a oe:@sUddlmZddlZddlZddlZddlZddlZddlmZddl m Z ddl m Z mZGdddejZdd eDZe jeje jeje jeje jeje jeje jejiZd ed <ejeefZejeefZe j d e j!d e j"de j#de j$de jde j%de jde j&di Z'ded<dd e'(DZ)dddddZ*dddddZ+Gdd d Z,Gd!d"d"Z-Gd#d$d$Z.Gd%d&d&Z/dS)') annotationsN)utils)x509)NameOIDObjectIdentifierc@s<eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zd S) _ASN1Type N)__name__ __module__ __qualname__ BitStringZ OctetString UTF8StringZ NumericStringPrintableStringZ T61String IA5StringZUTCTimeZGeneralizedTimeZ VisibleStringZUniversalStringZ BMPStringrr7C:\Program Files\Certbot\pkgs\cryptography\x509\name.pyrsrcCsi|] }|j|qSr)value.0irrr !r!z(typing.Dict[ObjectIdentifier, _ASN1Type]_NAMEOID_DEFAULT_TYPEZCNLZSTOZOUCZSTREETZDCZUID _OidNameMap_NAMEOID_TO_NAMEcCsi|]\}}||qSrr)rkvrrrr!<r"typing.Union[str, bytes]str)valreturncCs|sdSt|tr&dt|dS|dd}|dd}|dd }|d d }|d d }|dd}|dd}|dd}|ddvrd|}|ddkr|ddd}|S)z>Escape special characters in RFC4514 Distinguished Name value.#utf8\z\\"z\"+z\+,z\,;z\;z\>z\00r)r0 r:Nz\ ) isinstancebytesbinasciiZhexlifydecodereplace)r-rrr_escape_dn_value?s"           rAcCs|sdSdd}tj||S)Nr/cSs(|d}t|dkr|Stt|dS)N)grouplenchrint)mr-rrrsubds  z_unescape_dn_value..sub)_RFC4514NameParser_PAIR_RErI)r-rIrrr_unescape_dn_value\srLc@seZdZd!dddddddd d d Zedd d dZedd ddZedd ddZd"dddddZdddddZ dd ddZ dd dd Z dS)# NameAttributeNT) _validaterr+ztyping.Optional[_ASN1Type]boolNone)oidr_typerNr.cCst|tstd|tjkrB|tjkr.tdt|tsTtdnt|tsTtd|tj ksh|tj krt|tsvJt | d}|dkr|durt dn|dkrtjd |dd |durt|tj}t|tstd ||_||_||_dS) Nz2oid argument must be an ObjectIdentifier instance.z6oid must be X500_UNIQUE_IDENTIFIER for BitString type.z!value must be bytes for BitStringzvalue argument must be a strr1Tz/Country name must be a 2 character country codezUCountry names should be two characters, but the attribute is {} characters in length.) stacklevelz%_type must be from the _ASN1Type enum)r<r TypeErrorrrrZX500_UNIQUE_IDENTIFIERr=r, COUNTRY_NAMEJURISDICTION_COUNTRY_NAMErEencode ValueErrorwarningswarnformatr#getr_oid_valuerR)selfrQrrRrNZc_lenrrr__init__psJ        zNameAttribute.__init__r.cCs|jSN)r^r`rrrrQszNameAttribute.oidcCs|jSrc)r_rdrrrrszNameAttribute.valuer,cCst|j|jjS)zt The short attribute name (for example "CN") if available, otherwise the OID dotted string. )r(r]rQZ dotted_stringrdrrrrfc4514_attribute_namesz$NameAttribute.rfc4514_attribute_nametyping.Optional[_OidNameMap]attr_name_overridesr.cCs6|r||jnd}|dur"|j}|dt|jS)z Format as RFC4514 Distinguished Name string. Use short attribute name if available, otherwise fall back to OID dotted string. N=)r]rQrerAr)r`rhZ attr_namerrrrfc4514_strings zNameAttribute.rfc4514_stringobjectotherr.cCs&t|tstS|j|jko$|j|jkSrc)r<rMNotImplementedrQrr`rmrrr__eq__s zNameAttribute.__eq__rGcCst|j|jfSrc)hashrQrrdrrr__hash__szNameAttribute.__hash__cCs d|S)Nz/)r\rdrrr__repr__szNameAttribute.__repr__)N)N) rrrrapropertyrQrrerjrprrrsrrrrrMos8rMc@seZdZddddZddddd Zd d d d ddZdddddZddddZddddZddddZ d dddZ d S)!RelativeDistinguishedNametyping.Iterable[NameAttribute]) attributescCs\t|}|stdtdd|Ds.td||_t||_t|jt|krXtddS)Nz-a relative distinguished name cannot be emptycss|]}t|tVqdSrcr<rMrxrrr r"z5RelativeDistinguishedName.__init__..z/attributes must be an iterable of NameAttributez$duplicate attributes are not allowed)listrYallrU _attributes frozenset_attribute_setrEr`rwrrrras z"RelativeDistinguishedName.__init__rtyping.List[NameAttribute]rQr.csfdd|DS)Ncsg|]}|jkr|qSrrQrrrr r"zDRelativeDistinguishedName.get_attributes_for_oid..rr`rQrrrget_attributes_for_oidsz0RelativeDistinguishedName.get_attributes_for_oidNrfr,rgcsdfdd|jDS)z Format as RFC4514 Distinguished Name string. Within each RDN, attributes are joined by '+', although that is rarely used in certificates. r4c3s|]}|VqdSrcrjrattrrhrrr{sz;RelativeDistinguishedName.rfc4514_string..joinr~r`rhrrrrjs z(RelativeDistinguishedName.rfc4514_stringrkrOrlcCst|tstS|j|jkSrc)r<rurnrrorrrrps z RelativeDistinguishedName.__eq__rGrbcCs t|jSrc)rqrrdrrrrrsz"RelativeDistinguishedName.__hash__typing.Iterator[NameAttribute]cCs t|jSrc)iterr~rdrrr__iter__sz"RelativeDistinguishedName.__iter__cCs t|jSrc)rEr~rdrrr__len__sz!RelativeDistinguishedName.__len__cCsd|dS)Nzrrdrrrrssz"RelativeDistinguishedName.__repr__)N) rrrrarrjrprrrrrsrrrrrusruc@seZdZejdddddZejdddddZdddd dZed1d d dd ddZd2dd dddZdddddZ e ddddZ d3dddd d!Z d"d#d$d%d&Z d'dd(d)Zd*dd+d,Zd'dd-d.Zd dd/d0Zd S)4NamervrP)rwr.cCsdSrcrrrrrra sz Name.__init__z*typing.Iterable[RelativeDistinguishedName]cCsdSrcrrrrrraszGtyping.Iterable[typing.Union[NameAttribute, RelativeDistinguishedName]]cCs`t|}tdd|Dr,dd|D|_n0tdd|DrTttjt||_ntddS)Ncss|]}t|tVqdSrcrxryrrrr{r"z Name.__init__..cSsg|]}ttt|gqSr)rutypingcastrMryrrrrsz!Name.__init__..css|]}t|tVqdSrc)r<ruryrrrr{"r"zNattributes must be a list of NameAttribute or a list RelativeDistinguishedName)r|r}r~rrListrurUrrrrras  Nr,ztyping.Optional[_NameOidMap]datarhr.cCst||p iSrc)rJparse)clsrrhrrrfrom_rfc4514_string,szName.from_rfc4514_stringrfrgcsdfddt|jDS)a Format as RFC4514 Distinguished Name string. For example 'CN=foobar.com,O=Foo Corp,C=US' An X.509 name is a two-level structure: a list of sets of attributes. Each list element is separated by ',' and within each list element, set elements are separated by '+'. The latter is almost never used in real world certificates. According to RFC4514 section 2.1 the RDNSequence must be reversed when converting to string representation. r5c3s|]}|VqdSrcrrrrrr{Asz&Name.rfc4514_string..)rreversedr~rrrrrj4s zName.rfc4514_stringrrrcsfdd|DS)Ncsg|]}|jkr|qSrrrrrrrIr"z/Name.get_attributes_for_oid..rrrrrrFszName.get_attributes_for_oidz&typing.List[RelativeDistinguishedName]rbcCs|jSrcr~rdrrrrdnsKsz Name.rdnsz typing.Anyr=)backendr.cCs t|Src) rust_x509Zencode_name_bytes)r`rrrr public_bytesOszName.public_bytesrkrOrlcCst|tstS|j|jkSrc)r<rrnr~rorrrrpRs z Name.__eq__rGcCstt|jSrc)rqtupler~rdrrrrrXsz Name.__hash__rccs |jD]}|D] }|VqqdSrcr)r`rdnZavarrrr]s z Name.__iter__cCstdd|jDS)Ncss|]}t|VqdSrc)rE)rrrrrr{cr"zName.__len__..)sumr~rdrrrrbsz Name.__len__cCs"ddd|jD}d|dS)Nr5css|]}|VqdSrcrrrrrr{fr"z Name.__repr__..z]|[\da-zA-Z]{2})z7[\x01-\x1f\x21\x24-\x2A\x2D-\x3A\x3D\x3F-\x5B\x5D-\x7F]z3[\x01-\x21\x23-\x2A\x2D-\x3A\x3D\x3F-\x5B\x5D-\x7F]z7[\x01-\x1F\x21\x23-\x2A\x2D-\x3A\x3D\x3F-\x5B\x5D-\x7F]z[\x80-]|z ( (z!) ( (z)* (z$) )? )? z#([\da-zA-Z]{2})+r, _NameOidMaprPrcCs||_d|_||_dS)Nr)_data_idx_attr_name_overrides)r`rrhrrrrasz_RFC4514NameParser.__init__rOrbcCs|jt|jkSrc)rrErrdrrr _has_datasz_RFC4514NameParser._has_dataztyping.Optional[str]cCs|r|j|jSdSrc)rrrrdrrr_peeks z_RFC4514NameParser._peek)chr.cCs"||krt|jd7_dS)NrB)rrYr)r`rrrr _read_chars z_RFC4514NameParser._read_charcCs<|j|j|jd}|durt|}|jt|7_|S)N)pos)matchrrrYrDrE)r`patrr-rrr_read_res z_RFC4514NameParser._read_rercCs8|g}|r,|d||q tt|S)a' Parses the `data` string and converts it to a Name. According to RFC4514 section 2.1 the RDNSequence must be reversed when converting to string representation. So, when we parse it, we need to reverse again to get the RDNs on the correct order. r5) _parse_rdnrrappendrrrrrrrs  z_RFC4514NameParser.parserucCs8|g}|dkr0|d||q t|S)Nr4) _parse_narrrru)r`Znasrrrrs    z_RFC4514NameParser._parse_rdnrMc Csz||j}Wn>tyN||j}|j|t|}|durJtYn 0t|}|d| dkr||j }t |dd }n||j}t|}t||S)Nrir0rB)r_OID_RErY _DESCR_RErr]_NAME_TO_NAMEOIDrrr _HEXSTRING_REr>Z unhexlifyr? _STRING_RErLrM)r`Z oid_valuenamerQrZ raw_valuerrrrs"        z_RFC4514NameParser._parse_naN)rrrrecompilerrZ_PAIRrKZ_LUTF1Z_SUTF1Z_TUTF1rFsys maxunicodeZ_UTFMBZ _LEADCHARZ _STRINGCHARZ _TRAILCHARVERBOSErrrarrrrrrrrrrrrJjsH     rJ)0Z __future__rr>rrrrZZ cryptographyrZ"cryptography.hazmat.bindings._rustrrZcryptography.x509.oidrrEnumrZ_ASN1_TYPE_TO_ENUMrVrrWZ SERIAL_NUMBERZ DN_QUALIFIERZ EMAIL_ADDRESSrZDOMAIN_COMPONENTr#__annotations__Mappingr,r'rZ COMMON_NAMEZ LOCALITY_NAMEZSTATE_OR_PROVINCE_NAMEZORGANIZATION_NAMEZORGANIZATIONAL_UNIT_NAMEZSTREET_ADDRESSZUSER_IDr(itemsrrArLrMrurrJrrrrsH    g5_