U
    .e                     @  s  d Z ddlmZ ddlZddlZddlZddlmZmZ ddl	m
Z
 ddlmZmZ ddlmZ ddlmZmZ dd	lmZ d
dlmZ erddlmZ ddlmZ ddlmZ ddlmZ ddlm Z  ddl!m"Z" ddl#m$Z$ dZ%G dd dZ&G dd dZ'G dd de'Z(dS )zX.509 certificates.    )annotationsN)TYPE_CHECKINGIterator)default_backend)paddingrsa)load_pem_x509_certificate)bytes_to_strensure_bytes)SecurityError   )reraise_errors)DSAPublicKey)EllipticCurvePublicKey)Ed448PublicKey)Ed25519PublicKey)RSAPublicKey)	Prehashed)HashAlgorithm)Certificate	CertStoreFSCertStorec                   @  sz   e Zd ZdZdddddZddd	d
ZddddZddddZddddZddddZ	dddddddZ
dS )r   zX.509 certificate.strNonecertreturnc              	   C  sL   t dtfd4 tt|t d| _t| j tj	s>tdW 5 Q R X d S )NzInvalid certificate: {0!r})errors)backendz'Non-RSA certificates are not supported.)
r   
ValueErrorr   r
   r   _cert
isinstance
public_keyr   r   )selfr    r$   ?/tmp/pip-unpacked-wheel-f4liivr4/celery/security/certificate.py__init__"   s      zCertificate.__init__boolr   c                 C  s   t j  | jjkS )z%Check if the certificate has expired.)datetimeutcnowr    Znot_valid_afterr#   r$   r$   r%   has_expired,   s    zCertificate.has_expiredzXDSAPublicKey | EllipticCurvePublicKey | Ed448PublicKey | Ed25519PublicKey | RSAPublicKeyc                 C  s
   | j  S N)r    r"   r+   r$   r$   r%   
get_pubkey0   s    zCertificate.get_pubkeyintc                 C  s   | j jS )z,Return the serial number in the certificate.)r    Zserial_numberr+   r$   r$   r%   get_serial_number5   s    zCertificate.get_serial_numberc                 C  s   d dd | jjD S )zReturn issuer (CA) as a string. c                 s  s   | ]}|j V  qd S r-   )value).0xr$   r$   r%   	<genexpr>;   s     z)Certificate.get_issuer.<locals>.<genexpr>)joinr    Zissuerr+   r$   r$   r%   
get_issuer9   s    zCertificate.get_issuerc                 C  s   |    d|   S )z<Serial number/issuer pair uniquely identifies a certificate.r1   )r7   r0   r+   r$   r$   r%   get_id=   s    zCertificate.get_idbyteszHashAlgorithm | Prehashed)data	signaturedigestr   c              	   C  sH   t d6 tjt|tjjd}|  |t||| W 5 Q R X dS )z,Verify signature for string containing data.zBad signature: {0!r})ZmgfZsalt_lengthN)r   r   ZPSSZMGF1Z
MAX_LENGTHr.   verifyr
   )r#   r:   r;   r<   padr$   r$   r%   r=   A   s    
zCertificate.verifyN)__name__
__module____qualname____doc__r&   r,   r.   r0   r7   r8   r=   r$   r$   r$   r%   r      s   
r   c                   @  sL   e Zd ZdZddddZddddZd	d
dddZd
ddddZdS )r   z"Base class for certificate stores.r   r(   c                 C  s
   i | _ d S r-   )_certsr+   r$   r$   r%   r&   O   s    zCertStore.__init__zIterator[Certificate]c                 c  s   | j  E dH  dS )zReturn certificate iterator.N)rC   valuesr+   r$   r$   r%   	itercertsR   s    zCertStore.itercertsr   r   )idr   c                 C  s8   z| j t| W S  tk
r2   td|Y nX dS )zGet certificate by id.zUnknown certificate: N)rC   r	   KeyErrorr   )r#   rF   r$   r$   r%   __getitem__V   s    zCertStore.__getitem__r   c                 C  s2   t | }|| jkr$tdt|| j|< d S )NzDuplicate certificate: )r	   r8   rC   r   rF   )r#   r   Zcert_idr$   r$   r%   add_cert]   s    
zCertStore.add_certN)r?   r@   rA   rB   r&   rE   rH   rI   r$   r$   r$   r%   r   L   s
   r   c                      s(   e Zd ZdZddd fddZ  ZS )r   zFile system certificate store.r   r   )pathr   c              
     s|   t    tj|r$tj|d}t|D ]H}t|6}t|	 }|
 rbtd| | | W 5 Q R X q.d S )N*zExpired certificate: )superr&   osrJ   isdirr6   globopenr   readr,   r   r8   rI   )r#   rJ   pfr   	__class__r$   r%   r&   g   s    

zFSCertStore.__init__)r?   r@   rA   rB   r&   __classcell__r$   r$   rT   r%   r   d   s   r   ))rB   
__future__r   r)   rO   rM   typingr   r   Zcryptography.hazmat.backendsr   Z)cryptography.hazmat.primitives.asymmetricr   r   Zcryptography.x509r   Zkombu.utils.encodingr	   r
   Zcelery.exceptionsr   utilsr   Z-cryptography.hazmat.primitives.asymmetric.dsar   Z,cryptography.hazmat.primitives.asymmetric.ecr   Z/cryptography.hazmat.primitives.asymmetric.ed448r   Z1cryptography.hazmat.primitives.asymmetric.ed25519r   Z-cryptography.hazmat.primitives.asymmetric.rsar   Z/cryptography.hazmat.primitives.asymmetric.utilsr   Z%cryptography.hazmat.primitives.hashesr   __all__r   r   r   r$   r$   r$   r%   <module>   s.   -