U
    bh                     @  s  d Z ddlmZ ddlZddlZddlZddlmZmZ ddl	m
Z
 ddlmZmZ ddlmZ ddlmZmZ dd	lmZ d
dlmZ erddlmZ ddlmZ ddlmZ ddlmZ ddlm Z  ddl!m"Z" ddl#m$Z$ dZ%G dd dZ&G dd dZ'G dd de'Z(dS )zX.509 certificates.    )annotationsN)TYPE_CHECKINGIterator)default_backend)paddingrsa)load_pem_x509_certificate)bytes_to_strensure_bytes)SecurityError   )reraise_errors)DSAPublicKey)EllipticCurvePublicKey)Ed448PublicKey)Ed25519PublicKey)RSAPublicKey)	Prehashed)HashAlgorithm)Certificate	CertStoreFSCertStorec                   @  sz   e Zd ZdZdddddZddd	d
ZddddZddddZddddZddddZ	dddddddZ
dS )r   zX.509 certificate.strNonecertreturnc              	   C  sL   t dtfd4 tt|t d| _t| j tj	s>tdW 5 Q R X d S )NzInvalid certificate: {0!r})errors)backendz'Non-RSA certificates are not supported.)
r   
ValueErrorr   r
   r   _cert
isinstance
public_keyr   r   )selfr    r$   ?/tmp/pip-unpacked-wheel-kcem4wq5/celery/security/certificate.py__init__"   s      zCertificate.__init__boolr   c                 C  s   t j t jj| jjkS )z%Check if the certificate has expired.)datetimenowtimezoneutcr    Znot_valid_after_utcr#   r$   r$   r%   has_expired,   s    zCertificate.has_expiredzXDSAPublicKey | EllipticCurvePublicKey | Ed448PublicKey | Ed25519PublicKey | RSAPublicKeyc                 C  s
   | j  S N)r    r"   r-   r$   r$   r%   
get_pubkey0   s    zCertificate.get_pubkeyintc                 C  s   | j jS )z,Return the serial number in the certificate.)r    Zserial_numberr-   r$   r$   r%   get_serial_number5   s    zCertificate.get_serial_numberc                 C  s   d dd | jjD S )zReturn issuer (CA) as a string. c                 s  s   | ]}|j V  qd S r/   )value).0xr$   r$   r%   	<genexpr>;   s     z)Certificate.get_issuer.<locals>.<genexpr>)joinr    Zissuerr-   r$   r$   r%   
get_issuer9   s    zCertificate.get_issuerc                 C  s   |    d|   S )z<Serial number/issuer pair uniquely identifies a certificate.r3   )r9   r2   r-   r$   r$   r%   get_id=   s    zCertificate.get_idbyteszHashAlgorithm | Prehashed)data	signaturedigestr   c              	   C  sH   t d6 tjt|tjjd}|  |t||| W 5 Q R X dS )z,Verify signature for string containing data.zBad signature: {0!r})ZmgfZsalt_lengthN)r   r   ZPSSZMGF1Z
MAX_LENGTHr0   verifyr
   )r#   r<   r=   r>   padr$   r$   r%   r?   A   s    
zCertificate.verifyN)__name__
__module____qualname____doc__r&   r.   r0   r2   r9   r:   r?   r$   r$   r$   r%   r      s   
r   c                   @  sL   e Zd ZdZddddZddddZd	d
dddZd
ddddZdS )r   z"Base class for certificate stores.r   r(   c                 C  s
   i | _ d S r/   )_certsr-   r$   r$   r%   r&   O   s    zCertStore.__init__zIterator[Certificate]c                 c  s   | j  E dH  dS )zReturn certificate iterator.N)rE   valuesr-   r$   r$   r%   	itercertsR   s    zCertStore.itercertsr   r   )idr   c                 C  s8   z| j t| W S  tk
r2   td|Y nX dS )zGet certificate by id.zUnknown certificate: N)rE   r	   KeyErrorr   )r#   rH   r$   r$   r%   __getitem__V   s    zCertStore.__getitem__r   c                 C  s2   t | }|| jkr$tdt|| j|< d S )NzDuplicate certificate: )r	   r:   rE   r   rH   )r#   r   Zcert_idr$   r$   r%   add_cert]   s    
zCertStore.add_certN)rA   rB   rC   rD   r&   rG   rJ   rK   r$   r$   r$   r%   r   L   s
   r   c                      s(   e Zd ZdZddd fddZ  ZS )r   zFile system certificate store.r   r   )pathr   c              
     s|   t    tj|r$tj|d}t|D ]H}t|6}t|	 }|
 rbtd| | | W 5 Q R X q.d S )N*zExpired certificate: )superr&   osrL   isdirr8   globopenr   readr.   r   r:   rK   )r#   rL   pfr   	__class__r$   r%   r&   g   s    

zFSCertStore.__init__)rA   rB   rC   rD   r&   __classcell__r$   r$   rV   r%   r   d   s   r   ))rD   
__future__r   r)   rQ   rO   typingr   r   Zcryptography.hazmat.backendsr   Z)cryptography.hazmat.primitives.asymmetricr   r   Zcryptography.x509r   Zkombu.utils.encodingr	   r
   Zcelery.exceptionsr   utilsr   Z-cryptography.hazmat.primitives.asymmetric.dsar   Z,cryptography.hazmat.primitives.asymmetric.ecr   Z/cryptography.hazmat.primitives.asymmetric.ed448r   Z1cryptography.hazmat.primitives.asymmetric.ed25519r   Z-cryptography.hazmat.primitives.asymmetric.rsar   Z/cryptography.hazmat.primitives.asymmetric.utilsr   Z%cryptography.hazmat.primitives.hashesr   __all__r   r   r   r$   r$   r$   r%   <module>   s.   -