B
    u9a"  ã            
   @   s  d Z ddlZddlZddlZddlZddlT dZej ej 	e
¡¡ZdCd	d
„ZdZdd„ Zdd„ Zdd„ Zedkre e¡ eddd\ZZeddƒZe e¡ W dQ R X eddƒZe e¡ W dQ R X edƒ edddddddd d!g	ƒ edddddd"dd d!g	ƒ ed#dƒZe e¡ e e¡ W dQ R X ed"d$ƒZe e¡ W dQ R X eƒ  ed%dd\ZZed&dƒZe e¡ e e¡ W dQ R X edd'ƒ\ZZed(dƒZe e¡ e e¡ W dQ R X ed%d'ƒ\ZZed)dƒZe e¡ e e¡ W dQ R X ed*d'd+d,\ZZed-dƒZe e¡ e e¡ W dQ R X d.d/d0d1d2d3d4d5d6g	Zed7d8 e¡d9\ZZed:dƒZe e¡ e e¡ W dQ R X d;d<d=d>d?gZed@d'd8 e¡d9\ZZedAdƒZe e¡ e e¡ W dQ R X eƒ  edBƒ ed#ƒ ed(ƒ dS )DzOMake the custom certificate and private key files used by test_ssl
and friends.é    N)Ú*a
  
    [ default ]
    base_url               = http://testca.pythontest.net/testca

    [req]
    distinguished_name     = req_distinguished_name
    prompt                 = no

    [req_distinguished_name]
    C                      = XY
    L                      = Castle Anthrax
    O                      = Python Software Foundation
    CN                     = {hostname}

    [req_x509_extensions_simple]
    subjectAltName         = @san

    [req_x509_extensions_full]
    subjectAltName         = @san
    keyUsage               = critical,keyEncipherment,digitalSignature
    extendedKeyUsage       = serverAuth,clientAuth
    basicConstraints       = critical,CA:false
    subjectKeyIdentifier   = hash
    authorityKeyIdentifier = keyid:always,issuer:always
    authorityInfoAccess    = @issuer_ocsp_info
    crlDistributionPoints  = @crl_info

    [ issuer_ocsp_info ]
    caIssuers;URI.0        = $base_url/pycacert.cer
    OCSP;URI.0             = $base_url/ocsp/

    [ crl_info ]
    URI.0                  = $base_url/revocation.crl

    [san]
    DNS.1 = {hostname}
    {extra_san}

    [dir_sect]
    C                      = XY
    L                      = Castle Anthrax
    O                      = Python Software Foundation
    CN                     = dirname example

    [princ_name]
    realm = EXP:0, GeneralString:KERBEROS.REALM
    principal_name = EXP:1, SEQUENCE:principal_seq

    [principal_seq]
    name_type = EXP:0, INTEGER:1
    name_string = EXP:1, SEQUENCE:principals

    [principals]
    princ1 = GeneralString:username

    [ ca ]
    default_ca      = CA_default

    [ CA_default ]
    dir = cadir
    database  = $dir/index.txt
    crlnumber = $dir/crl.txt
    default_md = sha256
    default_days = 3600
    default_crl_days = 3600
    certificate = pycacert.pem
    private_key = pycakey.pem
    serial    = $dir/serial
    RANDFILE  = $dir/.rand
    policy          = policy_match

    [ policy_match ]
    countryName             = match
    stateOrProvinceName     = optional
    organizationName        = match
    organizationalUnitName  = optional
    commonName              = supplied
    emailAddress            = optional

    [ policy_anything ]
    countryName   = optional
    stateOrProvinceName = optional
    localityName    = optional
    organizationName  = optional
    organizationalUnitName  = optional
    commonName    = supplied
    emailAddress    = optional


    [ v3_ca ]

    subjectKeyIdentifier=hash
    authorityKeyIdentifier=keyid:always,issuer
    basicConstraints = CA:true

    FÚ Úreq_x509_extensions_fullúrsa:3072c             C   s  t d|  ƒ g }x4tdƒD ](}tjdd}| |j¡ W d Q R X qW |\}}	}
ztj| |d}t|dƒ}| 	|¡ W d Q R X ddd	d
dd|d|
d|d|g}|rÜtjdd}| |j¡ |j}W d Q R X |d|g7 }n|dd|	g7 }t
dg| ƒ |r,dd|d|d|	dddddd|g}t
dg| ƒ t|	dƒ}| ¡ }W d Q R X t|
dƒ}| ¡ }W d Q R X ||fS x|D ]}t |¡ qvW X d S )Nzcreating cert for é   F)Údelete)ÚhostnameÚ	extra_sanÚwÚreqz-newz-daysÚ3650z-nodesz-newkeyz-keyoutz-extensionsz-configz-outz-x509ÚopensslÚcaz-outdirÚcadirz-policyZpolicy_anythingz-batchz-infilesÚr)ÚprintÚrangeÚtempfileÚNamedTemporaryFileÚappendÚnameÚreq_templateÚformatÚopenÚwriteÚ
check_callÚreadÚosÚremove)r   Úsignr	   ÚextÚkeyZ	tempnamesÚiÚfZreq_fileZ	cert_fileZkey_filer   ÚargsZreqfileÚcertr   © r&   ú$/usr/lib/python3.7/make_ssl_certs.pyÚmake_cert_keyn   sJ    



r(   r   c               C   s   t  t¡ d S )N)ÚshutilZrmtreeÚ	TMP_CADIRr&   r&   r&   r'   Ú	unmake_ca    s    r+   c              C   st  t  t¡ tt j dd¡dƒ} W d Q R X tt j dd¡dƒ} |  d¡ W d Q R X tt j dd¡dƒ} |  d¡ W d Q R X t d	¡Â}| t	j
d
dd¡ | ¡  t ¡ ’} dddddddddddd| jddg}tdg| ƒ dd|jdddd d!td"dddd#ddd$| jg}tdg| ƒ dd|jd%dd&g}tdg| ƒ W d Q R X W d Q R X tdd'd(ddd)gƒ t d)d*¡ d S )+Nr   z	index.txtza+zcrl.txtZ00zindex.txt.attrzw+zunique_subject = nor
   zour-ca-serverr   )r   r	   r   z-newz-daysr   z-extensionsZv3_caz-nodesz-newkeyzrsa:3072z-keyoutzpycakey.pemz-outz-subjzG/C=XY/L=Castle Anthrax/O=Python Software Foundation CA/CN=our-ca-serverr   r   z-configz-create_serialzpycacert.pemz-batchz-outdirz-keyfilez	-selfsignz-infilesz-gencrlzrevocation.crlZx509z-inzcapath/ceff1710.0zcapath/b1930218.0)r   Úmkdirr*   r   ÚpathÚjoinr   r   r   r   r   Úflushr   r   r)   Úcopy)r#   Útr$   r&   r&   r'   Úmake_ca£   s4    




"r2   c             C   s   dd l }t | | ¡¡ d S )Nr   )Ú_sslÚpprintZ_test_decode_cert)r-   r3   r&   r&   r'   Ú
print_certÄ   s    r5   Ú__main__Z	localhostZreq_x509_extensions_simple)r    zssl_cert.pemr
   zssl_key.pemz5password protecting ssl_key.pem in ssl_key.passwd.pemr   Zrsaz-inz-outzssl_key.passwd.pemz-des3z-passoutzpass:somepasszkeycert.passwd.pemzkeycert.pemza+Zfakehostnamezkeycert2.pemTzkeycert3.pemzkeycert4.pemzlocalhost-ecczparam:secp384r1.pem)r!   zkeycertecc.pemz0otherName.1 = 1.2.3.4;UTF8:some other identifierz/otherName.2 = 1.3.6.1.5.2.2;SEQUENCE:princ_namezemail.1 = user@example.orgzDNS.2 = www.example.orgzdirName.1 = dir_sectzURI.1 = https://www.python.org/zIP.1 = 127.0.0.1z
IP.2 = ::1zRID.1 = 1.2.3.4.5ZallsansÚ
)r	   zallsans.pemz'DNS.2 = xn--knig-5qa.idn.pythontest.netz6DNS.3 = xn--knigsgsschen-lcb0w.idna2003.pythontest.netz6DNS.4 = xn--knigsgchen-b4a3dun.idna2008.pythontest.netz,DNS.5 = xn--nxasmq6b.idna2003.pythontest.netz,DNS.6 = xn--nxasmm1c.idna2008.pythontest.netZidnsanszidnsans.pemz=update Lib/test/test_ssl.py and Lib/test/test_asyncio/util.py)Fr   r   r   )Ú__doc__r   r4   r)   r   Ú
subprocessr   r-   ÚabspathÚdirnameÚ__file__Úherer(   r*   r+   r2   r5   Ú__name__Úchdirr%   r!   r   r#   r   r   r   r	   r.   r&   r&   r&   r'   Ú<module>   s   a 
/!








