a
    ze$                     @   s  d Z ddlZddlZddlZddlZddlT dZdZdZej	
ej	eZd8ddZdZdd Zdd Zdd Zedkree eddd\ZZeddZee W d   n1 s0    Y  eddZee W d   n1 s0    Y  ed eg d eg d edd$Zee ee W d   n1 sT0    Y  edd Zee W d   n1 s0    Y  e  ed!dd\ZZed"d$Zee ee W d   n1 s0    Y  edd#d$\ZZed%d$Zee ee W d   n1 s00    Y  ed!d#d$\ZZed&d$Zee ee W d   n1 s0    Y  ed'd#d(d)\ZZed*d$Zee ee W d   n1 s0    Y  g d+Zed,d#d-ed.\ZZed/d$Zee ee W d   n1 s20    Y  g d0Zed1d#d-ed.\ZZed2d$Zee ee W d   n1 s0    Y  ed3d#d4d5\ZZed6d$Zee ee W d   n1 s0    Y  e  ed7 ed ed% dS )9zOMake the custom certificate and private key files used by test_ssl
and friends.    N)*Z20180829142316ZZ20371028142316Za
  
    [ default ]
    base_url               = http://testca.pythontest.net/testca

    [req]
    distinguished_name     = req_distinguished_name
    prompt                 = no

    [req_distinguished_name]
    C                      = XY
    L                      = Castle Anthrax
    O                      = Python Software Foundation
    CN                     = {hostname}

    [req_x509_extensions_nosan]

    [req_x509_extensions_simple]
    subjectAltName         = @san

    [req_x509_extensions_full]
    subjectAltName         = @san
    keyUsage               = critical,keyEncipherment,digitalSignature
    extendedKeyUsage       = serverAuth,clientAuth
    basicConstraints       = critical,CA:false
    subjectKeyIdentifier   = hash
    authorityKeyIdentifier = keyid:always,issuer:always
    authorityInfoAccess    = @issuer_ocsp_info
    crlDistributionPoints  = @crl_info

    [ issuer_ocsp_info ]
    caIssuers;URI.0        = $base_url/pycacert.cer
    OCSP;URI.0             = $base_url/ocsp/

    [ crl_info ]
    URI.0                  = $base_url/revocation.crl

    [san]
    DNS.1 = {hostname}
    {extra_san}

    [dir_sect]
    C                      = XY
    L                      = Castle Anthrax
    O                      = Python Software Foundation
    CN                     = dirname example

    [princ_name]
    realm = EXP:0, GeneralString:KERBEROS.REALM
    principal_name = EXP:1, SEQUENCE:principal_seq

    [principal_seq]
    name_type = EXP:0, INTEGER:1
    name_string = EXP:1, SEQUENCE:principals

    [principals]
    princ1 = GeneralString:username

    [ ca ]
    default_ca      = CA_default

    [ CA_default ]
    dir = cadir
    database  = $dir/index.txt
    crlnumber = $dir/crl.txt
    default_md = sha256
    startdate = {startdate}
    default_startdate = {startdate}
    enddate = {enddate}
    default_enddate = {enddate}
    default_days = 7000
    default_crl_days = 7000
    certificate = pycacert.pem
    private_key = pycakey.pem
    serial    = $dir/serial
    RANDFILE  = $dir/.rand
    policy          = policy_match

    [ policy_match ]
    countryName             = match
    stateOrProvinceName     = optional
    organizationName        = match
    organizationalUnitName  = optional
    commonName              = supplied
    emailAddress            = optional

    [ policy_anything ]
    countryName   = optional
    stateOrProvinceName = optional
    localityName    = optional
    organizationName  = optional
    organizationalUnitName  = optional
    commonName    = supplied
    emailAddress    = optional


    [ v3_ca ]

    subjectKeyIdentifier=hash
    authorityKeyIdentifier=keyid:always,issuer
    basicConstraints = CA:true

    F req_x509_extensions_fullrsa:3072c                 C   s$  t d|   g }tdD ]<}tjdd}||j W d    q1 sJ0    Y  q|\}}	}
ztj| |tt	d}t
|d}|| W d    n1 s0    Y  ddd	d
dd|d|
d|d|g}|rtjdd"}||j |j}W d    n1 s0    Y  |d|g7 }n|dd|	g7 }tdg|  |rldd|d|d|	dddddd|g}tdg|  t
|	d}| }W d    n1 s0    Y  t
|
d}| }W d    n1 s0    Y  ||fW |D ]}t| qS ]}t| qn|D ]}t| q0 d S )Nzcreating cert for    F)deletehostname	extra_san	startdateenddatewreq-new-nodesz-daysZ7000-newkey-keyout-extensions-config-outz-x509opensslca-outdircadirz-policyZpolicy_anything-batch-infilesr)printrangetempfileNamedTemporaryFileappendnamereq_templateformatr   r   openwrite
check_callreadosremove)r	   signr
   extkeyZ	tempnamesifZreq_fileZ	cert_fileZkey_filer   argsZreqfilecertr"    r2   )/usr/lib/python3.9/test/make_ssl_certs.pymake_cert_keyw   sb    ,
(
&	((r4   r   c                   C   s   t t d S )N)shutilrmtree	TMP_CADIRr2   r2   r2   r3   	unmake_ca   s    r8   c                  C   s  t t tt jddd} W d    n1 s40    Y  tt jddd} | d W d    n1 sr0    Y  tt jddd} | d W d    n1 s0    Y  tt jdd	d
} | d W d    n1 s0    Y  td
}t	j
ddttd}|| |  t } dd|jddddddd| jddg}tdg|  dd|jddddtddd d!d"d#| jg}tdg|  dd|jd$dd%g}tdg|  W d    n1 s0    Y  W d    n1 s0    Y  tg d& td'd( d S ))Nr   z	index.txta+zcrl.txtZ00zindex.txt.attrzw+zunique_subject = noserialr   zCB2D80995A69525B
zour-ca-serverr   r   r   r   r   r   r   r   r   zpycakey.pemr   z-subjzG/C=XY/L=Castle Anthrax/O=Python Software Foundation CA/CN=our-ca-serverr   r   pycacert.pemr   r   z-keyfilez	-selfsignr   Zv3_car   z-gencrlzrevocation.crl)r   Zx509-inr;   r   capath/ceff1710.0r=   zcapath/b1930218.0)r)   mkdirr7   r%   pathjoinr&   r   r    r#   r$   r   r   flushr"   r'   r5   copy)r/   tr   r0   r2   r2   r3   make_ca   sJ    
(((



NrD   c                 C   s   dd l }t||  d S )Nr   )_sslpprintZ_test_decode_cert)r?   rE   r2   r2   r3   
print_cert   s    rG   __main__	localhostZreq_x509_extensions_simple)r,   zssl_cert.pemr   ssl_key.pemz5password protecting ssl_key.pem in ssl_key.passwd.pem)	r   pkeyr<   rJ   r   zssl_key.passwd.pem-aes256-passoutpass:somepass)	r   rK   r<   rJ   r   keycert.passwd.pemrL   rM   rN   zkeycert.pemrO   r9   Zfakehostnamezkeycert2.pemT)r+   zkeycert3.pemzkeycert4.pemzlocalhost-ecczparam:secp384r1.pem)r+   r-   zkeycertecc.pem)	z0otherName.1 = 1.2.3.4;UTF8:some other identifierz/otherName.2 = 1.3.6.1.5.2.2;SEQUENCE:princ_namezemail.1 = user@example.orgzDNS.2 = www.example.orgzdirName.1 = dir_sectzURI.1 = https://www.python.org/zIP.1 = 127.0.0.1z
IP.2 = ::1zRID.1 = 1.2.3.4.5Zallsans
)r+   r
   zallsans.pem)z'DNS.2 = xn--knig-5qa.idn.pythontest.netz6DNS.3 = xn--knigsgsschen-lcb0w.idna2003.pythontest.netz6DNS.4 = xn--knigsgchen-b4a3dun.idna2008.pythontest.netz,DNS.5 = xn--nxasmq6b.idna2003.pythontest.netz,DNS.6 = xn--nxasmm1c.idna2008.pythontest.netZidnsanszidnsans.pemZnosanZreq_x509_extensions_nosan)r+   r,   z	nosan.pemz>update Lib/test/test_ssl.py and Lib/test/test_asyncio/utils.py)Fr   r   r   )__doc__r)   rF   r5   r   
subprocessr   r   r#   r?   abspathdirname__file__herer4   r7   r8   rD   rG   __name__chdirr1   r-   r%   r/   r&   r   r'   r
   r@   r2   r2   r2   r3   <module>   s   g  
5,

((
**
*
*
*

*
*
*
*