o cKH@sTddlZddlZddlZddlmZmZddlmZddlm Z m Z ddl m Z ddl mZmZmZGdddejZGd d d ejZe je je je je jfZd e jd dfd dZGdddejZGdddZGdddejdZGdddejdZ GdddejdZ!GdddZ"GdddZ#de$d efdd Z%de$d e!fd!d"Z&dS)#N)utilsx509)ocsp)hashes serialization)CERTIFICATE_PRIVATE_KEY_TYPES)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extensionc@seZdZdZdZdS)OCSPResponderEncodingzBy HashzBy NameN)__name__ __module__ __qualname__ZHASHNAMErr6lib/python3.10/site-packages/cryptography/x509/ocsp.pyr sr c@s$eZdZdZdZdZdZdZdZdS)OCSPResponseStatusrN) r r r SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIREDZ UNAUTHORIZEDrrrrrsr algorithmreturncCst|ts tddS)Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512) isinstance_ALLOWED_HASHES ValueError)rrrr_verify_algorithm.s rc@seZdZdZdZdZdS)OCSPCertStatusrrrN)r r rZGOODREVOKEDZUNKNOWNrrrrr5src@sVeZdZdejdejdejdedejde j ejde j ejde j ej fd d Z d S) _SingleResponsecertissuerr cert_status this_update next_updaterevocation_timerevocation_reasonc Cst|tjr t|tjstdt|t|tjstd|dur,t|tjs,td||_||_||_||_ ||_ t|t sDtd|t j urZ|durQt d|durYt dn$t|tjsdtdt|}|tkrpt d|dur~t|tjs~td ||_||_||_dS) N%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)rr Certificate TypeErrorrdatetimeZ_certZ_issuerZ _algorithmZ _this_updateZ _next_updaterr rr r ReasonFlagsZ _cert_statusZ_revocation_timeZ_revocation_reason) selfr"r#rr$r%r&r'r(rrr__init__<s\        z_SingleResponse.__init__N) r r rrr*r HashAlgorithmrr,typingOptionalr-r/rrrrr!;s$   r!c@seZdZeejdefddZeejdefddZeejde j fddZ eejde fdd Z ejd ejdefd d Zeejdejfd dZdS) OCSPRequestrcCdSz3 The hash of the issuer public key Nrr.rrrissuer_key_hashzOCSPRequest.issuer_key_hashcCr4z- The hash of the issuer name Nrr6rrrissuer_name_hashr8zOCSPRequest.issuer_name_hashcCr4zK The hash algorithm used in the issuer name and key hashes Nrr6rrrhash_algorithmr8zOCSPRequest.hash_algorithmcCr4zM The serial number of the cert whose status is being checked Nrr6rrr serial_numberr8zOCSPRequest.serial_numberencodingcCr4)z/ Serializes the request to DER Nrr.r?rrr public_bytesr8zOCSPRequest.public_bytescCr4)zP The list of request extensions. Not single request extensions. Nrr6rrr extensionsr8zOCSPRequest.extensionsN)r r rpropertyabcabstractmethodbytesr7r:rr0r<intr>rEncodingrAr ExtensionsrBrrrrr3s$r3) metaclassc@seZdZeejdefddZeejdej e j fddZ eejdej e j fddZeejde j fdd Zeejdej e j fd d Zeejdefd d ZeejdefddZeejdejfddZeejdefddZdS)OCSPSingleResponsercCr4zY The status of the certificate (an element from the OCSPCertStatus enum) Nrr6rrrcertificate_statusr8z%OCSPSingleResponse.certificate_statuscCr4z^ The date of when the certificate was revoked or None if not revoked. Nrr6rrrr'r8z"OCSPSingleResponse.revocation_timecCr4zi The reason the certificate was revoked or None if not specified or not revoked. Nrr6rrrr(r8z$OCSPSingleResponse.revocation_reasoncCr4z The most recent time at which the status being indicated is known by the responder to have been correct Nrr6rrrr%r8zOCSPSingleResponse.this_updatecCr4zC The time when newer information will be available Nrr6rrrr&r8zOCSPSingleResponse.next_updatecCr4r5rr6rrrr7r8z"OCSPSingleResponse.issuer_key_hashcCr4r9rr6rrrr:r8z#OCSPSingleResponse.issuer_name_hashcCr4r;rr6rrrr<r8z!OCSPSingleResponse.hash_algorithmcCr4r=rr6rrrr>r8z OCSPSingleResponse.serial_numberN)r r rrCrDrErrMr1r2r,r'rr-r(r%r&rFr7r:rr0r<rGr>rrrrrKs8rKc@sfeZdZeejdejefddZ eejde fddZ eejde j fddZeejdejejfdd Zeejdefd d Zeejdefd d Zeejdeje jfddZeejdejefddZeejdeje jfddZeejdejfddZeejdefddZeejdejejfddZ eejdeje j!fddZ"eejdejfddZ#eejdejejfddZ$eejdefd d!Z%eejdefd"d#Z&eejdejfd$d%Z'eejde(fd&d'Z)eejde j*fd(d)Z+eejde j*fd*d+Z,ejd,e-j.defd-d.Z/d/S)0 OCSPResponsercCr4)z_ An iterator over the individual SINGLERESP structures in the response Nrr6rrr responsesr8zOCSPResponse.responsescCr4)zm The status of the response. This is a value from the OCSPResponseStatus enumeration Nrr6rrrresponse_statusr8zOCSPResponse.response_statuscCr4)zA The ObjectIdentifier of the signature algorithm Nrr6rrrsignature_algorithm_oidr8z$OCSPResponse.signature_algorithm_oidcCr4)zX Returns a HashAlgorithm corresponding to the type of the digest signed Nrr6rrrsignature_hash_algorithmr8z%OCSPResponse.signature_hash_algorithmcCr4)z% The signature bytes Nrr6rrr signaturer8zOCSPResponse.signaturecCr4)z+ The tbsResponseData bytes Nrr6rrrtbs_response_bytesr8zOCSPResponse.tbs_response_bytescCr4)z A list of certificates used to help build a chain to verify the OCSP response. This situation occurs when the OCSP responder uses a delegate certificate. Nrr6rrr certificatesr8zOCSPResponse.certificatescCr4)z2 The responder's key hash or None Nrr6rrrresponder_key_hash(r8zOCSPResponse.responder_key_hashcCr4)z. The responder's Name or None Nrr6rrrresponder_name/r8zOCSPResponse.responder_namecCr4)z4 The time the response was produced Nrr6rrr produced_at6r8zOCSPResponse.produced_atcCr4rLrr6rrrrM=r8zOCSPResponse.certificate_statuscCr4rNrr6rrrr'Dr8zOCSPResponse.revocation_timecCr4rOrr6rrrr(Lr8zOCSPResponse.revocation_reasoncCr4rPrr6rrrr%Tr8zOCSPResponse.this_updatecCr4rQrr6rrrr&\r8zOCSPResponse.next_updatecCr4r5rr6rrrr7cr8zOCSPResponse.issuer_key_hashcCr4r9rr6rrrr:jr8zOCSPResponse.issuer_name_hashcCr4r;rr6rrrr<qr8zOCSPResponse.hash_algorithmcCr4r=rr6rrrr>xr8zOCSPResponse.serial_numbercCr4)zR The list of response extensions. Not single response extensions. Nrr6rrrrBr8zOCSPResponse.extensionscCr4)zR The list of single response extensions. Not response extensions. Nrr6rrrsingle_extensionsr8zOCSPResponse.single_extensionsr?cCr4)z0 Serializes the response to DER Nrr@rrrrAr8zOCSPResponse.public_bytesN)0r r rrCrDrEr1IteratorrKrSrrTrZObjectIdentifierrUr2rr0rVrFrWrXListr*rYrZNamer[r,r\rrMr'r-r(r%r&r7r:r<rGr>rIrBr]rrHrArrrrrRs rRc @seZdZddgfdejejejejej fdejeje e e ej fdej ej ejddfddZdejd ejd ej ddfd d Zd e de de d ej ddf ddZdejdeddfddZdefddZdS)OCSPRequestBuilderNrequest request_hashrBrcCs||_||_||_dSN)_request _request_hash _extensions)r.rbrcrBrrrr/s  zOCSPRequestBuilder.__init__r"r#rcCsZ|jdus |jdurtdt|t|tjrt|tjs"tdt|||f|j|j S)N.Only one certificate can be added to a requestr)) rerfrrrrr*r+rarg)r.r"r#rrrradd_certificatesz"OCSPRequestBuilder.add_certificater:r7r>cCs|jdus |jdurtdt|tstdt|td|td||j t |ks5|j t |kr9tdt |j||||f|j S)Nrhz serial_number must be an integerr:r7z`issuer_name_hash and issuer_key_hash must be the same length as the digest size of the algorithm) rerfrrrGr+rr _check_bytesZ digest_sizelenrarg)r.r:r7r>rrrradd_certificate_by_hashs&    z*OCSPRequestBuilder.add_certificate_by_hashextvalcriticalcCsHt|tjs tdt|j||}t||jt|j |j |j|gSNz"extension must be an ExtensionType) rr ExtensionTyper+ Extensionoidr rgrarerfr.rmrn extensionrrr add_extensions  z OCSPRequestBuilder.add_extensioncCs&|jdur|jdurtdt|S)Nz*You must add a certificate before building)rerfrrZcreate_ocsp_requestr6rrrbuilds zOCSPRequestBuilder.build)r r rr1r2Tuplerr*rr0rFrGr_rqrpr/rirlboolrur3rvrrrrras^      rac@s0eZdZdddgfdejedejejeje fdejej ejdej ej ej fddZ dejd ejd ejd ed ejd ejejdejejdejejddfddZde dejddfddZdejejddfddZdej deddfddZded ejejdefddZed edefd!d"ZdS)#OCSPResponseBuilderNresponse responder_idcertsrBcCs||_||_||_||_dSrd) _response _responder_id_certsrg)r.rzr{r|rBrrrr/s  zOCSPResponseBuilder.__init__r"r#rr$r%r&r'r(rc Cs<|jdur tdt||||||||} t| |j|j|jS)Nz#Only one response per OCSPResponse.)r}rr!ryr~rrg) r.r"r#rr$r%r&r'r(Z singleresprrr add_responses$  z OCSPResponseBuilder.add_responser?responder_certcCsP|jdur tdt|tjstdt|tstdt|j||f|j |j S)Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) r~rrrr*r+r ryr}rrg)r.r?rrrrr{s   z OCSPResponseBuilder.responder_idcCs\|jdur tdt|}t|dkrtdtdd|Ds$tdt|j|j||j S)Nz!certificates may only be set oncerzcerts must not be an empty listcss|] }t|tjVqdSrd)rrr*).0xrrr 3sz3OCSPResponseBuilder.certificates..z$certs must be a list of Certificates) rrlistrkallr+ryr}r~rg)r.r|rrrrY+s  z OCSPResponseBuilder.certificatesrmrncCsLt|tjs tdt|j||}t||jt|j |j |j |j|gSro) rrrpr+rqrrr rgryr}r~rrsrrrru<s   z!OCSPResponseBuilder.add_extension private_keycCs6|jdur td|jdurtdttj|||S)Nz&You must add a response before signingz*You must add a responder_id before signing)r}rr~rcreate_ocsp_responserr)r.rrrrrsignLs   zOCSPResponseBuilder.signrTcCs4t|ts td|tjurtdt|dddS)Nz7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)rrr+rrrr)clsrTrrrbuild_unsuccessfulZs  z&OCSPResponseBuilder.build_unsuccessful)r r rr1r2r!rwrr*r r_rqrpr/rr0rr,r-rr{IterablerYrxrurrRr classmethodrrrrrrrys           rydatacC t|Srd)rload_der_ocsp_requestrrrrrh rcCrrd)rload_der_ocsp_responserrrrrlrr)'rDr,r1Z cryptographyrrZ"cryptography.hazmat.bindings._rustrZcryptography.hazmat.primitivesrrZ/cryptography.hazmat.primitives.asymmetric.typesrZcryptography.x509.baserr r Enumr rZSHA1ZSHA224ZSHA256ZSHA384ZSHA512rr0rrr!ABCMetar3rKrRraryrFrrrrrrs6    F+D%V~