U
    d                     @   s   d Z ddlZddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZmZ ddlmZ dd	lmZ d
ZG dd dZG dd dZG dd deZdS )zX.509 certificates.    N)default_backend)padding)load_pem_x509_certificate)bytes_to_strensure_bytes)SecurityError   )reraise_errors)Certificate	CertStoreFSCertStorec                   @   sH   e Zd ZdZdd Zdd Zdd Zdd	 Zd
d Zdd Z	dd Z
dS )r
   zX.509 certificate.c              	   C   s2   t dtfd tt|t d| _W 5 Q R X d S )NzInvalid certificate: {0!r})errors)backend)r	   
ValueErrorr   r   r   _cert)selfcert r   ?/tmp/pip-unpacked-wheel-mu1yl971/celery/security/certificate.py__init__   s      zCertificate.__init__c                 C   s   t j  | jjkS )z%Check if the certificate has expired.)datetimeutcnowr   Znot_valid_afterr   r   r   r   has_expired   s    zCertificate.has_expiredc                 C   s
   | j  S )z Get public key from certificate.)r   Z
public_keyr   r   r   r   
get_pubkey    s    zCertificate.get_pubkeyc                 C   s   | j jS )z,Return the serial number in the certificate.)r   Zserial_numberr   r   r   r   get_serial_number$   s    zCertificate.get_serial_numberc                 C   s   d dd | jjD S )zReturn issuer (CA) as a string. c                 s   s   | ]}|j V  qd S N)value).0xr   r   r   	<genexpr>*   s     z)Certificate.get_issuer.<locals>.<genexpr>)joinr   Zissuerr   r   r   r   
get_issuer(   s    zCertificate.get_issuerc                 C   s   |    d|   S )z<Serial number/issuer pair uniquely identifies a certificate.r   )r#   r   r   r   r   r   get_id,   s    zCertificate.get_idc              	   C   sH   t d6 tjt|tjjd}|  |t||| W 5 Q R X dS )z,Verify signature for string containing data.zBad signature: {0!r})ZmgfZsalt_lengthN)r	   r   ZPSSZMGF1Z
MAX_LENGTHr   verifyr   )r   data	signaturedigestZpaddr   r   r   r%   0   s    

  zCertificate.verifyN)__name__
__module____qualname____doc__r   r   r   r   r#   r$   r%   r   r   r   r   r
      s   r
   c                   @   s0   e Zd ZdZdd Zdd Zdd Zdd	 Zd
S )r   z"Base class for certificate stores.c                 C   s
   i | _ d S r   )_certsr   r   r   r   r   ?   s    zCertStore.__init__c                 c   s   | j  E dH  dS )zReturn certificate iterator.N)r-   valuesr   r   r   r   	itercertsB   s    zCertStore.itercertsc                 C   s8   z| j t| W S  tk
r2   td|Y nX dS )zGet certificate by id.zUnknown certificate: N)r-   r   KeyErrorr   )r   idr   r   r   __getitem__F   s    zCertStore.__getitem__c                 C   s2   t | }|| jkr$tdt|| j|< d S )NzDuplicate certificate: )r   r$   r-   r   r1   )r   r   Zcert_idr   r   r   add_certM   s    
zCertStore.add_certN)r)   r*   r+   r,   r   r/   r2   r3   r   r   r   r   r   <   s
   r   c                       s    e Zd ZdZ fddZ  ZS )r   zFile system certificate store.c              
      s|   t    tj|r$tj|d}t|D ]H}t|6}t|	 }|
 rbtd| | | W 5 Q R X q.d S )N*zExpired certificate: )superr   ospathisdirr"   globopenr
   readr   r   r$   r3   )r   r7   pfr   	__class__r   r   r   W   s    

zFSCertStore.__init__)r)   r*   r+   r,   r   __classcell__r   r   r>   r   r   T   s   r   )r,   r   r9   r6   Zcryptography.hazmat.backendsr   Z)cryptography.hazmat.primitives.asymmetricr   Zcryptography.x509r   Zkombu.utils.encodingr   r   Zcelery.exceptionsr   utilsr	   __all__r
   r   r   r   r   r   r   <module>   s   *