48.5N)rO   rP   rQ   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdefdefgZdS )AccessDescriptionaccess_methodaccess_locationN)rO   rP   rQ   r  rO  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )AuthorityInfoAccessSyntaxN)rO   rP   rQ   r  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )SubjectInfoAccessSyntaxN)rO   rP   rQ   r  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )FeaturesN)rO   rP   rQ   r   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdefdefgZdS )EntrustVersionInfoZentrust_versZentrust_info_flagsN)rO   rP   rQ   r   r   r   r8   r8   r8   r;   r    s   r  c            	   @   s"   e Zd Zddddddddd	Zd
S )NetscapeCertificateTypeZ
ssl_clientZ
ssl_serverZemailZobject_signingZreservedZssl_caZemail_caZobject_signing_ca)r   r   rp   r   r   r   r   r   N)rO   rP   rQ   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZddddZdS )Versionv1Zv2Zv3)r   r   rp   N)rO   rP   rQ   r   r8   r8   r8   r;   r  %  s   r  c               @   s"   e Zd ZdefdefdefgZdS )TPMSpecificationr}   levelrevisionN)rO   rP   rQ   r-   r   r   r8   r8   r8   r;   r  -  s   r  c               @   s   e Zd ZeZdS )SetOfTPMSpecificationN)rO   rP   rQ   r  r   r8   r8   r8   r;   r  5  s   r  c               @   s"   e Zd ZdefdefdefgZdS )TCGSpecificationVersionZmajor_versionZminor_versionr  N)rO   rP   rQ   r   r   r8   r8   r8   r;   r  9  s   r  c               @   s   e Zd ZdefdefgZdS )TCGPlatformSpecificationversionZplatform_classN)rO   rP   rQ   r  r#   r   r8   r8   r8   r;   r  A  s   r  c               @   s   e Zd ZeZdS )SetOfTCGPlatformSpecificationN)rO   rP   rQ   r  r   r8   r8   r8   r;   r  H  s   r  c               @   s   e Zd ZdddddZdS )EKGenerationTypeZinternalZinjectedZinternal_revocableZinjected_revocable)r   r   rp   r   N)rO   rP   rQ   r   r8   r8   r8   r;   r  L  s   r  c               @   s   e Zd ZddddZdS )EKGenerationLocationr   r   ek_cert_signer)r   r   rp   N)rO   rP   rQ   r   r8   r8   r8   r;   r  U  s   r  c               @   s   e Zd ZddddZdS )EKCertificateGenerationLocationr   r   r  )r   r   rp   N)rO   rP   rQ   r   r8   r8   r8   r;   r  ]  s   r  c               @   s    e Zd ZddddddddZd	S )
EvaluationAssuranceLevellevel1level2level3level4Zlevel5Zlevel6Zlevel7)r   rp   r   r   r   r   r   N)rO   rP   rQ   r   r8   r8   r8   r;   r  e  s   r  c               @   s   e Zd ZddddZdS )EvaluationStatusZdesigned_to_meetZevaluation_in_progressZevaluation_completed)r   r   rp   N)rO   rP   rQ   r   r8   r8   r8   r;   r  q  s   r  c               @   s   e Zd ZddddZdS )StrengthOfFunctionZbasicZmediumZhigh)r   r   rp   N)rO   rP   rQ   r   r8   r8   r8   r;   r  y  s   r  c               @   s.   e Zd ZdefdeddifdeddifgZdS )URIReferencerT  Zhash_algorithmr   TZ
hash_valueN)rO   rP   rQ   r   r   r   r   r8   r8   r8   r;   r    s   r  c               @   st   e Zd Zdefdefdefdeddifdedd	d
fdedd	d
fde	dd	d
fdedd	d
fde	dd	d
fg	Z
dS )CommonCriteriaMeasuresr  Zassurance_levelZevaluation_statusplusr[  FZstrengh_of_functionr   T)r   r   Zprofile_oidr   Zprofile_urlrp   Z
target_oidr   Z
target_urir   N)rO   rP   rQ   r   r  r  r   r  r!   r  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZdddddZdS )SecurityLevelr  r  r  r  )r   rp   r   r   N)rO   rP   rQ   r   r8   r8   r8   r;   r    s   r  c               @   s(   e Zd ZdefdefdeddifgZdS )	FIPSLevelr  r  r  r[  FN)rO   rP   rQ   r   r  r   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd Zdeddifdeddifdeddd	fd
eddd	fdeddd	fdeddd	fde	ddd	fdedddfde
ddifg	ZdS )TPMSecurityAssertionsr  r[  r  Zfield_upgradableFZek_generation_typer   T)r   r   Zek_generation_locationr   Z"ek_certificate_generation_locationrp   Zcc_infor   Z
fips_levelr   Ziso_9000_certifiedr   )r   r[  Ziso_9000_urir   N)rO   rP   rQ   r  r   r  r  r  r  r  r   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )SetOfTPMSecurityAssertionsN)rO   rP   rQ   r  r   r8   r8   r8   r;   r    s   r  c               @   s&   e Zd Zddddddddd	d
d
ZdS )SubjectDirectoryAttributeIdsupported_algorithmstpm_specificationtcg_platform_specificationtpm_security_assertionspda_date_of_birthpda_place_of_birth
pda_genderpda_country_of_citizenshippda_country_of_residenceZentrust_user_role)
z2.5.4.52z2.23.133.2.16z2.23.133.2.17z2.23.133.2.18z1.3.6.1.5.5.7.9.1z1.3.6.1.5.5.7.9.2z1.3.6.1.5.5.7.9.3z1.3.6.1.5.5.7.9.4z1.3.6.1.5.5.7.9.5z1.2.840.113533.7.68.29N)rO   rP   rQ   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )SetOfGeneralizedTimeN)rO   rP   rQ   r   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )SetOfDirectoryStringN)rO   rP   rQ   r   r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )SetOfPrintableStringN)rO   rP   rQ   r%   r   r8   r8   r8   r;   r    s   r  c               @   s2   e Zd ZdefdedddfdedddfgZdS )	SupportedAlgorithmZalgorithm_identifierZintended_usager   T)r  r   Zintended_certificate_policiesr   N)rO   rP   rQ   r   r   r|  r   r8   r8   r8   r;   r    s   r  c               @   s   e Zd ZeZdS )SetOfSupportedAlgorithmN)rO   rP   rQ   r  r   r8   r8   r8   r;   r    s   r  c            
   @   sH   e Zd ZdefdefgZdZeee	e
eeeeed	Zdd ZdeiZdS )SubjectDirectoryAttributer   r   )r   r   )	r  r  r  r  r  r  r  r  r  c             C   s"   | d j }|| jkr| j| S tS )Nr   )rT   r   r)   )r9   Ztype_r8   r8   r;   _values_spec  s    


z&SubjectDirectoryAttribute._values_specN)rO   rP   rQ   r  r   r   r   r  r  r  r  r  r  r  r   r  Z_spec_callbacksr8   r8   r8   r;   r    s   
r  c               @   s   e Zd ZeZdS )SubjectDirectoryAttributesN)rO   rP   rQ   r  r   r8   r8   r8   r;   r    s   r  c               @   s@   e Zd Zddddddddd	d
ddddddddddddddZdS )ExtensionIdsubject_directory_attributesr^  	key_usageprivate_key_usage_periodsubject_alt_nameissuer_alt_namebasic_constraintsname_constraintscrl_distribution_pointscertificate_policiespolicy_mappingsauthority_key_identifierpolicy_constraintsextended_key_usagefreshest_crlinhibit_any_policyauthority_information_accesssubject_information_accesstls_featureocsp_no_checkentrust_version_extensionnetscape_certificate_type!signed_certificate_timestamp_list)z2.5.29.9z	2.5.29.14z	2.5.29.15z	2.5.29.16z	2.5.29.17z	2.5.29.18z	2.5.29.19z	2.5.29.30z	2.5.29.31z	2.5.29.32z	2.5.29.33z	2.5.29.35z	2.5.29.36z	2.5.29.37z	2.5.29.46z	2.5.29.54z1.3.6.1.5.5.7.1.1z1.3.6.1.5.5.7.1.11z1.3.6.1.5.5.7.1.24z1.3.6.1.5.5.7.48.1.5z1.2.840.113533.7.65.0z2.16.840.1.113730.1.1z1.3.6.1.4.1.11129.2.4.2N)rO   rP   rQ   r   r8   r8   r8   r;   r    s.   r  c               @   s`   e Zd ZdefdeddifdefgZdZee	e
eeeeeeeeeeeeeeeeeeee	dZdS )		Extensionextn_idcriticalr[  F
extn_value)r  r  )r  r^  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  N)rO   rP   rQ   r  r   r$   r   r   r  r#   r   r   rV  rY  rh  rn  r|  r~  r]  r  r  r   r  r  r  r   r  r  r   r8   r8   r8   r;   r  %  s6   
r  c               @   s   e Zd ZeZdS )
ExtensionsN)rO   rP   rQ   r  r   r8   r8   r8   r;   r  H  s   r  c               @   sl   e Zd Zdedddfdefdefdefdefd	efd
efde	dddfde	dddfde
dddfg
ZdS )TbsCertificater  r   r  )r  r[  r   	signatureissuervaliditysubjectsubject_public_key_infoZissuer_unique_idr   T)r   r   Zsubject_unique_idrp   
extensionsr   )r  r   N)rO   rP   rQ   r  r   r   r   rX  r0   r"   r  r   r8   r8   r8   r;   r  L  s   r  c               @   s  e Zd ZdefdefdefgZdZdZdZ	dZ
dZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dd Z'e(dd	 Z)e(d
d Z*e(dd Z+e(dd Z,e(dd Z-e(dd Z.e(dd Z/e(dd Z0e(dd Z1e(dd Z2e(dd Z3e(dd Z4e(d d! Z5e(d"d# Z6e(d$d% Z7e(d&d' Z8e(d(d) Z9e(d*d+ Z:e(d,d- Z;e(d.d/ Z<e(d0d1 Z=e(d2d3 Z>e(d4d5 Z?e(d6d7 Z@e(d8d9 ZAe(d:d; ZBe(d<d= ZCe(d>d? ZDe(d@dA ZEe(dBdC ZFe(dDdE ZGe(dFdG ZHe(dHdI ZIe(dJdK ZJe(dLdM ZKe(dNdO ZLdPdQ ZMe(dRdS ZNe(dTdU ZOe(dVdW ZPe(dXdY ZQe(dZd[ ZRe(d\d] ZSe(d^d_ ZTe(d`da ZUe(dbdc ZVe(ddde ZWe(dfdg ZXdhdi ZYdjdk ZZdldm Z[dS )nCertificatetbs_certificatesignature_algorithmsignature_valueFNc             C   sl   t  | _xX| d d D ]H}|d j}d| }t| |rHt| ||d j |d jr| j| qW d| _dS )	zv
        Sets common named extensions to private attributes and creates a list
        of critical extensions
        r  r  r  z	_%s_valuer  r  TN)rN   _critical_extensionsrT   hasattrsetattrZparsedadd_processed_extensions)r9   	extensionr   r   r8   r8   r;   _set_extensions  s    


zCertificate._set_extensionsc             C   s   | j s|   | jS )z
        Returns a set of the names (or OID if not a known extension) of the
        extensions marked as critical

        :return:
            A set of unicode strings
        )r  r  r  )r9   r8   r8   r;   critical_extensions  s    
zCertificate.critical_extensionsc             C   s   | j s|   | jS )z
        This extension is used to constrain the period over which the subject
        private key may be used

        :return:
            None or a PrivateKeyUsagePeriod object
        )r  r  _private_key_usage_period_value)r9   r8   r8   r;   private_key_usage_period_value  s    
z*Certificate.private_key_usage_period_valuec             C   s   | j s|   | jS )z
        This extension is used to contain additional identification attributes
        about the subject.

        :return:
            None or a SubjectDirectoryAttributes object
        )r  r  _subject_directory_attributes)r9   r8   r8   r;   "subject_directory_attributes_value  s    
z.Certificate.subject_directory_attributes_valuec             C   s   | j s|   | jS )z
        This extension is used to help in creating certificate validation paths.
        It contains an identifier that should generally, but is not guaranteed
        to, be unique.

        :return:
            None or an OctetString object
        )r  r  _key_identifier_value)r9   r8   r8   r;   key_identifier_value  s    z Certificate.key_identifier_valuec             C   s   | j s|   | jS )z
        This extension is used to define the purpose of the public key
        contained within the certificate.

        :return:
            None or a KeyUsage
        )r  r  _key_usage_value)r9   r8   r8   r;   key_usage_value  s    
zCertificate.key_usage_valuec             C   s   | j s|   | jS )aT  
        This extension allows for additional names to be associate with the
        subject of the certificate. While it may contain a whole host of
        possible names, it is usually used to allow certificates to be used
        with multiple different domain names.

        :return:
            None or a GeneralNames object
        )r  r  _subject_alt_name_value)r9   r8   r8   r;   subject_alt_name_value  s    z"Certificate.subject_alt_name_valuec             C   s   | j s|   | jS )z
        This extension allows associating one or more alternative names with
        the issuer of the certificate.

        :return:
            None or an x509.GeneralNames object
        )r  r  _issuer_alt_name_value)r9   r8   r8   r;   issuer_alt_name_value  s    
z!Certificate.issuer_alt_name_valuec             C   s   | j s|   | jS )a'  
        This extension is used to determine if the subject of the certificate
        is a CA, and if so, what the maximum number of intermediate CA certs
        after this are, before an end-entity certificate is found.

        :return:
            None or a BasicConstraints object
        )r  r  _basic_constraints_value)r9   r8   r8   r;   basic_constraints_value  s    z#Certificate.basic_constraints_valuec             C   s   | j s|   | jS )z
        This extension is used in CA certificates, and is used to limit the
        possible names of certificates issued.

        :return:
            None or a NameConstraints object
        )r  r  _name_constraints_value)r9   r8   r8   r;   name_constraints_value		  s    
z"Certificate.name_constraints_valuec             C   s   | j s|   | jS )z
        This extension is used to help in locating the CRL for this certificate.

        :return:
            None or a CRLDistributionPoints object
            extension
        )r  r  _crl_distribution_points_value)r9   r8   r8   r;   crl_distribution_points_value	  s    
z)Certificate.crl_distribution_points_valuec             C   s   | j s|   | jS )a;  
        This extension defines policies in CA certificates under which
        certificates may be issued. In end-entity certificates, the inclusion
        of a policy indicates the issuance of the certificate follows the
        policy.

        :return:
            None or a CertificatePolicies object
        )r  r  _certificate_policies_value)r9   r8   r8   r;   certificate_policies_value%	  s    z&Certificate.certificate_policies_valuec             C   s   | j s|   | jS )z
        This extension allows mapping policy OIDs to other OIDs. This is used
        to allow different policies to be treated as equivalent in the process
        of validation.

        :return:
            None or a PolicyMappings object
        )r  r  _policy_mappings_value)r9   r8   r8   r;   policy_mappings_value5	  s    z!Certificate.policy_mappings_valuec             C   s   | j s|   | jS )z
        This extension helps in identifying the public key with which to
        validate the authenticity of the certificate.

        :return:
            None or an AuthorityKeyIdentifier object
        )r  r  _authority_key_identifier_value)r9   r8   r8   r;   authority_key_identifier_valueD	  s    
z*Certificate.authority_key_identifier_valuec             C   s   | j s|   | jS )z
        This extension is used to control if policy mapping is allowed and
        when policies are required.

        :return:
            None or a PolicyConstraints object
        )r  r  _policy_constraints_value)r9   r8   r8   r;   policy_constraints_valueR	  s    
z$Certificate.policy_constraints_valuec             C   s   | j s|   | jS )z
        This extension is used to help locate any available delta CRLs

        :return:
            None or an CRLDistributionPoints object
        )r  r  _freshest_crl_value)r9   r8   r8   r;   freshest_crl_value`	  s    	zCertificate.freshest_crl_valuec             C   s   | j s|   | jS )z
        This extension is used to prevent mapping of the any policy to
        specific requirements

        :return:
            None or a Integer object
        )r  r  _inhibit_any_policy_value)r9   r8   r8   r;   inhibit_any_policy_valuem	  s    
z$Certificate.inhibit_any_policy_valuec             C   s   | j s|   | jS )z
        This extension is used to define additional purposes for the public key
        beyond what is contained in the basic constraints.

        :return:
            None or an ExtKeyUsageSyntax object
        )r  r  _extended_key_usage_value)r9   r8   r8   r;   extended_key_usage_value{	  s    
z$Certificate.extended_key_usage_valuec             C   s   | j s|   | jS )z
        This extension is used to locate the CA certificate used to sign this
        certificate, or the OCSP responder for this certificate.

        :return:
            None or an AuthorityInfoAccessSyntax object
        )r  r  #_authority_information_access_value)r9   r8   r8   r;   "authority_information_access_value	  s    
z.Certificate.authority_information_access_valuec             C   s   | j s|   | jS )z
        This extension is used to access information about the subject of this
        certificate.

        :return:
            None or a SubjectInfoAccessSyntax object
        )r  r  !_subject_information_access_value)r9   r8   r8   r;    subject_information_access_value	  s    
z,Certificate.subject_information_access_valuec             C   s   | j s|   | jS )z
        This extension is used to list the TLS features a server must respond
        with if a client initiates a request supporting them.

        :return:
            None or a Features object
        )r  r  _tls_feature_value)r9   r8   r8   r;   tls_feature_value	  s    
zCertificate.tls_feature_valuec             C   s   | j s|   | jS )a-  
        This extension is used on certificates of OCSP responders, indicating
        that revocation information for the certificate should never need to
        be verified, thus preventing possible loops in path validation.

        :return:
            None or a Null object (if present)
        )r  r  _ocsp_no_check_value)r9   r8   r8   r;   ocsp_no_check_value	  s    zCertificate.ocsp_no_check_valuec             C   s
   | d j S )zE
        :return:
            A byte string of the signature
        r  )rT   )r9   r8   r8   r;   r  	  s    zCertificate.signaturec             C   s
   | d j S )zj
        :return:
            A unicode string of "rsassa_pkcs1v15", "rsassa_pss", "dsa", "ecdsa"
        r  )signature_algo)r9   r8   r8   r;   r  	  s    zCertificate.signature_algoc             C   s
   | d j S )z
        :return:
            A unicode string of "md2", "md5", "sha1", "sha224", "sha256",
            "sha384", "sha512", "sha512_224", "sha512_256"
        r  )	hash_algo)r9   r8   r8   r;   r  	  s    zCertificate.hash_algoc             C   s   | d d S )zT
        :return:
            The PublicKeyInfo object for this certificate
        r  r  r8   )r9   r8   r8   r;   
public_key	  s    zCertificate.public_keyc             C   s   | d d S )zZ
        :return:
            The Name object for the subject of this certificate
        r  r  r8   )r9   r8   r8   r;   r  	  s    zCertificate.subjectc             C   s   | d d S )zY
        :return:
            The Name object for the issuer of this certificate
        r  r  r8   )r9   r8   r8   r;   r  	  s    zCertificate.issuerc             C   s   | d d j S )zT
        :return:
            An integer of the certificate's serial number
        r  r   )rT   )r9   r8   r8   r;   r   	  s    zCertificate.serial_numberc             C   s   | j s
dS | j jS )z
        :return:
            None or a byte string of the certificate's key identifier from the
            key identifier extension
        N)r  rT   )r9   r8   r8   r;   r^  
  s    zCertificate.key_identifierc             C   s.   | j dkr(| jjd t| jd | _ | j S )z
        :return:
            A byte string of the SHA-256 hash of the issuer concatenated with
            the ascii character ":", concatenated with the serial number as
            an ascii string
        N   :r\   )_issuer_serialr  r	  r   r   rF   )r9   r8   r8   r;   issuer_serial
  s    	
zCertificate.issuer_serialc             C   s   | d d d j S )zd
        :return:
            A datetime of latest time when the certificate is still valid
        r  r  r   )rT   )r9   r8   r8   r;   not_valid_after
  s    zCertificate.not_valid_afterc             C   s   | d d d j S )zd
        :return:
            A datetime of the earliest time when the certificate is valid
        r  r  r   )rT   )r9   r8   r8   r;   not_valid_before$
  s    zCertificate.not_valid_beforec             C   s   | j s
dS | j d jS )z
        :return:
            None or a byte string of the key_identifier from the authority key
            identifier extension
        Nr^  )r  rT   )r9   r8   r8   r;   r  ,
  s    z$Certificate.authority_key_identifierc             C   sj   | j dkrd| j}|r^|d jr^| jd d j}| }| jd j}|jd t|d | _ nd| _ | j S )a;  
        :return:
            None or a byte string of the SHA-256 hash of the isser from the
            authority key identifier extension concatenated with the ascii
            character ":", concatenated with the serial number from the
            authority key identifier extension as an ascii string
        Fr_  r   r`  r  r\   N)_authority_issuer_serialr  rT   r   Zuntagr	  r   rF   )r9   Zakivr  Zauthority_serialr8   r8   r;   authority_issuer_serial9
  s    

z#Certificate.authority_issuer_serialc             C   s   | j dkr| | j| _ | j S )z
        Returns complete CRL URLs - does not include delta CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_crl_distribution_points!_get_http_crl_distribution_pointsr  )r9   r8   r8   r;   r  O
  s    	
z#Certificate.crl_distribution_pointsc             C   s   | j dkr| | j| _ | j S )z
        Returns delta CRL URLs - does not include complete CRLs

        :return:
            A list of zero or more DistributionPoint objects
        N)_delta_crl_distribution_pointsr  r  )r9   r8   r8   r;   delta_crl_distribution_points\
  s    	
z)Certificate.delta_crl_distribution_pointsc             C   sd   g }|dkrg S xN|D ]F}|d }|t kr,q|jdkr8qx"|jD ]}|jdkr@|| q@W qW |S )a?  
        Fetches the DistributionPoint object for non-relative, HTTP CRLs
        referenced by the certificate

        :param crl_distribution_points:
            A CRLDistributionPoints object to grab the DistributionPoints from

        :return:
            A list of zero or more DistributionPoint objects
        Nrj  rc  rT  )r/   r   r   r   )r9   r  r   rj  Zdistribution_point_namerl  r8   r8   r;   r  i
  s    


z-Certificate._get_http_crl_distribution_pointsc             C   sb   | j s
g S g }xN| j D ]D}|d jdkr|d }|jdkr<q|j}| dr|| qW |S )zx
        :return:
            A list of zero or more unicode strings of the OCSP URLs for this
            cert
        r  r  r  rT  )zhttp://zhttps://zldap://zldaps://)r  rT   r   r?   rE   r   )r9   r   entrylocationrm  r8   r8   r;   	ocsp_urls
  s    
zCertificate.ocsp_urlsc             C   s   | j dkrg | _ | jrLx| jD ](}|jdkr|j| j kr| j |j qW nXtd}xL| jjD ]@}x:|D ]2}|d jdkrj|d j}|	|rj| j | qjW q`W | j S )z
        :return:
            A list of unicode strings of valid domain names for the certificate.
            Wildcard certificates will have a domain in the form: *.example.com
        NrQ  zE^(\*\.)?(?:[a-zA-Z0-9](?:[a-zA-Z0-9\-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$r   r   rL   )
_valid_domainsr  r   rT   r   r   compiler  r   match)r9   rl  patternr   Zname_type_valuerL   r8   r8   r;   valid_domains
  s    




zCertificate.valid_domainsc             C   sD   | j dkr>g | _ | jr>x&| jD ]}|jdkr| j |j qW | j S )zj
        :return:
            A list of unicode strings of valid IP addresses for the certificate
        NrU  )
_valid_ipsr  r   r   rT   )r9   rl  r8   r8   r;   	valid_ips
  s    

zCertificate.valid_ipsc             C   s   | j o| j d jS )zW
        :return;
            A boolean - if the certificate is marked as a CA
        rZ  )r  rT   )r9   r8   r8   r;   rZ  
  s    zCertificate.cac             C   s   | j s
dS | jd jS )zT
        :return;
            None or an integer of the maximum path length
        Nr\  )rZ  r  rT   )r9   r8   r8   r;   max_path_length
  s    zCertificate.max_path_lengthc             C   s   | j dkr| j| jk| _ | j S )zx
        :return:
            A boolean - if the certificate is self-issued, as defined by RFC
            5280
        N)_self_issuedr  r  )r9   r8   r8   r;   self_issued
  s    
zCertificate.self_issuedc             C   sJ   | j dkrDd| _ | jrD| jr>| js*d| _ qD| j| jkrDd| _ nd| _ | j S )a  
        :return:
            A unicode string of "no" or "maybe". The "maybe" result will
            be returned if the certificate issuer and subject are the same.
            If a key identifier and authority key identifier are present,
            they will need to match otherwise "no" will be returned.

            To verify is a certificate is truly self-signed, the signature
            will need to be verified. See the certvalidator package for
            one possible solution.
        NZnomaybe)_self_signedr,  r^  r  )r9   r8   r8   r;   self_signed
  s    
zCertificate.self_signedc             C   s$   | j dkrt|   | _ | j S )zk
        :return:
            The SHA-1 hash of the DER-encoded bytes of this complete certificate
        N)r  r  r  r  r  )r9   r8   r8   r;   r    s    
zCertificate.sha1c             C   s   d dd t| jD S )z
        :return:
            A unicode string of the SHA-1 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r   c             s   s   | ]}d | V  qdS )z%02XNr8   )r   cr8   r8   r;   r     s    z/Certificate.sha1_fingerprint.<locals>.<genexpr>)r   r   r  )r9   r8   r8   r;   sha1_fingerprint  s    zCertificate.sha1_fingerprintc             C   s$   | j dkrt|   | _ | j S )zy
        :return:
            The SHA-256 hash of the DER-encoded bytes of this complete
            certificate
        N)r  r  r	  r  r  )r9   r8   r8   r;   r	  !  s    
zCertificate.sha256c             C   s   d dd t| jD S )z
        :return:
            A unicode string of the SHA-256 hash, formatted using hex encoding
            with a space between each pair of characters, all uppercase
        r   c             s   s   | ]}d | V  qdS )z%02XNr8   )r   r0  r8   r8   r;   r   5  s    z1Certificate.sha256_fingerprint.<locals>.<genexpr>)r   r   r	  )r9   r8   r8   r;   sha256_fingerprint-  s    zCertificate.sha256_fingerprintc             C   sP  t |tsttdt||dd }|ddk}| oNt	
d|}| oZ| }|r| jsjdS |d}xh| jD ]^}|dd }|d}	t|	t|krq||	|krd	S | |}
|
r|| ||	r|d	S q|W dS | jsdS |rtjntj}t||}xD| jD ]:}|ddkr(tjntj}t||}||krd	S qW dS )
a  
        Check if a domain name or IP address is valid according to the
        certificate

        :param domain_ip:
            A unicode string of a domain name or IP address

        :return:
            A boolean - if the domain or IP is valid for the certificate
        zL
                domain_ip must be a unicode string, not %s
                r   r\   rk   r[   z^\d+\.\d+\.\d+\.\d+$FrA   T)r=   r   rD   r	   r   rF   rc   r?   r^   r   r%  r'  rs   rx   _is_wildcard_domain_is_wildcard_matchr)  ru   rw   rv   r4   )r9   Z	domain_ipZencoded_domain_ipZis_ipv6Zis_ipv4Z	is_domaindomain_labelsZvalid_domainZencoded_valid_domainvalid_domain_labelsZis_wildcardr}   Znormalized_ipZvalid_ipZvalid_familyZnormalized_valid_ipr8   r8   r;   is_valid_domain_ip7  sB    







zCertificate.is_valid_domain_ipc             C   sZ   | ddkrdS | d}|s(dS |d ddkr>dS |d dd dkrVdS d	S )
af  
        Checks if a domain is a valid wildcard according to
        https://tools.ietf.org/html/rfc6125#section-6.4.3

        :param domain:
            A unicode string of the domain name, where any U-labels from an IDN
            have been converted to A-labels

        :return:
            A boolean - if the domain is a valid wildcard domain
        *r   FrA   r   r[   r   zxn--T)countr?   rs   r^   )r9   Zdomainlabelsr8   r8   r;   r3  y  s    zCertificate._is_wildcard_domainc             C   sl   |d }|dd }|d }|dd }||kr4dS |dkr@dS t d|dd d	 }||rhdS dS )
a  
        Determines if the labels in a domain are a match for labels from a
        wildcard valid domain name

        :param domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in the domain name to check

        :param valid_domain_labels:
            A list of unicode strings, with A-label form for IDNs, of the labels
            in a wildcard domain pattern

        :return:
            A boolean - if the domain matches the valid domain
        r   r   NFr8  T^z.*$)r   r$  r   r%  )r9   r5  r6  Zfirst_domain_labelZother_domain_labelsZwildcard_labelZother_valid_domain_labelsZwildcard_regexr8   r8   r;   r4    s    
zCertificate._is_wildcard_match)\rO   rP   rQ   r  r   r"   r   r  r  r  r  r  r  r  r  r  r  r  r  r   r  r  r  r  r
  r  r  r  r  r  r  r  r  r#  r(  r+  r.  r  r  r  rd   r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r	  r  r  r  r  r  r  r  r  r  r  r   r^  r  r  r  r  r  r  r  r  r"  r'  r)  rZ  r*  r,  r/  r  r1  r	  r2  r7  r3  r4  r8   r8   r8   r;   r  [  s   
		
				#	

B!r  c               @   s   e Zd ZeZdS )KeyPurposeIdentifiersN)rO   rP   rQ   r  r   r8   r8   r8   r;   r=    s   r=  c               @   s   e Zd ZeZdS )SequenceOfAlgorithmIdentifiersN)rO   rP   rQ   r   r   r8   r8   r8   r;   r>    s   r>  c            	   @   sP   e Zd Zdeddifdedddfdeddifdeddifd	ed
ddfgZdS )CertificateAuxZtrustr   TZrejectr   )r   r   aliasZkeyidr:   r   N)rO   rP   rQ   r=  r-   r#   r>  r   r8   r8   r8   r;   r?    s
   r?  c               @   s   e Zd ZeegZdS )TrustedCertificateN)rO   rP   rQ   r  r?  Z_child_specsr8   r8   r8   r;   rA    s   rA  )r   Z
__future__r   r   r   r   
contextlibr   Z	encodingsr   r  r   ru   r   r   r   Z_errorsr	   Z_irir
   r   Z_ordereddictr   Z_typesr   r   r   Zalgosr   r   r   r   Zcorer   r   r   r   r   r   r   r   r   r   r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r   r0   utilr1   r2   r3   r4   r5   rS   rW   rf   r   r   r   r   r   r   r   r   r   r   r   r   r
  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r   r!  r"  r#  r$  r%  r&  r'  r(  rI  rL  rM  rN  rO  rV  rW  rX  rY  r]  ra  rd  re  rg  rh  ri  rn  ro  rp  rq  rr  rs  rv  ry  rz  r{  r|  r}  r~  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r=  r>  r?  rA  r8   r8   r8   r;   <module>   s  x59q 	  BU* D

			"2%	p			#      o
